# A Blockchain-Based CP-ABE Scheme with Partially Hidden Access Structures

Authors: Yang Ba; Xuexian Hu; Yue Chen; Zenghang Hao; Xuewei Li; Xincheng Yan
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Data sharing has become a key technology to break down data silos in the big data era. Ciphertext-policy attribute-based encryption (CP-ABE) is widely used in secure data-sharing schemes to realize flexible and fine-grained access control. However, in traditional CP-ABE schemes, the access structure is directly shared along with the ciphertext, potentially leading to users’ private information leakage. Outsourcing data to a centralized third party can easily result in privacy leakage and single-point bottlenecks, and the lack of transparency in data storage and sharing casts doubts whether users’ data are safe. To address these issues, we propose a blockchain-based CP-ABE scheme with partially hidden access structures (BCP-ABE-PHAS) to achieve fine-grained access control while ensuring user privacy. First, we propose an efficient CP-ABE scheme with partially hidden access structures, where the ciphertext size is constant. To assist data decryption, we design a garbled Bloom filter to help users quickly locate the position of wildcards in the access structure. Then, to improve storage efficiency and system scalability, we propose a data storage scheme that combines blockchain technology and the interplanetary file system, ensuring data integrity. Finally, we employ smart contracts for a transparent data storage and sharing process without third-party participation. Security analysis and performance evaluation show that the proposed BCP-ABE-PHAS scheme can preserve policy privacy with efficient storage and low computational overhead.


---

## Body

## 1. Introduction

Cloud computing promotes the aggregation of storage and computational resources and has a tremendous market value. However, when data owners outsource data to cloud services, they lose control of their data, and their private information is at risk of leakage [1]. Recently, data security incidents have occurred frequently, and such events undermine users’ confidence in data security and raise concerns regarding cloud storage.In 2005, Sahai and Waters [2] proposed attribute-based encryption (ABE) to achieve fine-grained access control. The ABE scheme is mainly categorized into ciphertext-policy ABE (CP-ABE) [3] and key-policy ABE (KP-ABE) [4]. In the KP-ABE scheme, the secret key and ciphertext are associated with the access structure (or access policy) and attribute set, respectively. In this case, the ciphertext can only be decrypted when the attribute set satisfies the access policy. Contrarily, in the CP-ABE scheme, the ciphertext and secret key are associated with the access policy and attribute set, respectively.The CP-ABE scheme features fine-grained access control and one-to-many secure data sharing. However, in the traditional CP-ABE scheme, the access policy is directly shared along with the ciphertext. Consequently, anyone can get this access policy while obtaining the ciphertext; however, the access policy may contain the user’s sensitive information.Consider a scenario in which a patient with a social security number (SSN) 123-456-789 wants to outsource his (or her) health data to the cloud and establish an access policy, as shown in Figure1(a). This patient designs an access policy based on which only this patient or the psychologist at the city hospital can access the data. If the patient uses the traditional CP-ABE scheme to send the encrypted data and access policy to the cloud, anyone with access to this cloud can obtain the patient’s access policy. Thus, the data security of this patient, who is suffering from psychological problems, is undoubtedly threatened.Figure 1
(a) Access structure. (b) Partially hidden access structure.
(a)(b)The most effective way to protect a user’s access policy information is to hide the attribute information. Policy hiding involves fully and partially hiding. In the CP-ABE scheme, fully hidden access policies imply that no attribute information in the access policy is revealed, and partially hidden access policies imply that only sensitive attribute values are hidden. As shown in Figure1(b), the partially hidden access policy is expressed as (SSN: ∗ OR (Affiliation: ∗ AND Occupation: ∗)), where the attribute values that may expose a user’s information are hidden. A tradeoff is obtained between the efficiency of the CP-ABE scheme and the fully hidden access structure using a partially hidden access structure embedded in the CP-ABE scheme to reduce computational costs [5].Additionally, centralized storage architectures are vulnerable to various network attacks such as single point of attack, man-in-the-middle attack, and distributed denial-of-service attack [6, 7]. Owing to such attacks, data owners may lose control of their data. Because blockchain technology is transparent, decentralized, and unforgeable, blockchain-based data storage and sharing schemes have been proposed to resist such attacks. Blockchain is an append-only distributed database, so large-scale data can quickly bloat the blockchain and make it expensive and inefficient to scale. To alleviate the storage pressure of the blockchain, we propose a storage scheme that combines blockchain technology and the interplanetary file system (IPFS) [8].Therefore, we propose a blockchain-based CP-ABE scheme with a partially hidden access structure (BCP-ABE-PHAS) to realize secure data storage and sharing. Our main contributions are summarized as follows:(1)
We propose a CP-ABE scheme with partially hidden access structures to achieve fine-grained access control and ensure user privacy. Moreover, to assist data decryption, we design a garbled Bloom filter (GBF) to locate the position of wildcards in the access policy.(2)
To ensure data integrity and improve system scalability, we adopt a storage scheme that combines blockchain technology and the IPFS, in which the real ciphertext is stored in the IPFS, and meanwhile, the access policy is stored on the blockchain.(3)
We employ smart contracts to achieve automated and trusted access control, where the entire data storage and sharing process is transparent without third-party participation.(4)
Security analysis and performance evaluation show that the proposed scheme can achieve effective privacy preservation without incurring considerable overhead.The remainder of this paper is organized as follows. In Section2, we introduce the related work. In Section 3, preliminaries are described. We then present the system architecture and security model in Section 4, followed by the detailed construction of the proposed scheme in Section 5. The security analysis and the performance evaluation are performed in Section 6, and the conclusions are presented in Section 7.


## 2. Related Work

Bethencourt et al. [3] proposed the first CP-ABE scheme. This scheme allows data owners to specify a fine-grained access policy for their data to realize secure data sharing. However, an access policy may contain a user’s sensitive information which is attached to the ciphertext as a plaintext, causing privacy leakage [9].To address this problem, some schemes that hide the access policy have been proposed. For example, Nishide et al. [10] proposed a CP-ABE scheme with hidden access policies. They proposed two schemes in which only attribute values are hidden using AND gates on multivalued attributes with wildcards. Based on this scheme [10], Li et al. [11] implemented user accountability while hiding the access policy. Phuong et al. [12] proposed two CP-ABE schemes with a hidden access policy. In this case, the access structure employs AND gates on positive and negative attributes with wildcards, and the ciphertext length is constant. Although these schemes are secure and efficient, AND-based access policies are limited in terms of expressiveness.Thus, to facilitate a more expressive access policy, Lai et al. [13] proposed a partially hidden CP-ABE scheme that supports linear secret-sharing scheme-based access policy. Based on this scheme [13], Zhang et al. [14] proposed a scheme that can support a large attribute universe. However, these schemes are built using composite-order bilinear groups; thus, their efficiency is low. Katz et al. [15] first proposed the inner-product predicate encryption. However, the “superpolynomial blowup” problem makes the CP-ABE schemes that use the attribute-hiding IPE to construct a fully hidden access policy very inefficient [16]. Hur [17] proposed a CP-ABE scheme that can support any monotonous access policy. In this case, the access policy is hidden by attribute remapping, and most decryption operations are delegated to the cloud storage center to considerably reduce the requester’s computational overhead.Because blockchain technology is decentralized, tamperproof, and transparent, it is widely used in secure data sharing and access control schemes. Based on inner-product predicate encryption [15], Gao et al. [18] proposed a trustworthy secure CP-ABE scheme with a fully hidden access policy based on blockchain technology. This scheme combines inner-product encryption and homomorphic encryption to hide access policies and uses smart contracts to store the generated proof on the blockchain permanently. Zhang et al. [19] proposed an access control for the Internet of Things (IoT) based on the smart contract which consists of the judge contract, access control contract, and register contract to achieve intelligent and efficient access control. Additionally, Xu et al. [20] proposed a blockchain-based smart healthcare system for large-scale health data privacy preservation. This system uses digital envelope technology to verify the confidentiality of information; however, it can only support one-to-one secure transmission, which does not satisfy the requirements of users who simultaneously employ multiple third parties to provide services. In the IoT environment, Xu et al. [21] and Novo [22] adopted the blockchain technology to realize secure data sharing and access control; however, these schemes do not satisfy large-scale storage and privacy protection requirements.


## 3. Preliminaries

In this section, we introduce some basic knowledge associated with our BCP-ABE-PHAS.


### 3.1. Bilinear Map

LetG and GT be multiplicative cyclic groups of prime order q. A bilinear mapping is a function e:G×G⟶GT which has the following properties:(1)
Bilinearity:∀u,v∈G and ∀a,b∈ℤq∗, there exists eua,vb=eu,vab(2)
Nondegeneracy: there existsg∈G such that eg,g≠1(3)
Computability:∀u,v∈G, eu,v can be effectively computed


### 3.2. Blockchain

Blockchain is an append-only data structure in a peer-to-peer network environment, where data blocks are connected chronologically in a chain and the data in a blockchain are assured to be tamperproof, unforgeable, and traceable using cryptography [23]. As shown in Figure 2, a block comprises the block header and block body. The block header consists of four components: (1) PreBkHash, which is the digest of the previous block; (2) TS, which is the timestamp of the block creation; (3) nonce, which is the consensus proof computed by miners and guarantees the consensus of the block; (4) Merkle root, which is the root hash of the Merkle hash tree. The block body stores transaction details.Figure 2
Blockchain structure.The concept of smart contracts was first proposed by Szabo [24]. A smart contract is a program that contains code (its function) and data (its state). Smart contracts are used in Ethereum blockchain [25].The contract address is usually given when a contract is deployed to the blockchain. Contract address is the address to a collection of codes on the blockchain that executes functions. These functions of a contract address are executed when a transaction is made to the contract address. Once a smart contract is deployed in the network, it can run as programmed without human intervention.


### 3.3. Bloom Filter

The Bloom filter is a space-efficient probabilistic data structure used to determine whether an element is contained in a specific set [26]. The Bloom filter is an m-bit array that can represent a set S of maximum n elements. The Bloom filter has k independent hash functions H=h1,…,hk, where hi:0,1∗↦1,m and 1≤i≤k indicates that the value generated by the hash function is uniformly distributed in 1,m. Herein, a Bloom filter with parameters m,n,k,H is represented as m,n,k,H0BF, a Bloom filter encoding the set S is represented as BFS, and the value at index i in BFS is represented as BFSi.First, all bits in the Bloom filter are set to 0. As shown in Figure3, when we add the element x in the set S=x,y to the Bloom filter, we set BFShix=1 for 1≤i≤3. When we verify the existence of an element y in set S, if BFShiy=0 exists for 1≤i≤3, this proves that y∉S; otherwise, y∈S with a high probability.Figure 3
Bloom filter.The Bloom filter yields false positives; in other words, it yields an element that does not belong to the setS, but the corresponding position values are all 1. As shown in Figure 3, the element z does not belong to the set x,y; however, BFShiz=1 for 1≤i≤3. According to Bose et al. [27], the false positive probability is negligible if we select the optimal k and m values.


### 3.4. Secret Sharing

Secret sharing technology is an important aspect of cryptography research. For example, Shamir [28] proposed a k,n-threshold secret-sharing scheme. The basic concept of this scheme is that the secret s to be shared is divided and distributed to n participants. The secret can be recovered in the case of minimum k participants; otherwise, the secret cannot be recovered. When k=n, secret sharing can be obtained using the ⊕ (XOR) operation. Randomly generate n−1 bit strings r1,…,rn−1 with the same length as the secret s, and calculate rn=r1⊕…⊕rn−1⊕s; each of ri is a part of the secret s. Finally, the secret s can be obtained by computing r1⊕…⊕rn.


### 3.5. Attribute Vector

As shown in Figure4, we define two attribute vectors W¯=w¯1,…,w¯L∈Σ∗L and W=w1,…,wL∈ΣL, where Σ⊂ℤq∗ and Σ∗=Σ∪∗. Here, W¯ contains the wildcard ∗, and J=j1,…,jn⊂1,…,L represents the set of wildcard positions in W¯.Figure 4
Attribute vector.The decryption algorithm discussed in this paper employs the following polynomial identity, wherewi is the attribute value at position i in the attribute vector.(1)∑i=1L∏j∈Ji−jwi=∑i=1,i∉JL∏j∈Ji−jwi.We use Viète’s formulas [29] to construct the polynomial ∏j∈Ji−j=xn+an−1xn−1+⋯+a0 in equation (1), and the coefficients are calculated as follows:(2)an−k=−1i−n∏1≤i1<i2<…<ik≤nji1ji2…jik,0≤k≤n,where n=J. Here, if J is clear, we can calculate the polynomial coefficients ai. For example, when J=j1,j2,j3, we can construct polynomial x−j1x−j2x−j3 and calculate the coefficients:(3)a0=−j1j2j3,a1=j1j2+j1j3+j2j3,a2=−j1+j2+j3,a3=1.


### 3.6. Decision Linear Assumption

LetG be a bilinear group of prime order q with a generator g. For any probabilistic polynomial-time (PPT) adversary A, its advantage AdvAλ in solving the decision linear (DLIN) problem [30] in G is(4)AdvAλ=PrAg,ga,gb,gac,gd,gbc+d=1−PrAg,ga,gb,gac,gd,gr=1,where the probability is taken over all possible choices of a,b,c,d,r∈ℤq∗. We say that the DLIN assumption holds in G if there exists a negligible function ελ such that AdvAλ<ϵ for any PPT algorithm A.


## 3.1. Bilinear Map

LetG and GT be multiplicative cyclic groups of prime order q. A bilinear mapping is a function e:G×G⟶GT which has the following properties:(1)
Bilinearity:∀u,v∈G and ∀a,b∈ℤq∗, there exists eua,vb=eu,vab(2)
Nondegeneracy: there existsg∈G such that eg,g≠1(3)
Computability:∀u,v∈G, eu,v can be effectively computed


## 3.2. Blockchain

Blockchain is an append-only data structure in a peer-to-peer network environment, where data blocks are connected chronologically in a chain and the data in a blockchain are assured to be tamperproof, unforgeable, and traceable using cryptography [23]. As shown in Figure 2, a block comprises the block header and block body. The block header consists of four components: (1) PreBkHash, which is the digest of the previous block; (2) TS, which is the timestamp of the block creation; (3) nonce, which is the consensus proof computed by miners and guarantees the consensus of the block; (4) Merkle root, which is the root hash of the Merkle hash tree. The block body stores transaction details.Figure 2
Blockchain structure.The concept of smart contracts was first proposed by Szabo [24]. A smart contract is a program that contains code (its function) and data (its state). Smart contracts are used in Ethereum blockchain [25].The contract address is usually given when a contract is deployed to the blockchain. Contract address is the address to a collection of codes on the blockchain that executes functions. These functions of a contract address are executed when a transaction is made to the contract address. Once a smart contract is deployed in the network, it can run as programmed without human intervention.


## 3.3. Bloom Filter

The Bloom filter is a space-efficient probabilistic data structure used to determine whether an element is contained in a specific set [26]. The Bloom filter is an m-bit array that can represent a set S of maximum n elements. The Bloom filter has k independent hash functions H=h1,…,hk, where hi:0,1∗↦1,m and 1≤i≤k indicates that the value generated by the hash function is uniformly distributed in 1,m. Herein, a Bloom filter with parameters m,n,k,H is represented as m,n,k,H0BF, a Bloom filter encoding the set S is represented as BFS, and the value at index i in BFS is represented as BFSi.First, all bits in the Bloom filter are set to 0. As shown in Figure3, when we add the element x in the set S=x,y to the Bloom filter, we set BFShix=1 for 1≤i≤3. When we verify the existence of an element y in set S, if BFShiy=0 exists for 1≤i≤3, this proves that y∉S; otherwise, y∈S with a high probability.Figure 3
Bloom filter.The Bloom filter yields false positives; in other words, it yields an element that does not belong to the setS, but the corresponding position values are all 1. As shown in Figure 3, the element z does not belong to the set x,y; however, BFShiz=1 for 1≤i≤3. According to Bose et al. [27], the false positive probability is negligible if we select the optimal k and m values.


## 3.4. Secret Sharing

Secret sharing technology is an important aspect of cryptography research. For example, Shamir [28] proposed a k,n-threshold secret-sharing scheme. The basic concept of this scheme is that the secret s to be shared is divided and distributed to n participants. The secret can be recovered in the case of minimum k participants; otherwise, the secret cannot be recovered. When k=n, secret sharing can be obtained using the ⊕ (XOR) operation. Randomly generate n−1 bit strings r1,…,rn−1 with the same length as the secret s, and calculate rn=r1⊕…⊕rn−1⊕s; each of ri is a part of the secret s. Finally, the secret s can be obtained by computing r1⊕…⊕rn.


## 3.5. Attribute Vector

As shown in Figure4, we define two attribute vectors W¯=w¯1,…,w¯L∈Σ∗L and W=w1,…,wL∈ΣL, where Σ⊂ℤq∗ and Σ∗=Σ∪∗. Here, W¯ contains the wildcard ∗, and J=j1,…,jn⊂1,…,L represents the set of wildcard positions in W¯.Figure 4
Attribute vector.The decryption algorithm discussed in this paper employs the following polynomial identity, wherewi is the attribute value at position i in the attribute vector.(1)∑i=1L∏j∈Ji−jwi=∑i=1,i∉JL∏j∈Ji−jwi.We use Viète’s formulas [29] to construct the polynomial ∏j∈Ji−j=xn+an−1xn−1+⋯+a0 in equation (1), and the coefficients are calculated as follows:(2)an−k=−1i−n∏1≤i1<i2<…<ik≤nji1ji2…jik,0≤k≤n,where n=J. Here, if J is clear, we can calculate the polynomial coefficients ai. For example, when J=j1,j2,j3, we can construct polynomial x−j1x−j2x−j3 and calculate the coefficients:(3)a0=−j1j2j3,a1=j1j2+j1j3+j2j3,a2=−j1+j2+j3,a3=1.


## 3.6. Decision Linear Assumption

LetG be a bilinear group of prime order q with a generator g. For any probabilistic polynomial-time (PPT) adversary A, its advantage AdvAλ in solving the decision linear (DLIN) problem [30] in G is(4)AdvAλ=PrAg,ga,gb,gac,gd,gbc+d=1−PrAg,ga,gb,gac,gd,gr=1,where the probability is taken over all possible choices of a,b,c,d,r∈ℤq∗. We say that the DLIN assumption holds in G if there exists a negligible function ελ such that AdvAλ<ϵ for any PPT algorithm A.


## 4. System Architecture and Security Model

### 4.1. System Architecture

The system architecture of the proposed scheme is shown in Figure5. As illustrated, the system architecture involves five entities, i.e., attribute authority (AA), IPFS, data owner (DO), data user (DU), and blockchain.AA: the AA manages all attributes in the system and assigns attributes to users. It is also responsible for generating public parameters and issuing secret keys based on the users’ attributes. In this paper, the AA is fully trusted.IPFS: the IPFS is a distributed file storage system based on content addressing. Note that there is no central server node in the IPFS; thus, it can avoid the risk of a single point of failure. The IPFS uses an encryption algorithm to calculate the hash valuehashipfs of a file, and this hashipfs is used as the file’s address. This approach reduces the repeated storage of files and ensures the integrity of files.DO: the DO selects thefile to be shared and creates a corresponding access policy. First, the DO encrypts the file using the symmetric key aeskey and stores the ciphertext encfile in the IPFS. Then, the proposed CP-ABE scheme is used to encrypt aeskey and generate the ciphertext CT. Finally, hashipfs and CT are stored on the blockchain using a smart contract.DU: the DU sends a request to the AA, and the AA generates a secret key based on the attribute set of the DU. The DU obtainsCT stored on the blockchain using the smart contract and decrypts CT based on its secret key. Here, if the attribute set satisfies the access structure set by the DO, then the DU can obtain the file from the IPFS using aeskey and hashipfs.Blockchain: the blockchain is an append-only distributed database, where data are stored permanently and are tamperproof. To ensure secure data sharing and fine-grained access control, the DO only storeshashipfs and CT on the blockchain using smart contracts.Figure 5
System architecture.


### 4.2. The Definition of the BCP-ABE-PHAS Scheme

Here, we present the definition of our scheme. This scheme mainly involves the following four algorithms:(i)
Setup1λ: the Setup algorithm is executed by the AA. This algorithm takes security parameter 1λ as the input and outputs the public parameters PK and master secret key MSK.(ii)
KeyGenPK,MSK,W: the KeyGen algorithm is executed by the AA. Here, PK, MSK, and W of the DU are taken as inputs, and the secret key SKW associated with W is the output.(iii)
EncryptPK,M,W¯,J: the Encrypt algorithm is executed by the DO. This algorithm comprises the BuildGBF and GenCT functions.BuildGBFW¯,J: this function takes an access policy W¯ and the wildcard position set J as inputs and outputs GBFGenCTPK,M,W¯,J: this function takes PK, a message M, an access policy W¯, and the wildcard position set J as inputs and outputs ciphertext CT(iv)
DecryptPK,SKW,GBF,CT: the Decrypt algorithm is executed by the DU and comprises the QueryGBF and Dec functions.QueryGBFW,GBF: this function takes an attribute vector W of the DU as the input and queries GBF to obtain the wildcard position set JDecPK,SKW,CT,J: this function takes PK, SKW, J, and CT as inputs and outputs MHere, letPK,MSK←Setup1λ, SKW←KeyGenPK,MSK,W, and CT,GBF←EncryptPK,M,W¯,J. For correctness, we require the following conditions to hold:(1)
If the attribute vectorW of the DU satisfies the access policy W¯, then M←DecryptPK,SKW,GBF,CT(2)
Otherwise,DecryptPK,SKW,GBF,CT outputs a random message


### 4.3. Security Model

Definition 1.
A CP-ABE scheme with the hidden access policy is semantically secure in the selective model if for all PPT adversariesA,(5)PrExpAλ=1−12<ελ,for some negligible function ϵλ. Based on [29], the security game ExpAλ is described as follows:Init:A selects two different challenge attribute vectors W¯0,W¯1∈Σ∗L, for at least one w¯i≠∗.Setup: the challengerℬ runs Setup1λ algorithm, which outputs PK and MSK. It sends PK to A and keeps MSK to itself.Query phase 1:A adaptively issues key queries for the attribute vector W∈ΣL, under the restriction that wi≠w¯0i and wi≠w¯1i. ℬ runs KeyGenPK,MSK,W algorithm to obtain SKW and sends SKW to A.Challenge:A submits two messages M0,M1M0=M1 and sends them to ℬ. Given W¯0 and W¯1, ℬ randomly selects β∈0,1 and encrypts Mβ under W¯β. Finally, ℬ sends CTβ to A.Query phase 2: query phase 2 is the same as query phase 1.Guess: finally,A outputs its guess β′∈0,1 for β. If β′=β, then return 1; else, return 0.


## 4.1. System Architecture

The system architecture of the proposed scheme is shown in Figure5. As illustrated, the system architecture involves five entities, i.e., attribute authority (AA), IPFS, data owner (DO), data user (DU), and blockchain.AA: the AA manages all attributes in the system and assigns attributes to users. It is also responsible for generating public parameters and issuing secret keys based on the users’ attributes. In this paper, the AA is fully trusted.IPFS: the IPFS is a distributed file storage system based on content addressing. Note that there is no central server node in the IPFS; thus, it can avoid the risk of a single point of failure. The IPFS uses an encryption algorithm to calculate the hash valuehashipfs of a file, and this hashipfs is used as the file’s address. This approach reduces the repeated storage of files and ensures the integrity of files.DO: the DO selects thefile to be shared and creates a corresponding access policy. First, the DO encrypts the file using the symmetric key aeskey and stores the ciphertext encfile in the IPFS. Then, the proposed CP-ABE scheme is used to encrypt aeskey and generate the ciphertext CT. Finally, hashipfs and CT are stored on the blockchain using a smart contract.DU: the DU sends a request to the AA, and the AA generates a secret key based on the attribute set of the DU. The DU obtainsCT stored on the blockchain using the smart contract and decrypts CT based on its secret key. Here, if the attribute set satisfies the access structure set by the DO, then the DU can obtain the file from the IPFS using aeskey and hashipfs.Blockchain: the blockchain is an append-only distributed database, where data are stored permanently and are tamperproof. To ensure secure data sharing and fine-grained access control, the DO only storeshashipfs and CT on the blockchain using smart contracts.Figure 5
System architecture.


## 4.2. The Definition of the BCP-ABE-PHAS Scheme

Here, we present the definition of our scheme. This scheme mainly involves the following four algorithms:(i)
Setup1λ: the Setup algorithm is executed by the AA. This algorithm takes security parameter 1λ as the input and outputs the public parameters PK and master secret key MSK.(ii)
KeyGenPK,MSK,W: the KeyGen algorithm is executed by the AA. Here, PK, MSK, and W of the DU are taken as inputs, and the secret key SKW associated with W is the output.(iii)
EncryptPK,M,W¯,J: the Encrypt algorithm is executed by the DO. This algorithm comprises the BuildGBF and GenCT functions.BuildGBFW¯,J: this function takes an access policy W¯ and the wildcard position set J as inputs and outputs GBFGenCTPK,M,W¯,J: this function takes PK, a message M, an access policy W¯, and the wildcard position set J as inputs and outputs ciphertext CT(iv)
DecryptPK,SKW,GBF,CT: the Decrypt algorithm is executed by the DU and comprises the QueryGBF and Dec functions.QueryGBFW,GBF: this function takes an attribute vector W of the DU as the input and queries GBF to obtain the wildcard position set JDecPK,SKW,CT,J: this function takes PK, SKW, J, and CT as inputs and outputs MHere, letPK,MSK←Setup1λ, SKW←KeyGenPK,MSK,W, and CT,GBF←EncryptPK,M,W¯,J. For correctness, we require the following conditions to hold:(1)
If the attribute vectorW of the DU satisfies the access policy W¯, then M←DecryptPK,SKW,GBF,CT(2)
Otherwise,DecryptPK,SKW,GBF,CT outputs a random message


## 4.3. Security Model

Definition 1.
A CP-ABE scheme with the hidden access policy is semantically secure in the selective model if for all PPT adversariesA,(5)PrExpAλ=1−12<ελ,for some negligible function ϵλ. Based on [29], the security game ExpAλ is described as follows:Init:A selects two different challenge attribute vectors W¯0,W¯1∈Σ∗L, for at least one w¯i≠∗.Setup: the challengerℬ runs Setup1λ algorithm, which outputs PK and MSK. It sends PK to A and keeps MSK to itself.Query phase 1:A adaptively issues key queries for the attribute vector W∈ΣL, under the restriction that wi≠w¯0i and wi≠w¯1i. ℬ runs KeyGenPK,MSK,W algorithm to obtain SKW and sends SKW to A.Challenge:A submits two messages M0,M1M0=M1 and sends them to ℬ. Given W¯0 and W¯1, ℬ randomly selects β∈0,1 and encrypts Mβ under W¯β. Finally, ℬ sends CTβ to A.Query phase 2: query phase 2 is the same as query phase 1.Guess: finally,A outputs its guess β′∈0,1 for β. If β′=β, then return 1; else, return 0.


## 5. Construction of the BCP-ABE-PHAS

### 5.1. Setup Phase

In this paper, we useU=att1,…,attL to represent the attribute universe in the system. Here, Vi=vi,1,…,vi,ni is the set of possible values of the ith category attribute, where ni=Vi. Thus, the user’s attribute vector is W=w1,…,wL, where wi∈Vi,1≤i≤L. The access structure of the proposed scheme is W¯=w¯1,…,w¯L=∧i∈IWw¯i, where IW=i|1≤i≤L,w¯i≠∗. If w¯i=wi or w¯i=∗, we use W⊨W¯ to denote that the user’s attribute vector W satisfies the access policy W¯; otherwise, we use W⊭W¯ to denote that the user’s attribute vector W does not satisfy the access policy W¯. Here, the wildcard ∗ in the access structure means “do not care.” The upper bound of the wildcard in the access structure is defined as N, where N≪L.The setup phase is run by the AA. Here,G and GT are the multiplicative cyclic groups of a large prime order q, g is a generator of G, and e:G×G⟶GT is a bilinear map. The AA randomly chooses α,t1,t2,x1,…,xN∈ℤq and V0,U1,…,UL∈G and sets Ω1=eg,V0αt1 and Ω2=eg,V0αt2. Let Vj=V0xj for j=1,…,N. The AA also generates k independent hash functions H=h1,…,hk. Therefore, the public parameters are expressed as follows:(6)PK=e,G,GT,g,q,Ω1,Ω2,gα,V0,x1,…,xN,H,U1,…,UL.Additionally, the master secret key is expressed as follows:(7)MSK=α,t1,t2,V1,…,VN.


### 5.2. Data Encryption Phase

The encryption phase is executed by the DO and involves three main parts, which are described in the following section.


#### 5.2.1. IPFS Storage

The DO selects thefile to be shared, generates the symmetric key aeskey using the Advanced Encryption Standard (AES), and encrypts the file using aeskey to generate the ciphertext encfile.To relieve the pressure on blockchain storage, the proposed scheme storesencfile in the IPFS using the ipfs add encfile command, and the IPFS returns unique hash value ipfshash to retrieve encfile. Note that anyone can obtain the ciphertext encfile stored in the IPFS using the ipfs get ipfshash command.


#### 5.2.2. Hidden Access Policy

The blockchain is public, all participants can obtain the data on the blockchain, so we need to hide the attribute information of the access policy. The access policy developed by the DO isW¯=w¯1,…,w¯L. Assume that the access policy W¯ contains n≤N wildcards that occur at positions J=j1,…jn.When data are decrypted, determining the position of the wildcard symbols is essential; however, directly sending the setJ may reveal the user’s private information. Thus, to solve this problem, we adopt an efficient positioning algorithm based on the GBF. The GBF is a combination of a Bloom filter and secret sharing technology. Differing from traditional Bloom filters that use a bit array, the GBF uses an array of λ bits. The GBF can verify whether an attribute exists in the specified set and locate the position index of the attribute to realize the hidden set J and protect the user’s private information. In addition to the probability of hash function collisions, the probability of string matching must be verified. Therefore, the false positive probability of the GBF is less than that of the traditional Bloom filter.When the DO adds an elementattj,j∈J, to the GBF, the algorithm first uses the k,k-secret-sharing scheme to randomly generate k−1λ-bit strings r1,j,…,rk−1,j and sets rk,j=r1,j⊕…⊕rk−1,j⊕j. Then, it hashes attj with k independent hash functions H=h1,…,hk and obtains h1attj,…,hkattj, where hiattj is uniformly distributed in 1,m. Finally, generated ri,j is stored in the GBF based on the position index generated by hiattj.When elements are further added to the GBF, if a certain position is already occupied by previously added elements, we reuse the share already stored in the GBF. As shown in Figure6, when we add j2 to the GBF, the hash value of hdattj2 is the same as the hash value of hiattj1. If we modify ri,j1, the previously added element j1 cannot be restored; thus, we set rd,j2=ri,j1. The construction of the GBF is presented in Algorithm 1.Figure 6
The garbled Bloom filter.Algorithm 1: Build GBF.
Input: set J, security parameter λ, m, and k hash functions H=h1,…,hkOutput: garbled Bloom filter GBF(1)
GBF = new m-element array of bit strings;(2)
fori=0tom−1do(3)
GBFi=NULL;//initialize the GBF with “NULL”(4)
end for(5)
foreachx∈Jdo(6)
emptySolt=−1,finalShare=x;(7)
fori=0tok−1do(8)
j=hi+1attx;//get the index of the position(9)
ifGBFj==NULLthen(10)
ifemptySolt==−1then(11)
emptySolt=j;(12)
else(13)
GBFj←0,1λ;//get a new share(14)
finalShare=finalShare⊕GBFj;(15)
end if(16)
else(17)
finalShare=finalShare⊕GBFj;//reuse an existing share(18)
end if(19)
end for(20)
GBFemptySolt=finalShare;//store the last share(21)
end for(22)
fori=0tom−1do(23)
ifGBFi==NULLthen(24)
GBFi←0,1λ;//fill the position with random strings(25)
end if(26)
end forThe DO constructs a GBF to hide the setJ of wildcard positions based on Algorithm 1 and then uses Viète’s formulas to compute ai1≤i≤n. Here, m=∑k=0nxkak−1, where x0=1. It randomly chooses r1,r2∈ℤq∗. The DO then creates CT as(8)C0=MΩ1r1Ω2r2,C1=gαmr1,C2=gmr2,C3=V0∏i=1LUi∏k=1ni−jkmw¯ir1+r2,where M is aeskey. Therefore, the ciphertext is CT=C0,C1,C2,C3,GBF.


#### 5.2.3. Blockchain Storage

A blockchain is an append-only distributed database that stores data on the blockchain permanently, which ensures that the data can be tamperproof but increases the storage pressure on the blockchain. Therefore, in this paper, the ciphertextencfile is stored in the IPFS, and only ipfshash and CT are stored on the blockchain. To achieve secure data sharing and fine-grained access control, we employ smart contracts to ensure that the data storage and sharing process is open and transparent without third-party participation. Here, the public and private keys of the DO in the blockchain are represented by BPKDO and BSKDO, respectively.Generally, the DO is the creator of the access control contract (ACC) who wants to share data with DUs. The ACC provides application binary interfaces (ABIs) to manage and implement access control. The ABIs of the ACC are presented in Table1.Table 1
ABIs of the ACC.
ABIPermissionsDescriptionuploadfile()Contract creatorThe ABI uploads data on the blockchaingetfile()PublicThe ABI obtains the data stored on the blockchainkill()Contract creatorThe ABI performs theselfdestruct operation to delete the ACCThe DO creates and deploys the ACC and then obtains the contract address and ABIs. Furthermore, the DO sends a transaction to execute theuploadfile ABI of the ACC to upload the data on the blockchain (Algorithm 2).Algorithm 2: Generate a storage transaction.
Input:CT, ipfshash, time, BSKDO, ACC address addr, and uploadfile ABIOutput: storage transaction Txstorage(1)
Compute the message digestMD=Htime,ipfshash,CT;(2)
Generate the signaturesign=signBSKDOMD;(3)
Generate a storage transactionTxstorage=time,ipfshash,CT,sign;(4)
SendTxstorage according to addr and uploadfile ABI;(5)
returnTxstorage;


### 5.3. Key Generation Phase

The key generation phase is executed by the AA. In this phase, the secret key is generated for the DU, the attribute vector of which isW=w1,…,wL∈ΣL. The AA randomly chooses s∈ℤq and sets s1=t1+s and s2=t2+s. Then, the following algorithm is executed:(9)K=gαs,K1=K1,0,K1,1,…,K1,N=V0s1∏i=1LUiswi,V1s1∏i=1LUisiwi,…,VNs1∏i=1LUisiNwi,K1′=K1,0′,K1,1′,…,K1,N′=V0αs2∏i=1LUiαswi,V1αs2∏i=1LUiαsiwi,…,VNαs2∏i=1LUiαsiNwi.Therefore, the secret key of the DU isSK=K,K1,K1′.


### 5.4. Data Decryption Phase

Data decryption is performed by the DU and mainly comprises the following three phases.


#### 5.4.1. Obtain Data on the Blockchain

The DU sends a transaction to execute thegetfile ABI of the ACC to obtain the data stored on the blockchain (Algorithm 3).Algorithm 3: Obtain the data stored on the blockchain.
Input: ACC address addr, getfile ABI, and BPKDOOutput: verified result(1)
Obtain the data according toaddr and getfile ABI;(2)
Compute the message digestMD′=Htime,ipfshash,CT;(3)
Verify the signatureMD=VerifyBPKDOsign;(4)
ifMD′==MDthen(5)
return True;(6)
else(7)
return False;(8)
end ifTherefore, the DU obtainsipfshash and CT stored on the blockchain.


#### 5.4.2. QueryGBF

The DU obtains the data stored on the blockchain, whereCT=C0,C1,C2,C3,GBF. As observed from the data encryption phase, obtaining J is the key to decrypting CT. Here, the DU obtains J according to Algorithm 4.Algorithm 4: QueryGBF.
Input: garbled Bloom filter GBF, n, the number of attributes L, security parameter λ, m, and k hash functions H=h1,…,hkOutput: set J(1)
J  = new set of length n;(2)
forx=1toLdo(3)
recovered=0λ;(4)
fori=1tokdo(5)
j=hiattx;(6)
ifGBFj==NULLthen(7)
break;(8)
else(9)
recovered=recovered⊕GBFj;(10)
end if(11)
end for(12)
ifrecovered==xthen(13)
J.addx;(14)
end if(15)
end forFirst, we determine whether the hash value of the attribute exists in the GBF. If the corresponding position of the attribute in the GBF is 0, the attribute must not be inJ. When all GBF positions corresponding to the k hash values of the attribute are not empty, the DU must calculate the position index of the wildcard in the access policy using ⊕; if the calculated value is the same as the position index corresponding to the attribute vector of the DU, the attribute is present in J; otherwise, this attribute is not in J.


#### 5.4.3. Data Decryption Phase

In this phase, the DU obtains the set of wildcard positionsJ and then uses Viète’s formulas to compute ai1≤i≤n, where m=∑k=0nxkak−1. The ciphertext can only be decrypted when the attributes of the DU can satisfy the access policy. Then, M can be computed as follows:(10)M=C0eK,C3eC1,∏k=0nK1,kakeC2,∏k=0n∏k=0nK1,K′ak.When the DU successfully decrypts the data, it obtainsaeskey. Then, the DU obtains encfile stored in the IPFS using ipfshash. Subsequently, aeskey is used to decrypt encfile to obtain the file shared by the DO.


## 5.1. Setup Phase

In this paper, we useU=att1,…,attL to represent the attribute universe in the system. Here, Vi=vi,1,…,vi,ni is the set of possible values of the ith category attribute, where ni=Vi. Thus, the user’s attribute vector is W=w1,…,wL, where wi∈Vi,1≤i≤L. The access structure of the proposed scheme is W¯=w¯1,…,w¯L=∧i∈IWw¯i, where IW=i|1≤i≤L,w¯i≠∗. If w¯i=wi or w¯i=∗, we use W⊨W¯ to denote that the user’s attribute vector W satisfies the access policy W¯; otherwise, we use W⊭W¯ to denote that the user’s attribute vector W does not satisfy the access policy W¯. Here, the wildcard ∗ in the access structure means “do not care.” The upper bound of the wildcard in the access structure is defined as N, where N≪L.The setup phase is run by the AA. Here,G and GT are the multiplicative cyclic groups of a large prime order q, g is a generator of G, and e:G×G⟶GT is a bilinear map. The AA randomly chooses α,t1,t2,x1,…,xN∈ℤq and V0,U1,…,UL∈G and sets Ω1=eg,V0αt1 and Ω2=eg,V0αt2. Let Vj=V0xj for j=1,…,N. The AA also generates k independent hash functions H=h1,…,hk. Therefore, the public parameters are expressed as follows:(6)PK=e,G,GT,g,q,Ω1,Ω2,gα,V0,x1,…,xN,H,U1,…,UL.Additionally, the master secret key is expressed as follows:(7)MSK=α,t1,t2,V1,…,VN.


## 5.2. Data Encryption Phase

The encryption phase is executed by the DO and involves three main parts, which are described in the following section.


### 5.2.1. IPFS Storage

The DO selects thefile to be shared, generates the symmetric key aeskey using the Advanced Encryption Standard (AES), and encrypts the file using aeskey to generate the ciphertext encfile.To relieve the pressure on blockchain storage, the proposed scheme storesencfile in the IPFS using the ipfs add encfile command, and the IPFS returns unique hash value ipfshash to retrieve encfile. Note that anyone can obtain the ciphertext encfile stored in the IPFS using the ipfs get ipfshash command.


### 5.2.2. Hidden Access Policy

The blockchain is public, all participants can obtain the data on the blockchain, so we need to hide the attribute information of the access policy. The access policy developed by the DO isW¯=w¯1,…,w¯L. Assume that the access policy W¯ contains n≤N wildcards that occur at positions J=j1,…jn.When data are decrypted, determining the position of the wildcard symbols is essential; however, directly sending the setJ may reveal the user’s private information. Thus, to solve this problem, we adopt an efficient positioning algorithm based on the GBF. The GBF is a combination of a Bloom filter and secret sharing technology. Differing from traditional Bloom filters that use a bit array, the GBF uses an array of λ bits. The GBF can verify whether an attribute exists in the specified set and locate the position index of the attribute to realize the hidden set J and protect the user’s private information. In addition to the probability of hash function collisions, the probability of string matching must be verified. Therefore, the false positive probability of the GBF is less than that of the traditional Bloom filter.When the DO adds an elementattj,j∈J, to the GBF, the algorithm first uses the k,k-secret-sharing scheme to randomly generate k−1λ-bit strings r1,j,…,rk−1,j and sets rk,j=r1,j⊕…⊕rk−1,j⊕j. Then, it hashes attj with k independent hash functions H=h1,…,hk and obtains h1attj,…,hkattj, where hiattj is uniformly distributed in 1,m. Finally, generated ri,j is stored in the GBF based on the position index generated by hiattj.When elements are further added to the GBF, if a certain position is already occupied by previously added elements, we reuse the share already stored in the GBF. As shown in Figure6, when we add j2 to the GBF, the hash value of hdattj2 is the same as the hash value of hiattj1. If we modify ri,j1, the previously added element j1 cannot be restored; thus, we set rd,j2=ri,j1. The construction of the GBF is presented in Algorithm 1.Figure 6
The garbled Bloom filter.Algorithm 1: Build GBF.
Input: set J, security parameter λ, m, and k hash functions H=h1,…,hkOutput: garbled Bloom filter GBF(1)
GBF = new m-element array of bit strings;(2)
fori=0tom−1do(3)
GBFi=NULL;//initialize the GBF with “NULL”(4)
end for(5)
foreachx∈Jdo(6)
emptySolt=−1,finalShare=x;(7)
fori=0tok−1do(8)
j=hi+1attx;//get the index of the position(9)
ifGBFj==NULLthen(10)
ifemptySolt==−1then(11)
emptySolt=j;(12)
else(13)
GBFj←0,1λ;//get a new share(14)
finalShare=finalShare⊕GBFj;(15)
end if(16)
else(17)
finalShare=finalShare⊕GBFj;//reuse an existing share(18)
end if(19)
end for(20)
GBFemptySolt=finalShare;//store the last share(21)
end for(22)
fori=0tom−1do(23)
ifGBFi==NULLthen(24)
GBFi←0,1λ;//fill the position with random strings(25)
end if(26)
end forThe DO constructs a GBF to hide the setJ of wildcard positions based on Algorithm 1 and then uses Viète’s formulas to compute ai1≤i≤n. Here, m=∑k=0nxkak−1, where x0=1. It randomly chooses r1,r2∈ℤq∗. The DO then creates CT as(8)C0=MΩ1r1Ω2r2,C1=gαmr1,C2=gmr2,C3=V0∏i=1LUi∏k=1ni−jkmw¯ir1+r2,where M is aeskey. Therefore, the ciphertext is CT=C0,C1,C2,C3,GBF.


### 5.2.3. Blockchain Storage

A blockchain is an append-only distributed database that stores data on the blockchain permanently, which ensures that the data can be tamperproof but increases the storage pressure on the blockchain. Therefore, in this paper, the ciphertextencfile is stored in the IPFS, and only ipfshash and CT are stored on the blockchain. To achieve secure data sharing and fine-grained access control, we employ smart contracts to ensure that the data storage and sharing process is open and transparent without third-party participation. Here, the public and private keys of the DO in the blockchain are represented by BPKDO and BSKDO, respectively.Generally, the DO is the creator of the access control contract (ACC) who wants to share data with DUs. The ACC provides application binary interfaces (ABIs) to manage and implement access control. The ABIs of the ACC are presented in Table1.Table 1
ABIs of the ACC.
ABIPermissionsDescriptionuploadfile()Contract creatorThe ABI uploads data on the blockchaingetfile()PublicThe ABI obtains the data stored on the blockchainkill()Contract creatorThe ABI performs theselfdestruct operation to delete the ACCThe DO creates and deploys the ACC and then obtains the contract address and ABIs. Furthermore, the DO sends a transaction to execute theuploadfile ABI of the ACC to upload the data on the blockchain (Algorithm 2).Algorithm 2: Generate a storage transaction.
Input:CT, ipfshash, time, BSKDO, ACC address addr, and uploadfile ABIOutput: storage transaction Txstorage(1)
Compute the message digestMD=Htime,ipfshash,CT;(2)
Generate the signaturesign=signBSKDOMD;(3)
Generate a storage transactionTxstorage=time,ipfshash,CT,sign;(4)
SendTxstorage according to addr and uploadfile ABI;(5)
returnTxstorage;


## 5.2.1. IPFS Storage

The DO selects thefile to be shared, generates the symmetric key aeskey using the Advanced Encryption Standard (AES), and encrypts the file using aeskey to generate the ciphertext encfile.To relieve the pressure on blockchain storage, the proposed scheme storesencfile in the IPFS using the ipfs add encfile command, and the IPFS returns unique hash value ipfshash to retrieve encfile. Note that anyone can obtain the ciphertext encfile stored in the IPFS using the ipfs get ipfshash command.


## 5.2.2. Hidden Access Policy

The blockchain is public, all participants can obtain the data on the blockchain, so we need to hide the attribute information of the access policy. The access policy developed by the DO isW¯=w¯1,…,w¯L. Assume that the access policy W¯ contains n≤N wildcards that occur at positions J=j1,…jn.When data are decrypted, determining the position of the wildcard symbols is essential; however, directly sending the setJ may reveal the user’s private information. Thus, to solve this problem, we adopt an efficient positioning algorithm based on the GBF. The GBF is a combination of a Bloom filter and secret sharing technology. Differing from traditional Bloom filters that use a bit array, the GBF uses an array of λ bits. The GBF can verify whether an attribute exists in the specified set and locate the position index of the attribute to realize the hidden set J and protect the user’s private information. In addition to the probability of hash function collisions, the probability of string matching must be verified. Therefore, the false positive probability of the GBF is less than that of the traditional Bloom filter.When the DO adds an elementattj,j∈J, to the GBF, the algorithm first uses the k,k-secret-sharing scheme to randomly generate k−1λ-bit strings r1,j,…,rk−1,j and sets rk,j=r1,j⊕…⊕rk−1,j⊕j. Then, it hashes attj with k independent hash functions H=h1,…,hk and obtains h1attj,…,hkattj, where hiattj is uniformly distributed in 1,m. Finally, generated ri,j is stored in the GBF based on the position index generated by hiattj.When elements are further added to the GBF, if a certain position is already occupied by previously added elements, we reuse the share already stored in the GBF. As shown in Figure6, when we add j2 to the GBF, the hash value of hdattj2 is the same as the hash value of hiattj1. If we modify ri,j1, the previously added element j1 cannot be restored; thus, we set rd,j2=ri,j1. The construction of the GBF is presented in Algorithm 1.Figure 6
The garbled Bloom filter.Algorithm 1: Build GBF.
Input: set J, security parameter λ, m, and k hash functions H=h1,…,hkOutput: garbled Bloom filter GBF(1)
GBF = new m-element array of bit strings;(2)
fori=0tom−1do(3)
GBFi=NULL;//initialize the GBF with “NULL”(4)
end for(5)
foreachx∈Jdo(6)
emptySolt=−1,finalShare=x;(7)
fori=0tok−1do(8)
j=hi+1attx;//get the index of the position(9)
ifGBFj==NULLthen(10)
ifemptySolt==−1then(11)
emptySolt=j;(12)
else(13)
GBFj←0,1λ;//get a new share(14)
finalShare=finalShare⊕GBFj;(15)
end if(16)
else(17)
finalShare=finalShare⊕GBFj;//reuse an existing share(18)
end if(19)
end for(20)
GBFemptySolt=finalShare;//store the last share(21)
end for(22)
fori=0tom−1do(23)
ifGBFi==NULLthen(24)
GBFi←0,1λ;//fill the position with random strings(25)
end if(26)
end forThe DO constructs a GBF to hide the setJ of wildcard positions based on Algorithm 1 and then uses Viète’s formulas to compute ai1≤i≤n. Here, m=∑k=0nxkak−1, where x0=1. It randomly chooses r1,r2∈ℤq∗. The DO then creates CT as(8)C0=MΩ1r1Ω2r2,C1=gαmr1,C2=gmr2,C3=V0∏i=1LUi∏k=1ni−jkmw¯ir1+r2,where M is aeskey. Therefore, the ciphertext is CT=C0,C1,C2,C3,GBF.


## 5.2.3. Blockchain Storage

A blockchain is an append-only distributed database that stores data on the blockchain permanently, which ensures that the data can be tamperproof but increases the storage pressure on the blockchain. Therefore, in this paper, the ciphertextencfile is stored in the IPFS, and only ipfshash and CT are stored on the blockchain. To achieve secure data sharing and fine-grained access control, we employ smart contracts to ensure that the data storage and sharing process is open and transparent without third-party participation. Here, the public and private keys of the DO in the blockchain are represented by BPKDO and BSKDO, respectively.Generally, the DO is the creator of the access control contract (ACC) who wants to share data with DUs. The ACC provides application binary interfaces (ABIs) to manage and implement access control. The ABIs of the ACC are presented in Table1.Table 1
ABIs of the ACC.
ABIPermissionsDescriptionuploadfile()Contract creatorThe ABI uploads data on the blockchaingetfile()PublicThe ABI obtains the data stored on the blockchainkill()Contract creatorThe ABI performs theselfdestruct operation to delete the ACCThe DO creates and deploys the ACC and then obtains the contract address and ABIs. Furthermore, the DO sends a transaction to execute theuploadfile ABI of the ACC to upload the data on the blockchain (Algorithm 2).Algorithm 2: Generate a storage transaction.
Input:CT, ipfshash, time, BSKDO, ACC address addr, and uploadfile ABIOutput: storage transaction Txstorage(1)
Compute the message digestMD=Htime,ipfshash,CT;(2)
Generate the signaturesign=signBSKDOMD;(3)
Generate a storage transactionTxstorage=time,ipfshash,CT,sign;(4)
SendTxstorage according to addr and uploadfile ABI;(5)
returnTxstorage;


## 5.3. Key Generation Phase

The key generation phase is executed by the AA. In this phase, the secret key is generated for the DU, the attribute vector of which isW=w1,…,wL∈ΣL. The AA randomly chooses s∈ℤq and sets s1=t1+s and s2=t2+s. Then, the following algorithm is executed:(9)K=gαs,K1=K1,0,K1,1,…,K1,N=V0s1∏i=1LUiswi,V1s1∏i=1LUisiwi,…,VNs1∏i=1LUisiNwi,K1′=K1,0′,K1,1′,…,K1,N′=V0αs2∏i=1LUiαswi,V1αs2∏i=1LUiαsiwi,…,VNαs2∏i=1LUiαsiNwi.Therefore, the secret key of the DU isSK=K,K1,K1′.


## 5.4. Data Decryption Phase

Data decryption is performed by the DU and mainly comprises the following three phases.


### 5.4.1. Obtain Data on the Blockchain

The DU sends a transaction to execute thegetfile ABI of the ACC to obtain the data stored on the blockchain (Algorithm 3).Algorithm 3: Obtain the data stored on the blockchain.
Input: ACC address addr, getfile ABI, and BPKDOOutput: verified result(1)
Obtain the data according toaddr and getfile ABI;(2)
Compute the message digestMD′=Htime,ipfshash,CT;(3)
Verify the signatureMD=VerifyBPKDOsign;(4)
ifMD′==MDthen(5)
return True;(6)
else(7)
return False;(8)
end ifTherefore, the DU obtainsipfshash and CT stored on the blockchain.


### 5.4.2. QueryGBF

The DU obtains the data stored on the blockchain, whereCT=C0,C1,C2,C3,GBF. As observed from the data encryption phase, obtaining J is the key to decrypting CT. Here, the DU obtains J according to Algorithm 4.Algorithm 4: QueryGBF.
Input: garbled Bloom filter GBF, n, the number of attributes L, security parameter λ, m, and k hash functions H=h1,…,hkOutput: set J(1)
J  = new set of length n;(2)
forx=1toLdo(3)
recovered=0λ;(4)
fori=1tokdo(5)
j=hiattx;(6)
ifGBFj==NULLthen(7)
break;(8)
else(9)
recovered=recovered⊕GBFj;(10)
end if(11)
end for(12)
ifrecovered==xthen(13)
J.addx;(14)
end if(15)
end forFirst, we determine whether the hash value of the attribute exists in the GBF. If the corresponding position of the attribute in the GBF is 0, the attribute must not be inJ. When all GBF positions corresponding to the k hash values of the attribute are not empty, the DU must calculate the position index of the wildcard in the access policy using ⊕; if the calculated value is the same as the position index corresponding to the attribute vector of the DU, the attribute is present in J; otherwise, this attribute is not in J.


### 5.4.3. Data Decryption Phase

In this phase, the DU obtains the set of wildcard positionsJ and then uses Viète’s formulas to compute ai1≤i≤n, where m=∑k=0nxkak−1. The ciphertext can only be decrypted when the attributes of the DU can satisfy the access policy. Then, M can be computed as follows:(10)M=C0eK,C3eC1,∏k=0nK1,kakeC2,∏k=0n∏k=0nK1,K′ak.When the DU successfully decrypts the data, it obtainsaeskey. Then, the DU obtains encfile stored in the IPFS using ipfshash. Subsequently, aeskey is used to decrypt encfile to obtain the file shared by the DO.


## 5.4.1. Obtain Data on the Blockchain

The DU sends a transaction to execute thegetfile ABI of the ACC to obtain the data stored on the blockchain (Algorithm 3).Algorithm 3: Obtain the data stored on the blockchain.
Input: ACC address addr, getfile ABI, and BPKDOOutput: verified result(1)
Obtain the data according toaddr and getfile ABI;(2)
Compute the message digestMD′=Htime,ipfshash,CT;(3)
Verify the signatureMD=VerifyBPKDOsign;(4)
ifMD′==MDthen(5)
return True;(6)
else(7)
return False;(8)
end ifTherefore, the DU obtainsipfshash and CT stored on the blockchain.


## 5.4.2. QueryGBF

The DU obtains the data stored on the blockchain, whereCT=C0,C1,C2,C3,GBF. As observed from the data encryption phase, obtaining J is the key to decrypting CT. Here, the DU obtains J according to Algorithm 4.Algorithm 4: QueryGBF.
Input: garbled Bloom filter GBF, n, the number of attributes L, security parameter λ, m, and k hash functions H=h1,…,hkOutput: set J(1)
J  = new set of length n;(2)
forx=1toLdo(3)
recovered=0λ;(4)
fori=1tokdo(5)
j=hiattx;(6)
ifGBFj==NULLthen(7)
break;(8)
else(9)
recovered=recovered⊕GBFj;(10)
end if(11)
end for(12)
ifrecovered==xthen(13)
J.addx;(14)
end if(15)
end forFirst, we determine whether the hash value of the attribute exists in the GBF. If the corresponding position of the attribute in the GBF is 0, the attribute must not be inJ. When all GBF positions corresponding to the k hash values of the attribute are not empty, the DU must calculate the position index of the wildcard in the access policy using ⊕; if the calculated value is the same as the position index corresponding to the attribute vector of the DU, the attribute is present in J; otherwise, this attribute is not in J.


## 5.4.3. Data Decryption Phase

In this phase, the DU obtains the set of wildcard positionsJ and then uses Viète’s formulas to compute ai1≤i≤n, where m=∑k=0nxkak−1. The ciphertext can only be decrypted when the attributes of the DU can satisfy the access policy. Then, M can be computed as follows:(10)M=C0eK,C3eC1,∏k=0nK1,kakeC2,∏k=0n∏k=0nK1,K′ak.When the DU successfully decrypts the data, it obtainsaeskey. Then, the DU obtains encfile stored in the IPFS using ipfshash. Subsequently, aeskey is used to decrypt encfile to obtain the file shared by the DO.


## 6. Security Analysis and Performance Evaluation

### 6.1. Correctness

In this section, we verify the correctness of the proposed scheme. When we use a decryption key that satisfies the given access policy, the Decrypt algorithm indeed returns the correct message.(11)eK,C3=egαs,V0∏i=1LUi∏k=1ni−jkw¯i/∑m=0nxmamr1+r2=eg,V0αsr1+r∏i=1Leg,Uiαsw¯ir1+r2∑k=1ni−jk/∑m=0nxmam,where for equation (11), we use that ∑k=0nikak=∏k=1ni−jk,(12)eC1,∏k=0nK1,kak=egαr1/∑m=0nxmam,∏k=0nVks1∏i=1LUisikwiak=eg,V0αr1s1∏k=0nxkak∑m=0nxmam∏i=1Leg,Uiαsr1wi∑k=0nikak/∑m=0nxmam=Ω1r1eg,V0αsr1∏i=1Leg,Uiαsr1wi∑k=0nikak/∑m=0nxmameC2,∏k=0nK1,k′ak=egr2∑m=0nxmam,∏k=0nVkαs2∏i=1LUiαsikwiak=eg,V0αr2s2∏k=0nxkak∑m=0nxmam∏i=1Leg,Uiαsr2wi∑k=0nikak/∑m=0nxmam=Ω2r2eg,V0αsr2∏i=1Leg,Uiαsr2wi∑k=0nikak/∑m=0nxmam.Then, we have(13)eC1,∏k=0nK1,kakeC2,∏k=0nK1,k′ak=Ω1r1Ω2r2eg,V0αsr1+r2∏i=1Leg,Uiαswir1+r2∑k=0nikak∑m=0nxmam.If the secret key of the DU is valid, thenwi=w¯i, i∉j1,…,jn. Thus,(14)C0eK,C3eC1,∏k=0nK1,kak⋅eC2,∏k=0nK1,k′ak=MΩ1r1Ω2r2Ω1r1Ω2r2=M.


### 6.2. Security Analysis

Theorem 1.
The proposed BCP-ABE-PHAS scheme is semantically secure in the selective model assuming that the DLIN assumption holds in groupG.Proof.
Assume there exists a PPT adversaryA that can break the selective semantic security. We then build an algorithm ℬ that uses A to solve the DLIN problem in G.
Here, the challenger selects a bilinear groupG of prime order q and a generator g∈G, as well as the group GT and a bilinear map e:G×G⟶GT. Then, the challenger randomly chooses five values a,b,c,d,r∈ℤq∗ and computes Z0=gbc+d and Z1=gr. The challenger randomly chooses β∈0,1 and sends the tuple g,ga,gb,gac,gd,Zβ to ℬ. Note that the goal of ℬ is to guess β with a probability greater than 1/2. To generate a guess, ℬ interacts with A in the following selective semantic security experiment.Init:A chooses two challenge attribute vectors W¯0∈Σ∗L and W¯1∈Σ∗L. Here, the wildcard position sets are denoted as J0 and J1, respectively. Then, ℬ randomly chooses γ=0,1, where W¯γ=w¯1,…,w¯L.Setup:ℬ chooses N≤L, which is the upper bound number of wildcards. Then, ℬ chooses v0,u1,…,uL∈ℤq uniformly at random and sets the following:(15)xj=∑i=1Lijui∑i=1Luiforj=0,…,N,Vj=gbxjv0g−∑i=1Lijuiforj=0,…,N,Ui=guiw¯ifori=1,…,L.Here,ℬ randomly chooses σ1,σ2,σ3∈ℤq and computes Ω1=ega,V0σ1−σ2 and Ω2=egσ3⋅ga−σ2,V0.The public key is expressed as follows:(16)PK=e,G,GT,g,q,Ω1,Ω2,gα,V0,x1,…,xN,H,U1,…,UL.Additionally, the master secret key is expressed as follows:(17)MSK=α=a,t1=σ1−σ2,t2=σ3a−σ2,V1,…,VN.Query phase 1: in this phase,ℬ will respond to the key query of A. Each time, A will commit an attribute vector W=w1,…,wL and set s=σ2, s1=t1+σ2, and s2=σ2+σ3/a−σ2=σ3/a. Then, ℬ responds by computing(18)K=gaσ2,K1=K1,0,K1,1,…,K1,N=gbv0−∑i=1Luiσ1∏i=1Lgσ2ui/w¯iwi,gbv0−∑i=1Luix1σ1∏i=1Lgσ2iui/w¯iwi,…,gbv0−∑i=1LuixNσ1∏i=1Lgσ2iNui/w¯iwi.K1′=K1,0′,K1,1′,…,K1,N′=gbv0−∑i=1Luiσ3∏i=1Lgaσ2ui/w¯iwi,gbv0−∑i=1Luix1σ3∏i=1Lgaσ2iui/w¯iwi,…,gbv0−∑i=1LuixNσ3∏i=1Lga∏i=1Lgaσ2iNui/w¯iwi.Finally,ℬ sends SK=K,K1,K1′ to A.Challenge: when query phase 1 is over,A sends two messages M0,M1∈GT, M0=M1, to ℬ. Then, ℬ randomly chooses and outputs its guess and selects a message Mγ to encrypt under W¯γ. Then, ℬ creates(19)C0=Mγ⋅egac,gbv0σ1−σ2⋅egac,g∑i=1Luiσ1−σ2⋅egd,gbv0σ3⋅egd,g−aσ2−∑i=1Lui⋅egd,gσ3−∑i=1Lui,C1=gac/∑m=0nxmam,C2=gd/∑m=0nxmam,C3=Zβv0,ℬ sends the challenge ciphertext CT=C0,C1,C2,C3,GBF to A.Query phase 2: query phase 2 is the same as query phase 1.Guess:A outputs its guess γ′∈0,1 for γ.
Finally, ifγ′=γ, ℬ outputs 1; otherwise, ℬ outputs 0.
In the following, we analyze the probability of success forℬ. Here, if β=0, then ℬ will behave correctly as a challenger to A. Furthermore, A will have the probability of 1/2+ϵ of guessing γ. If β=1, A will have the probability of 1/2 of guessing γ.
To conclude this proof, we obtain the following:(20)Prℬg,ga,gb,gac,gd,gbc+d=1−Prℬg,ga,gb,gac,gd,gr=1≥Prβ=0∧γ′=γ−Prβ=1∧γ′=γ=12Prγ′=γ∣β=0−12Prγ′=γ∣β=1=12PrExpAλ=1−12≥12ε,which is nonnegligible, thereby contradicting the DLIN assumption.


### 6.3. Performance Evaluation

#### 6.3.1. Data Storage Efficiency

We conduct an experiment to verify the efficiency of two storage schemes, i.e., cloud-based server storage and IPFS-based distributed storage. Here, we set up a local server and an IPFS cluster in the same local area network. The cluster comprises five local devices, all of which are Ubuntu 18.04 systems with an Intel Core i5 CPU at 2.4 GHz with 4 GB RAM. We compare the performance of the two storage schemes based on the time required for uploading and downloading files. Figure7 shows the transmission time required by the two schemes. Note that all experimental results are the average of 30 trials. As shown in Figure 7, the upload and download time of files in the IPFS-based scheme are less than those of the files in the cloud-based scheme. Moreover, the time required for uploading and downloading the files in the cloud-based scheme exhibits a faster growth trend than the IPFS-based scheme when the file size increased. Therefore, the IPFS-based scheme can improve storage efficiency and system scalability.Figure 7
Transmission time of the two schemes.


#### 6.3.2. GBF Efficiency

We conduct another experiment to verify the storage and query efficiency of the GBF. Here, we use double hashing technology, and thek hash functions of the GBF are constructed using the 128-bit SpookyHash and MurmurHash. The length of the GBF is set to m=1024, and λ=8 in this experiment. Furthermore, the number of attributes in the access policy is 5–35, the number of wildcards is 2–14, and the number of hash functions is k=6,8, and10. Note that all reported experimental results are the average values obtained over 30 trials. As shown in Figure 8, for k=8, the time required to add 10 wildcards to the GBF is approximately 4.5 ms, and the query time is approximately 3.5 ms. Therefore, introducing the GBF does not increase the computational overhead of the system.Figure 8
Computational time for (a) BuildGBF and (b) QueryGBF.
(a)(b)


#### 6.3.3. Performance Evaluation

We also analyze the performance of our scheme and five existing CP-ABE schemes with AND gates in terms of the ciphertext size, decryption consumption, whether access policies are hidden, and so on. The results are presented in Table2, where p represents the pairing operation, e represents the exponentiation operation, l represents the number of attributes in the access structure, m represents the number of possible values for an attribute, and n represents the number of wildcards in the access structure. From Table 2, among all schemes that support wildcards and the hidden access policy, our scheme exhibits the smallest ciphertext size. Furthermore, the ciphertext size of our scheme is constant. Note that the decryption consumption of our scheme is related to the number of wildcards n, where n≪l; thus, our scheme has the advantage in terms of decryption consumption.Table 2
Performance comparison of CP-ABE schemes.
SchemeGroup orderAccess structuresCiphertext sizeDecryption costWildcardHidden policy[10]PrimeAND gates on multivalued attributesGT+2ml+1G3l+1p√√[12]PrimeAND gates on ±GT+4n+2G4n+2p√√[31]PrimeAND gates on multivalued attributesGT+2G2p××[32]CompositeAND gates on multivalued attributesGT+2ml+2Gl+1p√√[33]PrimeAND gates on ±GT+l+1Gl+1p√×OursPrimeAND gates on multivalued attributesGT+3G3p+2ne√√To evaluate the actual performance of our scheme, we compare it to schemes proposed in [10, 31]. Here, we implement our scheme on a desktop PC (3.4 GHz Intel Core i7 CPU with 16 GB RAM) based on Ubuntu 18.04 LTS and Java Pairing-Based Cryptography Library (JPBC) 2.0.0. This implementation uses a 160-bit elliptic curve group based on the supersingular curve y2=x3+x over a 512-bit finite field. The number of attributes in the access policy is 5–35, and the number of wildcards is 2–14. To ensure accuracy in our experiments, all reported experimental results are the averages obtained over 30 trials.Figure9(a) shows the size of the public parameters in the setup phase. The size of public parameters in all schemes increases linearly with the increase in the number of attributes. Nishide et al. [10] defined all possible values for each attribute in the public parameter; thus, the size of the public parameters is larger than other schemes. Figure 9(b) presents the execution time of the key generation phase. In our scheme, the key is generated by the AA with high computational power; therefore, although the time required in our scheme is greater than other schemes, it will not affect the efficiency of our scheme. Figure 9(c) presents the execution time of the encryption operation. Here, the number of exponentiation operations in the encryption algorithm is related to the attribute; thus, the required time increases with the increase in the number of attributes. The scheme in [10] exhibits more exponentiation operations in the encryption phase than our scheme and the scheme in [31]; thus, the required time is greater than the other two schemes. Figure 9(d) shows the execution time of the decryption operation. Note that the existing scheme [31] does not hide the access policy; thus, its decryption time is fixed. The decryption time of our scheme is less than that of the scheme in [10].Figure 9
Performance analysis and comparisons. (a) Public key. (b) Key generation. (c) Encryption data. (d) Decryption data.
(a)(b)(c)(d)In summary, our scheme has advantages in terms of data encryption and decryption when implementing the hidden access policy.


## 6.1. Correctness

In this section, we verify the correctness of the proposed scheme. When we use a decryption key that satisfies the given access policy, the Decrypt algorithm indeed returns the correct message.(11)eK,C3=egαs,V0∏i=1LUi∏k=1ni−jkw¯i/∑m=0nxmamr1+r2=eg,V0αsr1+r∏i=1Leg,Uiαsw¯ir1+r2∑k=1ni−jk/∑m=0nxmam,where for equation (11), we use that ∑k=0nikak=∏k=1ni−jk,(12)eC1,∏k=0nK1,kak=egαr1/∑m=0nxmam,∏k=0nVks1∏i=1LUisikwiak=eg,V0αr1s1∏k=0nxkak∑m=0nxmam∏i=1Leg,Uiαsr1wi∑k=0nikak/∑m=0nxmam=Ω1r1eg,V0αsr1∏i=1Leg,Uiαsr1wi∑k=0nikak/∑m=0nxmameC2,∏k=0nK1,k′ak=egr2∑m=0nxmam,∏k=0nVkαs2∏i=1LUiαsikwiak=eg,V0αr2s2∏k=0nxkak∑m=0nxmam∏i=1Leg,Uiαsr2wi∑k=0nikak/∑m=0nxmam=Ω2r2eg,V0αsr2∏i=1Leg,Uiαsr2wi∑k=0nikak/∑m=0nxmam.Then, we have(13)eC1,∏k=0nK1,kakeC2,∏k=0nK1,k′ak=Ω1r1Ω2r2eg,V0αsr1+r2∏i=1Leg,Uiαswir1+r2∑k=0nikak∑m=0nxmam.If the secret key of the DU is valid, thenwi=w¯i, i∉j1,…,jn. Thus,(14)C0eK,C3eC1,∏k=0nK1,kak⋅eC2,∏k=0nK1,k′ak=MΩ1r1Ω2r2Ω1r1Ω2r2=M.


## 6.2. Security Analysis

Theorem 1.
The proposed BCP-ABE-PHAS scheme is semantically secure in the selective model assuming that the DLIN assumption holds in groupG.Proof.
Assume there exists a PPT adversaryA that can break the selective semantic security. We then build an algorithm ℬ that uses A to solve the DLIN problem in G.
Here, the challenger selects a bilinear groupG of prime order q and a generator g∈G, as well as the group GT and a bilinear map e:G×G⟶GT. Then, the challenger randomly chooses five values a,b,c,d,r∈ℤq∗ and computes Z0=gbc+d and Z1=gr. The challenger randomly chooses β∈0,1 and sends the tuple g,ga,gb,gac,gd,Zβ to ℬ. Note that the goal of ℬ is to guess β with a probability greater than 1/2. To generate a guess, ℬ interacts with A in the following selective semantic security experiment.Init:A chooses two challenge attribute vectors W¯0∈Σ∗L and W¯1∈Σ∗L. Here, the wildcard position sets are denoted as J0 and J1, respectively. Then, ℬ randomly chooses γ=0,1, where W¯γ=w¯1,…,w¯L.Setup:ℬ chooses N≤L, which is the upper bound number of wildcards. Then, ℬ chooses v0,u1,…,uL∈ℤq uniformly at random and sets the following:(15)xj=∑i=1Lijui∑i=1Luiforj=0,…,N,Vj=gbxjv0g−∑i=1Lijuiforj=0,…,N,Ui=guiw¯ifori=1,…,L.Here,ℬ randomly chooses σ1,σ2,σ3∈ℤq and computes Ω1=ega,V0σ1−σ2 and Ω2=egσ3⋅ga−σ2,V0.The public key is expressed as follows:(16)PK=e,G,GT,g,q,Ω1,Ω2,gα,V0,x1,…,xN,H,U1,…,UL.Additionally, the master secret key is expressed as follows:(17)MSK=α=a,t1=σ1−σ2,t2=σ3a−σ2,V1,…,VN.Query phase 1: in this phase,ℬ will respond to the key query of A. Each time, A will commit an attribute vector W=w1,…,wL and set s=σ2, s1=t1+σ2, and s2=σ2+σ3/a−σ2=σ3/a. Then, ℬ responds by computing(18)K=gaσ2,K1=K1,0,K1,1,…,K1,N=gbv0−∑i=1Luiσ1∏i=1Lgσ2ui/w¯iwi,gbv0−∑i=1Luix1σ1∏i=1Lgσ2iui/w¯iwi,…,gbv0−∑i=1LuixNσ1∏i=1Lgσ2iNui/w¯iwi.K1′=K1,0′,K1,1′,…,K1,N′=gbv0−∑i=1Luiσ3∏i=1Lgaσ2ui/w¯iwi,gbv0−∑i=1Luix1σ3∏i=1Lgaσ2iui/w¯iwi,…,gbv0−∑i=1LuixNσ3∏i=1Lga∏i=1Lgaσ2iNui/w¯iwi.Finally,ℬ sends SK=K,K1,K1′ to A.Challenge: when query phase 1 is over,A sends two messages M0,M1∈GT, M0=M1, to ℬ. Then, ℬ randomly chooses and outputs its guess and selects a message Mγ to encrypt under W¯γ. Then, ℬ creates(19)C0=Mγ⋅egac,gbv0σ1−σ2⋅egac,g∑i=1Luiσ1−σ2⋅egd,gbv0σ3⋅egd,g−aσ2−∑i=1Lui⋅egd,gσ3−∑i=1Lui,C1=gac/∑m=0nxmam,C2=gd/∑m=0nxmam,C3=Zβv0,ℬ sends the challenge ciphertext CT=C0,C1,C2,C3,GBF to A.Query phase 2: query phase 2 is the same as query phase 1.Guess:A outputs its guess γ′∈0,1 for γ.
Finally, ifγ′=γ, ℬ outputs 1; otherwise, ℬ outputs 0.
In the following, we analyze the probability of success forℬ. Here, if β=0, then ℬ will behave correctly as a challenger to A. Furthermore, A will have the probability of 1/2+ϵ of guessing γ. If β=1, A will have the probability of 1/2 of guessing γ.
To conclude this proof, we obtain the following:(20)Prℬg,ga,gb,gac,gd,gbc+d=1−Prℬg,ga,gb,gac,gd,gr=1≥Prβ=0∧γ′=γ−Prβ=1∧γ′=γ=12Prγ′=γ∣β=0−12Prγ′=γ∣β=1=12PrExpAλ=1−12≥12ε,which is nonnegligible, thereby contradicting the DLIN assumption.


## 6.3. Performance Evaluation

### 6.3.1. Data Storage Efficiency

We conduct an experiment to verify the efficiency of two storage schemes, i.e., cloud-based server storage and IPFS-based distributed storage. Here, we set up a local server and an IPFS cluster in the same local area network. The cluster comprises five local devices, all of which are Ubuntu 18.04 systems with an Intel Core i5 CPU at 2.4 GHz with 4 GB RAM. We compare the performance of the two storage schemes based on the time required for uploading and downloading files. Figure7 shows the transmission time required by the two schemes. Note that all experimental results are the average of 30 trials. As shown in Figure 7, the upload and download time of files in the IPFS-based scheme are less than those of the files in the cloud-based scheme. Moreover, the time required for uploading and downloading the files in the cloud-based scheme exhibits a faster growth trend than the IPFS-based scheme when the file size increased. Therefore, the IPFS-based scheme can improve storage efficiency and system scalability.Figure 7
Transmission time of the two schemes.


### 6.3.2. GBF Efficiency

We conduct another experiment to verify the storage and query efficiency of the GBF. Here, we use double hashing technology, and thek hash functions of the GBF are constructed using the 128-bit SpookyHash and MurmurHash. The length of the GBF is set to m=1024, and λ=8 in this experiment. Furthermore, the number of attributes in the access policy is 5–35, the number of wildcards is 2–14, and the number of hash functions is k=6,8, and10. Note that all reported experimental results are the average values obtained over 30 trials. As shown in Figure 8, for k=8, the time required to add 10 wildcards to the GBF is approximately 4.5 ms, and the query time is approximately 3.5 ms. Therefore, introducing the GBF does not increase the computational overhead of the system.Figure 8
Computational time for (a) BuildGBF and (b) QueryGBF.
(a)(b)


### 6.3.3. Performance Evaluation

We also analyze the performance of our scheme and five existing CP-ABE schemes with AND gates in terms of the ciphertext size, decryption consumption, whether access policies are hidden, and so on. The results are presented in Table2, where p represents the pairing operation, e represents the exponentiation operation, l represents the number of attributes in the access structure, m represents the number of possible values for an attribute, and n represents the number of wildcards in the access structure. From Table 2, among all schemes that support wildcards and the hidden access policy, our scheme exhibits the smallest ciphertext size. Furthermore, the ciphertext size of our scheme is constant. Note that the decryption consumption of our scheme is related to the number of wildcards n, where n≪l; thus, our scheme has the advantage in terms of decryption consumption.Table 2
Performance comparison of CP-ABE schemes.
SchemeGroup orderAccess structuresCiphertext sizeDecryption costWildcardHidden policy[10]PrimeAND gates on multivalued attributesGT+2ml+1G3l+1p√√[12]PrimeAND gates on ±GT+4n+2G4n+2p√√[31]PrimeAND gates on multivalued attributesGT+2G2p××[32]CompositeAND gates on multivalued attributesGT+2ml+2Gl+1p√√[33]PrimeAND gates on ±GT+l+1Gl+1p√×OursPrimeAND gates on multivalued attributesGT+3G3p+2ne√√To evaluate the actual performance of our scheme, we compare it to schemes proposed in [10, 31]. Here, we implement our scheme on a desktop PC (3.4 GHz Intel Core i7 CPU with 16 GB RAM) based on Ubuntu 18.04 LTS and Java Pairing-Based Cryptography Library (JPBC) 2.0.0. This implementation uses a 160-bit elliptic curve group based on the supersingular curve y2=x3+x over a 512-bit finite field. The number of attributes in the access policy is 5–35, and the number of wildcards is 2–14. To ensure accuracy in our experiments, all reported experimental results are the averages obtained over 30 trials.Figure9(a) shows the size of the public parameters in the setup phase. The size of public parameters in all schemes increases linearly with the increase in the number of attributes. Nishide et al. [10] defined all possible values for each attribute in the public parameter; thus, the size of the public parameters is larger than other schemes. Figure 9(b) presents the execution time of the key generation phase. In our scheme, the key is generated by the AA with high computational power; therefore, although the time required in our scheme is greater than other schemes, it will not affect the efficiency of our scheme. Figure 9(c) presents the execution time of the encryption operation. Here, the number of exponentiation operations in the encryption algorithm is related to the attribute; thus, the required time increases with the increase in the number of attributes. The scheme in [10] exhibits more exponentiation operations in the encryption phase than our scheme and the scheme in [31]; thus, the required time is greater than the other two schemes. Figure 9(d) shows the execution time of the decryption operation. Note that the existing scheme [31] does not hide the access policy; thus, its decryption time is fixed. The decryption time of our scheme is less than that of the scheme in [10].Figure 9
Performance analysis and comparisons. (a) Public key. (b) Key generation. (c) Encryption data. (d) Decryption data.
(a)(b)(c)(d)In summary, our scheme has advantages in terms of data encryption and decryption when implementing the hidden access policy.


## 6.3.1. Data Storage Efficiency

We conduct an experiment to verify the efficiency of two storage schemes, i.e., cloud-based server storage and IPFS-based distributed storage. Here, we set up a local server and an IPFS cluster in the same local area network. The cluster comprises five local devices, all of which are Ubuntu 18.04 systems with an Intel Core i5 CPU at 2.4 GHz with 4 GB RAM. We compare the performance of the two storage schemes based on the time required for uploading and downloading files. Figure7 shows the transmission time required by the two schemes. Note that all experimental results are the average of 30 trials. As shown in Figure 7, the upload and download time of files in the IPFS-based scheme are less than those of the files in the cloud-based scheme. Moreover, the time required for uploading and downloading the files in the cloud-based scheme exhibits a faster growth trend than the IPFS-based scheme when the file size increased. Therefore, the IPFS-based scheme can improve storage efficiency and system scalability.Figure 7
Transmission time of the two schemes.


## 6.3.2. GBF Efficiency

We conduct another experiment to verify the storage and query efficiency of the GBF. Here, we use double hashing technology, and thek hash functions of the GBF are constructed using the 128-bit SpookyHash and MurmurHash. The length of the GBF is set to m=1024, and λ=8 in this experiment. Furthermore, the number of attributes in the access policy is 5–35, the number of wildcards is 2–14, and the number of hash functions is k=6,8, and10. Note that all reported experimental results are the average values obtained over 30 trials. As shown in Figure 8, for k=8, the time required to add 10 wildcards to the GBF is approximately 4.5 ms, and the query time is approximately 3.5 ms. Therefore, introducing the GBF does not increase the computational overhead of the system.Figure 8
Computational time for (a) BuildGBF and (b) QueryGBF.
(a)(b)


## 6.3.3. Performance Evaluation

We also analyze the performance of our scheme and five existing CP-ABE schemes with AND gates in terms of the ciphertext size, decryption consumption, whether access policies are hidden, and so on. The results are presented in Table2, where p represents the pairing operation, e represents the exponentiation operation, l represents the number of attributes in the access structure, m represents the number of possible values for an attribute, and n represents the number of wildcards in the access structure. From Table 2, among all schemes that support wildcards and the hidden access policy, our scheme exhibits the smallest ciphertext size. Furthermore, the ciphertext size of our scheme is constant. Note that the decryption consumption of our scheme is related to the number of wildcards n, where n≪l; thus, our scheme has the advantage in terms of decryption consumption.Table 2
Performance comparison of CP-ABE schemes.
SchemeGroup orderAccess structuresCiphertext sizeDecryption costWildcardHidden policy[10]PrimeAND gates on multivalued attributesGT+2ml+1G3l+1p√√[12]PrimeAND gates on ±GT+4n+2G4n+2p√√[31]PrimeAND gates on multivalued attributesGT+2G2p××[32]CompositeAND gates on multivalued attributesGT+2ml+2Gl+1p√√[33]PrimeAND gates on ±GT+l+1Gl+1p√×OursPrimeAND gates on multivalued attributesGT+3G3p+2ne√√To evaluate the actual performance of our scheme, we compare it to schemes proposed in [10, 31]. Here, we implement our scheme on a desktop PC (3.4 GHz Intel Core i7 CPU with 16 GB RAM) based on Ubuntu 18.04 LTS and Java Pairing-Based Cryptography Library (JPBC) 2.0.0. This implementation uses a 160-bit elliptic curve group based on the supersingular curve y2=x3+x over a 512-bit finite field. The number of attributes in the access policy is 5–35, and the number of wildcards is 2–14. To ensure accuracy in our experiments, all reported experimental results are the averages obtained over 30 trials.Figure9(a) shows the size of the public parameters in the setup phase. The size of public parameters in all schemes increases linearly with the increase in the number of attributes. Nishide et al. [10] defined all possible values for each attribute in the public parameter; thus, the size of the public parameters is larger than other schemes. Figure 9(b) presents the execution time of the key generation phase. In our scheme, the key is generated by the AA with high computational power; therefore, although the time required in our scheme is greater than other schemes, it will not affect the efficiency of our scheme. Figure 9(c) presents the execution time of the encryption operation. Here, the number of exponentiation operations in the encryption algorithm is related to the attribute; thus, the required time increases with the increase in the number of attributes. The scheme in [10] exhibits more exponentiation operations in the encryption phase than our scheme and the scheme in [31]; thus, the required time is greater than the other two schemes. Figure 9(d) shows the execution time of the decryption operation. Note that the existing scheme [31] does not hide the access policy; thus, its decryption time is fixed. The decryption time of our scheme is less than that of the scheme in [10].Figure 9
Performance analysis and comparisons. (a) Public key. (b) Key generation. (c) Encryption data. (d) Decryption data.
(a)(b)(c)(d)In summary, our scheme has advantages in terms of data encryption and decryption when implementing the hidden access policy.


## 7. Conclusion

In this paper, we propose a BCP-ABE-PHAS scheme to achieve trustworthy access while ensuring user privacy. Traditional centralized storage architectures are vulnerable to various network attacks, e.g., single point of attack, man-in-the-middle attack, and distributed denial-of-service attack. Therefore, we adopt a data storage scheme that combines blockchain technology and the IPFS; this approach relieves the storage pressure on the blockchain and guarantees data integrity. The experimental results demonstrate that our scheme is efficient and maintains a constant ciphertext size. Furthermore, to assist data decryption, we design a GBF to help users quickly locate the position of wildcards in the access policy. The proposed scheme uses smart contracts to guarantee that the entire data storage and sharing process is transparent, dynamic, and automated. The results of security analysis and performance evaluations demonstrate that our scheme is secure and efficient.



---

*Source: 4132597-2021-11-08.xml*