# A Secure Multimedia Data Sharing Scheme for Wireless Network

Authors: Liming Fang; Liang Liu; Jinyue Xia; Maosheng Sun
Journal: Security and Communication Networks
 (2018)

---

## Abstract

A large number of wireless devices like WiFi cameras and 4G robots have been deployed in the rapidly growing wireless network such as Internet of Things. All of the devices (sensors) are collecting and analyzing multimedia data all the time while they are actively working, and it is also required to share data among these the sensors. Typically, the wireless data is transmitted through the network gateway or the cloud platforms. In such a wireless environment, if there is no appropriate protection to the data, it is easy to cause potential data leakage. In reality, the owner of the sensor might only want to share the multimedia data stored in the sensor with a trusted third party (e.g., a family member or a coworker) through an internet gateway or the cloud platform. Ideally, the gateway or the cloud platform in the wireless network should transform one user’s encrypted data (wireless multimedia data) directly into another ciphertext under a set of new users (e.g., a trusted third party) without accessing the user’s plaintext data. In this work, a new secure notion called fuzzy-conditional proxy broadcast re-encryption (FC-PBRE) is presented to address the concern. In a FC-PBRE scheme, the proxy (the gateway or cloud server) uses a broadcast re-encryption key to re-encrypt the encrypted wireless multimedia data which can be decrypted by a set of delegatees if and only if the broadcast key’s conditional setW is close to the conditional set W′ of the ciphertext. With the FC-PBRE scheme, the wireless multimedia data is not disclosed and cannot be learnt by the proxy (the gateway or cloud server). In this paper, we first present the definition of security against chosen-ciphertext attacks for FC-PBRE. Second, we propose an efficient fuzzy-conditional proxy broadcast re-encryption scheme. Third, we prove that our FC-PBRE scheme is CCA-secure in the random oracle model based on the Decisional nBDHE assumption.


---

## Body

## 1. Introduction

Generally, a user (can be an attacker) has the access to the data stored in the wireless devices via(1) a direct connection with the devices, (2) the gateway of the network, and (3) a cloud platform. Because many wireless devices need to localize the configuration before they start working, they usually have a backend configuration interface (e.g., WEB, PC) open. Moreover the devices sometimes go offline even when they are actively working. As a result, the attacker can simply hack the login system of the configuration interface and obtain the multimedia data. In this case, even though the device and the cloud have been authenticated and encrypted (e.g., using SSL), the attack cannot be prevented. So, ensuring the multimedia data to be stored and shared securely has become extremely important [1–8]. To share the data partially, it would be good if all the multimedia data are encrypted via the data owner’s public key. For example, the device owner can give the data permission of the wireless camera configuration to the maintenance engineer, but the maintenance is not allowed to access to the video data. Obviously, such a scheme cannot allow sharing the private key directly with the maintenance engineer because sharing the private key means exposing the data to the engineer.One approach to ensure data confidentiality in the wireless network is that user data can be encrypted before it is updated into the server. The encryption technology is an effective way to protect user data; however it does have some drawbacks. For example, when a cloud user Alice shares her data with another user Bob, her encrypted data cannot be as the plain data and cloud servers should not be directly transmitted to the shared user’s ciphertext, because users (including Bob) cannot decrypt the received data. Of course, one easy way for Alice to fix this issue is to download her own encrypted data that is saved in the cloud, then decrypt and upload the decrypted data to the cloud again, and finally send it to Bob who Alice wants to share the data. However, using this method, the user’s data will be obtained by the untrusted third-party cloud, which cannot guarantee the data confidentiality. Therefore, in the cloud storage environment, a security mechanism is needed to allow the cloud server to transform the encrypted data of users directly into another shared user’s encrypted data without accessing the user’s plaintext data.Since the data security problem of users in the nontrusted third-party cloud server is increasingly prominent and traditional encryption technology has been unable to meet these application needs, the cloud server really should be able to convert a user’s ciphertext to a second’s user ciphertext on the basis of not involving decryption. There have been quite a few researches done in this area to address this concern. For example, proxy re-encryption [9] can directly transfer encrypted data of a user Alice, stored in a nontrusted third-party cloud under the authorization of Alice, into user Bob’s ciphertext, so as to achieve data sharing of Alice and Bob. Because of this feature, proxy re-encryption has been applied in IoT, cloud computing, email forwarding systems [9], and distributed file systems [10]. In proxy re-encryption, the third party can convert all Alice’s ciphertexts into Bob’s ciphertext, but in many applications, Alice hopes that the third party can only transform some specific conditions of ciphertext instead of all ciphertext. For example, the owners of wireless devices might only want to share part of the encrypted multimedia data instead of sharing all the data with a group of other users. To achieve that goal, conditional proxy re-encryption was proposed to provide such a mechanism that allows Alice to freely determine which encrypted data needs to be shared with Bob [11]. The third party in the conditional proxy re-encryption scheme has the ability to convert a ciphertext only if it meets certain specific conditions.For applications like group photo sharing, however, conditional proxy re-encryption scheme becomes a problem if one person’s multimedia needs to be shared with a group of users via a cloud platform. For example, in a scenario of a picture’s owner (Alice) who wishes to share the encrypted photo data with the family members, the cloud cannot directly forward the owner Alice’s encrypted data of camera to a group of family members, since only Alice has the private key to decrypt after forwarding. Although conditional proxy re-encryption can convert Alice’s ciphertext into a different ciphertext, only the one person can decrypt the ciphertext, not a group of people to decrypt. Thus it cannot be adapted to the situation of group data sharing. Recently, the conditional proxy broadcast re-encryption(C-PBRE) was presented [12] to resolve the issue. In a C-PBRE scheme, a user’s ciphertext can be transformed to another ciphertext for a group of users by a third party proxy. Moreover, the third-party proxy can only convert ciphertext with specific conditions.Although the C-PBRE has addressed some concerns, still there is a flaw, which is that the C-PBRE scheme cannot support fuzzy condition matching. Here, we give an example of an online medical service system to show the importance of fuzzy condition matching and the fuzzy-conditional proxy broadcast re-encryption (FC-PBRE). Usually a multimedia electronic medical record is a system that tracks the electronic medical record of the patients. It integrates image, video, audio, and text and everything can be stored in the cloud at the same time. Doing so enables the medical staff to look up all medical records related to the patient such as an MRI or X-ray image from a PC or a smart phone. In order to protect patient privacy of multimedia electronic medical records, we need to encrypt and protect relevant data. But how to implement the sharing of multimedia electronic medical records after encryption is a difficult problem and FC-PBRE comes to solve this problem. More specifically, in an online medical system, patients are more likely to find a doctor who meets the following requirements for the treatment of a cold. We can simply denote the requirements as follows:R1=(“Cold”∧“fever”∧“runnynose”∧“sorethroat”). With R1 a patient can encrypt her health record before she uploads it to the medical system. However, the medical system cannot directly access the disease record in this case, because it does not necessarily have a matching secret key under R1. What the system can do is re-encrypt the ciphertext so that other doctors may be able to see the case as long as these doctors meet at least d(d≤R1) conditions of R1. By adopting FC-PBRE, a doctor sets up a different access policy R2 and sends a re-encryption key rkR1 to the proxy. When a doctor is away, the proxy can re-encrypt the ciphertext if and only if R1∩R2≥d. However, in many situations Alice may want to cooperate with a set of colleagues satisfying R2 to consultation on the patient’s condition. In traditional FC-PRE, if Alice wants to consulate with N colleagues, the proxy needs to perform N re-encryption operations. The problem, though, is that the proxy’s computation is linear with N; this may not be desirable in terms of the complexity. In contrast, in FC-PBRE, the proxy can re-encrypte Alice’s ciphertext to a group of users at one time. As a result, an FC-PBRE scheme is likely to resolve this complexity problem.In the multimedia data sharing environment, it is needed to have a secure mechanism that allows the cloud server to transform one user’s encrypted data directly into another ciphertext under a set of new users without accessing the user’s plaintext data. In this paper, fuzzy-conditional proxy broadcast re-encryption (FC-PBRE) is proposed to address the concern. In FC-PBRE, the proxy uses a broadcast re-encryption key to re-encrypt a ciphertext which can be decrypted by a set of delegatees if and only if the broadcast key’s conditional setW is close to the conditional set W′ of the ciphertext. With the FC-PBRE scheme, the plaintext data is not disclosed and cannot be learnt by the proxy. The paper is structured as follows. First we introduce the security definition against chosen-ciphertext attacks for FC-PBRE. Second, our efficient fuzzy-conditional proxy broadcast re-encryption scheme is presented. Finally, we prove that our FC-PBRE scheme is CCA-secure in the random oracle model based on the Decisional nBDHE assumption.


## 2. Related Work

Proxy re-encryption [9] can directly transfer encrypted data of user Alice stored in nontrusted third-party cloud under the authorization of Alice into user Bob ciphertext, so as to achieve data sharing of Alice and Bob. But the third party can transform all Alice’s ciphertext into Bobs ciphertext in PRE scheme, but in many applications, Alice hopes that the third party can only transform some specific conditions of ciphertext instead of all ciphertext. In a C-PRE scheme [11], only the one ciphertext from Alice that meets certain specific conditions can be converted by third parties into a Bob’s ciphertext. Therefore, with conditional proxy re-encryption, Alice can determine which ciphertext for third parties to re-encrypt; thus a flexible control of the ciphertext can be observed. Weng et al. [11] proposed conditional proxy re-encryption scheme and they proved that it is chosen-ciphertext attack secure in the random oracle model. Similarly, Tang [13] proposed a type based proxy re-encryption scheme, a secure proxy re-encryption with keyword search scheme, and it is proven secure in the random oracle model [14]. On top of the keyword search scheme, an anonymous conditional proxy re-encryption with keyword search scheme was proposed by Fang et al. [15]. On the paper, they also proved that their scheme is chosen-ciphertext secure. Fang et al. [16] presented a fuzzy-conditional proxy re-encryption scheme and proved the security in the random oracle model. The scheme can support fuzzy matching between multiple keywords; that is, only some key words in the re-encryption key satisfy the matching, and the third party can complete the re-encryption.Without the random oracle, a conditional proxy re-encryption scheme [17] was proposed to support a more fine-grained access strategy under the standard model. Reference [18] designed an identity based proxy re-encryption mechanism for multiple hop (Multihop) under the standard model. In this scheme, the re-encrypt ciphertext can still be re-encrypted repeatedly, and the length of ciphertext does not increase with the number of re-encryptions. So the length of the ciphertext is constant.With regard to anonymity, Ateniese et al. [19] came out with the idea of anonymous proxy re-encryption and proved that their scheme is chosen plaintext attack security under the standard model. With anonymous proxy re-encryption, an attacker cannot obtain user’s identity from the key. Later, a new scheme was proposed to achieve the security of chosen-ciphertext attack with the random oracle [20]. Subsequently, Shao et al. improved the scheme by using the standard model for the security proof [21]. Followed by Shao et al.’s work, a security model is enhanced for anonymous proxy re-encryption [22]. In the security model of [22], it allows attackers to get re-encrypted queries directly, instead of obtaining re-encrypted query by acquiring re-encryption key query. Shao et al. [23] proposed an anonymous ID based proxy re-encryption to extend anonymous proxy re-encryption to identity based anonymous proxy re-encryption. Their scheme is proven secure in the random oracle model. An anonymous identity based multiuser identity based proxy re-encryption scheme was proven CCA-secure in the standard model [18]. The same literature also analyzed its application in privacy protection and data sharing in big data storage system. The above schemes are about proxy anonymous encryption with user identity anonymity. A keyword anonymity conditional proxy re-encryption scheme [24] was demonstrated to achieve the anonymity of conditions.


## 3. Preliminaries

### 3.1. Bilinear Map

G and GT denote two multiplicative cyclic groups with the same prime order p. g is a generator of group G. A bilinear pairing is a bilinear map e:G×G→GT with the following properties:(1)
e(Ua,Vb)=e(U,V)ab for all a,b←RZp∗ and U,V∈G.(2)
e(U,U)≠1.(3)
e(U,V) can be computed in polynomial time for all U,V∈G.


### 3.2. The n-BDHE Assumption

Ifp is a prime, let Zp denote the set {0,1,…,p-1} and Zp∗ denote the set {1,2,…,p-1}. Let e:G×G→GT be a bilinear map. Given 2n+1 elements (1)μ,ν,νγ,νγ2,…,νγn,νγn+2,…,νγ2n∈G2n+1and an element T∈GT, the adversary’s task is to decide if T=?e(μ,ν)γn+1.Denoteνγi as νi, and define the advantage of an adversary A as(2)AdvG,An-BDHE=PrAμ,ν,ν1,…,νn,νn+2,…,ν2n,eνn+1,μ=1-PrAμ,ν,ν1,…,νn,νn+2,…,ν2n,T=1where ν,μ∈G, γ∈Zp∗, and T∈GT are randomly chosen. We conclude that the n-BDHE assumption relative to (G,GT) holds [25], if AdvG,An-BDHE is negligible for all probability polynomial time (PPT) adversary A.


## 3.1. Bilinear Map

G and GT denote two multiplicative cyclic groups with the same prime order p. g is a generator of group G. A bilinear pairing is a bilinear map e:G×G→GT with the following properties:(1)
e(Ua,Vb)=e(U,V)ab for all a,b←RZp∗ and U,V∈G.(2)
e(U,U)≠1.(3)
e(U,V) can be computed in polynomial time for all U,V∈G.


## 3.2. The n-BDHE Assumption

Ifp is a prime, let Zp denote the set {0,1,…,p-1} and Zp∗ denote the set {1,2,…,p-1}. Let e:G×G→GT be a bilinear map. Given 2n+1 elements (1)μ,ν,νγ,νγ2,…,νγn,νγn+2,…,νγ2n∈G2n+1and an element T∈GT, the adversary’s task is to decide if T=?e(μ,ν)γn+1.Denoteνγi as νi, and define the advantage of an adversary A as(2)AdvG,An-BDHE=PrAμ,ν,ν1,…,νn,νn+2,…,ν2n,eνn+1,μ=1-PrAμ,ν,ν1,…,νn,νn+2,…,ν2n,T=1where ν,μ∈G, γ∈Zp∗, and T∈GT are randomly chosen. We conclude that the n-BDHE assumption relative to (G,GT) holds [25], if AdvG,An-BDHE is negligible for all probability polynomial time (PPT) adversary A.


## 4. FC-PBRE Model and Security Notion

Two security definitions for fuzzy-conditional proxy broadcast re-encryption as well as its model are introduced in this section.Definition 1 (FC-PBRE).
A (single-use) proxy broadcast re-encryption scheme runs the following algorithms:(i)
Setup(λ,n,d): in the setup step, for the input, λ is the security parameter, n is the maximum allowed number of users, and d is the threshold. The system at this step generates a public key PK and a master secret key MK.(ii)
KenGen(PK,MK,i): given the public key PK, the master key MK, and a user i, the system generates secret key ski for the user i.(iii)
Encrypt(PK,S,m,W): the Encrypt() algorithm takes the public key PK, a user sets S⊆{1,2,…,n}, a message m, and a set of keywords W as the input, it then outputs the ciphertext C for the user set S with condition set W.(iv)
ReKGen(PK,ski,S′,W′): on inputting PK, the user’s private key ski, a set of users (S′⊆{1,2,…,n}) and a keywords set W′, outputs the re-encryption key rkeyi,S′,W′.(v)
REnc(PK,rkeyi,S′,W′,i,S,S′,C): with the public key PK, a re-encryption key rkeyi,S′,W′, the user i, two different user sets S and S′, and the original ciphertext C, this algorithm computes the re-encrypted ciphertext CR. This step requires |W∩W′|≥d, where d is the threshold and if the condition cannot be met, an error symbol ⊥ will be output instead.(vi)
DecryptL2(PK,ski,i,S,C): DecryptL2 represents the decryption algorithm for the original ciphertext. It takes the public key PK, user i, the private key ski of the user i, a set of users S, and ciphertext C for user set S, and it outputs the plaintext m.(vii)
DecryptL1(PK,skj,i,j,S,S′,CR): DecryptL1 represents the re-encrypted ciphertext decryption algorithm. It outputs the plaintext m from the input of a public key, a user’s private key skj, users i, j, user sets S, S′, and a re-encrypted CR. If the algorithm aborts, it outputs ⊥.Correctness. The definition of the correctness of a FC-PBRE scheme is as follows; given two user sets S,S′, condition sets W,W′, C=Encrypt(PK,S,m,W), and rkeyi,S′,W′=ReKGen(PK,ski,S′,W′), then CR=REnc(PK,rkeyi,S′,W′,i,S,S′,C), if W∩W′≥dP r [ D e c c y p t L 2 ( P K , s k i , i , S , C ) = m ] = 1, if i∈S;P r [ D e c r y p t L 1 ( P K , s k j , i , j , S , S ′ , C R ) = m ] = 1, if j∈S′.The game-based model is used to define the security for the FC-PBRE scheme. Similar to a security model from [25], the CCA security of the FC-PBRE scheme is considered in the selective-set model. In such a model, the adversary is supposed to commit ahead the challenge user set S∗ and the condition set W∗.Definition 2 (IND-set-CCA game).
The following lists two games between one adversaryA and a challenger C.
Game 1 is to consider the security of the original ciphertexts. We define the IND-OR-CCA game as follows:(1)
Init. In the initial phase, the adversaryA selects a target users set S∗⊆{1,2,…,n} and the condition set W∗={ω1∗,ω2∗,…,ωn∗}.(2)
Setup. At this stage of the game, the challengerC runs Setup(n), and as a result, he can generate the public key PK and the master key MK. Then he gives PK to A.(3)
Query phase 1.A makes the following queries:
(a)
Extract(i): the challenger runs ski=KeyGen(PK,MK,i) and returns ski to A.(b)
ReKGen(i,S′,W′): C runs rkeyi,S′,W′=ReKGen(PK,ski,S′,W′) and ski=KeyGen(PK,MK,i) and returns rkeyi,S′,W′ to A.(c)
REnc(i,S,S′,C): C runs REnc(PK,rkeyi,S′,W′,i,S,S′,C), where rkeyi,S′,W′=ReKGen(PK,ski,S′,W′) and ski=KeyGen(PK,MK,i), and returns the output to A.(d)
DecryptL2(i,S,C): C runs DecryptL2(PK,ski,i,S,C), where ski=KeyGen(PK,MK,i), and returns the output to A.(e)
DecryptL1(i,j,S,S′,CR): C runs DecryptL1(PK,skj,i,j,S,S′,CR), where skj=KeyGen(PK,MK,j), and returns the output to A.A has to follow the restrictions in this phase. First, A cannot make Extract(i) for any i∈S∗; second A cannot make ReKGen(i,S′,W′) and Extract(j), if i∈S∗, j∈S′, and W′∩W∗≥d.(4)
Challenge. As soon asA finishes Query phase 1, A computes two equal length messages (m0,m1). C selects a bit b∈{0,1} and sets the challenge ciphertext to be C∗=Encrypt(PK,mb,S∗,W∗). C∗ is then sent to A.(5)
Query phase 2. In addition to the restrictions in phase 1,A continues making queries with the following extra restrictions: A is not allowed to run REnc(i,S∗,S′,C∗) and Extract(j) if i∈S∗ and j∈S′;
(a)
A is not allowed to run DecryptL2(i,S∗,C∗) for any i∈S∗;(b)
A is not allowed to run DecryptL1(i,j,S∗,S′,CR) if i∈S∗, j∈S′ and CR=REnc(i,S∗,S′,C∗).(6)
Guess.A makes the guess for b′. The adversary wins the game if b′=b.The above adversaryA is referred to as an IND-OR-CCA adversary. The advantage is defined as (3)AdvA,nGame1=Prb′=b-12.Game 2. IND-Re-CCA game is used for the indistinguishability of the re-encrypted ciphertext.(1)
Init. To begin the game, an adversaryA selects a target users set S∗⊆{1,2,…,n} and a condition set W∗={ω1∗,ω2∗,…,ωn∗}.(2)
Setup. The challengerC generates the public key PK and master key MK by running runs Setup(n). Then C gives PK to A.(3)
Query phase 1. The adversaryA makes the following queries:
(a)
Extract(i): C gets ski from KeyGen(PK,MK,i). Then it returns it to A. Note that A cannot make Extract(i) for any user i∈S∗;(b)
ReKGen(i,S′,W′): C runs rkeyi,S′,W′=ReKGen(PK,ski,S′,W′), where ski=KeyGen(PK,MK,i), and returns rkeyi,S′,W′ to A.(c)
DecryptL1(i,j,S,S′,CR): C runs DecryptL1(PK,skj,i,j,S,S′,CR), where skj=KeyGen(PK,msk,j), and returns the result to A.(4)
Challenge. OnceA finishes Query phase 1, A outputs two equal length messages (m0,m1). Challenger C chooses a bit b∈{0,1} and sets the challenge ciphertext to be C∗=REnc(PK,rkeyi,S∗,W∗,i,S,S∗,C), where i∈S, i∉S∗ and C=Encrypt(PK,mb,S,W∗). C∗ is returned to the adversary A.(5)
Query phase 2.A continues making queries but is subject to the following restrictions:
(a)
A cannot make Extract(i) for any i∈S∗;(b)
A cannot make DecryptL1(i,j,S,S∗,C∗), if i∈S and j∈S∗.(6)
Guess.A makes the guess b′. The adversary wins the game if b′=b.The above adversaryA is referred as an IND-Re-CCA adversary. Its advantage is defined as (4)AdvA,nGame2=Prb′=b-12.A fuzzy-conditional proxy broadcast re-encryption scheme is called IND-Set-CCA-secure if for all PPT adversaryA, AdvA,nGame1, and AdvA,nGame2 are negligible.


## 5. The Proposed FC-PBRE Scheme

### 5.1. Our Construction

A Lagrange coefficientΔω,S(x) is defined for ω∈Zp and a set S, of elements in Zp: (5)Δω,Sx=∏i∈S,i≠ωx-iω-iOur FC-PBRE scheme contains the following algorithms:(i)
Setup(λ,n,d): Let M={0,1}k denote the message space. The algorithm randomly selects α,γ∈Zp and Z∈G and computes νi=gαi for i=1,2,…,n,n+2,…,2n. Let Hash1:{0,1}k×GT→Zp∗, Hash2:GT→{0,1}k, Hash3:GT×G×G×G×{0,1}k→G, Hash4:Zp∗→G, and Hash5:{0,1}k→Zp∗ be collusion-resistant hash functions. It computes υ=gγ. Setup(λ,n,d) outputs the public key PK and the master key MK for the cloud server as follows: (6)PK=ν,ν1,…,νn,νn+2,ν2n,υ,Z,Hash1,Hash2,Hash3,Hash4,MK=γ.(ii)
KeyGen(PK,MK,i): The secret key for a cloud user i is generated in this phase, where(7)ski=νiγ.(iii)
Encrypt(PK,S,m,W): To encrypt a plaintext m∈M under the set S⊆{1,2,…,n} with condition W, it randomly picks a R∈GT, computes t=Hash1(m,R), and outputs the results of the ciphertext: C=(C1,C2,C3,C4,C5,C6). (8)C1=R·eν1,νnt,C2=νt,C3=υ·∏j∈Sνn+1-jt,C4=Cω=Hash4ωtω∈W,C5=m⊕Hash2R,C6=Hash3C1,C2,C3,C4,C5t.(iv)
ReKGen(PK,ski,S′,W′): On inputting ski=νiγ, S′∈{1,2,…,n} and W′, it randomly selects σ∈{0,1}k and a polynomial f(x) with d-1 degree, where f(0)=Hash5(σ). For each ω∈W′, it selects a random value rω and computes (9)a=aω=ski·ZqωHash4ωrωω∈W′,b=bω=νrωω∈W′.It chooses random values∈Zp∗, R′∈G2, computes t′=Hash1(σ,R′), and sets (10)rkey1=R′·eν1,νnt′,rkey2=νt′,rkey3=υ·∏j∈S′νn+1-jt′,rkey4=σ⊕Hash2R′,rkey5=Hash3rkey1,rkey2,rkey3,rkey4t′.It outputs the re-encryption keyrki,S′,W′=a,b,rkey1,rkey2,rkey3,rkey4,rkey5.(v)
REnc(PK,rkeyi,S′,W′,i,S,S′,C): On inputting a re-encryption key rkeyi,S′,W′=(a,b,rkey1,rkey2,rkey3,rkey4,rkey5) and a ciphertext C=(C1,C2,C3,C4,C5,C6), it verifies whether the following hold:(11)eC2,υ·∏j∈Sνn+1-j=?eν,C3,(12)eC2,Hash4ωω∈S=?eν,Cωω∈S,(13)eC2,Hash3C1,C2,C3,C4,C5=?eν,C6.If not, it outputs⊥. Otherwise, it randomly selects a d element set F⊆W∩W′. If such a set F cannot be found, the algorithm outputs ⊥, or else it computes (14)C1~=C1·∏ω∈Ferkey0·∏j∈S,j≠iνn+1-j+i,C2eνi,C3·ebω,CωΔω,F0Then the re-encrypted ciphertext isCR=(C1~,C2,C5,rkey1,rkey2,rkey3,rkey4,rkey5).(vi)
DecryptL2(PK,ski,i,S,C): It takes a secret key ski and a ciphertext C=(C1,C2,C3,C4,C5,C6) as the inputs, it
(1)
verifies if the three equations (11)–(13) hold. If not, it aborts and outputs the error ⊥ or, else,(2)
computesR=C1·e(ski·∏j∈S,j≠iνn+1-j+i,C2)/e(νi,C3), m=C5⊕Hash2(R), and t=Hash1(m,R) and verifies whether (15)C2=νt,(16)C3=υ·∏j∈Sνn+1-jt,(17)C6=Hash3C1,C2,C3,C4,C5thold. It returnsm or else returns ⊥.(vii)
DecryptL1(PK,skj,i,j,S,S′,CR): On inputting a secret key skj and a re-encrypted ciphertext CR=(C1~,C2,C5,rkey1,rkey2,rkey3,rkey4,rkey5), it proceeds as follows:First verifying whether all of the equations hold:(18)erkey2,υ·∏j∈Sνn+1-j=?eν,rkey3,(19)erkey2,Hash3rkey1,…,rkey4=?eν,rkey5.If they do not hold, it outputs⊥. Otherwise, it computes(20)R′=rkey1·eskj·∏l∈S′,l≠jνn+1-l+j,rkey2egj,rk3,σ=rkey5⊕Hash2R′,gs=rkey4Hash4σ,t′=Hash1σ,R′.It verifies whether(21)rkey2=νt′,rkey3=υ·∏l∈S′νn+1-lt′,rkey5=Hash3rkey1,rkey2,rkey3,rkey4t′hold. If not, it returns⊥, or elseit computesR=C1~/e(C2,ZHash5(σ)), m=C5⊕Hash2(R), and t=Hash1(m,R). It verifies whether C2=νt holds. If it holds, it returns m or else it returns ⊥.


### 5.2. Security Proof

In section, we prove that our scheme is IND-Set-CCA-secure in the ROM.Theorem 3.
IfHash1,Hash2,Hash3,Hash4,Hash5 are target collision-resistant hash functions and the Decisional nBDHE assumption holds, the above scheme then is IND-Set-CCA-secure in the ROM.Lemma 4.
If an IND-OR-CCA is attackerA that can successfully attack FC-PBRE, then we are able to construct a simulator S that can solve Decisional nBDHE assumption.Proof.
The simulatorS is provided a Decisional nBDHE instance (μ,ν,ν1,…,νn,νn+2,…,ν2n,T) and has to decide whether T=e(νn+1,μ) from a random value. The simulator S controls the random oracles (RO) Hash1,Hash2,Hash3,Hash4,Hash5 as follows:
S searches Hash1 for (m,R,t). If Hash1 list already exists, then S sends t to A. Else, S randomly selects t∈Zp∗, sends s to A, and puts (m,R,t) in Hash1 list.
S searches Hash2 for (R,κ). If Hash2 list already exists, then S sends κ to A. Else, S randomly selects κ∈{0,1}k, sends κ to A, and puts (R,κ) to Hash2.
S searches Hash3 for (C1,C2,C3,C4,C5,ϕ,φ). If Hash3 list already exists, then S sends ψ to A. Else, S randomly selects ϕ∈Zp∗, generates ψ=νϕ, sends ψ to A, and puts (C1,C2,C3,C4,C5,ϕ,φ) to Hash3 list.
S searches Hash4 for (ω,τ,ϖ). If Hash4 list already exists, then S sends ϖ to A. Else, S randomly selects τ∈Zp∗ and sets ϖ=ντ, sends ϖ to A, and puts (ω,τ,ϖ) to Hash4 list.
S searches Hash5 for (σ,ϱ). If Hash5 list already exists, then S sends ϱ to A. Else, S randomly selects ϱ∈Zp∗, sends ϱ to A, and adds (σ,ϱ) to Hash5 list.
S then keeps the lists as follows:
(i)KeyList stores the tuples (β,i,ski);
(ii)ReKeyList stores the tuples (β1,i,S′,W′,rkeyi,S′,W′,σ,R,FlagOne), which maintains the results of query ReKGen(ski,S′,W′). If FlagOne=1, then it is a valid re-encryption key, or else it is random.
(iii)REncList stores the tuples (i,S,S′,C,CR,FlagTwo), which maintains query REnc(i,S,S′,C). Note that if FlagTwo=1, then a re-encryption key which is used to generate the re-encrypted ciphertext should be valid, or else the re-encrypted ciphertext is invalid and randomly generated.(1)
Init. The attacker selects a challenge user set S∗⊆{1,2,…,n} and challenge conditional set W∗={ω1∗,ω2∗,…,ωn∗}.(2)
Setup. The simulator S randomly selects values ϖ,∈Zp and Z∈G and sets (22)υ=νϖ·∏j∈S∗νn+1-j-1≜νγ.S sets the public key as (23)PK=υ,ν,ν1,…,νn,νn+2,…,ν2n,Z,Hash1,Hash2,Hash3,Hash4,Hash5andsk=γ. S sends PK to the attacker A.(3)
Query phase 1.A does some of the columns of the query, and the response of S is as follows:
(i)
Extract(i): If i∈S∗, then S aborts. Else the simulator S first searches KeyList, and if (β,i,ski) are in KeyList, then it outputs ski. Otherwise, S throws a biased coin β (Pr[β=1]=δ for some δ).
(a)
Whenβ=0, S aborts and outputs a random bit.(b)
Whenβ=1, S calculates ski=νiμ·(∏j∈S∗νn+1-j+i)-1. Note that we have (24)ski=νiϖ·∏j∈S∗νn+1-j+i-1=νϖ·∏j∈S∗νn+1-j-1αi=υαi=νiγ.(ii)
ReKGen(i,S′,W′): the simulator S verifies whether tuple (∗,j,skj) is in KeyList (i∈S∗, j∈S′, and W′∩W∗≥d). If not, then S aborts. Otherwise S searches whether there is a tuple (∗,i,S′,W′,rkeyi,S′,W′,σ,R,∗) in ReKeyList. If yes, S outputs rkeyi,S′,W′. Otherwise, the simulator S proceeds:
(a)
If(1,i,ski) exists in KeyList, as in the real algorithm of the scheme, the simulator S generates the re-encryption key rkeyi,S′,W′ from ReKGen by using the secret key ski. S returns rkeyi,S′,W′ to A. Then it puts (∗,i,S′,W′,rkeyi,S′,W′,σ,R,1) to ReKeyList, where σ,R are randomly selected.(b)
Otherwise,S throws a biased coin β. If β=1, S queries the Extract(i) oracle to get ski and, then, generates rkeyi,S′,W′ from ReKGen. S returns the re-encryption key rkeyi,S′,W′ to A. Then it adds (1,i,ski) and (∗,i,S′,W′,rkeyi,S′,W′,σ,R,1) to KeyList and ReKeyList, respectively. If β=0, S sets {a=(aω=ρω),b=(bω=ρω′):ω∈W′} for randomly chosen ρω,ρω′∈G. Then S constructs rkey1,rkey2,rkey3,rkey4,rkey5 to encrypted random σ,R as the real environment. The simulator S sends the re-encryption key to A. Then it adds (∗,i,S′,W′,rkeyi,S′,W′,σ,R,0) to ReKeyList.(iii)
REnc(i,S,S′,C): S searches (i,S,S′,C,CR,∗) in REncList. If yes, S returns CR. Else, it is dealt with in the below:
(a)
If(∗,i,S′,rkeyi,S′,W′,σ,R,∗) in ReKeyList, as the real environment, S uses rkeyi,S′,W′ to construct CR by REnc and sends CR to A. Then it adds (i,S,S′,C,CR,∗) to REncList. Here we need C=Encrypt(PK,S,m,W) and W∩W′≥d.(b)
Otherwise,S first makes ReKGen(i,S′) query to retrieve the re-encryption key rkeyi,S′,W′. Next, S constructs CR. Then it puts (i,S,S′,C,CR,∗) to REncList.(iv)
DecryptL2(i,S,C): S tests (11)-(13). If the test does not pass, it aborts with an error ⊥. Else
(a)
If(1,i,ski) already exists in KeyList, S recovers m by using ski.(b)
Otherwise,S queries Extract(i) to obtain ski and S recovers m by using ski.(v)
DecryptL1(i,j,S,S′,CR): S checks (18)-(19). If one of the equations cannot be validated, it aborts and outputs ⊥. Otherwise, S proceeds:
(a)
If(1,j,skj) already exists in KeyList, S recovers m by using skj.(b)
Otherwise,S queries Extract(j) to get skj and S recovers m by using skj.(4)
Challenge. Once the attacker A decides that Phase 1 is finished, it outputs two messages (m0,m1). And S randomly selects b∈{0,1},R∗∈GT. Let μ=gt∗ for some randomly chosen t∗. S computes (25)C1∗=R∗·T,C2∗=μ=νt∗,C3∗=μϖ=νϖt∗=νϖ·∏j∈S∗νn+1-j-1∏j∈S∗νn+1-jt∗=υ∏j∈S∗νn+1-jt∗,C4∗=Cω=μτ=ντt∗=Hash4ωt∗ω∈W∗,C5∗=mb⊕Hash2R∗,φ∗=Hash3C1∗,C3∗,C3∗,C4∗,C5∗,C6∗=μϕ∗=Hash3C1∗,C3∗,C3∗,C4∗,C5∗t∗whereS queries (C1∗,C2∗,C3∗,C4∗,C5∗) to RO Hash3 for entry (C1∗,C2∗,C3∗,C4∗,C5∗,ϕ∗,φ∗). S sends C∗=(C1∗,C2∗,C3∗,C4∗,C5∗,C6∗) to A. If T=e(νn+1,μ), we have C1∗=R∗·T=R∗·e(ν,νn+1)t∗. Hence the challenge ciphertext C∗ is a valid one. Otherwise, C∗ is independent of b if T is a random value, in the attacker’s view.(5)
Query phase 2.A makes queries continuously.(6)
Guess.A generates the guess bit b′, if b′=b, and then outputs 1, which means that T=e(νn+1,μ); else outputs 0. In this case, T is a random value in G2.Probability analysis. When S′s aborting happens, we define the game as Abort. In the case S does not abort, A does not know the different between the game and the actual scheme. Let q denote the total number of all queries; we have Pr[¬Abort]≥δq·((p-1)/p)q≜ξq≥ξq(1-ξ), which is maximized at δopt=q/(1+q). Using δopt, the probability Pr[¬Abort] is at least 1/e˙(1+q), where e˙ is the base of the nature logarithm. Therefore, we have (26)ϵ′⩾ϵe˙1+q-AdvHash1,ATCR-AdvHash2,ATCR-AdvHash3,ATCR-AdvHash4,ATCR-AdvHash5,ATCR.With this we complete the proof of Lemma4.Lemma 5.
If an IND-Re-CCA attacker can successfully attack our scheme, then a simulatorS that can be constructed to solve the Decisional nBDHE assumption.Proof.
We use the same game construction from the proof of Lemma4 and modify the challenge phase to prove Lemma 5. To construct the challenge re-encrypt ciphertext, S randomly selects b∈{0,1},R∗∈GT. Let h=gt∗ for the randomly selected t∗. S then computes (27)C1~∗=R∗·eμ,ZHash5σ,C2∗=μ=νt∗,C5∗=mb⊕Hash2R∗,S then constructs rkey1∗,rkey2∗,rkey3∗,rkey4∗,rkey5∗ in the same way as in game 1.
The proofs of Lemmas4 and 5 conclude that we have proven Theorem 3.


## 5.1. Our Construction

A Lagrange coefficientΔω,S(x) is defined for ω∈Zp and a set S, of elements in Zp: (5)Δω,Sx=∏i∈S,i≠ωx-iω-iOur FC-PBRE scheme contains the following algorithms:(i)
Setup(λ,n,d): Let M={0,1}k denote the message space. The algorithm randomly selects α,γ∈Zp and Z∈G and computes νi=gαi for i=1,2,…,n,n+2,…,2n. Let Hash1:{0,1}k×GT→Zp∗, Hash2:GT→{0,1}k, Hash3:GT×G×G×G×{0,1}k→G, Hash4:Zp∗→G, and Hash5:{0,1}k→Zp∗ be collusion-resistant hash functions. It computes υ=gγ. Setup(λ,n,d) outputs the public key PK and the master key MK for the cloud server as follows: (6)PK=ν,ν1,…,νn,νn+2,ν2n,υ,Z,Hash1,Hash2,Hash3,Hash4,MK=γ.(ii)
KeyGen(PK,MK,i): The secret key for a cloud user i is generated in this phase, where(7)ski=νiγ.(iii)
Encrypt(PK,S,m,W): To encrypt a plaintext m∈M under the set S⊆{1,2,…,n} with condition W, it randomly picks a R∈GT, computes t=Hash1(m,R), and outputs the results of the ciphertext: C=(C1,C2,C3,C4,C5,C6). (8)C1=R·eν1,νnt,C2=νt,C3=υ·∏j∈Sνn+1-jt,C4=Cω=Hash4ωtω∈W,C5=m⊕Hash2R,C6=Hash3C1,C2,C3,C4,C5t.(iv)
ReKGen(PK,ski,S′,W′): On inputting ski=νiγ, S′∈{1,2,…,n} and W′, it randomly selects σ∈{0,1}k and a polynomial f(x) with d-1 degree, where f(0)=Hash5(σ). For each ω∈W′, it selects a random value rω and computes (9)a=aω=ski·ZqωHash4ωrωω∈W′,b=bω=νrωω∈W′.It chooses random values∈Zp∗, R′∈G2, computes t′=Hash1(σ,R′), and sets (10)rkey1=R′·eν1,νnt′,rkey2=νt′,rkey3=υ·∏j∈S′νn+1-jt′,rkey4=σ⊕Hash2R′,rkey5=Hash3rkey1,rkey2,rkey3,rkey4t′.It outputs the re-encryption keyrki,S′,W′=a,b,rkey1,rkey2,rkey3,rkey4,rkey5.(v)
REnc(PK,rkeyi,S′,W′,i,S,S′,C): On inputting a re-encryption key rkeyi,S′,W′=(a,b,rkey1,rkey2,rkey3,rkey4,rkey5) and a ciphertext C=(C1,C2,C3,C4,C5,C6), it verifies whether the following hold:(11)eC2,υ·∏j∈Sνn+1-j=?eν,C3,(12)eC2,Hash4ωω∈S=?eν,Cωω∈S,(13)eC2,Hash3C1,C2,C3,C4,C5=?eν,C6.If not, it outputs⊥. Otherwise, it randomly selects a d element set F⊆W∩W′. If such a set F cannot be found, the algorithm outputs ⊥, or else it computes (14)C1~=C1·∏ω∈Ferkey0·∏j∈S,j≠iνn+1-j+i,C2eνi,C3·ebω,CωΔω,F0Then the re-encrypted ciphertext isCR=(C1~,C2,C5,rkey1,rkey2,rkey3,rkey4,rkey5).(vi)
DecryptL2(PK,ski,i,S,C): It takes a secret key ski and a ciphertext C=(C1,C2,C3,C4,C5,C6) as the inputs, it
(1)
verifies if the three equations (11)–(13) hold. If not, it aborts and outputs the error ⊥ or, else,(2)
computesR=C1·e(ski·∏j∈S,j≠iνn+1-j+i,C2)/e(νi,C3), m=C5⊕Hash2(R), and t=Hash1(m,R) and verifies whether (15)C2=νt,(16)C3=υ·∏j∈Sνn+1-jt,(17)C6=Hash3C1,C2,C3,C4,C5thold. It returnsm or else returns ⊥.(vii)
DecryptL1(PK,skj,i,j,S,S′,CR): On inputting a secret key skj and a re-encrypted ciphertext CR=(C1~,C2,C5,rkey1,rkey2,rkey3,rkey4,rkey5), it proceeds as follows:First verifying whether all of the equations hold:(18)erkey2,υ·∏j∈Sνn+1-j=?eν,rkey3,(19)erkey2,Hash3rkey1,…,rkey4=?eν,rkey5.If they do not hold, it outputs⊥. Otherwise, it computes(20)R′=rkey1·eskj·∏l∈S′,l≠jνn+1-l+j,rkey2egj,rk3,σ=rkey5⊕Hash2R′,gs=rkey4Hash4σ,t′=Hash1σ,R′.It verifies whether(21)rkey2=νt′,rkey3=υ·∏l∈S′νn+1-lt′,rkey5=Hash3rkey1,rkey2,rkey3,rkey4t′hold. If not, it returns⊥, or elseit computesR=C1~/e(C2,ZHash5(σ)), m=C5⊕Hash2(R), and t=Hash1(m,R). It verifies whether C2=νt holds. If it holds, it returns m or else it returns ⊥.


## 5.2. Security Proof

In section, we prove that our scheme is IND-Set-CCA-secure in the ROM.Theorem 3.
IfHash1,Hash2,Hash3,Hash4,Hash5 are target collision-resistant hash functions and the Decisional nBDHE assumption holds, the above scheme then is IND-Set-CCA-secure in the ROM.Lemma 4.
If an IND-OR-CCA is attackerA that can successfully attack FC-PBRE, then we are able to construct a simulator S that can solve Decisional nBDHE assumption.Proof.
The simulatorS is provided a Decisional nBDHE instance (μ,ν,ν1,…,νn,νn+2,…,ν2n,T) and has to decide whether T=e(νn+1,μ) from a random value. The simulator S controls the random oracles (RO) Hash1,Hash2,Hash3,Hash4,Hash5 as follows:
S searches Hash1 for (m,R,t). If Hash1 list already exists, then S sends t to A. Else, S randomly selects t∈Zp∗, sends s to A, and puts (m,R,t) in Hash1 list.
S searches Hash2 for (R,κ). If Hash2 list already exists, then S sends κ to A. Else, S randomly selects κ∈{0,1}k, sends κ to A, and puts (R,κ) to Hash2.
S searches Hash3 for (C1,C2,C3,C4,C5,ϕ,φ). If Hash3 list already exists, then S sends ψ to A. Else, S randomly selects ϕ∈Zp∗, generates ψ=νϕ, sends ψ to A, and puts (C1,C2,C3,C4,C5,ϕ,φ) to Hash3 list.
S searches Hash4 for (ω,τ,ϖ). If Hash4 list already exists, then S sends ϖ to A. Else, S randomly selects τ∈Zp∗ and sets ϖ=ντ, sends ϖ to A, and puts (ω,τ,ϖ) to Hash4 list.
S searches Hash5 for (σ,ϱ). If Hash5 list already exists, then S sends ϱ to A. Else, S randomly selects ϱ∈Zp∗, sends ϱ to A, and adds (σ,ϱ) to Hash5 list.
S then keeps the lists as follows:
(i)KeyList stores the tuples (β,i,ski);
(ii)ReKeyList stores the tuples (β1,i,S′,W′,rkeyi,S′,W′,σ,R,FlagOne), which maintains the results of query ReKGen(ski,S′,W′). If FlagOne=1, then it is a valid re-encryption key, or else it is random.
(iii)REncList stores the tuples (i,S,S′,C,CR,FlagTwo), which maintains query REnc(i,S,S′,C). Note that if FlagTwo=1, then a re-encryption key which is used to generate the re-encrypted ciphertext should be valid, or else the re-encrypted ciphertext is invalid and randomly generated.(1)
Init. The attacker selects a challenge user set S∗⊆{1,2,…,n} and challenge conditional set W∗={ω1∗,ω2∗,…,ωn∗}.(2)
Setup. The simulator S randomly selects values ϖ,∈Zp and Z∈G and sets (22)υ=νϖ·∏j∈S∗νn+1-j-1≜νγ.S sets the public key as (23)PK=υ,ν,ν1,…,νn,νn+2,…,ν2n,Z,Hash1,Hash2,Hash3,Hash4,Hash5andsk=γ. S sends PK to the attacker A.(3)
Query phase 1.A does some of the columns of the query, and the response of S is as follows:
(i)
Extract(i): If i∈S∗, then S aborts. Else the simulator S first searches KeyList, and if (β,i,ski) are in KeyList, then it outputs ski. Otherwise, S throws a biased coin β (Pr[β=1]=δ for some δ).
(a)
Whenβ=0, S aborts and outputs a random bit.(b)
Whenβ=1, S calculates ski=νiμ·(∏j∈S∗νn+1-j+i)-1. Note that we have (24)ski=νiϖ·∏j∈S∗νn+1-j+i-1=νϖ·∏j∈S∗νn+1-j-1αi=υαi=νiγ.(ii)
ReKGen(i,S′,W′): the simulator S verifies whether tuple (∗,j,skj) is in KeyList (i∈S∗, j∈S′, and W′∩W∗≥d). If not, then S aborts. Otherwise S searches whether there is a tuple (∗,i,S′,W′,rkeyi,S′,W′,σ,R,∗) in ReKeyList. If yes, S outputs rkeyi,S′,W′. Otherwise, the simulator S proceeds:
(a)
If(1,i,ski) exists in KeyList, as in the real algorithm of the scheme, the simulator S generates the re-encryption key rkeyi,S′,W′ from ReKGen by using the secret key ski. S returns rkeyi,S′,W′ to A. Then it puts (∗,i,S′,W′,rkeyi,S′,W′,σ,R,1) to ReKeyList, where σ,R are randomly selected.(b)
Otherwise,S throws a biased coin β. If β=1, S queries the Extract(i) oracle to get ski and, then, generates rkeyi,S′,W′ from ReKGen. S returns the re-encryption key rkeyi,S′,W′ to A. Then it adds (1,i,ski) and (∗,i,S′,W′,rkeyi,S′,W′,σ,R,1) to KeyList and ReKeyList, respectively. If β=0, S sets {a=(aω=ρω),b=(bω=ρω′):ω∈W′} for randomly chosen ρω,ρω′∈G. Then S constructs rkey1,rkey2,rkey3,rkey4,rkey5 to encrypted random σ,R as the real environment. The simulator S sends the re-encryption key to A. Then it adds (∗,i,S′,W′,rkeyi,S′,W′,σ,R,0) to ReKeyList.(iii)
REnc(i,S,S′,C): S searches (i,S,S′,C,CR,∗) in REncList. If yes, S returns CR. Else, it is dealt with in the below:
(a)
If(∗,i,S′,rkeyi,S′,W′,σ,R,∗) in ReKeyList, as the real environment, S uses rkeyi,S′,W′ to construct CR by REnc and sends CR to A. Then it adds (i,S,S′,C,CR,∗) to REncList. Here we need C=Encrypt(PK,S,m,W) and W∩W′≥d.(b)
Otherwise,S first makes ReKGen(i,S′) query to retrieve the re-encryption key rkeyi,S′,W′. Next, S constructs CR. Then it puts (i,S,S′,C,CR,∗) to REncList.(iv)
DecryptL2(i,S,C): S tests (11)-(13). If the test does not pass, it aborts with an error ⊥. Else
(a)
If(1,i,ski) already exists in KeyList, S recovers m by using ski.(b)
Otherwise,S queries Extract(i) to obtain ski and S recovers m by using ski.(v)
DecryptL1(i,j,S,S′,CR): S checks (18)-(19). If one of the equations cannot be validated, it aborts and outputs ⊥. Otherwise, S proceeds:
(a)
If(1,j,skj) already exists in KeyList, S recovers m by using skj.(b)
Otherwise,S queries Extract(j) to get skj and S recovers m by using skj.(4)
Challenge. Once the attacker A decides that Phase 1 is finished, it outputs two messages (m0,m1). And S randomly selects b∈{0,1},R∗∈GT. Let μ=gt∗ for some randomly chosen t∗. S computes (25)C1∗=R∗·T,C2∗=μ=νt∗,C3∗=μϖ=νϖt∗=νϖ·∏j∈S∗νn+1-j-1∏j∈S∗νn+1-jt∗=υ∏j∈S∗νn+1-jt∗,C4∗=Cω=μτ=ντt∗=Hash4ωt∗ω∈W∗,C5∗=mb⊕Hash2R∗,φ∗=Hash3C1∗,C3∗,C3∗,C4∗,C5∗,C6∗=μϕ∗=Hash3C1∗,C3∗,C3∗,C4∗,C5∗t∗whereS queries (C1∗,C2∗,C3∗,C4∗,C5∗) to RO Hash3 for entry (C1∗,C2∗,C3∗,C4∗,C5∗,ϕ∗,φ∗). S sends C∗=(C1∗,C2∗,C3∗,C4∗,C5∗,C6∗) to A. If T=e(νn+1,μ), we have C1∗=R∗·T=R∗·e(ν,νn+1)t∗. Hence the challenge ciphertext C∗ is a valid one. Otherwise, C∗ is independent of b if T is a random value, in the attacker’s view.(5)
Query phase 2.A makes queries continuously.(6)
Guess.A generates the guess bit b′, if b′=b, and then outputs 1, which means that T=e(νn+1,μ); else outputs 0. In this case, T is a random value in G2.Probability analysis. When S′s aborting happens, we define the game as Abort. In the case S does not abort, A does not know the different between the game and the actual scheme. Let q denote the total number of all queries; we have Pr[¬Abort]≥δq·((p-1)/p)q≜ξq≥ξq(1-ξ), which is maximized at δopt=q/(1+q). Using δopt, the probability Pr[¬Abort] is at least 1/e˙(1+q), where e˙ is the base of the nature logarithm. Therefore, we have (26)ϵ′⩾ϵe˙1+q-AdvHash1,ATCR-AdvHash2,ATCR-AdvHash3,ATCR-AdvHash4,ATCR-AdvHash5,ATCR.With this we complete the proof of Lemma4.Lemma 5.
If an IND-Re-CCA attacker can successfully attack our scheme, then a simulatorS that can be constructed to solve the Decisional nBDHE assumption.Proof.
We use the same game construction from the proof of Lemma4 and modify the challenge phase to prove Lemma 5. To construct the challenge re-encrypt ciphertext, S randomly selects b∈{0,1},R∗∈GT. Let h=gt∗ for the randomly selected t∗. S then computes (27)C1~∗=R∗·eμ,ZHash5σ,C2∗=μ=νt∗,C5∗=mb⊕Hash2R∗,S then constructs rkey1∗,rkey2∗,rkey3∗,rkey4∗,rkey5∗ in the same way as in game 1.
The proofs of Lemmas4 and 5 conclude that we have proven Theorem 3.


## 6. Comparison

We use schemes from [24, 26] as baselines as [26] achieves the same security and [24] supports the same fuzzy property with our scheme. In the implementation, we selected two most efficient schemes to do experimental comparisons. Our experimental environment is as follows: Core i7 Processor (6M Cache, 3.40 GHz) with a Linux operating system. In the implementation, the proxy re-encrypted the ciphertext of the delegator to 20 different ciphertext for the delegate. The average value of the execution time of 50 experiments is used to eliminate the errors. Table 1 lists the comparison of the performance of the schemes. Although ReKGen, Enc, REnc, DecryptL2, and DecryptL1 time is a little greater than [24, 26] as our scheme needs to support the property of broadcast, the time overhead of the re-encryption algorithm is much slower than our scheme. This is due to the fact that the proxy is only required to run the re-encryption algorithm once.Table 1
Comparison with Weng et al. [26] and Fang et al. [24].
Scheme ReKGen(ms) Enc(ms) REnc(ms) DecryptL2(ms) DecryptL1(ms) Weng et al. 9.22 5.64 40.32 5.09 6.27  Fang et al. 11.46 6.03 36.62 6.31 7.13  Our scheme 12.42 7.01 28.08 7.54 8.36


## 7. Application

With the proposed FC-PBRE scheme, we illustrate an example of the scheme’s possible application and show how FC-PBRE scheme protects the confidentiality and privacy of multimedia data in the Internet of Things.


### 7.1. Application of Security in Internet of Things

With the development of wireless networks and the Internet of Things, a large number of wireless devices (WiFi cameras, wireless sensors, etc.) are deployed; they are collecting and analyzing multimedia data at all times. Many applications require these wireless devices to share data, and insecure data sharing before wireless devices can easily lead to data leakage. Usually a normal user accesses a wireless device in three ways: first, through direct connection with the wireless device; second, through the gateway; third, through the cloud platform. Because many wireless devices need to be localized before they start to work, they usually have backend configuration interfaces (WEB, PC) and are offline at some point during their work, so it is more convenient for an attacker to access multimedia data directly by cracking the login password of the backend configuration interface. In this case, even if the device and cloud have been authenticated and encrypted (such as using SSL) they cannot prevent the attack. How to ensure the safe storage and sharing of wireless multimedia data becomes particularly important. In this environment, we can deploy FC-PBRE to ensure the security of the system. The data of each device (including multimedia data, control data) is encrypted by the device owner’s public key (CA=Encrypt(PKA,S,m,W)). Obviously, no user can decrypt the data except the data owner A. When the device owner A needs to grant data privileges to the maintenance engineer for the configurations of wireless devices (such as WiFi cameras), the maintenance engineer B has to request a re-encryption key rkA,S′,W′=ReKGen(PK,skA,S′,W′), where BinS′ from the device owner A. The maintenance engineer B can use the re-encrypted key to perform the re-encryption algorithm CR=REnc(PKA,rki,S′,W′,i,S,S′,CA) to convert the device owner’s ciphertext CA into their own ciphertext CR, and then B uses his own public key to decrypt the ciphertext by performing the re-encrypted ciphertext decryption algorithm m=DecryptL1(PKA,skB,A,B,S,S′,CR). Similarly, if the gateway or cloud platform wishes to share encrypted multimedia data to authorized third-party users (i.e., E=E1,E2,…,En) without decryption, the device owner A only needs to produce a re-encrypted key rkA,E,W′=ReKGen(PKA,skA,E,W′), which will be used to re-encrypt the message from the device owner A to the third-party user sets E=E1,E2,…,En. After the key rkA,E,W′ is generated, it will be sent to the cloud platform. Therefore, the cloud platform can run the re-encryption algorithm CR=REnc(PKA,rki,E,W′,A,S,S′,CA) to convert the device owner’s ciphertext into CR, which can be decrypted with the third party’s own private key.


## 7.1. Application of Security in Internet of Things

With the development of wireless networks and the Internet of Things, a large number of wireless devices (WiFi cameras, wireless sensors, etc.) are deployed; they are collecting and analyzing multimedia data at all times. Many applications require these wireless devices to share data, and insecure data sharing before wireless devices can easily lead to data leakage. Usually a normal user accesses a wireless device in three ways: first, through direct connection with the wireless device; second, through the gateway; third, through the cloud platform. Because many wireless devices need to be localized before they start to work, they usually have backend configuration interfaces (WEB, PC) and are offline at some point during their work, so it is more convenient for an attacker to access multimedia data directly by cracking the login password of the backend configuration interface. In this case, even if the device and cloud have been authenticated and encrypted (such as using SSL) they cannot prevent the attack. How to ensure the safe storage and sharing of wireless multimedia data becomes particularly important. In this environment, we can deploy FC-PBRE to ensure the security of the system. The data of each device (including multimedia data, control data) is encrypted by the device owner’s public key (CA=Encrypt(PKA,S,m,W)). Obviously, no user can decrypt the data except the data owner A. When the device owner A needs to grant data privileges to the maintenance engineer for the configurations of wireless devices (such as WiFi cameras), the maintenance engineer B has to request a re-encryption key rkA,S′,W′=ReKGen(PK,skA,S′,W′), where BinS′ from the device owner A. The maintenance engineer B can use the re-encrypted key to perform the re-encryption algorithm CR=REnc(PKA,rki,S′,W′,i,S,S′,CA) to convert the device owner’s ciphertext CA into their own ciphertext CR, and then B uses his own public key to decrypt the ciphertext by performing the re-encrypted ciphertext decryption algorithm m=DecryptL1(PKA,skB,A,B,S,S′,CR). Similarly, if the gateway or cloud platform wishes to share encrypted multimedia data to authorized third-party users (i.e., E=E1,E2,…,En) without decryption, the device owner A only needs to produce a re-encrypted key rkA,E,W′=ReKGen(PKA,skA,E,W′), which will be used to re-encrypt the message from the device owner A to the third-party user sets E=E1,E2,…,En. After the key rkA,E,W′ is generated, it will be sent to the cloud platform. Therefore, the cloud platform can run the re-encryption algorithm CR=REnc(PKA,rki,E,W′,A,S,S′,CA) to convert the device owner’s ciphertext into CR, which can be decrypted with the third party’s own private key.


## 8. Conclusions

In the paper, a new security notion called fuzzy-conditional proxy broadcast re-encryption (FC-PBRE) is presented. In a FC-PBRE, the proxy uses a broadcast re-encryption key to re-encrypt a ciphertext which can be decrypted by a set of delegatees if and only if the broadcast key’s conditional setW is close to the conditional set W′ of the ciphertext. Moreover, the proxy learns nothing about the plaintext from entire process. Second, we define the security notion against chosen-ciphertext attacks for FC-PBRE and propose an efficient fuzzy-conditional proxy broadcast re-encryption scheme. Finally, we prove that our FC-PBRE scheme is the chosen-ciphertext attack secure in the random oracle model under the Decisional nBDHE assumption.Given our contributions, further research might explore constructing a CCA-secure FC-PBRE scheme in the standard model. It also can focus on the construction of the fuzzy-conditional proxy broadcast re-encryption schemes without pairings.



---

*Source: 5037892-2018-10-18.xml*