# A Practical and Efficient Blockchain-Assisted Attribute-Based Encryption Scheme for Access Control and Data Sharing

Authors: Linjian Hong; Kai Zhang; Junqing Gong; Haifeng Qian
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Attribute-based encryption (ABE) is a powerful encryption scheme with flexible access control over encrypted data that has been widely adopted in cloud computing scenarios to facilitate data sharing. However, despite convenience and efficiency provided by data sharing based on cloud, it is commonly vulnerable to issues like key abuse (namely, illegal key sharing by user or key distribution by authority) and key escrow (namely, illegal decryption by ABE authority). Hence, exploring a more secure ABE scheme that can be key abuse and key escrow resistant is crucial. Furthermore, data modification that happens in cloud storage and outsourced computation is also a challenge for the cloud-based data sharing schemes. To handle the above issues, in this paper, we propose a secure and efficient data sharing scheme based on attribute-based encryption (ABE) and blockchain equipped with InterPlanetary File System (IPFS). In particular, we show that the large-universe ABE with outsourced decryption (LU-ABE-OD) scheme proposed by Ning et al. is vulnerable to key escrow attack, which is not secure enough in the data sharing scenario. Therefore, based on their basic proposal, we construct an improved multi-authority LU-ABE-OD scheme to encrypt personal data, which are stored in the IPFS system while blockchain is applied to store the hash value returned by IPFS and be responsible for the outsourced decryption. As a result, our scheme greatly reduces the decryption overheads of the user while risks of key abuse and key escrow can be settled. Meanwhile, the introduction of IPFS significantly reduces the storage burden on chain without data tampering problem. Through theoretical analysis and experimental simulation, we prove the feasibility, security, and efficiency of our scheme.


---

## Body

## 1. Introduction

With the advent of the era of big data, the storage, processing, and sharing of massive data has become a bottleneck. To solve this issue, cloud storage has been considered to be the most efficient, convenient, and economical method for many users. However, the trust issue in terms of data privacy between the cloud and users is brought up, and thus encrypting sensitive data before they are uploaded is of great significance. Furthermore, apart from data privacy, particular scenario like data sharing always requires flexible access of encrypted data, which leads to the necessity of a fine-grained access control encryption scheme.Attribute-based encryption (ABE), a cryptographic primitive proposed by Sahai and Waters [1] that guarantees only those who possess certain attributes can access the targeted encrypted data, is proved to be a positive solution. According to Goyal et al. [2], ABE schemes can be generally divided into two patterns: ciphertext-policy ABE (CP-ABE) and key-policy ABE (KP-ABE). In a CP-ABE scheme, the access policy is embedded into ciphertexts and user’s private key is associated with an attribute collection, which is widely used in traditional cloud-based data sharing scenarios. However, practical applications based on basic ABE schemes suffer from the restriction of small-universe setting (SU-ABE) [3], in which the attribute universe must be determined when generating public parameters and no attribute can be added then. Hence, large-universe ABE (LU-ABE) [3] was proposed, realizing the unbounded attribute universe so that new attributes can be added arbitrarily. Meanwhile, key abuse and key escrow issues remain challenges to be faced. Specifically, the former risk can be caused by malicious users illegally sharing their keys (which can also be maliciously attained by attacker, namely, key leakage) and attribute authority (AA) illegally distributing keys to unauthorized users while the latter risk mainly caused by curious AA who masters all users’ private keys and intends to violate their privacy. For key abuse problem, traceable ABE schemes [4–6] were proposed to track the owner of leaked or abused key to relieve subsequent impact. For key escrow issue, multi-authority ABE (MA-ABE) schemes [7–9] were considered to be promising since the powerful decryption ability of a single center has been dispersed and none of the centers can illegally intrude on users’ privacy.Apart from all the above, traditional ABE schemes also suffer from the limitation in efficiency. Furthermore, data encrypted by ABE will lead to huge decryption costs. To solve these issues especially for resource-limited users, Green et al. [13] proposed the outsourcing decryption scheme of ABE (ABE-OD), which greatly reduces local decryption overheads by outsourcing most of decryption tasks to the cloud. Later, based on Waters’s CP-ABE scheme, Lai et al. [14] realized the verification of ABE-OD in the standard model to handle the malicious computation in ABE-OD scenarios. Along the previous constructions, schemes [15–19] have been proposed to promote efficiency and reduce costs. Nonetheless, the introduction of cloud in the above leads to the centralization of system, which will bring up problems of data tampering.Blockchain, with its powerful decentralized mechanism, has attracted a growing number of researchers and provides feasible approaches to address the impact of cloud since data stored on chain are tamper resistant and transparent. Efficient blockchain-based CP-ABE schemes for specific data sharing scenarios like electronic health records (EHRs) and Internet of Things (IoT) [20–26] have received widespread attention. However, in most mentioned cases, the decryption of ciphertexts is still outsourced to cloud while blockchain is only used to record access control data in which storage burden on chain raises another problem. Fortunately, benefiting from peer-to-peer distributed storage systems such as InterPlanetary File System (IPFS) [27] and distributed hash table (DHT) [28], the challenge of on-chain data storage can be well solved through stored off chain. Schemes in [12, 29, 30] adopting such distributed storage system instead of on-chain or cloud storage are proved secure and efficient. Furthermore, according to the above proposals, blockchain can also be considered as an effective technique that takes over decryption tasks as the role of cloud, thus making it significant to explore both secure and efficient blockchain-based data sharing scheme.


### 1.1. Motivation

In traditional data sharing scenarios, cloud computing and cloud storage are usually adopted to process data. However, despite great convenience brought by the introduction of the third party, it unavoidably leads to trust issues. Most schemes assume that the third party (i.e., the cloud) is semi-trusted or even trusted, which means users can only confirm whether the result of outsourced computation is correct and the stored data are tampered. Nonetheless, it cannot prevent the underlying threat of data modification by malicious cloud in practice. To address the issue of data tampering, a promising solution is to introduce blockchain or shared database for storage instead of the cloud. However, in terms of huge computational costs of ABE decryption in data sharing scenarios, we should also consider the improvement of decryption efficiency especially for the users who are resource-limited. Blockchain equipped with smart contracts or chaincode, which can perform specific computing task, provides a feasible solution. Among the previous mentioned blockchain-based data sharing schemes, proposals in [20–26] ignored the huge data storage on chain. Wang et al. [29] proposed an improved scheme by IPFS, but the user has to take huge computational costs, while Wang et al. [12] put forward an ABE-OD scheme assisted by blockchain to reduce users’ costs, but it ignored the security in practice. Pham et al. [30] considered both security and efficiency, but their scheme lacks concrete instantiation and security analysis. Therefore, it is still necessary to explore a secure and efficient blockchain-based access control and data sharing scheme, which is the focus of this article.


### 1.2. Contributions

In this paper, we mainly propose a data sharing system based on blockchain and ABE which can achieve both high security and efficiency for data users. In particular, we present a blockchain-based large-universe multi-authority CP-ABE with outsourced decryption scheme (LU-MAABE-OD) based on basic outsourced CP-ABE scheme proposed by Ning et al. [10] and traceable multi-authority CP-ABE scheme proposed by Zhang et al. [11]. Our contributions are as follows:(i)
We construct a user-friendly data sharing scheme that combines large-universe CP-ABE and blockchain to promote flexibility and efficiency. The constant size of public parameters makes the system more scalable, and it will be practical and convenient for users to join without the limitation on attribute universe. Moreover, partial decryption assisted by smart contracts or chaincode in blockchain instead of the cloud in traditional scenarios can further reduce the computation overhead of the user side since the verification is not necessary.(ii)
Our proposed scheme is multi-authority based and key escrow and key abuse resistant. The user’s decryption secret key is produced by the collaboration of two semi-trusted parties, i.e., key generation center (KGC) and attribute authority (AA), which is also blinded by the public key owned by user, so that none of participants can forge the key alone. Besides, in our scheme, the key generated is a transformation key which can just partially recover the ciphertexts and can be public, and thus none of the third party can recover the ciphertexts (i.e., the encapsulated key). Furthermore, due to the sophisticated design of key sanity and owner check mechanism before the decryption of blockchain, the public transformation key can only be used by its owner in our system, thus avoiding malicious computation burden on chain.(iii)
We give formal security analysis and concrete construction which proves that our proposal is feasible and secure. Besides, experimental simulation and comparison indicate that our scheme is efficient, especially for resource-constrained users.Table1 shows a functional comparison between our proposal and several representative related schemes.Table 1
A comparison between our scheme and related schemes.
Scheme
Large universe
Multi-authority
Outsourced decryption
Blockchain
Access structure
NCD + 17 [10]
✓
✕
✓
✕
LSSS
ZZP + 20 [11]
✓
✓
✕
✕
LSSS
WCY21 [12]
✕
✕
✓
✓
Tree
Our scheme
✓
✓
✓
✓
LSSS


### 1.3. Organization

We organize the rest of our paper as follows. In Sections2 and 3, we briefly review the related work and preliminaries involved in our scheme, respectively. Then, in Section 4, the overview of our system model, system assumptions, formal description, and security model will be displayed. In Section 5, we will describe our concrete scheme and security analysis in detail. Next, we evaluate the system in Section 6 and finally draw a conclusion in Section 7.


## 1.1. Motivation

In traditional data sharing scenarios, cloud computing and cloud storage are usually adopted to process data. However, despite great convenience brought by the introduction of the third party, it unavoidably leads to trust issues. Most schemes assume that the third party (i.e., the cloud) is semi-trusted or even trusted, which means users can only confirm whether the result of outsourced computation is correct and the stored data are tampered. Nonetheless, it cannot prevent the underlying threat of data modification by malicious cloud in practice. To address the issue of data tampering, a promising solution is to introduce blockchain or shared database for storage instead of the cloud. However, in terms of huge computational costs of ABE decryption in data sharing scenarios, we should also consider the improvement of decryption efficiency especially for the users who are resource-limited. Blockchain equipped with smart contracts or chaincode, which can perform specific computing task, provides a feasible solution. Among the previous mentioned blockchain-based data sharing schemes, proposals in [20–26] ignored the huge data storage on chain. Wang et al. [29] proposed an improved scheme by IPFS, but the user has to take huge computational costs, while Wang et al. [12] put forward an ABE-OD scheme assisted by blockchain to reduce users’ costs, but it ignored the security in practice. Pham et al. [30] considered both security and efficiency, but their scheme lacks concrete instantiation and security analysis. Therefore, it is still necessary to explore a secure and efficient blockchain-based access control and data sharing scheme, which is the focus of this article.


## 1.2. Contributions

In this paper, we mainly propose a data sharing system based on blockchain and ABE which can achieve both high security and efficiency for data users. In particular, we present a blockchain-based large-universe multi-authority CP-ABE with outsourced decryption scheme (LU-MAABE-OD) based on basic outsourced CP-ABE scheme proposed by Ning et al. [10] and traceable multi-authority CP-ABE scheme proposed by Zhang et al. [11]. Our contributions are as follows:(i)
We construct a user-friendly data sharing scheme that combines large-universe CP-ABE and blockchain to promote flexibility and efficiency. The constant size of public parameters makes the system more scalable, and it will be practical and convenient for users to join without the limitation on attribute universe. Moreover, partial decryption assisted by smart contracts or chaincode in blockchain instead of the cloud in traditional scenarios can further reduce the computation overhead of the user side since the verification is not necessary.(ii)
Our proposed scheme is multi-authority based and key escrow and key abuse resistant. The user’s decryption secret key is produced by the collaboration of two semi-trusted parties, i.e., key generation center (KGC) and attribute authority (AA), which is also blinded by the public key owned by user, so that none of participants can forge the key alone. Besides, in our scheme, the key generated is a transformation key which can just partially recover the ciphertexts and can be public, and thus none of the third party can recover the ciphertexts (i.e., the encapsulated key). Furthermore, due to the sophisticated design of key sanity and owner check mechanism before the decryption of blockchain, the public transformation key can only be used by its owner in our system, thus avoiding malicious computation burden on chain.(iii)
We give formal security analysis and concrete construction which proves that our proposal is feasible and secure. Besides, experimental simulation and comparison indicate that our scheme is efficient, especially for resource-constrained users.Table1 shows a functional comparison between our proposal and several representative related schemes.Table 1
A comparison between our scheme and related schemes.
Scheme
Large universe
Multi-authority
Outsourced decryption
Blockchain
Access structure
NCD + 17 [10]
✓
✕
✓
✕
LSSS
ZZP + 20 [11]
✓
✓
✕
✕
LSSS
WCY21 [12]
✕
✕
✓
✓
Tree
Our scheme
✓
✓
✓
✓
LSSS


## 1.3. Organization

We organize the rest of our paper as follows. In Sections2 and 3, we briefly review the related work and preliminaries involved in our scheme, respectively. Then, in Section 4, the overview of our system model, system assumptions, formal description, and security model will be displayed. In Section 5, we will describe our concrete scheme and security analysis in detail. Next, we evaluate the system in Section 6 and finally draw a conclusion in Section 7.


## 2. Related Work

### 2.1. Attribute-Based Encryption

Attribute-based encryption (ABE), first proposed by Sahai and Waters [1], was a sophisticated cryptography scheme that could support flexible and fine-grained access control, thus commonly being used in data sharing scenarios. However, the huge computational overhead has been the bottleneck, thus attracting numerous relevant research studies [31–33] on promoting the security, expressiveness, and efficiency of ABE. Among them, a promising method to reduce costs of user is to outsource partial decryption to a proxy (i.e., cloud), which was formalized in [13] as ABE with outsourcing decryption (ABE-OD). In such a setting, users only need to expose a transformation key to cloud while the final decryption key is kept secretly. To solve the invalid decryption in ABE-OD scenarios, Lai et al. [14] put forward a verifiable ABE-OD scheme while sacrificing the size of ciphertexts and operation complexity compared with [31], followed by schemes [16–19] proposed to achieve higher efficiency and expressiveness. However, all of the above schemes restrict the final decryption and verification to individual who owns the final decryption key, thus leading to inflexible data sharing and access since data users must obtain the final decryption key from the data owner. Besides, the limitation on attribute universe restricts their practical scenarios because no additional attribute can be added when the public parameters are set up, which was defined as small-universe ABE (SU-ABE) [3]. For better scalability, large-universe ABE (LU-ABE) [3] was put forward so that new attributes can be added arbitrarily. Nonetheless, key abuse and key escrow remain two obstacles. To achieve higher security, traceable ABE schemes [4–6] that could deal with key abuse issue were proved effective by embedding user’s id in the key. In 2017, Ning et al. [10] presented an efficient key abuse resistant LU-ABE-OD scheme while it depends on a single authority that is considered to be honest, thus leading to key escrow problem. To remove the impact caused by centralization of single authority, multi-authority ABE schemes [7–9] which could deal with key escrow problem were proposed. Since the key is jointly generated by multiple AA, any AA cannot forge the key or decrypt underlying data. Later, Zhang et al. [11] proposed a multi-authority LU-ABE scheme which is resistant to key escrow and key abuse attack. In their scheme, the key was comprised by the collaboration of two authorities (i.e., KGC and AA) and traceable mechanism was integrated to follow the abused key. However, the user decryption cost has not been taken into consideration so that it cannot be well performed particularly for resource-limited users. Furthermore, although all of the abovementioned ABE schemes can achieve higher efficiency or security in data sharing scenarios, most of them ignore the impact of malicious cloud services while data integrity is of great significance especially for data owners. In a word, research on more secure data sharing scheme is worthy of exploration.


### 2.2. Blockchain-Based Data Sharing Scheme

The development of blockchain technology contributes to addressing issues in data sharing caused by traditional cloud storage system due to its transparency and tamper resistance. For better combination with practical applications, schemes in [20–23] proposed blockchain-based EHRs sharing models and schemes in [24–26] put forward blockchain-based sharing models in scenario of IoT (Internet of Things). Despite the sophisticated design of ABE schemes that can support traceable, searchable, and outsourced decryption, key leakage resistance, etc., none of them concentrates on the storage burden on chain caused by huge ABE ciphertext storage overheads. To reduce overheads on chain, distributed storage systems like IPFS and DHT have been widely concerned. Based on IPFS and smart contracts, Wang et al. [29] put forward a data sharing model in which personal data management is controlled by data owner himself. Despite the promotion of privacy, data owner has to bear huge computation costs of key generation and distribution while data user has to take on the whole decryption cost, too. Similarly, Wang et al. [12] put forward a personal privacy data protection scheme based on blockchain and DHT, combing proxy reencryption scheme to outsource partial decryption task to blockchain and achieving access transparency. Nonetheless, data owner still undertakes large amounts of computation tasks and the proposed ABE scheme is actually poor in security. Later, a decentralized storage system combining IPFS, ABE, and blockchain was proposed by Pham et al. [30] without concrete construction and experimental analysis that can prove the feasibility. Therefore, exploring a more secure and efficient data sharing scheme in decentralized storage system remains an issue.


## 2.1. Attribute-Based Encryption

Attribute-based encryption (ABE), first proposed by Sahai and Waters [1], was a sophisticated cryptography scheme that could support flexible and fine-grained access control, thus commonly being used in data sharing scenarios. However, the huge computational overhead has been the bottleneck, thus attracting numerous relevant research studies [31–33] on promoting the security, expressiveness, and efficiency of ABE. Among them, a promising method to reduce costs of user is to outsource partial decryption to a proxy (i.e., cloud), which was formalized in [13] as ABE with outsourcing decryption (ABE-OD). In such a setting, users only need to expose a transformation key to cloud while the final decryption key is kept secretly. To solve the invalid decryption in ABE-OD scenarios, Lai et al. [14] put forward a verifiable ABE-OD scheme while sacrificing the size of ciphertexts and operation complexity compared with [31], followed by schemes [16–19] proposed to achieve higher efficiency and expressiveness. However, all of the above schemes restrict the final decryption and verification to individual who owns the final decryption key, thus leading to inflexible data sharing and access since data users must obtain the final decryption key from the data owner. Besides, the limitation on attribute universe restricts their practical scenarios because no additional attribute can be added when the public parameters are set up, which was defined as small-universe ABE (SU-ABE) [3]. For better scalability, large-universe ABE (LU-ABE) [3] was put forward so that new attributes can be added arbitrarily. Nonetheless, key abuse and key escrow remain two obstacles. To achieve higher security, traceable ABE schemes [4–6] that could deal with key abuse issue were proved effective by embedding user’s id in the key. In 2017, Ning et al. [10] presented an efficient key abuse resistant LU-ABE-OD scheme while it depends on a single authority that is considered to be honest, thus leading to key escrow problem. To remove the impact caused by centralization of single authority, multi-authority ABE schemes [7–9] which could deal with key escrow problem were proposed. Since the key is jointly generated by multiple AA, any AA cannot forge the key or decrypt underlying data. Later, Zhang et al. [11] proposed a multi-authority LU-ABE scheme which is resistant to key escrow and key abuse attack. In their scheme, the key was comprised by the collaboration of two authorities (i.e., KGC and AA) and traceable mechanism was integrated to follow the abused key. However, the user decryption cost has not been taken into consideration so that it cannot be well performed particularly for resource-limited users. Furthermore, although all of the abovementioned ABE schemes can achieve higher efficiency or security in data sharing scenarios, most of them ignore the impact of malicious cloud services while data integrity is of great significance especially for data owners. In a word, research on more secure data sharing scheme is worthy of exploration.


## 2.2. Blockchain-Based Data Sharing Scheme

The development of blockchain technology contributes to addressing issues in data sharing caused by traditional cloud storage system due to its transparency and tamper resistance. For better combination with practical applications, schemes in [20–23] proposed blockchain-based EHRs sharing models and schemes in [24–26] put forward blockchain-based sharing models in scenario of IoT (Internet of Things). Despite the sophisticated design of ABE schemes that can support traceable, searchable, and outsourced decryption, key leakage resistance, etc., none of them concentrates on the storage burden on chain caused by huge ABE ciphertext storage overheads. To reduce overheads on chain, distributed storage systems like IPFS and DHT have been widely concerned. Based on IPFS and smart contracts, Wang et al. [29] put forward a data sharing model in which personal data management is controlled by data owner himself. Despite the promotion of privacy, data owner has to bear huge computation costs of key generation and distribution while data user has to take on the whole decryption cost, too. Similarly, Wang et al. [12] put forward a personal privacy data protection scheme based on blockchain and DHT, combing proxy reencryption scheme to outsource partial decryption task to blockchain and achieving access transparency. Nonetheless, data owner still undertakes large amounts of computation tasks and the proposed ABE scheme is actually poor in security. Later, a decentralized storage system combining IPFS, ABE, and blockchain was proposed by Pham et al. [30] without concrete construction and experimental analysis that can prove the feasibility. Therefore, exploring a more secure and efficient data sharing scheme in decentralized storage system remains an issue.


## 3. Preliminaries

In this section, we briefly present the involved basic knowledge related to our system.


### 3.1. Bilinear Pairings

LetG1, G2 and GT denote three multiplicative cyclic groups of the same prime order p. g1 and g2 are the generators of G1 and G2, respectively. e:G1×G2⟶GT is a bilinear map with properties as follows:(i)
Bilinearity: for alla,b∈ℤp, eg1a,g2b=eg1,g2ab.(ii)
Non-degeneracy:eg1,g2≠1.(iii)
Computability:e should be efficiently computable.


### 3.2. Access Structure

Definition 1.
(access structure [34]). Let U be the attribute universe. A collection A⊆2U is monotone while ∀X,Y satisfy that if X∈A and X⊆Y then Y∈A. An access structure (respectively, monotone access structure) is a collection (resp. monotone collection) A of non-empty subsets of U, i.e., A⊆2U/∅. The sets in A are called the authorized sets while the sets not in A are called the unauthorized ones. In this paper, the role of the parties is delegated by attributes. Thus, A is a collection of authorized attributes and we only discuss the monotone access structure.


### 3.3. Linear Secret Sharing Schemes (LSSS)

Definition 2.
linear secret sharing schemes
34
: Let U denote the attribute and p be a prime. A secret sharing scheme Π over a set of parties on U is called linear (over ℤp) if it satisfies(1)
The shares of secrets∈ℤp for each attribute form a vector over ℤp.(2)
For each access structureA on U, there exists a share-generating matrix M with l rows and n columns for Π. And for i=1,…,l, a function ρ labels ith row of M with attribute ρi from S. During the generation of the shares s, we consider the column vector v⟶=s,r2,…,rn, where r2,…,rn∈ℤp are randomly chosen. Then the vector of l shares of s according to Π is equal to Mv⟶∈ℤpl×1. The share Mv⟶j where j∈l “belongs” to attribute ρj.According to [34], each linear secret sharing scheme satisfying the above definition enjoys the linear reconstruction property, defined as follows: suppose that Π is an LSSS for an access control A, and S∗∈A is an authorized set. Let I⊂1,2,…,l be defined as I=i∈l∧ρi∈S∗. For any valid shares λ=Mv⟶ii∈I of a secret s according to Π, there exist constants ωi∈ℤpi∈I such that ∑i∈Iωiλi=s.


### 3.4. Blockchain and IPFS

First proposed in [35], blockchain is known as the underlying concept of Bitcoin and can simply be considered as a distributed ledger in the peer-to-peer network, in which all transactions can be recorded on chain. As each transaction in blockchain is public, traceable, and tamper resistant, it gradually plays an important role in various industrial scenarios (i.e., medical, financial, educational, and so on) and blockchain-based system Ethereum [36] and Hyperledger Fabric [37] have achieved prominent achievement. Most significantly, the introduction of blockchain solves the trust problem in traditional centralized systems due to the arrival of smart contract [38] (in Ethereum, or called chaincode in Hyperledger Fabric), which is a series of codes that can be executed and recorded automatically when running conditions are triggered. Once executed successfully, the result cannot be tampered. Nonetheless, blockchain has to undertake the issue of massive data storage on chain, and a promising method is to transfer the data off chain. IPFS, a peer-to-peer distributed file system proposed by Benet [27], provides a promising solution. Unlike traditional Internet HTTP protocol which needs to search the domain address, IPFS is designed to search the content address so that any peer can be a server and can also request the file in content-addressed block, thus contributing to cheaper, faster, and more secure network services. With the assistance of IPFS, the hash value of data can be stored on chain instead while the data can be stored in IPFS. So far, the combination of blockchain and IPFS system has attracted attention from researchers in different fields.


### 3.5. Review of Ning Et Al.’s Basic Scheme [10]

Our blockchain-based outsourced CP-ABE scheme is related to that of basic outsourced CP-ABE scheme [10] proposed by Ning et al., so we now revisit it. According to their construction, the system is composed of four entities, namely, cloud, authority (AA), data owner (DO), and data user (DU), in which cloud is semi-honest (who will obey the protocol but try to collect private information of users as possible) while AA is honest (who is totally trusted by other entities). Their construction can be briefly depicted as follows:(i)
Setup1λ⟶pp,msk: with the input of a security parameter λ, this algorithm (run by AA) produces a bilinear group D=G,GT,p,e and randomly chooses elements g,h,u,v,w∈G and α∈ℤp. It outputs the system public parameters pp=D,g,h,u,v,w,eg,gα and system master secret key msk=α.(ii)
Setupcpp⟶pkc,skc: with the input of public parameters pp, this algorithm (run by cloud) randomly chooses sc∈ℤp and generates the public key pkc=Pc=gsc and secret key skc=sc of cloud.(iii)
Setupupp⟶pku,sku: with the input of public parameters pp, this algorithm (run by DU) randomly chooses su∈ℤp and generates the public key pku=Pu=gsu and secret key sku=su of user.(iv)
KeyGenpp,pkc,pku,msk,S⟶skS: with the input of public parameters pp, public key of cloud pkc, public key of user pku, the system master secret key msk and attribute set of user S., this algorithm (run by AA) randomly chooses β,r,rττ∈k∈ℤp and then computes K0=PuαPcβwr,K1=gβ,K2=gr,Kτ,3=grτ,Kτ,4=uAτhrτv−rτ∈k. It finally outputs the secret key skS=S,K0,K1,K2,Kτ,3,Kτ,4τ∈k.(v)
KeyGenoutskS⟶tkS: the algorithm (run by DU) simply sets tkS=skS and returns the transformation key tkS.(vi)
Encryptpp,A⟶ctA,KDU: with the input of public parameters pp and an LSSS access structure A=M,ρ, this algorithm (run by DU) first randomly chooses s∈ℤp and r2,…,rn∈ℤp to construct a column vector v⟶=s,r2,…,rn and computes the vector of shares λ⟶=λ1,λ2,…,λlT=Mv⟶. It also randomly chooses ri∈ℤp for each Mi and tττ∈l∈ℤp. It then computes C0=gs,Cτ,1=wλτvtτ,Cτ,2=uρτh−tτ,Cτ,3=gtττ∈l, in which the encapsulated key is KDU=eg,gαs and ciphertext is ctA=M,ρ,C0,Cτ,1,Cτ,2,Cτ,3τ∈l.(vii)
Decryptoutpp,ctA,tkS,skc⟶pct/⊥: with the input of public parameters pp, the ciphertext ctA, the transformation key tkS and secret key of cloud skc, this algorithm (run by cloud) calculates a share to attributes in S and computes the constants ωi∈ℤpi∈l with the set of rows I=i:ρi∈S in M such that ∑i∈IωiMi=1,0,…,0. If S does not satisfy the access structure A, it outputs ⊥. Otherwise, it calculates(1)P=∏i∈leCτ,1,K2eCτ,2,Kτ,3eCτ,3,Kτ,4ωi,C′=eC0,K0eC0,K1skc⋅P=eg,Puαs.And it outputs the partially decrypted ciphertextpct=A,C′.(viii)
Decryptupct,sku⟶key: with the input of a partially decrypted ciphertext pct and the user secret key sku, the algorithm (run by DU) calculates and outputs(2)key=C′sku−1=eg,Puαssu−1=eg,gαs.As is proved in [10], the above construction is secure under the proposed security model. Nonetheless, it cannot be practical in terms of the honest AA. In fact, if we consider AA as a semi-honest party, the proposed scheme will no longer be secure under key escrow attack.(ix)
With the master secret keyα, semi-honest AA privately calculates gα. With the given ciphertext ctA, semi-honest AA withdraws C0=gs.(x)
AA easily computeskey=egα,gs=eg,gαs which is actually the encapsulated key KDU=eg,gαs, thus making the system insecure.To sum up, scheme in [10] is insecure in the security model comprised of semi-honest AA, and thus solving key escrow issue caused by such single-authority system and exploring scheme with higher security is necessary.


## 3.1. Bilinear Pairings

LetG1, G2 and GT denote three multiplicative cyclic groups of the same prime order p. g1 and g2 are the generators of G1 and G2, respectively. e:G1×G2⟶GT is a bilinear map with properties as follows:(i)
Bilinearity: for alla,b∈ℤp, eg1a,g2b=eg1,g2ab.(ii)
Non-degeneracy:eg1,g2≠1.(iii)
Computability:e should be efficiently computable.


## 3.2. Access Structure

Definition 1.
(access structure [34]). Let U be the attribute universe. A collection A⊆2U is monotone while ∀X,Y satisfy that if X∈A and X⊆Y then Y∈A. An access structure (respectively, monotone access structure) is a collection (resp. monotone collection) A of non-empty subsets of U, i.e., A⊆2U/∅. The sets in A are called the authorized sets while the sets not in A are called the unauthorized ones. In this paper, the role of the parties is delegated by attributes. Thus, A is a collection of authorized attributes and we only discuss the monotone access structure.


## 3.3. Linear Secret Sharing Schemes (LSSS)

Definition 2.
linear secret sharing schemes
34
: Let U denote the attribute and p be a prime. A secret sharing scheme Π over a set of parties on U is called linear (over ℤp) if it satisfies(1)
The shares of secrets∈ℤp for each attribute form a vector over ℤp.(2)
For each access structureA on U, there exists a share-generating matrix M with l rows and n columns for Π. And for i=1,…,l, a function ρ labels ith row of M with attribute ρi from S. During the generation of the shares s, we consider the column vector v⟶=s,r2,…,rn, where r2,…,rn∈ℤp are randomly chosen. Then the vector of l shares of s according to Π is equal to Mv⟶∈ℤpl×1. The share Mv⟶j where j∈l “belongs” to attribute ρj.According to [34], each linear secret sharing scheme satisfying the above definition enjoys the linear reconstruction property, defined as follows: suppose that Π is an LSSS for an access control A, and S∗∈A is an authorized set. Let I⊂1,2,…,l be defined as I=i∈l∧ρi∈S∗. For any valid shares λ=Mv⟶ii∈I of a secret s according to Π, there exist constants ωi∈ℤpi∈I such that ∑i∈Iωiλi=s.


## 3.4. Blockchain and IPFS

First proposed in [35], blockchain is known as the underlying concept of Bitcoin and can simply be considered as a distributed ledger in the peer-to-peer network, in which all transactions can be recorded on chain. As each transaction in blockchain is public, traceable, and tamper resistant, it gradually plays an important role in various industrial scenarios (i.e., medical, financial, educational, and so on) and blockchain-based system Ethereum [36] and Hyperledger Fabric [37] have achieved prominent achievement. Most significantly, the introduction of blockchain solves the trust problem in traditional centralized systems due to the arrival of smart contract [38] (in Ethereum, or called chaincode in Hyperledger Fabric), which is a series of codes that can be executed and recorded automatically when running conditions are triggered. Once executed successfully, the result cannot be tampered. Nonetheless, blockchain has to undertake the issue of massive data storage on chain, and a promising method is to transfer the data off chain. IPFS, a peer-to-peer distributed file system proposed by Benet [27], provides a promising solution. Unlike traditional Internet HTTP protocol which needs to search the domain address, IPFS is designed to search the content address so that any peer can be a server and can also request the file in content-addressed block, thus contributing to cheaper, faster, and more secure network services. With the assistance of IPFS, the hash value of data can be stored on chain instead while the data can be stored in IPFS. So far, the combination of blockchain and IPFS system has attracted attention from researchers in different fields.


## 3.5. Review of Ning Et Al.’s Basic Scheme [10]

Our blockchain-based outsourced CP-ABE scheme is related to that of basic outsourced CP-ABE scheme [10] proposed by Ning et al., so we now revisit it. According to their construction, the system is composed of four entities, namely, cloud, authority (AA), data owner (DO), and data user (DU), in which cloud is semi-honest (who will obey the protocol but try to collect private information of users as possible) while AA is honest (who is totally trusted by other entities). Their construction can be briefly depicted as follows:(i)
Setup1λ⟶pp,msk: with the input of a security parameter λ, this algorithm (run by AA) produces a bilinear group D=G,GT,p,e and randomly chooses elements g,h,u,v,w∈G and α∈ℤp. It outputs the system public parameters pp=D,g,h,u,v,w,eg,gα and system master secret key msk=α.(ii)
Setupcpp⟶pkc,skc: with the input of public parameters pp, this algorithm (run by cloud) randomly chooses sc∈ℤp and generates the public key pkc=Pc=gsc and secret key skc=sc of cloud.(iii)
Setupupp⟶pku,sku: with the input of public parameters pp, this algorithm (run by DU) randomly chooses su∈ℤp and generates the public key pku=Pu=gsu and secret key sku=su of user.(iv)
KeyGenpp,pkc,pku,msk,S⟶skS: with the input of public parameters pp, public key of cloud pkc, public key of user pku, the system master secret key msk and attribute set of user S., this algorithm (run by AA) randomly chooses β,r,rττ∈k∈ℤp and then computes K0=PuαPcβwr,K1=gβ,K2=gr,Kτ,3=grτ,Kτ,4=uAτhrτv−rτ∈k. It finally outputs the secret key skS=S,K0,K1,K2,Kτ,3,Kτ,4τ∈k.(v)
KeyGenoutskS⟶tkS: the algorithm (run by DU) simply sets tkS=skS and returns the transformation key tkS.(vi)
Encryptpp,A⟶ctA,KDU: with the input of public parameters pp and an LSSS access structure A=M,ρ, this algorithm (run by DU) first randomly chooses s∈ℤp and r2,…,rn∈ℤp to construct a column vector v⟶=s,r2,…,rn and computes the vector of shares λ⟶=λ1,λ2,…,λlT=Mv⟶. It also randomly chooses ri∈ℤp for each Mi and tττ∈l∈ℤp. It then computes C0=gs,Cτ,1=wλτvtτ,Cτ,2=uρτh−tτ,Cτ,3=gtττ∈l, in which the encapsulated key is KDU=eg,gαs and ciphertext is ctA=M,ρ,C0,Cτ,1,Cτ,2,Cτ,3τ∈l.(vii)
Decryptoutpp,ctA,tkS,skc⟶pct/⊥: with the input of public parameters pp, the ciphertext ctA, the transformation key tkS and secret key of cloud skc, this algorithm (run by cloud) calculates a share to attributes in S and computes the constants ωi∈ℤpi∈l with the set of rows I=i:ρi∈S in M such that ∑i∈IωiMi=1,0,…,0. If S does not satisfy the access structure A, it outputs ⊥. Otherwise, it calculates(1)P=∏i∈leCτ,1,K2eCτ,2,Kτ,3eCτ,3,Kτ,4ωi,C′=eC0,K0eC0,K1skc⋅P=eg,Puαs.And it outputs the partially decrypted ciphertextpct=A,C′.(viii)
Decryptupct,sku⟶key: with the input of a partially decrypted ciphertext pct and the user secret key sku, the algorithm (run by DU) calculates and outputs(2)key=C′sku−1=eg,Puαssu−1=eg,gαs.As is proved in [10], the above construction is secure under the proposed security model. Nonetheless, it cannot be practical in terms of the honest AA. In fact, if we consider AA as a semi-honest party, the proposed scheme will no longer be secure under key escrow attack.(ix)
With the master secret keyα, semi-honest AA privately calculates gα. With the given ciphertext ctA, semi-honest AA withdraws C0=gs.(x)
AA easily computeskey=egα,gs=eg,gαs which is actually the encapsulated key KDU=eg,gαs, thus making the system insecure.To sum up, scheme in [10] is insecure in the security model comprised of semi-honest AA, and thus solving key escrow issue caused by such single-authority system and exploring scheme with higher security is necessary.


## 4. Our Construction

In this section, we mainly propose our construction of system model, system assumptions, formal description, and security model.


### 4.1. System Model

In our blockchain-based data sharing model, key/data encapsulation mechanism (KEM/DEM) [39] is applied in which our LU-MAABE-OD scheme is involved to generate the symmetric session key for encrypting data. As depicted in Figure 1, our data sharing model mainly consists of five entities, namely, key generation center (KGC), attribute authority (AA), data user (DU), data owner (DO), and blockchain (BC) equipped with smart contracts (SCs) or chaincode (chaincode is preferred in our system) and IPFS.(i)
KGC: the key generation center who participates in the setup of public parameter and key generation of DO and DU.(ii)
AA: the attribute authority who participates in the setup of public parameter and key generation of DO and DU.(iii)
DO: the owner who expects to share some data with those who satisfy specific access structure, so he/she needs to determine the access policy and the symmetric session key which is encrypted by KEM ciphertexts and further used to encrypt shared data; then he/she generates DEM ciphertexts which will be uploaded to IPFS together with KEM ciphertexts. After uploading, DO only needs to save the IPFS address of KEM/DEM ciphertexts to BC.(iv)
DU: the user who owns certain access structure and wants to access data. DU is uniquely labelled by his/her public identityID in the whole system. Besides, DU possesses his/her own public and secret key pair which contributes to the generation of private transformation key together with his/her attribute set and ID with the help of KGC and AA. The transformation key can be public while the secret key is always kept privately and used to make final decryption.(v)
BC: the data storage center which is maintained by a number of recording nodes, which are called miners in public blockchain like Ethereum and authorized nodes in permissioned blockchain like Hyperledger. In our scheme, BC with SC/chaincode can also undertake the task of partially decrypting KEM ciphertexts. To relieve the burden on chain, all the KEM/DEM ciphertexts are stored in IPFS while the addresses of IPFS are stored on chain. When needed, BC will retrieve the corresponding data through the IPFS address.Figure 1
System overview of our scheme.The workflow can be mainly described as follows:(i)
Initialization: in the phase of system public parameter generation, both KGC and AA will participate and keep their master keys secretly. Any user (i.e., Ui) can randomly choose his/her private key and generate his/her public key according to system public parameter. It should be noted that no user can use a duplicate public key.(ii)
Authentication: KGC and AA audit the authentication information ID together with attribute set S, which can be denoted as a pair (S, ID) submitted by Ui and collectively generate his/her transformation key tkS,ID.(1)
Ui forwards his/her key pair to KGC. After audited, an intermediate key skS,IDKGC will be produced and sent to AA.(2)
After receivingskS,IDKGC, AA generates the final decryption key skS,IDAA and sends it to Ui.(3)
Ui simply keeps skS,IDAA as the transformation key tkS,ID.(iii)
DataEncryption: with the help of KEM/DEM mechanism, DO encrypts data with the generated encapsulated key which is encrypted by KEM ciphertexts to produce DEM ciphertexts, and then KEM and DEM ciphertexts will be uploaded to IPFS. If finished, corresponding IPFS addresses should be saved on chain for searching.(iv)
DataDecryption: to obtain the encapsulated key for decryption, DU can decrypt KEM ciphertexts with the help of chaincode according to the following steps.(1)
DU can invoke the chaincode which is preencoded and deployed by one system maintainer of blockchain for helping decryption. If executed, the chaincode will check whethertkS,ID is used by the key owner. It first checks whether ID of DU satisfies ℋID=L, in which L is the embedded value in tkS,ID that records the hash of key owner’s ID. If it fails, decryption will be refused. Otherwise, it will then do key sanity check to validate whether tkS,ID is just forged by changing ID. If it fails, decryption will also be refused. It should be noted that such checking is designed to avoid heavy burden caused by invalid decryption of malicious users.(2)
If the key is confirmed to be used by its owner, KEM ciphertexts from IPFS will be decrypted and partially decrypted ciphertextpct will be sent back to DU through chaincode.(3)
DU finally decryptspct with his/her private key and achieves the encapsulated key that can be further used in the decryption of DEM ciphertexts stored in IPFS.We briefly take the medical data sharing scenario as an example for the better understanding of our protocol. We choose Hyperledger as the blockchain in which recording nodes are composed of some permissioned regulators and the preencoded decryption chaincode is deployed by one of them, and the system initiators are KGC and AA. Any user can generate their own public-secret key pair according to the system public parameter and then achieve the transformation key generated by the cooperation of KGC and AA according to his/her unique labelID and access structure in the system. According to the specific access policy, DO who wants to share medical data can generate KEM ciphertexts that can decrypt the encapsulation key, which can be further used to encrypt the medical data to DEM ciphertexts, and then KEM/DEM ciphertexts are uploaded to IPFS. DU who wants to access medical data but lacks computing power can decrypt KEM ciphertexts by invoking the deployed chaincode with the transformation key. During the execution of the chaincode, it will first check whether the key is used by its owner. If not, the execution of the chaincode will fail. Otherwise, the chaincode will output the decrypted result and DU only needs to decrypt the encapsulation key with his/her secret key by performing one exponential operation and finally decrypts the DEM ciphertexts from IPFS with the encapsulation key to achieve the underlying medical data. It is easy to find that the application of blockchain can not only solve the problem of tamper-resistant data storage but also help the decryption of resource-limited users with chaincode.


### 4.2. System Assumptions

In this paper, we suppose all the entities are driven by their interests and not entirely trusted.(i)
KGC: it is a semi-honest entity who may be curious about the data owned by DO and the secret key of DU, but it will honestly execute the agreed protocol. Besides, it is noted that KGC will never collude with AA.(ii)
AA: it is also a semi-honest entity who may be curious about the data owned by DO and the secret key of DU, but it will honestly execute the agreed protocol. Besides, it is noted that AA will never collude with KGC.(iii)
DO: DO may be curious about the data owned by other DOs and he/she will always keep his/her secret key in the system.(iv)
DU: DU may be curious about the data that he/she cannot access and he/she will always keep his/her secret key in the system.(v)
BC: in terms of the consensus protocol of blockchain, we consider this entity as a semi-honest one, which means the recording nodes will honestly obey the specific protocol and run chaincode, but they may also be curious about the underlying data. Besides, they are restricted not to collude with KGC and AA at the same time.


### 4.3. Definition

According to the description above, a formal definition of our proposed LU-MAABE-OD scheme consists of ten probabilistic polynomial time (PPT) algorithms as follows.(1)
SetupKGC1λ⟶ppKGC,mskKGC: with a security parameter λ, this algorithm (run by KGC) produces KGC public parameter ppKGC and KGC master secret key mskKGC.(2)
SetupAAppKGC⟶ppAA,mskAA,pp: with KGC public parameter ppKGC, this algorithm (run by AA) produces AA public parameter ppAA and AA master secret key mskAA. And it finally outputs system public parameter which is denoted by the union pp=ppKGC∪ppAA.(3)
Setupupp⟶pku,sku: with public parameter pp, the output of this algorithm (run by user) is the public key pku and master secret key sku of user.(4)
KeyGenKGCpp,mskKGC,pku,S,ID⟶skS,IDKGC: with public parameter pp, KGC master key mskKGC, user public key pku together with his/her attribute set S and id label ID, this algorithm (run by KGC) produces the partial decryption key skS,IDKGC.(5)
KeyGenAApp,mskAA,skS,IDKGC,S,ID⟶skS,IDAA: with public parameter pp, AA master key mskAA, partial decryption key skS,IDKGC, the user’s attribute set S and id label ID, this algorithm (run by AA) produces the final decryption key skS,IDAA.(6)
KeyGenuskS,IDAA⟶tkS,ID: with final decryption key skS,IDAA, the output of this algorithm (run by user) is the user transformation key tkS,ID.(7)
Encryptpp,A⟶KDU,ctA: with public parameter pp and the LSSS access structure A chosen by DO, this algorithm (run by user) produces the encapsulated key KDU which is further used for generation of DEM ciphertext and outputs KEM ciphertext ctA.(8)
KeySanityCheckpp,tkS,ID⟶1/0: with public parameter pp and user transformation key tkS,ID, this algorithm (run by BC) checks whether the key is well-formed and used by its owner. If it passes, this algorithm will output 1. Otherwise, it outputs 0.(9)
DecryptBCpp,ctA,tkS,ID⟶pct/⊥: with public parameter pp, user transformation key tkS,ID, and KEM ciphertext ctA, this algorithm (run by chaincode invoked by DU) produces the transformed ciphertext pct if the tkS,ID passes KeySanityCheck and access structure A embedded in it satisfies the given access policy. Otherwise, it outputs ⊥.(10)
DecryptDUpct,sku⟶key: with the transformed ciphertext pct together with user master secret key sku, this algorithm (run by user) finally produces the encapsulated key key for decrypting DEM ciphertext.


### 4.4. Security Model

LetΣ=SetupKGC, SetupAA, Setupu, KeyGenKGC, KeyGenAA, KeyGenu, Encrypt, KeySanityCheck, DecryptBC, DecryptDU denote our LU-MAABE-OD scheme. To concretely define the security notion of Σ, specific security requirements should be satisfied which can be described as the following security games.Definition 3.
(RCCA-secure ABE with outsourcing [13]). A CP-ABE scheme with outsourcing is RCCA-secure if any PPT adversary A can win the RCCA game defined as follows with at most negligible advantage.(i)
CPA security: it is defined that a scheme is CPA-secure, namely, secure against chosen-plaintext attacks if A cannot make decryption queries.(ii)
Selective security: it is defined that a scheme can achieve selective security if an Init stage is added before Setup where A commits to the challenge A∗.
RCCA-secure game for malicious DU which is similar to scheme [10]: in our LU-MAABE-OD scheme, the security model of RCCA security game can be denoted by GameΣ,ARCCA, in which the adversary A interacts with the challenger C.(1)
Setup: C executes algorithm SetupKGC and SetupAA, then pp is forwarded to A.(2)
QueryPhase-1: C initializes an integer counter j=0, an empty table T, and a set D. C answers the following queries from A:(i)
Create(S): C sets j:=j+1 and then executes Setupu to achieve a user master secret key sku and public key pku. It then runs KeyGenKGC on attribute-identity pairs S,ID to fetch the intermediate decryption key skS,IDKGC. It also executes KeyGenAA on skS,ID to fetch the final decryption key skS,IDAA (can also be denoted by skS,ID). Afterwards, KeyGenu on skS,ID is run to fetch the user transformation key tkS,ID. Eventually, the entry j,S,ID,skS,ID,tkS,ID,pku,sku is stored in T.(ii)
Corrupt.SK(i): C checks whether the i-th entry i,S,ID,skS,ID,pku,sku is in T. If such an entry exists, D:=D∪S,ID and skS,ID,pku,sku is returned to A , or ⊥ is output.(iii)
Corrupt.TK(i): C checks whether the i-th entry i,S,ID,tkS,ID is in T. If such an entry exists, tkS,ID will be returned to A, or ⊥ is output.(iv)
Decrypt(i,ct): C checks whether the i-th entry i,S,ID,skS,ID is in T. If there is such an entry, it then returns the decryption on ct, or it will output ⊥.(3)
Challenge: a challenge value A∗ is submitted by A, which has the restriction that S does not satisfy A∗. C then executes Encrypt to achieve ciphertexts ctA∗,KDU∗, and then a random bit b∈0,1 is selected. If b=0, ctA∗,KDU∗ is returned, or a random key KR∗ is chosen in the encapsulated key space and it returns ctA∗,KR∗ if b=1.(4)
QueryPhase-2: the same as QueryPhase-1 except it should satisfy the restrictions that neither can A issue a Corrupt query nor A can make a Decrypt query on ctA∗,KDU∗.(5)
Guess: A outputs a guess b∈0,1 of b. It is defined that A wins the game GameΣ,ARCCA if b′=b.Definition 4.
The LU-MAABE-OD is RCCA-secure if any PPT adversary can win the above gameGameΣ,ARCCA with at most a negligible advantage.Key Sanity Check Game. In our LU-MAABE-OD scheme, the security model of key sanity check game is similar to scheme [11] and can be denoted by GameΣ,AKSC, in which the adversary A interacts with the challenger C.(1)
C invokes A to run algorithm SetupKGC and SetupAA to produce the system parameter pp, the master secret key of KGC mskKGC, and AA mskAA.(2)
A returns pp, a ciphertext ct together with two distinct transformation keys tkS,ID1 and tkS,ID2 which are associated with the same attribute-identity label S,ID.(3)
It is defined thatA wins GameΣ,AKSC if the following requirements are satisfied:(i)
Checkpp,tkS,IDi=1,i=1,2, which indicates that both of transformation keys can pass the key sanity check.(ii)
Decpp,ct,tkS,IDi≠⊥,i=1,2, which indicates that both of transformation keys can be used to decrypt the ciphertext.(iii)
Decpp,ct,tkS,ID1≠Decpp,ct,tkS,ID2, which indicates that the results of decryption by two transformation keys are different.Definition 5.
LU-MAABE-OD is a scheme that can make key sanity check if any PPT adversaryA can win the above game GameΣ,AKSC with at most a negligible advantage.


## 4.1. System Model

In our blockchain-based data sharing model, key/data encapsulation mechanism (KEM/DEM) [39] is applied in which our LU-MAABE-OD scheme is involved to generate the symmetric session key for encrypting data. As depicted in Figure 1, our data sharing model mainly consists of five entities, namely, key generation center (KGC), attribute authority (AA), data user (DU), data owner (DO), and blockchain (BC) equipped with smart contracts (SCs) or chaincode (chaincode is preferred in our system) and IPFS.(i)
KGC: the key generation center who participates in the setup of public parameter and key generation of DO and DU.(ii)
AA: the attribute authority who participates in the setup of public parameter and key generation of DO and DU.(iii)
DO: the owner who expects to share some data with those who satisfy specific access structure, so he/she needs to determine the access policy and the symmetric session key which is encrypted by KEM ciphertexts and further used to encrypt shared data; then he/she generates DEM ciphertexts which will be uploaded to IPFS together with KEM ciphertexts. After uploading, DO only needs to save the IPFS address of KEM/DEM ciphertexts to BC.(iv)
DU: the user who owns certain access structure and wants to access data. DU is uniquely labelled by his/her public identityID in the whole system. Besides, DU possesses his/her own public and secret key pair which contributes to the generation of private transformation key together with his/her attribute set and ID with the help of KGC and AA. The transformation key can be public while the secret key is always kept privately and used to make final decryption.(v)
BC: the data storage center which is maintained by a number of recording nodes, which are called miners in public blockchain like Ethereum and authorized nodes in permissioned blockchain like Hyperledger. In our scheme, BC with SC/chaincode can also undertake the task of partially decrypting KEM ciphertexts. To relieve the burden on chain, all the KEM/DEM ciphertexts are stored in IPFS while the addresses of IPFS are stored on chain. When needed, BC will retrieve the corresponding data through the IPFS address.Figure 1
System overview of our scheme.The workflow can be mainly described as follows:(i)
Initialization: in the phase of system public parameter generation, both KGC and AA will participate and keep their master keys secretly. Any user (i.e., Ui) can randomly choose his/her private key and generate his/her public key according to system public parameter. It should be noted that no user can use a duplicate public key.(ii)
Authentication: KGC and AA audit the authentication information ID together with attribute set S, which can be denoted as a pair (S, ID) submitted by Ui and collectively generate his/her transformation key tkS,ID.(1)
Ui forwards his/her key pair to KGC. After audited, an intermediate key skS,IDKGC will be produced and sent to AA.(2)
After receivingskS,IDKGC, AA generates the final decryption key skS,IDAA and sends it to Ui.(3)
Ui simply keeps skS,IDAA as the transformation key tkS,ID.(iii)
DataEncryption: with the help of KEM/DEM mechanism, DO encrypts data with the generated encapsulated key which is encrypted by KEM ciphertexts to produce DEM ciphertexts, and then KEM and DEM ciphertexts will be uploaded to IPFS. If finished, corresponding IPFS addresses should be saved on chain for searching.(iv)
DataDecryption: to obtain the encapsulated key for decryption, DU can decrypt KEM ciphertexts with the help of chaincode according to the following steps.(1)
DU can invoke the chaincode which is preencoded and deployed by one system maintainer of blockchain for helping decryption. If executed, the chaincode will check whethertkS,ID is used by the key owner. It first checks whether ID of DU satisfies ℋID=L, in which L is the embedded value in tkS,ID that records the hash of key owner’s ID. If it fails, decryption will be refused. Otherwise, it will then do key sanity check to validate whether tkS,ID is just forged by changing ID. If it fails, decryption will also be refused. It should be noted that such checking is designed to avoid heavy burden caused by invalid decryption of malicious users.(2)
If the key is confirmed to be used by its owner, KEM ciphertexts from IPFS will be decrypted and partially decrypted ciphertextpct will be sent back to DU through chaincode.(3)
DU finally decryptspct with his/her private key and achieves the encapsulated key that can be further used in the decryption of DEM ciphertexts stored in IPFS.We briefly take the medical data sharing scenario as an example for the better understanding of our protocol. We choose Hyperledger as the blockchain in which recording nodes are composed of some permissioned regulators and the preencoded decryption chaincode is deployed by one of them, and the system initiators are KGC and AA. Any user can generate their own public-secret key pair according to the system public parameter and then achieve the transformation key generated by the cooperation of KGC and AA according to his/her unique labelID and access structure in the system. According to the specific access policy, DO who wants to share medical data can generate KEM ciphertexts that can decrypt the encapsulation key, which can be further used to encrypt the medical data to DEM ciphertexts, and then KEM/DEM ciphertexts are uploaded to IPFS. DU who wants to access medical data but lacks computing power can decrypt KEM ciphertexts by invoking the deployed chaincode with the transformation key. During the execution of the chaincode, it will first check whether the key is used by its owner. If not, the execution of the chaincode will fail. Otherwise, the chaincode will output the decrypted result and DU only needs to decrypt the encapsulation key with his/her secret key by performing one exponential operation and finally decrypts the DEM ciphertexts from IPFS with the encapsulation key to achieve the underlying medical data. It is easy to find that the application of blockchain can not only solve the problem of tamper-resistant data storage but also help the decryption of resource-limited users with chaincode.


## 4.2. System Assumptions

In this paper, we suppose all the entities are driven by their interests and not entirely trusted.(i)
KGC: it is a semi-honest entity who may be curious about the data owned by DO and the secret key of DU, but it will honestly execute the agreed protocol. Besides, it is noted that KGC will never collude with AA.(ii)
AA: it is also a semi-honest entity who may be curious about the data owned by DO and the secret key of DU, but it will honestly execute the agreed protocol. Besides, it is noted that AA will never collude with KGC.(iii)
DO: DO may be curious about the data owned by other DOs and he/she will always keep his/her secret key in the system.(iv)
DU: DU may be curious about the data that he/she cannot access and he/she will always keep his/her secret key in the system.(v)
BC: in terms of the consensus protocol of blockchain, we consider this entity as a semi-honest one, which means the recording nodes will honestly obey the specific protocol and run chaincode, but they may also be curious about the underlying data. Besides, they are restricted not to collude with KGC and AA at the same time.


## 4.3. Definition

According to the description above, a formal definition of our proposed LU-MAABE-OD scheme consists of ten probabilistic polynomial time (PPT) algorithms as follows.(1)
SetupKGC1λ⟶ppKGC,mskKGC: with a security parameter λ, this algorithm (run by KGC) produces KGC public parameter ppKGC and KGC master secret key mskKGC.(2)
SetupAAppKGC⟶ppAA,mskAA,pp: with KGC public parameter ppKGC, this algorithm (run by AA) produces AA public parameter ppAA and AA master secret key mskAA. And it finally outputs system public parameter which is denoted by the union pp=ppKGC∪ppAA.(3)
Setupupp⟶pku,sku: with public parameter pp, the output of this algorithm (run by user) is the public key pku and master secret key sku of user.(4)
KeyGenKGCpp,mskKGC,pku,S,ID⟶skS,IDKGC: with public parameter pp, KGC master key mskKGC, user public key pku together with his/her attribute set S and id label ID, this algorithm (run by KGC) produces the partial decryption key skS,IDKGC.(5)
KeyGenAApp,mskAA,skS,IDKGC,S,ID⟶skS,IDAA: with public parameter pp, AA master key mskAA, partial decryption key skS,IDKGC, the user’s attribute set S and id label ID, this algorithm (run by AA) produces the final decryption key skS,IDAA.(6)
KeyGenuskS,IDAA⟶tkS,ID: with final decryption key skS,IDAA, the output of this algorithm (run by user) is the user transformation key tkS,ID.(7)
Encryptpp,A⟶KDU,ctA: with public parameter pp and the LSSS access structure A chosen by DO, this algorithm (run by user) produces the encapsulated key KDU which is further used for generation of DEM ciphertext and outputs KEM ciphertext ctA.(8)
KeySanityCheckpp,tkS,ID⟶1/0: with public parameter pp and user transformation key tkS,ID, this algorithm (run by BC) checks whether the key is well-formed and used by its owner. If it passes, this algorithm will output 1. Otherwise, it outputs 0.(9)
DecryptBCpp,ctA,tkS,ID⟶pct/⊥: with public parameter pp, user transformation key tkS,ID, and KEM ciphertext ctA, this algorithm (run by chaincode invoked by DU) produces the transformed ciphertext pct if the tkS,ID passes KeySanityCheck and access structure A embedded in it satisfies the given access policy. Otherwise, it outputs ⊥.(10)
DecryptDUpct,sku⟶key: with the transformed ciphertext pct together with user master secret key sku, this algorithm (run by user) finally produces the encapsulated key key for decrypting DEM ciphertext.


## 4.4. Security Model

LetΣ=SetupKGC, SetupAA, Setupu, KeyGenKGC, KeyGenAA, KeyGenu, Encrypt, KeySanityCheck, DecryptBC, DecryptDU denote our LU-MAABE-OD scheme. To concretely define the security notion of Σ, specific security requirements should be satisfied which can be described as the following security games.Definition 3.
(RCCA-secure ABE with outsourcing [13]). A CP-ABE scheme with outsourcing is RCCA-secure if any PPT adversary A can win the RCCA game defined as follows with at most negligible advantage.(i)
CPA security: it is defined that a scheme is CPA-secure, namely, secure against chosen-plaintext attacks if A cannot make decryption queries.(ii)
Selective security: it is defined that a scheme can achieve selective security if an Init stage is added before Setup where A commits to the challenge A∗.
RCCA-secure game for malicious DU which is similar to scheme [10]: in our LU-MAABE-OD scheme, the security model of RCCA security game can be denoted by GameΣ,ARCCA, in which the adversary A interacts with the challenger C.(1)
Setup: C executes algorithm SetupKGC and SetupAA, then pp is forwarded to A.(2)
QueryPhase-1: C initializes an integer counter j=0, an empty table T, and a set D. C answers the following queries from A:(i)
Create(S): C sets j:=j+1 and then executes Setupu to achieve a user master secret key sku and public key pku. It then runs KeyGenKGC on attribute-identity pairs S,ID to fetch the intermediate decryption key skS,IDKGC. It also executes KeyGenAA on skS,ID to fetch the final decryption key skS,IDAA (can also be denoted by skS,ID). Afterwards, KeyGenu on skS,ID is run to fetch the user transformation key tkS,ID. Eventually, the entry j,S,ID,skS,ID,tkS,ID,pku,sku is stored in T.(ii)
Corrupt.SK(i): C checks whether the i-th entry i,S,ID,skS,ID,pku,sku is in T. If such an entry exists, D:=D∪S,ID and skS,ID,pku,sku is returned to A , or ⊥ is output.(iii)
Corrupt.TK(i): C checks whether the i-th entry i,S,ID,tkS,ID is in T. If such an entry exists, tkS,ID will be returned to A, or ⊥ is output.(iv)
Decrypt(i,ct): C checks whether the i-th entry i,S,ID,skS,ID is in T. If there is such an entry, it then returns the decryption on ct, or it will output ⊥.(3)
Challenge: a challenge value A∗ is submitted by A, which has the restriction that S does not satisfy A∗. C then executes Encrypt to achieve ciphertexts ctA∗,KDU∗, and then a random bit b∈0,1 is selected. If b=0, ctA∗,KDU∗ is returned, or a random key KR∗ is chosen in the encapsulated key space and it returns ctA∗,KR∗ if b=1.(4)
QueryPhase-2: the same as QueryPhase-1 except it should satisfy the restrictions that neither can A issue a Corrupt query nor A can make a Decrypt query on ctA∗,KDU∗.(5)
Guess: A outputs a guess b∈0,1 of b. It is defined that A wins the game GameΣ,ARCCA if b′=b.Definition 4.
The LU-MAABE-OD is RCCA-secure if any PPT adversary can win the above gameGameΣ,ARCCA with at most a negligible advantage.Key Sanity Check Game. In our LU-MAABE-OD scheme, the security model of key sanity check game is similar to scheme [11] and can be denoted by GameΣ,AKSC, in which the adversary A interacts with the challenger C.(1)
C invokes A to run algorithm SetupKGC and SetupAA to produce the system parameter pp, the master secret key of KGC mskKGC, and AA mskAA.(2)
A returns pp, a ciphertext ct together with two distinct transformation keys tkS,ID1 and tkS,ID2 which are associated with the same attribute-identity label S,ID.(3)
It is defined thatA wins GameΣ,AKSC if the following requirements are satisfied:(i)
Checkpp,tkS,IDi=1,i=1,2, which indicates that both of transformation keys can pass the key sanity check.(ii)
Decpp,ct,tkS,IDi≠⊥,i=1,2, which indicates that both of transformation keys can be used to decrypt the ciphertext.(iii)
Decpp,ct,tkS,ID1≠Decpp,ct,tkS,ID2, which indicates that the results of decryption by two transformation keys are different.Definition 5.
LU-MAABE-OD is a scheme that can make key sanity check if any PPT adversaryA can win the above game GameΣ,AKSC with at most a negligible advantage.


## 5. LU-MAABE-OD Construction

### 5.1. Construction

Our LU-MAABE-OD scheme is based on the idea in [10, 11], and the detailed construction is described in Figure 2.Figure 2
Construction of our LU-MAABE-OD scheme.


### 5.2. Correctness

The correctness of our LU-MAABE-OD scheme is proved as described in Figure3.Figure 3
Correctness of our LU-MAABE-OD scheme.


### 5.3. Security Analysis

Theorem 1.
Assume that the CP-ABE scheme in [33] is selectively CPA-secure, and the proposed LU-MAABE-OD scheme is selectively CPA-secure with respect to Definition 4.Proof.
We simply denote the LU-MAABE-OD system proposed in Section1 by Σ=SetupKGC, SetupAA, Setupu, KeyGenKGC, KeyGenAA, KeyGenu, Encrypt, KeySanityCheck, DecryptBC, DecryptDU and the CP-ABE system in [33] by Σ′=Setup′, KeyGen′, Encrypt′, Decrypt′. To prove the security of Σ, we reduce the selective security of it to Σ′, which indicates that if there is an adversary A who can selectively break Σ with a non-negligible advantage ϵ, it can also be used to break Σ′. We build a PPT adversary A with a challenge access structure M∗,ρ∗ that can selectively break Σ with a non-negligible advantage ϵ and a PPT simulator algorithm ℬ that can selectively break Σ′ with a non-negligible advantage ϵ. In the system, challenger of Σ′ is denoted by C.(1)
Init: ℬ receives a challenge access structure M∗,ρ∗ selected by A and ℬ sends it to C.(2)
Setup: after obtaining M∗,ρ∗, C generates public parameter pp=D,g,h,u,v,w,eg,gα in which D=p,G,GT,e and then sends it to ℬ. Once received, ℬ chooses α′,β∈ℤp at random and sets ppKGC=D,h,u,v,w,gβ,eg,gα′, mskKGC=α′,β, ppAA=eg,gα, mskAA=α/α′.(3)
QueryPhase-1: ℬ initializes an integer counter j=0, an empty table T, and then answers the queries from A as follows:(i)
Create(S): A with an attribute-identity set S,ID issues the decryption key query. When receiving, ℬ forwards S,ID to C and obtains a secret key skS,ID′=K0′=gαwr,K1′=gr,Kτ,2′=grτ,Kτ,3′=uAτhrτv−rτ∈S. Next, ℬ randomly chooses du′∈ℤp and computes Pu=gdu′. To formalize, the user public key is set as pku=Pu while user master key is sku=du′. Then, ℬ computes K0=K0′du′/β+ℋID, K1=K1′du′/β+ℋID, K2=K1β, K3=eg,gαdu′, Kτ,1=Kτ,2′du′,Kτ,2=Kτ,3′du′τ∈S. Let r∗=r⋅du′/β+ℋID, rτ∗=rτ⋅du′, and then r∗,rτ∗ are random numbers due to the randomness of r,rτ, respectively. Therefore, skS,ID=K0=Puα/β+ℋIDwr∗,K1=gr∗,K2=gr∗β,K3=eg,Puα,Kτ,1=grτ∗,Kτ,2=uAτhrτ∗v−r∗β+ℋIDτ∈S∗ inherits the randomness. It sets the transformation key tkS,ID=skS,ID and the entry j,S,ID,skS,ID,tkS,ID,pku,sku is stored in T.(ii)
Corrupt.SK(i): ℬ checks whether the i-th entry i,S,ID,skS,ID,pku,sku is in table T. It then returns skS,ID,pku,sku to A, or ⊥ if there is no such entry.(iii)
Corrupt.TK(i): ℬ checks whether the i-th entry i,S,ID,tkS,ID is in table T. It then returns tkS,ID to A, or ⊥ if there is no such entry.(4)
Challenge: A declares two messages m0,m1 of the same length which are forwarded to ℬ. Then, they are sent to C by ℬ and achieve a challenge ciphertext ct∗=M∗,ρ∗,C∗,C0∗,Cτ,1∗,Cτ,2∗,Cτ,3∗τ∈l. Then, ℬ selects a random bit bℬ∈0,1 to calculate keybℬ=C∗/mbℬ and returns to A the new challenge ciphertext ct=M,ρ,keybℬ,C0=C0∗,C1=C0∗β,Cτ,1=Cτ,1∗,Cτ,2=Cτ,2∗,Cτ,3=Cτ,3∗τ∈l.(5)
QueryPhase-2: the same as QueryPhase-1.(6)
Guess: A outputs a guess bit bA∈0,1. If bA=1, it denotes that keybℬ is a random key and ℬ outputs 1−bℬ. Otherwise, it means that keybℬ is guessed as the key encapsulated by ct and ℬ outputs bℬ.
Obviously, ifA can selectively break our scheme Σ with a non-negligible advantage ϵ, ℬ can also selectively break scheme Σ′ with the same advantage.Theorem 2.
In our LU-MAABE-OD scheme, the advantage of any PPT adversary winning in the key sanity check gameGameΣ,AKSC is negligible.Proof.
It is similar to the proof in [11]. We build a PPT adversary A in our LU-MAABE-OD scheme, which can be denoted by Σ. It produces the public parameter pp, a ciphertext ct, and two different transformation keys tkS,IDi=S,L,K1i,K2i,K3i,K4i,Kτ,1i,Kτ,2iτ∈S, i=1,2. A wins the game GameΣ,AKSC only if the following three requirements are all satisfied.(i)
Checkpp,tkS,IDi=1,i=1,2.(ii)
Decpp,ct,tkS,IDi≠⊥,i=1,2.(iii)
Decpp,ct,tkS,ID1≠Decpp,ct,tkS,ID2.
Based on the first condition, we have fori=1,2, it satisfies.(i)
K0,K1,K2,Kτ,1,Kτ,2∈G,K3∈GT.(ii)
eK0,gβgL=ew,K1L⋅ew,K2⋅K3.
Based on the second condition, we have fori=1,2, there is(3)Bi=eC0LC1,K0i∏j∈leCj,1,K1iLK2ieCj,2,Kρj,1ieCj,3,Kρj,2iωj.
Therefore, we will finally achieveB1=B2=eg,gα′sμ, from which we can calculate that.(i)
Decpp,ct,tkS,ID1=C/B1.(ii)
Decpp,ct,tkS,ID2=C/B2.
It is obvious that the respective decryption result is the same which contradicts with the last condition. Thus, the advantage thatA can win the game GameΣ,AKSC is negligible.Theorem 3.
In our LU-MAABE-OD scheme, semi-honest KGC or AA cannot recover the underlying encrypted data and secret key of DU since they are not allowed to collude with each other.Proof.
SupposeA is a PPT adversary who is curious about obtaining the encapsulated key KDU=eg,gα′sμ and DU’s private key sku=du.(i)
For DU’s private key,A can easily obtain the public parameter pp and DU’s private key message sk=eg,Puα′,eg,Puα′μ. To obtain DU’s secret key du, either a semi-honest KGC or a semi-honest AA as A is required to solve discrete logarithm problems of computing logeg,ga′eg,puα′ or loggpu, which are considered to be impossible for any PPT adversary. Therefore, any semi-honest KGC or AA cannot illegally obtain DU’s secret key.(ii)
For the encapsulated key,A can easily obtain the public parameter pp and ciphertext message ct′=gs related to calculating KDU. If A is a semi-honest KGC (who cannot collude with AA), with the master secret key α′, A can easily calculate egα′,gs=eg,gα′s. To obtainKDU,at least one of DU’s secret key du(which has been proved difficult for PPT adversaryA to achieve), AA’s secret key μ and random secret information s should be obtained; otherwise, KGC can never decrypt KDU due to the discrete logarithm problem of computing logggs or logeg,gα′eg,gα′μ. If A is a semi-honest AA (who cannot collude with KGC), similarly, it is required to obtain α′ or s or du; otherwise, A is required to handle the discrete logarithm problem of computing logggs or logeg,gμeg,gα′μ. In a word, any semi-honest KGC or AA cannot illegally obtain encapsulated key.Lemma 1.
In our LU-MAABE-OD system, any PPT adversary cannot abuse public or leaked transformation key which is not owned by him/her.Proof.
Suppose there exists a PPT adversaryA (with his/her identity ID′) who wants to abuse public (since the transformation key will be publicly recorded after it is used through BC) or leaked transformation key which is not owned by him/her. It is noted that due to our sophisticated design, chaincode invoked by A will make a check before decryption. If ℋID in the transformation key does not satisfy ℋID=ℋID′, chaincode will reject to provide decryption services and produce ⊥. Otherwise, it will make a key sanity check to validate whether the transformation key is well-formed. If it passes, A can make a decryption through chaincode, or it will be rejected. According to Theorem 2, A can only win the game GameΣ,AKSC with a negligible advantage, and thus A cannot abuse public or leaked transformation key which is not owned by him/her.


## 5.1. Construction

Our LU-MAABE-OD scheme is based on the idea in [10, 11], and the detailed construction is described in Figure 2.Figure 2
Construction of our LU-MAABE-OD scheme.


## 5.2. Correctness

The correctness of our LU-MAABE-OD scheme is proved as described in Figure3.Figure 3
Correctness of our LU-MAABE-OD scheme.


## 5.3. Security Analysis

Theorem 1.
Assume that the CP-ABE scheme in [33] is selectively CPA-secure, and the proposed LU-MAABE-OD scheme is selectively CPA-secure with respect to Definition 4.Proof.
We simply denote the LU-MAABE-OD system proposed in Section1 by Σ=SetupKGC, SetupAA, Setupu, KeyGenKGC, KeyGenAA, KeyGenu, Encrypt, KeySanityCheck, DecryptBC, DecryptDU and the CP-ABE system in [33] by Σ′=Setup′, KeyGen′, Encrypt′, Decrypt′. To prove the security of Σ, we reduce the selective security of it to Σ′, which indicates that if there is an adversary A who can selectively break Σ with a non-negligible advantage ϵ, it can also be used to break Σ′. We build a PPT adversary A with a challenge access structure M∗,ρ∗ that can selectively break Σ with a non-negligible advantage ϵ and a PPT simulator algorithm ℬ that can selectively break Σ′ with a non-negligible advantage ϵ. In the system, challenger of Σ′ is denoted by C.(1)
Init: ℬ receives a challenge access structure M∗,ρ∗ selected by A and ℬ sends it to C.(2)
Setup: after obtaining M∗,ρ∗, C generates public parameter pp=D,g,h,u,v,w,eg,gα in which D=p,G,GT,e and then sends it to ℬ. Once received, ℬ chooses α′,β∈ℤp at random and sets ppKGC=D,h,u,v,w,gβ,eg,gα′, mskKGC=α′,β, ppAA=eg,gα, mskAA=α/α′.(3)
QueryPhase-1: ℬ initializes an integer counter j=0, an empty table T, and then answers the queries from A as follows:(i)
Create(S): A with an attribute-identity set S,ID issues the decryption key query. When receiving, ℬ forwards S,ID to C and obtains a secret key skS,ID′=K0′=gαwr,K1′=gr,Kτ,2′=grτ,Kτ,3′=uAτhrτv−rτ∈S. Next, ℬ randomly chooses du′∈ℤp and computes Pu=gdu′. To formalize, the user public key is set as pku=Pu while user master key is sku=du′. Then, ℬ computes K0=K0′du′/β+ℋID, K1=K1′du′/β+ℋID, K2=K1β, K3=eg,gαdu′, Kτ,1=Kτ,2′du′,Kτ,2=Kτ,3′du′τ∈S. Let r∗=r⋅du′/β+ℋID, rτ∗=rτ⋅du′, and then r∗,rτ∗ are random numbers due to the randomness of r,rτ, respectively. Therefore, skS,ID=K0=Puα/β+ℋIDwr∗,K1=gr∗,K2=gr∗β,K3=eg,Puα,Kτ,1=grτ∗,Kτ,2=uAτhrτ∗v−r∗β+ℋIDτ∈S∗ inherits the randomness. It sets the transformation key tkS,ID=skS,ID and the entry j,S,ID,skS,ID,tkS,ID,pku,sku is stored in T.(ii)
Corrupt.SK(i): ℬ checks whether the i-th entry i,S,ID,skS,ID,pku,sku is in table T. It then returns skS,ID,pku,sku to A, or ⊥ if there is no such entry.(iii)
Corrupt.TK(i): ℬ checks whether the i-th entry i,S,ID,tkS,ID is in table T. It then returns tkS,ID to A, or ⊥ if there is no such entry.(4)
Challenge: A declares two messages m0,m1 of the same length which are forwarded to ℬ. Then, they are sent to C by ℬ and achieve a challenge ciphertext ct∗=M∗,ρ∗,C∗,C0∗,Cτ,1∗,Cτ,2∗,Cτ,3∗τ∈l. Then, ℬ selects a random bit bℬ∈0,1 to calculate keybℬ=C∗/mbℬ and returns to A the new challenge ciphertext ct=M,ρ,keybℬ,C0=C0∗,C1=C0∗β,Cτ,1=Cτ,1∗,Cτ,2=Cτ,2∗,Cτ,3=Cτ,3∗τ∈l.(5)
QueryPhase-2: the same as QueryPhase-1.(6)
Guess: A outputs a guess bit bA∈0,1. If bA=1, it denotes that keybℬ is a random key and ℬ outputs 1−bℬ. Otherwise, it means that keybℬ is guessed as the key encapsulated by ct and ℬ outputs bℬ.
Obviously, ifA can selectively break our scheme Σ with a non-negligible advantage ϵ, ℬ can also selectively break scheme Σ′ with the same advantage.Theorem 2.
In our LU-MAABE-OD scheme, the advantage of any PPT adversary winning in the key sanity check gameGameΣ,AKSC is negligible.Proof.
It is similar to the proof in [11]. We build a PPT adversary A in our LU-MAABE-OD scheme, which can be denoted by Σ. It produces the public parameter pp, a ciphertext ct, and two different transformation keys tkS,IDi=S,L,K1i,K2i,K3i,K4i,Kτ,1i,Kτ,2iτ∈S, i=1,2. A wins the game GameΣ,AKSC only if the following three requirements are all satisfied.(i)
Checkpp,tkS,IDi=1,i=1,2.(ii)
Decpp,ct,tkS,IDi≠⊥,i=1,2.(iii)
Decpp,ct,tkS,ID1≠Decpp,ct,tkS,ID2.
Based on the first condition, we have fori=1,2, it satisfies.(i)
K0,K1,K2,Kτ,1,Kτ,2∈G,K3∈GT.(ii)
eK0,gβgL=ew,K1L⋅ew,K2⋅K3.
Based on the second condition, we have fori=1,2, there is(3)Bi=eC0LC1,K0i∏j∈leCj,1,K1iLK2ieCj,2,Kρj,1ieCj,3,Kρj,2iωj.
Therefore, we will finally achieveB1=B2=eg,gα′sμ, from which we can calculate that.(i)
Decpp,ct,tkS,ID1=C/B1.(ii)
Decpp,ct,tkS,ID2=C/B2.
It is obvious that the respective decryption result is the same which contradicts with the last condition. Thus, the advantage thatA can win the game GameΣ,AKSC is negligible.Theorem 3.
In our LU-MAABE-OD scheme, semi-honest KGC or AA cannot recover the underlying encrypted data and secret key of DU since they are not allowed to collude with each other.Proof.
SupposeA is a PPT adversary who is curious about obtaining the encapsulated key KDU=eg,gα′sμ and DU’s private key sku=du.(i)
For DU’s private key,A can easily obtain the public parameter pp and DU’s private key message sk=eg,Puα′,eg,Puα′μ. To obtain DU’s secret key du, either a semi-honest KGC or a semi-honest AA as A is required to solve discrete logarithm problems of computing logeg,ga′eg,puα′ or loggpu, which are considered to be impossible for any PPT adversary. Therefore, any semi-honest KGC or AA cannot illegally obtain DU’s secret key.(ii)
For the encapsulated key,A can easily obtain the public parameter pp and ciphertext message ct′=gs related to calculating KDU. If A is a semi-honest KGC (who cannot collude with AA), with the master secret key α′, A can easily calculate egα′,gs=eg,gα′s. To obtainKDU,at least one of DU’s secret key du(which has been proved difficult for PPT adversaryA to achieve), AA’s secret key μ and random secret information s should be obtained; otherwise, KGC can never decrypt KDU due to the discrete logarithm problem of computing logggs or logeg,gα′eg,gα′μ. If A is a semi-honest AA (who cannot collude with KGC), similarly, it is required to obtain α′ or s or du; otherwise, A is required to handle the discrete logarithm problem of computing logggs or logeg,gμeg,gα′μ. In a word, any semi-honest KGC or AA cannot illegally obtain encapsulated key.Lemma 1.
In our LU-MAABE-OD system, any PPT adversary cannot abuse public or leaked transformation key which is not owned by him/her.Proof.
Suppose there exists a PPT adversaryA (with his/her identity ID′) who wants to abuse public (since the transformation key will be publicly recorded after it is used through BC) or leaked transformation key which is not owned by him/her. It is noted that due to our sophisticated design, chaincode invoked by A will make a check before decryption. If ℋID in the transformation key does not satisfy ℋID=ℋID′, chaincode will reject to provide decryption services and produce ⊥. Otherwise, it will make a key sanity check to validate whether the transformation key is well-formed. If it passes, A can make a decryption through chaincode, or it will be rejected. According to Theorem 2, A can only win the game GameΣ,AKSC with a negligible advantage, and thus A cannot abuse public or leaked transformation key which is not owned by him/her.


## 6. System Analysis

In this section, we will evaluate the practical performance and the challenges brought by blockchain system in our scheme.


### 6.1. Performance Evaluations

We evaluated the performance of our scheme and made a comparison with three other existing schemes [10–12] in terms of overheads of the following stages: Setup, KeyGen, Encrypt, and Decrypt. It should be noted that we evaluated all the costs in the former three stages while only the user decryption time was evaluated in the last stage.We implemented our LU-MAABE-OD scheme in software based on Charm [40] (Version 0.50). To make a comparison, we also implemented the scheme in [10–12] and MNT224 elliptic curve is applied. All the experiments were executed on a computer equipped with 2.4 GHz Intel Core i5 with 8 GB of RAM running MacOS Mojave 10.14.6 and Python3. By increasing number of policy attributes from 1 to 100, we compared the total running time in stage of Setup, KeyGen, Encrypt, and Decrypt. For accuracy, we repeated 50 times for each scheme and the average was taken as the results in our figures and the time is all given in seconds.As shown in Figure4, we examine the time cost of Setup, from which we can find the overhead in [12] is linear to the attribute universe while that of our scheme and [10, 11] is constant. As the introduction of two authorities, costs in our scheme and in [11] are 0.02 s higher than those in [10] on average. Figure 5 shows the cost of KeyGen, from which we can follow that our scheme costs much more than [10, 12] for the reason of key blindness by two authorities, which will unavoidably increase considerable overheads. However, compared with another multi-authority scheme in [11], our scheme improves the efficiency of nearly 2.8 s on average when the user attribute size is 100. From Figure 6 which tests the cost of Encrypt, it is shown that scheme in [10, 11] and our scheme achieve nearly the same encryption efficiency while scheme in [12] is around 2.6 s faster on average when the policy attribute size is 100 owing to the low-paid small-universe construction of access tree. Figure 7 displays the Decrypt cost in user side, which only costs a constant time of 0.004 s on average in our scheme because most of cost is taken by blockchain. Despite the use of outsourced decryption, scheme in [10] can also achieve constant decryption cost, but it is about 0.013 s lower than that of our scheme as the verification of decryption result from cloud is needed while it is unnecessary in our scheme. It is noted that although blockchain-assisted decryption is adopted in scheme [21], heavy computation is still required for users which is linear to the attribute size and in scheme [11], the whole decryption task is taken by users so that huge overheads will be put on the user side. As a result, our scheme achieves higher security compared with [10, 12] while efficiency on KeyGen and Encrypt has been sacrificed; however, the high performance of Decrypt is realized so that our scheme is made especially applicable for resource-constrained data users. Besides, with the same high security, our scheme performs better than scheme in [11] in terms of overall overheads.Figure 4
The Setup cost in NCD + 17, ZZP + 20, WCY21, and our scheme.Figure 5
The KeyGen cost in NCD + 17, ZZP + 20, WCY21, and our scheme.Figure 6
The Encrypt cost in NCD + 17, ZZP + 20, WCY21, and our scheme.Figure 7
The Decrypt cost in NCD + 17, ZZP + 20, WCY21, and our scheme.


### 6.2. Blockchain Analysis

As mentioned above, our system implementation is based on blockchain, and the IPFS data storage and partial decryption by smart contracts/chaincodes are the keys to solve on-chain storage burden and user computing overheads in traditional schemes. Therefore, we need to consider some problems that may be brought by the introduction of blockchain platform. In terms of public blockchain like Ethereum, resource-limited DU can ask blockchain to make outsourced decryption and the execution cost of smart contracts needs to be paid by DU for the help of decryption. However, due to the technique problem that smart contract cannot well support pairing operations in ABE currently, it is not recommended to be deployed in Ethereum until the related language library (i.e., Solidity) is introduced. Besides, regular problems like network congestion remains to be further discussed. In terms of permissioned blockchain like Hyperledger, it can be deployed in scenarios like healthcare and IoT data sharing, in which the system is maintained by a number of authorized nodes (i.e., data center managers). Since the key received by chaincode is just the transformation key which can be public and the final secret key to decrypt is always kept by DU themselves, the underlying data will also never be achieved illegally by those nodes. Besides, even if these nodes can collude with one of AA and KGC, according to the analysis of Theorem3, as long as AA and KGC do not collude with each other, the underlying data and the user’s secret key will not be disclosed, and thus the collusion between the node and AA/KGC will not affect the security. Therefore, under the assumption of this article mentioned in Section 2, the system is still secure.


## 6.1. Performance Evaluations

We evaluated the performance of our scheme and made a comparison with three other existing schemes [10–12] in terms of overheads of the following stages: Setup, KeyGen, Encrypt, and Decrypt. It should be noted that we evaluated all the costs in the former three stages while only the user decryption time was evaluated in the last stage.We implemented our LU-MAABE-OD scheme in software based on Charm [40] (Version 0.50). To make a comparison, we also implemented the scheme in [10–12] and MNT224 elliptic curve is applied. All the experiments were executed on a computer equipped with 2.4 GHz Intel Core i5 with 8 GB of RAM running MacOS Mojave 10.14.6 and Python3. By increasing number of policy attributes from 1 to 100, we compared the total running time in stage of Setup, KeyGen, Encrypt, and Decrypt. For accuracy, we repeated 50 times for each scheme and the average was taken as the results in our figures and the time is all given in seconds.As shown in Figure4, we examine the time cost of Setup, from which we can find the overhead in [12] is linear to the attribute universe while that of our scheme and [10, 11] is constant. As the introduction of two authorities, costs in our scheme and in [11] are 0.02 s higher than those in [10] on average. Figure 5 shows the cost of KeyGen, from which we can follow that our scheme costs much more than [10, 12] for the reason of key blindness by two authorities, which will unavoidably increase considerable overheads. However, compared with another multi-authority scheme in [11], our scheme improves the efficiency of nearly 2.8 s on average when the user attribute size is 100. From Figure 6 which tests the cost of Encrypt, it is shown that scheme in [10, 11] and our scheme achieve nearly the same encryption efficiency while scheme in [12] is around 2.6 s faster on average when the policy attribute size is 100 owing to the low-paid small-universe construction of access tree. Figure 7 displays the Decrypt cost in user side, which only costs a constant time of 0.004 s on average in our scheme because most of cost is taken by blockchain. Despite the use of outsourced decryption, scheme in [10] can also achieve constant decryption cost, but it is about 0.013 s lower than that of our scheme as the verification of decryption result from cloud is needed while it is unnecessary in our scheme. It is noted that although blockchain-assisted decryption is adopted in scheme [21], heavy computation is still required for users which is linear to the attribute size and in scheme [11], the whole decryption task is taken by users so that huge overheads will be put on the user side. As a result, our scheme achieves higher security compared with [10, 12] while efficiency on KeyGen and Encrypt has been sacrificed; however, the high performance of Decrypt is realized so that our scheme is made especially applicable for resource-constrained data users. Besides, with the same high security, our scheme performs better than scheme in [11] in terms of overall overheads.Figure 4
The Setup cost in NCD + 17, ZZP + 20, WCY21, and our scheme.Figure 5
The KeyGen cost in NCD + 17, ZZP + 20, WCY21, and our scheme.Figure 6
The Encrypt cost in NCD + 17, ZZP + 20, WCY21, and our scheme.Figure 7
The Decrypt cost in NCD + 17, ZZP + 20, WCY21, and our scheme.


## 6.2. Blockchain Analysis

As mentioned above, our system implementation is based on blockchain, and the IPFS data storage and partial decryption by smart contracts/chaincodes are the keys to solve on-chain storage burden and user computing overheads in traditional schemes. Therefore, we need to consider some problems that may be brought by the introduction of blockchain platform. In terms of public blockchain like Ethereum, resource-limited DU can ask blockchain to make outsourced decryption and the execution cost of smart contracts needs to be paid by DU for the help of decryption. However, due to the technique problem that smart contract cannot well support pairing operations in ABE currently, it is not recommended to be deployed in Ethereum until the related language library (i.e., Solidity) is introduced. Besides, regular problems like network congestion remains to be further discussed. In terms of permissioned blockchain like Hyperledger, it can be deployed in scenarios like healthcare and IoT data sharing, in which the system is maintained by a number of authorized nodes (i.e., data center managers). Since the key received by chaincode is just the transformation key which can be public and the final secret key to decrypt is always kept by DU themselves, the underlying data will also never be achieved illegally by those nodes. Besides, even if these nodes can collude with one of AA and KGC, according to the analysis of Theorem3, as long as AA and KGC do not collude with each other, the underlying data and the user’s secret key will not be disclosed, and thus the collusion between the node and AA/KGC will not affect the security. Therefore, under the assumption of this article mentioned in Section 2, the system is still secure.


## 7. Conclusion

In this paper, an efficient large-universe multi-authority CP-ABE scheme with blockchain-assisted outsourced decryption (LU-MAABE-OD) for data sharing system is proposed. In particular, we extended the basic outsourced scheme based on [10] and introduced two authorities (namely, KGC and AA) to avoid key escrow problem which was ignored in [10] while key leakage resilience was reserved. Then, the technique of blockchain and IPFS was applied to be responsible for outsourced decryption and data storage, solving the issue of malicious decryption in traditional cloud computation scenarios and storage burden on chain, respectively. As of independent interest, our scheme was also key abuse resistant due to the key owner and key sanity check through chaincode on blockchain. Furthermore, we evaluated the performance and discussed the security of our LU-MAABE-OD scheme. As a result, our scheme achieved higher security at the expense of some efficiency. However, LU-MAABE-OD was user-friendly in terms of the most lightweight user decryption cost, which was especially needed for resource-limited data users. For the future work, we think it is promising to explore more significant functions like attribute revocation, user revocation, and policy hiding and devote to promoting overall efficiency in such blockchain-based access control and data sharing system.



---

*Source: 4978802-2022-09-30.xml*