# A Privacy Protection Scheme for IoT Big Data Based on Time and Frequency Limitation

Authors: Lei Zhang; Yu Huo; Qiang Ge; Yuxiang Ma; Qiqi Liu; Wenlei Ouyang
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

Various applications of the Internet of Things assisted by deep learning such as autonomous driving and smart furniture have gradually penetrated people’s social life. These applications not only provide people with great convenience but also promote the progress and development of society. However, how to ensure that the important personal privacy information in the big data of the Internet of Things will not be leaked when it is stored and shared on the cloud is a challenging issue. The main challenges include (1) the changes in access rights caused by the flow of manufacturers or company personnel while sharing and (2) the lack of limitation on time and frequency. We propose a data privacy protection scheme based on time and decryption frequency limitation that can be applied in the Internet of Things. Legitimate users can obtain the original data, while users without a homomorphic encryption key can perform operation training on the homomorphic ciphertext. On the one hand, this scheme does not affect the training of the neural network model, on the other hand, it improves the confidentiality of data. Besides that, this scheme introduces a secure two-party agreement to improve security while generating keys. While revoking, each attribute is specified for the validity period in advance. Once the validity period expires, the attribute will be revoked. By using storage lists and setting tokens to limit the number of user accesses, it effectively solves the problem of data leakage that may be caused by multiple accesses in a long time. The theoretical analysis demonstrates that the proposed scheme can not only ensure safety but also improve efficiency.


---

## Body

## 1. Introduction

The development of emerging computing technologies (e.g., cloud computing) have brought opportunity for various industries, such as hyperspectral remote sensing image algorithms [1, 2], classification algorithms [3], matrix operations under linear systems [4, 5], and data generated by Internet of Things (IoT) devices. If the data in a solution is stored in the cloud or the calculation is outsourced to the cloud, the local storage and calculation pressure will be greatly reduced. Among them, for IoT big data, because IoT devices generate huge amounts of data, the structure of the traditional machine learning model is relatively simple, which can no longer meet the new needs of IoT applications. Thus, deep learning technology has been widely used in IoT applications [6], e.g., smart home [7], smart city [8, 9], and autonomous driving [10].In the scenario of applying deep learning technology to big data in the IoT, in order to train a neural network, large amounts of data need to be obtained from the IoT devices. For example, crowdsensing systems collect data that comes from sensors embedded on personally owned mobile devices [11]. These data may contain sensitive information of some users. However, IoT networks are becoming more vulnerable to various web attacks [12]. Obviously, once they “share” these IoT data with the same field, they are likely to lose control of this data. If these data containing private information are leaked, and there is a lack of effective protection mechanism in the process of IoT search [13], it may cause irreversible harm to the people whose information is leaked. For example, in the field of healthcare, human physiological data collected by wearable IoT devices are put into deep learning models, which can predict the physical condition of patients [14–17]. Once these data are leaked, it will not only cause a patient’s economic loss but also endanger life [18]. In the field of autonomous driving, the prediction system of deep learning may be maliciously interfered. Once location privacy data is obtained maliciously, it may cause traffic safety problems and bring troubles to society [19]. It can be seen that how to protect users’ private data still faces severe challenges for projects that use deep learning to assist IoT applications, and it is a problem that must be solved.At present, many solutions have been proposed to solve the big data privacy protection problem in machine learning [20] or deep learning. Generally, these schemes are divided into three categories: federated learning [21, 22], encryption-based technologies [23–26], and differential privacy technologies [27, 28], as shown in Figure 1. Figure 1 shows the working principles of three different types of privacy protection. Among them, encryption-based technologies mainly use direct encryption of data, such as using homomorphic encryption algorithms or setting access control on data uploaded to cloud servers. However, in actual situations, data owners not only want to share training data with others but also want to guarantee data security. Although homomorphic encryption solution realizes the encryption of data, it cannot meet the needs of multiuser data sharing when sharing data in the same field, and it cannot achieve one-to-many fine-grained communication. In attribute-based encryption, only users who meet the access strategy set by the owner can obtain the data, which can achieve more flexible access control. Therefore, to handle the problem of the incompatibility of secure storage and fine-grained sharing of IoT big data in deep learning, an attribute-based encryption solution can be introduced. Among them, the encryption of the ciphertext strategy is more suitable to be used in this scenario than the key-based encryption due to the characteristics of the ciphertext contact access strategy and key contact access structure.Figure 1
Three different types of working principles.In the actual data sharing scenario, due to the numerous attributes of the visitor, there are many departments in the enterprise engaged in the IoT, so the attribute fluidity is relatively large. Access users obtain the key through their own identity attribute information. If the attribute used to represent the identity does not have a valid period, it means that even if an employee resigns or a department merges, it will not affect the access rights of the resigned employee or the original department staff, and these employees can still obtain data through their own identity attributes. If a resigned employee sells IoT big data in exchange for economic benefits, it will not only endanger the interests of the company but also harm people’s personal safety. This shows that it is necessary to set the validity period for each user attribute. The attribute will be cancelled when it expires. Moreover, many current solutions allow users to access unlimited times within the set time. To prevent the number of visits from being abused, it is necessary to limit the number of visits within the set time. By limiting the user’s access period and access frequency, to a certain extent, it is possible to reduce the occurrence of data leakage caused by the sale of data information by employees or outsiders using decryption attributes to access big data of the Internet of Things.We consider the data privacy problems of big data generated in the field of IoT for mobile computing and use attribute revocation idea [29, 30], then propose an IoT big data privacy protection scheme based on time and the number of decryption restrictions. This scheme combines homomorphic encryption and attribute-based encryption. In summary, the main contributions of this paper are as follows:(1)
We propose a scheme that limits attribute usage time and user decryption frequency. By setting the attribute version number for each attribute as a mark, it is compared with the local time to determine whether the time has expired and realize the revocation. Besides, it limits the number of user accesses by establishing a user decryption frequency table and setting access tokens.(2)
We combine homomorphic encryption with ciphertext-based attribute-based encryption technology, which makes this solution more effective in improving data confidentiality without affecting neural network model training.(3)
We analyse the security of the scheme in a real deployment.The remainder of the paper is organized as follows. After introducing the related work in Section2, we provide related technologies used in this paper in Section 3. Section 4 describes the design of our scheme. We analyse security and effectiveness of our scheme in Section 5. Finally, Section 6 concludes this study.


## 2. Related Work

Although deep learning has brought great convenience to human life, its application is inseparable from data. If some IoT data involves the user’s private information, once it is leaked, it will cause property and life safety issues. More and more solutions [31–34] are proposed to solve data security issues, which are implemented by not directly processing data. In addition, people can also protect their privacy by processing data. Lv et al. [35] proposed a secure transaction framework based on the blockchain, which uses the encryption mechanism of the blockchain to ensure information security, but it does not achieve fine-grained access control. Lindell et al. [36] proposed that two parties can process data sets collaboratively without revealing their privacy. Agrawal et al. [37] proposed a scheme that implements the function of outsourcing data to others for data mining tasks. This scheme is confirmed that it does not reveal the data owner’s private information during the outsourcing process. Homomorphic encryption technology is considered to be the most effective and most direct means of protecting user privacy [38]. It can directly perform operations, and the results can be consistent with the results of plaintext operations. In 2007, Orlandi et al. [39] introduced homomorphic encryption technology and multiparty secure computing technology to feed the encrypted data into the neural network model for training, which not only ensured the consistency of the plaintext and ciphertext calculation results but also considered security. In [40], the authors proposed a neural network model that uses encrypted data for training. At the same time, in this scheme, it is also proved that cloud services can be used to put encrypted data into the neural network for prediction operations, and the results are returned from the cloud in the form of ciphertext. In [41], the authors improved the scheme [40] and proved that encrypted data can also train neural networks.In addition to directly encrypting big data, there are also many solutions for setting access control to the data protection layer. In [42], the author created the first CP-ABE solutions, the access policy and ciphertext are sent to the receiver together. Due to the existence of user or attribute revocation problems, research on revocation of ABE has always received extensive attention. Shi et al. [43] proposed a scheme under a hierarchical cryptosystem. Once the attributes are revoked, the public key, private key, and ciphertext of the scheme need to be updated, so the revoking efficiency of this scheme is not high. In [44, 45], the authors pointed out that the private key can be divided into two parts. If the attribute is revoked, the two keys need to be updated, and it is necessary to reencrypt the ciphertext and header files, so the cost of revocation is relatively large. In [46], the authors proposed a user revocation scheme based on a time limit, but it did not achieve fine-grained attribute revocation. In [47], the authors proposed a scheme for using smart contracts to revoke attributes. In addition to these revocation schemes, the purpose of revocation can also be realized by limiting the number of user visits. In [48], the authors proposed a scheme that decryption frequency can be limited. But the function of this scheme is a bit single. While sharing IoT big data that can be used for neural network training, users can adopt a scheme that combines homomorphic encryption and CP-ABE. The solution proposed in [49] has proved that combining the two technologies in such scenarios can not only reduce the risk of data leakage but also reduce the number of key communications. However, in the field of deep learning-assisted IoT applications, there are very few solutions that can combine these technologies to limit user access time and specify the number of user accesses.


## 3. Preliminaries

### 3.1. Bilinear Maps

Suppose there is a large prime numberp and two cyclic groups G1 and G2, their orders are both p, and g is a generator of G1. Then, there is a mapping e:G1×G1⟶G2 from G1 to G2, and it has the following properties [50]:(1)
Bilinearity:ega,gb=egb,ga=eg,gab for ∀a,b∈Zp∗ and ∀u,v∈G1(2)
Nondegeneracy: there existsx,y∈G1, such that ex,y≠1, where 1 is the identity element of group G2(3)
Computability: for∀u,v∈G1,eu,v can be calculated by an effective algorithm.Then, we call the above mappinge a bilinear mapping. In general, the cyclic group G1 is an additive cyclic group, and the cyclic group G2 is a multiplicative cyclic group.


### 3.2. Diffie-Hellman Problem

For the additive cyclic groupG1 in the above bilinear map e, there are the following difficult problems in cryptography and discrete mathematics, various cryptosystems based on bilinear mapping are built on the basis of these difficult problems.Definition 1 (discrete logarithm problem (DL)).
If there are any two elementsg and Y, g∈G1, Y∈G1, and satisfy Y=gk, where k∈Zp∗, it is difficult to calculate the value of k.Definition 2 (computational Diffie-Hellman problem (CDH)).
Given that a triplet isg,ga,gb, where g is a generator of group G1, a,b∈Zp∗, it is difficult to calculate the value of gab.Definition 3 (decisional Diffie-Hellman problem (DDH)).
If there is a four-tupleg,ga,gb,gc, where g is a generator, a,b,c∈Zp∗, it is difficult to determine whether c=abmodp is true.Because the above three types of problems are based on groupG1, they are all regarded as group G1 problems.


### 3.3. DBDH Assumption

Given that a five-tuple is [g,ga,gb,gc,Z], where g is a generator of group G1, a,b,c∈RZP, Z∈G2, it is difficult to determine whether Z=eg,gabc is true.


### 3.4. Access Structure

The structure is a set of judgment conditions, usually expressed asΓ, which contains several attribute elements in the attribute set A and threshold logic operators (such as OR and AND). If there is an attribute set that satisfies the judgment condition, this attribute set is called an authorized set, otherwise, we called it an unauthorized set. Let P=P1,P2,⋯,Pn be the entity set of n participants. For ∀B,C, if B∈C and B⊆C, there is C∈A, then, the set A⊆2P1,P2,⋯,Pn is monotonous. An access structure is a nonempty subset of {P1,P2,⋯,Pn}, namely, A⊆2P1,P2,⋯,Pn\{ϕ}. In this proposed solution, the identity information of each user can be described by multiple attributes, such as company, department, and position, which are all his attributes.


### 3.5. Secure Two-Party Computing Protocol

A secure two-party computing protocol [51–53] means that in a network environment with a low safety factor, two participants can obtain the value of a function after collaborative calculation. Then, they can also obtain the desired value from each other according to this agreement. However, apart from knowing the value of oneself, other information cannot be derived. Through this agreement, it can be ensured that the privacy of the participants themselves will not be leaked when they do not trust each other, which improves program security.


### 3.6. Homomorphic Encryption

DefinitionEk,a means using an encryption algorithm to encrypt a, the key is k, and F means a certain algorithm of homomorphic encryption, if there is an effective algorithm I, it can be satisfied: Ek,Fa1,a2,⋯,an=Ik,FEa1,Ea2,⋯,Ean. It means that E is homomorphic to F.


## 3.1. Bilinear Maps

Suppose there is a large prime numberp and two cyclic groups G1 and G2, their orders are both p, and g is a generator of G1. Then, there is a mapping e:G1×G1⟶G2 from G1 to G2, and it has the following properties [50]:(1)
Bilinearity:ega,gb=egb,ga=eg,gab for ∀a,b∈Zp∗ and ∀u,v∈G1(2)
Nondegeneracy: there existsx,y∈G1, such that ex,y≠1, where 1 is the identity element of group G2(3)
Computability: for∀u,v∈G1,eu,v can be calculated by an effective algorithm.Then, we call the above mappinge a bilinear mapping. In general, the cyclic group G1 is an additive cyclic group, and the cyclic group G2 is a multiplicative cyclic group.


## 3.2. Diffie-Hellman Problem

For the additive cyclic groupG1 in the above bilinear map e, there are the following difficult problems in cryptography and discrete mathematics, various cryptosystems based on bilinear mapping are built on the basis of these difficult problems.Definition 1 (discrete logarithm problem (DL)).
If there are any two elementsg and Y, g∈G1, Y∈G1, and satisfy Y=gk, where k∈Zp∗, it is difficult to calculate the value of k.Definition 2 (computational Diffie-Hellman problem (CDH)).
Given that a triplet isg,ga,gb, where g is a generator of group G1, a,b∈Zp∗, it is difficult to calculate the value of gab.Definition 3 (decisional Diffie-Hellman problem (DDH)).
If there is a four-tupleg,ga,gb,gc, where g is a generator, a,b,c∈Zp∗, it is difficult to determine whether c=abmodp is true.Because the above three types of problems are based on groupG1, they are all regarded as group G1 problems.


## 3.3. DBDH Assumption

Given that a five-tuple is [g,ga,gb,gc,Z], where g is a generator of group G1, a,b,c∈RZP, Z∈G2, it is difficult to determine whether Z=eg,gabc is true.


## 3.4. Access Structure

The structure is a set of judgment conditions, usually expressed asΓ, which contains several attribute elements in the attribute set A and threshold logic operators (such as OR and AND). If there is an attribute set that satisfies the judgment condition, this attribute set is called an authorized set, otherwise, we called it an unauthorized set. Let P=P1,P2,⋯,Pn be the entity set of n participants. For ∀B,C, if B∈C and B⊆C, there is C∈A, then, the set A⊆2P1,P2,⋯,Pn is monotonous. An access structure is a nonempty subset of {P1,P2,⋯,Pn}, namely, A⊆2P1,P2,⋯,Pn\{ϕ}. In this proposed solution, the identity information of each user can be described by multiple attributes, such as company, department, and position, which are all his attributes.


## 3.5. Secure Two-Party Computing Protocol

A secure two-party computing protocol [51–53] means that in a network environment with a low safety factor, two participants can obtain the value of a function after collaborative calculation. Then, they can also obtain the desired value from each other according to this agreement. However, apart from knowing the value of oneself, other information cannot be derived. Through this agreement, it can be ensured that the privacy of the participants themselves will not be leaked when they do not trust each other, which improves program security.


## 3.6. Homomorphic Encryption

DefinitionEk,a means using an encryption algorithm to encrypt a, the key is k, and F means a certain algorithm of homomorphic encryption, if there is an effective algorithm I, it can be satisfied: Ek,Fa1,a2,⋯,an=Ik,FEa1,Ea2,⋯,Ean. It means that E is homomorphic to F.


## 4. The Proposed System

### 4.1. System Solution

In our proposed solution, there exist six types of entities: IoT device, cloud server, data user, attribute authorization centre, key generation centre, and time server. The scheme model is shown in Figure2.Figure 2
System model.From Figure2, we can know that the data owner can encrypt all kinds of data from IoT devices and upload the data to CSP. The access user makes an access request to the cloud server. Legitimate users can download document set from the cloud server and decrypt it. CSP and KGC jointly generate keys for users through continuous interaction. The time server is responsible for detecting whether the time sent to it by other entities has expired or has been forged or tampered with.


### 4.2. System Algorithms

We let groupG be a bilinear group, let g be a generator in group G. Let e:G×G⟶G1 be a bilinear mapping. We choose three hash functions in this scheme: H:0,1∗⟶G, so that each attribute can be mapped to the group, H1:G1⟶ZP∗, and H2:0,1∗⟶0,1∗. In addition, for any i∈ZP∗, an attribute set A, the Lagrangian coefficient is defined as ∆i,Ax=∏j∈A,j≠ix−j/i−j.(1)
Setupλ⟶PKKGC,MKKGC,PKCSP,MKCSP,PKsign,MKsign. First, the security parameter λ is used to generate three pairs of public and private keys, which are the key generation centre’s key pair PKKGC,MKKGC, the cloud server’s key pair PKCSP,MKCSP, and the public and private key pair for digital signature PKsign,MKsign. KGC randomly selects β∈RZP∗ and sets h=gβ, so (PKKGC=h,MKKGC=β). At the same time, KGC also selects a random number γ∈RZP∗, so that the public and private key pair used for digital signature is PKsign=gγ,MKsign=γ. CSP randomly selects α∈RZP∗, it sets (PKCSP=eg,gα, MKCSP=gα). Second, CSP allocates initialization information other than public and private keys for users accessing IoT data, including setting the unique identity of the ith user as ui, where ui∈ZP∗. A list L is stored in the cloud server, which contains the user’s unique mark ui, the number of user visits σ, and the state-related mark Kc. Third, KGC selects a random secret value rj∈ZP∗ for the user, and AAC selects a mark vi∈ZP∗ for each attribute. Therefore, the system public key is PK=G,g,h,f=g1/β,eg,gα, and the master key is MK=α,β. The initial value of σ is set to 0.(2)
KeyGenPK,MK,MKsign,A,Ui,st⟶SKut. In this part, the digital signature private key MKsign, the user’s attribute set A, and the attribute version key Ui, and outputs the user’s decryption key. The following four parts are included:(a)
Generate attribute version key. This part is executed by AAC. AAC randomly selects any valueti∈ZP∗ for each attribute, and ti is used as a parameter for subsequent use, so the attribute version key is set to Ui=viti, and the attribute version key is generated and sent to CSP.(b)
Generate partial user keys. This part is formed by the simultaneous operation of KGC and CSP via introducing a secure two-party computing protocol. First, KGC takes the parameters (rj,β) as input, and CSP takes the parameter α as input. Through calculation, x=α+rjβ is obtained, and the result is output to CSP. CSP selects a random number δ∈ZP∗, calculates A=gxδ=gα+rjβδ, and sends the calculation result to KGC. When KGC receives the result, calculate B=A1/β2=gα+rjβδ1/β2=gα+rjδ/β, and finally, the result B is sent to CSP. CSP calculates SKC=B1/δ=gα+rj/β from the received result B. KGC inputs the set attribute version key and outputs partial user’s private key (SKk=∀λ∈A,Dλ=grjHλUi,Dλ∗=gUi). The partial user’s decryption key is composed of a combination of the private key generated by CSP and KGC: SK=SKC,SKk=D=gα+rj/β,∀λ∈A,Dλ=grj·HλUi,Dλ∗=gUi(c)
In this part of the algorithm,Kp=g1/H2st+ui, Kc=E1/H2st+ui,Kc is the output value of the algorithm VRF [54], Kp,Kc refer to the calculation and detection scheme of the algorithm VRF. Therefore, the final decryption key is SKut=SK,st,Kc,Kp=D=gα+rj/β,∀λ∈A,Dλ=grj·HλUi,Dλ∗=gUi,st,Kc,Kp, the generated decryption key is sent to the user.(d)
Set the expiration timeTt for each attribute and digitally sign Ttξ=g1/H2Tt+γ.(3)
HKeyGen (). This algorithm generates the key of a homomorphic encryption algorithm. This scheme uses the DGHV encryption algorithm. In this algorithm, the key is selected as follows: we choose a randomly generated positive prime number as the keyp, where p∈2η2−1,2η2.(4)
EncryptionPK,Γ,M,p⟶CT∗. This algorithm first inputs the system public key and access policy tree Γ, homomorphic encryption key p, and plaintext message M. Then, this algorithm outputs encrypted ciphertext CT∗. First, the data owner uses the homomorphic encryption key p to encrypt the plaintext M. The specific operation is as follows: they choose two random numbers q,r, where p∈2ηs−1,2ηs,r∈2η−1,2η, p/2>2r,q≫p. The ciphertext of the document set is calculated by formula pq+2r+M, M is expressed in binary, and the generated ciphertext is uploaded. Second, the data owner encrypts the homomorphic key and uploads the key with attribute access control to the cloud. The data owner regards the attributes as leaf nodes, the root node of the tree is R, and the other nodes are threshold logic operators. The encryption operation performs from the root node and, from top to bottom, produces a linked order for each node, which is dx polynomial qx. If nx is the threshold of nonleaf nodes, then there is a relation dx=nx−1. Then, they select a random value s∈ZP∗, set the polynomial on the root node to qR0=s, and use the homomorphic encryption key p to encrypt the plaintext, and use the encryption result to calculate C=Encp·eg,gαs,C^=hs. Let the polynomial of other nodes be qx0=qpxindexx, where indexx represents the number associated with any node x. The order of nodes is indicated from left to right. In the entire access policy tree, the information carried by each leaf node must be calculated, Cλ=gqλ0, Cλ∗=Hλqλ0. Then, the final CT∗ is CT∗=Γ,C=Encp·eg,gαs,C^=hs,∀λ∈J:Cλ=gqλ0,Cλ∗=Hλqλ0.(5)
TimeCheckSKut,S,Tt,ξ,PKsign. In this part of the algorithm, after the time server receives the validity period of the attribute, it first needs to verify it with digital signature technology to check whether it has been forged or tampered with and verify it with the following calculation method:(1)egH2Tt·PKsign,ξ=egH2Tt·gγ,g1/H2Tt+γ=egH2Tt+γ,g1/H2Tt+γ=eg,g.If the verification is successful, it means that the attribute has not been forged or tampered with. The time server compares the validity periodTt with the present time to determine whether the attribute has exceeded the validity period. If it has not expired, you need to continue to execute step 6. If it expires, the attribute needs to be revoked. On the contrary, if the verification fails, it means that the validity period Tt has been maliciously modified, then return ⊥.(6)
GenTokenui,st,ctrmax⟶BT: after verifying the attribute validity period Tt, it also needs to verify the user’s access times, but the difference is that even if a certain attribute fails, the user still has the possibility of access rights, but if the access times exceed the set threshold, then the user does not have the right to access IoT resource data. This algorithm makes the user’s unique identity ui, the user’s current state st, and the maximum allowed number of decryption ctrmax into a token and sends the token to the cloud server.(7)
PredecryptionSKut,BT⟶timeindex. In this part, the cloud server first detects egH2st∗gui,Kp=E and Kc=eg,Kp after receiving the token with information. If it meets the verification conditions, CSP will detect the number of decryption σ+1≤ctrmax in the list L, if it is satisfied, let σ=σ+1, update Kc at this time and store it in the list L, and then, the user and CSP continue to perform step 8. Then, let timeindex=1, otherwise, timeindex=⊥. If timeindex=⊥, it means accessing users can no longer access IoT big data even if they have access rights.(8)
DecryptionSKut,CT∗⟶p. This part of the algorithm is executed by the decryption user and is divided into the following four parts:(a)
When the nodex in the access policy tree belongs to the leaf node in the access policy tree, let i=attx, it means that the attribute corresponding to the node x computes(2)DecryptNodeSKut,CT∗,x=eDi,CxeDi∗,Cx∗=eg,gqx0rj+Uieg,gqx0Ui=eg,grjqx0.If the attribute is not in the user’s attribute set, return⊥.(b)
Whenλ belongs to a nonleaf node in the structure tree, we let Sx be the set of child nodes of each node z of size kx. When Fz exists and the user’s current decryption frequency meet the requirements, then compute(3)Fx=∏z∈SxFztimeindex∆i,Sx′=∏z∈Sxeg,grjqz0∆i,Sx′=∏z∈Sxeg,grjqparentzindexz∆i,Sx′=eg,grjqλ0.If the root nodeR in this structure tree is replaced by the x node in the above formula, it can be computed as A=DecryptNodeSKut,CT∗,R=eg,grjs.(c)
When the user’s attribute set meets the requirements, decryption is performed:(4)DecCeC^,D/A=Deceg,gαs·Encpehs,gα+rj/β/eg,grjs=Deceg,gαs·EncMehs,gα+rj/β/eg,grjs=Deceg,gαs·EncMeg,gαs=p(d)
After the data visitor obtains the homomorphic keyp, users can obtain the document set by using the homomorphic key p.(9)
Revocation. When the attribute is revoked, this algorithm is executed. In the algorithm, it consists of three parts:(a)
First, KGC randomly selects a reencryption parameterψ, which is assigned to AAC, CSP, and users whose attributes have been revoked, so that they can update relevant component information in time. Receiving the update information, AAC updates the attribute version keys Ui′ of the revoked attributes that it manages, Ui′=viti′.(b)
The next step is to update the user key. CSP obtains the reencryption parameters allocated in the previous step and regenerates the user’s latest version key together with KGC. The updated user key isSKut=D=gα+rj/β,Dλ′=grj·HψλUi′,Dλ′∗=gUi′,∀λ∈A\λ′:Dλ=grj·HλUi,Dλ∗=gUi,st,Kc,Kp.(c)
The third step is to update the ciphertext. In this part, CSP first selects a random cipher values′∈ZP∗ to ensure forward security and then updates the relevant components of the ciphertext after receiving the reencryption parameters. The updated ciphertext is(5)CT∗=Γ,C=eg,gαs+s′·EnckM,C^=hs+s′,∀λ∈J:Cλ=gqλ0+s′,Cλ∗=Hψλqλ0+s′λ=λ′,Cλ∗=Hλqλ0+s′λ≠λ′


## 4.1. System Solution

In our proposed solution, there exist six types of entities: IoT device, cloud server, data user, attribute authorization centre, key generation centre, and time server. The scheme model is shown in Figure2.Figure 2
System model.From Figure2, we can know that the data owner can encrypt all kinds of data from IoT devices and upload the data to CSP. The access user makes an access request to the cloud server. Legitimate users can download document set from the cloud server and decrypt it. CSP and KGC jointly generate keys for users through continuous interaction. The time server is responsible for detecting whether the time sent to it by other entities has expired or has been forged or tampered with.


## 4.2. System Algorithms

We let groupG be a bilinear group, let g be a generator in group G. Let e:G×G⟶G1 be a bilinear mapping. We choose three hash functions in this scheme: H:0,1∗⟶G, so that each attribute can be mapped to the group, H1:G1⟶ZP∗, and H2:0,1∗⟶0,1∗. In addition, for any i∈ZP∗, an attribute set A, the Lagrangian coefficient is defined as ∆i,Ax=∏j∈A,j≠ix−j/i−j.(1)
Setupλ⟶PKKGC,MKKGC,PKCSP,MKCSP,PKsign,MKsign. First, the security parameter λ is used to generate three pairs of public and private keys, which are the key generation centre’s key pair PKKGC,MKKGC, the cloud server’s key pair PKCSP,MKCSP, and the public and private key pair for digital signature PKsign,MKsign. KGC randomly selects β∈RZP∗ and sets h=gβ, so (PKKGC=h,MKKGC=β). At the same time, KGC also selects a random number γ∈RZP∗, so that the public and private key pair used for digital signature is PKsign=gγ,MKsign=γ. CSP randomly selects α∈RZP∗, it sets (PKCSP=eg,gα, MKCSP=gα). Second, CSP allocates initialization information other than public and private keys for users accessing IoT data, including setting the unique identity of the ith user as ui, where ui∈ZP∗. A list L is stored in the cloud server, which contains the user’s unique mark ui, the number of user visits σ, and the state-related mark Kc. Third, KGC selects a random secret value rj∈ZP∗ for the user, and AAC selects a mark vi∈ZP∗ for each attribute. Therefore, the system public key is PK=G,g,h,f=g1/β,eg,gα, and the master key is MK=α,β. The initial value of σ is set to 0.(2)
KeyGenPK,MK,MKsign,A,Ui,st⟶SKut. In this part, the digital signature private key MKsign, the user’s attribute set A, and the attribute version key Ui, and outputs the user’s decryption key. The following four parts are included:(a)
Generate attribute version key. This part is executed by AAC. AAC randomly selects any valueti∈ZP∗ for each attribute, and ti is used as a parameter for subsequent use, so the attribute version key is set to Ui=viti, and the attribute version key is generated and sent to CSP.(b)
Generate partial user keys. This part is formed by the simultaneous operation of KGC and CSP via introducing a secure two-party computing protocol. First, KGC takes the parameters (rj,β) as input, and CSP takes the parameter α as input. Through calculation, x=α+rjβ is obtained, and the result is output to CSP. CSP selects a random number δ∈ZP∗, calculates A=gxδ=gα+rjβδ, and sends the calculation result to KGC. When KGC receives the result, calculate B=A1/β2=gα+rjβδ1/β2=gα+rjδ/β, and finally, the result B is sent to CSP. CSP calculates SKC=B1/δ=gα+rj/β from the received result B. KGC inputs the set attribute version key and outputs partial user’s private key (SKk=∀λ∈A,Dλ=grjHλUi,Dλ∗=gUi). The partial user’s decryption key is composed of a combination of the private key generated by CSP and KGC: SK=SKC,SKk=D=gα+rj/β,∀λ∈A,Dλ=grj·HλUi,Dλ∗=gUi(c)
In this part of the algorithm,Kp=g1/H2st+ui, Kc=E1/H2st+ui,Kc is the output value of the algorithm VRF [54], Kp,Kc refer to the calculation and detection scheme of the algorithm VRF. Therefore, the final decryption key is SKut=SK,st,Kc,Kp=D=gα+rj/β,∀λ∈A,Dλ=grj·HλUi,Dλ∗=gUi,st,Kc,Kp, the generated decryption key is sent to the user.(d)
Set the expiration timeTt for each attribute and digitally sign Ttξ=g1/H2Tt+γ.(3)
HKeyGen (). This algorithm generates the key of a homomorphic encryption algorithm. This scheme uses the DGHV encryption algorithm. In this algorithm, the key is selected as follows: we choose a randomly generated positive prime number as the keyp, where p∈2η2−1,2η2.(4)
EncryptionPK,Γ,M,p⟶CT∗. This algorithm first inputs the system public key and access policy tree Γ, homomorphic encryption key p, and plaintext message M. Then, this algorithm outputs encrypted ciphertext CT∗. First, the data owner uses the homomorphic encryption key p to encrypt the plaintext M. The specific operation is as follows: they choose two random numbers q,r, where p∈2ηs−1,2ηs,r∈2η−1,2η, p/2>2r,q≫p. The ciphertext of the document set is calculated by formula pq+2r+M, M is expressed in binary, and the generated ciphertext is uploaded. Second, the data owner encrypts the homomorphic key and uploads the key with attribute access control to the cloud. The data owner regards the attributes as leaf nodes, the root node of the tree is R, and the other nodes are threshold logic operators. The encryption operation performs from the root node and, from top to bottom, produces a linked order for each node, which is dx polynomial qx. If nx is the threshold of nonleaf nodes, then there is a relation dx=nx−1. Then, they select a random value s∈ZP∗, set the polynomial on the root node to qR0=s, and use the homomorphic encryption key p to encrypt the plaintext, and use the encryption result to calculate C=Encp·eg,gαs,C^=hs. Let the polynomial of other nodes be qx0=qpxindexx, where indexx represents the number associated with any node x. The order of nodes is indicated from left to right. In the entire access policy tree, the information carried by each leaf node must be calculated, Cλ=gqλ0, Cλ∗=Hλqλ0. Then, the final CT∗ is CT∗=Γ,C=Encp·eg,gαs,C^=hs,∀λ∈J:Cλ=gqλ0,Cλ∗=Hλqλ0.(5)
TimeCheckSKut,S,Tt,ξ,PKsign. In this part of the algorithm, after the time server receives the validity period of the attribute, it first needs to verify it with digital signature technology to check whether it has been forged or tampered with and verify it with the following calculation method:(1)egH2Tt·PKsign,ξ=egH2Tt·gγ,g1/H2Tt+γ=egH2Tt+γ,g1/H2Tt+γ=eg,g.If the verification is successful, it means that the attribute has not been forged or tampered with. The time server compares the validity periodTt with the present time to determine whether the attribute has exceeded the validity period. If it has not expired, you need to continue to execute step 6. If it expires, the attribute needs to be revoked. On the contrary, if the verification fails, it means that the validity period Tt has been maliciously modified, then return ⊥.(6)
GenTokenui,st,ctrmax⟶BT: after verifying the attribute validity period Tt, it also needs to verify the user’s access times, but the difference is that even if a certain attribute fails, the user still has the possibility of access rights, but if the access times exceed the set threshold, then the user does not have the right to access IoT resource data. This algorithm makes the user’s unique identity ui, the user’s current state st, and the maximum allowed number of decryption ctrmax into a token and sends the token to the cloud server.(7)
PredecryptionSKut,BT⟶timeindex. In this part, the cloud server first detects egH2st∗gui,Kp=E and Kc=eg,Kp after receiving the token with information. If it meets the verification conditions, CSP will detect the number of decryption σ+1≤ctrmax in the list L, if it is satisfied, let σ=σ+1, update Kc at this time and store it in the list L, and then, the user and CSP continue to perform step 8. Then, let timeindex=1, otherwise, timeindex=⊥. If timeindex=⊥, it means accessing users can no longer access IoT big data even if they have access rights.(8)
DecryptionSKut,CT∗⟶p. This part of the algorithm is executed by the decryption user and is divided into the following four parts:(a)
When the nodex in the access policy tree belongs to the leaf node in the access policy tree, let i=attx, it means that the attribute corresponding to the node x computes(2)DecryptNodeSKut,CT∗,x=eDi,CxeDi∗,Cx∗=eg,gqx0rj+Uieg,gqx0Ui=eg,grjqx0.If the attribute is not in the user’s attribute set, return⊥.(b)
Whenλ belongs to a nonleaf node in the structure tree, we let Sx be the set of child nodes of each node z of size kx. When Fz exists and the user’s current decryption frequency meet the requirements, then compute(3)Fx=∏z∈SxFztimeindex∆i,Sx′=∏z∈Sxeg,grjqz0∆i,Sx′=∏z∈Sxeg,grjqparentzindexz∆i,Sx′=eg,grjqλ0.If the root nodeR in this structure tree is replaced by the x node in the above formula, it can be computed as A=DecryptNodeSKut,CT∗,R=eg,grjs.(c)
When the user’s attribute set meets the requirements, decryption is performed:(4)DecCeC^,D/A=Deceg,gαs·Encpehs,gα+rj/β/eg,grjs=Deceg,gαs·EncMehs,gα+rj/β/eg,grjs=Deceg,gαs·EncMeg,gαs=p(d)
After the data visitor obtains the homomorphic keyp, users can obtain the document set by using the homomorphic key p.(9)
Revocation. When the attribute is revoked, this algorithm is executed. In the algorithm, it consists of three parts:(a)
First, KGC randomly selects a reencryption parameterψ, which is assigned to AAC, CSP, and users whose attributes have been revoked, so that they can update relevant component information in time. Receiving the update information, AAC updates the attribute version keys Ui′ of the revoked attributes that it manages, Ui′=viti′.(b)
The next step is to update the user key. CSP obtains the reencryption parameters allocated in the previous step and regenerates the user’s latest version key together with KGC. The updated user key isSKut=D=gα+rj/β,Dλ′=grj·HψλUi′,Dλ′∗=gUi′,∀λ∈A\λ′:Dλ=grj·HλUi,Dλ∗=gUi,st,Kc,Kp.(c)
The third step is to update the ciphertext. In this part, CSP first selects a random cipher values′∈ZP∗ to ensure forward security and then updates the relevant components of the ciphertext after receiving the reencryption parameters. The updated ciphertext is(5)CT∗=Γ,C=eg,gαs+s′·EnckM,C^=hs+s′,∀λ∈J:Cλ=gqλ0+s′,Cλ∗=Hψλqλ0+s′λ=λ′,Cλ∗=Hλqλ0+s′λ≠λ′


## 5. Safety and Efficiency Analysis

### 5.1. Solution Security Analysis

#### 5.1.1. Confidentiality

The confidentiality of this scheme is achieved through two aspects. On the one hand, the attributes of the user must be able to meet the policy set by data owner. If the access policy is not met, then the attributes cannot be used to calculateeg,grjs, so it can prevent unauthorized users from stealing sensitive data. On the other hand, while generating the user’s key, to reduce the condition impact of low safety factor and untrustworthy, a secure two-party computing protocol is used to protect the related information of the private key from being obtained by anyone other than itself.


#### 5.1.2. Forward Security

Since each user is set to limit decryption frequency, when users access data, if they meet the requirements of the access policy, they also need to send a token carrying the number of times of decryption to the cloud server. If the number of accesses exceeds the limit, then the user can no longer be decrypted, which ensures forward security.


#### 5.1.3. Collusion Resistance

Users need to use their own attributes to calculateeg,grjs. If users with different permissions want to create a conspiracy attack, then KGC and CSP will generate partial decryption keys through a secure two-party calculation protocol D=gα+rj/β,Dλ=grj·HλUi,Dλ∗=gUi, where ui is a unique random value for each user, so even if the attackers collude, they cannot calculate the value of eg,grjs.


#### 5.1.4. Chosen-Plaintext Attack

Proof.
We consider that there exists a polynomial adversaryA that is able to break this solution and algorithm B that can overcome the DBDH problem with the advantage of ε.
Initialization: adversaryA selects an access structure tree Τ and sends this access strategy tree to challenger B, and challenger B executes the Setup () initialization algorithm. This part of the process is as follows:
Randomly select four values to calculateeg,gabeg,gx=eg,gα, where a,b,c,xϵZP∗.
For each attributeλϵA, select a random value ℓiϵZP∗, when the attribute does not exist in the access structure tree T, we set Yi=H1/ℓi, yi=b/ℓi, if the attribute exists in the access structure tree T, we let Yi=gℓi and yi=ℓi.
The public keyPK=G,h,g,f=g1/β,eg,gα is published, and challenger B keeps the private key MK=α,β.
Phase 1: after challengerB obtains the public key, adversary A can issue a query request. Adversary A selects an attribute set s=λi∣λi∈T and ui and submits the information to challenger B to apply for a private key. Challenger B randomly selects ri,Ui generates the corresponding private key. The calculation process is as follows:(6)SK=D=gab+x+rj/β,Dλ=grj·HλUi,Dλ∗=gUi.
If the number of decryptions meets the requirements,st,Kc,Kp will not affect the final decryption effect.
Challenge: adversaryA has obtained the access control tree Τ at this time and then submits two plaintexts of the same length to challenger B. By comparing the attribute sets, if the attribute set sent in the previous step does not meet the structure tree Τ, then the two plaintexts are set to m0,m1, and the two plaintexts are sent to challenger B along with the access strategy tree. Then, B randomly selects p∈a,b, calculate:(7)C0=EncMp·eg,gαs=EncMp·eg,gab+xs=EncMp·eg,gabseg,gxs=EncMp·eg,gabs·egx,gs,C0~=hs,∀λ∈J:Cλ~=gqλ0,Cλ∗~=Hλqλ0.
ChallengerB sends this information to A.
Phase 2:A can always ask B for private key-related information, and then, A guesses the ciphertext and needs to give his own guess value p′.
Guess: ifp′=p′, then DBDH is established, the advantage is prp′=p′∣eg,gabc=ε+1/2, if p′≠p′, the ciphertext cannot be judged, and the advantage is prp′≠p′∣eg,gϑ=1/2. In summary, prg,ga,gb,gc,eg,gabc=1−prg,ga,gb,gc,eg,gϑ=1≥ε. It shows that this scheme can realize that no adversary can break the scheme with a nonnegligible advantage in polynomial time.


### 5.2. Theoretical Comparison

Our scheme is compared with other schemes in terms of revocation mechanism, time limit, number of decryption limits, and anticollusion. The comparison results are shown in Table1.Table 1
Functional comparison.
SchemesRevocabilityTimeNumberCollusionCiphertext operability[55]User and attribute××✓×[46]User✓×✓×[48]User×✓✓×[47]Attribute✓×✓×[49]None××✓✓[56]Attribute××✓×Our schemeUser and attribute✓✓✓✓From Table1, it can be seen that in [46–49, 56], the revocation schemes proposed by the authors do not fully meet the revocation needs. Although in [55] the authors proposed a scheme that can support user revocation and attribute revocation, in the scenario we mentioned, it is also a requirement that the ciphertext can be operated. This scheme in [49] realizes that users can operate on ciphertext, but it is not suitable for scenarios where attributes need to be revoked. Our scheme realizes two revocation functions, solves the basic system security problem, and achieves the ciphertext operable function. What is more, we also consider two factors: time and frequency of decryption.Our scheme is compared with other schemes in terms of key generation efficiency, decryption efficiency, and revocation efficiency.e is the exponential calculation cost, and p is the bilinear pair calculation cost. The comparison results are shown in Table 2.Table 2
Cost comparison.
SchemesSecret key costDecryption costRevocationUserCSPAttribute-costUser-cost[55]3e3p×3n+1pnp[56]4e×ee×Our schemeO5nOnOnO5nO1It can be seen that in [55] only the user performs the decryption operation and in [56] only CSP performs the decryption operation, which will cause one-side pressure. Our scheme can effectively reduce the amount of user tasks by placing part of the decryption task on the cloud server. Also, in [55], while realizing user revocation, the cost is np. However, in our scheme, if the user is revoked after judgment, the user only needs to be removed from the list L, thus, its computational complexity is better than the schemes [55, 56]. Although the cost of generating the key is relatively high due to the use of a two-party security protocol, the security of the key is guaranteed through this multiparty cooperation method.


## 5.1. Solution Security Analysis

### 5.1.1. Confidentiality

The confidentiality of this scheme is achieved through two aspects. On the one hand, the attributes of the user must be able to meet the policy set by data owner. If the access policy is not met, then the attributes cannot be used to calculateeg,grjs, so it can prevent unauthorized users from stealing sensitive data. On the other hand, while generating the user’s key, to reduce the condition impact of low safety factor and untrustworthy, a secure two-party computing protocol is used to protect the related information of the private key from being obtained by anyone other than itself.


### 5.1.2. Forward Security

Since each user is set to limit decryption frequency, when users access data, if they meet the requirements of the access policy, they also need to send a token carrying the number of times of decryption to the cloud server. If the number of accesses exceeds the limit, then the user can no longer be decrypted, which ensures forward security.


### 5.1.3. Collusion Resistance

Users need to use their own attributes to calculateeg,grjs. If users with different permissions want to create a conspiracy attack, then KGC and CSP will generate partial decryption keys through a secure two-party calculation protocol D=gα+rj/β,Dλ=grj·HλUi,Dλ∗=gUi, where ui is a unique random value for each user, so even if the attackers collude, they cannot calculate the value of eg,grjs.


### 5.1.4. Chosen-Plaintext Attack

Proof.
We consider that there exists a polynomial adversaryA that is able to break this solution and algorithm B that can overcome the DBDH problem with the advantage of ε.
Initialization: adversaryA selects an access structure tree Τ and sends this access strategy tree to challenger B, and challenger B executes the Setup () initialization algorithm. This part of the process is as follows:
Randomly select four values to calculateeg,gabeg,gx=eg,gα, where a,b,c,xϵZP∗.
For each attributeλϵA, select a random value ℓiϵZP∗, when the attribute does not exist in the access structure tree T, we set Yi=H1/ℓi, yi=b/ℓi, if the attribute exists in the access structure tree T, we let Yi=gℓi and yi=ℓi.
The public keyPK=G,h,g,f=g1/β,eg,gα is published, and challenger B keeps the private key MK=α,β.
Phase 1: after challengerB obtains the public key, adversary A can issue a query request. Adversary A selects an attribute set s=λi∣λi∈T and ui and submits the information to challenger B to apply for a private key. Challenger B randomly selects ri,Ui generates the corresponding private key. The calculation process is as follows:(6)SK=D=gab+x+rj/β,Dλ=grj·HλUi,Dλ∗=gUi.
If the number of decryptions meets the requirements,st,Kc,Kp will not affect the final decryption effect.
Challenge: adversaryA has obtained the access control tree Τ at this time and then submits two plaintexts of the same length to challenger B. By comparing the attribute sets, if the attribute set sent in the previous step does not meet the structure tree Τ, then the two plaintexts are set to m0,m1, and the two plaintexts are sent to challenger B along with the access strategy tree. Then, B randomly selects p∈a,b, calculate:(7)C0=EncMp·eg,gαs=EncMp·eg,gab+xs=EncMp·eg,gabseg,gxs=EncMp·eg,gabs·egx,gs,C0~=hs,∀λ∈J:Cλ~=gqλ0,Cλ∗~=Hλqλ0.
ChallengerB sends this information to A.
Phase 2:A can always ask B for private key-related information, and then, A guesses the ciphertext and needs to give his own guess value p′.
Guess: ifp′=p′, then DBDH is established, the advantage is prp′=p′∣eg,gabc=ε+1/2, if p′≠p′, the ciphertext cannot be judged, and the advantage is prp′≠p′∣eg,gϑ=1/2. In summary, prg,ga,gb,gc,eg,gabc=1−prg,ga,gb,gc,eg,gϑ=1≥ε. It shows that this scheme can realize that no adversary can break the scheme with a nonnegligible advantage in polynomial time.


## 5.1.1. Confidentiality

The confidentiality of this scheme is achieved through two aspects. On the one hand, the attributes of the user must be able to meet the policy set by data owner. If the access policy is not met, then the attributes cannot be used to calculateeg,grjs, so it can prevent unauthorized users from stealing sensitive data. On the other hand, while generating the user’s key, to reduce the condition impact of low safety factor and untrustworthy, a secure two-party computing protocol is used to protect the related information of the private key from being obtained by anyone other than itself.


## 5.1.2. Forward Security

Since each user is set to limit decryption frequency, when users access data, if they meet the requirements of the access policy, they also need to send a token carrying the number of times of decryption to the cloud server. If the number of accesses exceeds the limit, then the user can no longer be decrypted, which ensures forward security.


## 5.1.3. Collusion Resistance

Users need to use their own attributes to calculateeg,grjs. If users with different permissions want to create a conspiracy attack, then KGC and CSP will generate partial decryption keys through a secure two-party calculation protocol D=gα+rj/β,Dλ=grj·HλUi,Dλ∗=gUi, where ui is a unique random value for each user, so even if the attackers collude, they cannot calculate the value of eg,grjs.


## 5.1.4. Chosen-Plaintext Attack

Proof.
We consider that there exists a polynomial adversaryA that is able to break this solution and algorithm B that can overcome the DBDH problem with the advantage of ε.
Initialization: adversaryA selects an access structure tree Τ and sends this access strategy tree to challenger B, and challenger B executes the Setup () initialization algorithm. This part of the process is as follows:
Randomly select four values to calculateeg,gabeg,gx=eg,gα, where a,b,c,xϵZP∗.
For each attributeλϵA, select a random value ℓiϵZP∗, when the attribute does not exist in the access structure tree T, we set Yi=H1/ℓi, yi=b/ℓi, if the attribute exists in the access structure tree T, we let Yi=gℓi and yi=ℓi.
The public keyPK=G,h,g,f=g1/β,eg,gα is published, and challenger B keeps the private key MK=α,β.
Phase 1: after challengerB obtains the public key, adversary A can issue a query request. Adversary A selects an attribute set s=λi∣λi∈T and ui and submits the information to challenger B to apply for a private key. Challenger B randomly selects ri,Ui generates the corresponding private key. The calculation process is as follows:(6)SK=D=gab+x+rj/β,Dλ=grj·HλUi,Dλ∗=gUi.
If the number of decryptions meets the requirements,st,Kc,Kp will not affect the final decryption effect.
Challenge: adversaryA has obtained the access control tree Τ at this time and then submits two plaintexts of the same length to challenger B. By comparing the attribute sets, if the attribute set sent in the previous step does not meet the structure tree Τ, then the two plaintexts are set to m0,m1, and the two plaintexts are sent to challenger B along with the access strategy tree. Then, B randomly selects p∈a,b, calculate:(7)C0=EncMp·eg,gαs=EncMp·eg,gab+xs=EncMp·eg,gabseg,gxs=EncMp·eg,gabs·egx,gs,C0~=hs,∀λ∈J:Cλ~=gqλ0,Cλ∗~=Hλqλ0.
ChallengerB sends this information to A.
Phase 2:A can always ask B for private key-related information, and then, A guesses the ciphertext and needs to give his own guess value p′.
Guess: ifp′=p′, then DBDH is established, the advantage is prp′=p′∣eg,gabc=ε+1/2, if p′≠p′, the ciphertext cannot be judged, and the advantage is prp′≠p′∣eg,gϑ=1/2. In summary, prg,ga,gb,gc,eg,gabc=1−prg,ga,gb,gc,eg,gϑ=1≥ε. It shows that this scheme can realize that no adversary can break the scheme with a nonnegligible advantage in polynomial time.


## 5.2. Theoretical Comparison

Our scheme is compared with other schemes in terms of revocation mechanism, time limit, number of decryption limits, and anticollusion. The comparison results are shown in Table1.Table 1
Functional comparison.
SchemesRevocabilityTimeNumberCollusionCiphertext operability[55]User and attribute××✓×[46]User✓×✓×[48]User×✓✓×[47]Attribute✓×✓×[49]None××✓✓[56]Attribute××✓×Our schemeUser and attribute✓✓✓✓From Table1, it can be seen that in [46–49, 56], the revocation schemes proposed by the authors do not fully meet the revocation needs. Although in [55] the authors proposed a scheme that can support user revocation and attribute revocation, in the scenario we mentioned, it is also a requirement that the ciphertext can be operated. This scheme in [49] realizes that users can operate on ciphertext, but it is not suitable for scenarios where attributes need to be revoked. Our scheme realizes two revocation functions, solves the basic system security problem, and achieves the ciphertext operable function. What is more, we also consider two factors: time and frequency of decryption.Our scheme is compared with other schemes in terms of key generation efficiency, decryption efficiency, and revocation efficiency.e is the exponential calculation cost, and p is the bilinear pair calculation cost. The comparison results are shown in Table 2.Table 2
Cost comparison.
SchemesSecret key costDecryption costRevocationUserCSPAttribute-costUser-cost[55]3e3p×3n+1pnp[56]4e×ee×Our schemeO5nOnOnO5nO1It can be seen that in [55] only the user performs the decryption operation and in [56] only CSP performs the decryption operation, which will cause one-side pressure. Our scheme can effectively reduce the amount of user tasks by placing part of the decryption task on the cloud server. Also, in [55], while realizing user revocation, the cost is np. However, in our scheme, if the user is revoked after judgment, the user only needs to be removed from the list L, thus, its computational complexity is better than the schemes [55, 56]. Although the cost of generating the key is relatively high due to the use of a two-party security protocol, the security of the key is guaranteed through this multiparty cooperation method.


## 6. Conclusions

Since important personal privacy may be leaked while storing and sharing IoT big data on the cloud, we have proposed an IoT big data privacy protection scheme based on time and decryption frequency limitation, the solution realizes the revocation within the time range and the revocation within the range of decryption times. The access control is set by the combination of homomorphic encryption and attribute-based encryption. In our scheme, legitimate users with a homomorphic encryption key can obtain the original data, and users without a homomorphic encryption key can perform operation training on the homomorphic ciphertext. Our scheme does not only affect the training of the neural network model but also improves the confidentiality of the data. At the same time, the security of the system is improved by introducing a secure two-party agreement. Through theoretical analysis, we found that our scheme realizes two revocation functions, solves the basic system security problem, and achieves the ciphertext operable function. While realizing user revocation, the computational complexity is preferable to other schemes. Besides, our scheme can effectively reduce the amount of user tasks by placing part of the decryption task on the cloud server. Therefore, our scheme can not only ensure safety but also improve efficiency. In the next step, we plan to combine the advantages of decentralization and anonymity of blockchain to protect big data in the Internet of Things in a distributed storage environment.



---

*Source: 5545648-2021-07-14.xml*