# Secure and Privacy-Preserving Data Sharing and Collaboration in Mobile Healthcare Social Networks of Smart Cities

Authors: Qinlong Huang; Licheng Wang; Yixian Yang
Journal: Security and Communication Networks
 (2017)

---

## Abstract

Mobile healthcare social networks (MHSN) integrated with connected medical sensors and cloud-based health data storage provide preventive and curative health services in smart cities. The fusion of social data together with real-time health data facilitates a novel paradigm of healthcare big data analysis. However, the collaboration of healthcare and social network service providers may pose a series of security and privacy issues. In this paper, we propose a secure health and social data sharing and collaboration scheme in MHSN. To preserve the data privacy, we realize secure and fine-grained health data and social data sharing with attribute-based encryption and identity-based broadcast encryption techniques, respectively, which allows patients to share their private personal data securely. In order to achieve enhanced data collaboration, we allow the healthcare analyzers to access both the reencrypted health data and the social data with authorization from the data owner based on proxy reencryption. Specifically, most of the health data encryption and decryption computations are outsourced from resource-constrained mobile devices to a health cloud, and the decryption of the healthcare analyzer incurs a low cost. The security and performance analysis results show the security and efficiency of our scheme.


---

## Body

## 1. Introduction

As an emerging paradigm, smart cities leverage a variety of promising techniques, such as Internet of Things, mobile communications, and big data analysis, to enable intelligent services and provide a comfortable life for local residents [1]. The smart city is an urbanized area where multiple sectors cooperate to achieve sustainable outcomes through the analysis of contextual, real-time information, which would produce massive opportunities for mobile healthcare social network (MHSN) [2]. MHSN extends the traditional centralized healthcare system, in which the patients stay at home or in hospital environment and the professional physicians in the healthcare center take responsibility of generating medical treatment. With the considerable development of wearable devices and body sensors in the smart city, MHSN serving as a mobile community platform for healthcare purposes improves healthcare efficiency and places great emphasis on social interactivities [3] and assists patients in dealing with certain emergency situations or helps in forwarding data and sharing patients’ feelings.Compared to traditional hospital-centric healthcare which not only lacks efficiency when dealing with identifying some serious diseases in early stages but also suffers from limited healthcare information [4], MHSN enables continuous health monitoring and timely diagnosis to the patients in the smart city. It relies on wearable devices and medical sensors to measure the patients’ health conditions and sends health data to the processing unit for doctors’ further diagnosis and analysis and provides easy access to a patient’s historical comprehensive health information. Additionally, the patients wearing body sensors continuously monitoring their health conditions are assumed to walk outside, moving from time to time and place to place [5]. However, MHSN may suffer from a series of security and privacy threats due to the vulnerabilities of personal health and social data. The collected private information is stored and processed in the honest but curious health and social cloud servers, which may be directly revealed during the storage and processing phases [6, 7]. Moreover, the adversary can intercept the sessions between patients to get their health and social data. Hence, the underlying security and privacy requirements, including confidentiality and access control, should be satisfied in MHSN [8–10].Intelligent healthcare is another functionality that can be realized in MHSN, which would provide efficient diagnosis and health condition warning by analyzing the infectiousness in real time, such as infectious diseases analysis [11]. As we know, infectious diseases could be rapidly spread in the population via human-to-human contact. An old-fashioned approach to prevent the spread of disease is to isolate the susceptible people for a certain period. However, this approach is always not satisfactory, since people having frequent contact or strong social relationships with a patient are more easily infected from the perspectives of biomedicine and sociology. In general, the spread of infectious diseases depends on users’ social contacts and health conditions in a high probability. Specifically, the effective infectious diseases analysis could take several key factors into consideration, that is, susceptibility of the infected patient and immunity strength of contacted user. However, the health and social data of patients are collected by multiple independent service providers, such as hospitals and social network vendors. Hence, the collaboration of these service providers is the key challenge of enabling this enhanced infection analysis in MHSN.


### 1.1. Our Techniques

In order to preserve the patient’s data privacy and achieve data availability, encryption techniques must be adopted to make both health and social data invisible to the untrusted cloud servers. Any users without the authorization of the data owner should not be able to access the personal health and social data, and the collaboration of different untrusted cloud servers should be achieved via an authorized entity. Otherwise, patients may not be willing to share their health and social data such that the infection analysis would be disabled. In fact, attribute-based encryption (ABE) and identity-based broadcast encryption (IBBE) are widely adopted encryption algorithms [12]. Particularly, CP-ABE is conceptually closer to traditional access control models, to enforce fine-grained access control of encrypted data. By using CP-ABE, health data can be protected with access policy, and only the people who possess a set of attributes that satisfy the access policy can access data. IBBE scheme is a cryptographic mechanism in which data owners could broadcast their encrypted data to multiple receivers at one time and the public key of the user can be regarded as any valid strings, such as the email, unique ID, and username. In combination, these two mechanisms can be used to implement data protection in healthcare systems and social networks. In this paper, we propose a secure health and social data sharing and collaboration scheme in MHSN. The main contributions of our scheme are as follows:(1)
We realize secure and privacy-preserving health data and social data sharing with attribute-based encryption and identity-based broadcast encryption techniques, respectively, which protects the private data confidentiality.(2)
We provide a secure data collaboration construction from different independent cloud servers based on proxy reencryption (PRE), which allows the healthcare analyzers authorized by the data owner to access the reencrypted health data and social data for enhanced data analysis.(3)
We outsource most of the health data encryption and decryption computations from resource-constrained mobile devices to a health cloud, and the decryption of the healthcare analyzer incurs low cost. The extensive security and performance analysis results show that our scheme is secure and efficient.


### 1.2. Organization

This paper is structured as follows: we review related work in Section2. We introduce the preliminaries in Section 3 and provide the system model, system definition, and security definition in Section 4. The detailed construction is given in Section 5. Then, we analyze the security and performance of our scheme in Sections 6 and 7, respectively. Finally, we conclude this paper in Section 8.


## 1.1. Our Techniques

In order to preserve the patient’s data privacy and achieve data availability, encryption techniques must be adopted to make both health and social data invisible to the untrusted cloud servers. Any users without the authorization of the data owner should not be able to access the personal health and social data, and the collaboration of different untrusted cloud servers should be achieved via an authorized entity. Otherwise, patients may not be willing to share their health and social data such that the infection analysis would be disabled. In fact, attribute-based encryption (ABE) and identity-based broadcast encryption (IBBE) are widely adopted encryption algorithms [12]. Particularly, CP-ABE is conceptually closer to traditional access control models, to enforce fine-grained access control of encrypted data. By using CP-ABE, health data can be protected with access policy, and only the people who possess a set of attributes that satisfy the access policy can access data. IBBE scheme is a cryptographic mechanism in which data owners could broadcast their encrypted data to multiple receivers at one time and the public key of the user can be regarded as any valid strings, such as the email, unique ID, and username. In combination, these two mechanisms can be used to implement data protection in healthcare systems and social networks. In this paper, we propose a secure health and social data sharing and collaboration scheme in MHSN. The main contributions of our scheme are as follows:(1)
We realize secure and privacy-preserving health data and social data sharing with attribute-based encryption and identity-based broadcast encryption techniques, respectively, which protects the private data confidentiality.(2)
We provide a secure data collaboration construction from different independent cloud servers based on proxy reencryption (PRE), which allows the healthcare analyzers authorized by the data owner to access the reencrypted health data and social data for enhanced data analysis.(3)
We outsource most of the health data encryption and decryption computations from resource-constrained mobile devices to a health cloud, and the decryption of the healthcare analyzer incurs low cost. The extensive security and performance analysis results show that our scheme is secure and efficient.


## 1.2. Organization

This paper is structured as follows: we review related work in Section2. We introduce the preliminaries in Section 3 and provide the system model, system definition, and security definition in Section 4. The detailed construction is given in Section 5. Then, we analyze the security and performance of our scheme in Sections 6 and 7, respectively. Finally, we conclude this paper in Section 8.


## 2. Related Work

Personal health records (PHRs) are the electronic records containing health and medical information of patients, which involves privacy information that patients are unwilling to disclose. Thus, the security and protection of PHR have been of great concern and a subject of research over the years [13]. Zhang et al. [14] proposed a PHR security and privacy preservation scheme by introducing consent-based access control, where the consent can only be generated by an authorized user based on PRE. Currently, there has been an increasing interest in applying ABE to protect PHR. ABE is a promising one-to-many cryptographic technique to realize flexible and fine-grained access control for sharing data [15], which was first introduced by Sahai and Waters as a new method for fuzzy identity-based encryption (IBE) [16]. It features a mechanism that enables access control over encrypted data using access policies and ascribed attributes among private keys and ciphertexts [17]. Narayan et al. [18] proposed an attribute-based infrastructure for PHR systems, where each patient’s PHR files are encrypted using a broadcast variant of ciphertext-policy ABE. Li et al. [19] proposed a novel ABE-based framework for patient-centric secure sharing of PHRs in cloud computing environments. Au et al. [20] designed a general framework for secure sharing of PHR in cloud with CP-ABE, and it deploys attribute-based PRE (ABPRE) mechanism so that the ciphertext for doctor A can be transformed to the ciphertext for doctor B. However, the main complaint in CP-ABE scheme is the high computation overhead brought about by its complex computation. This problem will become even worse in the face of resource-limited wearable devices or mobile sensors in MHSN, since it needs to perform burdensome computation tasks for fine-grained data access control when adopting the ABE algorithm. In order to reduce the computational overheads, Liu et al. [21] proposed an outsourced healthcare record access control system by moving the encryption computation offline and keeping online computation task very low. Yeh et al. [22] proposed a decryption outsourcing framework for health information access control in the cloud by utilizing CSP to check whether the attributes satisfy the access policy in ciphertext, which induces the outsourced encryption and decryption scheme introduced by Zhang et al. [23].Intelligent healthcare, which is one of the intelligent services in the smart city, contains various health-related applications in MHSN, such as home care and emergency alarm [24]. Wang et al. [25] designed a secure health cloud system framework based on IBE, in which the assistant doctor can access the health data for enhanced analysis with authorization from the data owner based on identity-based PRE (IBPRE). In particular, by analyzing the collected social data together with real-time health data, accurate infection analysis can be achieved. The secure collaboration of healthcare and social network service providers is the key challenge of intelligent healthcare, since different service providers may adopt different techniques to protect data privacy. Zhang et al. [11] introduced some challenges of security and privacy in MHSN of smart cities and proposed the first secure data collaboration framework of healthcare and social network service providers. However, this scheme does not give the implementation construction. Liang et al. [26] proposed PEC, an ABE-based emergency call scheme for MHSN, which combines location data with health data to guarantee that emergency information is sent to nearby physicians. Jiang et al. [27] proposed EPPS, a personal health information sharing scheme based on ABE by combining the mobile social network with a healthcare center. Patients with geographical proximity can constitute a group to exchange health conditions, healthcare experiences, and medical treatments with the authorized physician. But in this scheme, the physicians in the healthcare center must have many attribute secret keys for each attribute to dock with patients in different groups. Moreover, these two schemes above do not consider the data collaboration (e.g., infectious diseases analysis) with health and social data.


## 3. Preliminaries

### 3.1. Bilinear Pairing

LetG0 and GT be two multiplicative groups of prime order p. A bilinear map is a function e:G0×G0→GT with the following properties:(1)
Computability. There is an efficient algorithm to compute e(g,h)∈GT, for any g,h∈G0.(2)
Bilinearity. For all g,h∈G0 and a,b∈Zp, we have e(ga,hb)=e(g,h)ab.(3)
Nondegeneracy. If g is a generator of G0, then e(g,g) is also a generator of GT.


### 3.2. Ciphertext-Policy Attribute-Based Encryption

The CP-ABE is a cryptography prototype for one-to-many secure communication, which consists of the following algorithms [17].(1)
Setup(1λ). The setup algorithm takes as input the security parameter λ and outputs a public key PK and a master secret key MK.(2)
KeyGen(PK,MK,S). The key generation algorithm takes as input the public key PK, the master secret key MK, and a set S of attributes and outputs an attribute key AK.(3)
Enc(PK,M,T). The encryption algorithm takes as input the public key PK, a message M, and an access policy T and outputs a ciphertext CT.(4)
Dec(PK,AK,CT). The decryption algorithm takes as input the public key PK, an attribute key AK, and a ciphertext CT with an access policy T. If S∈T, it outputs the message M.


### 3.3. Identity-Based Broadcast Encryption

The IBBE can be seen as an extension of the IBE, by allowing one to encrypt a message once for many receivers. The definition of IBBE is as follows [28].(1)
Setup(1λ,N). The setup algorithm takes as input a security parameter λ and the maximal size N of a set of receivers and outputs a pair of public key PK and master secret key MK.(2)
KegGen(PK,MK,ID). The key generation algorithm takes as input the public key PK, the master secret key MK, and a user’s identity ID and outputs a secret key SKID for the user.(3)
Enc(PK,M,U). The encryption algorithm takes as input the public key PK, a message M, and a set U of receivers’ identities; the algorithm outputs a ciphertext CT for U.(4)
Dec(PK,CT,SKID,ID). The decryption algorithm takes as input the public key PK, a ciphertext CT, a secret key SKID, and an identity ID; the algorithm outputs the message M if ID∈U.


## 3.1. Bilinear Pairing

LetG0 and GT be two multiplicative groups of prime order p. A bilinear map is a function e:G0×G0→GT with the following properties:(1)
Computability. There is an efficient algorithm to compute e(g,h)∈GT, for any g,h∈G0.(2)
Bilinearity. For all g,h∈G0 and a,b∈Zp, we have e(ga,hb)=e(g,h)ab.(3)
Nondegeneracy. If g is a generator of G0, then e(g,g) is also a generator of GT.


## 3.2. Ciphertext-Policy Attribute-Based Encryption

The CP-ABE is a cryptography prototype for one-to-many secure communication, which consists of the following algorithms [17].(1)
Setup(1λ). The setup algorithm takes as input the security parameter λ and outputs a public key PK and a master secret key MK.(2)
KeyGen(PK,MK,S). The key generation algorithm takes as input the public key PK, the master secret key MK, and a set S of attributes and outputs an attribute key AK.(3)
Enc(PK,M,T). The encryption algorithm takes as input the public key PK, a message M, and an access policy T and outputs a ciphertext CT.(4)
Dec(PK,AK,CT). The decryption algorithm takes as input the public key PK, an attribute key AK, and a ciphertext CT with an access policy T. If S∈T, it outputs the message M.


## 3.3. Identity-Based Broadcast Encryption

The IBBE can be seen as an extension of the IBE, by allowing one to encrypt a message once for many receivers. The definition of IBBE is as follows [28].(1)
Setup(1λ,N). The setup algorithm takes as input a security parameter λ and the maximal size N of a set of receivers and outputs a pair of public key PK and master secret key MK.(2)
KegGen(PK,MK,ID). The key generation algorithm takes as input the public key PK, the master secret key MK, and a user’s identity ID and outputs a secret key SKID for the user.(3)
Enc(PK,M,U). The encryption algorithm takes as input the public key PK, a message M, and a set U of receivers’ identities; the algorithm outputs a ciphertext CT for U.(4)
Dec(PK,CT,SKID,ID). The decryption algorithm takes as input the public key PK, a ciphertext CT, a secret key SKID, and an identity ID; the algorithm outputs the message M if ID∈U.


## 4. The Proposed Scheme

### 4.1. System Model

In MHSN, the fusion of health data and social data facilitates a novel paradigm of authorized infection analysis. Our scheme focuses on the secure sharing and collaboration of these data. As shown in Figure1, the system model of our scheme consists of central authority, health cloud, social cloud, users, healthcare provider, and healthcare analyzer.(1)
Central Authority. The central authority is a fully trusted party which is in charge of generating system parameters as well as private keys for each user.(2)
Health Cloud. The health cloud is a semitrusted party which provides health data storage service. It is also responsible for helping encrypt health data for mobile healthcare sensors and decrypt the ciphertext for healthcare providers and reencrypt ciphertext for healthcare analyzers.(3)
Social Cloud. The social cloud is also a semitrusted party which provides social data storage service and is in charge of reencrypting social ciphertext for healthcare analyzers.(4)
Data Owner. The data owners generate a great amount of health data through the mobile healthcare sensors and upload them to the health cloud by defining access policy and also upload their social data to the social cloud for sharing.(5)
User. The user is the ciphertexts’ receiver and is able to decrypt the ciphertexts if he is the intended receiver defined by the data owners.(6)
Healthcare Provider. The healthcare providers are the intended receivers of health ciphertext stored in the health cloud. If a healthcare provider’s attribute set satisfies the access policy in the ciphertext, he is able to decrypt the patient’s health data from the ciphertext.(7)
Healthcare Analyzer. The healthcare analyzer is the authorized receiver of both health ciphertext and social ciphertext for data collaboration and analysis.Figure 1
System model of our scheme.


### 4.2. System Definition

Based on the system model, our scheme consists of the following algorithms.(1)
Setup(1λ,N). The central authority takes as input a security parameter λ and the maximal size of receiver set N and outputs a system public key PK and a master secret key MK.(2)
AKeyGen(PK,MK,S). The central authority takes as input PK and MK and a set of attributes S of user or healthcare provider and outputs the attribute key AK.(3)
SKeyGen(PK,MK,ID). The central authority takes as input PK and MK and an identity ID of user or healthcare analyzer and outputs the secret key of user SK.(4)
Cloud.Encrypt(PK,T). The health cloud takes as input PK and an access policy T and outputs an outsourced health ciphertext CT′.(5)
Health.Encrypt(PK,mh,CT′). The health data owner takes as input PK, health data mh, and an outsourced health ciphertext CT′ and outputs a health ciphertext CTh.(6)
Cloud.Decrypt(PK,CTh,AK′). The health cloud takes as input PK, a health ciphertext CTh, and an outsourced attribute key AK′ and outputs a partial decrypted health ciphertext CTr if the attributes in AK′ satisfy the access policy in the ciphertext.(7)
Health.Decrypt(CTr,AK). The healthcare provider takes as input a partial decrypted health ciphertext CTr and an attribute key AK and outputs the health data mh.(8)
Social.Encrypt(PK,mc,U). The social data owner takes as input PK, social data mc, and a set U of receivers’ identities and outputs a social ciphertext CTc.(9)
Social.Decrypt(PK,CTc,ID,SK). The social receiver takes as input PK, a social ciphertext CTc, a receiver’s identity ID, and its secret key SK and outputs the social data mc if ID and SK are valid.(10)
Health.ReKeyGen(PK,AK,ID′). The health data owner takes as input PK, attribute key AK, and a healthcare analyzer’s identity ID′ and outputs a health reencryption key RKh.(11)
Health.ReEnc(CTh,RKh). The health cloud takes as input a health ciphertext CTh and a heath reencryption key RKh and outputs a reencrypted health ciphertext RTh.(12)
Social.ReKeyGen(PK,SK,ID′). The social data owner takes as input PK, a secret key SK, and a healthcare analyzer’s identity ID′ and outputs a social reencryption key RKc.(13)
Social.ReEnc(CTc,RKc). The social cloud takes as input a social ciphertext CTc and a social reencryption key RKc and outputs a reencrypted social ciphertext RTc.(14)
Analyzer.Decrypt(RTh,RTc,SK′). The healthcare analyzer takes as input a reencrypted health ciphertext RTh, a reencrypted social ciphertext RTc, and a secret key SK′ and outputs health data mh and social data mc.In the registration phase, the central authority runsSetup algorithms to generate system public key and master secret key. Meanwhile, it also usesAKeyGen andSKeyGen algorithm to generate attribute keys and secret keys of users in the system. For the health data, the health cloud first runsCloud.Encrypt algorithm to encrypt data with an access policy, and then the data owner runsHealth.Encrypt algorithm to finish the encryption. When accessing the health data, the health cloud first uses theCloud.Decrypt algorithm to partially decrypt the ciphertext, and then the user can use theHealth.Decrypt algorithm to recover the data. For the social data, the data owner runsSocial.Encrypt algorithm to encrypt data for a set of receivers, and the user can use theSocial.Decrypt algorithm to recover the social data. Furthermore, the data owner could runHealth.ReKeyGen andSocial.ReKeyGen algorithms, respectively, to generate reencryption keys containing their own attribute keys and secret keys. Receiving the reencryption keys, the health cloud and social cloud would runHealth.ReEnc andSocial.ReEnc algorithms to transform the initial ciphertexts to the reencrypted ciphertexts. Hence, the healthcare analyzer can runAnalyzer.Decrypt algorithm to decrypt the reencrypted health and social ciphertexts.


### 4.3. Security Definition

In our scheme, we assume that the health cloud and social cloud are honest but curious, which means they carry out computation and storage tasks but may try to learn information about the private data [29]. Specifically, the security model covers the following aspects.(1)
Data Confidentiality. The unauthorized users that are not the intended receivers defined by the data owner should be prevented from accessing the health and social data. The healthcare analyzer should not be able to access the reencrypted data without the authorization of the data owner.(2)
Fine-Grained Access Control. The data owner can customize an expressive and flexible access policy so that the health data only can be accessed by the healthcare providers whose attributes satisfy these policies.(3)
Collusion Resistance. If each of the users’ attributes in the set cannot satisfy the access policy in the ciphertexts alone, the access of ciphertext should not successful.


## 4.1. System Model

In MHSN, the fusion of health data and social data facilitates a novel paradigm of authorized infection analysis. Our scheme focuses on the secure sharing and collaboration of these data. As shown in Figure1, the system model of our scheme consists of central authority, health cloud, social cloud, users, healthcare provider, and healthcare analyzer.(1)
Central Authority. The central authority is a fully trusted party which is in charge of generating system parameters as well as private keys for each user.(2)
Health Cloud. The health cloud is a semitrusted party which provides health data storage service. It is also responsible for helping encrypt health data for mobile healthcare sensors and decrypt the ciphertext for healthcare providers and reencrypt ciphertext for healthcare analyzers.(3)
Social Cloud. The social cloud is also a semitrusted party which provides social data storage service and is in charge of reencrypting social ciphertext for healthcare analyzers.(4)
Data Owner. The data owners generate a great amount of health data through the mobile healthcare sensors and upload them to the health cloud by defining access policy and also upload their social data to the social cloud for sharing.(5)
User. The user is the ciphertexts’ receiver and is able to decrypt the ciphertexts if he is the intended receiver defined by the data owners.(6)
Healthcare Provider. The healthcare providers are the intended receivers of health ciphertext stored in the health cloud. If a healthcare provider’s attribute set satisfies the access policy in the ciphertext, he is able to decrypt the patient’s health data from the ciphertext.(7)
Healthcare Analyzer. The healthcare analyzer is the authorized receiver of both health ciphertext and social ciphertext for data collaboration and analysis.Figure 1
System model of our scheme.


## 4.2. System Definition

Based on the system model, our scheme consists of the following algorithms.(1)
Setup(1λ,N). The central authority takes as input a security parameter λ and the maximal size of receiver set N and outputs a system public key PK and a master secret key MK.(2)
AKeyGen(PK,MK,S). The central authority takes as input PK and MK and a set of attributes S of user or healthcare provider and outputs the attribute key AK.(3)
SKeyGen(PK,MK,ID). The central authority takes as input PK and MK and an identity ID of user or healthcare analyzer and outputs the secret key of user SK.(4)
Cloud.Encrypt(PK,T). The health cloud takes as input PK and an access policy T and outputs an outsourced health ciphertext CT′.(5)
Health.Encrypt(PK,mh,CT′). The health data owner takes as input PK, health data mh, and an outsourced health ciphertext CT′ and outputs a health ciphertext CTh.(6)
Cloud.Decrypt(PK,CTh,AK′). The health cloud takes as input PK, a health ciphertext CTh, and an outsourced attribute key AK′ and outputs a partial decrypted health ciphertext CTr if the attributes in AK′ satisfy the access policy in the ciphertext.(7)
Health.Decrypt(CTr,AK). The healthcare provider takes as input a partial decrypted health ciphertext CTr and an attribute key AK and outputs the health data mh.(8)
Social.Encrypt(PK,mc,U). The social data owner takes as input PK, social data mc, and a set U of receivers’ identities and outputs a social ciphertext CTc.(9)
Social.Decrypt(PK,CTc,ID,SK). The social receiver takes as input PK, a social ciphertext CTc, a receiver’s identity ID, and its secret key SK and outputs the social data mc if ID and SK are valid.(10)
Health.ReKeyGen(PK,AK,ID′). The health data owner takes as input PK, attribute key AK, and a healthcare analyzer’s identity ID′ and outputs a health reencryption key RKh.(11)
Health.ReEnc(CTh,RKh). The health cloud takes as input a health ciphertext CTh and a heath reencryption key RKh and outputs a reencrypted health ciphertext RTh.(12)
Social.ReKeyGen(PK,SK,ID′). The social data owner takes as input PK, a secret key SK, and a healthcare analyzer’s identity ID′ and outputs a social reencryption key RKc.(13)
Social.ReEnc(CTc,RKc). The social cloud takes as input a social ciphertext CTc and a social reencryption key RKc and outputs a reencrypted social ciphertext RTc.(14)
Analyzer.Decrypt(RTh,RTc,SK′). The healthcare analyzer takes as input a reencrypted health ciphertext RTh, a reencrypted social ciphertext RTc, and a secret key SK′ and outputs health data mh and social data mc.In the registration phase, the central authority runsSetup algorithms to generate system public key and master secret key. Meanwhile, it also usesAKeyGen andSKeyGen algorithm to generate attribute keys and secret keys of users in the system. For the health data, the health cloud first runsCloud.Encrypt algorithm to encrypt data with an access policy, and then the data owner runsHealth.Encrypt algorithm to finish the encryption. When accessing the health data, the health cloud first uses theCloud.Decrypt algorithm to partially decrypt the ciphertext, and then the user can use theHealth.Decrypt algorithm to recover the data. For the social data, the data owner runsSocial.Encrypt algorithm to encrypt data for a set of receivers, and the user can use theSocial.Decrypt algorithm to recover the social data. Furthermore, the data owner could runHealth.ReKeyGen andSocial.ReKeyGen algorithms, respectively, to generate reencryption keys containing their own attribute keys and secret keys. Receiving the reencryption keys, the health cloud and social cloud would runHealth.ReEnc andSocial.ReEnc algorithms to transform the initial ciphertexts to the reencrypted ciphertexts. Hence, the healthcare analyzer can runAnalyzer.Decrypt algorithm to decrypt the reencrypted health and social ciphertexts.


## 4.3. Security Definition

In our scheme, we assume that the health cloud and social cloud are honest but curious, which means they carry out computation and storage tasks but may try to learn information about the private data [29]. Specifically, the security model covers the following aspects.(1)
Data Confidentiality. The unauthorized users that are not the intended receivers defined by the data owner should be prevented from accessing the health and social data. The healthcare analyzer should not be able to access the reencrypted data without the authorization of the data owner.(2)
Fine-Grained Access Control. The data owner can customize an expressive and flexible access policy so that the health data only can be accessed by the healthcare providers whose attributes satisfy these policies.(3)
Collusion Resistance. If each of the users’ attributes in the set cannot satisfy the access policy in the ciphertexts alone, the access of ciphertext should not successful.


## 5. Construction

### 5.1. System Setup

The central authority runsSetup algorithm to select a bilinear map e:G0×G0→GT, where G0 and GT are two multiplicative groups with prime order p and g is the generator of G0. Then, the central authority chooses the maximum number of receivers N, randomly chooses g,h,u,v,w∈G0 and α,β∈Zp, chooses cryptographic hash function H1:0,1∗→Zp∗, H2:GT→G0, and finally outputs a system public key PK=(g,gβ,e(g,g)α,h,uα,v,vα,…,vαN,e(u,v),w) and a master secret key MK=(u,α,β).


### 5.2. Key Generation

The central authority runsAKeyGen algorithm to select a random γ∈Zp, which is a unique secret assigned to each user. Then, the central authority chooses random ε,φ∈Zp and random rj for each attribute j∈S, where S is the attribute set of the user, and outputs the attribute key AK.(1)AK=D=gα+γ/β,D1=gγhε,D2=gε,D3=g1/φ,D4=gφα,D5=wφα,D~j=gγH1jrj,D~j′=grjj∈S.For each user in the system, the central authority runsSKeyGen algorithm to select a random π∈Zp and output the secret key SK for the user with identity ID.(2)SK=K=g1/α+H1ID,K1=u1/π,K2=vπ,K3=wπ.


### 5.3. Secure Health Data Sharing

#### 5.3.1. Health Data Encryption

The mobile healthcare sensors of the data owner could collect a wide range of real-time health data (e.g., blood pressure, heart rate, and pulse), for further diagnosis or specialist analysis. Before uploading the data to the health cloud, the data owner first chooses a randomHK∈Zp and encrypts the health data mh with HK using a symmetric encryption algorithm, denoted as C=SEHK(mh). Then, the data owner defines an access policy T, to ensure that only users satisfying this policy can access data, and then sends to the health cloud.Then, the health cloud runsCloud.Encrypt algorithm to perform the outsourced encryption. For each node x in the access policy tree T, the health cloud chooses a polynomial px. These polynomials are chosen in the following way in a top-down manner, starting from the root node R. For each node x in the tree, set the degree dx of the polynomial px to be one less than the threshold value kx of that node; that is, dx=kx-1. Starting with the root node R, the algorithm chooses a random s∈Zp and sets pR(0)=s. Then, it chooses dR other points of the polynomial pR randomly to define it completely. For any other node x, it sets px(0)=pparent(x)(index(x)) and chooses dx other points randomly to completely define px. Let Y be the set of leaf nodes in T; the health cloud outputs an outsourced ciphertext CT′ as(3)CT′=T,C3′=gs,C4′=hs,C7=C~y=gpy0,C~y′=H1attrypy0y∈Y.The health cloud returnsCT′ to the data owner. The data owner runs Health.Encrypt algorithm to select t∈Zp at random and computes C1=HK·e(g,g)αt with HK and computes C2=gβt,C3=C3′·gt,C4=C4′·ht,C5=(D4)t,C6=(D5)t. Finally, the data owner outputs the ciphertext CTh as(4)CTh=T,C=SEHKmh,C1=HK·eg,gαt,C2=gβt,C3=gs+t,C4=hs+t,C5=gφαt,C6=wφαt,C7=C~y=gpy0,C~y′=H1attrypy0y∈Y.


#### 5.3.2. Health Data Decryption

If the attributes of the healthcare provider satisfy the access policyT, he can decrypt CTh successfully by informing health cloud and obtaining the symmetric key. The health cloud runs Cloud.Decrypt algorithm with the ciphertext and outsourced attribute key AK′=(D1,D2,{D~j,D~j′}j∈S) from the healthcare provider. The health cloud first runsDecryptNode algorithm which can be described as a recursive algorithm. This algorithm takes the ciphertext CTh, AK′, and a node x from the access tree T as input.(
1
) If the node x is a leaf node, then we let z=attrx and compute as follows. If z∈S, then (5)DecryptNodeCTh,AK′,x=eD~z,C~xeD~z′,C~x′=egγH1zrz,gpx0egrz,H1attrxpx0=eg,gγpx0.Ifz∉S, then DecryptNode(CTh,AK′,x)=⊥.(
2
) If the node x is a nonleaf node, the algorithm DecryptNode(CTh,AK′,x) proceeds as follows: for all nodes n that are children of x, it calls DecryptNode(CTh,AK′,n) and stores output as Fn. Let Sx be an arbitrary kx-sized set of child nodes n such that Fn≠⊥. If no such set exists, then the node is not satisfied and the function returns ⊥. Otherwise, the function defines j=index(n) and Sx′={index(n):n∈Sx} and returns the result. (6)Fx=∏n∈SxFnΔj,Sx′0=∏n∈Sxeg,gr·pparentnindexnΔj,Sx′0=∏n∈Sxeg,gr·pxj·Δj,Sx′0=eg,grpx0.If the access policy treeT is satisfied by S, we set the result of the entire evaluation for the access tree T as F, such that (7)F=DecryptNodeCTh,AK′,R=eg,gγpR0=eg,gγs.Then, the health cloud computes(8)B=eD1,C3eD2,C4=egγhε,gs+tegε,hs+t=eg,gγs+t,A=BF=eg,gγs+teg,gγs=eg,gγt.Finally, the health cloud sends the partial decrypted health ciphertextCTr=(C=SEHK(mh),C1=HK·e(g,g)αt,C2=gβt,A=e(g,g)γt) to the healthcare provider. After receiving CTr from the health cloud, the healthcare provider runs Health.Decrypt algorithm to obtain the symmetric key. (9)HK=C1·AeC2,D=HK·eg,gαt·eg,gγtegβt,gα+γ/β.Thus,SEHK(mh) can be decrypted with HK by applying the symmetric decryption algorithm, and the healthcare provider can access the data owner’s health data for diagnosis.


### 5.4. Secure Social Data Sharing

#### 5.4.1. Social Data Encryption

For the private social data denoted asmc, the data owner runs Social.Encrypt algorithm to encrypt it and then outsource the ciphertext to the social cloud. First, the data owner chooses a set U of receivers’ identities (where U≤N) and a random CK∈Zp which is used to encrypt the data based on the symmetric encryption algorithm. The data owner randomly picks k∈Zp∗ and outputs a social ciphertext CTc.(10)CTc=C=SECKmc,C1=CK·eu,vk,C2=vk·∏IDi∈Uα+H1IDi,C3=vπk,C4=wπk,C5=u-αk.


#### 5.4.2. Social Data Decryption

The user with identityID runs Social.Decrypt algorithm to decrypt the social ciphertext. If ID∈U, the user computes(11)I=eC5,vΔαID,U·eK,C21/∏IDi∈U∧IDi≠IDH1IDi=eu-αk,vΔαID,U·eu1/α+H1ID,vk·∏IDi∈Uα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=eu-αk,vα-1·∏IDi∈U∧IDi≠IDα+H1IDi-∏IDi∈U∧IDi≠IDH1IDi·eu,vk·∏IDi∈U∧IDi≠IDα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=euk,v∏IDi∈U∧IDi≠IDH1IDi-∏IDi∈U∧IDi≠IDα+H1IDi+∏IDi∈U∧IDi≠IDα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=eu,vk,where(12)ΔαID,U=α-1·∏IDi∈U∧IDi≠IDα+H1IDi-∏IDi∈U∧IDi≠IDH1IDi.Then, the user computes CK withI.(13)CK=C1I=CK·eu,vkeu,vk.Finally, the user recovers messagemc with CK using the symmetric encryption algorithm.


### 5.5. Authorized Data Analysis

#### 5.5.1. Health Data Reencryption

In order to analyze the healthcare data, the health data owner runsHealth.ReKeyGen algorithm to choose a healthcare analyzer’s identity ID′, randomly pick t′,b∈Zp, and compute the following with attribute key AK:(14)R1=D3·wb=g1/φ·wb,R2=vt′·α+H1ID′,R3=H2eu,vt′·gb.Then, the health data owner outputs the health reencryption keyRKh=(R1,R2,R3). When receiving the reencryption key, the health cloud runs Health.ReEnc algorithm to reencrypt the initial health ciphertext. The health cloud computes(15)C1′=C1eR1,C5=HK·eg,gαteg1/φ·wb,gφαt=HK·ewb,g-φαt.Finally, the health cloud outputs a reencrypted health ciphertext.(16)RTh=C′=C=SEHKmh,C1′=HK·ewb,g-φαt,C2′=R2=vt′·α+H1ID′,C3′=R3=H2eu,vt′·gb,C4′=C6=wφαt.


#### 5.5.2. Social Data Reencryption

The social data is also used to analyze healthcare, such as infectious diseases. The data owner runsSocial.ReKeyGen algorithm to choose a healthcare analyzer’s identity ID′, randomly pick k′,l∈Zp, and compute the following with secret key SK:(17)R1=K1·wl=u1/π·wl,R2=vk′·α+H1ID′,R3=H2eu,vk′·vl.Then, the data owner outputs the social reencryption keyRKc=(R1,R2,R3). Then, receiving the reencryption key, the social cloud runs Social.ReEnc algorithm to reencrypt the initial social ciphertext. The social cloud computes(18)C1′=C1eR1,C3=CK·eu,vkeu1/π·wl,vπk=CK·ewl,v-πk.Finally, the social cloud outputs a reencrypted social ciphertext.(19)RTc=C′=C=SECKmc,C1′=CK·ewl,v-πk,C2′=R2=vk′·α+H1ID′,C3′=R3=H2eu,vk′·vl,C4′=C4=wπk.


#### 5.5.3. Authorized Decryption

For the reencrypted health and social ciphertext, the healthcare analyzer with identityID′ runsAnalyzer.Decrypt algorithm to decrypt. For the health data, the healthcare analyzer first computes(20)K′=eK,C2′=eu1/α+H1ID′,vt′·α+H1ID′=eu,vt′.Then, the healthcare analyzer computes(21)Z=C3′H2K′=H2eu,vt′·gbH2eu,vt′=gb.Finally, the healthcare analyzer computes the HK and recovers the health datamh.(22)HK=C1′·eZ,C4′=HK·ewb,g-φαt·egb,wφαt.For the social data, the healthcare analyzer can computevl with secret key and then compute CK and recover the social data mc.(23)CK=C1′·evl,C4′=CK·ewl,v-πk·evl,wπk.Therefore, the healthcare analyzers can access both the reencrypted health data and the social data for collaboration and analysis with authorization from the data owner.


## 5.1. System Setup

The central authority runsSetup algorithm to select a bilinear map e:G0×G0→GT, where G0 and GT are two multiplicative groups with prime order p and g is the generator of G0. Then, the central authority chooses the maximum number of receivers N, randomly chooses g,h,u,v,w∈G0 and α,β∈Zp, chooses cryptographic hash function H1:0,1∗→Zp∗, H2:GT→G0, and finally outputs a system public key PK=(g,gβ,e(g,g)α,h,uα,v,vα,…,vαN,e(u,v),w) and a master secret key MK=(u,α,β).


## 5.2. Key Generation

The central authority runsAKeyGen algorithm to select a random γ∈Zp, which is a unique secret assigned to each user. Then, the central authority chooses random ε,φ∈Zp and random rj for each attribute j∈S, where S is the attribute set of the user, and outputs the attribute key AK.(1)AK=D=gα+γ/β,D1=gγhε,D2=gε,D3=g1/φ,D4=gφα,D5=wφα,D~j=gγH1jrj,D~j′=grjj∈S.For each user in the system, the central authority runsSKeyGen algorithm to select a random π∈Zp and output the secret key SK for the user with identity ID.(2)SK=K=g1/α+H1ID,K1=u1/π,K2=vπ,K3=wπ.


## 5.3. Secure Health Data Sharing

### 5.3.1. Health Data Encryption

The mobile healthcare sensors of the data owner could collect a wide range of real-time health data (e.g., blood pressure, heart rate, and pulse), for further diagnosis or specialist analysis. Before uploading the data to the health cloud, the data owner first chooses a randomHK∈Zp and encrypts the health data mh with HK using a symmetric encryption algorithm, denoted as C=SEHK(mh). Then, the data owner defines an access policy T, to ensure that only users satisfying this policy can access data, and then sends to the health cloud.Then, the health cloud runsCloud.Encrypt algorithm to perform the outsourced encryption. For each node x in the access policy tree T, the health cloud chooses a polynomial px. These polynomials are chosen in the following way in a top-down manner, starting from the root node R. For each node x in the tree, set the degree dx of the polynomial px to be one less than the threshold value kx of that node; that is, dx=kx-1. Starting with the root node R, the algorithm chooses a random s∈Zp and sets pR(0)=s. Then, it chooses dR other points of the polynomial pR randomly to define it completely. For any other node x, it sets px(0)=pparent(x)(index(x)) and chooses dx other points randomly to completely define px. Let Y be the set of leaf nodes in T; the health cloud outputs an outsourced ciphertext CT′ as(3)CT′=T,C3′=gs,C4′=hs,C7=C~y=gpy0,C~y′=H1attrypy0y∈Y.The health cloud returnsCT′ to the data owner. The data owner runs Health.Encrypt algorithm to select t∈Zp at random and computes C1=HK·e(g,g)αt with HK and computes C2=gβt,C3=C3′·gt,C4=C4′·ht,C5=(D4)t,C6=(D5)t. Finally, the data owner outputs the ciphertext CTh as(4)CTh=T,C=SEHKmh,C1=HK·eg,gαt,C2=gβt,C3=gs+t,C4=hs+t,C5=gφαt,C6=wφαt,C7=C~y=gpy0,C~y′=H1attrypy0y∈Y.


### 5.3.2. Health Data Decryption

If the attributes of the healthcare provider satisfy the access policyT, he can decrypt CTh successfully by informing health cloud and obtaining the symmetric key. The health cloud runs Cloud.Decrypt algorithm with the ciphertext and outsourced attribute key AK′=(D1,D2,{D~j,D~j′}j∈S) from the healthcare provider. The health cloud first runsDecryptNode algorithm which can be described as a recursive algorithm. This algorithm takes the ciphertext CTh, AK′, and a node x from the access tree T as input.(
1
) If the node x is a leaf node, then we let z=attrx and compute as follows. If z∈S, then (5)DecryptNodeCTh,AK′,x=eD~z,C~xeD~z′,C~x′=egγH1zrz,gpx0egrz,H1attrxpx0=eg,gγpx0.Ifz∉S, then DecryptNode(CTh,AK′,x)=⊥.(
2
) If the node x is a nonleaf node, the algorithm DecryptNode(CTh,AK′,x) proceeds as follows: for all nodes n that are children of x, it calls DecryptNode(CTh,AK′,n) and stores output as Fn. Let Sx be an arbitrary kx-sized set of child nodes n such that Fn≠⊥. If no such set exists, then the node is not satisfied and the function returns ⊥. Otherwise, the function defines j=index(n) and Sx′={index(n):n∈Sx} and returns the result. (6)Fx=∏n∈SxFnΔj,Sx′0=∏n∈Sxeg,gr·pparentnindexnΔj,Sx′0=∏n∈Sxeg,gr·pxj·Δj,Sx′0=eg,grpx0.If the access policy treeT is satisfied by S, we set the result of the entire evaluation for the access tree T as F, such that (7)F=DecryptNodeCTh,AK′,R=eg,gγpR0=eg,gγs.Then, the health cloud computes(8)B=eD1,C3eD2,C4=egγhε,gs+tegε,hs+t=eg,gγs+t,A=BF=eg,gγs+teg,gγs=eg,gγt.Finally, the health cloud sends the partial decrypted health ciphertextCTr=(C=SEHK(mh),C1=HK·e(g,g)αt,C2=gβt,A=e(g,g)γt) to the healthcare provider. After receiving CTr from the health cloud, the healthcare provider runs Health.Decrypt algorithm to obtain the symmetric key. (9)HK=C1·AeC2,D=HK·eg,gαt·eg,gγtegβt,gα+γ/β.Thus,SEHK(mh) can be decrypted with HK by applying the symmetric decryption algorithm, and the healthcare provider can access the data owner’s health data for diagnosis.


## 5.3.1. Health Data Encryption

The mobile healthcare sensors of the data owner could collect a wide range of real-time health data (e.g., blood pressure, heart rate, and pulse), for further diagnosis or specialist analysis. Before uploading the data to the health cloud, the data owner first chooses a randomHK∈Zp and encrypts the health data mh with HK using a symmetric encryption algorithm, denoted as C=SEHK(mh). Then, the data owner defines an access policy T, to ensure that only users satisfying this policy can access data, and then sends to the health cloud.Then, the health cloud runsCloud.Encrypt algorithm to perform the outsourced encryption. For each node x in the access policy tree T, the health cloud chooses a polynomial px. These polynomials are chosen in the following way in a top-down manner, starting from the root node R. For each node x in the tree, set the degree dx of the polynomial px to be one less than the threshold value kx of that node; that is, dx=kx-1. Starting with the root node R, the algorithm chooses a random s∈Zp and sets pR(0)=s. Then, it chooses dR other points of the polynomial pR randomly to define it completely. For any other node x, it sets px(0)=pparent(x)(index(x)) and chooses dx other points randomly to completely define px. Let Y be the set of leaf nodes in T; the health cloud outputs an outsourced ciphertext CT′ as(3)CT′=T,C3′=gs,C4′=hs,C7=C~y=gpy0,C~y′=H1attrypy0y∈Y.The health cloud returnsCT′ to the data owner. The data owner runs Health.Encrypt algorithm to select t∈Zp at random and computes C1=HK·e(g,g)αt with HK and computes C2=gβt,C3=C3′·gt,C4=C4′·ht,C5=(D4)t,C6=(D5)t. Finally, the data owner outputs the ciphertext CTh as(4)CTh=T,C=SEHKmh,C1=HK·eg,gαt,C2=gβt,C3=gs+t,C4=hs+t,C5=gφαt,C6=wφαt,C7=C~y=gpy0,C~y′=H1attrypy0y∈Y.


## 5.3.2. Health Data Decryption

If the attributes of the healthcare provider satisfy the access policyT, he can decrypt CTh successfully by informing health cloud and obtaining the symmetric key. The health cloud runs Cloud.Decrypt algorithm with the ciphertext and outsourced attribute key AK′=(D1,D2,{D~j,D~j′}j∈S) from the healthcare provider. The health cloud first runsDecryptNode algorithm which can be described as a recursive algorithm. This algorithm takes the ciphertext CTh, AK′, and a node x from the access tree T as input.(
1
) If the node x is a leaf node, then we let z=attrx and compute as follows. If z∈S, then (5)DecryptNodeCTh,AK′,x=eD~z,C~xeD~z′,C~x′=egγH1zrz,gpx0egrz,H1attrxpx0=eg,gγpx0.Ifz∉S, then DecryptNode(CTh,AK′,x)=⊥.(
2
) If the node x is a nonleaf node, the algorithm DecryptNode(CTh,AK′,x) proceeds as follows: for all nodes n that are children of x, it calls DecryptNode(CTh,AK′,n) and stores output as Fn. Let Sx be an arbitrary kx-sized set of child nodes n such that Fn≠⊥. If no such set exists, then the node is not satisfied and the function returns ⊥. Otherwise, the function defines j=index(n) and Sx′={index(n):n∈Sx} and returns the result. (6)Fx=∏n∈SxFnΔj,Sx′0=∏n∈Sxeg,gr·pparentnindexnΔj,Sx′0=∏n∈Sxeg,gr·pxj·Δj,Sx′0=eg,grpx0.If the access policy treeT is satisfied by S, we set the result of the entire evaluation for the access tree T as F, such that (7)F=DecryptNodeCTh,AK′,R=eg,gγpR0=eg,gγs.Then, the health cloud computes(8)B=eD1,C3eD2,C4=egγhε,gs+tegε,hs+t=eg,gγs+t,A=BF=eg,gγs+teg,gγs=eg,gγt.Finally, the health cloud sends the partial decrypted health ciphertextCTr=(C=SEHK(mh),C1=HK·e(g,g)αt,C2=gβt,A=e(g,g)γt) to the healthcare provider. After receiving CTr from the health cloud, the healthcare provider runs Health.Decrypt algorithm to obtain the symmetric key. (9)HK=C1·AeC2,D=HK·eg,gαt·eg,gγtegβt,gα+γ/β.Thus,SEHK(mh) can be decrypted with HK by applying the symmetric decryption algorithm, and the healthcare provider can access the data owner’s health data for diagnosis.


## 5.4. Secure Social Data Sharing

### 5.4.1. Social Data Encryption

For the private social data denoted asmc, the data owner runs Social.Encrypt algorithm to encrypt it and then outsource the ciphertext to the social cloud. First, the data owner chooses a set U of receivers’ identities (where U≤N) and a random CK∈Zp which is used to encrypt the data based on the symmetric encryption algorithm. The data owner randomly picks k∈Zp∗ and outputs a social ciphertext CTc.(10)CTc=C=SECKmc,C1=CK·eu,vk,C2=vk·∏IDi∈Uα+H1IDi,C3=vπk,C4=wπk,C5=u-αk.


### 5.4.2. Social Data Decryption

The user with identityID runs Social.Decrypt algorithm to decrypt the social ciphertext. If ID∈U, the user computes(11)I=eC5,vΔαID,U·eK,C21/∏IDi∈U∧IDi≠IDH1IDi=eu-αk,vΔαID,U·eu1/α+H1ID,vk·∏IDi∈Uα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=eu-αk,vα-1·∏IDi∈U∧IDi≠IDα+H1IDi-∏IDi∈U∧IDi≠IDH1IDi·eu,vk·∏IDi∈U∧IDi≠IDα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=euk,v∏IDi∈U∧IDi≠IDH1IDi-∏IDi∈U∧IDi≠IDα+H1IDi+∏IDi∈U∧IDi≠IDα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=eu,vk,where(12)ΔαID,U=α-1·∏IDi∈U∧IDi≠IDα+H1IDi-∏IDi∈U∧IDi≠IDH1IDi.Then, the user computes CK withI.(13)CK=C1I=CK·eu,vkeu,vk.Finally, the user recovers messagemc with CK using the symmetric encryption algorithm.


## 5.4.1. Social Data Encryption

For the private social data denoted asmc, the data owner runs Social.Encrypt algorithm to encrypt it and then outsource the ciphertext to the social cloud. First, the data owner chooses a set U of receivers’ identities (where U≤N) and a random CK∈Zp which is used to encrypt the data based on the symmetric encryption algorithm. The data owner randomly picks k∈Zp∗ and outputs a social ciphertext CTc.(10)CTc=C=SECKmc,C1=CK·eu,vk,C2=vk·∏IDi∈Uα+H1IDi,C3=vπk,C4=wπk,C5=u-αk.


## 5.4.2. Social Data Decryption

The user with identityID runs Social.Decrypt algorithm to decrypt the social ciphertext. If ID∈U, the user computes(11)I=eC5,vΔαID,U·eK,C21/∏IDi∈U∧IDi≠IDH1IDi=eu-αk,vΔαID,U·eu1/α+H1ID,vk·∏IDi∈Uα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=eu-αk,vα-1·∏IDi∈U∧IDi≠IDα+H1IDi-∏IDi∈U∧IDi≠IDH1IDi·eu,vk·∏IDi∈U∧IDi≠IDα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=euk,v∏IDi∈U∧IDi≠IDH1IDi-∏IDi∈U∧IDi≠IDα+H1IDi+∏IDi∈U∧IDi≠IDα+H1IDi1/∏IDi∈U∧IDi≠IDH1IDi=eu,vk,where(12)ΔαID,U=α-1·∏IDi∈U∧IDi≠IDα+H1IDi-∏IDi∈U∧IDi≠IDH1IDi.Then, the user computes CK withI.(13)CK=C1I=CK·eu,vkeu,vk.Finally, the user recovers messagemc with CK using the symmetric encryption algorithm.


## 5.5. Authorized Data Analysis

### 5.5.1. Health Data Reencryption

In order to analyze the healthcare data, the health data owner runsHealth.ReKeyGen algorithm to choose a healthcare analyzer’s identity ID′, randomly pick t′,b∈Zp, and compute the following with attribute key AK:(14)R1=D3·wb=g1/φ·wb,R2=vt′·α+H1ID′,R3=H2eu,vt′·gb.Then, the health data owner outputs the health reencryption keyRKh=(R1,R2,R3). When receiving the reencryption key, the health cloud runs Health.ReEnc algorithm to reencrypt the initial health ciphertext. The health cloud computes(15)C1′=C1eR1,C5=HK·eg,gαteg1/φ·wb,gφαt=HK·ewb,g-φαt.Finally, the health cloud outputs a reencrypted health ciphertext.(16)RTh=C′=C=SEHKmh,C1′=HK·ewb,g-φαt,C2′=R2=vt′·α+H1ID′,C3′=R3=H2eu,vt′·gb,C4′=C6=wφαt.


### 5.5.2. Social Data Reencryption

The social data is also used to analyze healthcare, such as infectious diseases. The data owner runsSocial.ReKeyGen algorithm to choose a healthcare analyzer’s identity ID′, randomly pick k′,l∈Zp, and compute the following with secret key SK:(17)R1=K1·wl=u1/π·wl,R2=vk′·α+H1ID′,R3=H2eu,vk′·vl.Then, the data owner outputs the social reencryption keyRKc=(R1,R2,R3). Then, receiving the reencryption key, the social cloud runs Social.ReEnc algorithm to reencrypt the initial social ciphertext. The social cloud computes(18)C1′=C1eR1,C3=CK·eu,vkeu1/π·wl,vπk=CK·ewl,v-πk.Finally, the social cloud outputs a reencrypted social ciphertext.(19)RTc=C′=C=SECKmc,C1′=CK·ewl,v-πk,C2′=R2=vk′·α+H1ID′,C3′=R3=H2eu,vk′·vl,C4′=C4=wπk.


### 5.5.3. Authorized Decryption

For the reencrypted health and social ciphertext, the healthcare analyzer with identityID′ runsAnalyzer.Decrypt algorithm to decrypt. For the health data, the healthcare analyzer first computes(20)K′=eK,C2′=eu1/α+H1ID′,vt′·α+H1ID′=eu,vt′.Then, the healthcare analyzer computes(21)Z=C3′H2K′=H2eu,vt′·gbH2eu,vt′=gb.Finally, the healthcare analyzer computes the HK and recovers the health datamh.(22)HK=C1′·eZ,C4′=HK·ewb,g-φαt·egb,wφαt.For the social data, the healthcare analyzer can computevl with secret key and then compute CK and recover the social data mc.(23)CK=C1′·evl,C4′=CK·ewl,v-πk·evl,wπk.Therefore, the healthcare analyzers can access both the reencrypted health data and the social data for collaboration and analysis with authorization from the data owner.


## 5.5.1. Health Data Reencryption

In order to analyze the healthcare data, the health data owner runsHealth.ReKeyGen algorithm to choose a healthcare analyzer’s identity ID′, randomly pick t′,b∈Zp, and compute the following with attribute key AK:(14)R1=D3·wb=g1/φ·wb,R2=vt′·α+H1ID′,R3=H2eu,vt′·gb.Then, the health data owner outputs the health reencryption keyRKh=(R1,R2,R3). When receiving the reencryption key, the health cloud runs Health.ReEnc algorithm to reencrypt the initial health ciphertext. The health cloud computes(15)C1′=C1eR1,C5=HK·eg,gαteg1/φ·wb,gφαt=HK·ewb,g-φαt.Finally, the health cloud outputs a reencrypted health ciphertext.(16)RTh=C′=C=SEHKmh,C1′=HK·ewb,g-φαt,C2′=R2=vt′·α+H1ID′,C3′=R3=H2eu,vt′·gb,C4′=C6=wφαt.


## 5.5.2. Social Data Reencryption

The social data is also used to analyze healthcare, such as infectious diseases. The data owner runsSocial.ReKeyGen algorithm to choose a healthcare analyzer’s identity ID′, randomly pick k′,l∈Zp, and compute the following with secret key SK:(17)R1=K1·wl=u1/π·wl,R2=vk′·α+H1ID′,R3=H2eu,vk′·vl.Then, the data owner outputs the social reencryption keyRKc=(R1,R2,R3). Then, receiving the reencryption key, the social cloud runs Social.ReEnc algorithm to reencrypt the initial social ciphertext. The social cloud computes(18)C1′=C1eR1,C3=CK·eu,vkeu1/π·wl,vπk=CK·ewl,v-πk.Finally, the social cloud outputs a reencrypted social ciphertext.(19)RTc=C′=C=SECKmc,C1′=CK·ewl,v-πk,C2′=R2=vk′·α+H1ID′,C3′=R3=H2eu,vk′·vl,C4′=C4=wπk.


## 5.5.3. Authorized Decryption

For the reencrypted health and social ciphertext, the healthcare analyzer with identityID′ runsAnalyzer.Decrypt algorithm to decrypt. For the health data, the healthcare analyzer first computes(20)K′=eK,C2′=eu1/α+H1ID′,vt′·α+H1ID′=eu,vt′.Then, the healthcare analyzer computes(21)Z=C3′H2K′=H2eu,vt′·gbH2eu,vt′=gb.Finally, the healthcare analyzer computes the HK and recovers the health datamh.(22)HK=C1′·eZ,C4′=HK·ewb,g-φαt·egb,wφαt.For the social data, the healthcare analyzer can computevl with secret key and then compute CK and recover the social data mc.(23)CK=C1′·evl,C4′=CK·ewl,v-πk·evl,wπk.Therefore, the healthcare analyzers can access both the reencrypted health data and the social data for collaboration and analysis with authorization from the data owner.


## 6. Security Analysis

The sharing data in our scheme is encrypted with CP-ABE and IBBE techniques, which are secure against chosen plaintext attack since the DBDH assumption holds [23, 28]. We analyze the security properties of our scheme as follows [29].(1)
Data Confidentiality. The health data is encrypted using access policy, and the confidentiality of health data can be guaranteed against users who do not hold a set of attributes that satisfy the access policy. In the encryption phase, though the health cloud performs encryption computation for the data owner, it still cannot access the data without the attribute key. During the decryption phase, since the set of attributes cannot satisfy the access policy in the ciphertext, the health cloud server cannot recover the value A=e(g,g)γt to further get the desired value HK. Therefore, only the users with valid attributes that satisfy the access policy can decrypt the health ciphertext. The social data is encrypted with a random symmetric key CK, and then CK is protected by IBBE. Since the symmetric encryption and IBBE scheme are secure, the confidentiality of outsourced social data can be guaranteed against unauthorized users whose identities are not in the set of receivers’ identities defined by the data owner.(2)
Fine-Grained Access Control. The fine-grained access control allows flexibility in specifying differential access policies of individual health data. To enforce this kind of access control, we utilize CP-ABE to escort the symmetric encryption key of health data. In the health data encryption phase of our scheme, the data owner is able to enforce an expressive and flexible access policy and encrypt the symmetric key which is used to encrypt the health data. Specifically, the access policy of encrypted data defined in access tree supports complex operations including both AND and OR gate, which is able to represent any desired access conditions.(3)
Collusion Resistance. The users may intend to combine their attribute keys to access the data which they cannot access individually. In our scheme, the central authority generates attribute keys for different users; the attribute key is associated with random γ, which is uniquely related to each user and makes the combination of components in different attribute keys meaningless. Suppose two or more users with different attributes combine together to satisfy the access policy; they cannot compute F=e(g,g)γs in the outsourced decryption phase. Thus, the proposed scheme is collusion-resistant.


## 7. Performance Analysis

### 7.1. Functionality Comparisons

We list the key features of our scheme in Table1 and make a comparison of our scheme with several data sharing schemes in MHSN in terms of health data confidentiality, health data access control, outsourced encryption and decryption, data authorization, and social data collaboration. In order to achieve fine-grained access control, most of these schemes adopt the ABE technique. From the comparison, we can see that only EPPS [27] and our scheme achieve health data outsourced decryption considering the low computing power of resource-constrained mobile devices or healthcare sensors. Zhang et al. [14], Wang et al. [25], Au et al. [20], and our scheme support data authorization by deploying PRE mechanism so that the semitrusted server could reencrypt the ciphertext to data requester for research and analysis purposes without acquiring any plaintext. Further, PEC [26] combines social data with healthcare record for emergency call, and EPPS [27] divides the mobile patients into different groups according to social data. However, both PEC [26] and EPPS [27] only utilize location information of social data and ignore other valuable data in social networks, which makes extensive social data needed in-depth healthcare analysis (e.g., infectious diseases analysis) impossible.Table 1
Functionality comparison of data sharing schemes in MHSN.
Zhang et al. [14]
Wang et al. [25]
Au et al. [20]
PEC [26]
EPPS [27]
Our scheme
Health data confidentiality
PKE
IBE
CP-ABE
CP-ABE
CP-ABE
CP-ABE
Health data access control
Consent-based
Identity-based
Attribute-based
Attribute-based
Attribute-based
Attribute-based
Outsourced encryption
—
No
No
No
No
Yes
Outsourced decryption
—
No
No
No
Yes
Yes
Data authorization
Yes
Yes
Yes
No
No
Yes
Social data collaboration
No
No
No
Yes
Yes
YesMoreover, the health and social data may be collected and protected by different independent service providers adopting different encryption techniques, such as ABE and IBBE. Thus, to achieve data collaboration of these service providers, data authorization in these different service providers must be supported. Our scheme proposes an efficient CP-ABE construction with outsourced encryption and decryption to achieve efficient fine-grained access control of health data and provides a secure solution for the collaboration of different service providers by transforming the ABE-encrypted health data and IBBE-encrypted social data into an IBE-encrypted one that can only be decrypted by an authorized healthcare analyzer such as specialists, since IBE is more suitable to be employed on resource-constrained mobile devices in MHSN.


### 7.2. Performance Comparisons

We analyze the performance efficiency of health data encryption, decryption, reencryption key generation, and reencryption by comparing our scheme with several secure health data sharing schemes; the result is shown in Table2. Let Tr be the computation cost of a single pairing, T0 be the computation cost of an exponent operation in G0, Tt be the time for an exponent operation in GT, Nc be the number of attributes in a ciphertext, Nr be the number of attributes in a reencrypted ciphertext, and Nu be the total number of receivers in social networks. We ignore the simple multiplication, hash, and symmetric encryption and decryption operations.Table 2
Comparison of computation overhead for health data sharing.
Schemes
Data encryption
Data decryption
Data reencryption key generation
Data reencryption
Yeh et al. [22]
T
r
+
(
2
N
c
+
1
)
T
0
+
T
t
2
T
r
+
T
t
—
—
EPPS [27]
(
3
N
c
+
1
)
T
0
+
T
t
T
t
—
—
Au et al. [20]
(
3
N
c
+
2
)
T
0
+
T
t
(
2
N
c
+
1
)
T
r
+
N
c
T
t
(
3
N
r
+
1
)
T
0
+
T
t
(
2
N
r
+
2
)
T
r
+
N
r
T
t
Wang et al. [25]
2
T
0
+
2
T
t
2
T
r
3
T
0
T
r
+
T
0
Our scheme
5
T
0
+
T
t
T
r
3
T
0
+
T
t
T
rFirst, we discuss the computation cost of health data encryption and decryption. Since Yeh et al. [22], EPPS [27], and Au et al. [20] all perform standard ABE algorithm locally in the encryption phase, their encryption computation costs are Tr+(2Nc+1)T0+Tt, (3Nc+1)T0+Tt, and (3Nc+2)T0+Tt, respectively, which grow linearly with the number of attributes in access policy. In our scheme, the users with mobile sensors only need to perform 5T0+Tt to encrypt the data, which is constant, the same as Wang et al. [25] and less than these schemes. In the data decryption phase, receivers in Au et al.’s study [20] use secret keys corresponding to matched attributes to recursively decrypt the health ciphertext, and the computation cost is (2Nc+1)Tr+NcTt. In Yeh et al.’s study [22], EPPS [27], and our scheme, most of the decryption computations are outsourced to the cloud server. In particular, users in our scheme only need to perform one pairing operation to decrypt the ciphertext.Further, in the data authorization phase, Au et al. [20] adopted ABPRE to reencrypt ciphertext for authorized users, and the computation costs of reencryption key generation and data reencryption are both related to the number of attributes of new access policy. Our scheme transforms ABE-encrypted health data to IBE-encrypted health data for analysis purposes, and the computation costs in these two phases are 3T0+Tt and Tr, which is constant and efficient as in Wang et al.’s study [25].We also evaluate the computation overhead of social data sharing when the ciphertexts in different service providers need to collaborate together. From Table3, we can observe that the social data encryption cost on the data owner is (Nu+4)T0+Tt based on IBBE. If the user is one of the desirable receivers, he can perform 2Tr+(Nu-1)T0+Tt cost to decrypt ciphertext. Moreover, our scheme also has high efficiency for the social data authorized phase, in which the IBBE-encrypted social data can be reencrypted to IBE-encrypted one by semitrusted social cloud with reencryption key generated by the data owner. The computation cost of generating reencryption key is 4T0+Tt, and the semitrusted social cloud needs to take Tr cost to finish the social data reencryption. At last, the authorized healthcare analyzer needs to perform 2Tr to obtain the social data or health data which are both protected by IBE.Table 3
Computation overhead of social data sharing.
Data encryption
Data decryption
Data reencryption key generation
Data reencryption
Data authorized decryption
(
N
u
+
4
)
T
0
+
T
t
2
T
r
+
(
N
u
-
1
)
T
0
+
T
t
4
T
0
+
T
t
T
r
2
T
r


### 7.3. Experimental Evaluation

We conduct experiments on a Linux system with an Intel Core 2 Duo CPU with 2.53 GHz processor and 4 GB memory. The experimental prototype is written in C language with the assistance of cpabe toolkit and pairing-based cryptography library [30]. We use a pairing-friendly type A 160-bit elliptic curve group based on the supersingular curve over a 512-bit finite field. The Advanced Encryption Standard (AES) is chosen as the symmetric key encryption scheme.We analyze the time cost of the data encryption and decryption by comparing our scheme with Yeh et al. [22], EPPS [27], Au et al. [20], and Wang et al. [25]. In the data encryption phase, the data owner in these schemes encrypts a file with an access policy and posts the encrypted file to the cloud server. Figure 2 shows the computation time on data owners during this phase. The encryption time on data owners grows with the number of attributes in access policy in Yeh et al. [22], EPPS [27], and Au et al. [20], while it stays constant in our scheme. In the data decryption phase, Figure 3 shows the computation time on healthcare providers for decryption versus the number of attributes in access policy of ciphertext. Compared to Au et al. [20], we can see that the decryption times of Yeh et al. [22], EPPS [27], and our scheme are almost the same, which are constant since most of the laborious decryption operations are delegated to the cloud server.Figure 2
Computation cost of health data encryption.Figure 3
Computation cost of health data decryption.Furthermore, we evaluate the computation time cost in health data reencryption phase and health data authorized decryption phase, and the results are shown in Figures4 and 5, respectively. We compare our scheme with that of Au et al. [20] which utilizes ABPRE to support a general framework for secure sharing of PHR and that of Wang et al. [25] which adopts IBPRE. We can observe that the experimental results in Au et al. [20] approximately follow a linear relationship as the number of attributes increases. In our scheme, the data owner generates reencryption keys for authorized healthcare analyzers so that the ABE-based ciphertext can be reencrypted to an IBE-based one and then be decrypted with a secret key, which is independent of the number of attributes in access policy as in Wang et al. [25].Figure 4
Computation cost of health data reencryption.Figure 5
Computation cost of health data authorized decryption.


## 7.1. Functionality Comparisons

We list the key features of our scheme in Table1 and make a comparison of our scheme with several data sharing schemes in MHSN in terms of health data confidentiality, health data access control, outsourced encryption and decryption, data authorization, and social data collaboration. In order to achieve fine-grained access control, most of these schemes adopt the ABE technique. From the comparison, we can see that only EPPS [27] and our scheme achieve health data outsourced decryption considering the low computing power of resource-constrained mobile devices or healthcare sensors. Zhang et al. [14], Wang et al. [25], Au et al. [20], and our scheme support data authorization by deploying PRE mechanism so that the semitrusted server could reencrypt the ciphertext to data requester for research and analysis purposes without acquiring any plaintext. Further, PEC [26] combines social data with healthcare record for emergency call, and EPPS [27] divides the mobile patients into different groups according to social data. However, both PEC [26] and EPPS [27] only utilize location information of social data and ignore other valuable data in social networks, which makes extensive social data needed in-depth healthcare analysis (e.g., infectious diseases analysis) impossible.Table 1
Functionality comparison of data sharing schemes in MHSN.
Zhang et al. [14]
Wang et al. [25]
Au et al. [20]
PEC [26]
EPPS [27]
Our scheme
Health data confidentiality
PKE
IBE
CP-ABE
CP-ABE
CP-ABE
CP-ABE
Health data access control
Consent-based
Identity-based
Attribute-based
Attribute-based
Attribute-based
Attribute-based
Outsourced encryption
—
No
No
No
No
Yes
Outsourced decryption
—
No
No
No
Yes
Yes
Data authorization
Yes
Yes
Yes
No
No
Yes
Social data collaboration
No
No
No
Yes
Yes
YesMoreover, the health and social data may be collected and protected by different independent service providers adopting different encryption techniques, such as ABE and IBBE. Thus, to achieve data collaboration of these service providers, data authorization in these different service providers must be supported. Our scheme proposes an efficient CP-ABE construction with outsourced encryption and decryption to achieve efficient fine-grained access control of health data and provides a secure solution for the collaboration of different service providers by transforming the ABE-encrypted health data and IBBE-encrypted social data into an IBE-encrypted one that can only be decrypted by an authorized healthcare analyzer such as specialists, since IBE is more suitable to be employed on resource-constrained mobile devices in MHSN.


## 7.2. Performance Comparisons

We analyze the performance efficiency of health data encryption, decryption, reencryption key generation, and reencryption by comparing our scheme with several secure health data sharing schemes; the result is shown in Table2. Let Tr be the computation cost of a single pairing, T0 be the computation cost of an exponent operation in G0, Tt be the time for an exponent operation in GT, Nc be the number of attributes in a ciphertext, Nr be the number of attributes in a reencrypted ciphertext, and Nu be the total number of receivers in social networks. We ignore the simple multiplication, hash, and symmetric encryption and decryption operations.Table 2
Comparison of computation overhead for health data sharing.
Schemes
Data encryption
Data decryption
Data reencryption key generation
Data reencryption
Yeh et al. [22]
T
r
+
(
2
N
c
+
1
)
T
0
+
T
t
2
T
r
+
T
t
—
—
EPPS [27]
(
3
N
c
+
1
)
T
0
+
T
t
T
t
—
—
Au et al. [20]
(
3
N
c
+
2
)
T
0
+
T
t
(
2
N
c
+
1
)
T
r
+
N
c
T
t
(
3
N
r
+
1
)
T
0
+
T
t
(
2
N
r
+
2
)
T
r
+
N
r
T
t
Wang et al. [25]
2
T
0
+
2
T
t
2
T
r
3
T
0
T
r
+
T
0
Our scheme
5
T
0
+
T
t
T
r
3
T
0
+
T
t
T
rFirst, we discuss the computation cost of health data encryption and decryption. Since Yeh et al. [22], EPPS [27], and Au et al. [20] all perform standard ABE algorithm locally in the encryption phase, their encryption computation costs are Tr+(2Nc+1)T0+Tt, (3Nc+1)T0+Tt, and (3Nc+2)T0+Tt, respectively, which grow linearly with the number of attributes in access policy. In our scheme, the users with mobile sensors only need to perform 5T0+Tt to encrypt the data, which is constant, the same as Wang et al. [25] and less than these schemes. In the data decryption phase, receivers in Au et al.’s study [20] use secret keys corresponding to matched attributes to recursively decrypt the health ciphertext, and the computation cost is (2Nc+1)Tr+NcTt. In Yeh et al.’s study [22], EPPS [27], and our scheme, most of the decryption computations are outsourced to the cloud server. In particular, users in our scheme only need to perform one pairing operation to decrypt the ciphertext.Further, in the data authorization phase, Au et al. [20] adopted ABPRE to reencrypt ciphertext for authorized users, and the computation costs of reencryption key generation and data reencryption are both related to the number of attributes of new access policy. Our scheme transforms ABE-encrypted health data to IBE-encrypted health data for analysis purposes, and the computation costs in these two phases are 3T0+Tt and Tr, which is constant and efficient as in Wang et al.’s study [25].We also evaluate the computation overhead of social data sharing when the ciphertexts in different service providers need to collaborate together. From Table3, we can observe that the social data encryption cost on the data owner is (Nu+4)T0+Tt based on IBBE. If the user is one of the desirable receivers, he can perform 2Tr+(Nu-1)T0+Tt cost to decrypt ciphertext. Moreover, our scheme also has high efficiency for the social data authorized phase, in which the IBBE-encrypted social data can be reencrypted to IBE-encrypted one by semitrusted social cloud with reencryption key generated by the data owner. The computation cost of generating reencryption key is 4T0+Tt, and the semitrusted social cloud needs to take Tr cost to finish the social data reencryption. At last, the authorized healthcare analyzer needs to perform 2Tr to obtain the social data or health data which are both protected by IBE.Table 3
Computation overhead of social data sharing.
Data encryption
Data decryption
Data reencryption key generation
Data reencryption
Data authorized decryption
(
N
u
+
4
)
T
0
+
T
t
2
T
r
+
(
N
u
-
1
)
T
0
+
T
t
4
T
0
+
T
t
T
r
2
T
r


## 7.3. Experimental Evaluation

We conduct experiments on a Linux system with an Intel Core 2 Duo CPU with 2.53 GHz processor and 4 GB memory. The experimental prototype is written in C language with the assistance of cpabe toolkit and pairing-based cryptography library [30]. We use a pairing-friendly type A 160-bit elliptic curve group based on the supersingular curve over a 512-bit finite field. The Advanced Encryption Standard (AES) is chosen as the symmetric key encryption scheme.We analyze the time cost of the data encryption and decryption by comparing our scheme with Yeh et al. [22], EPPS [27], Au et al. [20], and Wang et al. [25]. In the data encryption phase, the data owner in these schemes encrypts a file with an access policy and posts the encrypted file to the cloud server. Figure 2 shows the computation time on data owners during this phase. The encryption time on data owners grows with the number of attributes in access policy in Yeh et al. [22], EPPS [27], and Au et al. [20], while it stays constant in our scheme. In the data decryption phase, Figure 3 shows the computation time on healthcare providers for decryption versus the number of attributes in access policy of ciphertext. Compared to Au et al. [20], we can see that the decryption times of Yeh et al. [22], EPPS [27], and our scheme are almost the same, which are constant since most of the laborious decryption operations are delegated to the cloud server.Figure 2
Computation cost of health data encryption.Figure 3
Computation cost of health data decryption.Furthermore, we evaluate the computation time cost in health data reencryption phase and health data authorized decryption phase, and the results are shown in Figures4 and 5, respectively. We compare our scheme with that of Au et al. [20] which utilizes ABPRE to support a general framework for secure sharing of PHR and that of Wang et al. [25] which adopts IBPRE. We can observe that the experimental results in Au et al. [20] approximately follow a linear relationship as the number of attributes increases. In our scheme, the data owner generates reencryption keys for authorized healthcare analyzers so that the ABE-based ciphertext can be reencrypted to an IBE-based one and then be decrypted with a secret key, which is independent of the number of attributes in access policy as in Wang et al. [25].Figure 4
Computation cost of health data reencryption.Figure 5
Computation cost of health data authorized decryption.


## 8. Conclusion

In this paper, we focus on the secure health data and social data sharing and collaboration in MHSN for smart cities and propose a detailed construction based on ABE and IBBE. Our scheme allows the data owner to authorize the healthcare analyzers to access data by reencrypting both ABE-protected health data and IBBE-protected social data to IBE-protected one, which provides a solution for the collaboration of different service providers. In order to reduce the computation overhead of resource-constrained mobile devices, outsourced encryption and decryption construction is adopted in our scheme, which can delegate most of the computation cost to a cloud server. Finally, we analyze the performance of our scheme with the existing schemes in MHSN and conduct experiments. The results have shown that our scheme is secure and efficient.



---

*Source: 6426495-2017-08-03.xml*