# Efficient Attribute-Based Encryption with Privacy-Preserving Key Generation and Its Application in Industrial Cloud

Authors: Yujiao Song; Hao Wang; Xiaochao Wei; Lei Wu
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Due to the rapid development of new technologies such as cloud computing, Internet of Things (IoT), and mobile Internet, the data volumes are exploding. Particularly, in the industrial field, a large amount of data is generated every day. How to manage and use industrial Big Data primely is a thorny challenge for every industrial enterprise manager. As an emerging form of service, cloud computing technology provides a good solution. It receives more and more attention and support due to its flexible configuration, on-demand purchase, and easy maintenance. Using cloud technology, enterprises get rid of the heavy data management work and concentrate on their main business. Although cloud technology has many advantages, there are still many problems in terms of security and privacy. To protect the confidentiality of the data, the mainstream solution is encrypting data before uploading. In order to achieve flexible access control to encrypted data, attribute-based encryption (ABE) is an outstanding candidate. At present, more and more applications are using ABE to ensure data security. However, the privacy protection issues during the key generation phase are not considered in the current ABE systems. That is to say, the key generation center (KGC) knows both of attributes and corresponding keys of each user. This problem is especially serious in the industrial big data scenario, because it will cause great damage to the business secrets of industrial enterprises. In this paper, we design a new ABE scheme that protects user’s privacy during key issuing. In our new scheme, we separate the functionality of attribute auditing and key generating to ensure that the KGC cannot know user’s attributes and that the attribute auditing center (AAC) cannot obtain the user’s secret key. This is ideal for many privacy-sensitive scenarios, such as industrial big data scenario.


---

## Body

## 1. Introduction

Due to the rapid development of new technologies such as cloud computing, Internet of Things (IoT), and mobile Internet, the data volumes are exploding, and we have truly entered the era of “Big Data.” Big Data technology has been focused and applied to almost every industry, retail, healthcare, financial services, government, and so on. Particularly, in the field of industrial production, a large amount of data is generated every day, and it includes business data from information systems, machine data from industrial IoT systems, and some other data from related websites, etc. For a manufacturing enterprise, Big Data can not only be used to improve the efficiency of the business, but more importantly change the manufacturing process and business model. Industrial Big Data is the core of intelligent manufacturing and industrial IoT and provides the most favorable support for the development of Industry 4.0. How to manage and use industrial Big Data efficiently is a great challenge for every enterprise manager.Cloud computing technology can provide better solutions to the above challenge. Using cloud technology, enterprises get rid of the heavy data management work and concentrate on their main business. Nowadays, large cloud service providers, such as Amazon, Microsoft, IBM, etc., have launched industrial cloud platforms, and more and more industrial enterprises migrate their data to these platforms. However, hosting data to third-party platforms will create new problems, because the security and privacy of the data have to depend on the credibility of the third-party. For businesses, the biggest concern is the confidentiality of industrial data. The main solution to this problem is to use encrypting methods to protect data before uploading it. However, traditional symmetric and asymmetric encryption schemes are not appropriate for providing fine-grained access control. Therefore, the above problems have brought new challenges to data encryption, and numerous studies have focused on these issues [1–3].Among various solutions, attribute-based encryption (ABE) [4, 5] has become an excellent candidate because of its ability to provide data confidentiality and fine-grained access control for cloud storage. Currently, more and more industrial enterprises are using ABE. In an industrial alliance, enterprises can share encrypted data based on the attributes. Only those enterprises whose attributes meet the access policy can decrypt the encrypted data. Although much research has been done on ABE [6–8], there are still some problems that have not been solved well. The current ABE systems do not consider privacy protection during the key generation phase. That is to say, the key generation center (KGC) knows the attributes and corresponding keys of each user in this system. This causes great damage to the user’s privacy and data confidentiality. Particularly, in the application scenarios of industrial big data, the attributes of enterprise users may be related to the business secrets of enterprises.


### 1.1. Our Contribution

In order to solve the privacy protection problem in key generation phase, we propose a new ABE system, in which we separate the functionality of attribute auditing and key extracting to ensure that the KGC does not know the specific attributes of the user and that the attribute auditing center (AAC) does not obtain the user’s key. In this system, when user applies its private key, it authenticates its attributes to AAC first and gets a blind token, which only certificates its attributes blindly and reveals nothing about specific attributes. The user presents the blind token to the KGC to obtain the corresponding blind key, from which user can extract the final private key. During this process, no information about the user’s attributes is leaked to the KGC, and no information about the private key is leaked to the AAC. We implicitly use the oblivious transfer (OT) protocol to solve this problem. This protects the user’s privacy during key generation phase.Our ABE is suitable for privacy sensitive scenarios. Particularly, in the encryption system of industrial cloud, the attributes often involve business secrets of industrial enterprises. KGC, as a technology department, should not know these types of secret information. Therefore, we expressly introduce an application of our new scheme in the industrial cloud.


### 1.2. Related Work

#### 1.2.1. Attribute-Based Encryption

Attribute-based encryption is a one-to-many public key encryption. Only the user, whose attributes satisfy the access policy set by the encryptor, can decrypt the ciphertext. This concept originates from identity-based encryption [9]. In 2005, Sahai and Waters [4] proposed the concept of fuzzy identity encryption, which became a precedent for attribute-based encryption. In 2006, Goyal et al. [5] first proposed the formal definition of attribute-based encryption (ABE), which classifies as key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE). They also constructed the first KP-ABE scheme. In the next year, Bethencourt et al. [10] gave the CP-ABE construction for the first time. In a CP-ABE scheme, the encryptor sets an access policy in the ciphertext to determine which kind of users can decrypt the data. This is very consistent with the security requirements of cloud storage. In recent years, more and more researches focus on CP-ABE [11–13]. However, none of the aforementioned works deals with privacy protection problem in the key generation phase.


#### 1.2.2. Oblivious Transfer

The concept of oblivious transfer (OT) is originally proposed by Rabin [14] in 1981, and then it became an important basic primitive in the field of cryptography. In an OT protocol, the sender delivers part of messages to the receiver and is still unaware of which parts (if any) are delivered. In other words, a secure OT protocol must satisfy two security features: (1) the sender cannot obtain the selection information of the receiver; (2) the receiver cannot obtain any information about other messages except for its choice.In 1985, Even et al. [15] presented a specific 1-out-of-2 OT protocol (OT21), in which the sender S has 2 values, and receiver R only gets one of them. Then, Brassard et al. [16] extended OT21 to OTn1. In 1998, Stern [17] gave a generalized construction of OT protocol based on public key encryption. In 2001, Naor and Pinkas [18] gave a 2-round OTn1 protocol based on Diffie-Hellman assumption without random oracle. In the same year, Aiello et al. [19] constructed a 2-round OTn1 protocol based on homomorphic public-key encryption. In 2002, Tzeng [20] gave an OTn1 protocol with better round complexity and better communication complexity. In 2003, Ishai et al. [21] proposed OT extension, from which a large number of OTs can be performed using only cheap symmetric-key operations. In the past decades, OT protocol has been fully studied and widely used [22–25].


### 1.3. Organization

In Section2, we introduce the preliminaries of this paper. In Section 3, we introduce the concept of attribute-based encryption with privacy preserving key generation (PPKG-ABE) and its security definition. In Section 4, we propose a specific PPKG-ABE scheme and analyze its security in Section 5. In Section 6, we introduce the application of PPKG-ABE in industrial cloud environment for protecting the security of industrial Big Data.


## 1.1. Our Contribution

In order to solve the privacy protection problem in key generation phase, we propose a new ABE system, in which we separate the functionality of attribute auditing and key extracting to ensure that the KGC does not know the specific attributes of the user and that the attribute auditing center (AAC) does not obtain the user’s key. In this system, when user applies its private key, it authenticates its attributes to AAC first and gets a blind token, which only certificates its attributes blindly and reveals nothing about specific attributes. The user presents the blind token to the KGC to obtain the corresponding blind key, from which user can extract the final private key. During this process, no information about the user’s attributes is leaked to the KGC, and no information about the private key is leaked to the AAC. We implicitly use the oblivious transfer (OT) protocol to solve this problem. This protects the user’s privacy during key generation phase.Our ABE is suitable for privacy sensitive scenarios. Particularly, in the encryption system of industrial cloud, the attributes often involve business secrets of industrial enterprises. KGC, as a technology department, should not know these types of secret information. Therefore, we expressly introduce an application of our new scheme in the industrial cloud.


## 1.2. Related Work

### 1.2.1. Attribute-Based Encryption

Attribute-based encryption is a one-to-many public key encryption. Only the user, whose attributes satisfy the access policy set by the encryptor, can decrypt the ciphertext. This concept originates from identity-based encryption [9]. In 2005, Sahai and Waters [4] proposed the concept of fuzzy identity encryption, which became a precedent for attribute-based encryption. In 2006, Goyal et al. [5] first proposed the formal definition of attribute-based encryption (ABE), which classifies as key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE). They also constructed the first KP-ABE scheme. In the next year, Bethencourt et al. [10] gave the CP-ABE construction for the first time. In a CP-ABE scheme, the encryptor sets an access policy in the ciphertext to determine which kind of users can decrypt the data. This is very consistent with the security requirements of cloud storage. In recent years, more and more researches focus on CP-ABE [11–13]. However, none of the aforementioned works deals with privacy protection problem in the key generation phase.


### 1.2.2. Oblivious Transfer

The concept of oblivious transfer (OT) is originally proposed by Rabin [14] in 1981, and then it became an important basic primitive in the field of cryptography. In an OT protocol, the sender delivers part of messages to the receiver and is still unaware of which parts (if any) are delivered. In other words, a secure OT protocol must satisfy two security features: (1) the sender cannot obtain the selection information of the receiver; (2) the receiver cannot obtain any information about other messages except for its choice.In 1985, Even et al. [15] presented a specific 1-out-of-2 OT protocol (OT21), in which the sender S has 2 values, and receiver R only gets one of them. Then, Brassard et al. [16] extended OT21 to OTn1. In 1998, Stern [17] gave a generalized construction of OT protocol based on public key encryption. In 2001, Naor and Pinkas [18] gave a 2-round OTn1 protocol based on Diffie-Hellman assumption without random oracle. In the same year, Aiello et al. [19] constructed a 2-round OTn1 protocol based on homomorphic public-key encryption. In 2002, Tzeng [20] gave an OTn1 protocol with better round complexity and better communication complexity. In 2003, Ishai et al. [21] proposed OT extension, from which a large number of OTs can be performed using only cheap symmetric-key operations. In the past decades, OT protocol has been fully studied and widely used [22–25].


## 1.2.1. Attribute-Based Encryption

Attribute-based encryption is a one-to-many public key encryption. Only the user, whose attributes satisfy the access policy set by the encryptor, can decrypt the ciphertext. This concept originates from identity-based encryption [9]. In 2005, Sahai and Waters [4] proposed the concept of fuzzy identity encryption, which became a precedent for attribute-based encryption. In 2006, Goyal et al. [5] first proposed the formal definition of attribute-based encryption (ABE), which classifies as key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE). They also constructed the first KP-ABE scheme. In the next year, Bethencourt et al. [10] gave the CP-ABE construction for the first time. In a CP-ABE scheme, the encryptor sets an access policy in the ciphertext to determine which kind of users can decrypt the data. This is very consistent with the security requirements of cloud storage. In recent years, more and more researches focus on CP-ABE [11–13]. However, none of the aforementioned works deals with privacy protection problem in the key generation phase.


## 1.2.2. Oblivious Transfer

The concept of oblivious transfer (OT) is originally proposed by Rabin [14] in 1981, and then it became an important basic primitive in the field of cryptography. In an OT protocol, the sender delivers part of messages to the receiver and is still unaware of which parts (if any) are delivered. In other words, a secure OT protocol must satisfy two security features: (1) the sender cannot obtain the selection information of the receiver; (2) the receiver cannot obtain any information about other messages except for its choice.In 1985, Even et al. [15] presented a specific 1-out-of-2 OT protocol (OT21), in which the sender S has 2 values, and receiver R only gets one of them. Then, Brassard et al. [16] extended OT21 to OTn1. In 1998, Stern [17] gave a generalized construction of OT protocol based on public key encryption. In 2001, Naor and Pinkas [18] gave a 2-round OTn1 protocol based on Diffie-Hellman assumption without random oracle. In the same year, Aiello et al. [19] constructed a 2-round OTn1 protocol based on homomorphic public-key encryption. In 2002, Tzeng [20] gave an OTn1 protocol with better round complexity and better communication complexity. In 2003, Ishai et al. [21] proposed OT extension, from which a large number of OTs can be performed using only cheap symmetric-key operations. In the past decades, OT protocol has been fully studied and widely used [22–25].


## 1.3. Organization

In Section2, we introduce the preliminaries of this paper. In Section 3, we introduce the concept of attribute-based encryption with privacy preserving key generation (PPKG-ABE) and its security definition. In Section 4, we propose a specific PPKG-ABE scheme and analyze its security in Section 5. In Section 6, we introduce the application of PPKG-ABE in industrial cloud environment for protecting the security of industrial Big Data.


## 2. Preliminaries

### 2.1. CP-ABE

In CP-ABE system, there are three types of entities, i.e., key generation center (KGC), encryptor, and decryptor. The KGC issues secret key according to users’ attributes. The encryptor encrypts the messages according to a designated access policy. The decryptor can decrypt the ciphertext successfully only if its attributes satisfy the corresponding access policy.There are four algorithms in a CP-ABE scheme:( 1 ) Setup: it takes security parameters as input and outputs public parameters PP and master secret key MSK.( 2 ) KeyGen: it takes public parameters PP, master secret key MSK, and a set of attributes S as input and outputs secret key SKS corresponding to S.( 3 ) Encryption: it takes public parameters PP, access policy W, and message M as input and outputs the ciphertext CTW.( 4 ) Decryption: it takes public parameters PP, ciphertext CTW, and secret key SKS as input and outputs the message M, if and only if the attributes S satisfy the access policy W; i.e., S⊨W.


### 2.2. Oblivious Transfer

The oblivious transfer (OT) protocol is a two-party computation protocol in which one party is the sender (S) and the other is the recipient (R). The protocol ensures the following: S sends a group of messages to R. R can get a subset of these messages, but S does not know which messages that R received.In this paper, we draw on a classic(OT21) protocol [26]:PartyS has two elements δ0, δ1 of group G and party R has a bit b∈0,1. The descriptions of group G are known to both parties, where |G|=q and g is a generator.( 1 )  R randomly chooses α,β,γ∈[1,q] and sets τ as follows:(a) Ifσ=0, then τ=(gα,gβ,gαβ,gγ).(b) Ifσ=1, then τ=(gα,gβ,gγ,gαβ).R sends τ to S.( 2 )  S receives τ=(x,y,z0,z1). Then, S checks z0≠z1. If not, it outputs ⊥, and aborts.In addition,S chooses u0,u1,v0,v1∈[1,q] randomly and computes the following 4 values: (1)ω0=xu0·gv0,k0=z0u0·yv0ω1=xu1·gv1,k1=z1u1·yv1Then,S calculates c0=x0·k0,c1=x1·k1 and sends (ω0,c0) and (ω1,c1) to R.Finally,R calculates kσ=(ω0)β and obtains δσ=cσ·(kσ)-1.


### 2.3. Bilinear Maps

LetG1, G2, and GT be three q order cyclic groups. The bilinear pairing operation e is a bilinear map, e:G1×G2→GT, and satisfies the following properties:( 1 )  ∀g∈G1, ∀h∈G2, ∀x,y∈Zq∗, there is e(gx,hy)=e(g,h)xy( 2 )  ∃g0∈G1, ∃h0∈G2, e(g0,h0)≠1( 3 )  ∀g∈G1, ∀h∈G2, e(g,h) can be computed in polynomial timeIn this paper, we use asymmetric bilinear groups; that is,G1≠G2.


### 2.4. Security Assumption

Definition 1.
LetG1, G2, and GT form bilinear groups, let g be a generator of G1, and let h be a generator of G2. For some unknown α∈Zp∗, define gi=gαi, and set y→g,α,n=(g1,…,gn,gn+2,…,g2n). We say an algorithm B solves n-BDHE problem with advantage ϵ, if on input g,h,y→g,α,n, (2)PrBegn+1,h=1-PrBZ=1≥ϵ,where Z is a random element of GT∗.
The decisionn-BDHE assumption holds if ϵ is negligible for any polynomial algorithm.


## 2.1. CP-ABE

In CP-ABE system, there are three types of entities, i.e., key generation center (KGC), encryptor, and decryptor. The KGC issues secret key according to users’ attributes. The encryptor encrypts the messages according to a designated access policy. The decryptor can decrypt the ciphertext successfully only if its attributes satisfy the corresponding access policy.There are four algorithms in a CP-ABE scheme:( 1 ) Setup: it takes security parameters as input and outputs public parameters PP and master secret key MSK.( 2 ) KeyGen: it takes public parameters PP, master secret key MSK, and a set of attributes S as input and outputs secret key SKS corresponding to S.( 3 ) Encryption: it takes public parameters PP, access policy W, and message M as input and outputs the ciphertext CTW.( 4 ) Decryption: it takes public parameters PP, ciphertext CTW, and secret key SKS as input and outputs the message M, if and only if the attributes S satisfy the access policy W; i.e., S⊨W.


## 2.2. Oblivious Transfer

The oblivious transfer (OT) protocol is a two-party computation protocol in which one party is the sender (S) and the other is the recipient (R). The protocol ensures the following: S sends a group of messages to R. R can get a subset of these messages, but S does not know which messages that R received.In this paper, we draw on a classic(OT21) protocol [26]:PartyS has two elements δ0, δ1 of group G and party R has a bit b∈0,1. The descriptions of group G are known to both parties, where |G|=q and g is a generator.( 1 )  R randomly chooses α,β,γ∈[1,q] and sets τ as follows:(a) Ifσ=0, then τ=(gα,gβ,gαβ,gγ).(b) Ifσ=1, then τ=(gα,gβ,gγ,gαβ).R sends τ to S.( 2 )  S receives τ=(x,y,z0,z1). Then, S checks z0≠z1. If not, it outputs ⊥, and aborts.In addition,S chooses u0,u1,v0,v1∈[1,q] randomly and computes the following 4 values: (1)ω0=xu0·gv0,k0=z0u0·yv0ω1=xu1·gv1,k1=z1u1·yv1Then,S calculates c0=x0·k0,c1=x1·k1 and sends (ω0,c0) and (ω1,c1) to R.Finally,R calculates kσ=(ω0)β and obtains δσ=cσ·(kσ)-1.


## 2.3. Bilinear Maps

LetG1, G2, and GT be three q order cyclic groups. The bilinear pairing operation e is a bilinear map, e:G1×G2→GT, and satisfies the following properties:( 1 )  ∀g∈G1, ∀h∈G2, ∀x,y∈Zq∗, there is e(gx,hy)=e(g,h)xy( 2 )  ∃g0∈G1, ∃h0∈G2, e(g0,h0)≠1( 3 )  ∀g∈G1, ∀h∈G2, e(g,h) can be computed in polynomial timeIn this paper, we use asymmetric bilinear groups; that is,G1≠G2.


## 2.4. Security Assumption

Definition 1.
LetG1, G2, and GT form bilinear groups, let g be a generator of G1, and let h be a generator of G2. For some unknown α∈Zp∗, define gi=gαi, and set y→g,α,n=(g1,…,gn,gn+2,…,g2n). We say an algorithm B solves n-BDHE problem with advantage ϵ, if on input g,h,y→g,α,n, (2)PrBegn+1,h=1-PrBZ=1≥ϵ,where Z is a random element of GT∗.
The decisionn-BDHE assumption holds if ϵ is negligible for any polynomial algorithm.


## 3. Attribute-Based Encryption with Privacy Preserving Key Generation

In the key generation phase of traditional ABE, KGC always knows the attribute information of each user. This has greatly damaged the privacy of users. In order to solve this problem, we separate the two functions of attribute auditing and key extracting. We introduce an attribute audit center (AAC) in ABE system to authenticate the attributes of users and to make blind token for them. KGC, as a simple technical support institution, is only responsible for generating keys, but it does not know the corresponding attributes of these keys.


### 3.1. System Model

In the key generation phase (as shown in Figure1), there are three types of entities: attribute audit center (AAC), key generation center (KGC), and data user. In this system, user submits its attributes and relevant evidence to AAC. The AAC audits the user’s attributes and returns a blind token with the signature of AAC to user. In practical applications, AAC is often carried out by the institutions that provide certification for user’s attributes, such as government offices, because they know the attributes of users themselves and do not cause extra leaks. In other words, the blind token is the evidence for users owning some attributes. This token does not reveal any information of user’s attributes and only ensures the authenticity. When user needs to obtain its attributes key, it will submit the blind token to KGC, which is a technical institution. The KGC first checks the legitimacy of the token; if the token is invalid, it aborts; otherwise, it runs the key generation algorithm on the token and returns a blind key. After user obtains the blind key, it extracts the secret key locally.Figure 1
System model.The specific process is as follows:( 1 ) The user shows its attributes and relevant evidence to the attribute audit center (AAC).( 2 ) The AAC audits the user’s attributes and returns a blind token to the user with its signature.( 3 ) When a user needs to obtain its attributes key, it will submit its blind token to the key generation center (KGC). The KGC cannot get any information about the user’s attributes. It only can confirm that the user truly has related attributes.( 4 ) The key generation center (KGC) first checks the legitimacy of the token, and if the signature is illegal, it aborts; otherwise, it runs the key generation algorithm and outputs a blind key.( 5 ) The user receives the blind key from KGC and extracts the private key.


### 3.2. Syntax

In detail, an attribute-based encryption with privacy preserving key generation scheme (PPKG-ABE) includes seven fundamental algorithms:Setup,UserTemKeyGen,BlindTokenGen,BlindKenGen,KeyExtra,Encrypt, andDecrypt. The specific algorithms are described as follows:Setup(κ)→PP,MK: the setup algorithm is run by KGC, it inputs security parameter κ, and it outputs public parameters PP and master secret key MSK.UserTemKeyGen(PP, κ)→TPKUser, TSKUser: the user’s temporary-key generation algorithm is run by user. It takes PP and security parameters κ as input and outputs user’s temporary public key TPKUser and user’s temporary secret key TSKUser.BlindTokenGen(PP, S, TPKUser)→TS: the blind token generation algorithm is run by AAC. It takes PP, user’s attributes set S, and user’s temporary public key TPKUser as input and outputs a blind token T for attributes set S.BlindKenGen(PP, MSK, TS)→BSK: the blind key generation algorithm is run by KGC. It takes PP, master secret key MSK, and user’s blind token TS as input and outputs blind secret key BSK for attributes set S.KeyExtra(BSKS, TSKUser)→SKS: the key extract algorithm is run by user locally. It takes blind secret key BSKS and user’s temporary secret key TSKUser as input and outputs the final secret key SK for attributes set S.Encrypt(PP, M, W)→CT: the encryption algorithm is run by encryptor. It takes PP, message M, and access structure W as input and outputs ciphertext CT.Decrypt(CTW, SKS)→M: the decryption algorithm is run by decryptor. It takes ciphertext CTW and secret key SKS as input and outputs message M, if S⊨W.We note, in PPKG-ABE scheme, that AAC is responsible for auditing user’s attributes and issuing blind tokenTS to user. The blind token includes a description of the authenticity of user’s attributes, along with the signature of AAC, and reveals on information about specific attributes.


### 3.3. Security Model

We define the security in two aspects: confidentiality and privacy. Specifically, in this security model, we do not allow AAC and KGC to collude.


#### 3.3.1. Confidentiality

We introduce the selective security model of choosing plaintext attacks for the PPKG-ABE scheme. The specific process is working between adversaryA and challenger C:Init.  A specifies an access structure W∗ for challenge.Setup.  C calls the Setup algorithm and returns PP to A.Phase 2.
A queries secret key on any attributes set S⊭W∗. C returns the secret key SK for S.Challenge. A submits two messages M0∗ and M1∗, where |M0∗|=|M1∗|. C chooses b∈0,1 randomly and encrypts Mb∗ under W∗. Then, it returns CT∗ to A.Phase 3.
Repeats as Phase2.Guess. A guesses b′ for b. The advantage Adv for A is defined as Pr[b′=b] - 1/2.Definition 4.
The PPKG-ABE scheme is selectively IND-CPA secure ifAdv is negligible for any polynomial time adversaries.


#### 3.3.2. Privacy

We introduce a new security game for defining privacy. In this game, we define the following two oracles.Blind Token Oracle O B T ( S ): it takes attributes set S as input and outputs corresponding blind token TS.Blind Key Oracle O B K ( T S ): it takes blind token TS as input and outputs corresponding blind key BSKS.The specific process is working between adversaryA and challenger C:Setup. C calls the Setup algorithm and returns PP to A.Phase 5.
A queries blind token oracle OBT and blind key oracle freely.Challenge. A submits two attributes sets S0∗ and S1∗, where |S0∗|=|S1∗|. C chooses b∈{0,1} randomly and queries blind token oracle OBT on input Sb∗. It returns blind token TSb∗ to A.Phase 6.
Repeats as Phase5.Guess. A guesses b′ for b. The advantage Adv for A is defined as Pr[b′=b] - 1/2.Definition 7.
The PPKG-ABE scheme is privacy-protected in key generation phase, ifAdv is negligible for any polynomial time adversaries.


## 3.1. System Model

In the key generation phase (as shown in Figure1), there are three types of entities: attribute audit center (AAC), key generation center (KGC), and data user. In this system, user submits its attributes and relevant evidence to AAC. The AAC audits the user’s attributes and returns a blind token with the signature of AAC to user. In practical applications, AAC is often carried out by the institutions that provide certification for user’s attributes, such as government offices, because they know the attributes of users themselves and do not cause extra leaks. In other words, the blind token is the evidence for users owning some attributes. This token does not reveal any information of user’s attributes and only ensures the authenticity. When user needs to obtain its attributes key, it will submit the blind token to KGC, which is a technical institution. The KGC first checks the legitimacy of the token; if the token is invalid, it aborts; otherwise, it runs the key generation algorithm on the token and returns a blind key. After user obtains the blind key, it extracts the secret key locally.Figure 1
System model.The specific process is as follows:( 1 ) The user shows its attributes and relevant evidence to the attribute audit center (AAC).( 2 ) The AAC audits the user’s attributes and returns a blind token to the user with its signature.( 3 ) When a user needs to obtain its attributes key, it will submit its blind token to the key generation center (KGC). The KGC cannot get any information about the user’s attributes. It only can confirm that the user truly has related attributes.( 4 ) The key generation center (KGC) first checks the legitimacy of the token, and if the signature is illegal, it aborts; otherwise, it runs the key generation algorithm and outputs a blind key.( 5 ) The user receives the blind key from KGC and extracts the private key.


## 3.2. Syntax

In detail, an attribute-based encryption with privacy preserving key generation scheme (PPKG-ABE) includes seven fundamental algorithms:Setup,UserTemKeyGen,BlindTokenGen,BlindKenGen,KeyExtra,Encrypt, andDecrypt. The specific algorithms are described as follows:Setup(κ)→PP,MK: the setup algorithm is run by KGC, it inputs security parameter κ, and it outputs public parameters PP and master secret key MSK.UserTemKeyGen(PP, κ)→TPKUser, TSKUser: the user’s temporary-key generation algorithm is run by user. It takes PP and security parameters κ as input and outputs user’s temporary public key TPKUser and user’s temporary secret key TSKUser.BlindTokenGen(PP, S, TPKUser)→TS: the blind token generation algorithm is run by AAC. It takes PP, user’s attributes set S, and user’s temporary public key TPKUser as input and outputs a blind token T for attributes set S.BlindKenGen(PP, MSK, TS)→BSK: the blind key generation algorithm is run by KGC. It takes PP, master secret key MSK, and user’s blind token TS as input and outputs blind secret key BSK for attributes set S.KeyExtra(BSKS, TSKUser)→SKS: the key extract algorithm is run by user locally. It takes blind secret key BSKS and user’s temporary secret key TSKUser as input and outputs the final secret key SK for attributes set S.Encrypt(PP, M, W)→CT: the encryption algorithm is run by encryptor. It takes PP, message M, and access structure W as input and outputs ciphertext CT.Decrypt(CTW, SKS)→M: the decryption algorithm is run by decryptor. It takes ciphertext CTW and secret key SKS as input and outputs message M, if S⊨W.We note, in PPKG-ABE scheme, that AAC is responsible for auditing user’s attributes and issuing blind tokenTS to user. The blind token includes a description of the authenticity of user’s attributes, along with the signature of AAC, and reveals on information about specific attributes.


## 3.3. Security Model

We define the security in two aspects: confidentiality and privacy. Specifically, in this security model, we do not allow AAC and KGC to collude.


### 3.3.1. Confidentiality

We introduce the selective security model of choosing plaintext attacks for the PPKG-ABE scheme. The specific process is working between adversaryA and challenger C:Init.  A specifies an access structure W∗ for challenge.Setup.  C calls the Setup algorithm and returns PP to A.Phase 2.
A queries secret key on any attributes set S⊭W∗. C returns the secret key SK for S.Challenge. A submits two messages M0∗ and M1∗, where |M0∗|=|M1∗|. C chooses b∈0,1 randomly and encrypts Mb∗ under W∗. Then, it returns CT∗ to A.Phase 3.
Repeats as Phase2.Guess. A guesses b′ for b. The advantage Adv for A is defined as Pr[b′=b] - 1/2.Definition 4.
The PPKG-ABE scheme is selectively IND-CPA secure ifAdv is negligible for any polynomial time adversaries.


### 3.3.2. Privacy

We introduce a new security game for defining privacy. In this game, we define the following two oracles.Blind Token Oracle O B T ( S ): it takes attributes set S as input and outputs corresponding blind token TS.Blind Key Oracle O B K ( T S ): it takes blind token TS as input and outputs corresponding blind key BSKS.The specific process is working between adversaryA and challenger C:Setup. C calls the Setup algorithm and returns PP to A.Phase 5.
A queries blind token oracle OBT and blind key oracle freely.Challenge. A submits two attributes sets S0∗ and S1∗, where |S0∗|=|S1∗|. C chooses b∈{0,1} randomly and queries blind token oracle OBT on input Sb∗. It returns blind token TSb∗ to A.Phase 6.
Repeats as Phase5.Guess. A guesses b′ for b. The advantage Adv for A is defined as Pr[b′=b] - 1/2.Definition 7.
The PPKG-ABE scheme is privacy-protected in key generation phase, ifAdv is negligible for any polynomial time adversaries.


## 3.3.1. Confidentiality

We introduce the selective security model of choosing plaintext attacks for the PPKG-ABE scheme. The specific process is working between adversaryA and challenger C:Init.  A specifies an access structure W∗ for challenge.Setup.  C calls the Setup algorithm and returns PP to A.Phase 2.
A queries secret key on any attributes set S⊭W∗. C returns the secret key SK for S.Challenge. A submits two messages M0∗ and M1∗, where |M0∗|=|M1∗|. C chooses b∈0,1 randomly and encrypts Mb∗ under W∗. Then, it returns CT∗ to A.Phase 3.
Repeats as Phase2.Guess. A guesses b′ for b. The advantage Adv for A is defined as Pr[b′=b] - 1/2.Definition 4.
The PPKG-ABE scheme is selectively IND-CPA secure ifAdv is negligible for any polynomial time adversaries.


## 3.3.2. Privacy

We introduce a new security game for defining privacy. In this game, we define the following two oracles.Blind Token Oracle O B T ( S ): it takes attributes set S as input and outputs corresponding blind token TS.Blind Key Oracle O B K ( T S ): it takes blind token TS as input and outputs corresponding blind key BSKS.The specific process is working between adversaryA and challenger C:Setup. C calls the Setup algorithm and returns PP to A.Phase 5.
A queries blind token oracle OBT and blind key oracle freely.Challenge. A submits two attributes sets S0∗ and S1∗, where |S0∗|=|S1∗|. C chooses b∈{0,1} randomly and queries blind token oracle OBT on input Sb∗. It returns blind token TSb∗ to A.Phase 6.
Repeats as Phase5.Guess. A guesses b′ for b. The advantage Adv for A is defined as Pr[b′=b] - 1/2.Definition 7.
The PPKG-ABE scheme is privacy-protected in key generation phase, ifAdv is negligible for any polynomial time adversaries.


## 4. A Specific PPKG-ABE Scheme

### 4.1. Construction

In this construction, the PPKG-ABE scheme is constructed on the basis of [27], which only supports AND gates. Suppose that the attribute universe is U=att1,att2,…,attn, where each atti has 2 values: “+” and “−”. The “+” denotes that user owns this attribute, while the “−” denotes that user does not own this attribute. The specific scheme is as follows:Setup(κ, U): the setup algorithm is run by KGC. It takes security parameters κ and attribute universe U as input, where |U|=n. The algorithm first chooses q order bilinear groups G1, G2, and GT, where g is a generator of G1 and h is a generator of G2. Let H be a cryptographic hash function; H:G1→G2. For i∈[1,n], it chooses ri,rn+i∈Zp∗, si,sn+i∈G2 randomly and sets ui=g-ri and hi=e(g,si). It outputs (3)PP≔g,h,uk,hkk∈1,2n,H,MSK≔rk,skk∈1,2n.In general speaking, 〈ui,hi〉|i∈[1,n] correspond to the positive attributes and 〈un+i,hn+i〉|i∈[1,n] correspond to the negative attributes.UserTemKeyGen(PP, κ): the user’s temporary-key generation algorithm is run by user. It takes public parameters PP and security parameters κ as input and chooses βi←Zq randomly for i∈[1,n], as its temporary secret key TSKUser. Then, it calculates the temporary public key TPKUser={hβi}i∈[1,n].BlindTokenGen(PP, S, TPKUser): the blind token generation algorithm is run by AAC. It takes public parameters PP, user’s attributes set S, and user’s temporary public key TPKUser as input. S expresses an attributes set, which includes n signs, e.g., S=(+,-,+…,+), where “+” indicates that the user owns this attribute and “−” indicates that the user does not own this attribute. It selects αi,γi←Zp randomly and calculates hαi, (hβi)αi, and hγi, for i∈[1,n].If the attributeatti=“+”∈S, then it sets xi=hαi, yi=hβi, zi,0=hαiβi, zi,1=hγi. Otherwise, the attribute atti= “−” ∈ S, and it sets xi=hαi, yi=hβi, zi,0=hγi, zi,1=hαiβi. (4)tS=ti=xi∥yi∥zi,0∥zi,1i∈1,n.Then, it runs standard signature algorithm ontS to get a signature Σ and returns TS=(tS,Σ) to user.BlindKenGen(PP, MSK, TS): the user submits the token TS corresponding to attributes set S to the KGC for applying secret key. KGC first checks that all xi,yi,zi,0,zi,1∈G1,  zi,0≠zi,1 and that Σ is legal. If not, it aborts outputting ⊥; otherwise it randomly chooses ui,0,ui,1,vi,0,vi,1←Zq for i∈[1,n] and calculates the following values: (5)wi,0=xiui,0·hvi,0,ki,0=zi,0ui,0·yivi,0wi,1=xiui,1·hvi,1,ki,1=zi,1ui,1·yivi,1Then, it randomly choosesv∈G2 for each user and calculates σi,0=sivri,σi,1=sn+ivrn+i, for i∈[1,n]. It calculates ci,0=σi,0·ki,0, ci,1=σi,1·ki,1, for i∈[1,n].The blind secret key(6)BSK=v,wi,0,ci,0,wi,1,ci,1i∈1,n.It returns BSK to user.KeyExtra(TSKUser, BSK): the key extract algorithm is run by user.Fori∈[1,n], if atti=“+”, it sets wi=wi,0, ci=ci,0; else if atti=“-”, it sets wi=wi,1, ci=ci,1 and calculates (7)ki=wiβi,σi=ciki.It outputs(8)SK≔v,σii∈1,n.We note, in the above key issuing procedure, that KGC cannot obtain the specific attributes of user, and AAC cannot obtain the secret key.Encrypt(PK, M, W): it takes public key PK, AND gate structure W, and message M as input, where W=⋀atti∈Aatti_, for A is the related attributes set, and atti_∈“+”,“-”. It chooses s∈Zp∗ randomly and sets 〈uA,hA〉=〈∏atti∈Aui_,∏atti∈Ahi_〉, where for each atti∈A,ifatti=“+”, ui_,hi_=〈ui,hi〉ifatti=“-”, ui_,hi_=〈un+i,hn+i〉Then, it computesct0=M·hAs,ct1=gs,ct2=uAs.The ciphertext is defined asCT=(W,ct0,ct1,ct2).Decrypt(PP, SKS, CT): if S⊨W, the decryption algorithm computes sk=〈v,σ=∏atti∈Aσi〉, for related attributes set A. Then, it computes the message (9)M=ct0ect1,σ·ect2,v.


### 4.2. Correctness

The correctness is guaranteed by(10)ect1,σ·ect2,v=egs,∏atti∈Aσie∏atti∈Aui_s,v=∏atti∈Aeg,σi·eui_,vs=∏atti∈Aeg,si_vri_·eg-ri_,vs=∏atti∈Aeg,si_·eg,vri_·eg-ri_,vs=∏atti∈Aeg,si_s=∏atti∈Ahi_s=hAs.


## 4.1. Construction

In this construction, the PPKG-ABE scheme is constructed on the basis of [27], which only supports AND gates. Suppose that the attribute universe is U=att1,att2,…,attn, where each atti has 2 values: “+” and “−”. The “+” denotes that user owns this attribute, while the “−” denotes that user does not own this attribute. The specific scheme is as follows:Setup(κ, U): the setup algorithm is run by KGC. It takes security parameters κ and attribute universe U as input, where |U|=n. The algorithm first chooses q order bilinear groups G1, G2, and GT, where g is a generator of G1 and h is a generator of G2. Let H be a cryptographic hash function; H:G1→G2. For i∈[1,n], it chooses ri,rn+i∈Zp∗, si,sn+i∈G2 randomly and sets ui=g-ri and hi=e(g,si). It outputs (3)PP≔g,h,uk,hkk∈1,2n,H,MSK≔rk,skk∈1,2n.In general speaking, 〈ui,hi〉|i∈[1,n] correspond to the positive attributes and 〈un+i,hn+i〉|i∈[1,n] correspond to the negative attributes.UserTemKeyGen(PP, κ): the user’s temporary-key generation algorithm is run by user. It takes public parameters PP and security parameters κ as input and chooses βi←Zq randomly for i∈[1,n], as its temporary secret key TSKUser. Then, it calculates the temporary public key TPKUser={hβi}i∈[1,n].BlindTokenGen(PP, S, TPKUser): the blind token generation algorithm is run by AAC. It takes public parameters PP, user’s attributes set S, and user’s temporary public key TPKUser as input. S expresses an attributes set, which includes n signs, e.g., S=(+,-,+…,+), where “+” indicates that the user owns this attribute and “−” indicates that the user does not own this attribute. It selects αi,γi←Zp randomly and calculates hαi, (hβi)αi, and hγi, for i∈[1,n].If the attributeatti=“+”∈S, then it sets xi=hαi, yi=hβi, zi,0=hαiβi, zi,1=hγi. Otherwise, the attribute atti= “−” ∈ S, and it sets xi=hαi, yi=hβi, zi,0=hγi, zi,1=hαiβi. (4)tS=ti=xi∥yi∥zi,0∥zi,1i∈1,n.Then, it runs standard signature algorithm ontS to get a signature Σ and returns TS=(tS,Σ) to user.BlindKenGen(PP, MSK, TS): the user submits the token TS corresponding to attributes set S to the KGC for applying secret key. KGC first checks that all xi,yi,zi,0,zi,1∈G1,  zi,0≠zi,1 and that Σ is legal. If not, it aborts outputting ⊥; otherwise it randomly chooses ui,0,ui,1,vi,0,vi,1←Zq for i∈[1,n] and calculates the following values: (5)wi,0=xiui,0·hvi,0,ki,0=zi,0ui,0·yivi,0wi,1=xiui,1·hvi,1,ki,1=zi,1ui,1·yivi,1Then, it randomly choosesv∈G2 for each user and calculates σi,0=sivri,σi,1=sn+ivrn+i, for i∈[1,n]. It calculates ci,0=σi,0·ki,0, ci,1=σi,1·ki,1, for i∈[1,n].The blind secret key(6)BSK=v,wi,0,ci,0,wi,1,ci,1i∈1,n.It returns BSK to user.KeyExtra(TSKUser, BSK): the key extract algorithm is run by user.Fori∈[1,n], if atti=“+”, it sets wi=wi,0, ci=ci,0; else if atti=“-”, it sets wi=wi,1, ci=ci,1 and calculates (7)ki=wiβi,σi=ciki.It outputs(8)SK≔v,σii∈1,n.We note, in the above key issuing procedure, that KGC cannot obtain the specific attributes of user, and AAC cannot obtain the secret key.Encrypt(PK, M, W): it takes public key PK, AND gate structure W, and message M as input, where W=⋀atti∈Aatti_, for A is the related attributes set, and atti_∈“+”,“-”. It chooses s∈Zp∗ randomly and sets 〈uA,hA〉=〈∏atti∈Aui_,∏atti∈Ahi_〉, where for each atti∈A,ifatti=“+”, ui_,hi_=〈ui,hi〉ifatti=“-”, ui_,hi_=〈un+i,hn+i〉Then, it computesct0=M·hAs,ct1=gs,ct2=uAs.The ciphertext is defined asCT=(W,ct0,ct1,ct2).Decrypt(PP, SKS, CT): if S⊨W, the decryption algorithm computes sk=〈v,σ=∏atti∈Aσi〉, for related attributes set A. Then, it computes the message (9)M=ct0ect1,σ·ect2,v.


## 4.2. Correctness

The correctness is guaranteed by(10)ect1,σ·ect2,v=egs,∏atti∈Aσie∏atti∈Aui_s,v=∏atti∈Aeg,σi·eui_,vs=∏atti∈Aeg,si_vri_·eg-ri_,vs=∏atti∈Aeg,si_·eg,vri_·eg-ri_,vs=∏atti∈Aeg,si_s=∏atti∈Ahi_s=hAs.


## 5. Proof of Security

### 5.1. Confidentiality

Theorem 8.
If the decisionaln-BDHE assumption holds for bilinear groups G1, G2, and GT, our PPGK-ABE scheme is selectively IND-CPA secure.Proof.
If the adversaryA can win above security game with nonnegligible advantage, we can construct an algorithm B to break the decision n-BDHE assumption. B plays the security game with A as follows:
Init. B receives challenge gate W∗=⋀attij∈A∗attij_ from A. We suppose |A∗|=m<n, and I∗={ij|attij∈A∗}.
Setup. B chooses j∗∈[1,m], rk′∈Zp∗, xk∈G2, rij,aij∈Zp∗ randomly, for k∈[1,2n], j∈[1,m].
Forij∈I∗-{j∗}, B computes public parameters as follows:
( 1 ) If attij_=+, (11)uij,hij=grijgn+1-ij-1,eg,haij,uij+n,hij+n=g-rij+n′,eg,xij+n.
( 2 ) If attij_=-, (12)uij,hij=g-rij′,eg,xij,uij+n,hij+n=grijgn+1-ij-1,eg,haij.
Forattij=attij∗, B computes as follows:
( 1 ) If attij∗_=+, (13)uij∗,hij∗=grij∗·∏k∈I∗-ij∗gn+1-k,eg,haij∗eg,hαn+1uij∗+n,hij∗+n=g-rij∗+n′,eg,xij∗+n.
( 2 ) If attj∗_=-, (14)uij∗,hij∗=g-rij∗′,eg,xij∗,uij∗+n,hij∗+n=grij∗·∏k∈I∗-ij∗gn+1-k,eg,haij∗eg,hαn+1,
Forij∉I∗, B computes (15)uij,hij=g-rij′,eg,xij,uij+n,hij+n=g-rij+n′,eg,xij+n.Phase 9.
A queries secret key on any attributes set S∣≠W∗=⋀attij∈A∗attij_; therefore, ∃attij∈A∗, s.t. either attij∈S for attij_=-, or attij∉S for attij_=+. Suppose that attij_∈S∣≠W. B chooses z∈Zp∗ randomly and computes ν=gijgz.Forattij, B computes σattij=xij+n(gijgz)rij+n′.Foratti≠attij, σatti is computed as follows:( 1 ) If i=ik∈I∗-j∗(k≠j∗), calculate (16)σatti=gaikgijrikgn+1-ik+ijuik-z.( 2 ) If i=ij∗, calculate (17)σatti=gaij∗gijrij∗∏k∈I∗-j∗k≠ijuij∗-z.( 3 ) If i∉I∗, calculate(a)σatti=xi(gijgz)ri′, if atti_=+;(b)σatti=xi+n(gijgz)ri+n′, if atti_=-.B answers secret key query for S: (18)SK=ν,σatti∣i∈1,n.Challenge. For aI∗=∑j=1maij,rI∗=∑j=1mrij, 〈uI∗,hI∗〉 is calculated as follows:(19)uI∗=uij∗_∏k∈I∗-j∗uk_=grij∗∏k∈I∗-j∗gn+1-k∏k∈I∗-j∗grkgn+1-k-1=grI∗,hI∗=hij∗_∏k∈I∗-j∗hk_=eg,haij∗·eg,hαn+1∏k∈I∗-j∗eg,hak=eg,haI∗+αn+1.A submits M0 and M1 with |M0|=|M1|. B randomly chooses b∈0,1, s′∈Zp∗ and computes (20)CT∗=W∗,ct0∗=MbTeg,hs′aI∗,ct1∗=gs′,ct2∗=gs′rI∗.IfT=e(gn+1,h), CT∗ is a valid ciphertext; else if T is random, CT∗ is independent of b.Guess. If A outputs b′=b, B guesses that T=e(gn+1,h). Otherwise, B guesses that T is random.Therefore,B can break the decisional n-BDHE assumption with nonnegligible advantage.


### 5.2. Privacy

Theorem 10.
If the DDH assumption holds inG2, our PPGK-ABE scheme is privacy preserving in key generation phase.Proof.
If DDH assumption holds inG2, no probabilistic polynomial-time adversary can distinguish following tuple: (hα,hβ,hαβ,hγ) and (hα,hβ,hγ,hαβ), where h is a generator of group G2, and α,β,γ are selected from Zp∗ randomly. Therefore, no probabilistic polynomial-time adversary can win the security game for privacy.


## 5.1. Confidentiality

Theorem 8.
If the decisionaln-BDHE assumption holds for bilinear groups G1, G2, and GT, our PPGK-ABE scheme is selectively IND-CPA secure.Proof.
If the adversaryA can win above security game with nonnegligible advantage, we can construct an algorithm B to break the decision n-BDHE assumption. B plays the security game with A as follows:
Init. B receives challenge gate W∗=⋀attij∈A∗attij_ from A. We suppose |A∗|=m<n, and I∗={ij|attij∈A∗}.
Setup. B chooses j∗∈[1,m], rk′∈Zp∗, xk∈G2, rij,aij∈Zp∗ randomly, for k∈[1,2n], j∈[1,m].
Forij∈I∗-{j∗}, B computes public parameters as follows:
( 1 ) If attij_=+, (11)uij,hij=grijgn+1-ij-1,eg,haij,uij+n,hij+n=g-rij+n′,eg,xij+n.
( 2 ) If attij_=-, (12)uij,hij=g-rij′,eg,xij,uij+n,hij+n=grijgn+1-ij-1,eg,haij.
Forattij=attij∗, B computes as follows:
( 1 ) If attij∗_=+, (13)uij∗,hij∗=grij∗·∏k∈I∗-ij∗gn+1-k,eg,haij∗eg,hαn+1uij∗+n,hij∗+n=g-rij∗+n′,eg,xij∗+n.
( 2 ) If attj∗_=-, (14)uij∗,hij∗=g-rij∗′,eg,xij∗,uij∗+n,hij∗+n=grij∗·∏k∈I∗-ij∗gn+1-k,eg,haij∗eg,hαn+1,
Forij∉I∗, B computes (15)uij,hij=g-rij′,eg,xij,uij+n,hij+n=g-rij+n′,eg,xij+n.Phase 9.
A queries secret key on any attributes set S∣≠W∗=⋀attij∈A∗attij_; therefore, ∃attij∈A∗, s.t. either attij∈S for attij_=-, or attij∉S for attij_=+. Suppose that attij_∈S∣≠W. B chooses z∈Zp∗ randomly and computes ν=gijgz.Forattij, B computes σattij=xij+n(gijgz)rij+n′.Foratti≠attij, σatti is computed as follows:( 1 ) If i=ik∈I∗-j∗(k≠j∗), calculate (16)σatti=gaikgijrikgn+1-ik+ijuik-z.( 2 ) If i=ij∗, calculate (17)σatti=gaij∗gijrij∗∏k∈I∗-j∗k≠ijuij∗-z.( 3 ) If i∉I∗, calculate(a)σatti=xi(gijgz)ri′, if atti_=+;(b)σatti=xi+n(gijgz)ri+n′, if atti_=-.B answers secret key query for S: (18)SK=ν,σatti∣i∈1,n.Challenge. For aI∗=∑j=1maij,rI∗=∑j=1mrij, 〈uI∗,hI∗〉 is calculated as follows:(19)uI∗=uij∗_∏k∈I∗-j∗uk_=grij∗∏k∈I∗-j∗gn+1-k∏k∈I∗-j∗grkgn+1-k-1=grI∗,hI∗=hij∗_∏k∈I∗-j∗hk_=eg,haij∗·eg,hαn+1∏k∈I∗-j∗eg,hak=eg,haI∗+αn+1.A submits M0 and M1 with |M0|=|M1|. B randomly chooses b∈0,1, s′∈Zp∗ and computes (20)CT∗=W∗,ct0∗=MbTeg,hs′aI∗,ct1∗=gs′,ct2∗=gs′rI∗.IfT=e(gn+1,h), CT∗ is a valid ciphertext; else if T is random, CT∗ is independent of b.Guess. If A outputs b′=b, B guesses that T=e(gn+1,h). Otherwise, B guesses that T is random.Therefore,B can break the decisional n-BDHE assumption with nonnegligible advantage.


## 5.2. Privacy

Theorem 10.
If the DDH assumption holds inG2, our PPGK-ABE scheme is privacy preserving in key generation phase.Proof.
If DDH assumption holds inG2, no probabilistic polynomial-time adversary can distinguish following tuple: (hα,hβ,hαβ,hγ) and (hα,hβ,hγ,hαβ), where h is a generator of group G2, and α,β,γ are selected from Zp∗ randomly. Therefore, no probabilistic polynomial-time adversary can win the security game for privacy.


## 6. Application in Industrial Cloud

Nowadays, new technological revolution represented by Big Data, cloud computing, and Internet of Things is changing the traditional industrial manufacturing system [28, 29]. Industrial cloud provides more convenient and secure cooperation model for the industrial enterprises [30–32]. The ABE scheme has been gradually used in the industrial cloud environment. In these applications, the qualifications, patents, and procurement plans owned by an enterprise often represent its attributes. Using traditional ABE system, the enterprise has to disclose these attributes' information that may relate to business secret to the KGC for applying the corresponding private key. Our PPGK-ABE scheme can solve this problem correctly. In this section, we introduce how to deploy our scheme in the industrial cloud environment. Figure 2 shows the specific structure of the application using our PPGK-ABE scheme. It consists of the following entities:(i)
Industry Enterprise: in this system, the role of industry enterprise is data user. They want to get useful information according to their business, but they do not want to reveal their attributes information that may relate to their business secret to KGC.(ii)
Industry Alliance Manager: in this system, the role of the industry alliance manager is AAC, which issues blind token for the attributes of industry enterprises after reviewing the relevant evidence.(iii)
KGC: its responsibility is to issue the corresponding key to the attributes of industry enterprises. In this system, KGC cannot get these attributes.(iv)
Industrial Information Provider: in this system, industrial information providers are the members of the industrial alliance and include manufacturing enterprises, sales enterprises, logistics enterprises, scientific research institutions, consultant firms, and so on. They will use ABE scheme to share their encrypted data.(v)
Industrial Cloud: industrial cloud serves as data storage center and data sharing center in this system. In order to protect security and privacy of industrial Big Data, the industrial information providers upload their data in encrypted form.Figure 2
Application in industrial cloud.The specific workflow is as follows:(1)
After checking the relevant evidence, the industry enterprise and the industry alliance manager runUserTemKeyGen andBlindTokenGen algorithms, respectively. The industry enterprise gets the blind token corresponding to its attributes.(2)
When the industry enterprises need to ask for their attributes keys, they will submit their blind tokens to KGC. The KGC runsBlindKenGen algorithm and returns blind secret keys to the industry enterprises. In this process, the KGC cannot get any information about the enterprises’ attributes.(3)
After receiving the blind secret keys, the industry enterprises runKeyExtra algorithm to obtain their own secret key. Even if the industry alliance manager knows the attributes of industry enterprises, it does not know the secret keys corresponding to these attributes.(4)
The industrial information providers runEncrypt algorithm to encrypt the industrial data based on some access policies. Then, they share encrypted data on the cloud. Only the enterprises that meet the policies can access corresponding data.(5)
The industry enterprises acquire encrypted data from the cloud and runDecrypt algorithm to get plaintext.In the above application, industrial information providers can share industrial data according to enterprises’ attributes. Only the enterprises that meet the access policy are able to access data. Unlike traditional ABE solutions, in this application, the attributes information of enterprises will not be known by KGC. The business secret of enterprises is protected.



---

*Source: 3249726-2019-05-23.xml*