# Traceable Attribute-Based Secure Data Sharing with Hidden Policies in Mobile Health Networks

Authors: Xueyan Liu; Yukun Luo; Xiaotao Yang
Journal: Mobile Information Systems
 (2020)

---

## Abstract

The growing need to store, share, and manage medical and health records has resulted in electronic medical health sharing system (mHealth), which provides intelligent medical treatment for people. Attribute-based encryption (ABE) is regarded as a new cryptology to enhance fine-grained access control over encrypted sharing data in mHealth. However, some existing attribute-based mHealth systems not only violate the one-to-many application characteristics of attribute-based encryption mechanism but also destroy the anonymity of user. In this study, an efficient scheme is proposed to tackle the above defaults and offer two-way anonymity of data owner and data user by introducing a pseudoidentity. The computation of hidden access policy is reduced by removing the bilinear pairing, whereas the interaction between cloud storage and data user is avoided to save bandwidth during trapdoor generation. We also consider the temporal factor of the uploaded information by introducing access validity. Security and performance analyses show that the proposed scheme is efficient without reducing security.


---

## Body

## 1. Introduction

Given the rapid progress of cloud computing and mobile communication technology with ubiquitous mobile intelligent devices, the electronic medical health sharing system (mHealth) has been developed, which can provide intelligent healthcare services without temporal and spatial restrictions; specifically, mHealth allows patients to record body indicators and upload records, physicians to diagnose patients’ illness remotely, and researchers to explore medical records [1]. The application of mHealth reshapes healthcare services model [2]. Figure 1 shows a typical architecture of mHealth sharing system, wherein implanted and wearable sensor devices collect various physiological indicators of patients and then deliver the gathered information to a personal server, such as mobile device. Patients may upload these data to a cloud server (CS) to save a personal storage space and allow doctors, family, other patients, and researchers to access such information. CS provides storage and retrieval services, wherein all kinds of users can apply for access to cloud data according to their own requirements. These services are also fast and efficient.Figure 1
The architecture of the mHealth sharing system.Although mHealth provides convenience in people’s lives, promotes better quality of life, and exhibits good application prospect, it also raises a series of security issues [3]. After a patient uploads his/her electronic health records (EHRs) to cloud using personal service provider, other users may access such data in the cloud through various devices, laptops, personal computer, and mobile phones. EHRs contain physiological data (heartbeat, blood pressure, medications, and dosages) and sensitive information of patients (patient name, medical history, ID number, and phone number) and hospitals (hospital name and attending doctor). If EHRs are directly uploaded to the cloud for sharing, then the information of patients and hospitals will inevitably be leaked to the cloud server and various users, which may cause hidden danger to patients’ health, threaten users’ life and health, and affect hospitals. One of the solutions to these security issues is to encrypt EHRs before uploading them [4]. However, new problems may arise as follows: Firstly, who and how to obtain access? Secondly, patients and users operate EHRs through mobile devices, but the storage capacity, computing power, and overall capability of mobile devices are limited. Thirdly, patients do not want others to know their real identity, and users do not want to reveal what EHRs they have accessed.In sum, the mHealth system needs to solve the abovementioned problems through the following steps:(1)
Ensure data confidentiality: ensure CS and illegal users cannot obtain any information about EHRs.(2)
Proper access control: a patient needs to grant access permissions for different potential users to achieve flexible access control on EHRs in the mHealth system by encrypting once. In this way, unauthorised users cannot access shared EHRs.(3)
Lightweight cryptography: given the limitations of intelligent and mobile devices, an algorithm with little computation and communication costs should be provided.(4)
Two-way anonymity: ensure anonymity for both patients and data users.To reduce local storage load and achieve resource sharing, increasing numbers of personal and medical institutions upload EHRs to CS. However, CS is not completely trusted and patients do not want to public their EHRs. Hence, EHRs must be encrypted by patients before uploading to CS, which can avoid information leakage. For example, encrypting EHRs of infected patients and then uploading them to the cloud can protect the privacy of patients and hospitals. However, encrypted EHRs can no longer be provided to other data users. Hence, user access authorisation has become a research focus. In general, public key cryptography (such identity-based encryption and certificateless encryption) solves the authorisation problem by sending the key to potential users in advance [5, 6]. However, predicting the exact identity of users is impossible, whereas data owners cannot provide authorisation service each time data users send authorisation requests. Hence, traditional public key cryptography is not suitable for online healthcare system. Attribute-based encryption (ABE) is the most attractive and popular in one-to-many application. Data owners usually use ABE technique to solve the problem of multiple users’ flexible authorisation without the need to know the identity of potential users’ in advance. In ABE, only the users whose attribute set can satisfy the access policy can obtain access to ensure the anonymity of data users [7–9].However, in mHealth system, EHRs are important and sensitive, but in which the access policy includes sensitive information. For example, a patient with heart disease uploads his own EHR encrypted by the defined access policycardiovascular department∧chief doctor∨nurse, which will easily categorise such EHR as heart disease. Therefore, the access policy should also be hidden. Existing research on hidden access policy provided answers to maintain the confidentiality of access policy [10, 11].In the general scheme of attribute cryptography, the length of ciphertext and the computation of encryption and decryption are related to the number of attributes, which increases linearly and hence limits the application of this technique. Therefore, the use of fixed or small length ciphertext is a popular solution [12, 13], whereas outsourcing decryption is a good alternative [14].This solution can help patients and data owners who do not want to disclose their identity preserve their anonymity whilst sharing their own EHRs. Specifically, an infected patient who wants to upload personal encrypted records to provide information to scientific research, but due to some social factors, he/she does not want to let other users know his/her real identity [15]. In this case, the anonymity is of great significance.In addition to the abovementioned problems, time is also an important factor to be considered in the system. The delay of medical data transmission and access may cause serious consequences, including patient casualties.


### 1.1. Related Work

Sahai and Waters presented attribute-based encryption firstly [16]. Compared with traditional public key encryption, ciphertext can only be decrypted by one user, while the ABE ciphertext can be provided to multiple users. The encryptor encrypts a message based on an access policy, and only the user whose attributes set satisfies the requirement of encryptor can obtain the message. This mechanism establishes the one-to-many relationship between data owner and data users and enables the fine-grained access control. Key-Policy Attribute-Based Encryption (KP-ABE) and Ciphertext-Policy Attribute-Based Encryption (CP-ABE) are the two categories of ABE technique, whose division is proposed in literature [17].ABE is an excellent approach to ensure the secure access control of encrypted data and is widely used in many fields, such as cloud computing [18] and searchable encryption [19]. Most of the existing researches focus on the expressiveness of access policies [20]. However, in most ABE schemes, the policy is uploaded with the related ciphertext, which is public to CS and all users including illegal users [21–24]. Hence, any user who obtains the ciphertext can know what the content is about, which will disclose sensitive information about the shared data. Meanwhile, the access policy must be properly handled before sharing with ciphertex, that is, hidden. A series of research results on hidden access policy have been published [25–28]. Frikken et al. presented a protocol that protected both sensitive credentials and sensitive policies [25]. Lai et al. proposed another construction of CP-ABE scheme, which is a partially hidden access policy [26]. In response to the question of confidentiality, Hahn et al. proposed an attribute-based secure data sharing with hidden policies, which can be used in resource constrained environment [27]. These results provide better confidentiality of shared data and the anonymity of data user.In general ABE schemes, the length of ciphertext, computation of encryption, and decryption are related with the number of attributes of data user, which restricts the use of this technique. To resolve this defect, there are two main solutions. One is to reduce the length of ciphertext as much as possible or adopt fixed length ciphertext. To address this problem, Emura et al. introduced the concept of constant ciphetext length in 2009 [29]. After that, many similar schemes were proposed for constant ciphertext length [23, 30]. The other is to introduce outsourcing decryption to reduce the computation load [31–33]. Li et al. gave a solution to implement attribute-based access control system by introducing secure outsourcing techniques into ABE [31]. In order to decrease computation, Zuo et al. proposed the CCA security model for ABE with outsourced decryption and then presented a concrete CCA-secure ABE scheme with outsourced decryption [32]. In these schemes, data users only perform a small amount of computation by outsourcing a large amount of computing to the cloud service provider.Some studies with other characteristics have also been proposed, such as decentralized multiauthority scheme [34, 35], traceable scheme [36], and leakage-resilience scheme [37] and reduce online computation load scheme [38]. These studies provide applications in different focus areas.


### 1.2. Contribution

Given the continuous development of modern mobile communication and sensor technology, mHealth becomes a hot topic in the academe and healthcare industry. In view of the problems existing in the current mHealth system and the problems discussed in [27], this work proposes an improved attribute-based secure data sharing scheme for mHealth with hidden policies and traceability. Specifically, this study aims to (1) solve the problem of identity disclosure by introducing a concept of public pseudo-identity, wherein the real identity is only known by the centre authority (CA); (2) save bandwidth, wherein the interaction between CS and data user is avoided during token generation; and (3) meet the application needs of mobile medical system, wherein the temporal factor is introduced by setting the validity period of shared information by the data owner.


### 1.3. Organization

The rest of paper is organized as follows. We introduce the cryptographic primitives and describe the access policy and mHealth system model in Section2. In Section 3, we review the scheme in [27] and give a detailed discussion. Section 4 gives an improved scheme, followed by security and performance analysis. Finally, Section 5 shows a conclusion of this paper.


## 1.1. Related Work

Sahai and Waters presented attribute-based encryption firstly [16]. Compared with traditional public key encryption, ciphertext can only be decrypted by one user, while the ABE ciphertext can be provided to multiple users. The encryptor encrypts a message based on an access policy, and only the user whose attributes set satisfies the requirement of encryptor can obtain the message. This mechanism establishes the one-to-many relationship between data owner and data users and enables the fine-grained access control. Key-Policy Attribute-Based Encryption (KP-ABE) and Ciphertext-Policy Attribute-Based Encryption (CP-ABE) are the two categories of ABE technique, whose division is proposed in literature [17].ABE is an excellent approach to ensure the secure access control of encrypted data and is widely used in many fields, such as cloud computing [18] and searchable encryption [19]. Most of the existing researches focus on the expressiveness of access policies [20]. However, in most ABE schemes, the policy is uploaded with the related ciphertext, which is public to CS and all users including illegal users [21–24]. Hence, any user who obtains the ciphertext can know what the content is about, which will disclose sensitive information about the shared data. Meanwhile, the access policy must be properly handled before sharing with ciphertex, that is, hidden. A series of research results on hidden access policy have been published [25–28]. Frikken et al. presented a protocol that protected both sensitive credentials and sensitive policies [25]. Lai et al. proposed another construction of CP-ABE scheme, which is a partially hidden access policy [26]. In response to the question of confidentiality, Hahn et al. proposed an attribute-based secure data sharing with hidden policies, which can be used in resource constrained environment [27]. These results provide better confidentiality of shared data and the anonymity of data user.In general ABE schemes, the length of ciphertext, computation of encryption, and decryption are related with the number of attributes of data user, which restricts the use of this technique. To resolve this defect, there are two main solutions. One is to reduce the length of ciphertext as much as possible or adopt fixed length ciphertext. To address this problem, Emura et al. introduced the concept of constant ciphetext length in 2009 [29]. After that, many similar schemes were proposed for constant ciphertext length [23, 30]. The other is to introduce outsourcing decryption to reduce the computation load [31–33]. Li et al. gave a solution to implement attribute-based access control system by introducing secure outsourcing techniques into ABE [31]. In order to decrease computation, Zuo et al. proposed the CCA security model for ABE with outsourced decryption and then presented a concrete CCA-secure ABE scheme with outsourced decryption [32]. In these schemes, data users only perform a small amount of computation by outsourcing a large amount of computing to the cloud service provider.Some studies with other characteristics have also been proposed, such as decentralized multiauthority scheme [34, 35], traceable scheme [36], and leakage-resilience scheme [37] and reduce online computation load scheme [38]. These studies provide applications in different focus areas.


## 1.2. Contribution

Given the continuous development of modern mobile communication and sensor technology, mHealth becomes a hot topic in the academe and healthcare industry. In view of the problems existing in the current mHealth system and the problems discussed in [27], this work proposes an improved attribute-based secure data sharing scheme for mHealth with hidden policies and traceability. Specifically, this study aims to (1) solve the problem of identity disclosure by introducing a concept of public pseudo-identity, wherein the real identity is only known by the centre authority (CA); (2) save bandwidth, wherein the interaction between CS and data user is avoided during token generation; and (3) meet the application needs of mobile medical system, wherein the temporal factor is introduced by setting the validity period of shared information by the data owner.


## 1.3. Organization

The rest of paper is organized as follows. We introduce the cryptographic primitives and describe the access policy and mHealth system model in Section2. In Section 3, we review the scheme in [27] and give a detailed discussion. Section 4 gives an improved scheme, followed by security and performance analysis. Finally, Section 5 shows a conclusion of this paper.


## 2. Preliminaries

### 2.1. Bilinear Map

LetG0 and G1 be two groups with prime order p. e, a bilinear map, e:G0×G0⟶G1, satisfies the following properties:(1)
Bilinearty.eua,vb=euvab, where u,v∈G0 and a,b∈Zp∗(2)
Nondegenerate.eg,g≠1, where g is the generator of G0(3)
Computable. There is an efficient algorithm to compute the bilinear map e


### 2.2. Security Assumption

#### 2.2.1.k−BDHE Problem (Bilinear Diffie–Hellman Exponent) [39]

LetG0 be a bilinear group with prime order p and g is the generator of G0. The k−BDHE problem in G0 states that given a vector of 2K+1 elements h,g,ga,ga2,…,gaK,gaK+2,…,ga2K∈G02K+1, it is computationally intractable to compute the value eg,hαK+1.Define the setYg,α,K as Yg,α,K=ga,ga2,…,gaK,gaK+2,…,ga2K.Definition 1 (Decisionalk−BDHE).
The decisionalk−BDHE assumption is said to be held in G1, if there is no probabilistic polynomial time adversary with nonnegligible advantage to distinguish(1)h,g,Yg,α,K,eg,hαK+1,h,g,Yg,α,K,eg,hR,where α,R∈Zp∗ and g,h∈G0.


#### 2.2.2.l−SDH Assumption (Strong Diffie–Hellman) [40]

Given al+1–tuple g,ga,ga2,…,gal as input, output c,g1/α+c∈Zp∗×G0. An algorithm ℂ has advantage ε in solving l−SDH in G0 if the following holds:(2)Prℂg,ga,ga2,…,gal=c,g1/α+c≥ε,where random α∈Zp∗.Definition 2.
Thel−SDH assumption is t,ε−secure if no t−time algorithm has advantage at least ε in solving the l−SDH problem in G0.


### 2.3. Access Policy

The attribute universe isU=A1,A2,…,Ak, each Ai∈Ai+,Ai−,Ai∗, where Ai+=i denotes that the user has Ai, Ai−=k+i denotes that the user has no Ai, Ai∗=2k+i denotes a wildcard specifying do not care, i=1,2,…,k. Let Lua=Lua1,Lua2,…,Luak be an attribute set of user, where Luai∈Ai+,Ai−.LetW=W1,W2,…,Wk be an AND-gate access policy, where Wi∈Ai+,Ai−,Ai∗. Denote Lua=W that the attribute set Lua of user satisfies W. Then,(3)Lua=W⟺W⊏Lua⊔A1∗,A2∗,…,Ai∗.


### 2.4. A System Model

In mHealth systems, individual intelligent sensors monitor certain physiological signal and send to the mobile device. Then, the mobile devices upload the received data to the cloud. Users with requirements can initiate requests to obtain retrieval authorisation. In Figure2, there exist four types of entities in the improved scheme as follows:(1)
Centre authority (CA): it is a trusted entity that generates the system master key and public parameters and issues user’s private key on his attributes(2)
Data owner: this is a patient who encrypts his data and generates the encrypted keyword index and then uploads them to cloud server(3)
Data user: patient, physician, nurse, researcher, etc. can be such entities who obtain his private key from CA; he/she generates the token of keyword and gets search authorized to decrypt a ciphertext only if his/her attribute set satisfies the corresponding access policy(4)
Cloud sever (CS): this is a storage centre that stores electric medical and health records and carries searching and some other work, such as partially decryption.Figure 2
A system model.Table1 gives the notations used in the paper.Table 1
Notations used in the paper.
NotationsDescriptioniTheith attribute, i=1,2,…,k.jThe value of theith attribute j∈1,3kLuaThe attribute set of userUaLuaiTheith attribute value of UaWThe access policyWiTheith attribute value of WL¯uaThe hidden attribute setW¯The hidden access policy


## 2.1. Bilinear Map

LetG0 and G1 be two groups with prime order p. e, a bilinear map, e:G0×G0⟶G1, satisfies the following properties:(1)
Bilinearty.eua,vb=euvab, where u,v∈G0 and a,b∈Zp∗(2)
Nondegenerate.eg,g≠1, where g is the generator of G0(3)
Computable. There is an efficient algorithm to compute the bilinear map e


## 2.2. Security Assumption

### 2.2.1.k−BDHE Problem (Bilinear Diffie–Hellman Exponent) [39]

LetG0 be a bilinear group with prime order p and g is the generator of G0. The k−BDHE problem in G0 states that given a vector of 2K+1 elements h,g,ga,ga2,…,gaK,gaK+2,…,ga2K∈G02K+1, it is computationally intractable to compute the value eg,hαK+1.Define the setYg,α,K as Yg,α,K=ga,ga2,…,gaK,gaK+2,…,ga2K.Definition 1 (Decisionalk−BDHE).
The decisionalk−BDHE assumption is said to be held in G1, if there is no probabilistic polynomial time adversary with nonnegligible advantage to distinguish(1)h,g,Yg,α,K,eg,hαK+1,h,g,Yg,α,K,eg,hR,where α,R∈Zp∗ and g,h∈G0.


### 2.2.2.l−SDH Assumption (Strong Diffie–Hellman) [40]

Given al+1–tuple g,ga,ga2,…,gal as input, output c,g1/α+c∈Zp∗×G0. An algorithm ℂ has advantage ε in solving l−SDH in G0 if the following holds:(2)Prℂg,ga,ga2,…,gal=c,g1/α+c≥ε,where random α∈Zp∗.Definition 2.
Thel−SDH assumption is t,ε−secure if no t−time algorithm has advantage at least ε in solving the l−SDH problem in G0.


## 2.2.1.k−BDHE Problem (Bilinear Diffie–Hellman Exponent) [39]

LetG0 be a bilinear group with prime order p and g is the generator of G0. The k−BDHE problem in G0 states that given a vector of 2K+1 elements h,g,ga,ga2,…,gaK,gaK+2,…,ga2K∈G02K+1, it is computationally intractable to compute the value eg,hαK+1.Define the setYg,α,K as Yg,α,K=ga,ga2,…,gaK,gaK+2,…,ga2K.Definition 1 (Decisionalk−BDHE).
The decisionalk−BDHE assumption is said to be held in G1, if there is no probabilistic polynomial time adversary with nonnegligible advantage to distinguish(1)h,g,Yg,α,K,eg,hαK+1,h,g,Yg,α,K,eg,hR,where α,R∈Zp∗ and g,h∈G0.


## 2.2.2.l−SDH Assumption (Strong Diffie–Hellman) [40]

Given al+1–tuple g,ga,ga2,…,gal as input, output c,g1/α+c∈Zp∗×G0. An algorithm ℂ has advantage ε in solving l−SDH in G0 if the following holds:(2)Prℂg,ga,ga2,…,gal=c,g1/α+c≥ε,where random α∈Zp∗.Definition 2.
Thel−SDH assumption is t,ε−secure if no t−time algorithm has advantage at least ε in solving the l−SDH problem in G0.


## 2.3. Access Policy

The attribute universe isU=A1,A2,…,Ak, each Ai∈Ai+,Ai−,Ai∗, where Ai+=i denotes that the user has Ai, Ai−=k+i denotes that the user has no Ai, Ai∗=2k+i denotes a wildcard specifying do not care, i=1,2,…,k. Let Lua=Lua1,Lua2,…,Luak be an attribute set of user, where Luai∈Ai+,Ai−.LetW=W1,W2,…,Wk be an AND-gate access policy, where Wi∈Ai+,Ai−,Ai∗. Denote Lua=W that the attribute set Lua of user satisfies W. Then,(3)Lua=W⟺W⊏Lua⊔A1∗,A2∗,…,Ai∗.


## 2.4. A System Model

In mHealth systems, individual intelligent sensors monitor certain physiological signal and send to the mobile device. Then, the mobile devices upload the received data to the cloud. Users with requirements can initiate requests to obtain retrieval authorisation. In Figure2, there exist four types of entities in the improved scheme as follows:(1)
Centre authority (CA): it is a trusted entity that generates the system master key and public parameters and issues user’s private key on his attributes(2)
Data owner: this is a patient who encrypts his data and generates the encrypted keyword index and then uploads them to cloud server(3)
Data user: patient, physician, nurse, researcher, etc. can be such entities who obtain his private key from CA; he/she generates the token of keyword and gets search authorized to decrypt a ciphertext only if his/her attribute set satisfies the corresponding access policy(4)
Cloud sever (CS): this is a storage centre that stores electric medical and health records and carries searching and some other work, such as partially decryption.Figure 2
A system model.Table1 gives the notations used in the paper.Table 1
Notations used in the paper.
NotationsDescriptioniTheith attribute, i=1,2,…,k.jThe value of theith attribute j∈1,3kLuaThe attribute set of userUaLuaiTheith attribute value of UaWThe access policyWiTheith attribute value of WL¯uaThe hidden attribute setW¯The hidden access policy


## 3. The Scheme in Reference [27]

In this section, we review the scheme in Reference [27] and give a detailed discussion.


### 3.1. Review of the Scheme

#### 3.1.1. Setup

LetG0,G1 be two bilinear groups of prime order p with generator g∈G0, e:G0×G0⟶G1, and random α,β,γ∈Zp.H:Zp∗⟶G0is a hash function. CA computes gj=gαj, j=1,2,…,K,K+2,…,2K, K=3k. Then, it computes v=gγ and h=gβ. The public and master keys arePK=g,g1,…,gK,gK+2,…,g2K,v,h, MSK=α,β,γ, and an identity table T=∅ is initialized.


#### 3.1.2. KeyGen

Assume that each data userUa with identity idua and an attribute set Lua=Lua1,Lua2,…,Luak, if Ua has attribute Ai, Luai=i, else Luai=k+i. CA randomly chooses c,μa∈Zp∗, r1,r2,…,rk∈Zp and computes r=∑i=1kri, D=grγ/μa+c, D′=c, D″=gr, and Da=gμa. For each i∈1,k, the following are computed:(4)Di=Hjβ,Di1=gγcαj+rj/μa+c,j∈1,k,gγcαj+rj−k/μa+c,j∈k+1,2k,Di2=gγcαj+rj−2k/μa+c,j∈2k+1,3k.The private key of userUa is(5)SKua=D,Di1,Di2,Di,D′,D″,Da.At last, CA puts a tuplec,idua into table T and uploads tuple idua,li=gjD′i=1k to the CS.


#### 3.1.3. Encrypt

The data ownerUo specifies an access policy W, where each attribute is either positive/negative or wildcard. Uo chooses a random t∈Zp and computes Key=egK,g1kt, C=MKey, C0=gt, and C1=v∏j∈WgK+1−jt.Next,Uo chooses a random b∈Zp∗, computer C2=gb, si=ehb,Hj, Hsi for i∈1,k, then the W is obfuscated as W¯. Then, the cipher is(6)CT=W¯,C,C0,C1,C2,idua.


#### 3.1.4. GenToken

The data userUa with a set of attribute Lua wants to access the shared data of owner Ub, gets C2 from CS, and computes si=eC2,Di=egb,Hjβ, Ii=Hsi. As a result, the attribute set Lua is transformed into L¯ua. The token is(7)TKua=Iii=1k.


#### 3.1.5. PDecrypt

The CS checks whether the attribute setL¯ua satisfies the access policy W¯. If satisfies, CSP searches idua,li=gjD′i=1k to partially decrypt CT as follows:(8)Ai=eli,C1=egjD′,C1=eg,v∏s∈WgK+1−sαjtD′=eg,gγ+∑s∈WαK+1−sαjtD′=eg,gαjtD′γ+tD′∑s∈WαK+1−s+j,for all i∈1,k. Then, it computes a production of all Ai as CT′=∏i=1kAi and sends to the data user Ua.


#### 3.1.6. Decrypt

Once the partially decrypted ciphertextT′ is received, Ua computes the following:(9)Bi=eC0,∏s∈W,s≠jgK+1−s+jD′⋅Di=eg,gtD′∑s∈WαK+1−s+j+tγαjD′+ri/μa+c,where Di=D1i,Luai∈1,2kD2i,Luai∈2k+1,3k, and obtains B=∏i=1kBi; next, Ua carries the decryption as follows:(10)CT′B⋅eD,C0=eg,gαK+1ktD′,CT′B⋅eD,C01/D′=eg,gαK+1kt=egαK,gαkt=egK,g1kt=Key.Then,Ua decrypts MKey.


#### 3.1.7. Trace

SKua is well-formed if the following conditions hold:(11)eDa⋅gD′,D=ev,D″≠1.IfSKua is well-formed, CA searches D′ in T. If D′ is in T, then it can output the corresponding identity idua.


### 3.2. Analysis of the Scheme

Problems in the scheme are observed. A detailed analysis is given follows.


#### 3.2.1. Destroy One-to-Many Mechanism

The data ownerUo must know exactly the identity idua of data user in advance, wherein Uo can decide if he/she will provide access to the target user Ua. In this case, the identity idua of data user is sent to CS with ciphertext. CS can confirm which users can view or access shared messages by providing access rules, which may threaten the security of data users. As a result, this feature is not in line with the feature of developed in the attribute encryption mechanism, given that it cannot guarantee the anonymity of data users.


#### 3.2.2. Identity Leakage

Before constructing the search token, the data userUa firstly obtains C2 of the data owner Uo from the cloud service provider (CSP) firstly. In this case, data users may know the identity of the data owner who shared the information he/she is interested in. Therefore, the anonymity of the data owner cannot be guaranteed and the application scope of the scheme is limited.


#### 3.2.3. Interaction Problem

While generating the token, an interaction exists between data user and the CSP. The data user submits the identityUo of the data owner he/she wants to access. Then, the CS feeds back C2 corresponding to the given identity Uo, which increases the communication load.


## 3.1. Review of the Scheme

### 3.1.1. Setup

LetG0,G1 be two bilinear groups of prime order p with generator g∈G0, e:G0×G0⟶G1, and random α,β,γ∈Zp.H:Zp∗⟶G0is a hash function. CA computes gj=gαj, j=1,2,…,K,K+2,…,2K, K=3k. Then, it computes v=gγ and h=gβ. The public and master keys arePK=g,g1,…,gK,gK+2,…,g2K,v,h, MSK=α,β,γ, and an identity table T=∅ is initialized.


### 3.1.2. KeyGen

Assume that each data userUa with identity idua and an attribute set Lua=Lua1,Lua2,…,Luak, if Ua has attribute Ai, Luai=i, else Luai=k+i. CA randomly chooses c,μa∈Zp∗, r1,r2,…,rk∈Zp and computes r=∑i=1kri, D=grγ/μa+c, D′=c, D″=gr, and Da=gμa. For each i∈1,k, the following are computed:(4)Di=Hjβ,Di1=gγcαj+rj/μa+c,j∈1,k,gγcαj+rj−k/μa+c,j∈k+1,2k,Di2=gγcαj+rj−2k/μa+c,j∈2k+1,3k.The private key of userUa is(5)SKua=D,Di1,Di2,Di,D′,D″,Da.At last, CA puts a tuplec,idua into table T and uploads tuple idua,li=gjD′i=1k to the CS.


### 3.1.3. Encrypt

The data ownerUo specifies an access policy W, where each attribute is either positive/negative or wildcard. Uo chooses a random t∈Zp and computes Key=egK,g1kt, C=MKey, C0=gt, and C1=v∏j∈WgK+1−jt.Next,Uo chooses a random b∈Zp∗, computer C2=gb, si=ehb,Hj, Hsi for i∈1,k, then the W is obfuscated as W¯. Then, the cipher is(6)CT=W¯,C,C0,C1,C2,idua.


### 3.1.4. GenToken

The data userUa with a set of attribute Lua wants to access the shared data of owner Ub, gets C2 from CS, and computes si=eC2,Di=egb,Hjβ, Ii=Hsi. As a result, the attribute set Lua is transformed into L¯ua. The token is(7)TKua=Iii=1k.


### 3.1.5. PDecrypt

The CS checks whether the attribute setL¯ua satisfies the access policy W¯. If satisfies, CSP searches idua,li=gjD′i=1k to partially decrypt CT as follows:(8)Ai=eli,C1=egjD′,C1=eg,v∏s∈WgK+1−sαjtD′=eg,gγ+∑s∈WαK+1−sαjtD′=eg,gαjtD′γ+tD′∑s∈WαK+1−s+j,for all i∈1,k. Then, it computes a production of all Ai as CT′=∏i=1kAi and sends to the data user Ua.


### 3.1.6. Decrypt

Once the partially decrypted ciphertextT′ is received, Ua computes the following:(9)Bi=eC0,∏s∈W,s≠jgK+1−s+jD′⋅Di=eg,gtD′∑s∈WαK+1−s+j+tγαjD′+ri/μa+c,where Di=D1i,Luai∈1,2kD2i,Luai∈2k+1,3k, and obtains B=∏i=1kBi; next, Ua carries the decryption as follows:(10)CT′B⋅eD,C0=eg,gαK+1ktD′,CT′B⋅eD,C01/D′=eg,gαK+1kt=egαK,gαkt=egK,g1kt=Key.Then,Ua decrypts MKey.


### 3.1.7. Trace

SKua is well-formed if the following conditions hold:(11)eDa⋅gD′,D=ev,D″≠1.IfSKua is well-formed, CA searches D′ in T. If D′ is in T, then it can output the corresponding identity idua.


## 3.1.1. Setup

LetG0,G1 be two bilinear groups of prime order p with generator g∈G0, e:G0×G0⟶G1, and random α,β,γ∈Zp.H:Zp∗⟶G0is a hash function. CA computes gj=gαj, j=1,2,…,K,K+2,…,2K, K=3k. Then, it computes v=gγ and h=gβ. The public and master keys arePK=g,g1,…,gK,gK+2,…,g2K,v,h, MSK=α,β,γ, and an identity table T=∅ is initialized.


## 3.1.2. KeyGen

Assume that each data userUa with identity idua and an attribute set Lua=Lua1,Lua2,…,Luak, if Ua has attribute Ai, Luai=i, else Luai=k+i. CA randomly chooses c,μa∈Zp∗, r1,r2,…,rk∈Zp and computes r=∑i=1kri, D=grγ/μa+c, D′=c, D″=gr, and Da=gμa. For each i∈1,k, the following are computed:(4)Di=Hjβ,Di1=gγcαj+rj/μa+c,j∈1,k,gγcαj+rj−k/μa+c,j∈k+1,2k,Di2=gγcαj+rj−2k/μa+c,j∈2k+1,3k.The private key of userUa is(5)SKua=D,Di1,Di2,Di,D′,D″,Da.At last, CA puts a tuplec,idua into table T and uploads tuple idua,li=gjD′i=1k to the CS.


## 3.1.3. Encrypt

The data ownerUo specifies an access policy W, where each attribute is either positive/negative or wildcard. Uo chooses a random t∈Zp and computes Key=egK,g1kt, C=MKey, C0=gt, and C1=v∏j∈WgK+1−jt.Next,Uo chooses a random b∈Zp∗, computer C2=gb, si=ehb,Hj, Hsi for i∈1,k, then the W is obfuscated as W¯. Then, the cipher is(6)CT=W¯,C,C0,C1,C2,idua.


## 3.1.4. GenToken

The data userUa with a set of attribute Lua wants to access the shared data of owner Ub, gets C2 from CS, and computes si=eC2,Di=egb,Hjβ, Ii=Hsi. As a result, the attribute set Lua is transformed into L¯ua. The token is(7)TKua=Iii=1k.


## 3.1.5. PDecrypt

The CS checks whether the attribute setL¯ua satisfies the access policy W¯. If satisfies, CSP searches idua,li=gjD′i=1k to partially decrypt CT as follows:(8)Ai=eli,C1=egjD′,C1=eg,v∏s∈WgK+1−sαjtD′=eg,gγ+∑s∈WαK+1−sαjtD′=eg,gαjtD′γ+tD′∑s∈WαK+1−s+j,for all i∈1,k. Then, it computes a production of all Ai as CT′=∏i=1kAi and sends to the data user Ua.


## 3.1.6. Decrypt

Once the partially decrypted ciphertextT′ is received, Ua computes the following:(9)Bi=eC0,∏s∈W,s≠jgK+1−s+jD′⋅Di=eg,gtD′∑s∈WαK+1−s+j+tγαjD′+ri/μa+c,where Di=D1i,Luai∈1,2kD2i,Luai∈2k+1,3k, and obtains B=∏i=1kBi; next, Ua carries the decryption as follows:(10)CT′B⋅eD,C0=eg,gαK+1ktD′,CT′B⋅eD,C01/D′=eg,gαK+1kt=egαK,gαkt=egK,g1kt=Key.Then,Ua decrypts MKey.


## 3.1.7. Trace

SKua is well-formed if the following conditions hold:(11)eDa⋅gD′,D=ev,D″≠1.IfSKua is well-formed, CA searches D′ in T. If D′ is in T, then it can output the corresponding identity idua.


## 3.2. Analysis of the Scheme

Problems in the scheme are observed. A detailed analysis is given follows.


### 3.2.1. Destroy One-to-Many Mechanism

The data ownerUo must know exactly the identity idua of data user in advance, wherein Uo can decide if he/she will provide access to the target user Ua. In this case, the identity idua of data user is sent to CS with ciphertext. CS can confirm which users can view or access shared messages by providing access rules, which may threaten the security of data users. As a result, this feature is not in line with the feature of developed in the attribute encryption mechanism, given that it cannot guarantee the anonymity of data users.


### 3.2.2. Identity Leakage

Before constructing the search token, the data userUa firstly obtains C2 of the data owner Uo from the cloud service provider (CSP) firstly. In this case, data users may know the identity of the data owner who shared the information he/she is interested in. Therefore, the anonymity of the data owner cannot be guaranteed and the application scope of the scheme is limited.


### 3.2.3. Interaction Problem

While generating the token, an interaction exists between data user and the CSP. The data user submits the identityUo of the data owner he/she wants to access. Then, the CS feeds back C2 corresponding to the given identity Uo, which increases the communication load.


## 3.2.1. Destroy One-to-Many Mechanism

The data ownerUo must know exactly the identity idua of data user in advance, wherein Uo can decide if he/she will provide access to the target user Ua. In this case, the identity idua of data user is sent to CS with ciphertext. CS can confirm which users can view or access shared messages by providing access rules, which may threaten the security of data users. As a result, this feature is not in line with the feature of developed in the attribute encryption mechanism, given that it cannot guarantee the anonymity of data users.


## 3.2.2. Identity Leakage

Before constructing the search token, the data userUa firstly obtains C2 of the data owner Uo from the cloud service provider (CSP) firstly. In this case, data users may know the identity of the data owner who shared the information he/she is interested in. Therefore, the anonymity of the data owner cannot be guaranteed and the application scope of the scheme is limited.


## 3.2.3. Interaction Problem

While generating the token, an interaction exists between data user and the CSP. The data user submits the identityUo of the data owner he/she wants to access. Then, the CS feeds back C2 corresponding to the given identity Uo, which increases the communication load.


## 4. Improved Scheme

In this section, we propose an improved scheme that can overcome the defects in [27] by introducing new features without weakening security or setting any particular conditions. (1) Public pseudo-identity is introduced, wherein the real identity is only known by the CA. (2) The access policy is hidden, and the user attribute set is made complicated by eliminating the bilinear pairings to reduce the calculation load. As a result, users will not apply to CS for aid information of the data owner when generating the token. (3) Access validity is added to the ciphertext.


### 4.1. Concrete Scheme

#### 4.1.1. Access Validity

In order to introduce the temporal factor, we give a mechanism to determine the access validity.T is the access validity of shared data, Tstamp is the time stamp, and T is divided into T1,T2,…,Tτ based on different time units of application requirements. Then HT=h1,h2,…,hτ,h1′,h2′,…,h′τ′, where hi=hTiTstamp, hτ′' is redundant data, andh′i′≠hi. Let tt be the current time; if htt−TstampTstamp∈HT, then tt satisfies T (Figure 3).Figure 3
Access validity.For example, access validityT=9days, which can be expressed as H9=1,2,…,9 and time stamp Tstamp=2020.02.15. A request occurred at timett=2020.02.19 and then h4=h42020.02.15∈H9, so the request is within the validity period.


#### 4.1.2. Concrete Construction

Figure4 shows the overview of the improved scheme, which is described below.Figure 4
Overview of the improved scheme.(1) Setup. The same as in [27].H1:0,1∗⟶Zp∗,h:0,1∗×G1⟶Zp∗.(2) KeyGen. Assume an user Ut with identity idut and attribute set Lut, where t can be either o or a. Uo is the data owner and Ua is the data user. D′=c=H1idut, Di=HLuaiiβ, and the private key and public identity are(12)SKut=D,Di1,Di2,Di,D′,D″,Dt,HIDut=hidutDt.At last, put a tupleidut,HIDut,c into the table T and upload HIDut,gjD′ to CS.Instantly, havingUo with identity iduo and attribute set Luo, the private key and public identity are(13)SKuo=D,Di1,Di2,Di,D′,D″,Do,HIDuo=hiduoDo.HavingUa with identity idua and attribute set Lua, the private key and public identity are(14)SKua=D,Di1,Di2,Di,D′,D″,Da,HIDua=hiduaDa.(3) Encrypt. Only the differences are shown. Uo computes C2=∏j∈1,2kHjit and obfuscates W as follows: if Wi=Ai∗, W¯i=∗, else W¯i=0, so only ∗ and 0 are in the hidden access policy W¯. Next, Uo sets access validity T of M and computes HT=h1,h2,…,hτ,h1′,h2′,…,h′τ′ as shown in Section 4.1.1. Then the cipher is(15)CT=W¯,C,C0,C1,C2,HIDuo,Ht,Tstamp.(4) GenToken. Ua chooses x∈Zp∗ randomly and computes Di¯=HLuaiiβ/x, tka=h1/x=gβ/x. The token is(16)TKua=D¯i,tka,HIDua.(5) PDecrypt. Once the query is received, CS gets current time ttand computes whether htt−TstampTstamp∈HT. If it holds, CS goes on to judge whether the attributes set L¯ua satisfies the access policy W¯ by verifying equation (17). Then, CS performs the same operations as in the literature [27] and returns results to Ua:(17)e∏W¯i=0D¯i,C0=eC2,tka.(6) Decryp. The difference in this step is Di′=D1i,ifW¯i=0D2i,ifW¯i=∗; as long as Ua is a legitimate user, it can correctly meet the requirements of the hidden access policy W¯ at one time.(7) Trace. When something goes wrong, only pseudoidentity HIDut is submitted to CA who can find the true identity idut from idut,HIDut,c.


### 4.2. Security Model

The security model of the improved scheme is similar to that of the scheme in [27]. The data confidentiality of the improved scheme is considered to be guaranteed if there is no probabilistic polynomial-time adversary A with nonnegligible advantages in the following security game.


#### 4.2.1. Init

The adversary A chooses a challenge access policyW∗ and sends it to the challenger B.


#### 4.2.2. Setup

The challenger B runs theSetup algorithm and publishes the public parameter PK.Phase 1.
The adversary A submitsidua,Lua to query decryption keys where Lua≠W∗. The challenger B answers with a decryption key SKua. A repeats this phase adaptively.


#### 4.2.3. Challenge

The challenger B runsEncrypt algorithm to obtain C0∗,C0∗,Key. Next, B sets Key0=Key and picks a random Key1 of same length as Key0. It then flips a random coin b∈0,1 and gives C0∗,C0∗,Keyb to the adversary.Phase 2.
The adversaryA repeats Phase 1.


#### 4.2.4. Guess

The adversaryA outputs a guess b′∈0,1 .The adversaryA wins the game if b′=b under the restriction that Lua≠W∗. The advantage of an adversary in this game is defined as(18)Prb′=b−12.


### 4.3. Security Analysis

#### 4.3.1. Data Confidentiality

The security of improved scheme is still based on thek−DBDH problem.Theorem 1.
If a probabilistic polynomial-time adversaryA can break our scheme with a nonnegligible advantage, then we can construct a simulator B to solve k−BDHE problem with a nonnegligible advantage.Proof.
A is an adversary who can break our scheme, and then we can construct a simulator B which solves the k−BDHE problem.Then, A and B play the interactive game in Figure5.(1) Init. A submits a challenged access policy W∗ to B.(2) Setup. The simulator B runs the Setup algorithm to generate the public parameter PK. B chooses random d∈Zp and generates(19)v=gd∏gK+1−j−1=gd−∑j∈WαK+1−j=gγ,where B outputs PK=g,Yg,α,K,v∈G2K+1.Figure 5
The game between the adversary and simulator.Phase 3.
The adversaryA submits idua,Lua to query private keys, where Lua≠W∗. The challenger B first selects k random numbers ri∈Zp for i=1,2,…,k and sets k=r1+r2+⋯+rk. Then, B randomly chooses a,c∈Zp∗ and computes(20)D=gd∏gK+1−j−1r/a+c=grγ/a+c.
Fori∈1,k,(21)Di1=gd∏gK+1−j−c∏gK+1−j−ri′/a+c=gd∏gK+1−j−1cαi+rj/a+c,ifj∈1,k,gd∏gK+1−j−c∏gK+1−j−ri′/a+c=gd∏gK+1−j−1cαi+rj−k/μa+c,ifj∈k+1,2k,Di2=ggd∏​gK+1−j−1cαi+rj−2k/μa+c,j∈2k+1,3k.
(3) Challenge. B sets C0∗=h=gt for some t and C1∗=hd and gives C0∗,C0∗,Zk to A. Thus hd=gdt=gd∏gK+1−j−1∏gK+1−jt=v∏gK+1−jt, and Zk=Key if Z=eg,hαK+1.Phase 4.
The adversaryA repeats Phase 1.
(4) Guess. The adversary A outputs a guess b′∈0,1. If the adversary A outputs b′=1, Z is a random element; if b′=0, Z is eg,hαK+1. When b′=0, B breaks the k−BDHE problem.
Note that in attribute-based cryptography, collusion attack is an important discussion point. In order to model the collusion attacks, a decrypting proxy is presented. Each decryption proxypir simulates a legal decryption key component with a random r. The definition of decryption proxy and the detail of model collusion attacks are given in [27], which will not be discussed here.
If there is 0-collusion, B has at least∈/2 advantage in breaking the k−BDHE problem.
If there is 1-collusion, B has at least1−q/pl∈/2 advantage in breaking the k−BDHE problem.
If there ism-collusion, B has at least 1−1−q/plm∈/2 advantage in breaking k−BDHE problem.
So, the advantage ofB to solve the k−BDHE problem is max∈/2,1−q/pl∈/2,1−1−q/plm∈/2.


#### 4.3.2. Policy Privacy

In the proposed scheme, no extra computation is needed for policy hiding, given that0,∗ exist in W¯. Hence, when the CS receives the encrypted sharing data with W¯, it can obtain nothing about the content and the access policy. The CS carries out partial decryption and sends the result to Ua. Likewise, unauthorised users, as adversaries, either from the server or users, can only obtain hidden access policies (Figure 6). Thus, our scheme provides policy privacy.Figure 6
The scheme ensures the policy privacy.


#### 4.3.3. Two-Way Anonymity

When an entity joins the system, the CA generates a pseudo-identityHIDut instead of his/her true identity idut. Firstly, the data owner shares information under a pseudo-identity HIDuo, and thus the CS and data users cannot obtain the true identity of the data owner. Secondly, potential data users’ idua can have an access without revealing their true identity, given that their attribute set satisfies the access policy. In this way, the data owner and the CS cannot know who access the encrypted information uploaded in the system. Therefore, the improved scheme ensures the two-way anonymity whilst realising flexible authorisation.


#### 4.3.4. Traceability

The security of improved scheme is still based onl−SDH problem. When a user identity HIDut is questioned, only the CA can trace his/her true identity idut by detecting the corresponding key and querying idut,HIDut,c. In particular, D′=c=H1idut, where true identity idut is used to generate c, which further enhances the accuracy of tracking.


#### 4.3.5. Access Validity

We also include the temporal factor with ciphertext in the improved scheme by giving a judgment mechanism, given that some EHRs have no shared value after a certain period of time. To prevent attack, access validityT and time stamp Tst are hashed, which provides evidence for CS verification. For example, the emergency message uploaded by a patient is invalid after his/her treatment time.


### 4.4. Performance Analysis

In this section, we conduct a performance analysis on the improved scheme compared with that on the existing schemes [15, 20, 27]. For the sake of simplicity, we define some notations on the main operation: n: the number of attributes; ex: modular exponentiation operation; p: pairing operation; h: hash operation; G0 and G1: the length of element in G0and G1, respectively.


#### 4.4.1. Computation and Communication Costs

As shown in Table2, computation cost during encryption phase is constant in our scheme, whereas it increases with the number of attributes in other schemes. During the decryption phase, the computation cost is equal to scheme [27], whereas in scheme [15, 20], it is relatively higher. Compared with the computation in the token generation phase, n+1ex is observed in our scheme, whereas np+h in scheme [27]. Therefore, the calculation amount of our scheme is low.Table 2
Comparison of computation and communication.
LocationEnc.TokenDec.Ciphertext length[15]n+2ex—2n+1p+nexn+1G0+G1[20]2n+3ex—2n+1p+nex2n+1G0+G1[27]3ex+npnp+hn+1p+ex3G0+G1Proposed3exn+1exn+1p+ex2G0+G1In the case of ciphertext,2G0+G1 is used in our scheme and 3G0+G1 in [27]. However, communication cost in other two schemes are n+1G0+G1 and 2n+1G0+G1, respectively. Thus, the proposed scheme has lesser communication cost, which is independent of the number of attributes.


#### 4.4.2. Features

Table3 shows the comparison amongst the features of different schemes. The proposed scheme provides one-to-many application requirement and two-way anonymity of data owner and data user, supports noninteractive relationship in token generation, and considers access validity.Table 3
Comparison of features.
LocationOne-to-manyAnonymityNoninteractionAccess validityOwnerUser[15]✓×✓✓×[20]✓××✓×[27]××✓××Proposed✓✓✓✓✓Next, we give the thorough experimental evaluation of our scheme. Our simulation experiment is on Intel(R) Core(TM) i7-6500U CPU at 2.5 GHz and 8.00 GB RAM. The algorithms are implemented using the pairing-based cryptography (PBC) library version 0.4.7-vc.zip [41]. Concretely, we select the Type A elliptic curve parameter with the 160-bit order in PBC library. For comparison convenience, we set n∈1,25, and all of the experimental results are averages of 200 trials. Meanwhile, we just show the experimental results of Encrypt, Decrypt, and GenToken algorithms.As shown in Figure7(a), the encryption time in the proposed scheme is constant 3ex, whereas in other three schemes, they are n+2ex, 2n+3ex, and 3ex+np, respectively; they increase with the number of attributes in the access policy. In the decryption phase, the time cost of our scheme is almost the same as that in scheme [27], while the time cost of the other two schemes is relatively high, as shown in Figure 7(b). Figure 7(c) shows that the token generation time of the improved scheme is slightly lower than that in [27], given that no bilinear pairing exists in our scheme. Thus, the improved scheme is efficient without reducing the security.Figure 7
Time costs of different phases. (a) Encryption time. (b) Decryption time. (c) GenToken time.
(a)(b)(c)


#### 4.4.3. Further Efficiency Comparison

In order to show the efficiency of improved scheme, we also simulate the main phase of our scheme on the laptop with Intel(R) Core(TM) i7-8550U CPU at 1.80 GHz and 8.00 GB RAM. Figure8 shows the results on different devices.Figure 8
Time costs on different devices. (a) Encryption time. (b) Decryption time. (c) GenToken time.
(a)(b)(c)


## 4.1. Concrete Scheme

### 4.1.1. Access Validity

In order to introduce the temporal factor, we give a mechanism to determine the access validity.T is the access validity of shared data, Tstamp is the time stamp, and T is divided into T1,T2,…,Tτ based on different time units of application requirements. Then HT=h1,h2,…,hτ,h1′,h2′,…,h′τ′, where hi=hTiTstamp, hτ′' is redundant data, andh′i′≠hi. Let tt be the current time; if htt−TstampTstamp∈HT, then tt satisfies T (Figure 3).Figure 3
Access validity.For example, access validityT=9days, which can be expressed as H9=1,2,…,9 and time stamp Tstamp=2020.02.15. A request occurred at timett=2020.02.19 and then h4=h42020.02.15∈H9, so the request is within the validity period.


### 4.1.2. Concrete Construction

Figure4 shows the overview of the improved scheme, which is described below.Figure 4
Overview of the improved scheme.(1) Setup. The same as in [27].H1:0,1∗⟶Zp∗,h:0,1∗×G1⟶Zp∗.(2) KeyGen. Assume an user Ut with identity idut and attribute set Lut, where t can be either o or a. Uo is the data owner and Ua is the data user. D′=c=H1idut, Di=HLuaiiβ, and the private key and public identity are(12)SKut=D,Di1,Di2,Di,D′,D″,Dt,HIDut=hidutDt.At last, put a tupleidut,HIDut,c into the table T and upload HIDut,gjD′ to CS.Instantly, havingUo with identity iduo and attribute set Luo, the private key and public identity are(13)SKuo=D,Di1,Di2,Di,D′,D″,Do,HIDuo=hiduoDo.HavingUa with identity idua and attribute set Lua, the private key and public identity are(14)SKua=D,Di1,Di2,Di,D′,D″,Da,HIDua=hiduaDa.(3) Encrypt. Only the differences are shown. Uo computes C2=∏j∈1,2kHjit and obfuscates W as follows: if Wi=Ai∗, W¯i=∗, else W¯i=0, so only ∗ and 0 are in the hidden access policy W¯. Next, Uo sets access validity T of M and computes HT=h1,h2,…,hτ,h1′,h2′,…,h′τ′ as shown in Section 4.1.1. Then the cipher is(15)CT=W¯,C,C0,C1,C2,HIDuo,Ht,Tstamp.(4) GenToken. Ua chooses x∈Zp∗ randomly and computes Di¯=HLuaiiβ/x, tka=h1/x=gβ/x. The token is(16)TKua=D¯i,tka,HIDua.(5) PDecrypt. Once the query is received, CS gets current time ttand computes whether htt−TstampTstamp∈HT. If it holds, CS goes on to judge whether the attributes set L¯ua satisfies the access policy W¯ by verifying equation (17). Then, CS performs the same operations as in the literature [27] and returns results to Ua:(17)e∏W¯i=0D¯i,C0=eC2,tka.(6) Decryp. The difference in this step is Di′=D1i,ifW¯i=0D2i,ifW¯i=∗; as long as Ua is a legitimate user, it can correctly meet the requirements of the hidden access policy W¯ at one time.(7) Trace. When something goes wrong, only pseudoidentity HIDut is submitted to CA who can find the true identity idut from idut,HIDut,c.


## 4.1.1. Access Validity

In order to introduce the temporal factor, we give a mechanism to determine the access validity.T is the access validity of shared data, Tstamp is the time stamp, and T is divided into T1,T2,…,Tτ based on different time units of application requirements. Then HT=h1,h2,…,hτ,h1′,h2′,…,h′τ′, where hi=hTiTstamp, hτ′' is redundant data, andh′i′≠hi. Let tt be the current time; if htt−TstampTstamp∈HT, then tt satisfies T (Figure 3).Figure 3
Access validity.For example, access validityT=9days, which can be expressed as H9=1,2,…,9 and time stamp Tstamp=2020.02.15. A request occurred at timett=2020.02.19 and then h4=h42020.02.15∈H9, so the request is within the validity period.


## 4.1.2. Concrete Construction

Figure4 shows the overview of the improved scheme, which is described below.Figure 4
Overview of the improved scheme.(1) Setup. The same as in [27].H1:0,1∗⟶Zp∗,h:0,1∗×G1⟶Zp∗.(2) KeyGen. Assume an user Ut with identity idut and attribute set Lut, where t can be either o or a. Uo is the data owner and Ua is the data user. D′=c=H1idut, Di=HLuaiiβ, and the private key and public identity are(12)SKut=D,Di1,Di2,Di,D′,D″,Dt,HIDut=hidutDt.At last, put a tupleidut,HIDut,c into the table T and upload HIDut,gjD′ to CS.Instantly, havingUo with identity iduo and attribute set Luo, the private key and public identity are(13)SKuo=D,Di1,Di2,Di,D′,D″,Do,HIDuo=hiduoDo.HavingUa with identity idua and attribute set Lua, the private key and public identity are(14)SKua=D,Di1,Di2,Di,D′,D″,Da,HIDua=hiduaDa.(3) Encrypt. Only the differences are shown. Uo computes C2=∏j∈1,2kHjit and obfuscates W as follows: if Wi=Ai∗, W¯i=∗, else W¯i=0, so only ∗ and 0 are in the hidden access policy W¯. Next, Uo sets access validity T of M and computes HT=h1,h2,…,hτ,h1′,h2′,…,h′τ′ as shown in Section 4.1.1. Then the cipher is(15)CT=W¯,C,C0,C1,C2,HIDuo,Ht,Tstamp.(4) GenToken. Ua chooses x∈Zp∗ randomly and computes Di¯=HLuaiiβ/x, tka=h1/x=gβ/x. The token is(16)TKua=D¯i,tka,HIDua.(5) PDecrypt. Once the query is received, CS gets current time ttand computes whether htt−TstampTstamp∈HT. If it holds, CS goes on to judge whether the attributes set L¯ua satisfies the access policy W¯ by verifying equation (17). Then, CS performs the same operations as in the literature [27] and returns results to Ua:(17)e∏W¯i=0D¯i,C0=eC2,tka.(6) Decryp. The difference in this step is Di′=D1i,ifW¯i=0D2i,ifW¯i=∗; as long as Ua is a legitimate user, it can correctly meet the requirements of the hidden access policy W¯ at one time.(7) Trace. When something goes wrong, only pseudoidentity HIDut is submitted to CA who can find the true identity idut from idut,HIDut,c.


## 4.2. Security Model

The security model of the improved scheme is similar to that of the scheme in [27]. The data confidentiality of the improved scheme is considered to be guaranteed if there is no probabilistic polynomial-time adversary A with nonnegligible advantages in the following security game.


### 4.2.1. Init

The adversary A chooses a challenge access policyW∗ and sends it to the challenger B.


### 4.2.2. Setup

The challenger B runs theSetup algorithm and publishes the public parameter PK.Phase 1.
The adversary A submitsidua,Lua to query decryption keys where Lua≠W∗. The challenger B answers with a decryption key SKua. A repeats this phase adaptively.


### 4.2.3. Challenge

The challenger B runsEncrypt algorithm to obtain C0∗,C0∗,Key. Next, B sets Key0=Key and picks a random Key1 of same length as Key0. It then flips a random coin b∈0,1 and gives C0∗,C0∗,Keyb to the adversary.Phase 2.
The adversaryA repeats Phase 1.


### 4.2.4. Guess

The adversaryA outputs a guess b′∈0,1 .The adversaryA wins the game if b′=b under the restriction that Lua≠W∗. The advantage of an adversary in this game is defined as(18)Prb′=b−12.


## 4.2.1. Init

The adversary A chooses a challenge access policyW∗ and sends it to the challenger B.


## 4.2.2. Setup

The challenger B runs theSetup algorithm and publishes the public parameter PK.Phase 1.
The adversary A submitsidua,Lua to query decryption keys where Lua≠W∗. The challenger B answers with a decryption key SKua. A repeats this phase adaptively.


## 4.2.3. Challenge

The challenger B runsEncrypt algorithm to obtain C0∗,C0∗,Key. Next, B sets Key0=Key and picks a random Key1 of same length as Key0. It then flips a random coin b∈0,1 and gives C0∗,C0∗,Keyb to the adversary.Phase 2.
The adversaryA repeats Phase 1.


## 4.2.4. Guess

The adversaryA outputs a guess b′∈0,1 .The adversaryA wins the game if b′=b under the restriction that Lua≠W∗. The advantage of an adversary in this game is defined as(18)Prb′=b−12.


## 4.3. Security Analysis

### 4.3.1. Data Confidentiality

The security of improved scheme is still based on thek−DBDH problem.Theorem 1.
If a probabilistic polynomial-time adversaryA can break our scheme with a nonnegligible advantage, then we can construct a simulator B to solve k−BDHE problem with a nonnegligible advantage.Proof.
A is an adversary who can break our scheme, and then we can construct a simulator B which solves the k−BDHE problem.Then, A and B play the interactive game in Figure5.(1) Init. A submits a challenged access policy W∗ to B.(2) Setup. The simulator B runs the Setup algorithm to generate the public parameter PK. B chooses random d∈Zp and generates(19)v=gd∏gK+1−j−1=gd−∑j∈WαK+1−j=gγ,where B outputs PK=g,Yg,α,K,v∈G2K+1.Figure 5
The game between the adversary and simulator.Phase 3.
The adversaryA submits idua,Lua to query private keys, where Lua≠W∗. The challenger B first selects k random numbers ri∈Zp for i=1,2,…,k and sets k=r1+r2+⋯+rk. Then, B randomly chooses a,c∈Zp∗ and computes(20)D=gd∏gK+1−j−1r/a+c=grγ/a+c.
Fori∈1,k,(21)Di1=gd∏gK+1−j−c∏gK+1−j−ri′/a+c=gd∏gK+1−j−1cαi+rj/a+c,ifj∈1,k,gd∏gK+1−j−c∏gK+1−j−ri′/a+c=gd∏gK+1−j−1cαi+rj−k/μa+c,ifj∈k+1,2k,Di2=ggd∏​gK+1−j−1cαi+rj−2k/μa+c,j∈2k+1,3k.
(3) Challenge. B sets C0∗=h=gt for some t and C1∗=hd and gives C0∗,C0∗,Zk to A. Thus hd=gdt=gd∏gK+1−j−1∏gK+1−jt=v∏gK+1−jt, and Zk=Key if Z=eg,hαK+1.Phase 4.
The adversaryA repeats Phase 1.
(4) Guess. The adversary A outputs a guess b′∈0,1. If the adversary A outputs b′=1, Z is a random element; if b′=0, Z is eg,hαK+1. When b′=0, B breaks the k−BDHE problem.
Note that in attribute-based cryptography, collusion attack is an important discussion point. In order to model the collusion attacks, a decrypting proxy is presented. Each decryption proxypir simulates a legal decryption key component with a random r. The definition of decryption proxy and the detail of model collusion attacks are given in [27], which will not be discussed here.
If there is 0-collusion, B has at least∈/2 advantage in breaking the k−BDHE problem.
If there is 1-collusion, B has at least1−q/pl∈/2 advantage in breaking the k−BDHE problem.
If there ism-collusion, B has at least 1−1−q/plm∈/2 advantage in breaking k−BDHE problem.
So, the advantage ofB to solve the k−BDHE problem is max∈/2,1−q/pl∈/2,1−1−q/plm∈/2.


### 4.3.2. Policy Privacy

In the proposed scheme, no extra computation is needed for policy hiding, given that0,∗ exist in W¯. Hence, when the CS receives the encrypted sharing data with W¯, it can obtain nothing about the content and the access policy. The CS carries out partial decryption and sends the result to Ua. Likewise, unauthorised users, as adversaries, either from the server or users, can only obtain hidden access policies (Figure 6). Thus, our scheme provides policy privacy.Figure 6
The scheme ensures the policy privacy.


### 4.3.3. Two-Way Anonymity

When an entity joins the system, the CA generates a pseudo-identityHIDut instead of his/her true identity idut. Firstly, the data owner shares information under a pseudo-identity HIDuo, and thus the CS and data users cannot obtain the true identity of the data owner. Secondly, potential data users’ idua can have an access without revealing their true identity, given that their attribute set satisfies the access policy. In this way, the data owner and the CS cannot know who access the encrypted information uploaded in the system. Therefore, the improved scheme ensures the two-way anonymity whilst realising flexible authorisation.


### 4.3.4. Traceability

The security of improved scheme is still based onl−SDH problem. When a user identity HIDut is questioned, only the CA can trace his/her true identity idut by detecting the corresponding key and querying idut,HIDut,c. In particular, D′=c=H1idut, where true identity idut is used to generate c, which further enhances the accuracy of tracking.


### 4.3.5. Access Validity

We also include the temporal factor with ciphertext in the improved scheme by giving a judgment mechanism, given that some EHRs have no shared value after a certain period of time. To prevent attack, access validityT and time stamp Tst are hashed, which provides evidence for CS verification. For example, the emergency message uploaded by a patient is invalid after his/her treatment time.


## 4.3.1. Data Confidentiality

The security of improved scheme is still based on thek−DBDH problem.Theorem 1.
If a probabilistic polynomial-time adversaryA can break our scheme with a nonnegligible advantage, then we can construct a simulator B to solve k−BDHE problem with a nonnegligible advantage.Proof.
A is an adversary who can break our scheme, and then we can construct a simulator B which solves the k−BDHE problem.Then, A and B play the interactive game in Figure5.(1) Init. A submits a challenged access policy W∗ to B.(2) Setup. The simulator B runs the Setup algorithm to generate the public parameter PK. B chooses random d∈Zp and generates(19)v=gd∏gK+1−j−1=gd−∑j∈WαK+1−j=gγ,where B outputs PK=g,Yg,α,K,v∈G2K+1.Figure 5
The game between the adversary and simulator.Phase 3.
The adversaryA submits idua,Lua to query private keys, where Lua≠W∗. The challenger B first selects k random numbers ri∈Zp for i=1,2,…,k and sets k=r1+r2+⋯+rk. Then, B randomly chooses a,c∈Zp∗ and computes(20)D=gd∏gK+1−j−1r/a+c=grγ/a+c.
Fori∈1,k,(21)Di1=gd∏gK+1−j−c∏gK+1−j−ri′/a+c=gd∏gK+1−j−1cαi+rj/a+c,ifj∈1,k,gd∏gK+1−j−c∏gK+1−j−ri′/a+c=gd∏gK+1−j−1cαi+rj−k/μa+c,ifj∈k+1,2k,Di2=ggd∏​gK+1−j−1cαi+rj−2k/μa+c,j∈2k+1,3k.
(3) Challenge. B sets C0∗=h=gt for some t and C1∗=hd and gives C0∗,C0∗,Zk to A. Thus hd=gdt=gd∏gK+1−j−1∏gK+1−jt=v∏gK+1−jt, and Zk=Key if Z=eg,hαK+1.Phase 4.
The adversaryA repeats Phase 1.
(4) Guess. The adversary A outputs a guess b′∈0,1. If the adversary A outputs b′=1, Z is a random element; if b′=0, Z is eg,hαK+1. When b′=0, B breaks the k−BDHE problem.
Note that in attribute-based cryptography, collusion attack is an important discussion point. In order to model the collusion attacks, a decrypting proxy is presented. Each decryption proxypir simulates a legal decryption key component with a random r. The definition of decryption proxy and the detail of model collusion attacks are given in [27], which will not be discussed here.
If there is 0-collusion, B has at least∈/2 advantage in breaking the k−BDHE problem.
If there is 1-collusion, B has at least1−q/pl∈/2 advantage in breaking the k−BDHE problem.
If there ism-collusion, B has at least 1−1−q/plm∈/2 advantage in breaking k−BDHE problem.
So, the advantage ofB to solve the k−BDHE problem is max∈/2,1−q/pl∈/2,1−1−q/plm∈/2.


## 4.3.2. Policy Privacy

In the proposed scheme, no extra computation is needed for policy hiding, given that0,∗ exist in W¯. Hence, when the CS receives the encrypted sharing data with W¯, it can obtain nothing about the content and the access policy. The CS carries out partial decryption and sends the result to Ua. Likewise, unauthorised users, as adversaries, either from the server or users, can only obtain hidden access policies (Figure 6). Thus, our scheme provides policy privacy.Figure 6
The scheme ensures the policy privacy.


## 4.3.3. Two-Way Anonymity

When an entity joins the system, the CA generates a pseudo-identityHIDut instead of his/her true identity idut. Firstly, the data owner shares information under a pseudo-identity HIDuo, and thus the CS and data users cannot obtain the true identity of the data owner. Secondly, potential data users’ idua can have an access without revealing their true identity, given that their attribute set satisfies the access policy. In this way, the data owner and the CS cannot know who access the encrypted information uploaded in the system. Therefore, the improved scheme ensures the two-way anonymity whilst realising flexible authorisation.


## 4.3.4. Traceability

The security of improved scheme is still based onl−SDH problem. When a user identity HIDut is questioned, only the CA can trace his/her true identity idut by detecting the corresponding key and querying idut,HIDut,c. In particular, D′=c=H1idut, where true identity idut is used to generate c, which further enhances the accuracy of tracking.


## 4.3.5. Access Validity

We also include the temporal factor with ciphertext in the improved scheme by giving a judgment mechanism, given that some EHRs have no shared value after a certain period of time. To prevent attack, access validityT and time stamp Tst are hashed, which provides evidence for CS verification. For example, the emergency message uploaded by a patient is invalid after his/her treatment time.


## 4.4. Performance Analysis

In this section, we conduct a performance analysis on the improved scheme compared with that on the existing schemes [15, 20, 27]. For the sake of simplicity, we define some notations on the main operation: n: the number of attributes; ex: modular exponentiation operation; p: pairing operation; h: hash operation; G0 and G1: the length of element in G0and G1, respectively.


### 4.4.1. Computation and Communication Costs

As shown in Table2, computation cost during encryption phase is constant in our scheme, whereas it increases with the number of attributes in other schemes. During the decryption phase, the computation cost is equal to scheme [27], whereas in scheme [15, 20], it is relatively higher. Compared with the computation in the token generation phase, n+1ex is observed in our scheme, whereas np+h in scheme [27]. Therefore, the calculation amount of our scheme is low.Table 2
Comparison of computation and communication.
LocationEnc.TokenDec.Ciphertext length[15]n+2ex—2n+1p+nexn+1G0+G1[20]2n+3ex—2n+1p+nex2n+1G0+G1[27]3ex+npnp+hn+1p+ex3G0+G1Proposed3exn+1exn+1p+ex2G0+G1In the case of ciphertext,2G0+G1 is used in our scheme and 3G0+G1 in [27]. However, communication cost in other two schemes are n+1G0+G1 and 2n+1G0+G1, respectively. Thus, the proposed scheme has lesser communication cost, which is independent of the number of attributes.


### 4.4.2. Features

Table3 shows the comparison amongst the features of different schemes. The proposed scheme provides one-to-many application requirement and two-way anonymity of data owner and data user, supports noninteractive relationship in token generation, and considers access validity.Table 3
Comparison of features.
LocationOne-to-manyAnonymityNoninteractionAccess validityOwnerUser[15]✓×✓✓×[20]✓××✓×[27]××✓××Proposed✓✓✓✓✓Next, we give the thorough experimental evaluation of our scheme. Our simulation experiment is on Intel(R) Core(TM) i7-6500U CPU at 2.5 GHz and 8.00 GB RAM. The algorithms are implemented using the pairing-based cryptography (PBC) library version 0.4.7-vc.zip [41]. Concretely, we select the Type A elliptic curve parameter with the 160-bit order in PBC library. For comparison convenience, we set n∈1,25, and all of the experimental results are averages of 200 trials. Meanwhile, we just show the experimental results of Encrypt, Decrypt, and GenToken algorithms.As shown in Figure7(a), the encryption time in the proposed scheme is constant 3ex, whereas in other three schemes, they are n+2ex, 2n+3ex, and 3ex+np, respectively; they increase with the number of attributes in the access policy. In the decryption phase, the time cost of our scheme is almost the same as that in scheme [27], while the time cost of the other two schemes is relatively high, as shown in Figure 7(b). Figure 7(c) shows that the token generation time of the improved scheme is slightly lower than that in [27], given that no bilinear pairing exists in our scheme. Thus, the improved scheme is efficient without reducing the security.Figure 7
Time costs of different phases. (a) Encryption time. (b) Decryption time. (c) GenToken time.
(a)(b)(c)


### 4.4.3. Further Efficiency Comparison

In order to show the efficiency of improved scheme, we also simulate the main phase of our scheme on the laptop with Intel(R) Core(TM) i7-8550U CPU at 1.80 GHz and 8.00 GB RAM. Figure8 shows the results on different devices.Figure 8
Time costs on different devices. (a) Encryption time. (b) Decryption time. (c) GenToken time.
(a)(b)(c)


## 4.4.1. Computation and Communication Costs

As shown in Table2, computation cost during encryption phase is constant in our scheme, whereas it increases with the number of attributes in other schemes. During the decryption phase, the computation cost is equal to scheme [27], whereas in scheme [15, 20], it is relatively higher. Compared with the computation in the token generation phase, n+1ex is observed in our scheme, whereas np+h in scheme [27]. Therefore, the calculation amount of our scheme is low.Table 2
Comparison of computation and communication.
LocationEnc.TokenDec.Ciphertext length[15]n+2ex—2n+1p+nexn+1G0+G1[20]2n+3ex—2n+1p+nex2n+1G0+G1[27]3ex+npnp+hn+1p+ex3G0+G1Proposed3exn+1exn+1p+ex2G0+G1In the case of ciphertext,2G0+G1 is used in our scheme and 3G0+G1 in [27]. However, communication cost in other two schemes are n+1G0+G1 and 2n+1G0+G1, respectively. Thus, the proposed scheme has lesser communication cost, which is independent of the number of attributes.


## 4.4.2. Features

Table3 shows the comparison amongst the features of different schemes. The proposed scheme provides one-to-many application requirement and two-way anonymity of data owner and data user, supports noninteractive relationship in token generation, and considers access validity.Table 3
Comparison of features.
LocationOne-to-manyAnonymityNoninteractionAccess validityOwnerUser[15]✓×✓✓×[20]✓××✓×[27]××✓××Proposed✓✓✓✓✓Next, we give the thorough experimental evaluation of our scheme. Our simulation experiment is on Intel(R) Core(TM) i7-6500U CPU at 2.5 GHz and 8.00 GB RAM. The algorithms are implemented using the pairing-based cryptography (PBC) library version 0.4.7-vc.zip [41]. Concretely, we select the Type A elliptic curve parameter with the 160-bit order in PBC library. For comparison convenience, we set n∈1,25, and all of the experimental results are averages of 200 trials. Meanwhile, we just show the experimental results of Encrypt, Decrypt, and GenToken algorithms.As shown in Figure7(a), the encryption time in the proposed scheme is constant 3ex, whereas in other three schemes, they are n+2ex, 2n+3ex, and 3ex+np, respectively; they increase with the number of attributes in the access policy. In the decryption phase, the time cost of our scheme is almost the same as that in scheme [27], while the time cost of the other two schemes is relatively high, as shown in Figure 7(b). Figure 7(c) shows that the token generation time of the improved scheme is slightly lower than that in [27], given that no bilinear pairing exists in our scheme. Thus, the improved scheme is efficient without reducing the security.Figure 7
Time costs of different phases. (a) Encryption time. (b) Decryption time. (c) GenToken time.
(a)(b)(c)


## 4.4.3. Further Efficiency Comparison

In order to show the efficiency of improved scheme, we also simulate the main phase of our scheme on the laptop with Intel(R) Core(TM) i7-8550U CPU at 1.80 GHz and 8.00 GB RAM. Figure8 shows the results on different devices.Figure 8
Time costs on different devices. (a) Encryption time. (b) Decryption time. (c) GenToken time.
(a)(b)(c)


## 5. Conclusions

In this study, we propose an improved secure sharing scheme using ABE for mHealth. Our improved scheme has advantages of two-way anonymity of data owner and data user, noninteractive relationship, and low computation costs without weakening security or setting any particular conditions. The improved scheme helps to protect EHRs from the unauthorised online entities in mHealth. The proposed scheme also considers access validity of EHRs. Through security and evaluative results of comparison, our scheme is found more efficient in terms of computational cost and energy consumption than three of the existing schemes.As part of our future work, we aim to design efficient attribute-based signcryption schemes for mHealth. Additionally, we aim to provide different access rights for different users.



---

*Source: 3984048-2020-08-03.xml*