# Efficient Multibit Function Encryption for Data Security in Internet of Things

Authors: Qihong Chen; Mingming Jiang; Yuyan Guo; Dongbing Zhang; Weina Jia; Wen Zheng
Journal: Security and Communication Networks
 (2022)

---

## Abstract

The development of the Internet of Things (IoT) has been facing severe security threats, and the security and fine-grained access control of data in the IoT is one of the security problems that urgently need to deal with. Attribute-based encryption (ABE) schemes over lattice can not only achieve fine-grained access control but also resist quantum attacks. However, most schemes are single-bit encryption, which is inefficient. In this study, a multibit inner product predicate encryption (PE) scheme over lattice is proposed, which effectively expands the plaintext space. The scheme can realize multibit attribute-based encryption with the hidden access structure for data security in the IoT and support And-gate operation in the access structure with multiattribute. The fine-grained access control of ciphertext data can be realized under the condition of ensuring data privacy. The security of the scheme is based on LWE problem, and it can resist quantum attacks, that is, CPA security under the standard model.


---

## Body

## 1. Introduction

At the same time as the development of the IoT, the privacy protection issue of the IoT has attracted widespread public attention. In the IoT, there are countless terminal devices that transmit the sensed data to the huge data center. Due to the unpredictable risks in the network, this also makes the IoT face difficult security challenges. However, in the IoT, one of the key technologies for privacy protection is access control technology. So, it has research value. It is an important research direction for the security and privacy protection of the IoT. As the cornerstone of information security, cryptography can provide information integrity, confidentiality, nonrepudiation, controllability, and availability [1]. For the realization of the fine-grained encryption, functional encryption (FE) [2] is emerged. And ABE and PE are two important applications of FE [3]. In the FE model, two important concepts are involved, namely, access policy and attribute set. The attribute set is the collection of all possible attributes of the user. The access policy is fine-grained control when users access data. Only when the user’s attributes satisfy the access policy, the user can have the authority to access the data. In FE, the access policy and user’s attributes are, respectively, associated with the private key and the ciphertext. If and only when the user’s attribute meets the access policy, the ciphertext can be successfully decrypted.In the PE scheme [3], the predicate f is used to generate secret key skf, and then, attribute set I is used to generate the ciphertext (CT). Therefore, if and only if fI=1, skf can decrypt the CT. The first inner product predicates (IPE) encryption scheme is proposed by Katz et al. [3]. In [3], the attribute is represented by vector w, and the predicate is represented by vector v. If and only if v,w=0, a user can successfully decrypt the CT. Compared with ABE, the PE system has the characteristic of attribute hiding. Due to the feature of attribute hiding, it also makes the construction of PE more complicated. The IPE encryption system can support CNF and DNF formulas.ABE originated from identity-based encryption (IBE), which was first evolved from the concept of fuzzy identity-based encryption (FIBE) [4]. On this basis, two variants of ABE are proposed, and they are key-policy attribute-based encryption (KP-ABE) [5] and ciphertext-policy attribute-based encryption (CP-ABE) [6], respectively. As a key supporting technology for data sharing in the IoT, the FE system can realize flexible application of data based on user’s attributes. In CP-ABE, the access policy is used to generate the ciphertext, and the user’s attribute is used to generate the secret key. In contrast, in KP-ABE, the access policy is used to generate the secret key, and the user’s attribute is used to generate the ciphertext. In the ABE scheme, when the user’s attributes match the access policy, the decryptor can successfully decrypt the ciphertext. The ABE system can achieve great value in the IoT. Since CP-ABE can fulfill the security requirements of IoT data sharing, it can convert the IPE scheme into CP-ABE with hidden access policy.Subsequently, there are many applications about the IoT [7–19]. And some predicate encryption schemes [20, 21] and ABE schemes [22, 23] have been proposed, but these are based on bilinear groups and cannot resist quantum attacks. Nowadays, there are more and more intelligent applications [24–30]. The rapid development of quantum computers also makes it urgent to design functional encryption scheme that can resist quantum attacks. Information security issues have also received more and more attention [31–35]. In recent years, because the lattice cryptosystem is simple to calculate and can resist quantum attacks, it has become the key research direction of many scholars. Regev [36] first proposed the learning with errors (LWE) problem. And then, it is proved as hard as the shortest vector problem (SVP) in the worst case over lattice; this is also difficult for quantum adversaries. Therefore, there is no probability polynomial time (PPT) algorithm that can overcome the LWE hard problem over lattice. Agrawal et al. [37] first proposed a lattice-based FE scheme, which can realize attribute hiding. However, the FE scheme can only realize single-bit encryption. One after another, people have proposed more and more lattice-based functional encryption schemes [38–41], but highly efficient attribute encryption schemes that can hide access policy are rare. So, this study is mainly to construct an efficient IPE encryption over lattice, and it can be converted to ABE that supports access policy hiding.


### 1.1. Our Construction

Our scheme is based on the lattice IPE of the BGN system. The scheme is multibit encryption. First, we use the predicate vectorv to generate the private key E, and then, we embed the public key A and an attribute vector w into the ciphertext. In the decryption process, when v,w=0, the ciphertext can be decrypted.


### 1.2. Organization

In Section2, we exemplified some symbols that will be used in this study and introduced the basic lattice definitions, as well as some algorithms and hard assumption over lattices. In Section 3, we introduced the definition and security model of the functional encryption scheme. In Section 4, we mainly describe the specific scheme and security proof of the scheme in detail and then compare our scheme with other schemes in Section 4.4. In order to expand the plaintext space, in Section 5, we construct an expansion scheme. After the scheme is constructed, in order to demonstrate the performance of our scheme, we give an example in Section 6. Finally, in Section 7, a summary of this study is made.


## 1.1. Our Construction

Our scheme is based on the lattice IPE of the BGN system. The scheme is multibit encryption. First, we use the predicate vectorv to generate the private key E, and then, we embed the public key A and an attribute vector w into the ciphertext. In the decryption process, when v,w=0, the ciphertext can be decrypted.


## 1.2. Organization

In Section2, we exemplified some symbols that will be used in this study and introduced the basic lattice definitions, as well as some algorithms and hard assumption over lattices. In Section 3, we introduced the definition and security model of the functional encryption scheme. In Section 4, we mainly describe the specific scheme and security proof of the scheme in detail and then compare our scheme with other schemes in Section 4.4. In order to expand the plaintext space, in Section 5, we construct an expansion scheme. After the scheme is constructed, in order to demonstrate the performance of our scheme, we give an example in Section 6. Finally, in Section 7, a summary of this study is made.


## 2. Preliminaries

### 2.1. Notations

The ring of the integers and the real numbers are denoted byℤ and ℝ. Let ℤq denote the ring of integers modulo q and ℤqn×m represent the set of n×m matrices with entries in Zq, where q is an integer and q≥2. For a matrix A, A and AΤ represent the Euclidean norm and the transposed matrix of A, respectively. A˜ represents the Gram–Schmidt orthogonalization of A and A˜ represents the Gram–Schmidt norm of A˜. For parameter n, the function negln denotes negligible function of n.


### 2.2. Lattice

Definition 1.
Letb1,b2…bm∈ℝm be a set of linearly independent vectors, and an m-dimensional full rank lattice is defined as [42](1)Λ=Lb1,b2…bm=y∈ℝm,s.t.∃s∈ℤm,y=∑i=1msibi.Definition 2.
Letq be a prime, a matrix A∈ℤqn×m, and a vector u∈ℤqn, and we define three m-dimensional full rank lattices [43]:(2)ΛqA=e∈ℤm,s.t.∃s∈ℤqn,ATs=emodq,Λq⊥A=e∈ℤm,s.t.Ae=0modq,ΛquA=e∈ℤm,s.t.Ae=umodq.
Ift∈ΛquA, then ΛquA=Λq⊥A+t.


### 2.3. Relevant Algorithms

Lemma 1 (see [42]).
Let a primeq≥3 and a positive integer m=⌊6nlogq⌋. There is a PPT algorithm TrapGenq,n that output A∈ℤqn×m and TA∈ℤm×m, where the matrix A is statistically close to uniform distribution and TA is a basis for Λq⊥A. T˜A≤οnlogqandTA≤οnlogq.Definition 3.
(see [44]). For a vector c∈ℝn and a parameter s>0, then define a Gaussian distribution function on ℝn:(3)∀x∈ℝn,ρx=e−πx−c/s2.
Discrete Gaussian distribution function is defined overm-dimensional lattice Λ:(4)DΛ,s,cx=ρs,cxρs,cΛ.Lemma 2 (see [43]).
For anyn-dimensional lattice Λ, a vector c∈spanΛ, a matrix A∈ℤqn×m, and TA is a basis for Λq⊥A, s≥T˜A⋅ωlogm, we have(5)Prx⟵DΛ,s,c:x-c>sm≤negln.Lemma 3 (see [43]).
Letq≥2 and a matrix A∈ℤqn×m; TA is a basis for Λq⊥A. For s≥T˜A⋅ωlogm, c∈ℤm, and u∈ℤqm, here are the following algorithms:(1)
For algorithmSample PreA,TA,u,s, x∈ΛquA sampled by the algorithm is indistinguishable from DΛqu,s,c(2)
For algorithmSample GaussianA,TA,u,s, x∈Λq⊥A sampled by the algorithm is indistinguishable from DΛ,s,c


### 2.4. The LWE Hard Problem

The security of our schemes is reduced to LWE problem [36].Definition 4.
Let a primeq≥2, an integer n≥1, and a distribute χ over ℤq. An ℤq,n,χ-LWE problem instance includes access to an uncertain challenge oracle Ο. There are two possibilities for this undetermined oracle. The first is that Ο is a noisy pseudorandom sampler Οs, and the second is that the oracle is a truly random sampler Ο$. Then, their specific definitions are as follows:Οs: outputs some samples ai,yi=ai,aiΤs+xi∈ℤqn×ℤq, where the distribution of s∈ℤqn accords with the uniform distribution, xi∈ℤq is a sample from χ, and ai is uniform in ℤqnΟ$: outputs truly uniform random samples from ℤqn×ℤq
The following is the definition of noise distributionΨ¯α [37].Definition 5.
LetΨ¯α mean the probability distribution with mean 0 and standard deviation α/2π over ℤq, where α∈0,1 and an integer q≥2. x∈ℝ be chosen from Ψ¯α and output 「qx」.


## 2.1. Notations

The ring of the integers and the real numbers are denoted byℤ and ℝ. Let ℤq denote the ring of integers modulo q and ℤqn×m represent the set of n×m matrices with entries in Zq, where q is an integer and q≥2. For a matrix A, A and AΤ represent the Euclidean norm and the transposed matrix of A, respectively. A˜ represents the Gram–Schmidt orthogonalization of A and A˜ represents the Gram–Schmidt norm of A˜. For parameter n, the function negln denotes negligible function of n.


## 2.2. Lattice

Definition 1.
Letb1,b2…bm∈ℝm be a set of linearly independent vectors, and an m-dimensional full rank lattice is defined as [42](1)Λ=Lb1,b2…bm=y∈ℝm,s.t.∃s∈ℤm,y=∑i=1msibi.Definition 2.
Letq be a prime, a matrix A∈ℤqn×m, and a vector u∈ℤqn, and we define three m-dimensional full rank lattices [43]:(2)ΛqA=e∈ℤm,s.t.∃s∈ℤqn,ATs=emodq,Λq⊥A=e∈ℤm,s.t.Ae=0modq,ΛquA=e∈ℤm,s.t.Ae=umodq.
Ift∈ΛquA, then ΛquA=Λq⊥A+t.


## 2.3. Relevant Algorithms

Lemma 1 (see [42]).
Let a primeq≥3 and a positive integer m=⌊6nlogq⌋. There is a PPT algorithm TrapGenq,n that output A∈ℤqn×m and TA∈ℤm×m, where the matrix A is statistically close to uniform distribution and TA is a basis for Λq⊥A. T˜A≤οnlogqandTA≤οnlogq.Definition 3.
(see [44]). For a vector c∈ℝn and a parameter s>0, then define a Gaussian distribution function on ℝn:(3)∀x∈ℝn,ρx=e−πx−c/s2.
Discrete Gaussian distribution function is defined overm-dimensional lattice Λ:(4)DΛ,s,cx=ρs,cxρs,cΛ.Lemma 2 (see [43]).
For anyn-dimensional lattice Λ, a vector c∈spanΛ, a matrix A∈ℤqn×m, and TA is a basis for Λq⊥A, s≥T˜A⋅ωlogm, we have(5)Prx⟵DΛ,s,c:x-c>sm≤negln.Lemma 3 (see [43]).
Letq≥2 and a matrix A∈ℤqn×m; TA is a basis for Λq⊥A. For s≥T˜A⋅ωlogm, c∈ℤm, and u∈ℤqm, here are the following algorithms:(1)
For algorithmSample PreA,TA,u,s, x∈ΛquA sampled by the algorithm is indistinguishable from DΛqu,s,c(2)
For algorithmSample GaussianA,TA,u,s, x∈Λq⊥A sampled by the algorithm is indistinguishable from DΛ,s,c


## 2.4. The LWE Hard Problem

The security of our schemes is reduced to LWE problem [36].Definition 4.
Let a primeq≥2, an integer n≥1, and a distribute χ over ℤq. An ℤq,n,χ-LWE problem instance includes access to an uncertain challenge oracle Ο. There are two possibilities for this undetermined oracle. The first is that Ο is a noisy pseudorandom sampler Οs, and the second is that the oracle is a truly random sampler Ο$. Then, their specific definitions are as follows:Οs: outputs some samples ai,yi=ai,aiΤs+xi∈ℤqn×ℤq, where the distribution of s∈ℤqn accords with the uniform distribution, xi∈ℤq is a sample from χ, and ai is uniform in ℤqnΟ$: outputs truly uniform random samples from ℤqn×ℤq
The following is the definition of noise distributionΨ¯α [37].Definition 5.
LetΨ¯α mean the probability distribution with mean 0 and standard deviation α/2π over ℤq, where α∈0,1 and an integer q≥2. x∈ℝ be chosen from Ψ¯α and output 「qx」.


## 3. Multibit Function Encryption for IPE

### 3.1. Define

A multibit function encryption for IPE construction is composed of a triple algorithm (KeyGen, Enc, Dec).KeyGen (λ, ℓ, v): a security parameter is λ, a parameter ℓ represents the length of predicate v, and a vector v is input. The algorithm output public key pk and secret key SK.Enc (m, pk, w): pk is a message plaintext m and an attribute vector w is input; the algorithm outputs ciphertexts c.Dec (SK, c): SK and ciphertexts c are inputs; the algorithm outputs a message m.Correctness: If v,w=0, then we have(6)DecSK,Encpk,m,w=m.


### 3.2. Security Model

We introduced the security model of IPE, which is based on indistinguishability of ciphertexts under chosen-plaintext attack (IND-CPA) game. It indicates that the challenge ciphertexts and random elements in the ciphertext space are indistinguishable.Init: the adversary A chooses a target attribute vector w∗=w1∗,…,w1∗∈ℤqℓ and sends the message M∗ to challenger C.Setup:C accepts w∗ and M∗ from adversary A. C runs Setup (λ, ℓ) and gives A the public parameters pp. C keeps the master secret key MSK to itself.Phase 1.
C answers the A’s private key generation queries on predicate vector v=v1,…,vℓ∈ℤqℓ, where v,w∗≠0. C runs KeyGen (λ, ℓ, v) and then C sends the algorithm output result to the A.
Challenge: after A finishes Phase 1, A outputs a challenge plaintext M∗ to C. Therefore, C selects a bit b←0,1 randomly. If b=0, C sends CT  = Enc (pp,w∗,b) to A. If b=1, C chooses a random ciphertext CT=CT∗ from the ciphertext space and sends it to A.Phase 2.
A issues additional private key query on the predicate vector v, where v,w∗≠0. The C’s response as in Phase 1.
Guess: a guess b′∈0,1 is finally given by A. If b=b′, A wins this game.Definition 6.
A’s advantage is defined by us as follows:(7)AdvAλ=Prb=b′−12.


## 3.1. Define

A multibit function encryption for IPE construction is composed of a triple algorithm (KeyGen, Enc, Dec).KeyGen (λ, ℓ, v): a security parameter is λ, a parameter ℓ represents the length of predicate v, and a vector v is input. The algorithm output public key pk and secret key SK.Enc (m, pk, w): pk is a message plaintext m and an attribute vector w is input; the algorithm outputs ciphertexts c.Dec (SK, c): SK and ciphertexts c are inputs; the algorithm outputs a message m.Correctness: If v,w=0, then we have(6)DecSK,Encpk,m,w=m.


## 3.2. Security Model

We introduced the security model of IPE, which is based on indistinguishability of ciphertexts under chosen-plaintext attack (IND-CPA) game. It indicates that the challenge ciphertexts and random elements in the ciphertext space are indistinguishable.Init: the adversary A chooses a target attribute vector w∗=w1∗,…,w1∗∈ℤqℓ and sends the message M∗ to challenger C.Setup:C accepts w∗ and M∗ from adversary A. C runs Setup (λ, ℓ) and gives A the public parameters pp. C keeps the master secret key MSK to itself.Phase 1.
C answers the A’s private key generation queries on predicate vector v=v1,…,vℓ∈ℤqℓ, where v,w∗≠0. C runs KeyGen (λ, ℓ, v) and then C sends the algorithm output result to the A.
Challenge: after A finishes Phase 1, A outputs a challenge plaintext M∗ to C. Therefore, C selects a bit b←0,1 randomly. If b=0, C sends CT  = Enc (pp,w∗,b) to A. If b=1, C chooses a random ciphertext CT=CT∗ from the ciphertext space and sends it to A.Phase 2.
A issues additional private key query on the predicate vector v, where v,w∗≠0. The C’s response as in Phase 1.
Guess: a guess b′∈0,1 is finally given by A. If b=b′, A wins this game.Definition 6.
A’s advantage is defined by us as follows:(7)AdvAλ=Prb=b′−12.


## 4. Scheme

### 4.1. Construction

Setup (λ, ℓ): a security parameter λ and a parameter ℓ represent the length of the predicate vector and the attribute vector as input. Next, the following is carried out:(1)
Generate a uniformly random matrixA∈ℤqn×m and short basis TA∈ℤm×m for Λq⊥A using TrapGenq,n,m(2)
Selectℓ⋅1+k uniformly random matrices Ui,ξ∈ℤqn×m and a matrix U0∈ℤqn×m, where i=1,…,ℓ and ξ=0,…,k(3)
Outputpp = (A,Ui,ξi∈1,…,ℓ,ξ∈0,…,k,U0) and the master private key MSK=TAKeyGen (pp,MSK,v):pp, MSK, and a predicate vector v=v1,…,vℓ∈ℤqℓ are inputs. Next, the following is carried out:(1)
Write ther-ary decomposition of vi as(8)vi=∑ξ=0kvi,ξ⋅rξ,wherevi,ξ are integers in [0, r−1] and i=1,…,ℓ.(2)
Let the matrix be(9)U=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξ=u1,…,um,whereui∈ℤqn.(3)
Sampleei←Sample PreA,TA,ui,σ, where ei∈ℤqm and A⋅ei=uimodq. Let E=e1,…em; then, A⋅E=Umodq.(4)
OutputSK=E.Enc (pp,w,b):pp, an attribute vector w=w1,w2,…,wl∈ℤql, and a message plaintext vector b∈0,1m are inputs; next, the following is carried out:(1)
Select a uniformly random matrixB⟵ℤqn×m and a vector s⟵ℤqn(2)
Select a noise vectorx⟵Ψ¯αm(3)
Letc0=AΤs+2x, c′=U0Ts+2x+b, and ci,ξ=Ui,ξ+rξwiBΤs+2Ri,ξTx, where Ri,ξ∈−1,1m×m, i=1,…,ℓ and ξ=0,…,k(4)
Output the ciphertext CT =c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′Dec (pp,SK,CT): pp, SK, and CT are inputs; next, the following is carried out:(1)
Computecv→=∑i=1ℓ∑ξ=0kvi,ξci,ξ(2)
Lety=c′+cv→(3)
Computeb=y−EΤc0mod2


### 4.2. Correctness and Parameters

The calculation for decryption is as follows:(10)cv=∑i=1ℓ∑ξ=0kvi,ξci,ξ=∑i=1ℓ∑ξ=0kvi,ξUi,ξ+rξwiBTs+2Ri,ξTx=∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+∑i=1ℓ∑ξ=0krξvi,ξwi︸v,wBTs+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.If the user meets the decryption requirements, that is,v,w=0modq, let(11)cv=∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Then,(12)y=c′+cv→=U0Ts+2x+b+∑i=1ℓ∑ξ=0kvi,ξUi,ξΤs+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=UΤs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Finally, we compute(13)y−ETc0=UTs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−ETATs+2xmod2=UTs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−AETs−2ETxmod2=b+2x−2ETx+2∑i=1ℓ∑ξ=0kvi,ξRi,ξtxmod2=bmod2=b.In order to ensure the correctness of the overall structure of the scheme, we make some parameters meet certain conditions.(1)
TrapGenq,n requires m>6nlogq, TA≤οnlogq, and q=polyn(2)
The algorithmSample requires s≥T˜A⋅ωlogm(3)
To ensure decrypt successfully and the reduction of the scheme, we needq>5sm+1, α<1/smωlogm, and χ=Ψ¯αThen, we set the following parameters:m=6n⌈logq⌉, q=n3, s=m⋅ωlogn, and α=1/l+1s⋅m⋅ωlogm, where l is the length of the predicate vector and the attribute vector.


### 4.3. Security Analysis

Theorem 1.
Under the assumption of the LWE hard problem, our scheme is IND-CPA security in the standard model [45].Proof.
Some games are needed in the proof of our scheme to prove that the advantage over PPT adversary is negligible.
Game 0: this is the original IND-CPA game between an adversary A against our scheme and an IND-CPA challenger C.
Game 1: in the choice of matrix A and Ui,ξ, the operations of Game 0 and Game 1 are different. In Game 0, C generates A in ℤqn×m by running TrapGenq,n,m. According to Lemma 1, the matrix A is statistically close to a uniformly random matrix. In Game 1, we choose a matrix A randomly in ℤqn×m. Obviously, the matrix A is indistinguishable from Game 0.
LetRi,ξ∗∈−1,1m×m be selected from random matrix and B∗ be chosen from a random matrix in ℤqn×m and an attribute vector w∗=w1∗,…,wl∗∈ℤqℓ that A intends to attack. C constructs Ui,ξ as Ui,ξ⟵2ARi,ξ∗−rξwi∗B∗. For i∈1,…,ℓ and ξ∈0,…,k, the matrix Ui,ξ is indistinguishable from a uniformly random matrix in ℤqn×m.
InGame 0, the matrix Ui,ξ is uniformly random in ℤqn×m. From the above analysis, the matrix Ui,ξ in Game 0 and the matrix Ui,ξGame 1 are not distinguishable.
Game 2: in the way of generating matrix E and U0, the operations of Game 1 and Game 2 are different. The choice of A remains as in Game 1. C needs to answer the A’s private key queries of an attribute vector w∗, where v,w∗≠0. And C needs a matrix E. Firstly, C randomly selects matrix E according to Gauss distribution Ds,0. Then, C computes A⋅E=Umodq. E is selected from the Gauss distribution, and then, A is also a random matrix. Therefore, the matrix U is statistically not distinguishable from a uniformly random matrix.
LetU=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξ, where Ui,ξ remains as in Game 1 and vi,ξ as in KeyGen. Given U,Ui,ξ,vi,ξ, we can calculate U0. From the above analysis, U, Ui,ξ∈ℤqn×m are statistically close to uniformly random. Yet, U0 can be regarded as a uniformly random matrix. So, the matrix U0 is not distinguishable from Game 1.
Game 3: the challenge ciphertext triples c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ are the elements independently selected randomly in ℤqm. Because the challenge ciphertexts are always random elements, the adversary’s advantage is zero. Other parts are the same as Game 2.
For a PPT adversary, we will show that computationally indistinguishable betweenGame 2 and Game 3. Then, we reduce it to the LWE hard problem.
Reduction from LWE: regarding the advantage of distinguishing between Game 2 and Game 3, A’s advantage is negligible. Therefore, we construct an LWE algorithm ℬ.
Instance: ℬ has received m pairs’ random instances ai,yi∈ℤqn×ℤq from Ο.
Targeting:A claims to ℬ an attribute vector w∗ that it is going to be attacked.
Setup: different from the original scheme, ℬ generates pp as follows:(1)
We letA=a1,a2,…am∈ℤqn×m(2)
The matricesU0 and Ui,ξ are mentioned in Game 2, where i∈1,…,ℓ and ξ∈0,…,k
Queries: for A’s private key generation query of a predicate vector v (v,w∗≠0), ℬ’s answer is as Game 2.
Challenge: ℬ response to a challenge ciphertext for w∗, and then, A received the ciphertext about the plaintext M∗∈0,1m as follows:(1)
Lety′=y1,y2,…,ym∈ℤqm.(2)
c0=2y′=2ATs+2x.(3)
c′=U0Ts+2x+M∗.(4)
ci,ξ=Ui,ξ+rξwi∗BΤs+2Ri,ξ∗Tx=2ARi,ξ∗−rξwi∗B∗+rξwi∗B∗Ts+2Ri,ξ∗Tx=Ri,ξ∗T2AΤs+2x=Ri,ξ∗T⋅c0, where i∈1,…,ℓ and ξ∈0,…,k.Then, c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ as a challenge ciphertext.(5)
Randomly choose a bitb⟵0,1. If b=0, send CT=c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ to A. If b=1, choose a random c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′∈ℤqm from the ciphertext space and send it to A.
When the LWE oracle is pseudorandom (i.e.,Ο  =  Οs), the distribution of the challenge ciphertext is the same as in Game 2. When Ο  =  Ο$, choose the ciphertext from Game 3 as the challenge ciphertext.
Guess: when A can guess a right b, ℬ outputs 1, otherwise ℬ outputs 0.
Therefore, ℬ’s advantage in solving LWE hard problem is the advantage ofA to distinguish between Game 2 and Game 3. If A can distinguish the above games, then ℬ can solve LWE problem.


### 4.4. Comparison

In the process of comparing with other schemes [41, 46], we compared performance of three aspects. Among them is the size of the private key, whether it has the characteristics of attribute hiding and bit encryption. Table 1 is the result of comparison.Table 1
Comparison of related literature.
CryptosystemPrivate key sizeAttribute hidingBit encryption[41]οmnlogqNoSingle bit[46]οnlogqNoSingle bitOur schemeοmnlogqYesMultibit


## 4.1. Construction

Setup (λ, ℓ): a security parameter λ and a parameter ℓ represent the length of the predicate vector and the attribute vector as input. Next, the following is carried out:(1)
Generate a uniformly random matrixA∈ℤqn×m and short basis TA∈ℤm×m for Λq⊥A using TrapGenq,n,m(2)
Selectℓ⋅1+k uniformly random matrices Ui,ξ∈ℤqn×m and a matrix U0∈ℤqn×m, where i=1,…,ℓ and ξ=0,…,k(3)
Outputpp = (A,Ui,ξi∈1,…,ℓ,ξ∈0,…,k,U0) and the master private key MSK=TAKeyGen (pp,MSK,v):pp, MSK, and a predicate vector v=v1,…,vℓ∈ℤqℓ are inputs. Next, the following is carried out:(1)
Write ther-ary decomposition of vi as(8)vi=∑ξ=0kvi,ξ⋅rξ,wherevi,ξ are integers in [0, r−1] and i=1,…,ℓ.(2)
Let the matrix be(9)U=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξ=u1,…,um,whereui∈ℤqn.(3)
Sampleei←Sample PreA,TA,ui,σ, where ei∈ℤqm and A⋅ei=uimodq. Let E=e1,…em; then, A⋅E=Umodq.(4)
OutputSK=E.Enc (pp,w,b):pp, an attribute vector w=w1,w2,…,wl∈ℤql, and a message plaintext vector b∈0,1m are inputs; next, the following is carried out:(1)
Select a uniformly random matrixB⟵ℤqn×m and a vector s⟵ℤqn(2)
Select a noise vectorx⟵Ψ¯αm(3)
Letc0=AΤs+2x, c′=U0Ts+2x+b, and ci,ξ=Ui,ξ+rξwiBΤs+2Ri,ξTx, where Ri,ξ∈−1,1m×m, i=1,…,ℓ and ξ=0,…,k(4)
Output the ciphertext CT =c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′Dec (pp,SK,CT): pp, SK, and CT are inputs; next, the following is carried out:(1)
Computecv→=∑i=1ℓ∑ξ=0kvi,ξci,ξ(2)
Lety=c′+cv→(3)
Computeb=y−EΤc0mod2


## 4.2. Correctness and Parameters

The calculation for decryption is as follows:(10)cv=∑i=1ℓ∑ξ=0kvi,ξci,ξ=∑i=1ℓ∑ξ=0kvi,ξUi,ξ+rξwiBTs+2Ri,ξTx=∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+∑i=1ℓ∑ξ=0krξvi,ξwi︸v,wBTs+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.If the user meets the decryption requirements, that is,v,w=0modq, let(11)cv=∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Then,(12)y=c′+cv→=U0Ts+2x+b+∑i=1ℓ∑ξ=0kvi,ξUi,ξΤs+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=UΤs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Finally, we compute(13)y−ETc0=UTs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−ETATs+2xmod2=UTs+2x+b+2∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−AETs−2ETxmod2=b+2x−2ETx+2∑i=1ℓ∑ξ=0kvi,ξRi,ξtxmod2=bmod2=b.In order to ensure the correctness of the overall structure of the scheme, we make some parameters meet certain conditions.(1)
TrapGenq,n requires m>6nlogq, TA≤οnlogq, and q=polyn(2)
The algorithmSample requires s≥T˜A⋅ωlogm(3)
To ensure decrypt successfully and the reduction of the scheme, we needq>5sm+1, α<1/smωlogm, and χ=Ψ¯αThen, we set the following parameters:m=6n⌈logq⌉, q=n3, s=m⋅ωlogn, and α=1/l+1s⋅m⋅ωlogm, where l is the length of the predicate vector and the attribute vector.


## 4.3. Security Analysis

Theorem 1.
Under the assumption of the LWE hard problem, our scheme is IND-CPA security in the standard model [45].Proof.
Some games are needed in the proof of our scheme to prove that the advantage over PPT adversary is negligible.
Game 0: this is the original IND-CPA game between an adversary A against our scheme and an IND-CPA challenger C.
Game 1: in the choice of matrix A and Ui,ξ, the operations of Game 0 and Game 1 are different. In Game 0, C generates A in ℤqn×m by running TrapGenq,n,m. According to Lemma 1, the matrix A is statistically close to a uniformly random matrix. In Game 1, we choose a matrix A randomly in ℤqn×m. Obviously, the matrix A is indistinguishable from Game 0.
LetRi,ξ∗∈−1,1m×m be selected from random matrix and B∗ be chosen from a random matrix in ℤqn×m and an attribute vector w∗=w1∗,…,wl∗∈ℤqℓ that A intends to attack. C constructs Ui,ξ as Ui,ξ⟵2ARi,ξ∗−rξwi∗B∗. For i∈1,…,ℓ and ξ∈0,…,k, the matrix Ui,ξ is indistinguishable from a uniformly random matrix in ℤqn×m.
InGame 0, the matrix Ui,ξ is uniformly random in ℤqn×m. From the above analysis, the matrix Ui,ξ in Game 0 and the matrix Ui,ξGame 1 are not distinguishable.
Game 2: in the way of generating matrix E and U0, the operations of Game 1 and Game 2 are different. The choice of A remains as in Game 1. C needs to answer the A’s private key queries of an attribute vector w∗, where v,w∗≠0. And C needs a matrix E. Firstly, C randomly selects matrix E according to Gauss distribution Ds,0. Then, C computes A⋅E=Umodq. E is selected from the Gauss distribution, and then, A is also a random matrix. Therefore, the matrix U is statistically not distinguishable from a uniformly random matrix.
LetU=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξ, where Ui,ξ remains as in Game 1 and vi,ξ as in KeyGen. Given U,Ui,ξ,vi,ξ, we can calculate U0. From the above analysis, U, Ui,ξ∈ℤqn×m are statistically close to uniformly random. Yet, U0 can be regarded as a uniformly random matrix. So, the matrix U0 is not distinguishable from Game 1.
Game 3: the challenge ciphertext triples c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ are the elements independently selected randomly in ℤqm. Because the challenge ciphertexts are always random elements, the adversary’s advantage is zero. Other parts are the same as Game 2.
For a PPT adversary, we will show that computationally indistinguishable betweenGame 2 and Game 3. Then, we reduce it to the LWE hard problem.
Reduction from LWE: regarding the advantage of distinguishing between Game 2 and Game 3, A’s advantage is negligible. Therefore, we construct an LWE algorithm ℬ.
Instance: ℬ has received m pairs’ random instances ai,yi∈ℤqn×ℤq from Ο.
Targeting:A claims to ℬ an attribute vector w∗ that it is going to be attacked.
Setup: different from the original scheme, ℬ generates pp as follows:(1)
We letA=a1,a2,…am∈ℤqn×m(2)
The matricesU0 and Ui,ξ are mentioned in Game 2, where i∈1,…,ℓ and ξ∈0,…,k
Queries: for A’s private key generation query of a predicate vector v (v,w∗≠0), ℬ’s answer is as Game 2.
Challenge: ℬ response to a challenge ciphertext for w∗, and then, A received the ciphertext about the plaintext M∗∈0,1m as follows:(1)
Lety′=y1,y2,…,ym∈ℤqm.(2)
c0=2y′=2ATs+2x.(3)
c′=U0Ts+2x+M∗.(4)
ci,ξ=Ui,ξ+rξwi∗BΤs+2Ri,ξ∗Tx=2ARi,ξ∗−rξwi∗B∗+rξwi∗B∗Ts+2Ri,ξ∗Tx=Ri,ξ∗T2AΤs+2x=Ri,ξ∗T⋅c0, where i∈1,…,ℓ and ξ∈0,…,k.Then, c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ as a challenge ciphertext.(5)
Randomly choose a bitb⟵0,1. If b=0, send CT=c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ to A. If b=1, choose a random c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′∈ℤqm from the ciphertext space and send it to A.
When the LWE oracle is pseudorandom (i.e.,Ο  =  Οs), the distribution of the challenge ciphertext is the same as in Game 2. When Ο  =  Ο$, choose the ciphertext from Game 3 as the challenge ciphertext.
Guess: when A can guess a right b, ℬ outputs 1, otherwise ℬ outputs 0.
Therefore, ℬ’s advantage in solving LWE hard problem is the advantage ofA to distinguish between Game 2 and Game 3. If A can distinguish the above games, then ℬ can solve LWE problem.


## 4.4. Comparison

In the process of comparing with other schemes [41, 46], we compared performance of three aspects. Among them is the size of the private key, whether it has the characteristics of attribute hiding and bit encryption. Table 1 is the result of comparison.Table 1
Comparison of related literature.
CryptosystemPrivate key sizeAttribute hidingBit encryption[41]οmnlogqNoSingle bit[46]οnlogqNoSingle bitOur schemeοmnlogqYesMultibit


## 5. Extension

### 5.1. Construction

Setup (λ, ℓ): a security parameter λ and a parameter ℓ represent the length of predicate vector and attribute vector as input. Next, the following is carried out:(1)
UseTrapGenq,n,m to choose a uniformly random matrix A∈ℤqn×m and a short basis TA∈ℤm×m for Λq⊥A(2)
Selectℓ⋅1+k uniformly random matrices Ui,ξ∈ℤqn×m and a matrix U0∈ℤqn×m, where i=1,…,ℓ and ξ=0,…,k(3)
Outputpp = (A,Ui,ξi∈1,…,ℓ,ξ∈0,…,k,U0) and MSK=TAKeyGen (pp,MSK,v): pp, MSK, and a vector v=v1,…,vℓ∈ℤqℓ are inputs. Next, the following is carried out:(1)
Fori=1,…ℓ, write the r-ary decomposition of vi as(14)vi=∑ξ=0kvi,ξ⋅rξ,wherevi,ξ are integers in [0, r−1].(2)
Let the matrix be(15)U=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξ=u1,…,um,whereui∈ℤqn.(3)
Sampleei⟵Sample PreA,TA,ui,σ, where ei∈ℤqm and A⋅ei=uimodq. Let E=e1,…em; then, A⋅E=Umodq.(4)
OutputSK=E.Enc (pp,w,b): pp, a vector w=w1,w2,…,wℓ∈ℤqℓ, and a message plaintext vector b∈ℤpm as input; the following is carried out:(1)
Select a uniformly random matrixB⟵ℤqn×m and a vector s⟵ℤqn(2)
Select a noise vectorx⟵Ψ¯αm(3)
Letc0=AΤs+px, c′=U0Ts+px+b, and ci,ξ=Ui,ξ+rξwiBΤs+pRi,ξTx, where Ri,ξ∈−1,1m×m, i=1,…,ℓ and ξ=0,…,k(4)
Finally, the ciphertext CT =c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ is the outputDec (pp,SK,CT): pp, SK, and CT are input; the following is carried out:(1)
Computecv→=∑i=1ℓ∑ξ=0kvi,ξci,ξ(2)
Lety=c′+cv→(3)
Computeb=y−EΤc0modp


### 5.2. Correctness

The calculation for decryption is as follows:(16)cv=∑i=1ℓ∑ξ=0kvi,ξci,ξ=∑i=1ℓ∑ξ=0kvi,ξUi,ξ+rξwiBTs+pRi,ξTx=∑i=1ℓ∑ξ=0kvi,ξUi,ξΤs+∑i=1ℓ∑ξ=0krξvi,ξwi︸v,wBTs+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.If the user meets the decryption requirements, that is,v,w=0modq, let(17)cv=∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Then,(18)y=c′+cv→=U0Ts+px+b+∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=UTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Finally, we compute:(19)y−ETc0=UTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−EΤAΤs+pxmodp=UTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−AEΤs−pEΤxmodp=b+px−pEΤx+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTxmodp=bmodp=b.


### 5.3. Security

In this section, it is roughly the same as Section4.3, so we do not describe it in detail. The only difference is the message plaintext. In Section 5.1, the ciphertext on ℤp is encrypted. So, in Section 5.3, we only need to change Ui,ξ⟵2ARi,ξ∗−rξwi∗B∗ in Game 2 to Ui,ξ⟵pARi,ξ∗−rξwi∗B∗. In an interactive game between an adversary and a challenger, only this is different. And then, we change the 2 in the ciphertext triples of Challenge in Reduction from LWE to p. This is the only part that is different when it reduces to the LWE hard problem.


## 5.1. Construction

Setup (λ, ℓ): a security parameter λ and a parameter ℓ represent the length of predicate vector and attribute vector as input. Next, the following is carried out:(1)
UseTrapGenq,n,m to choose a uniformly random matrix A∈ℤqn×m and a short basis TA∈ℤm×m for Λq⊥A(2)
Selectℓ⋅1+k uniformly random matrices Ui,ξ∈ℤqn×m and a matrix U0∈ℤqn×m, where i=1,…,ℓ and ξ=0,…,k(3)
Outputpp = (A,Ui,ξi∈1,…,ℓ,ξ∈0,…,k,U0) and MSK=TAKeyGen (pp,MSK,v): pp, MSK, and a vector v=v1,…,vℓ∈ℤqℓ are inputs. Next, the following is carried out:(1)
Fori=1,…ℓ, write the r-ary decomposition of vi as(14)vi=∑ξ=0kvi,ξ⋅rξ,wherevi,ξ are integers in [0, r−1].(2)
Let the matrix be(15)U=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξ=u1,…,um,whereui∈ℤqn.(3)
Sampleei⟵Sample PreA,TA,ui,σ, where ei∈ℤqm and A⋅ei=uimodq. Let E=e1,…em; then, A⋅E=Umodq.(4)
OutputSK=E.Enc (pp,w,b): pp, a vector w=w1,w2,…,wℓ∈ℤqℓ, and a message plaintext vector b∈ℤpm as input; the following is carried out:(1)
Select a uniformly random matrixB⟵ℤqn×m and a vector s⟵ℤqn(2)
Select a noise vectorx⟵Ψ¯αm(3)
Letc0=AΤs+px, c′=U0Ts+px+b, and ci,ξ=Ui,ξ+rξwiBΤs+pRi,ξTx, where Ri,ξ∈−1,1m×m, i=1,…,ℓ and ξ=0,…,k(4)
Finally, the ciphertext CT =c0,ci,ξi∈1,…,ℓ,ξ∈0,…,k,c′ is the outputDec (pp,SK,CT): pp, SK, and CT are input; the following is carried out:(1)
Computecv→=∑i=1ℓ∑ξ=0kvi,ξci,ξ(2)
Lety=c′+cv→(3)
Computeb=y−EΤc0modp


## 5.2. Correctness

The calculation for decryption is as follows:(16)cv=∑i=1ℓ∑ξ=0kvi,ξci,ξ=∑i=1ℓ∑ξ=0kvi,ξUi,ξ+rξwiBTs+pRi,ξTx=∑i=1ℓ∑ξ=0kvi,ξUi,ξΤs+∑i=1ℓ∑ξ=0krξvi,ξwi︸v,wBTs+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.If the user meets the decryption requirements, that is,v,w=0modq, let(17)cv=∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Then,(18)y=c′+cv→=U0Ts+px+b+∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=U0+∑i=1ℓ∑ξ=0kvi,ξUi,ξTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx=UTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx.Finally, we compute:(19)y−ETc0=UTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−EΤAΤs+pxmodp=UTs+px+b+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTx−AEΤs−pEΤxmodp=b+px−pEΤx+p∑i=1ℓ∑ξ=0kvi,ξRi,ξTxmodp=bmodp=b.


## 5.3. Security

In this section, it is roughly the same as Section4.3, so we do not describe it in detail. The only difference is the message plaintext. In Section 5.1, the ciphertext on ℤp is encrypted. So, in Section 5.3, we only need to change Ui,ξ⟵2ARi,ξ∗−rξwi∗B∗ in Game 2 to Ui,ξ⟵pARi,ξ∗−rξwi∗B∗. In an interactive game between an adversary and a challenger, only this is different. And then, we change the 2 in the ciphertext triples of Challenge in Reduction from LWE to p. This is the only part that is different when it reduces to the LWE hard problem.


## 6. Application

For the above construction, we change the predicate vector inKeyGen into an attribute vector w and change the attribute vector in Enc into an access structure x. The result is a ciphertext-policy hiding CP-ABE. Below, we give a specific example.Suppose there is a company that wants to hire some qualified people who meet the company’s specified policy. However, the policy may contain some important strategic information that the company does not want to disclose, so the company can publish encrypted messages by our CP-ABE on the public platform to find people. Therefore, the company can keep important strategies secret. Therefore, competitors cannot know what strategy the company uses to recruit people.


### 6.1. Preliminaries

For the predicateORI1,I2, if x=I1 or x=I2, then ORI1,I2x=1. It can be coded as a univariate polynomial: px=x−I1⋅x−I2. When the relevant predicate is equal to 1, the polynomial is equal to zero.For the predicateORI1,I2, if x1=I1 or x2=I2, then ORI1,I2x1,x2=1. It can be encoded as a multivariate polynomial: p′x1,x2=x1−I1⋅x2−I2.For the predicateANDI1,I2, if x1=I1 and x2=I2, then ANDI1,I2x1,x2=1. It can be encoded as a multivariate polynomial: p″x1,x2=r⋅x1−I1+x2−I2.


### 6.2. An Example

(20)Working Department:ITANDJob Position : TechnicianORAge : Under30.It can be written as such a polynomial:(21)px1,x2,x3=rx1−I1+x2−I2⋅x3−I3=0⋅x1x2x3+0⋅x1x2+0⋅x1x3+1⋅x2x3+r⋅x1+−I3⋅x2+−I2⋅x3+I2I3−rI1,where I1=HWorking Department : IT, I2=HJob Position : Technician, and I3=HAge : Under30. And H is a collision-resistant hash function from 0,1∗ to Zq.In addition, the user’s attribute set:S=Working Department : IT, JobPosition : Technician, Age : Under30.LetI1′=HWorking Department : IT, I2′=HJob Position : Technician, and I3′=HAge : Under30. We can write the above polynomial as the inner product of two vectors. They are the predicate vector x=0,…0,1,r,−I3,−I2,I2I3−rI1 and the attribute vector w=I1′I2′I3′,I1′I2′,I1′I3′,I2′I3′,I1′,I2′,I3′,1. So, we get two vectors that meet the above description.We bringx and w into our CP-ABE scheme. When x,w=0, the user can decrypt the ciphertext.


## 6.1. Preliminaries

For the predicateORI1,I2, if x=I1 or x=I2, then ORI1,I2x=1. It can be coded as a univariate polynomial: px=x−I1⋅x−I2. When the relevant predicate is equal to 1, the polynomial is equal to zero.For the predicateORI1,I2, if x1=I1 or x2=I2, then ORI1,I2x1,x2=1. It can be encoded as a multivariate polynomial: p′x1,x2=x1−I1⋅x2−I2.For the predicateANDI1,I2, if x1=I1 and x2=I2, then ANDI1,I2x1,x2=1. It can be encoded as a multivariate polynomial: p″x1,x2=r⋅x1−I1+x2−I2.


## 6.2. An Example

(20)Working Department:ITANDJob Position : TechnicianORAge : Under30.It can be written as such a polynomial:(21)px1,x2,x3=rx1−I1+x2−I2⋅x3−I3=0⋅x1x2x3+0⋅x1x2+0⋅x1x3+1⋅x2x3+r⋅x1+−I3⋅x2+−I2⋅x3+I2I3−rI1,where I1=HWorking Department : IT, I2=HJob Position : Technician, and I3=HAge : Under30. And H is a collision-resistant hash function from 0,1∗ to Zq.In addition, the user’s attribute set:S=Working Department : IT, JobPosition : Technician, Age : Under30.LetI1′=HWorking Department : IT, I2′=HJob Position : Technician, and I3′=HAge : Under30. We can write the above polynomial as the inner product of two vectors. They are the predicate vector x=0,…0,1,r,−I3,−I2,I2I3−rI1 and the attribute vector w=I1′I2′I3′,I1′I2′,I1′I3′,I2′I3′,I1′,I2′,I3′,1. So, we get two vectors that meet the above description.We bringx and w into our CP-ABE scheme. When x,w=0, the user can decrypt the ciphertext.


## 7. Conclusion

The rapid development of the IoT has been integrated into everyone’s life, but the privacy protection of data sharing is still an important research direction of the IoT. Therefore, in this study, we propose a high-efficiency function encryption scheme over lattices to securely share data in the IoT. In this study, we use the BGN-type cryptosystem in [47] to propose a lattice-based multibit inner product predicate encryption scheme and then convert it into a multibit CP-ABE scheme that supports multiattribute AND-gate access structure. Then, under the standard model, our scheme is CPA secure and can resist quantum attacks.



---

*Source: 3227712-2022-04-14.xml*