# A Fine-Grained Medical Data Sharing Scheme with Ciphertext Reencryption

Authors: Jiahao Chen; Jingwei Wang; Xinchun Yin; Jianting Ning
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

With the fantastic development of cloud computing technology, cloud storage has been widely applied in the field of medical data sharing due to its efficiency and flexibility. Attribute-based encryption (ABE), as a promising technology, plays an important role in the fine-grained sharing of medical data. However, there are two issues: (1) an access policy specified in the encryption phase may need to be updated after a period of time, and (2) the considerable decryption overhead in ABE is too heavy for resource-limited devices. To address these issues, a fine-grained medical data sharing scheme with ciphertext reencryption is proposed. Users with decryption permission can produce reencryption keys and cloud server can reencrypt initial ciphertext. The cloud server can predecrypt ciphertext, which reduces user’s decryption overhead. Moreover, the traditional centralized server is replaced with a decentralized blockchain that performs system initialization, key management, and user revocation. We compared the proposed scheme with some existing schemes in terms of function and efficiency; the results show that the efficiency of the proposed scheme outperforms other related schemes. The security analysis shows that the proposed scheme is security and correctness.


---

## Body

## 1. Introduction

Since cloud computing was proposed, it has received increasing attention [1]. On the one hand, it is an Internet-based value-added service [2], which means that users can obtain cloud services through the network anywhere and anytime. On the other hand, with the continuous development of big data, cloud computing, as a novel and efficient computing paradigm [3], can store and manage huge amounts of data for users. As a result, an increasing number of individuals and enterprises outsource their data to the cloud, promoting the growth of cloud computing.Cloud storage, a new storage mechanism evolved from cloud computing, can provide users with ubiquitous data storage and access services by centrally processing resources stored in its area. At the same time, by taking use of cloud storage’s services, customers not only save costs on local data storage and maintenance but also get access to and share data with greater ease. Therefore, cloud storage is widely used in people’s daily life due to its flexibility, convenience, and economy [4].In the medical field, cloud storage has the advantages of low cost, convenient deployment and efficient storage, and the operations on its platform are basically automated, making it the most ideal environment for deploying standard data security access and sharing mechanisms [5]. On the one hand, the generation, collection, storage, integration, and application of data are decentralized, and cloud storage makes it possible to obtain high-quality medical services through the collection, management, and utilization of these data. On the other hand, with the explosive growth of data and the development of Internet of Things technology, users can effectively save the cost of local data management and maintenance by outsourcing their massive medical data to the cloud for storage.In the secure access and sharing mechanism of medical data stored in the cloud, as long as users are authorized, they can obtain safe, convenient, and high-quality medical services in a timely manner by sharing corresponding medical resources in the cloud. This not only greatly improves the storage and sharing efficiency of medical information but also effectively solves the problems of the traditional medical model, such as few medical channels for users, high medical costs for users, and unreasonable medical services for users. Therefore, the secure access and sharing mechanism of cloud storage medical data has become a hot topic in the field of medical and health research [6].The basic model of secure accessing and sharing mechanism of medical data is shown in Figure1. In the secure accessing and sharing mechanism of cloud storage medical data, data owners first encrypt the medical data, by paying a fee, the obtained ciphertext can be hosted to the cloud storage center, and the cloud storage center uses access control technology to manage users’ permissions to the sharing data.Figure 1
Basic model of secure accessing and sharing mechanism of medical data based on cloud storage.However, patients’ medical data is sensitive and confidential; they may include social security numbers, credit card information, and treatment history. CSP cannot be fully trusted due to various attacks in an untrusted network environment. Once medical data leaked, it may cause serious medical accidents and economic losses, which restricts the application of medical data sharing [7–9]. Therefore, we need to address security and privacy issues when designing practical and secure EHR sharing systems adapted to the cloud environment.Access control (AC) [10], as a part of the secure accessing and sharing mechanism of medical data, plays a significant role in medical data protection. As in an untrusted cloud storage environment, data owners encrypt the medical data before storing it in the cloud and ensuring that data requesters with decryption capabilities may access the data, therefore realizing the security of medical data cloud storage. Traditional ciphertext AC techniques, however, are no longer suited for cloud-based data sharing due to issues such as low work efficiency, high computing costs, and large bandwidth. This problem has been significantly improved by the proposal of the ciphertext-policy attribute-based encryption (CP-ABE) technique. In CP-ABE, data owners define the AC to ensure that only the data requesters who meet the access policy can decrypt the corresponding ciphertext. This provides not just fine-grained AC but also “one-to-many” encryption. Therefore, with the help of CP-ABE, safe access control and sharing of cloud-storage medical data can be implemented.In secure accessing and sharing mechanism of medical data based on cloud storage, there are also a large number of scenarios where the ciphertext needs to be reencrypted. For example, ciphertext reencryption technology enables doctor Alice working inP city’s hospital to share a patient’s medical data with doctor Bob working in Q city’s hospital. The ciphertext reencryption technology also enables the doctor Alice, who is on leave, to share her patient’s medical data to another doctor Eve in the same hospital. The straightforward solution to reencryption the ciphertext is that Alice first downloads the ciphertext from the cloud, decrypts the ciphertext, and reencrypts the plaintext with the new access policy. After encryption, Alice uploads the new ciphertext to the cloud. When a large amount of patients’ ciphertexts need to be reencrypted, this method not only incurs large computing overhead but also increases the communication cost between the cloud and Alice. In order to share data more effectively, proxy reencryption (PRE) [11] is introduced into CP-ABE, which is called ciphertext-policy attribute-based proxy reencryption scheme (CP-ABPRE). In response to the above situation, Alice generates a reencryption key and sends the key to the proxy server. The proxy server can use the key to encrypt the original ciphertexts, so that Bob(Eve) can decrypt the encrypted ciphertext data and realize the sharing of medical data.In PRE, the ciphertext encrypted under A’s public key can be transformed into ciphertext encrypted under B’s public key by a semitrusted proxy, and the proxy will not get any information about the underlying encrypted medical data. By implementing the permission of decryption authority, CP-ABPRE can securely and effectively reencrypt ciphertexts and assure the secure access and sharing of medical data. Since the proxy only needs to verify that the attributes in the user-generated reencryption key satisfy the access policy of the original ciphertexts, the proxy server can reencrypt a batch of such ciphertexts. As a result of its great security and low computing overhead, this technology is suitable for a large number of ciphertext reencryption scenarios.Overall, CP-ABPRE can not only perform one-to-many encryption but it can also safely reencrypt the relevant ciphertexts. It is suitable for the sharing of medical data. For one thing, the proxy can reencrypt the ciphertexts corresponding to access policy A into access policy B without changing the plaintexts. This not only allows for fine-grained access control for medical data users, but it also assures the security of medical data stored in the cloud. In other words, the proxy does not have to decrypt the ciphertext and then reencrypt the plaintext during the whole process. Instead, it may simply complete the ciphertext conversion by directly performing operations on the ciphertexts, which considerably decreases the proxy’s computing cost. Therefore, CP-ABPRE is critical for the secure accessing and sharing mechanism of medical data in cloud storage.However, most of the existing CP-ABPRE schemes must have a trusted center or key generation center (KGC), and the keys are generated and maintained through the KGC. In addition, centralized KGCs are vulnerable to attacks such as a single point of failure, once KGC is compromised by malicious organizations, and it will lead to serious information leakage. Blockchain technology has the potential to tackle this issue effectively. This technology was invented by Nakamoto [12] in 2008, and it has gained global notice. The benefits of blockchain include distributed storage, nontampering, and traceability. As a result, it has a wide range of applications in a variety of industries, including finance, communications, and the Internet of Things. In this paper, blockchain is used to replace the traditional trusted center, and users’ keys are generated by consensus nodes and users themselves, which solves the problem of centralization of key generation in traditional CP-ABPRE.


## 2. Related Work

In the traditional public key cryptosystem, the data owner can encrypt the medical data with the public key so that only the data user with the corresponding private key can decrypt ciphertexts, which effectively solves the problem of key distribution. However, due to issues with certificate administration and key escrow, this approach is inapplicable when large-scale medical data owners need to exchange their data. At the same time, in most cases, data owners may not know the particular receivers but aim to accomplish fine-grained access control through strategies created by data owners. As a result, the standard public key cryptosystem is incapable of addressing the issue of data access and sharing in cloud storage.With the continuous development of cryptographic research, Sahai and Waters [13] prompted an ABE scheme in 2005. Subsequently, Goyal et al. [14] proposed a key-policy attribute-based encryption (KP-ABE) scheme, in which the access policy is bound to the user secret key, and the attribute set is related to the ciphertext. When the attribute set in the ciphertext satisfies the policy in the key, the ciphertext can be decrypted. Bethencourt et al. [15] proposed a ciphertext-policy attribute-based encryption (CP-ABE) scheme. In CP-ABE, the access policy is bound to the ciphertext while the attribute set is related to the user secret key. Only when the attribute set in the key satisfies the access policy in the ciphertext can the ciphertext be decrypted. Since the access policy can be defined by the data owner, CP-ABE is suitable for medical data sharing in cloud storage. In 2011, Waters [16] proposed a CP-ABE scheme that uses linear secret sharing scheme (LSSS). Compared with the scheme of Bethencourt et al. [15], the efficiency has been improved.In order to address the problem of access policy updating, in 2009, Liang et al. [17] proposed a ciphertext-policy attribute-based proxy reencryption (CP-ABPRE) scheme, which allows a proxy to reencrypt a ciphertext encrypted by policy A to policy B and the proxy cannot obtain any information about the plaintext. However, their scheme cannot resist choose plaintext attacks. To solve this problem, Liang et al. [18] proposed a proxy reencryption scheme based on CP-ABE in 2013, which can resist choose plaintext attacks. However, both the generation of the reencryption key and the reencryption ciphertext require a large amount of calculation. In 2016, Yang et al. [19] employed a cloud server to implement dynamic attribute-based access control, which greatly improved the efficiency of reencryption and reduced the user’s decryption overhead. However, the proposed scheme only supports tree access structure. In 2017, Feng et al. [20] prompted an attribute-based proxy reencryption (AB-PRE) scheme which supports LSSS, but it only supports AND gates. In the same year, Ma et al. [21] proposed a verifiable outsourced decryption scheme; the outsourced decryption operation was completed by a decryption server. In 2019, Xu et al. [22] proposed a novel healthcare IoT system fusing advantages of attribute-based encryption, cloud, and edge computing, which provides an efficient, flexible, secure fine-grained access control mechanism with data verification in healthcare IoT network without any secure channel and enables data users to enjoy the lightweight decryption. In 2020, Deng et al. [23] proposed an AB-PRE scheme that supports arbitrary monotonic access policies, but the reencrypted ciphertext only supports identity-based encryption (IBE), and the scalability of reencryption is not as good as ABE. In 2020, Paul et al. [24] proposed an efficient attribute-based proxy reencryption with constant size ciphertext, but his scheme did not support user revocation. In 2021, Xu et al. [25] proposed a practical and secure dynamic EHR sharing system via Cloud. The user decryption keys of the works above are all generated by the KGC. Once the KGC is compromised, it will cause serious information leakage.Blockchain was first proposed as the underlying technology of Bitcoin [12]. It is an open distributed public ledger. Due to the hash function and consensus protocol used in the blockchain, it can not only ensure the unforgeability of the data stored in it but also guarantees traceability. Any user can access all the data stored in the ledger, and it is impossible for a malicious user to tamper with this data. In 2017, Huh et al. [26] used public blockchain to manage IoT devices; all the public key of users are stored in blockchain. In 2017, Liu et al. [27] used private blockchain to ensure data integrity. In 2019, Hu et al. [28] proposed a blockchain-based data sharing scheme, a decentralized system is established based on smart contracts.


### 2.1. Contributions

In this paper, we proposed a blockchain-aided fine-grained medical data sharing scheme supporting ciphertext reencryption. The characteristics of the scheme are as follows.


#### 2.1.1. Blockchain-Aided ABE

The proposed scheme allows users to generate private keys by themselves. This prevents the usage of users’ private keys created by KGC in traditional schemes. The KGC in traditional ABE is replaced by the consensus nodes of the distributed consensus blockchain, and the immutable ledger can store transactions. The user’s public key and system public parameters can be uploaded to the blockchain to ensure that the data is not tampered with.


#### 2.1.2. Ciphertext Reencryption

The proposed scheme allows the cloud to reencrypt a ciphertext decryptable by user A into a ciphertext decryptable by user B without disclosing the plaintext or the authorizer’s private key. The complete procedure does not necessitate decryption.


#### 2.1.3. Collusion Resistance

The proposed scheme adopts the user’s Global Identifier (GID) to bind attributes of users. Only attributes belonging to the same user can decrypt the ciphertext, thereby preventing the system from colluding attacks.


#### 2.1.4. Lightweight Decryption and Verification

The proposed scheme allows the cloud to pre-decrypt the ciphertext, lowering the user’s computational cost in the decryption process. Data user can decrypt the final ciphertext with only one exponentiation computation, and the user can verify if the cloud has made the correct transformation.


#### 2.1.5. Efficient User Revocation

For situations such as the resignation of doctors and the recovery of patients, their access rights need to be revoked. The proposed scheme supports efficient user revocation.


### 2.2. Paper Organization

Section3 introduces the background knowledge. The system architecture model is formally defined in Section 4. Details of the proposed scheme are depicted in Section 5. Section 6 introduces the performance analysis. Ultimately, the conclusion is given in Section 7.


## 2.1. Contributions

In this paper, we proposed a blockchain-aided fine-grained medical data sharing scheme supporting ciphertext reencryption. The characteristics of the scheme are as follows.


### 2.1.1. Blockchain-Aided ABE

The proposed scheme allows users to generate private keys by themselves. This prevents the usage of users’ private keys created by KGC in traditional schemes. The KGC in traditional ABE is replaced by the consensus nodes of the distributed consensus blockchain, and the immutable ledger can store transactions. The user’s public key and system public parameters can be uploaded to the blockchain to ensure that the data is not tampered with.


### 2.1.2. Ciphertext Reencryption

The proposed scheme allows the cloud to reencrypt a ciphertext decryptable by user A into a ciphertext decryptable by user B without disclosing the plaintext or the authorizer’s private key. The complete procedure does not necessitate decryption.


### 2.1.3. Collusion Resistance

The proposed scheme adopts the user’s Global Identifier (GID) to bind attributes of users. Only attributes belonging to the same user can decrypt the ciphertext, thereby preventing the system from colluding attacks.


### 2.1.4. Lightweight Decryption and Verification

The proposed scheme allows the cloud to pre-decrypt the ciphertext, lowering the user’s computational cost in the decryption process. Data user can decrypt the final ciphertext with only one exponentiation computation, and the user can verify if the cloud has made the correct transformation.


### 2.1.5. Efficient User Revocation

For situations such as the resignation of doctors and the recovery of patients, their access rights need to be revoked. The proposed scheme supports efficient user revocation.


## 2.1.1. Blockchain-Aided ABE

The proposed scheme allows users to generate private keys by themselves. This prevents the usage of users’ private keys created by KGC in traditional schemes. The KGC in traditional ABE is replaced by the consensus nodes of the distributed consensus blockchain, and the immutable ledger can store transactions. The user’s public key and system public parameters can be uploaded to the blockchain to ensure that the data is not tampered with.


## 2.1.2. Ciphertext Reencryption

The proposed scheme allows the cloud to reencrypt a ciphertext decryptable by user A into a ciphertext decryptable by user B without disclosing the plaintext or the authorizer’s private key. The complete procedure does not necessitate decryption.


## 2.1.3. Collusion Resistance

The proposed scheme adopts the user’s Global Identifier (GID) to bind attributes of users. Only attributes belonging to the same user can decrypt the ciphertext, thereby preventing the system from colluding attacks.


## 2.1.4. Lightweight Decryption and Verification

The proposed scheme allows the cloud to pre-decrypt the ciphertext, lowering the user’s computational cost in the decryption process. Data user can decrypt the final ciphertext with only one exponentiation computation, and the user can verify if the cloud has made the correct transformation.


## 2.1.5. Efficient User Revocation

For situations such as the resignation of doctors and the recovery of patients, their access rights need to be revoked. The proposed scheme supports efficient user revocation.


## 2.2. Paper Organization

Section3 introduces the background knowledge. The system architecture model is formally defined in Section 4. Details of the proposed scheme are depicted in Section 5. Section 6 introduces the performance analysis. Ultimately, the conclusion is given in Section 7.


## 3. Preliminaries

### 3.1. Notations

Related notations and definitions used in the proposed scheme are presented in Table1.Table 1
Notations and definitions used in the proposed scheme.
NotationDefinitionpLarge primeG,GTCyclic group of orderpgGenerator ofGZpInteger domain not greater thanpeBilinear mapM,ρAccess policy(M is a matrix of l×n, ρ is a map)CSPCloud server providerMDOMedical data ownerMDUMedical data userλSecurity parameterAAttribute universeCNConsensus nodesHHash functionSESymmetric-key encryption algorithmGIDUser’s Global Identifier


### 3.2. Access Structures

LetP1,P2,⋯,Pn be the set of n participants. For set A⊆2P1,P2,⋯Pn, if ∀B,C⊆P1,P2,⋯Pn, B∈C, B⊆C⇒C∈A, then A is said to be monotonic. Among them, the set belonging to A is called authorized set; otherwise, it is called unauthorized set [29].


### 3.3. Bilinear Maps

LetG and GT be two multiplicative cyclic groups of order p. g is a generator of G and e:G×G⟶GT is a map with three properties: (1) bilinearity—for ∀u,v∈G and ∀a,b∈Zp, eua,vb=eu,vab; (2) nondegeneracy—eg,g≠1; and (3) computability—for all ∀u,v∈G, there exists effective algorithms to calculate eu,v.


### 3.4. Linear Secret Sharing Schemes

LetA denote the attribute university and p denote a prime number. The secret sharing scheme Π on the secret space Zp realizes the access policy on A. If Π satisfies the following two properties, then, Π is linear [30].
(1)
Each part of the secrets∈Zp corresponds to an attribute in A, and each part constitutes a vector on Zp(2)
For the access policyS=M,ρ, M is a l×n secret sharing matrix. The function ρ maps the ith∈1,2,⋯,l row of M to an attribute ρi of the attribute set A. For example, construct a column vector u=s,y2,y3,⋯,yn⊺, where y2,y3,⋯,yn∈Zp are random numbers used to hide the secret value s. Then, Mu∈Zpl×1 is a vector with l rows and 1 column. That is, the secret value s is divided into l parts according to Π. Mui corresponds to the attribute ρi, where i∈lEvery LSSS has linear reconstruction property. Suppose thatΠ is a LSSS for the access structure S. P∈S is the set of arbitrary authorization, I=i∈l∧ρi∈P and I⊆1,2,⋯,l. For any legal sharing of λi=Muii∈I, there exists a set of constants σi∈Zpi∈I that can be calculated in polynomial time. For the unauthorized set p′, there is no such constant set as σii∈I.


### 3.5. Blockchain Technology

Blockchain is a specific data structure based on transparent and trusted consensus rules in a peer-to-peer network. It combines data blocks in a chronological order to form a specific data structure. Blockchain cryptographically guarantees a decentralized and credible distributed shared ledger system whose data cannot be tampered with, forged or traced. Blockchain is mainly divided into three types: public blockchain, consortium blockchain, and private blockchain. The consortium blockchain usually designates one or more preselected consensus nodes as the bookkeeper. The generation of each block is jointly determined by all consensus nodes. The connected nodes can participate in activities on the chain but do not care about the process of accounting. The public blockchain adopts aproof of work mechanism to exchange efficiency for fairness. The private blockchain sets a single central accounting node to exchange fairness for efficiency. Compared with the public blockchain and private blockchain, the participants in the consortium blockchain know each other’s digital identities and can reach business consensus in advance. The proof-of-work mechanism is no longer needed; thus, this can reduce energy consumption and improve efficiency. Since the consortium blockchain takes into account both efficiency and fairness, it is considered by many researchers to be the most suitable blockchain for medical data sharing application scenarios.


### 3.6. Random Oracle Model

The random oracle model (ROM) was proposed in 1993 [31]; the ROM uses the character of a random oracle to show the security of the algorithm. The random oracle can be considered a black box in theory, and the black box is embedded with a certain algorithm so that the inquirer cannot obtain any information no matter how many inquiries are made. Among them, the returned value is collision resistant, the value is the same for the same query, and the value is unpredictable for different queries. The random oracle H:0,1∗⟶0,1n is a specific type of hash function, and the function satisfies the following characteristics:
(1)
Uniformity: given the resulty after H operation, the distribution of y on 0,1n is uniform.(2)
Effectiveness: given a stringx, 𝐻 can do certain operations to get Hx. Hx is the effective output of H in low-order polynomial time of x length.(3)
Certainty: if the two numbers input by the oracleH are the same, then the two corresponding outputs must be the same.


### 3.7. q-DBPBDHE2 Assumption

The system selects two multiplicative cyclic groupsG and GT whose order is prime p, g is the generator of group G, and e:G×G⟶GT is a bilinear mapping. The system randomly selects a,s,b1,bq∈Zp∗ and R∈GT. The system defines a vector D=p,g,G,e,gs,gaii∈2q,i≠q+1,gbjaii,j∈2q,q,i≠q+1,gs/bii∈q,gsbjai/bj′i,j,j′∈q+1,q,q,j≠j′. If the adversary cannot distinguish a random factor R∈GT from eg,gaq+1s with a nonnegligible advantage ε in probabilistic polynomial time (PPT), then q-DBPBDHE2 assumption establish. Advantage ε is defined as PrAD,eg,gaq+1s=0−PrAD,R=0≥ε.


## 3.1. Notations

Related notations and definitions used in the proposed scheme are presented in Table1.Table 1
Notations and definitions used in the proposed scheme.
NotationDefinitionpLarge primeG,GTCyclic group of orderpgGenerator ofGZpInteger domain not greater thanpeBilinear mapM,ρAccess policy(M is a matrix of l×n, ρ is a map)CSPCloud server providerMDOMedical data ownerMDUMedical data userλSecurity parameterAAttribute universeCNConsensus nodesHHash functionSESymmetric-key encryption algorithmGIDUser’s Global Identifier


## 3.2. Access Structures

LetP1,P2,⋯,Pn be the set of n participants. For set A⊆2P1,P2,⋯Pn, if ∀B,C⊆P1,P2,⋯Pn, B∈C, B⊆C⇒C∈A, then A is said to be monotonic. Among them, the set belonging to A is called authorized set; otherwise, it is called unauthorized set [29].


## 3.3. Bilinear Maps

LetG and GT be two multiplicative cyclic groups of order p. g is a generator of G and e:G×G⟶GT is a map with three properties: (1) bilinearity—for ∀u,v∈G and ∀a,b∈Zp, eua,vb=eu,vab; (2) nondegeneracy—eg,g≠1; and (3) computability—for all ∀u,v∈G, there exists effective algorithms to calculate eu,v.


## 3.4. Linear Secret Sharing Schemes

LetA denote the attribute university and p denote a prime number. The secret sharing scheme Π on the secret space Zp realizes the access policy on A. If Π satisfies the following two properties, then, Π is linear [30].
(1)
Each part of the secrets∈Zp corresponds to an attribute in A, and each part constitutes a vector on Zp(2)
For the access policyS=M,ρ, M is a l×n secret sharing matrix. The function ρ maps the ith∈1,2,⋯,l row of M to an attribute ρi of the attribute set A. For example, construct a column vector u=s,y2,y3,⋯,yn⊺, where y2,y3,⋯,yn∈Zp are random numbers used to hide the secret value s. Then, Mu∈Zpl×1 is a vector with l rows and 1 column. That is, the secret value s is divided into l parts according to Π. Mui corresponds to the attribute ρi, where i∈lEvery LSSS has linear reconstruction property. Suppose thatΠ is a LSSS for the access structure S. P∈S is the set of arbitrary authorization, I=i∈l∧ρi∈P and I⊆1,2,⋯,l. For any legal sharing of λi=Muii∈I, there exists a set of constants σi∈Zpi∈I that can be calculated in polynomial time. For the unauthorized set p′, there is no such constant set as σii∈I.


## 3.5. Blockchain Technology

Blockchain is a specific data structure based on transparent and trusted consensus rules in a peer-to-peer network. It combines data blocks in a chronological order to form a specific data structure. Blockchain cryptographically guarantees a decentralized and credible distributed shared ledger system whose data cannot be tampered with, forged or traced. Blockchain is mainly divided into three types: public blockchain, consortium blockchain, and private blockchain. The consortium blockchain usually designates one or more preselected consensus nodes as the bookkeeper. The generation of each block is jointly determined by all consensus nodes. The connected nodes can participate in activities on the chain but do not care about the process of accounting. The public blockchain adopts aproof of work mechanism to exchange efficiency for fairness. The private blockchain sets a single central accounting node to exchange fairness for efficiency. Compared with the public blockchain and private blockchain, the participants in the consortium blockchain know each other’s digital identities and can reach business consensus in advance. The proof-of-work mechanism is no longer needed; thus, this can reduce energy consumption and improve efficiency. Since the consortium blockchain takes into account both efficiency and fairness, it is considered by many researchers to be the most suitable blockchain for medical data sharing application scenarios.


## 3.6. Random Oracle Model

The random oracle model (ROM) was proposed in 1993 [31]; the ROM uses the character of a random oracle to show the security of the algorithm. The random oracle can be considered a black box in theory, and the black box is embedded with a certain algorithm so that the inquirer cannot obtain any information no matter how many inquiries are made. Among them, the returned value is collision resistant, the value is the same for the same query, and the value is unpredictable for different queries. The random oracle H:0,1∗⟶0,1n is a specific type of hash function, and the function satisfies the following characteristics:
(1)
Uniformity: given the resulty after H operation, the distribution of y on 0,1n is uniform.(2)
Effectiveness: given a stringx, 𝐻 can do certain operations to get Hx. Hx is the effective output of H in low-order polynomial time of x length.(3)
Certainty: if the two numbers input by the oracleH are the same, then the two corresponding outputs must be the same.


## 3.7. q-DBPBDHE2 Assumption

The system selects two multiplicative cyclic groupsG and GT whose order is prime p, g is the generator of group G, and e:G×G⟶GT is a bilinear mapping. The system randomly selects a,s,b1,bq∈Zp∗ and R∈GT. The system defines a vector D=p,g,G,e,gs,gaii∈2q,i≠q+1,gbjaii,j∈2q,q,i≠q+1,gs/bii∈q,gsbjai/bj′i,j,j′∈q+1,q,q,j≠j′. If the adversary cannot distinguish a random factor R∈GT from eg,gaq+1s with a nonnegligible advantage ε in probabilistic polynomial time (PPT), then q-DBPBDHE2 assumption establish. Advantage ε is defined as PrAD,eg,gaq+1s=0−PrAD,R=0≥ε.


## 4. System Architecture

### 4.1. Functionalities of Each Entity

The proposed scheme includes 4 entities. As shown in Figure2, they are consensus node (CN), cloud server provider (CSP), medical data owner (MDO), and medical data user (MDU).Figure 2
System model.


#### 4.1.1. Consensus Node

Consensus nodes are the maintainer of the consortium blockchain. Each consensus node manages the attributes of MDUs, initializing the system, generating transfer keys for MDU, and maintaining a revocation list.


#### 4.1.2. Cloud Server Provider

CSP is responsible for storing ciphertext and managing the attribute transfer keys for each user. CSP receives the reencryption key and generates the corresponding reencryption ciphertext. CSP also performs outsourcing decryption for MDU. Furthermore, CSP needs to revoke illegal users in the system.


#### 4.1.3. Medical Data Owner

MDO first encrypts medical data with a symmetric key encryption algorithm, then encrypts the symmetric-key with a CP-ABPRE, and finally uploads the ciphertext to the CSP.


#### 4.1.4. Medical Data User

MDU with sufficient attributes can request the CSP to perform the semidecryption algorithm and then decrypt the semidecrypted ciphertext with their own private key efficiently. MDU also generates a reencryption key and uploads it to the CSP. It is worth noting that the MDU can only obtain the semidecrypted ciphertext after outsourcing decryption of the CSP but cannot obtain the original ciphertext in the CSP.


### 4.2. Formal Definition

(1)
GlobalSetupλ,A⟶PP,R: the algorithm inputs the security parameters λ according to the security requirements of the scheme and attribute universe A and outputs the system public parameter PP, an empty revocation list R.(2)
NodeSetupPP,η⟶NPKη,NSKη: this algorithm takes the public parameters PP and CN’s identity η as input and outputs CN’s node public key NPKη and node secret key NSKη.(3)
UserKeyGenPP,GID⟶UPK,USK: the algorithm inputs the PP and user GID and outputs the user public key UPK and user private key USK.(4)
TKGenPP,GID,S,NSKη,UPK⟶TKS,GID: the algorithm inputs the public parameter PP, user GID, user attribute set S, node secret key NSKη and user public key UPK and outputs the user’s transfer key TKS,GID. CN sends it to the user and CSP; CSP adds GID,TKS,GID to the key list KT.(5)
EncPP,m,M,ρ,NPKη⟶CT: this algorithm inputs the public parameter PP, a EHR plaintext m, an access policy M,ρ, and node public key NPKη and outputs the ciphertext CT.(6)
ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′: this algorithm inputs the public parameter PP, transfer key TKS,GID, user private key USK, node public key NPKη, user attribute set S, and a new access policy M′,ρ′ and outputs the reencryption key ReKeyS,GID⟶M′,ρ′.(7)
ReEncPP,ReKeyS,GID⟶M′,ρ′,CT⟶CM′,ρ′R: this algorithm inputs the public parameter PP, reencryption key ReKeyS,GID⟶M′,ρ′, and ciphertext CT and outputs the reencryption ciphertext CM′,ρ′R.(8)
TransDecPP,CT,S,TKS,GID,UPK⟶CTGID: this algorithm inputs the public parameter PP, ciphertext CT, user attribute set S, transform key TKS,GID, and user public key UPK and outputs the semidecrypted ciphertext CTGID.(9)
UserDecUSK,CTGID⟶m: this algorithm inputs the user private key USK and outputs the plaintext m.(10)
TransDecRPP,CM′,ρ′R,S′,TKS′,GID⟶CTGID′: this algorithm inputs the public parameter PP, ciphertext CM′,ρ′R, user attribute set S′, and transform key TKS′,GID and outputs the semidecrypted ciphertext CTGID′.(11)
UserDecRPP,USK,CTGID′⟶m: this algorithm inputs the public parameter PP, user private key USK, and semidecrypted ciphertext CTGID′ and outputs the plaintext m(12)
RevokeGID,R,KT⟶R,KT/GID,TKS,GID: this algorithm inputs the identity of the revoked user GID, revocation list R, and key list KT and outputs an updated revocation list R′ and an updated key list KT/GID,TKS,GID.


### 4.3. Threat Model

In the system, consensus nodes and MDO are fully trusted. Each consensus node manages the attributes of MDUs, initializing the system, generating transfer keys for MDU, and maintaining a revocation list. MDO honestly encrypts medical data and generates ciphertext according to its own wishes and uploads it to CSP.The CSP is semitrusted. CSP is semitrusted, and it follows our scheme but tries to learn sensitive data without any active attack. In addition to this, CSP may also dishonestly decrypt ciphertext for MDU to ease the burden of data storage or for any other reason.MDU are untrusted. MDU try to learn about unauthorized data and even try to collude with other MDU to gain access to sensitive data. To prevent attacks from untrusted DUs, we apply cryptosystems to ensure data confidentiality.From the above, the security of our proposed scheme depends on the blockchain and cryptosystem. As we all know, all data stored on the blockchain cannot be tampered with. The cryptosystems in our scheme are hash functions, symmetric encryption, and our scheme. We apply a collision-resistant hash function to prevent adversaries from compromising data integrity. Symmetric encryption is known to be resistant to all kinds of attacks. For the security of our scheme, we propose a formal security model in the next subsection to demonstrate the security of our scheme.


### 4.4. Security Model

The security model of the proposed scheme is a static security model. The static security model satisfies the confidentiality of messages; it can be defined by a security game between an adversaryAdv and a challenger C. The game is performed in the form of query-answer between Adv and C. All inquiries must be completed before the challenge phase. Since static security model of the scheme is mainly aimed at the collusion attack of multiple legitimate MDUs, it is required that Adv can ask the MDU for the private key many times and ask other legitimate MDUs: GID to partially decrypt the ciphertext CTGID. The implementation of the latter is based on that Adv can ask CSP for the corresponding transform key, so that Adv can obtain the GID’s CTGID according to the transform key of CSP.Definition 1.
Given a probabilistic polynomial time, if there is no one adversaryAdv can win the following game with a nonnegligible advantage, the proposed scheme is static security. In the game, A represents attribute universe of the protocol, and θ represents the consensus node set. Assume that each attribute is assigned to a consensus node (although each consensus node can manage multiple properties).The game consists of the following 4 phases.(1)
Initialization phase: the initialization phase is performed by challengeC. C inputs λ according to security requirements. Then, the GlobalSetup algorithm is performed, and the public parameter PP is sent to Adv.(2)
Query phase: define consensus nodes asNθ. Adv does the following query to C.(i)
Query 1:Adv chooses some Nθ; Adv asks C for their corresponding public key NPKθ.(ii)
Query 2:Adv selects some MDUs’ GIDii=1m and asks for their key pairs UPKi,USKii=1m.(iii)
Query 3:Adv asks C for the transfer key: input MDUs’ GIDi1≤i≤n and their attribute sets Si∈A; C performs TKGenPP,GID,S,NSKθ,UPK⟶TKS,GID to generate transfer key TKS,GID. Then, C returns TKS,GID to Adv. At the same time, the query made by Adv includes not only the query to obtain the transfer key corresponding to the MDUs’ GIDi but also the query to obtain the transfer key corresponding to other MDUs (that is, if 𝑛 is larger than 𝑚).(iv)
Query 4:Adv asks C for reencryption key: input user GIDi1≤i≤n, user attribute sets Si∈A, and access policy M′,ρ′; C performs ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′ to generate reencryption key ReKeyS,GID⟶M′,ρ′. Then, C returns ReKeyS,GID⟶M′,ρ′ to Adv. TKS,GID is generated by TKGen algorithm.(3)
Challenge phase:Adv submits two equal-length plaintexts M0∗, M1∗, and an access policy M∗,ρ∗ to C. C randomly selects b∈0,1 and executes Enc algorithm to calculate challenge ciphertext and return it to Adv. The limitation is that the GIDi1≤i≤m of the user who asked for the private key during the query; their attribute set Si does not satisfy M∗,ρ∗.(4)
Guess phase:Adv outputs guess b′∈0,1 on b. If b=b′, Adv wins the game. The advantage of Adv winning is defined as Prb=b′−1/2.


## 4.1. Functionalities of Each Entity

The proposed scheme includes 4 entities. As shown in Figure2, they are consensus node (CN), cloud server provider (CSP), medical data owner (MDO), and medical data user (MDU).Figure 2
System model.


### 4.1.1. Consensus Node

Consensus nodes are the maintainer of the consortium blockchain. Each consensus node manages the attributes of MDUs, initializing the system, generating transfer keys for MDU, and maintaining a revocation list.


### 4.1.2. Cloud Server Provider

CSP is responsible for storing ciphertext and managing the attribute transfer keys for each user. CSP receives the reencryption key and generates the corresponding reencryption ciphertext. CSP also performs outsourcing decryption for MDU. Furthermore, CSP needs to revoke illegal users in the system.


### 4.1.3. Medical Data Owner

MDO first encrypts medical data with a symmetric key encryption algorithm, then encrypts the symmetric-key with a CP-ABPRE, and finally uploads the ciphertext to the CSP.


### 4.1.4. Medical Data User

MDU with sufficient attributes can request the CSP to perform the semidecryption algorithm and then decrypt the semidecrypted ciphertext with their own private key efficiently. MDU also generates a reencryption key and uploads it to the CSP. It is worth noting that the MDU can only obtain the semidecrypted ciphertext after outsourcing decryption of the CSP but cannot obtain the original ciphertext in the CSP.


## 4.1.1. Consensus Node

Consensus nodes are the maintainer of the consortium blockchain. Each consensus node manages the attributes of MDUs, initializing the system, generating transfer keys for MDU, and maintaining a revocation list.


## 4.1.2. Cloud Server Provider

CSP is responsible for storing ciphertext and managing the attribute transfer keys for each user. CSP receives the reencryption key and generates the corresponding reencryption ciphertext. CSP also performs outsourcing decryption for MDU. Furthermore, CSP needs to revoke illegal users in the system.


## 4.1.3. Medical Data Owner

MDO first encrypts medical data with a symmetric key encryption algorithm, then encrypts the symmetric-key with a CP-ABPRE, and finally uploads the ciphertext to the CSP.


## 4.1.4. Medical Data User

MDU with sufficient attributes can request the CSP to perform the semidecryption algorithm and then decrypt the semidecrypted ciphertext with their own private key efficiently. MDU also generates a reencryption key and uploads it to the CSP. It is worth noting that the MDU can only obtain the semidecrypted ciphertext after outsourcing decryption of the CSP but cannot obtain the original ciphertext in the CSP.


## 4.2. Formal Definition

(1)
GlobalSetupλ,A⟶PP,R: the algorithm inputs the security parameters λ according to the security requirements of the scheme and attribute universe A and outputs the system public parameter PP, an empty revocation list R.(2)
NodeSetupPP,η⟶NPKη,NSKη: this algorithm takes the public parameters PP and CN’s identity η as input and outputs CN’s node public key NPKη and node secret key NSKη.(3)
UserKeyGenPP,GID⟶UPK,USK: the algorithm inputs the PP and user GID and outputs the user public key UPK and user private key USK.(4)
TKGenPP,GID,S,NSKη,UPK⟶TKS,GID: the algorithm inputs the public parameter PP, user GID, user attribute set S, node secret key NSKη and user public key UPK and outputs the user’s transfer key TKS,GID. CN sends it to the user and CSP; CSP adds GID,TKS,GID to the key list KT.(5)
EncPP,m,M,ρ,NPKη⟶CT: this algorithm inputs the public parameter PP, a EHR plaintext m, an access policy M,ρ, and node public key NPKη and outputs the ciphertext CT.(6)
ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′: this algorithm inputs the public parameter PP, transfer key TKS,GID, user private key USK, node public key NPKη, user attribute set S, and a new access policy M′,ρ′ and outputs the reencryption key ReKeyS,GID⟶M′,ρ′.(7)
ReEncPP,ReKeyS,GID⟶M′,ρ′,CT⟶CM′,ρ′R: this algorithm inputs the public parameter PP, reencryption key ReKeyS,GID⟶M′,ρ′, and ciphertext CT and outputs the reencryption ciphertext CM′,ρ′R.(8)
TransDecPP,CT,S,TKS,GID,UPK⟶CTGID: this algorithm inputs the public parameter PP, ciphertext CT, user attribute set S, transform key TKS,GID, and user public key UPK and outputs the semidecrypted ciphertext CTGID.(9)
UserDecUSK,CTGID⟶m: this algorithm inputs the user private key USK and outputs the plaintext m.(10)
TransDecRPP,CM′,ρ′R,S′,TKS′,GID⟶CTGID′: this algorithm inputs the public parameter PP, ciphertext CM′,ρ′R, user attribute set S′, and transform key TKS′,GID and outputs the semidecrypted ciphertext CTGID′.(11)
UserDecRPP,USK,CTGID′⟶m: this algorithm inputs the public parameter PP, user private key USK, and semidecrypted ciphertext CTGID′ and outputs the plaintext m(12)
RevokeGID,R,KT⟶R,KT/GID,TKS,GID: this algorithm inputs the identity of the revoked user GID, revocation list R, and key list KT and outputs an updated revocation list R′ and an updated key list KT/GID,TKS,GID.


## 4.3. Threat Model

In the system, consensus nodes and MDO are fully trusted. Each consensus node manages the attributes of MDUs, initializing the system, generating transfer keys for MDU, and maintaining a revocation list. MDO honestly encrypts medical data and generates ciphertext according to its own wishes and uploads it to CSP.The CSP is semitrusted. CSP is semitrusted, and it follows our scheme but tries to learn sensitive data without any active attack. In addition to this, CSP may also dishonestly decrypt ciphertext for MDU to ease the burden of data storage or for any other reason.MDU are untrusted. MDU try to learn about unauthorized data and even try to collude with other MDU to gain access to sensitive data. To prevent attacks from untrusted DUs, we apply cryptosystems to ensure data confidentiality.From the above, the security of our proposed scheme depends on the blockchain and cryptosystem. As we all know, all data stored on the blockchain cannot be tampered with. The cryptosystems in our scheme are hash functions, symmetric encryption, and our scheme. We apply a collision-resistant hash function to prevent adversaries from compromising data integrity. Symmetric encryption is known to be resistant to all kinds of attacks. For the security of our scheme, we propose a formal security model in the next subsection to demonstrate the security of our scheme.


## 4.4. Security Model

The security model of the proposed scheme is a static security model. The static security model satisfies the confidentiality of messages; it can be defined by a security game between an adversaryAdv and a challenger C. The game is performed in the form of query-answer between Adv and C. All inquiries must be completed before the challenge phase. Since static security model of the scheme is mainly aimed at the collusion attack of multiple legitimate MDUs, it is required that Adv can ask the MDU for the private key many times and ask other legitimate MDUs: GID to partially decrypt the ciphertext CTGID. The implementation of the latter is based on that Adv can ask CSP for the corresponding transform key, so that Adv can obtain the GID’s CTGID according to the transform key of CSP.Definition 1.
Given a probabilistic polynomial time, if there is no one adversaryAdv can win the following game with a nonnegligible advantage, the proposed scheme is static security. In the game, A represents attribute universe of the protocol, and θ represents the consensus node set. Assume that each attribute is assigned to a consensus node (although each consensus node can manage multiple properties).The game consists of the following 4 phases.(1)
Initialization phase: the initialization phase is performed by challengeC. C inputs λ according to security requirements. Then, the GlobalSetup algorithm is performed, and the public parameter PP is sent to Adv.(2)
Query phase: define consensus nodes asNθ. Adv does the following query to C.(i)
Query 1:Adv chooses some Nθ; Adv asks C for their corresponding public key NPKθ.(ii)
Query 2:Adv selects some MDUs’ GIDii=1m and asks for their key pairs UPKi,USKii=1m.(iii)
Query 3:Adv asks C for the transfer key: input MDUs’ GIDi1≤i≤n and their attribute sets Si∈A; C performs TKGenPP,GID,S,NSKθ,UPK⟶TKS,GID to generate transfer key TKS,GID. Then, C returns TKS,GID to Adv. At the same time, the query made by Adv includes not only the query to obtain the transfer key corresponding to the MDUs’ GIDi but also the query to obtain the transfer key corresponding to other MDUs (that is, if 𝑛 is larger than 𝑚).(iv)
Query 4:Adv asks C for reencryption key: input user GIDi1≤i≤n, user attribute sets Si∈A, and access policy M′,ρ′; C performs ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′ to generate reencryption key ReKeyS,GID⟶M′,ρ′. Then, C returns ReKeyS,GID⟶M′,ρ′ to Adv. TKS,GID is generated by TKGen algorithm.(3)
Challenge phase:Adv submits two equal-length plaintexts M0∗, M1∗, and an access policy M∗,ρ∗ to C. C randomly selects b∈0,1 and executes Enc algorithm to calculate challenge ciphertext and return it to Adv. The limitation is that the GIDi1≤i≤m of the user who asked for the private key during the query; their attribute set Si does not satisfy M∗,ρ∗.(4)
Guess phase:Adv outputs guess b′∈0,1 on b. If b=b′, Adv wins the game. The advantage of Adv winning is defined as Prb=b′−1/2.


## 5. Proposed Scheme

### 5.1. Concrete Construction

This section will give the design of the protocol. To better understand the protocol, the access policy of the protocol is represented by a two-tupleM,ρ, where M is a matrix of l×n and ρ maps each row of M to an attribute ρx. At the same time, define a function F:A⟶Aη; A represents attribute universe of the protocol, and Aη represents attributes managed by a consensus node (CN) with identity η: CNη; this function can implement the mapping of the attribute u∈A to CNη. The corresponding function δ∙=Fρ∙can realize the mapping of the rows of the matrix to a consensus node. The concrete construction is as follows:
(1)
GlobalSetupλ,A⟶PP,R: the GlobalSetup algorithm is performed by all CNs. They take a security parameter λ and system attribute universe A as input and outputs system public parameter PP, an empty revocation list R. The algorithm randomly selects a security parameter λ. Let G and GT be two multiplicative cyclic groups with prime order p, g be a generator of G, K be the key space of symmetric encryption, ande:G×G⟶GT be a nondegenerate bilinear pair. The algorithm selects 4 safety hash functions: H1:0,1∗⟶G, H2:GT⟶Zp∗, H3:A⟶G, and H4:0,1∗⟶K, and a symmetric-key encryption algorithm: SE=SE.Enc∙,SE.Dec∙. In SE, SE.Enc∙ is a symmetric encryption algorithm. At last, CNs output global public parameters PP=p,G,GT,g,e,H1,H2,H3,H4,SE,A,Aη, an empty revocation list R, and sends them to the blockchain.(2)
NodeSetupPP,η⟶NPKη,NSKη: the NodeSetup algorithm is performed by all CNs. Each CNη takes public parameters PP and identity η as input, output node public key NPKη, and node secret key NSKη. Each CNη randomly selects αη,yη∈Zp∗ and computes eg,gαη,gαη,gyη. They keep NSKη=αη,yη confidential and publish NPKη=eg,gαη,gαη,gyη.(3)
UserKeyGenPP,GID⟶UPK,USK: MDU performs the UserKeyGen algorithm. The algorithm inputs PP and user GID and outputs MDU’s user public key UPK and user private key USK. The algorithm randomly selects xGID∈Zp∗ and computes K1=gxGID, K2=H1GIDxGID. It sets UPK=K1,K2 and USK=xGID.(4)
TKGenPP,GID,S,NSKη,UPK⟶TKS,GID: CN performs the TKGen algorithm. The algorithm inputs public parameter PP, user GID, user attribute set S, node secret keyNSKη, and user public key UPK and outputs transfer key TKS,GID. For all attributes, u∈A, if u is managed by CNη. Then CNη randomly selects tu∈Zp∗ and computes CSKu,GID=gxGIDαη∙H1GIDxGIDyη∙H3utu and CSKu,GID′=gtu. Then, CNη sets TKS,GID=CSKu,GID,CSKu,GID′u∈S and sends it to MDU and CSP. CSP adds GID,TKS,GID to the key list KT.(5)
EncPP,m,M,ρ,NPKη⟶CT: MDO performs the Enc algorithm. Let M be a l×n matrix and ρ be the function that maps each row of M to an attribute. The algorithm randomly selects Y∈GT and sets key=H4Y, selects a positive integer ϖ, and concatenates ϖ bit 0 string after the message m, which is used for outsourced decryption verification. The algorithm uses the SE.Enc algorithm to obtain the ciphertext of the message m: MSE=SE.Enckeym0ϖ, where || denotes concatenation of a string. Then, it computes Ver=H1m0ϖ.The algorithm randomly selects s,y2,⋯,yn,z2,⋯,zn∈Zp∗ and sets vector v=s,y2,⋯yn⊺, ω=0,z2,⋯,zn⊺. For x∈l, the algorithm randomly selects Qx,Rx,rx∈Zp∗ and computes C0=Y∙eg,gs, C1,x=gQxgαδxrx,C2,x=g−rx, C3,x=gyδxrxgRx, C4,x=H3ρxrx, λx=Mvx, ωx=Mωx, C5,x=λx−Qx, and C6,x=ωx−Rx. The algorithm uploads CT=M,ρ,C0,C1,x,C2,x,C3,x,C4,x,C5,x,C6,xx∈l,MSE to CSP and uploads Ver to blockchain.(6)
ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′: MDU performs the ReKeyGen algorithm. It inputs public parameter PP, transfer key TKS,GID, user private key USK, node public key NPKη, user attribute set S, and a new access policy M′,ρ′ and outputs reencryption key ReKeyS,GID⟶M′,ρ′. The algorithm randomly selects s′,y2′,⋯,yn′,z2′,⋯,zn′,rx′∈Zp∗,β∈GT and sets two vectors v′=s′,y2′,⋯,yn′⊺ and ω′=0,z2′,⋯,zn′⊺. Then, for x∈l′, the algorithm sets λx′=M′v′x and ωx′=M′ω′x. The algorithm computes C0′=β∙eg,gs′, C1,x′=gλx′gαδ′xrx′, C2,x′=g−rx′, C3,x′=gyδ′xrx′gωx′, and C4,x′=H3ρ′xrx′ and then sets rk1=CSKu,GIDxGID−1H2β, rk2=CSKu,GID′xGID−1H2β, rk3=gH2β, rk4=H1GIDxGIDxGID−1H2β, and rk5=M′,ρ′,C0′,C1,x′,C2,x′,C3,x′,C4,x′x∈l′. Finally, the algorithm generates ReKeyS,GID⟶M′,ρ′=S,rk1,rk2,rk3,rk4,rk5 and sends ReKeyS,GID⟶M′,ρ′ to CSP.(7)
ReEncPP,ReKeyS,GID⟶M′,ρ′,CT⟶CM′,ρ′R: CSP performs the ReEnc algorithm. It inputs public parameter PP, reencryption key ReKeyS,GID⟶M′,ρ′, and ciphertext CT and outputs reencryption ciphertext CM′,ρ′R. After receiving ReKeyS,GID⟶M′,ρ′ sent by the MDU, the algorithm will check whether the attribute set S in ReKeyS,GID⟶M′,ρ′ matches the access policy M,ρ in CT. If S does not match M,ρ, it indicates ReKeyS,GID⟶M′,ρ′ is illegal, and CSP terminates the reencryption operation. If S matches M,ρ, the algorithm performs the following steps to compute the reencrypted ciphertext CM′,ρ′R. The algorithm sets I=x:ρx∈S⊆1,2,⋯,l and computes constant cx∈Zp∗ to let ∑x∈lcxMx=1,0,..,0. Then, the algorithm computes C4=∏x∈IeC1,xgC5,x,rk3cx and C5=∏x∈Ierk1,C2,xerk4,C3,xgC6,xerk2,C4,xcx and then computes C6=C4∙C5=eg,gsH2β. Finally, the algorithm outputs CM′,ρ′R=M′,ρ′,C0,C6,rk5,MSE.(8)
TransDecPP,CT,S,TKS,GID,UPK⟶CTGID: CSP performs the TransDec algorithm. It inputs public parameter PP, ciphertext CT, user attribute set S, transform key TKS,GID, and user public key UPK and outputs semidecrypted ciphertext CTGID. The algorithm checks whether S matches M,ρ in CT; if S does not match M,ρ, it aborts; otherwise, the algorithm lets I=x:ρx∈S⊆1,2,⋯,l and computes cx∈Zp∗ to let ∑x∈lcxMx=1,0,..,0. Thus, ∑x∈lλxcx=s, ∑x∈lωxcx=0. The algorithm computes C1,GID=∏x∈IeC1,xgC5,x,gcx and C2,GID=∏x∈IeCSKρx,GID,C2,x×eH1GIDxGID,C3,xgC6,xeCSKρx,GID′,C4,xcx. The algorithm sends semidecrypted ciphertext CTGID=C0,C1,GID,C2,GID,MSE to MDU.(9)
UserDecUSK,CTGID⟶m: this algorithm is performed by MDU; MDU uses USK to decrypt CTGID and obtains m. The algorithm computes C1,GIDC2,GID1/xGID=eg,gs. It recovers Y=C0/eg,gs and computes key=H4Y, m′=SE.DeckeyMSE. The algorithm checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then, it checks if H1m′=Ver (Ver can be obtained in blockchain); if it is, the message m can be obtained by truncating ϖ-bit 0 string. Otherwise, CSP is dishonest to return an incorrect semidecrypted ciphertext, and algorithm outputs ⊥.(10)
TransDecRPP,CM′,ρ′R,S′,TKS′,GID⟶CTGID′: CSP performs the TransDecR algorithm. It inputs public parameter PP, ciphertext CM′,ρ′R, user attribute set S′, and transform key TKS′,GID and outputs semidecrypted ciphertext CTGID′. The algorithm checks whether S′ matches M′,ρ′ in CM′,ρ′R; if S′ does not match M′,ρ′, it aborts. Otherwise, the algorithm performs the following steps: CSP let I′=x:ρ′x∈S′⊆1,2,⋯,l′ and computes cx′∈Zp∗ to let ∑x∈l′cx′Mx′=1,0,..,0. It then computes C1,GID′=∏x∈I′eC1,x′,gcx′ and C2,GID′=∏x∈I′eCSKρ′x,GID′,C2,x′eH1GID′xGID′,C3,x′×eCSKρ′x,GID′,C4,x′cx′. The algorithm sends semidecrypted ciphertext CTGID′=C0,C0′,C6,C1,GID′,C2,GID′,MSE to MDU.(11)
UserDecRPP,USK,CTGID′⟶m: This algorithm is performed by MDU; it inputs PP,USK,CTGID′ to decrypt CTGID′ to obtain m. The algorithm uses USK to compute β=β∙eg,gs′/eg,gs′ and then recoversY=C0/C61/H2β. MDU computes key=H4Y and m′=SE.DeckeyMSE. The algorithm then checks if there is a redundancy 0ϖ appended after m′, if it is, m′=m0ϖ. Then, it checks if H1m′=Ver (Ver can be obtained in blockchain), if it is, the message m can be acquired by omitting ϖ-bit 0 string. If not, CSP is dishonest to return an incorrect semidecrypted ciphertext and the algorithm outputs ⊥.(12)
RevokeGID,R,KT⟶R′,KT/GID,TKS,GID: the algorithm is performed by CN and CSP; CN first updates R and uploads the latest R′ to blockchain. CSP checks the latest R′ in blockchain and inputs malicious user’s GID in R′ and KT and outputs an updated KT/GID,TKS,GID. If the user’s GID needs to be revoked, CSP will find {GID,TKS,GID} in KT and delete GID,TKS,GID in KT.


### 5.2. Correctness

#### 5.2.1. Correctness of Decryption of Original CiphertextCT

The CSP checks whetherS matches M,ρ in CT; if S does not match M,ρ, it aborts; otherwise, the algorithm lets I=x:ρx∈S⊆1,2,⋯,l and computes cx∈Zp∗ to let ∑x∈lcxMx=1,0,..,0. Thus, ∑x∈lλxcx=s, ∑x∈lωxcx=0. There is η=δx=Fρx. CSP computes formula (3) to acquire C1,GID.
(1)C1,GID=∏x∈IeC1,xgC5,x,gcx=∏x∈IegQxgαδxrxgλx−Qx,gcx=∏x∈Iegαδxrxgλx,gcx=∏x∈Ieg,gλxcxeg,gαδxrxcx=eg,gs+∑x∈Iαδxrxcx.CSP then computes formula (4) to acquire C2,GID.
(2)C2,GID=∏x∈IeCSKρx,GID,C2,x×eH1GIDxGID,C3,xgC6,xeCSKρx,GID′,C4,xcx=∏x∈IegxGIDαδxH1GIDxGIDyδxH3ρxtρx,g−rx×eH1GIDxGID,gyδxrxgωxegtρx,H3ρxrxcx=∏x∈Ieg,gxGIDαδx−rxcxeH1GID,gxGIDωxcx=eg,g∑x∈IxGIDαδx−rxcx.MDU computes formula (5) to acquire eg,gs.
(3)C1,GIDC2,GID1/xGID=eg,gs+∑x∈Iαδxrxcx×eg,g∑x∈IxGIDαδx−rxcx1/xGID=eg,gs+∑x∈Iαδxrxcxeg,g∑x∈Iαδx−rxcx=eg,gs.It recoversY=C0/eg,gs and computes key=H4Y, m′=SE.DeckeyMSE. MDU checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then, it checks if H1m′=Ver (Ver can be obtained in blockchain); if it is, the message m can be obtained by truncating ϖ-bit 0 string. Otherwise, CSP is dishonest to return an incorrect semidecrypted ciphertext and algorithm outputs ⊥.


#### 5.2.2. Correctness of Decryption of Reencryption CiphertextReKeyS,GID⟶M′,ρ′

First, computeC4 and C5 separately.
(4)C4=∏x∈IeC1,xgC5,x,rk3cx=∏x∈Iegαδxrxgλx,gH2βcx=∏x∈Ieg,gλxH2βcxeg,gαδxrxH2βcx=eg,gsH2β+∑x∈IαδxrxH2βcx,(5)C5=∏x∈Ierk1,C2,xerk4,C3,xgC6,xerk2,C4,xcx=∏x∈Ieg,gαδxH2β−rxeH1GID,gH2βωxcx=∏x∈Ieg,gαδxH2β−rxcxeH1GID,gH2βωxcx=eg,g∑x∈IαδxH2β−rxcx.Then, computeC6.
(6)C6=C4∙C5=eg,gsH2βThe CSP checks whetherS′ matches M′,ρ′ in CM′,ρ′R; if S′ does not match M′,ρ′, it aborts. Otherwise, CSP performs the following steps: CSP let I′=x:ρ′x∈S′⊆1,2,⋯,l′ and computes cx′∈Zp∗ to let ∑x∈l′cx′Mx′=1,0,..,0. CSP computes formula (6) to acquire C1,GID′.
(7)C1,GID′=∏x∈I′eC1,x′,gcx′=∏x∈I′egλx′gαδ′xrx′,gcx′=∏x∈I′eg,gλx′cx′eg,gαδ′xrx′cx′=eg,gs′+∑x∈I′αδ′xrx′cx′.CSP then computes formula (7) to acquire C2,GID′.
(8)C2,GID′=∏x∈I′eCSKρ′x,GID′,C2,x′eH1GID′xGID′,C3,x′×eCSKρ′x,GID′,C4,x′cx′=∏x∈I′egxGID′αη′H1GID′xGID′yη′H3ρxtρx′,g−rx′×eH1GID′xGID′,gyδ′xrx′gωx′egtρx′,H3ρxrx′cx′=eg,g∑x∈I′xGID′αη′−rx′cx′.MDU computes formula (8) to acquire β.
(9)β==β∙eg,gs′eg,gs′+∑x∈I′αδ′xrx′cx′eg,g∑x∈I′xGID′αη′−rx′cx′1/xGID′=β∙eg,gs′eg,gs′.Then MDU can recoverY=C0/C61/H2β. MDU computes key=H4Y and m′=SE.DeckeyMSE. The algorithm then checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then it checks if H1m′=Ver (Ver can be obtained in blockchain), if it is, the message m can be acquired by omitting ϖ-bit 0 string. If not, CSP is dishonest to return an incorrect semidecrypted ciphertext and the algorithm outputs ⊥.


### 5.3. Security Analysis

Theorem 2.
If the q-DBPBDHE2 assumption holds, then the proposed scheme is statically secure under ROM.The proof of Theorem2 is based on the establishment of Lemmas 3 and 4. Therefore, the proofs of Lemmas 3 and 4 will be given as follows, respectively.Lemma 3.
If the q-DBPBDHE2 assumption holds, then the RW scheme proposed in [32] is statically secure under ROM.Proof.
Lemma3 is proved in [32], so Lemma 3 is valid.Lemma 4.
If the RW scheme constructed in [32] is statically secure under ROM, then the proposed scheme is statically secure under ROM.Proof.
Assuming there is a PPT adversaryAdv that can break the proposed scheme with a non-negligible advantage ε, then there must exist a simulator B who can break the RW scheme with advantage ε. Among them, B can break the proposed scheme with Adv and the challenger C in RW. The relevant phases are as follows.
(1)
Initialization phase:C sends the public parameter PP in the RW scheme to the simulator B. B performs GlobalSetupλ,A⟶PP,R algorithm and sends the uploaded public parameter PP=p,G,GT,g,e,H1,H2,H3,H4,SE,A,Aη to Adv.(2)
Query phase:Adv does the following query to B.Query 1:Adv chooses some Nθ, Adv asks B for the corresponding public key NPKθ, B then sends NPKθ to C. C performs AuthoritySetupGP,θ⟶UPKθ,USKθ in [32] to generate UPKθ=eg,gαθ,gyθ and sends it to B. After that, B performs NodeSetupPP,θ⟶NPKθ,NSKθ to generate UPKθ=eg,gαθ,gyθ, then B updates public key and sends them to Adv.Query 2:Adv selects some legitimate users GIDii=1m and asks for their key pairs UPKi,USKii=1m. B performs UserKeyGenPP,GID⟶UPK,USK to generate the corresponding UPKi=gxGIDi,H1GIDxGIDi and USKi=xGIDi, then sends UPKi,USKi to Adv.Query 3:Adv asks B for the transfer key: B first forwards the query to C to get the result output by scheme [32]. Then B performs TKGenPP,GID,S,NSKθ,UPK⟶TKS,GID to generate transfer key TKS,GID and return it to Adv. During the inquiry process, B calculates the transfer key corresponding to Si,GIDi=1n in two cases, specifically:Case 1.
For1≤i≤m, attribute j∈Si, B randomly selects tj∈Zp∗ and computes CSKj,GIDi=gαθH1GIDiyθH3jtjxGIDi=gxGIDiαθH1GIDixGIDiyθH3jtjxGIDi, CSKj,GID′=H3jtjxGIDi. B then acquires the transfer key TKSi,GIDi=CSKj,GIDi,CSKj,GID′j∈Si.Case 2.
Form≤i≤n, attribute j∈Si, B randomly selects tj∈Zp∗, gj∈G, computes CSKj,GIDi=gjH3jtj and CSKj,GID′=H3jtj. Since gαθH1GIDiyθ is in G, there must be an unknown xGIDi∈Zp∗ that can make gj=gαθH1GIDiyθxGIDi=gxGIDiαθH1GIDixGIDiyθ. Thus, the corresponding transfer key can be obtained as CSKj,GIDi=gjH3jtj=gxGIDiαθH1GIDixGIDiyθH3jtj, CSKj,GID′=H3jtj. B then sends the transfer key TKSi,GIDi=CSKj,GIDi,CSKj,GID′j∈Si to Adv.Query 4:Adv asks B for re-encryption key: B first forwards the query to C to get the result output by scheme [32]. Then, Adv sends users’ GIDi1≤i≤n, users’ attribute sets Si∈A and a new access policy M′,ρ′ to B. B performs ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′ to generate re-encryption key ReKeyS,GID⟶M′,ρ′. Then B returns ReKeyS,GID⟶M′,ρ′ to Adv. TKS,GID is generated by TKGen algorithm.
(3)
Challenge Phase:Adv submits two equal-length plaintexts M0∗, M1∗, and an access policy M∗,ρ∗ to C. C randomly selects b∈0,1, executes Enc algorithm to calculate challenge ciphertext and return it to Adv. The limitation is that the GIDi1≤i≤m of the MDUs who asked for the private key during the query, their attribute set Si does not satisfy M∗,ρ∗.(4)
Guess Phase:Adv outputs guess b′∈0,1 on b. At this time, B gives different guess values 𝑏′ according to the different guesses of Adv.In the above game,Adv can consider that B is the challenger C in scheme [32] The transfer key sent by C corresponds to the user private key generated by 𝑈𝑠𝑒𝑟𝐾𝑒𝑦𝐺𝑒𝑛 algorithm in the scheme [32]. At the same time, B can determine the symmetric key key in the proposed scheme according to the value of b′. Mainly, the key corresponds to the message M input by the Encrypt algorithm in the scheme [32]. Since the RW scheme is statically secure, the proposed scheme is also statically secure. Lemma 4 is proved.In summary, from the proofs of Lemmas3 and 4, it can be proved that Theorem 2 is also valid. Therefore, the proposed scheme is statically secure under ROM.


## 5.1. Concrete Construction

This section will give the design of the protocol. To better understand the protocol, the access policy of the protocol is represented by a two-tupleM,ρ, where M is a matrix of l×n and ρ maps each row of M to an attribute ρx. At the same time, define a function F:A⟶Aη; A represents attribute universe of the protocol, and Aη represents attributes managed by a consensus node (CN) with identity η: CNη; this function can implement the mapping of the attribute u∈A to CNη. The corresponding function δ∙=Fρ∙can realize the mapping of the rows of the matrix to a consensus node. The concrete construction is as follows:
(1)
GlobalSetupλ,A⟶PP,R: the GlobalSetup algorithm is performed by all CNs. They take a security parameter λ and system attribute universe A as input and outputs system public parameter PP, an empty revocation list R. The algorithm randomly selects a security parameter λ. Let G and GT be two multiplicative cyclic groups with prime order p, g be a generator of G, K be the key space of symmetric encryption, ande:G×G⟶GT be a nondegenerate bilinear pair. The algorithm selects 4 safety hash functions: H1:0,1∗⟶G, H2:GT⟶Zp∗, H3:A⟶G, and H4:0,1∗⟶K, and a symmetric-key encryption algorithm: SE=SE.Enc∙,SE.Dec∙. In SE, SE.Enc∙ is a symmetric encryption algorithm. At last, CNs output global public parameters PP=p,G,GT,g,e,H1,H2,H3,H4,SE,A,Aη, an empty revocation list R, and sends them to the blockchain.(2)
NodeSetupPP,η⟶NPKη,NSKη: the NodeSetup algorithm is performed by all CNs. Each CNη takes public parameters PP and identity η as input, output node public key NPKη, and node secret key NSKη. Each CNη randomly selects αη,yη∈Zp∗ and computes eg,gαη,gαη,gyη. They keep NSKη=αη,yη confidential and publish NPKη=eg,gαη,gαη,gyη.(3)
UserKeyGenPP,GID⟶UPK,USK: MDU performs the UserKeyGen algorithm. The algorithm inputs PP and user GID and outputs MDU’s user public key UPK and user private key USK. The algorithm randomly selects xGID∈Zp∗ and computes K1=gxGID, K2=H1GIDxGID. It sets UPK=K1,K2 and USK=xGID.(4)
TKGenPP,GID,S,NSKη,UPK⟶TKS,GID: CN performs the TKGen algorithm. The algorithm inputs public parameter PP, user GID, user attribute set S, node secret keyNSKη, and user public key UPK and outputs transfer key TKS,GID. For all attributes, u∈A, if u is managed by CNη. Then CNη randomly selects tu∈Zp∗ and computes CSKu,GID=gxGIDαη∙H1GIDxGIDyη∙H3utu and CSKu,GID′=gtu. Then, CNη sets TKS,GID=CSKu,GID,CSKu,GID′u∈S and sends it to MDU and CSP. CSP adds GID,TKS,GID to the key list KT.(5)
EncPP,m,M,ρ,NPKη⟶CT: MDO performs the Enc algorithm. Let M be a l×n matrix and ρ be the function that maps each row of M to an attribute. The algorithm randomly selects Y∈GT and sets key=H4Y, selects a positive integer ϖ, and concatenates ϖ bit 0 string after the message m, which is used for outsourced decryption verification. The algorithm uses the SE.Enc algorithm to obtain the ciphertext of the message m: MSE=SE.Enckeym0ϖ, where || denotes concatenation of a string. Then, it computes Ver=H1m0ϖ.The algorithm randomly selects s,y2,⋯,yn,z2,⋯,zn∈Zp∗ and sets vector v=s,y2,⋯yn⊺, ω=0,z2,⋯,zn⊺. For x∈l, the algorithm randomly selects Qx,Rx,rx∈Zp∗ and computes C0=Y∙eg,gs, C1,x=gQxgαδxrx,C2,x=g−rx, C3,x=gyδxrxgRx, C4,x=H3ρxrx, λx=Mvx, ωx=Mωx, C5,x=λx−Qx, and C6,x=ωx−Rx. The algorithm uploads CT=M,ρ,C0,C1,x,C2,x,C3,x,C4,x,C5,x,C6,xx∈l,MSE to CSP and uploads Ver to blockchain.(6)
ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′: MDU performs the ReKeyGen algorithm. It inputs public parameter PP, transfer key TKS,GID, user private key USK, node public key NPKη, user attribute set S, and a new access policy M′,ρ′ and outputs reencryption key ReKeyS,GID⟶M′,ρ′. The algorithm randomly selects s′,y2′,⋯,yn′,z2′,⋯,zn′,rx′∈Zp∗,β∈GT and sets two vectors v′=s′,y2′,⋯,yn′⊺ and ω′=0,z2′,⋯,zn′⊺. Then, for x∈l′, the algorithm sets λx′=M′v′x and ωx′=M′ω′x. The algorithm computes C0′=β∙eg,gs′, C1,x′=gλx′gαδ′xrx′, C2,x′=g−rx′, C3,x′=gyδ′xrx′gωx′, and C4,x′=H3ρ′xrx′ and then sets rk1=CSKu,GIDxGID−1H2β, rk2=CSKu,GID′xGID−1H2β, rk3=gH2β, rk4=H1GIDxGIDxGID−1H2β, and rk5=M′,ρ′,C0′,C1,x′,C2,x′,C3,x′,C4,x′x∈l′. Finally, the algorithm generates ReKeyS,GID⟶M′,ρ′=S,rk1,rk2,rk3,rk4,rk5 and sends ReKeyS,GID⟶M′,ρ′ to CSP.(7)
ReEncPP,ReKeyS,GID⟶M′,ρ′,CT⟶CM′,ρ′R: CSP performs the ReEnc algorithm. It inputs public parameter PP, reencryption key ReKeyS,GID⟶M′,ρ′, and ciphertext CT and outputs reencryption ciphertext CM′,ρ′R. After receiving ReKeyS,GID⟶M′,ρ′ sent by the MDU, the algorithm will check whether the attribute set S in ReKeyS,GID⟶M′,ρ′ matches the access policy M,ρ in CT. If S does not match M,ρ, it indicates ReKeyS,GID⟶M′,ρ′ is illegal, and CSP terminates the reencryption operation. If S matches M,ρ, the algorithm performs the following steps to compute the reencrypted ciphertext CM′,ρ′R. The algorithm sets I=x:ρx∈S⊆1,2,⋯,l and computes constant cx∈Zp∗ to let ∑x∈lcxMx=1,0,..,0. Then, the algorithm computes C4=∏x∈IeC1,xgC5,x,rk3cx and C5=∏x∈Ierk1,C2,xerk4,C3,xgC6,xerk2,C4,xcx and then computes C6=C4∙C5=eg,gsH2β. Finally, the algorithm outputs CM′,ρ′R=M′,ρ′,C0,C6,rk5,MSE.(8)
TransDecPP,CT,S,TKS,GID,UPK⟶CTGID: CSP performs the TransDec algorithm. It inputs public parameter PP, ciphertext CT, user attribute set S, transform key TKS,GID, and user public key UPK and outputs semidecrypted ciphertext CTGID. The algorithm checks whether S matches M,ρ in CT; if S does not match M,ρ, it aborts; otherwise, the algorithm lets I=x:ρx∈S⊆1,2,⋯,l and computes cx∈Zp∗ to let ∑x∈lcxMx=1,0,..,0. Thus, ∑x∈lλxcx=s, ∑x∈lωxcx=0. The algorithm computes C1,GID=∏x∈IeC1,xgC5,x,gcx and C2,GID=∏x∈IeCSKρx,GID,C2,x×eH1GIDxGID,C3,xgC6,xeCSKρx,GID′,C4,xcx. The algorithm sends semidecrypted ciphertext CTGID=C0,C1,GID,C2,GID,MSE to MDU.(9)
UserDecUSK,CTGID⟶m: this algorithm is performed by MDU; MDU uses USK to decrypt CTGID and obtains m. The algorithm computes C1,GIDC2,GID1/xGID=eg,gs. It recovers Y=C0/eg,gs and computes key=H4Y, m′=SE.DeckeyMSE. The algorithm checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then, it checks if H1m′=Ver (Ver can be obtained in blockchain); if it is, the message m can be obtained by truncating ϖ-bit 0 string. Otherwise, CSP is dishonest to return an incorrect semidecrypted ciphertext, and algorithm outputs ⊥.(10)
TransDecRPP,CM′,ρ′R,S′,TKS′,GID⟶CTGID′: CSP performs the TransDecR algorithm. It inputs public parameter PP, ciphertext CM′,ρ′R, user attribute set S′, and transform key TKS′,GID and outputs semidecrypted ciphertext CTGID′. The algorithm checks whether S′ matches M′,ρ′ in CM′,ρ′R; if S′ does not match M′,ρ′, it aborts. Otherwise, the algorithm performs the following steps: CSP let I′=x:ρ′x∈S′⊆1,2,⋯,l′ and computes cx′∈Zp∗ to let ∑x∈l′cx′Mx′=1,0,..,0. It then computes C1,GID′=∏x∈I′eC1,x′,gcx′ and C2,GID′=∏x∈I′eCSKρ′x,GID′,C2,x′eH1GID′xGID′,C3,x′×eCSKρ′x,GID′,C4,x′cx′. The algorithm sends semidecrypted ciphertext CTGID′=C0,C0′,C6,C1,GID′,C2,GID′,MSE to MDU.(11)
UserDecRPP,USK,CTGID′⟶m: This algorithm is performed by MDU; it inputs PP,USK,CTGID′ to decrypt CTGID′ to obtain m. The algorithm uses USK to compute β=β∙eg,gs′/eg,gs′ and then recoversY=C0/C61/H2β. MDU computes key=H4Y and m′=SE.DeckeyMSE. The algorithm then checks if there is a redundancy 0ϖ appended after m′, if it is, m′=m0ϖ. Then, it checks if H1m′=Ver (Ver can be obtained in blockchain), if it is, the message m can be acquired by omitting ϖ-bit 0 string. If not, CSP is dishonest to return an incorrect semidecrypted ciphertext and the algorithm outputs ⊥.(12)
RevokeGID,R,KT⟶R′,KT/GID,TKS,GID: the algorithm is performed by CN and CSP; CN first updates R and uploads the latest R′ to blockchain. CSP checks the latest R′ in blockchain and inputs malicious user’s GID in R′ and KT and outputs an updated KT/GID,TKS,GID. If the user’s GID needs to be revoked, CSP will find {GID,TKS,GID} in KT and delete GID,TKS,GID in KT.


## 5.2. Correctness

### 5.2.1. Correctness of Decryption of Original CiphertextCT

The CSP checks whetherS matches M,ρ in CT; if S does not match M,ρ, it aborts; otherwise, the algorithm lets I=x:ρx∈S⊆1,2,⋯,l and computes cx∈Zp∗ to let ∑x∈lcxMx=1,0,..,0. Thus, ∑x∈lλxcx=s, ∑x∈lωxcx=0. There is η=δx=Fρx. CSP computes formula (3) to acquire C1,GID.
(1)C1,GID=∏x∈IeC1,xgC5,x,gcx=∏x∈IegQxgαδxrxgλx−Qx,gcx=∏x∈Iegαδxrxgλx,gcx=∏x∈Ieg,gλxcxeg,gαδxrxcx=eg,gs+∑x∈Iαδxrxcx.CSP then computes formula (4) to acquire C2,GID.
(2)C2,GID=∏x∈IeCSKρx,GID,C2,x×eH1GIDxGID,C3,xgC6,xeCSKρx,GID′,C4,xcx=∏x∈IegxGIDαδxH1GIDxGIDyδxH3ρxtρx,g−rx×eH1GIDxGID,gyδxrxgωxegtρx,H3ρxrxcx=∏x∈Ieg,gxGIDαδx−rxcxeH1GID,gxGIDωxcx=eg,g∑x∈IxGIDαδx−rxcx.MDU computes formula (5) to acquire eg,gs.
(3)C1,GIDC2,GID1/xGID=eg,gs+∑x∈Iαδxrxcx×eg,g∑x∈IxGIDαδx−rxcx1/xGID=eg,gs+∑x∈Iαδxrxcxeg,g∑x∈Iαδx−rxcx=eg,gs.It recoversY=C0/eg,gs and computes key=H4Y, m′=SE.DeckeyMSE. MDU checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then, it checks if H1m′=Ver (Ver can be obtained in blockchain); if it is, the message m can be obtained by truncating ϖ-bit 0 string. Otherwise, CSP is dishonest to return an incorrect semidecrypted ciphertext and algorithm outputs ⊥.


### 5.2.2. Correctness of Decryption of Reencryption CiphertextReKeyS,GID⟶M′,ρ′

First, computeC4 and C5 separately.
(4)C4=∏x∈IeC1,xgC5,x,rk3cx=∏x∈Iegαδxrxgλx,gH2βcx=∏x∈Ieg,gλxH2βcxeg,gαδxrxH2βcx=eg,gsH2β+∑x∈IαδxrxH2βcx,(5)C5=∏x∈Ierk1,C2,xerk4,C3,xgC6,xerk2,C4,xcx=∏x∈Ieg,gαδxH2β−rxeH1GID,gH2βωxcx=∏x∈Ieg,gαδxH2β−rxcxeH1GID,gH2βωxcx=eg,g∑x∈IαδxH2β−rxcx.Then, computeC6.
(6)C6=C4∙C5=eg,gsH2βThe CSP checks whetherS′ matches M′,ρ′ in CM′,ρ′R; if S′ does not match M′,ρ′, it aborts. Otherwise, CSP performs the following steps: CSP let I′=x:ρ′x∈S′⊆1,2,⋯,l′ and computes cx′∈Zp∗ to let ∑x∈l′cx′Mx′=1,0,..,0. CSP computes formula (6) to acquire C1,GID′.
(7)C1,GID′=∏x∈I′eC1,x′,gcx′=∏x∈I′egλx′gαδ′xrx′,gcx′=∏x∈I′eg,gλx′cx′eg,gαδ′xrx′cx′=eg,gs′+∑x∈I′αδ′xrx′cx′.CSP then computes formula (7) to acquire C2,GID′.
(8)C2,GID′=∏x∈I′eCSKρ′x,GID′,C2,x′eH1GID′xGID′,C3,x′×eCSKρ′x,GID′,C4,x′cx′=∏x∈I′egxGID′αη′H1GID′xGID′yη′H3ρxtρx′,g−rx′×eH1GID′xGID′,gyδ′xrx′gωx′egtρx′,H3ρxrx′cx′=eg,g∑x∈I′xGID′αη′−rx′cx′.MDU computes formula (8) to acquire β.
(9)β==β∙eg,gs′eg,gs′+∑x∈I′αδ′xrx′cx′eg,g∑x∈I′xGID′αη′−rx′cx′1/xGID′=β∙eg,gs′eg,gs′.Then MDU can recoverY=C0/C61/H2β. MDU computes key=H4Y and m′=SE.DeckeyMSE. The algorithm then checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then it checks if H1m′=Ver (Ver can be obtained in blockchain), if it is, the message m can be acquired by omitting ϖ-bit 0 string. If not, CSP is dishonest to return an incorrect semidecrypted ciphertext and the algorithm outputs ⊥.


## 5.2.1. Correctness of Decryption of Original CiphertextCT

The CSP checks whetherS matches M,ρ in CT; if S does not match M,ρ, it aborts; otherwise, the algorithm lets I=x:ρx∈S⊆1,2,⋯,l and computes cx∈Zp∗ to let ∑x∈lcxMx=1,0,..,0. Thus, ∑x∈lλxcx=s, ∑x∈lωxcx=0. There is η=δx=Fρx. CSP computes formula (3) to acquire C1,GID.
(1)C1,GID=∏x∈IeC1,xgC5,x,gcx=∏x∈IegQxgαδxrxgλx−Qx,gcx=∏x∈Iegαδxrxgλx,gcx=∏x∈Ieg,gλxcxeg,gαδxrxcx=eg,gs+∑x∈Iαδxrxcx.CSP then computes formula (4) to acquire C2,GID.
(2)C2,GID=∏x∈IeCSKρx,GID,C2,x×eH1GIDxGID,C3,xgC6,xeCSKρx,GID′,C4,xcx=∏x∈IegxGIDαδxH1GIDxGIDyδxH3ρxtρx,g−rx×eH1GIDxGID,gyδxrxgωxegtρx,H3ρxrxcx=∏x∈Ieg,gxGIDαδx−rxcxeH1GID,gxGIDωxcx=eg,g∑x∈IxGIDαδx−rxcx.MDU computes formula (5) to acquire eg,gs.
(3)C1,GIDC2,GID1/xGID=eg,gs+∑x∈Iαδxrxcx×eg,g∑x∈IxGIDαδx−rxcx1/xGID=eg,gs+∑x∈Iαδxrxcxeg,g∑x∈Iαδx−rxcx=eg,gs.It recoversY=C0/eg,gs and computes key=H4Y, m′=SE.DeckeyMSE. MDU checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then, it checks if H1m′=Ver (Ver can be obtained in blockchain); if it is, the message m can be obtained by truncating ϖ-bit 0 string. Otherwise, CSP is dishonest to return an incorrect semidecrypted ciphertext and algorithm outputs ⊥.


## 5.2.2. Correctness of Decryption of Reencryption CiphertextReKeyS,GID⟶M′,ρ′

First, computeC4 and C5 separately.
(4)C4=∏x∈IeC1,xgC5,x,rk3cx=∏x∈Iegαδxrxgλx,gH2βcx=∏x∈Ieg,gλxH2βcxeg,gαδxrxH2βcx=eg,gsH2β+∑x∈IαδxrxH2βcx,(5)C5=∏x∈Ierk1,C2,xerk4,C3,xgC6,xerk2,C4,xcx=∏x∈Ieg,gαδxH2β−rxeH1GID,gH2βωxcx=∏x∈Ieg,gαδxH2β−rxcxeH1GID,gH2βωxcx=eg,g∑x∈IαδxH2β−rxcx.Then, computeC6.
(6)C6=C4∙C5=eg,gsH2βThe CSP checks whetherS′ matches M′,ρ′ in CM′,ρ′R; if S′ does not match M′,ρ′, it aborts. Otherwise, CSP performs the following steps: CSP let I′=x:ρ′x∈S′⊆1,2,⋯,l′ and computes cx′∈Zp∗ to let ∑x∈l′cx′Mx′=1,0,..,0. CSP computes formula (6) to acquire C1,GID′.
(7)C1,GID′=∏x∈I′eC1,x′,gcx′=∏x∈I′egλx′gαδ′xrx′,gcx′=∏x∈I′eg,gλx′cx′eg,gαδ′xrx′cx′=eg,gs′+∑x∈I′αδ′xrx′cx′.CSP then computes formula (7) to acquire C2,GID′.
(8)C2,GID′=∏x∈I′eCSKρ′x,GID′,C2,x′eH1GID′xGID′,C3,x′×eCSKρ′x,GID′,C4,x′cx′=∏x∈I′egxGID′αη′H1GID′xGID′yη′H3ρxtρx′,g−rx′×eH1GID′xGID′,gyδ′xrx′gωx′egtρx′,H3ρxrx′cx′=eg,g∑x∈I′xGID′αη′−rx′cx′.MDU computes formula (8) to acquire β.
(9)β==β∙eg,gs′eg,gs′+∑x∈I′αδ′xrx′cx′eg,g∑x∈I′xGID′αη′−rx′cx′1/xGID′=β∙eg,gs′eg,gs′.Then MDU can recoverY=C0/C61/H2β. MDU computes key=H4Y and m′=SE.DeckeyMSE. The algorithm then checks if there is a redundancy 0ϖ appended after m′; if it is, m′=m0ϖ. Then it checks if H1m′=Ver (Ver can be obtained in blockchain), if it is, the message m can be acquired by omitting ϖ-bit 0 string. If not, CSP is dishonest to return an incorrect semidecrypted ciphertext and the algorithm outputs ⊥.


## 5.3. Security Analysis

Theorem 2.
If the q-DBPBDHE2 assumption holds, then the proposed scheme is statically secure under ROM.The proof of Theorem2 is based on the establishment of Lemmas 3 and 4. Therefore, the proofs of Lemmas 3 and 4 will be given as follows, respectively.Lemma 3.
If the q-DBPBDHE2 assumption holds, then the RW scheme proposed in [32] is statically secure under ROM.Proof.
Lemma3 is proved in [32], so Lemma 3 is valid.Lemma 4.
If the RW scheme constructed in [32] is statically secure under ROM, then the proposed scheme is statically secure under ROM.Proof.
Assuming there is a PPT adversaryAdv that can break the proposed scheme with a non-negligible advantage ε, then there must exist a simulator B who can break the RW scheme with advantage ε. Among them, B can break the proposed scheme with Adv and the challenger C in RW. The relevant phases are as follows.
(1)
Initialization phase:C sends the public parameter PP in the RW scheme to the simulator B. B performs GlobalSetupλ,A⟶PP,R algorithm and sends the uploaded public parameter PP=p,G,GT,g,e,H1,H2,H3,H4,SE,A,Aη to Adv.(2)
Query phase:Adv does the following query to B.Query 1:Adv chooses some Nθ, Adv asks B for the corresponding public key NPKθ, B then sends NPKθ to C. C performs AuthoritySetupGP,θ⟶UPKθ,USKθ in [32] to generate UPKθ=eg,gαθ,gyθ and sends it to B. After that, B performs NodeSetupPP,θ⟶NPKθ,NSKθ to generate UPKθ=eg,gαθ,gyθ, then B updates public key and sends them to Adv.Query 2:Adv selects some legitimate users GIDii=1m and asks for their key pairs UPKi,USKii=1m. B performs UserKeyGenPP,GID⟶UPK,USK to generate the corresponding UPKi=gxGIDi,H1GIDxGIDi and USKi=xGIDi, then sends UPKi,USKi to Adv.Query 3:Adv asks B for the transfer key: B first forwards the query to C to get the result output by scheme [32]. Then B performs TKGenPP,GID,S,NSKθ,UPK⟶TKS,GID to generate transfer key TKS,GID and return it to Adv. During the inquiry process, B calculates the transfer key corresponding to Si,GIDi=1n in two cases, specifically:Case 1.
For1≤i≤m, attribute j∈Si, B randomly selects tj∈Zp∗ and computes CSKj,GIDi=gαθH1GIDiyθH3jtjxGIDi=gxGIDiαθH1GIDixGIDiyθH3jtjxGIDi, CSKj,GID′=H3jtjxGIDi. B then acquires the transfer key TKSi,GIDi=CSKj,GIDi,CSKj,GID′j∈Si.Case 2.
Form≤i≤n, attribute j∈Si, B randomly selects tj∈Zp∗, gj∈G, computes CSKj,GIDi=gjH3jtj and CSKj,GID′=H3jtj. Since gαθH1GIDiyθ is in G, there must be an unknown xGIDi∈Zp∗ that can make gj=gαθH1GIDiyθxGIDi=gxGIDiαθH1GIDixGIDiyθ. Thus, the corresponding transfer key can be obtained as CSKj,GIDi=gjH3jtj=gxGIDiαθH1GIDixGIDiyθH3jtj, CSKj,GID′=H3jtj. B then sends the transfer key TKSi,GIDi=CSKj,GIDi,CSKj,GID′j∈Si to Adv.Query 4:Adv asks B for re-encryption key: B first forwards the query to C to get the result output by scheme [32]. Then, Adv sends users’ GIDi1≤i≤n, users’ attribute sets Si∈A and a new access policy M′,ρ′ to B. B performs ReKeyGenPP,TKS,GID,USK,NPKη,S,M′,ρ′⟶ReKeyS,GID⟶M′,ρ′ to generate re-encryption key ReKeyS,GID⟶M′,ρ′. Then B returns ReKeyS,GID⟶M′,ρ′ to Adv. TKS,GID is generated by TKGen algorithm.
(3)
Challenge Phase:Adv submits two equal-length plaintexts M0∗, M1∗, and an access policy M∗,ρ∗ to C. C randomly selects b∈0,1, executes Enc algorithm to calculate challenge ciphertext and return it to Adv. The limitation is that the GIDi1≤i≤m of the MDUs who asked for the private key during the query, their attribute set Si does not satisfy M∗,ρ∗.(4)
Guess Phase:Adv outputs guess b′∈0,1 on b. At this time, B gives different guess values 𝑏′ according to the different guesses of Adv.In the above game,Adv can consider that B is the challenger C in scheme [32] The transfer key sent by C corresponds to the user private key generated by 𝑈𝑠𝑒𝑟𝐾𝑒𝑦𝐺𝑒𝑛 algorithm in the scheme [32]. At the same time, B can determine the symmetric key key in the proposed scheme according to the value of b′. Mainly, the key corresponds to the message M input by the Encrypt algorithm in the scheme [32]. Since the RW scheme is statically secure, the proposed scheme is also statically secure. Lemma 4 is proved.In summary, from the proofs of Lemmas3 and 4, it can be proved that Theorem 2 is also valid. Therefore, the proposed scheme is statically secure under ROM.


## 6. Performance Analysis

In this section, the function and efficiency of the proposed scheme and other related schemes [19, 20, 23, 24, 28] are evaluated and compared. We compared the aforementioned 5 schemes with our scheme in terms of system functions. The specific comparison is shown in Tables 2 and 3.Table 2
System function comparison of different schemes.
Scheme[28][24][23][20][19]OursSupport ciphertext conversion×√√√√√Collusion resistant√√√√√√Decryption outsourcing√√√××√No KGC√××××√User revocation√××√√√Decryption verification×√×××√Table 3
System efficiency comparison of different schemes.
Scheme[28][24][23][20][19]OursEncrypt7l+4E+P6l+2E7l+2E5l+1E6l+1E6l+1EOriginal ciphertext decryptE3I+1P+IEE3I+2P+E2IP+2IEEReencrypt key−2S+5ES+l+6E2S+2l+3E4SE2S+8l+8EReencrypt ciphertext decrypt−4P+2E2E3IP+2P+E2IP+2IE2ETotal7l+5E+P6l+I+9E+3I+5P+2S7l+11E+S+l5l+2S+6E+6I+4P4IP+4S+4I+6l+1E2S+14l+12EFigures3–5 shows the operating time of different algorithms. We use Java language in the Windows10 environment, and Java Pairing Based Cryptography (JPBC) is used as the cryptography library. G and GT are selected from the elliptic curve y2=x3+x. eg,g is a symmetric bilinear map. The length of the elements in G and GT is 1024 bits. The AES encryption algorithm is used as a symmetric-key encryption algorithm. The hardware is AMD R5 4600u CPU, 2.1 GHz frequency, and 8GB memory.Figure 3
User original ciphertext decryption time.Figure 4
User reencrypted ciphertext decryption time.Figure 5
Total computational cost.Table2 shows the function comparison; schemes [19, 20, 23, 24] support ciphertext reencryption and collision resistance. Compared with the 4 schemes, the proposed scheme has the most comprehensive functions. Though scheme [19, 20] support ciphertext reencryption, they do not support outsourced decryption. Thus, MDU will face huge decryption costs. Although schemes [19, 20, 28] realize user revocation, the keys of unrevoked users need to be updated when the revocation occurs, which brings additional computational overhead. The user private keys in schemes [19–24] are all generated by KGC; once KGC is compromised, it will cause serious information security incidents. In fact, there exists no fully trusted KGC in the world. The proposed scheme does not need a KGC, and the user private keys are generated by users. Besides, consortium blockchain is introduced to ensure medical data will not be tampered with; consensus nodes work together to ensure blockchain operation. Schemes [20, 24] cannot realize user revocation. Even if a user leaves the system, his private key can still decrypt the ciphertext in the system, which may lead to abuse of key authority. Although schemes [20, 28] support decryption outsourcing, they lack decryption verification. This makes data users cannot distinguish whether the CSP has tampered with the result of outsourced decryption. In addition, the scheme [23] only realizes the reencryption from ABE to IBE, not the reencryption from ABE to ABE. ABE can realize “one-to-many” encryption, while IBE can only realize “one-to-one” encryption. In summary, the proposed scheme is practical in functions and is suitable for cloud storage environments.Table3 shows the system efficiency comparison of different schemes. For simplicity, ∣S∣ denotes the number of user’s attributes, l denotes the number of rows in M, Idenotes the number of rows used for decryption in M, P denotes the bilinear pairing operation in G, and P denotes the exponential operation in G. Since the calculation cost of the schemes is related to 𝑙, |𝐼|, |𝑆|, the variables are unified for the convenience of discussion. Let the user attribute be a subset of the policy attribute; the user attributes always satisfy the access policy so that |𝐼| is consistent with |𝑆|. Thus, the computational cost of the solution is related to 𝑙 and |𝑆|.It can be seen from the results given in Table2 and Figures 3–5, schemes [23, 28] have a lower computational cost. The main reason is that in scheme [23], the ciphertext after reencryption is in IBE form, not ABE form, which makes its reencryption key cost is low. Scheme [28] does not support reencryption, so it has a low computational cost. Meanwhile, although schemes [20, 24] share the computational cost of the reencryption key to the trusted center, compared with the proposed scheme, the above two schemes have higher computational costs in the decryption stage. The computational cost of scheme [19] is the highest in all phases. Finally, from the perspective of total computational cost, the users in the proposed scheme have a lower computational overhead than users in schemes [19, 20, 24]. Therefore, the proposed scheme is efficient in computing.


## 7. Conclusion

This paper proposed a medical data sharing scheme supporting ciphertext reencryption. The proposed scheme can employ attribute-based proxy reencryption technology to allow the cloud to reencryption ciphertext. The reencryption key was provided by a user with decryption authority and the cloud cannot obtain the plaintext. It can effectively reduce the bandwidth and time cost caused by the round-trip transmission of ciphertext. Simultaneously, the proposed scheme makes use of a consortium blockchain to store public keys and public parameters and update the revocation list. The data stored on the blockchain is secure and cannot be tampered with. Consensus nodes jointly maintain the consortium blockchain, which can prevent security and privacy issues caused by KGC’s overcentralization. Ultimately, based on the q-DBPBDHE2 difficult problem assumption, the proposed scheme is proved to be statically secure. Hence, the proposed scheme is practical for secure access control and sharing of medical data in the cloud storage environment.



---

*Source: 3923597-2022-03-27.xml*