# User Privacy Protection Scheme Based on Verifiable Outsourcing Attribute-Based Encryption

Authors: Luo Sheng
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Given the rapid development of cloud computing and cloud storage technology, a growing number of enterprises and individuals use cloud storage services to save data or back up data. In the cloud storage services, although attribute-based encryption can protect users’ data security, the computational cost of key generation, data encryption, and data decryption linearly increases with the complexity of access strategies, which becomes more critical for resource-constrained users. Therefore, this paper proposes a verifiable attribute-based encryption scheme for a fully outsourced ciphertext policy. The scheme can simultaneously realize the functions of key generation, data encryption, and data decryption outsourcing and verify the correctness of the outsourcing calculation results. This scheme can effectively reduce the computational burden of a cloud storage system. The security and verifiability of the scheme are indicated and proved with the random oracle model. The experimental results show that the scheme has the advantages of function and efficiency compared with other schemes. The research results have theoretical and practical significance.


---

## Body

## 1. Introduction

In the era of big data, large amounts of data are rapidly generated from different sources (e.g., smartphones, sensors, and social networks). Traditional computer systems have been unable to store and process these data. The emerging cloud storage technology has been extensively utilized due to its advantages of low cost, large capacity, transparent access, and ability to provide services at any time [1, 2]. With the continuous development of cloud storage technology and mobile terminals, users can store their data in the cloud and rely on cloud servers to share data with other users. However, when data are outsourced to a cloud server, users lose physical control over their data, and the cloud service provider cannot be fully trusted. To solve the data security problem of cloud server users, Lai et al. [3] proposed a verifiable outsourcing decryption scheme, which can effectively verify the correctness of cloud computing results by establishing validation labels. As access policies are appended in plaintext to ciphertext, access policies may reveal user privacy. For example, if Alice encrypts her data to an ophthalmologist, then the attributes that an access policy may contain are ophthalmologists and doctors. Although the data cannot be decrypted, a person that views the data may speculate that Alice has an eye disease, which violates Alice’s privacy. To enable end users to effectively control their data access, sensitive data privacy protection mechanisms must be established for cloud storage. According to the literature, the existing cloud storage model has some shortcomings regarding encrypting and decrypting attributes based on outsourcing. The model has low computational efficiency and reliability and cannot adapt to large-scale user access. In this context, this paper proposes an efficient and verifiable fully outsourced CP-ABE scheme. This scheme can simultaneously realize the outsourcing of key generation, encryption, and decryption, verify the correctness of outsourcing calculation results, and build a secure and efficient cloud storage access control model.


## 2. Related Work

Traditional access control is based on trusted servers. To satisfy the requirements of cloud storage services, a cryptographic mechanism that is based on traditional access control is necessary. Attribute-based encryption (ABE) is a promising technology that cannot only guarantee the security of data storage but also realize flexible access permission settings [4, 5]. Currently, two classical algorithms exist for the attribute-based cryptosystem. The first algorithm is an attribute encryption algorithm that is based on ciphertext policy ABE (CP-ABE), which embeds access strategy into ciphertext, while the user’s private key binds a set of attributes to represent the user’s identity [6, 7]. Wang et al. [8] adopted the method [9] and extended most attribute encryption schemes based on a bilinear pairing operation to outsourced attribute encryption schemes. Lai et al. [10] considered the security verification of outsourcing decryption based on [9] and proposed an ABE scheme that supports verifiable outsourcing decryption and proves the security of the scheme with the standard model; however, the efficiency of the scheme is low. Subsequently, Lin et al. [11] systematically solved the security verification problem of outsourcing decryption; the efficiency of the proposed scheme was nearly half higher than that of [10]. In addition, Li et al. [12] used the MapReduce method to implement ABE-encrypted outsourcing computing. This scheme supports a tree access strategy and has a rich expressive ability but does not consider outsourcing decrypted computing. Fan et al. [13] proposed an ABE scheme that supports private key generation and decryption outsourcing, which employs two key generation service providers to help attribute authorization agencies complete the work of private key generation. Li et al. [14] proposed a verifiable outsourced multiauthorization access control scheme, which outsources most of the encryption and decryption tasks to fog nodes to reduce the user’s computing burden. The scheme can verify the correctness of the outsourced computing results. Li et al. [15] proposed a new verifiable outsourcing decryption ABE scheme. In this scheme, the length of ciphertext is not related to the complexity of the access policy. However, the scheme only supports the outsourcing of decryption computing, and the expression ability of the access policy is limited. None of these schemes can be completely outsourced, that is, private key generation, encryption, and decryption computing are simultaneously outsourced to third parties. Although Zhang et al. [15] proposed a completely outsourced CP-ABE scheme, which outsources key generation, encryption, and decryption to cloud service providers and completes the security certification of the scheme, the scheme could not verify the correctness of the outsourced calculation results. Ma et al. proposed a new construction of attribute-based encryption (ABE) which can outsource the complicated encryption task to a Encryption Service Provider (ESP) in a verifiable manner [16]. Hu et al. showed that Ma et al.’s proposal fails to provide the verifiability property for outsourced encryption [17]. However, verifiability is very important for cloud storage system applications.Due to the shortcomings of existing research, this paper proposes a verifiable complete outsourcing CP-ABE scheme. The scheme can realize the outsourcing of key generation, encryption, and decryption and verify the correctness of the outsourcing calculation results. Specifically, attributes authorization agencies employ two collude cloud service providers to generate an intermediate private keyISKx, such as x=1,2. The attribute authorization authority can complete the work of private key generation by simple calculation according to ISKx. This paper introduces the default attribute ξ to reconstruct the access policy to complete the encryption outsourcing work. Using the private key SK, reconstruct the transform key TK and retrieve the key RK. The cloud service providers complete part of the decryption of ciphertext via TK. In addition, two hash functions are used to verify the correctness of the outsourcing calculation results. This scheme can effectively reduce the computational burden of attribute authorization agencies and users. Based on the decision-making q-Bilinear Diffie–Hellman Exponent (q-BDHE) hypothesis, this paper proves the indistinguishable security of the proposed scheme in selecting plaintext attacks with the random oracle model and provides the verifiability proof of the proposed scheme. The theoretical analysis and experimental verification show that the proposed scheme has advantages of functionality and efficiency and is more suitable for practical application.


## 3. Research Model

The system model of the scheme proposed in this paper is shown in Figure1.Figure 1
A system model of fully outsourced attribute-based encryption.The core components of the system model include the Key Generation-Cloud Service Provider (KG-CSP), Encryption-Cloud Service Provider (E-CSP), Decryption-Cloud Service Provider (D-CSP), and Storage-Cloud Service Provider (S-CSP). These components provide private key generation services, data encryption services, data decryption services, and data storage services. During the process of service, however, the components cannot know the user’s private key and data plaintext.In this scheme, the data owner (DO) can use a mobile computing terminal to encrypt plaintext information and store it in the cloud. The data user (DU) can use mobile computing terminals to download ciphertext information from the cloud and decrypt it; mobile computing terminals can withstand this computing load.This paper assumes that the Attribute Authority (AA) is a fully trusted key distribution agency. Cloud service providers are honest but curious, that is, cloud service providers honestly follow the proper steps but due to curiosity will pry into the privacy of data during the course of their work [15]. Two KG−CSP cannot collude with each other to share data; thus, ISK obtained is information that is hidden relative to two KG−CSP.


## 4. Research Design

### 4.1. Theoretical Basis

#### 4.1.1. Bilinear Group

A bilinear group is an important key technology in the cryptosystem. Letψ be a group generation algorithm that considers the safety parameter λ as the input and output (p, G, GT, and e), where p is a prime determined by the safety parameter λ and G and GT are cyclic groups of the order prime p. Bilinear mapping e: G × G⟶GT satisfies the following properties:(1)
Bilinear:∀uandv∈G,aandb∈ZP,and eua,vb=eu,vab(2)
Non-degeneracy:g∈G exists such that the order of eg,g in GT is p, s∈Zp(3)
Computability: for∀uandv∈G, eu,v can be effectively calculated


#### 4.1.2. Linear Secret Sharing Scheme

The linear secret sharing scheme (LSSS) is defined as follows: if one of the key sharing schemes Π in the participant setp satisfies the following two conditions, then the scheme is referred to as a linear secret sharing scheme on Zp.(1)
The secret share of each entity constitutes a vector onZp.(2)
For each secret sharing scheme Π, a generating matrixMl×n exists. For each row i (i=1,2,…,l) in matrix M and mapping ρ:1,2,…,l⟶p, map each row in M to participant ρi, where ρ is a single projective function. Consider vector v=s,y2,…,yn, where s∈Zp is a shared key, y2,…,yn∈Zp is a random selection that is used to hide s, and Mv is a vector that consists of l secret shares. λi=Mvi represents the secret share of participant ρi.The LSSS scheme has a linear reconstruction property. Assume that Π is a linear secret sharing of access policyA. Let S∈A be an access authorization set, which is defined as I=i:ρi∈S. If λi is the effective share of secret s, then a set of constants wi∈Zpi∈I can be established in polynomial time, and equation ∑i∈Iwiλi=S holds.


#### 4.1.3. Decision-Makingq-BDHE Hypothesis

LetG denote a bilinear group whose order is prime p, and let g and h be two independent generators of group G. Choose the random value a∈ZP∗, and define yg,a,l=g1,g2,…,gl,gl+2,…,g2l∈G2l−1 among gi=gαi. The algorithm guesses by the output value z∈0,1.If|prBg,h,yg,α,l,egl+1,h=0−prBg,h,yg,α,l,Z=0|≥ε, then the dominant ε is defined to solve the decision-making q-BDHE problem for group G and GT. If there are no polynomial time algorithm existing, which cannot be disregarded to solve the decision-making q-BDHE problem, then we conclude that the decision-making q-BDHE hypothesis is valid in groups G and GT.


### 4.2. Hybrid Access Policy

This paper proposes a verifiable full outsourcing CP-ABE scheme based on Waters’ CP-ABE scheme [18]. In this scheme, the user’s private key is associated with the attribute set S, and the ciphertext is associated with the access policy M,ρ. To ensure the confidentiality of data in the process of encrypting outsourcing, this paper establishes the hybrid access policy Str=M,ρ∧ξ, where “∧” represents the “AND” gate, M,ρ represents the original access policy, and ξ represents the default attribute. For any given access policy T, the hybrid access policy Str=M,ρ∧ξ in this paper is constructed by introducing the default attribute ξ into the original access policy M,ρ using the “AND” gate. By this ingenious construction, the original access policy can be arbitrary. In the process of encryption, the data owner completes ξ encryption, and E-CSP completes M,ρ encryption without leaking plaintext information.


### 4.3. Encryption Scheme

The data security access control scheme in this article is as follows:(1)
Setup1λ: the algorithm chooses the bilinear group G, whose order is prime p, g is the generator of group G, and hξ,h1,…,hU∈G is a random group element. In addition, the exponent αandβ∈Zp is randomly selected and g1=gβ. Select the hash function H0:0,12λ⟶0,1∗, H1:0,1∗⟶Zp, and H2:0,1∗⟶0,1λ. The system master-private key MSK=ga and the system public key PK=G,g,g1,eg,gα,hξ,h1,…,hU,H0,H1,H2 are output.(2)
KeyGeninitPK,N: the algorithm randomly chooses exponent r′ and calculates D′=gβr′ and L′=gr′. For j=1 to N, calculate Dj′=hjr′. For j=ξ, calculate Dξ′=hξr′. The output intermediate key is ISKx=D′,L′,Dj′j∈1,N∪ξ, such as x=1,2.(3)
KeyGenpackageMSK,S,ISK1,ISK2: the algorithm uses the master-private key MSK, attribute set S=att1,att2,…,attk, and two independent sets ISK1=D′,L′,Dj′j∈1,k∪ξ and ISK1=D′,L′,Dj′j∈1,k∪ξ as input. The algorithm calculates L=L′⋅L″=gr′+r″=gr， D¯=D′⋅D″=gβr′+r″=gβr, and Dj=Dj′⋅Dj″=hjr′+r″=hjr， which implies that r=r′+r″. Obtain ISK=D¯,L,Djj∈1,k∪ξ. D=D¯⋅gα=gαgβr is computed, and the private key SK=D,L,Djj∈s∪ξ associated with attribute set S is output.(4)
Key BlindSK: the algorithm chooses a random value δ∈Zp and calculates D∧=Dδ and L∧=Lδ. For j∈S∪ξ, calculate Dj∧=Djδ. The retrieve key RK=δ and the conversion key TK=D∧,L∧,D∧jj∈s∪ξ are output.(5)
Encryptinitm: the algorithm randomly chooses R∈GT, calculates s=H1R,m, and randomly specifies a first-order polynomial q·, such as q0=s. The algorithm further sets s1=q1 and s1=q2. The encryption keys EKE−CSP=s1 and EKDO=s,s2,R are output.(6)
EncryptE−CSPPK,M,ρ,EKE−CSP: The algorithm takes PK,M,ρ,EKE−CSP as input parameters. M is a l×n matrix. Function ρ is a projective function that maps every row of M to an attribute. The algorithm randomly chooses vector v=s1,y2,…,yn∈Zp, which is used to encrypt index s1. For i=1 to l, calculate λi=vMi. Mi is the i line of the matrix M. The output middle ciphertext is CTE−CSP=C′=gs1,Ci=gβλihρi−s11≤i≤l.(7)
EncryptDOPK,M,ρ,EKDO,CTE−CSP,m: the algorithm obtains CTDO=C,C″,Cξ′,Cξ and verification flag VKm=H0t‖C″ by calculating t=H2R, C=R⋅eg,gαs, C″=m⊕t, VKm=H0t‖C″, Cξ′=gs2, and Cξ=gβs2hξ−s2. DO outputs the ciphertext CT=CTDO,CTE−CSP and then sends VKm and CT to S−CSP.(8)
DecryptD−CSPTK,CT: assume that the set of attributes S∪ξ that is associated with the user’s private key satisfies the mixed access policy Str=M,ρ∧ξ, which is associated with the ciphertext CT. The subscript set I⊆1,2,…,l of participants is defined as I=i:ρi∈S. If λi is an effective share of secret S1, then the set of constants wi∈Zpi∈I exists in polynomial time; thus, ∑i∈Iwiλi=S1. We note that several different ways to choose wi may exist to satisfy this formula. In addition, the decryption algorithm only needs to know M and I to determine these constants. DU sends TK to D−CSP. D−CSP is calculated according to the following formula:(1)T′=eC′,D∧∏i∈IeCi,L∧eC′,D∧ρiwi=egs1,gαgβrδ∏i∈Iegβλihρi−s1,grδegs1,hρirδwi=eg,gαs1δeg,gβrs1δ∏i∈Ieg,gβrδλiwi,T″=eCξ′,D∧eCξ,L∧eCξ′,D∧ξ=egs2,gαgβrδegβs2hξ−s2,grδegs2,hξrδ=eg,gαs2δ. We can calculate and obtain T=eg,gαsδ. The output converted the ciphertext TC=C,C″,T. D−CSP sends the converted ciphertext TC to DU.(9)
DecryptDUTC,VKm,RK: after DU receives TC, it calculates R=C/T1/δ and t=H2R. If H0t||C″≠VKm, output terminator ⊥. Otherwise, calculate m=C″⊕t and s=H1R,m. If C=R⋅eg,gαs, then T=eg,gαsδ outputs m; otherwise, it outputs terminator ⊥.


### 4.4. Safety Detection

#### 4.4.1. Scenario Hypothesis

This paper considers an adversary: adversaryA is a malicious user that can conspire with KG−CSPx(x can only be 1 or 2), E−CSP, D−CSP, and S−CSP. It can obtain user information, including ISKx(x can only be 1 or 2) of KG−CSPx, E−CSP encryption key EKE−CSP, intermediate ciphertext CTE−CSP, the conversion key TK of D−CSP, and the ciphertext CT of S−CSP. In this paper, the author assumes that x = 1, and then, A attempts to decrypt the ciphertext of other normal users.Choose the plaintext attack security game. The scheme proposed in this paper describes the Chosen Plaintext Attack (CPA) security game, which is described as follows:(1)
System initialization: the access strategyM∗,ρ∗ that adversary A will challenge is transmitted to emulator B(2)
System establishment:B executes the Setup algorithm and sends PK to rival AQuery phase 1: simulatorB initializes empty table T0, empty set E, and integer j=0. Rival A can repeat any of the following queries on attribute set S.(i)
CreateS： simulator B sets j:=j+1, runs the KenGeninit algorithm twice to obtain the intermediate private keys ISK1 and ISK2, runs KenGenpackage to obtain the private key SK of the associated attribute set S, and runs the Key Blind algorithm to obtain the conversion key TK and retrieve the key RK. j,S,SK,TK,RK,ISK1 is stored in table T0.Note: an adversary can repeatedly ask for the same set of attributes, such asfM∗,ρ∗,S≠1. However, A can submit the set of attributes S′, which satisfies M∗,ρ∗ for the Corrupt ISK1 query.(ii)
CorruptSKi: B verifies whether the number i entity i,S,SK exists in table T0. If this entity exists, set E:=E∪S and return SK; otherwise, return terminator ⊥.(iii)
CorruptISK1i: simulator B verifies whether the number i entity i,S,ISK1 existing in table T0. If this entity exists, return ISK1; otherwise, return terminator ⊥.(iv)
CorruptTKi: B verifies whether the number i entity i,S,TK exists in table T0. If this entity exists, return TK; otherwise, return terminator ⊥.Challenge phase: rivalA submits two equal-length messages m0 and m1, and then, emulator B randomly chooses b∈0,1. Based on the challenge access policy M∗,ρ∗ and plaintext message mb, after running Encryptinit, the encrypted key pair EKE−CSP∗,EKDO∗ is obtained. Run EncryptE−CSP to obtain the intermediate ciphertext CTE−CSP∗. Run EncryptDO to obtain the ciphertext CT∗ and verification flag VKm∗ of the plaintext message mb. B sends EKE−CSP∗, CT∗, and VKm∗ to rival A.Query phase 2: similar to query phase 1, rivalA continues to submit a list of attributes to simulator B.Guessing stage: rivalA outputs the value b′∈0,1 as a guess of b. If b′=b, we consider that rival A won the game. The advantage of rival A in the game is defined as follows: AdvACPAλ:=Prb′=b−1/2.Definition 1.
If no polynomial time exists, the rival uses the advantages that cannot be disregarded to attack the security model. We note that the objective of the proposed scheme is to choose plaintext security.
Verifiability game: verifiability ensures correct execution during the transformation phase. The verifiability of the proposed scheme is described by the game between simulatorB and rival A. The specific process is detailed as follows:
System establishment: simulatorB executes the Set up algorithm, sends PK to rival A, and retains the master-private key MSK.
Query phase 1:B responds to the query of rival A according to the way of private key generation. Because B knows MSK, it can answer all private key queries.
Challenge phase: rivalA submits the plaintext m∗ and access policy M∗,ρ∗. Simulator B runs Encryptinit to obtain the encryption key EKE−CSP∗. Run EncryptE−CSP to obtain the intermediate ciphertext CTE−CSP∗. Run EncryptDO to obtain CT∗,VKm∗. B sends them to rival A.
Query phase 2:B responds to the query from rival A by the way of query phase 1. However, rival A cannot ask for the set S of attributes that satisfy the access policy M∗,ρ∗.
Guessing stage: the output of rivalA satisfies S∗ and TC∗ of fM∗,ρ∗,S∗=1. If DecryptDUTC∗,RKs∗,VKm∗∗∉m∗,⊥, then A wins the game. A’s advantage in the game is defined as follows: AdvAVerλ:=PrAWins.Definition 2.
If no polynomial time exists, the rival uses the advantages that cannot be disregarded to attack the security model. We note that the scheme proposed in this paper is verifiable.


#### 4.4.2. Proof of Safety

Theorem 1.
Assuming that the decision-makingq-BDHE hypothesis is valid for groups G and GT, then the scheme proposed in this paper is selective CPA security with the random oracle model.
Prove: assuming that a polynomial time exists, rivalA can have the nonnegligible advantage ε and break through the scheme using the selective CPA security model. We can construct the simulator B, which has a nonnegligible advantage for solving the decision-making q-BDHE problem. Rival A is a malicious user and can conspire with KG−CSPx(x can only be 1 or 2), E−CSP, D−CSP, and S−CSP. This paper assumes that two KG−CSP cannot collude with each other to share data, while ISK is calculated by ISK1 and ISK2. ISK information is hidden from the perspective of all rivals A. This paper assumes that x=1 and that rival A attempts to decrypt the ciphertext of other normal users. Therefore, rival A can submit to satisfy attribute set S′ of M∗,ρ∗ for the ISK1 query but does not obtain any useful information about it.
B inputs the decision q-BDHE challenge tuple g,h,yg,α,l,andZ, where Z is a random element or egl+1,h and yg,α,l=g1,g2,…,gl,gl+2,…,g2l∈G2l−1 in group GT.
System initialization: rivalA chooses the access strategy T∗=M∗,ρ∗, which needs to be challenged, and sends it to the emulator B.
Establish system:B calculates PK=G,g,g1=ga,eg,ga,h1,…,hU,hξ by the way of challenger C in [18], and then, emulator B sends the public key PK to rival A.
Query phase 1:B initializes empty tables T0, T1, and T2, empty set E, and integer j=0. Rival A can repeat any of the following queries on the set of attributes.(1)
Random Oracle HashH1R,m. If the entity R,m,s exists in table T1, then it returns s. Otherwise, select the random value s∈Zp, record R,m,s in table T1, and return s.(2)
Random Oracle HashH2R. If the entity R,t exists in table T2, then it returns t. Otherwise, select the random value t∈0,1λ, record R,t in table T2, and return t.(3)
CreatS. After B receives the private key query of attribute set s from rival A, the default attribute ξ is added to the attribute set, that is, the private key query set is S∪ξ. B sets j:=j+1 and calculates and obtains SK=D,L,Djj∈S∪ξ according to challenger C in [18]. B runs KenGeninit to obtain ISK1. Run Key Blind to obtain the conversion key TK and retrieve the key RK. j,S,SK,TK,RK,ISK1 is stored in table T0. Note: A can repeatedly ask the same set of attributes S, where S can submit to satisfy fM∗,ρ∗,S≠1. However, A can submit attribute set S′ to satisfy M∗,ρ∗ for the ISK1 query.(4)
CorruptSKi. Simulator B verifies whether the ith entity i,S,andTK that exists in table T0. If it exists, set E:=E∪S and return SK. Otherwise, return terminator ⊥.(5)
CorruptISK1i. Simulator B verifies whether the ith entity i,S,andISK1 exists in table T0. If it exists, return ISK1. Otherwise, return terminator ⊥.(6)
CorruptTKi. Simulator B verifies whether the ith entity i,S,andTK exists in table T0. If it exists, return TK. Otherwise, return terminator ⊥.
Challenge phase: rivalA submits two plaintext messages of equal length m0 and m1. B randomly selects “message” R0,R1∈GT and b∈0,1. According to the method of C in [18], the ciphertext CTw=C¯,C′,Cii∈1,j (replace s with s1 in [18]; C¯ is equivalent to C） of the plaintext Rb correlation M∗,ρ∗ is obtained. B calculates s=H1Rb,mb and t=H2Rb, sets s2=s−s1, and calculates Cξ′=gs2, Cξ=gβs2hξ−s2, and egs2,gα′. Simulator B calculates C″=mb⊕t, VKm∗=H0t‖C″, and C=C¯⋅egs2,gα′. Simulator B sends CT∗=C,C″,Cξ′,Cξ,C′,Cii∈1,l, EKE−CSP∗=s1, and VKm∗=H0t‖C″ to rival A.
Query phase 2: similar to query phase 1, rivalA continues to submit a list of attributes to B.
Guessing stage: rivalA outputs the value b′∈0,1 as a guess of b. If b′=b, B output 0 indicates the guess Z=hgn+1,h. Otherwise, output 1 indicates the guess that Z is a random element in group GT. When Z=egn+1,h, simulator B can provide an effective simulation. Accordingly, we conclude that PrBg,h,yg,α,l,egl+1,h=0=1/2+AdvA. When Z is a random element in GT, mb is completely random for A. Accordingly, we conclude that PBg,h,yg,α,l,Z=0=1/2. Therefore, B has the advantage that it cannot be disregarded to attack the decision-making q-BDHE hypothesis.
The proof is complete.


#### 4.4.3. Proof of Verifiability

Theorem 2.
Assume thatH0 and H2 are hash functions against a collusion attack. The proposed scheme is verifiable.
Prove: assuming that rivalA can break through the verifiability, simulator B can be constructed to break down the anticollusion ability of the underlying hash functions H0 and H2. Rival A submits two challenge hash functions H0∗,H2∗. The simulation process of B is described as follows:
Establish system:B executes the Setup algorithm to obtain the public key PK and primary private key MSK. H0∗ and H2∗ are used to replace the hash functions in the public key PK. Note that B knows the primary private key MSK.
Query phase 1:B answers the query of rival A according to the adaptability of the scheme algorithm.
Challenge phase: rivalA submits the challenge plaintext m∗ and access strategy M∗,ρ∗. Simulator B calculates the ciphertext CTR∗=C,C′,Ci,Cξ′,Cξ of the random value R∗∈M and then calculates t∗=H2∗R∗, C'′∗=m∗⊕t∗, and VKm∗=H0∗t∗‖C″∗. B sends CT∗=CTR∗,C″∗ and VKm∗ to rival A. Retain VKm∗ and R∗,C″∗.
Query phase 2:B responds to the query of rival A in the way of query phase 1 but adversary A cannot query the attribute set S that satisfies the access policy M∗,ρ∗.
Guessing stage:A outputs the set of attributes S∗fM∗,ρ∗,S=1 and the transformation ciphertext TC=C,C″,T.
If rivalA breaks through the verifiability, then simulator B will restore plaintext m∉m∗,⊥ by DecryptDUTC∗,RKs∗,VKm∗∗. Analyse the potential success of rival A. If H0∗t‖C″≠VKm∗, the decryption algorithm outputs the terminator ⊥, such as t=H2∗R and R=C/T1/RKS∗. Therefore, we only need to consider the following two situations:
Situation 1:t,C″≠t∗,C″∗. As simulator B knows t∗,C″∗, B immediately obtains the collision of hash function H0∗.
Situation 2:t,C″=t∗,C″∗ but R≠R∗. H2∗R=t=t∗=H2∗R∗ will break the ability of H2∗ to resist a collusion attack.
Based on this analysis, the security proof of Theorem 2 is completed. The proof is complete.


## 4.1. Theoretical Basis

### 4.1.1. Bilinear Group

A bilinear group is an important key technology in the cryptosystem. Letψ be a group generation algorithm that considers the safety parameter λ as the input and output (p, G, GT, and e), where p is a prime determined by the safety parameter λ and G and GT are cyclic groups of the order prime p. Bilinear mapping e: G × G⟶GT satisfies the following properties:(1)
Bilinear:∀uandv∈G,aandb∈ZP,and eua,vb=eu,vab(2)
Non-degeneracy:g∈G exists such that the order of eg,g in GT is p, s∈Zp(3)
Computability: for∀uandv∈G, eu,v can be effectively calculated


### 4.1.2. Linear Secret Sharing Scheme

The linear secret sharing scheme (LSSS) is defined as follows: if one of the key sharing schemes Π in the participant setp satisfies the following two conditions, then the scheme is referred to as a linear secret sharing scheme on Zp.(1)
The secret share of each entity constitutes a vector onZp.(2)
For each secret sharing scheme Π, a generating matrixMl×n exists. For each row i (i=1,2,…,l) in matrix M and mapping ρ:1,2,…,l⟶p, map each row in M to participant ρi, where ρ is a single projective function. Consider vector v=s,y2,…,yn, where s∈Zp is a shared key, y2,…,yn∈Zp is a random selection that is used to hide s, and Mv is a vector that consists of l secret shares. λi=Mvi represents the secret share of participant ρi.The LSSS scheme has a linear reconstruction property. Assume that Π is a linear secret sharing of access policyA. Let S∈A be an access authorization set, which is defined as I=i:ρi∈S. If λi is the effective share of secret s, then a set of constants wi∈Zpi∈I can be established in polynomial time, and equation ∑i∈Iwiλi=S holds.


### 4.1.3. Decision-Makingq-BDHE Hypothesis

LetG denote a bilinear group whose order is prime p, and let g and h be two independent generators of group G. Choose the random value a∈ZP∗, and define yg,a,l=g1,g2,…,gl,gl+2,…,g2l∈G2l−1 among gi=gαi. The algorithm guesses by the output value z∈0,1.If|prBg,h,yg,α,l,egl+1,h=0−prBg,h,yg,α,l,Z=0|≥ε, then the dominant ε is defined to solve the decision-making q-BDHE problem for group G and GT. If there are no polynomial time algorithm existing, which cannot be disregarded to solve the decision-making q-BDHE problem, then we conclude that the decision-making q-BDHE hypothesis is valid in groups G and GT.


## 4.1.1. Bilinear Group

A bilinear group is an important key technology in the cryptosystem. Letψ be a group generation algorithm that considers the safety parameter λ as the input and output (p, G, GT, and e), where p is a prime determined by the safety parameter λ and G and GT are cyclic groups of the order prime p. Bilinear mapping e: G × G⟶GT satisfies the following properties:(1)
Bilinear:∀uandv∈G,aandb∈ZP,and eua,vb=eu,vab(2)
Non-degeneracy:g∈G exists such that the order of eg,g in GT is p, s∈Zp(3)
Computability: for∀uandv∈G, eu,v can be effectively calculated


## 4.1.2. Linear Secret Sharing Scheme

The linear secret sharing scheme (LSSS) is defined as follows: if one of the key sharing schemes Π in the participant setp satisfies the following two conditions, then the scheme is referred to as a linear secret sharing scheme on Zp.(1)
The secret share of each entity constitutes a vector onZp.(2)
For each secret sharing scheme Π, a generating matrixMl×n exists. For each row i (i=1,2,…,l) in matrix M and mapping ρ:1,2,…,l⟶p, map each row in M to participant ρi, where ρ is a single projective function. Consider vector v=s,y2,…,yn, where s∈Zp is a shared key, y2,…,yn∈Zp is a random selection that is used to hide s, and Mv is a vector that consists of l secret shares. λi=Mvi represents the secret share of participant ρi.The LSSS scheme has a linear reconstruction property. Assume that Π is a linear secret sharing of access policyA. Let S∈A be an access authorization set, which is defined as I=i:ρi∈S. If λi is the effective share of secret s, then a set of constants wi∈Zpi∈I can be established in polynomial time, and equation ∑i∈Iwiλi=S holds.


## 4.1.3. Decision-Makingq-BDHE Hypothesis

LetG denote a bilinear group whose order is prime p, and let g and h be two independent generators of group G. Choose the random value a∈ZP∗, and define yg,a,l=g1,g2,…,gl,gl+2,…,g2l∈G2l−1 among gi=gαi. The algorithm guesses by the output value z∈0,1.If|prBg,h,yg,α,l,egl+1,h=0−prBg,h,yg,α,l,Z=0|≥ε, then the dominant ε is defined to solve the decision-making q-BDHE problem for group G and GT. If there are no polynomial time algorithm existing, which cannot be disregarded to solve the decision-making q-BDHE problem, then we conclude that the decision-making q-BDHE hypothesis is valid in groups G and GT.


## 4.2. Hybrid Access Policy

This paper proposes a verifiable full outsourcing CP-ABE scheme based on Waters’ CP-ABE scheme [18]. In this scheme, the user’s private key is associated with the attribute set S, and the ciphertext is associated with the access policy M,ρ. To ensure the confidentiality of data in the process of encrypting outsourcing, this paper establishes the hybrid access policy Str=M,ρ∧ξ, where “∧” represents the “AND” gate, M,ρ represents the original access policy, and ξ represents the default attribute. For any given access policy T, the hybrid access policy Str=M,ρ∧ξ in this paper is constructed by introducing the default attribute ξ into the original access policy M,ρ using the “AND” gate. By this ingenious construction, the original access policy can be arbitrary. In the process of encryption, the data owner completes ξ encryption, and E-CSP completes M,ρ encryption without leaking plaintext information.


## 4.3. Encryption Scheme

The data security access control scheme in this article is as follows:(1)
Setup1λ: the algorithm chooses the bilinear group G, whose order is prime p, g is the generator of group G, and hξ,h1,…,hU∈G is a random group element. In addition, the exponent αandβ∈Zp is randomly selected and g1=gβ. Select the hash function H0:0,12λ⟶0,1∗, H1:0,1∗⟶Zp, and H2:0,1∗⟶0,1λ. The system master-private key MSK=ga and the system public key PK=G,g,g1,eg,gα,hξ,h1,…,hU,H0,H1,H2 are output.(2)
KeyGeninitPK,N: the algorithm randomly chooses exponent r′ and calculates D′=gβr′ and L′=gr′. For j=1 to N, calculate Dj′=hjr′. For j=ξ, calculate Dξ′=hξr′. The output intermediate key is ISKx=D′,L′,Dj′j∈1,N∪ξ, such as x=1,2.(3)
KeyGenpackageMSK,S,ISK1,ISK2: the algorithm uses the master-private key MSK, attribute set S=att1,att2,…,attk, and two independent sets ISK1=D′,L′,Dj′j∈1,k∪ξ and ISK1=D′,L′,Dj′j∈1,k∪ξ as input. The algorithm calculates L=L′⋅L″=gr′+r″=gr， D¯=D′⋅D″=gβr′+r″=gβr, and Dj=Dj′⋅Dj″=hjr′+r″=hjr， which implies that r=r′+r″. Obtain ISK=D¯,L,Djj∈1,k∪ξ. D=D¯⋅gα=gαgβr is computed, and the private key SK=D,L,Djj∈s∪ξ associated with attribute set S is output.(4)
Key BlindSK: the algorithm chooses a random value δ∈Zp and calculates D∧=Dδ and L∧=Lδ. For j∈S∪ξ, calculate Dj∧=Djδ. The retrieve key RK=δ and the conversion key TK=D∧,L∧,D∧jj∈s∪ξ are output.(5)
Encryptinitm: the algorithm randomly chooses R∈GT, calculates s=H1R,m, and randomly specifies a first-order polynomial q·, such as q0=s. The algorithm further sets s1=q1 and s1=q2. The encryption keys EKE−CSP=s1 and EKDO=s,s2,R are output.(6)
EncryptE−CSPPK,M,ρ,EKE−CSP: The algorithm takes PK,M,ρ,EKE−CSP as input parameters. M is a l×n matrix. Function ρ is a projective function that maps every row of M to an attribute. The algorithm randomly chooses vector v=s1,y2,…,yn∈Zp, which is used to encrypt index s1. For i=1 to l, calculate λi=vMi. Mi is the i line of the matrix M. The output middle ciphertext is CTE−CSP=C′=gs1,Ci=gβλihρi−s11≤i≤l.(7)
EncryptDOPK,M,ρ,EKDO,CTE−CSP,m: the algorithm obtains CTDO=C,C″,Cξ′,Cξ and verification flag VKm=H0t‖C″ by calculating t=H2R, C=R⋅eg,gαs, C″=m⊕t, VKm=H0t‖C″, Cξ′=gs2, and Cξ=gβs2hξ−s2. DO outputs the ciphertext CT=CTDO,CTE−CSP and then sends VKm and CT to S−CSP.(8)
DecryptD−CSPTK,CT: assume that the set of attributes S∪ξ that is associated with the user’s private key satisfies the mixed access policy Str=M,ρ∧ξ, which is associated with the ciphertext CT. The subscript set I⊆1,2,…,l of participants is defined as I=i:ρi∈S. If λi is an effective share of secret S1, then the set of constants wi∈Zpi∈I exists in polynomial time; thus, ∑i∈Iwiλi=S1. We note that several different ways to choose wi may exist to satisfy this formula. In addition, the decryption algorithm only needs to know M and I to determine these constants. DU sends TK to D−CSP. D−CSP is calculated according to the following formula:(1)T′=eC′,D∧∏i∈IeCi,L∧eC′,D∧ρiwi=egs1,gαgβrδ∏i∈Iegβλihρi−s1,grδegs1,hρirδwi=eg,gαs1δeg,gβrs1δ∏i∈Ieg,gβrδλiwi,T″=eCξ′,D∧eCξ,L∧eCξ′,D∧ξ=egs2,gαgβrδegβs2hξ−s2,grδegs2,hξrδ=eg,gαs2δ. We can calculate and obtain T=eg,gαsδ. The output converted the ciphertext TC=C,C″,T. D−CSP sends the converted ciphertext TC to DU.(9)
DecryptDUTC,VKm,RK: after DU receives TC, it calculates R=C/T1/δ and t=H2R. If H0t||C″≠VKm, output terminator ⊥. Otherwise, calculate m=C″⊕t and s=H1R,m. If C=R⋅eg,gαs, then T=eg,gαsδ outputs m; otherwise, it outputs terminator ⊥.


## 4.4. Safety Detection

### 4.4.1. Scenario Hypothesis

This paper considers an adversary: adversaryA is a malicious user that can conspire with KG−CSPx(x can only be 1 or 2), E−CSP, D−CSP, and S−CSP. It can obtain user information, including ISKx(x can only be 1 or 2) of KG−CSPx, E−CSP encryption key EKE−CSP, intermediate ciphertext CTE−CSP, the conversion key TK of D−CSP, and the ciphertext CT of S−CSP. In this paper, the author assumes that x = 1, and then, A attempts to decrypt the ciphertext of other normal users.Choose the plaintext attack security game. The scheme proposed in this paper describes the Chosen Plaintext Attack (CPA) security game, which is described as follows:(1)
System initialization: the access strategyM∗,ρ∗ that adversary A will challenge is transmitted to emulator B(2)
System establishment:B executes the Setup algorithm and sends PK to rival AQuery phase 1: simulatorB initializes empty table T0, empty set E, and integer j=0. Rival A can repeat any of the following queries on attribute set S.(i)
CreateS： simulator B sets j:=j+1, runs the KenGeninit algorithm twice to obtain the intermediate private keys ISK1 and ISK2, runs KenGenpackage to obtain the private key SK of the associated attribute set S, and runs the Key Blind algorithm to obtain the conversion key TK and retrieve the key RK. j,S,SK,TK,RK,ISK1 is stored in table T0.Note: an adversary can repeatedly ask for the same set of attributes, such asfM∗,ρ∗,S≠1. However, A can submit the set of attributes S′, which satisfies M∗,ρ∗ for the Corrupt ISK1 query.(ii)
CorruptSKi: B verifies whether the number i entity i,S,SK exists in table T0. If this entity exists, set E:=E∪S and return SK; otherwise, return terminator ⊥.(iii)
CorruptISK1i: simulator B verifies whether the number i entity i,S,ISK1 existing in table T0. If this entity exists, return ISK1; otherwise, return terminator ⊥.(iv)
CorruptTKi: B verifies whether the number i entity i,S,TK exists in table T0. If this entity exists, return TK; otherwise, return terminator ⊥.Challenge phase: rivalA submits two equal-length messages m0 and m1, and then, emulator B randomly chooses b∈0,1. Based on the challenge access policy M∗,ρ∗ and plaintext message mb, after running Encryptinit, the encrypted key pair EKE−CSP∗,EKDO∗ is obtained. Run EncryptE−CSP to obtain the intermediate ciphertext CTE−CSP∗. Run EncryptDO to obtain the ciphertext CT∗ and verification flag VKm∗ of the plaintext message mb. B sends EKE−CSP∗, CT∗, and VKm∗ to rival A.Query phase 2: similar to query phase 1, rivalA continues to submit a list of attributes to simulator B.Guessing stage: rivalA outputs the value b′∈0,1 as a guess of b. If b′=b, we consider that rival A won the game. The advantage of rival A in the game is defined as follows: AdvACPAλ:=Prb′=b−1/2.Definition 1.
If no polynomial time exists, the rival uses the advantages that cannot be disregarded to attack the security model. We note that the objective of the proposed scheme is to choose plaintext security.
Verifiability game: verifiability ensures correct execution during the transformation phase. The verifiability of the proposed scheme is described by the game between simulatorB and rival A. The specific process is detailed as follows:
System establishment: simulatorB executes the Set up algorithm, sends PK to rival A, and retains the master-private key MSK.
Query phase 1:B responds to the query of rival A according to the way of private key generation. Because B knows MSK, it can answer all private key queries.
Challenge phase: rivalA submits the plaintext m∗ and access policy M∗,ρ∗. Simulator B runs Encryptinit to obtain the encryption key EKE−CSP∗. Run EncryptE−CSP to obtain the intermediate ciphertext CTE−CSP∗. Run EncryptDO to obtain CT∗,VKm∗. B sends them to rival A.
Query phase 2:B responds to the query from rival A by the way of query phase 1. However, rival A cannot ask for the set S of attributes that satisfy the access policy M∗,ρ∗.
Guessing stage: the output of rivalA satisfies S∗ and TC∗ of fM∗,ρ∗,S∗=1. If DecryptDUTC∗,RKs∗,VKm∗∗∉m∗,⊥, then A wins the game. A’s advantage in the game is defined as follows: AdvAVerλ:=PrAWins.Definition 2.
If no polynomial time exists, the rival uses the advantages that cannot be disregarded to attack the security model. We note that the scheme proposed in this paper is verifiable.


### 4.4.2. Proof of Safety

Theorem 1.
Assuming that the decision-makingq-BDHE hypothesis is valid for groups G and GT, then the scheme proposed in this paper is selective CPA security with the random oracle model.
Prove: assuming that a polynomial time exists, rivalA can have the nonnegligible advantage ε and break through the scheme using the selective CPA security model. We can construct the simulator B, which has a nonnegligible advantage for solving the decision-making q-BDHE problem. Rival A is a malicious user and can conspire with KG−CSPx(x can only be 1 or 2), E−CSP, D−CSP, and S−CSP. This paper assumes that two KG−CSP cannot collude with each other to share data, while ISK is calculated by ISK1 and ISK2. ISK information is hidden from the perspective of all rivals A. This paper assumes that x=1 and that rival A attempts to decrypt the ciphertext of other normal users. Therefore, rival A can submit to satisfy attribute set S′ of M∗,ρ∗ for the ISK1 query but does not obtain any useful information about it.
B inputs the decision q-BDHE challenge tuple g,h,yg,α,l,andZ, where Z is a random element or egl+1,h and yg,α,l=g1,g2,…,gl,gl+2,…,g2l∈G2l−1 in group GT.
System initialization: rivalA chooses the access strategy T∗=M∗,ρ∗, which needs to be challenged, and sends it to the emulator B.
Establish system:B calculates PK=G,g,g1=ga,eg,ga,h1,…,hU,hξ by the way of challenger C in [18], and then, emulator B sends the public key PK to rival A.
Query phase 1:B initializes empty tables T0, T1, and T2, empty set E, and integer j=0. Rival A can repeat any of the following queries on the set of attributes.(1)
Random Oracle HashH1R,m. If the entity R,m,s exists in table T1, then it returns s. Otherwise, select the random value s∈Zp, record R,m,s in table T1, and return s.(2)
Random Oracle HashH2R. If the entity R,t exists in table T2, then it returns t. Otherwise, select the random value t∈0,1λ, record R,t in table T2, and return t.(3)
CreatS. After B receives the private key query of attribute set s from rival A, the default attribute ξ is added to the attribute set, that is, the private key query set is S∪ξ. B sets j:=j+1 and calculates and obtains SK=D,L,Djj∈S∪ξ according to challenger C in [18]. B runs KenGeninit to obtain ISK1. Run Key Blind to obtain the conversion key TK and retrieve the key RK. j,S,SK,TK,RK,ISK1 is stored in table T0. Note: A can repeatedly ask the same set of attributes S, where S can submit to satisfy fM∗,ρ∗,S≠1. However, A can submit attribute set S′ to satisfy M∗,ρ∗ for the ISK1 query.(4)
CorruptSKi. Simulator B verifies whether the ith entity i,S,andTK that exists in table T0. If it exists, set E:=E∪S and return SK. Otherwise, return terminator ⊥.(5)
CorruptISK1i. Simulator B verifies whether the ith entity i,S,andISK1 exists in table T0. If it exists, return ISK1. Otherwise, return terminator ⊥.(6)
CorruptTKi. Simulator B verifies whether the ith entity i,S,andTK exists in table T0. If it exists, return TK. Otherwise, return terminator ⊥.
Challenge phase: rivalA submits two plaintext messages of equal length m0 and m1. B randomly selects “message” R0,R1∈GT and b∈0,1. According to the method of C in [18], the ciphertext CTw=C¯,C′,Cii∈1,j (replace s with s1 in [18]; C¯ is equivalent to C） of the plaintext Rb correlation M∗,ρ∗ is obtained. B calculates s=H1Rb,mb and t=H2Rb, sets s2=s−s1, and calculates Cξ′=gs2, Cξ=gβs2hξ−s2, and egs2,gα′. Simulator B calculates C″=mb⊕t, VKm∗=H0t‖C″, and C=C¯⋅egs2,gα′. Simulator B sends CT∗=C,C″,Cξ′,Cξ,C′,Cii∈1,l, EKE−CSP∗=s1, and VKm∗=H0t‖C″ to rival A.
Query phase 2: similar to query phase 1, rivalA continues to submit a list of attributes to B.
Guessing stage: rivalA outputs the value b′∈0,1 as a guess of b. If b′=b, B output 0 indicates the guess Z=hgn+1,h. Otherwise, output 1 indicates the guess that Z is a random element in group GT. When Z=egn+1,h, simulator B can provide an effective simulation. Accordingly, we conclude that PrBg,h,yg,α,l,egl+1,h=0=1/2+AdvA. When Z is a random element in GT, mb is completely random for A. Accordingly, we conclude that PBg,h,yg,α,l,Z=0=1/2. Therefore, B has the advantage that it cannot be disregarded to attack the decision-making q-BDHE hypothesis.
The proof is complete.


### 4.4.3. Proof of Verifiability

Theorem 2.
Assume thatH0 and H2 are hash functions against a collusion attack. The proposed scheme is verifiable.
Prove: assuming that rivalA can break through the verifiability, simulator B can be constructed to break down the anticollusion ability of the underlying hash functions H0 and H2. Rival A submits two challenge hash functions H0∗,H2∗. The simulation process of B is described as follows:
Establish system:B executes the Setup algorithm to obtain the public key PK and primary private key MSK. H0∗ and H2∗ are used to replace the hash functions in the public key PK. Note that B knows the primary private key MSK.
Query phase 1:B answers the query of rival A according to the adaptability of the scheme algorithm.
Challenge phase: rivalA submits the challenge plaintext m∗ and access strategy M∗,ρ∗. Simulator B calculates the ciphertext CTR∗=C,C′,Ci,Cξ′,Cξ of the random value R∗∈M and then calculates t∗=H2∗R∗, C'′∗=m∗⊕t∗, and VKm∗=H0∗t∗‖C″∗. B sends CT∗=CTR∗,C″∗ and VKm∗ to rival A. Retain VKm∗ and R∗,C″∗.
Query phase 2:B responds to the query of rival A in the way of query phase 1 but adversary A cannot query the attribute set S that satisfies the access policy M∗,ρ∗.
Guessing stage:A outputs the set of attributes S∗fM∗,ρ∗,S=1 and the transformation ciphertext TC=C,C″,T.
If rivalA breaks through the verifiability, then simulator B will restore plaintext m∉m∗,⊥ by DecryptDUTC∗,RKs∗,VKm∗∗. Analyse the potential success of rival A. If H0∗t‖C″≠VKm∗, the decryption algorithm outputs the terminator ⊥, such as t=H2∗R and R=C/T1/RKS∗. Therefore, we only need to consider the following two situations:
Situation 1:t,C″≠t∗,C″∗. As simulator B knows t∗,C″∗, B immediately obtains the collision of hash function H0∗.
Situation 2:t,C″=t∗,C″∗ but R≠R∗. H2∗R=t=t∗=H2∗R∗ will break the ability of H2∗ to resist a collusion attack.
Based on this analysis, the security proof of Theorem 2 is completed. The proof is complete.


## 4.4.1. Scenario Hypothesis

This paper considers an adversary: adversaryA is a malicious user that can conspire with KG−CSPx(x can only be 1 or 2), E−CSP, D−CSP, and S−CSP. It can obtain user information, including ISKx(x can only be 1 or 2) of KG−CSPx, E−CSP encryption key EKE−CSP, intermediate ciphertext CTE−CSP, the conversion key TK of D−CSP, and the ciphertext CT of S−CSP. In this paper, the author assumes that x = 1, and then, A attempts to decrypt the ciphertext of other normal users.Choose the plaintext attack security game. The scheme proposed in this paper describes the Chosen Plaintext Attack (CPA) security game, which is described as follows:(1)
System initialization: the access strategyM∗,ρ∗ that adversary A will challenge is transmitted to emulator B(2)
System establishment:B executes the Setup algorithm and sends PK to rival AQuery phase 1: simulatorB initializes empty table T0, empty set E, and integer j=0. Rival A can repeat any of the following queries on attribute set S.(i)
CreateS： simulator B sets j:=j+1, runs the KenGeninit algorithm twice to obtain the intermediate private keys ISK1 and ISK2, runs KenGenpackage to obtain the private key SK of the associated attribute set S, and runs the Key Blind algorithm to obtain the conversion key TK and retrieve the key RK. j,S,SK,TK,RK,ISK1 is stored in table T0.Note: an adversary can repeatedly ask for the same set of attributes, such asfM∗,ρ∗,S≠1. However, A can submit the set of attributes S′, which satisfies M∗,ρ∗ for the Corrupt ISK1 query.(ii)
CorruptSKi: B verifies whether the number i entity i,S,SK exists in table T0. If this entity exists, set E:=E∪S and return SK; otherwise, return terminator ⊥.(iii)
CorruptISK1i: simulator B verifies whether the number i entity i,S,ISK1 existing in table T0. If this entity exists, return ISK1; otherwise, return terminator ⊥.(iv)
CorruptTKi: B verifies whether the number i entity i,S,TK exists in table T0. If this entity exists, return TK; otherwise, return terminator ⊥.Challenge phase: rivalA submits two equal-length messages m0 and m1, and then, emulator B randomly chooses b∈0,1. Based on the challenge access policy M∗,ρ∗ and plaintext message mb, after running Encryptinit, the encrypted key pair EKE−CSP∗,EKDO∗ is obtained. Run EncryptE−CSP to obtain the intermediate ciphertext CTE−CSP∗. Run EncryptDO to obtain the ciphertext CT∗ and verification flag VKm∗ of the plaintext message mb. B sends EKE−CSP∗, CT∗, and VKm∗ to rival A.Query phase 2: similar to query phase 1, rivalA continues to submit a list of attributes to simulator B.Guessing stage: rivalA outputs the value b′∈0,1 as a guess of b. If b′=b, we consider that rival A won the game. The advantage of rival A in the game is defined as follows: AdvACPAλ:=Prb′=b−1/2.Definition 1.
If no polynomial time exists, the rival uses the advantages that cannot be disregarded to attack the security model. We note that the objective of the proposed scheme is to choose plaintext security.
Verifiability game: verifiability ensures correct execution during the transformation phase. The verifiability of the proposed scheme is described by the game between simulatorB and rival A. The specific process is detailed as follows:
System establishment: simulatorB executes the Set up algorithm, sends PK to rival A, and retains the master-private key MSK.
Query phase 1:B responds to the query of rival A according to the way of private key generation. Because B knows MSK, it can answer all private key queries.
Challenge phase: rivalA submits the plaintext m∗ and access policy M∗,ρ∗. Simulator B runs Encryptinit to obtain the encryption key EKE−CSP∗. Run EncryptE−CSP to obtain the intermediate ciphertext CTE−CSP∗. Run EncryptDO to obtain CT∗,VKm∗. B sends them to rival A.
Query phase 2:B responds to the query from rival A by the way of query phase 1. However, rival A cannot ask for the set S of attributes that satisfy the access policy M∗,ρ∗.
Guessing stage: the output of rivalA satisfies S∗ and TC∗ of fM∗,ρ∗,S∗=1. If DecryptDUTC∗,RKs∗,VKm∗∗∉m∗,⊥, then A wins the game. A’s advantage in the game is defined as follows: AdvAVerλ:=PrAWins.Definition 2.
If no polynomial time exists, the rival uses the advantages that cannot be disregarded to attack the security model. We note that the scheme proposed in this paper is verifiable.


## 4.4.2. Proof of Safety

Theorem 1.
Assuming that the decision-makingq-BDHE hypothesis is valid for groups G and GT, then the scheme proposed in this paper is selective CPA security with the random oracle model.
Prove: assuming that a polynomial time exists, rivalA can have the nonnegligible advantage ε and break through the scheme using the selective CPA security model. We can construct the simulator B, which has a nonnegligible advantage for solving the decision-making q-BDHE problem. Rival A is a malicious user and can conspire with KG−CSPx(x can only be 1 or 2), E−CSP, D−CSP, and S−CSP. This paper assumes that two KG−CSP cannot collude with each other to share data, while ISK is calculated by ISK1 and ISK2. ISK information is hidden from the perspective of all rivals A. This paper assumes that x=1 and that rival A attempts to decrypt the ciphertext of other normal users. Therefore, rival A can submit to satisfy attribute set S′ of M∗,ρ∗ for the ISK1 query but does not obtain any useful information about it.
B inputs the decision q-BDHE challenge tuple g,h,yg,α,l,andZ, where Z is a random element or egl+1,h and yg,α,l=g1,g2,…,gl,gl+2,…,g2l∈G2l−1 in group GT.
System initialization: rivalA chooses the access strategy T∗=M∗,ρ∗, which needs to be challenged, and sends it to the emulator B.
Establish system:B calculates PK=G,g,g1=ga,eg,ga,h1,…,hU,hξ by the way of challenger C in [18], and then, emulator B sends the public key PK to rival A.
Query phase 1:B initializes empty tables T0, T1, and T2, empty set E, and integer j=0. Rival A can repeat any of the following queries on the set of attributes.(1)
Random Oracle HashH1R,m. If the entity R,m,s exists in table T1, then it returns s. Otherwise, select the random value s∈Zp, record R,m,s in table T1, and return s.(2)
Random Oracle HashH2R. If the entity R,t exists in table T2, then it returns t. Otherwise, select the random value t∈0,1λ, record R,t in table T2, and return t.(3)
CreatS. After B receives the private key query of attribute set s from rival A, the default attribute ξ is added to the attribute set, that is, the private key query set is S∪ξ. B sets j:=j+1 and calculates and obtains SK=D,L,Djj∈S∪ξ according to challenger C in [18]. B runs KenGeninit to obtain ISK1. Run Key Blind to obtain the conversion key TK and retrieve the key RK. j,S,SK,TK,RK,ISK1 is stored in table T0. Note: A can repeatedly ask the same set of attributes S, where S can submit to satisfy fM∗,ρ∗,S≠1. However, A can submit attribute set S′ to satisfy M∗,ρ∗ for the ISK1 query.(4)
CorruptSKi. Simulator B verifies whether the ith entity i,S,andTK that exists in table T0. If it exists, set E:=E∪S and return SK. Otherwise, return terminator ⊥.(5)
CorruptISK1i. Simulator B verifies whether the ith entity i,S,andISK1 exists in table T0. If it exists, return ISK1. Otherwise, return terminator ⊥.(6)
CorruptTKi. Simulator B verifies whether the ith entity i,S,andTK exists in table T0. If it exists, return TK. Otherwise, return terminator ⊥.
Challenge phase: rivalA submits two plaintext messages of equal length m0 and m1. B randomly selects “message” R0,R1∈GT and b∈0,1. According to the method of C in [18], the ciphertext CTw=C¯,C′,Cii∈1,j (replace s with s1 in [18]; C¯ is equivalent to C） of the plaintext Rb correlation M∗,ρ∗ is obtained. B calculates s=H1Rb,mb and t=H2Rb, sets s2=s−s1, and calculates Cξ′=gs2, Cξ=gβs2hξ−s2, and egs2,gα′. Simulator B calculates C″=mb⊕t, VKm∗=H0t‖C″, and C=C¯⋅egs2,gα′. Simulator B sends CT∗=C,C″,Cξ′,Cξ,C′,Cii∈1,l, EKE−CSP∗=s1, and VKm∗=H0t‖C″ to rival A.
Query phase 2: similar to query phase 1, rivalA continues to submit a list of attributes to B.
Guessing stage: rivalA outputs the value b′∈0,1 as a guess of b. If b′=b, B output 0 indicates the guess Z=hgn+1,h. Otherwise, output 1 indicates the guess that Z is a random element in group GT. When Z=egn+1,h, simulator B can provide an effective simulation. Accordingly, we conclude that PrBg,h,yg,α,l,egl+1,h=0=1/2+AdvA. When Z is a random element in GT, mb is completely random for A. Accordingly, we conclude that PBg,h,yg,α,l,Z=0=1/2. Therefore, B has the advantage that it cannot be disregarded to attack the decision-making q-BDHE hypothesis.
The proof is complete.


## 4.4.3. Proof of Verifiability

Theorem 2.
Assume thatH0 and H2 are hash functions against a collusion attack. The proposed scheme is verifiable.
Prove: assuming that rivalA can break through the verifiability, simulator B can be constructed to break down the anticollusion ability of the underlying hash functions H0 and H2. Rival A submits two challenge hash functions H0∗,H2∗. The simulation process of B is described as follows:
Establish system:B executes the Setup algorithm to obtain the public key PK and primary private key MSK. H0∗ and H2∗ are used to replace the hash functions in the public key PK. Note that B knows the primary private key MSK.
Query phase 1:B answers the query of rival A according to the adaptability of the scheme algorithm.
Challenge phase: rivalA submits the challenge plaintext m∗ and access strategy M∗,ρ∗. Simulator B calculates the ciphertext CTR∗=C,C′,Ci,Cξ′,Cξ of the random value R∗∈M and then calculates t∗=H2∗R∗, C'′∗=m∗⊕t∗, and VKm∗=H0∗t∗‖C″∗. B sends CT∗=CTR∗,C″∗ and VKm∗ to rival A. Retain VKm∗ and R∗,C″∗.
Query phase 2:B responds to the query of rival A in the way of query phase 1 but adversary A cannot query the attribute set S that satisfies the access policy M∗,ρ∗.
Guessing stage:A outputs the set of attributes S∗fM∗,ρ∗,S=1 and the transformation ciphertext TC=C,C″,T.
If rivalA breaks through the verifiability, then simulator B will restore plaintext m∉m∗,⊥ by DecryptDUTC∗,RKs∗,VKm∗∗. Analyse the potential success of rival A. If H0∗t‖C″≠VKm∗, the decryption algorithm outputs the terminator ⊥, such as t=H2∗R and R=C/T1/RKS∗. Therefore, we only need to consider the following two situations:
Situation 1:t,C″≠t∗,C″∗. As simulator B knows t∗,C″∗, B immediately obtains the collision of hash function H0∗.
Situation 2:t,C″=t∗,C″∗ but R≠R∗. H2∗R=t=t∗=H2∗R∗ will break the ability of H2∗ to resist a collusion attack.
Based on this analysis, the security proof of Theorem 2 is completed. The proof is complete.


## 5. Experiments and Results

### 5.1. Theoretical Analysis

To evaluate the computational efficiency of the scheme proposed in this paper, the computational overhead in the stages of private key generation, encryption, and decryption is theoretically analysed. The computational efficiency of this scheme is compared with that of the ABE scheme in [8, 13–15, 18]. In the process of the comparison, U represents the number of all attributes in the system, S denotes the number of attributes of DU, s represents a set of attributes that satisfies the decryption requirements, and l represents the number of rows in matrix M in LSSS. In addition, EG and EGT represent modular exponential operations in G and GT, respectively. P represents bilinear pairing operations. To compare the fairness, [13] is assumed to have only one AA. Table 1 shows the efficiency comparison of each scheme. Wang et al. [8] used offline or online technology in the encryption phase. To facilitate the comparison, other outsourcing technologies are compared.Table 1
Comparative analysis of computational efficiency.
SchemesReference [18]Reference [8]Reference [14]Reference [15]Reference [13]Author’s schemeKey generationAA2+SEG4+SEG3EG05+2SEG0KG-CSP4S+3EG2S+6EGEncryptionDO2l+1EG+1EGT2EG+EGT6EG+2EGT1EGT1EGT3EG+1EGTE-CSP3UEG5l+1EG3l+1EG2l+1EGDecryptionDUsEGT+2s+1p1EGT2EG+2EGT1EGT1EGT3EGTD-CSPsEG+sEGT+3s+2p4p2s+2EG+sEGT+3s+2p3s+1EG+sEGT+2s+1psEGT+2s+4pVerifiabilityNoNoYesNoYesYesOutsourceNoYesYesYesYesYesThe comparison of calculation efficiency of each scheme is shown in Table1. The work by Waters [18] is a CP-ABE-based scheme, which is also a solution without outsourcing. In [18], attribute authorization agencies, data users, and data owners need to compute a large number of pairwise and exponential operations. And, this paper proposes the author’s scheme based on [18]. The scheme achieves a verifiable and complete outsourcing function. This scheme can reduce the computational burden of AA, DO, and DU and considerably ease the computational burden of computing resource-constrained terminals. Li et al. [14] only support outsourced decryption calculation and can verify the correctness of the calculation results. Although the work [14] does not support the outsourcing computing function of key generation and encryption, it achieves the constant length of ciphertext and requires less computation in the key generation and encryption stage. The disadvantage is that [14] only supports the “AND” gate access strategy and has limited expressive ability. Wang et al. [8] support offline/online encryption and decryption outsourcing but the scheme does not support validation of the correctness of outsourcing decryption, and AA requires a large number of exponential operations. Kai et al. [13] support encryption and decryption outsourcing and verify the correctness of the calculation results but their AA requires numerous exponential operations. Rui et al. [15] and the author’s scheme realize the outsourcing functions of key generation, encryption, and decryption. However, Rui et al. [15] does not support verifiability and cannot guarantee the correctness of the calculation results.The comprehensive analysis shows that only the author’s scheme achieves the outsourcing computing functions of key generation, encryption, and decryption, reduces the computing load of the terminal, and supports verifiability. Outsourcing computing is important for mobile devices with limited electricity and computing resources. Therefore, the author’s scheme is effective and practical.


### 5.2. Experimental Analysis

Via theoretical analysis, the author’s scheme has advantages of function and efficiency. To further evaluate the actual performance of the author’s scheme, the author tested the computational time of [15] and the author’s scheme in terms of private key generation, data encryption, and data decryption by the following experimental environments. The experimental environment configuration is shown in Table 2.Table 2
Configuration of the experimental environment.
NameParameterRemarksHardwareCPUIntel(R) CoreTM i5-2400 @ 3.10 GHZ8 M cacheI/O reading speed 2 MMemoryDDR3 1333/1600 MHz, 4GHard disk256 GB PCIe × 4 NVMe SSDNetworkGuangzhou TelecomSoftwareOperating systemUbuntu 12.04NothingPBC LibraryPBC-0.5.14Encryption modeOpenSSL-1.0.0c, 128Bit, AESIn the CP-ABE scheme, access complexity affects the time of encryption and decryption. To illustrate this point, this paper usesS1ANDS2AND…Sn’s access strategy to simulate the most complex situation, where each Si is an attribute. This method ensures that all ciphertext components are involved in decryption computation. In this form, each time increment is 10, from 10 to 100, which produces 10 different access strategies. For each access strategy, 20 experiments are repeated, each experiment is completely independent, and the average is considered the experimental result.Attribute-based encryption usually cooperates with symmetric encryption to encrypt plaintext data, that is, encrypt plaintext with the symmetric key, and then encapsulates the symmetric key with attribute-based encryption. Therefore, to obtain benchmark results, a 128 bit symmetric key is encapsulated based on the previously mentioned access strategy. The experimental results are shown in Figure2.Figure 2
Comparison of simulation time. (a) Key generation of KG-CSP and AA. (b) Encryption of E-CSP and DO. (c) Decryption of D-CSP and DU.
(a)(b)(c)Figure2 has three subgraphs. Each subgraph compares the execution time of the author’s scheme and Rui et al.’s [15] scheme.Figure2(a) shows that KG−CSP undertakes most of the key generation, and the time of key generation linearly increases with the number of attributes. Attribute authorization agencies only need to undertake a small amount of computation to complete the key generation. In the foregoing section, the author analyses that the calculation amount of AA is 0. The author disregards multiplication and hash operations as they are secondary factors.Figure2(b) shows that E−CSP undertakes most of the encryption work, and the encryption time linearly increases with the complexity of the access policy. The data owner only requires a constant amount of computation to complete the encryption work.Figure2(c) shows that D−CSP undertakes most of the decryption work, and the ciphertext conversion time linearly increases with the complexity of the access strategy. User decryption only requires constant computation to complete the decryption work, which is unrelated to the complexity of the access policy.Figure2 shows that the key generation time, encryption time, and decryption time increase with the complexity of the attribute sets or access policies. By comparing the two schemes, the computing cost of the author’s scheme in the cloud is less than that of [15]. This advantage becomes more distinct with an increase of the number of attributes or the complexity of the access strategy. Figure 2(a) illustrates that both [15] and AA of the author’s scheme require less computation to complete the key generation, and the efficiency is comparable. Figures 2(b) and 2(c) show that DO and DU in [15] require less computation than the author’s scheme. However, this gap is very small and does not change with the number of attributes or the complexity of the access policies.The computation of the author’s scheme in the cloud is less than that in [15] and becomes more distinct with an increase in the number of attributes or the complexity of the access strategy, which helps AA and enables users to rent less cloud computing resources and reduce costs. The local computational complexity of the author’s scheme is slightly higher than that of [15]. However, this gap is very small and does not change with an increase in the number of attributes or the complexity of the access strategy. In addition, the author’s scheme supports the verifiability of decryption outsourcing, which is not available in [15].


## 5.1. Theoretical Analysis

To evaluate the computational efficiency of the scheme proposed in this paper, the computational overhead in the stages of private key generation, encryption, and decryption is theoretically analysed. The computational efficiency of this scheme is compared with that of the ABE scheme in [8, 13–15, 18]. In the process of the comparison, U represents the number of all attributes in the system, S denotes the number of attributes of DU, s represents a set of attributes that satisfies the decryption requirements, and l represents the number of rows in matrix M in LSSS. In addition, EG and EGT represent modular exponential operations in G and GT, respectively. P represents bilinear pairing operations. To compare the fairness, [13] is assumed to have only one AA. Table 1 shows the efficiency comparison of each scheme. Wang et al. [8] used offline or online technology in the encryption phase. To facilitate the comparison, other outsourcing technologies are compared.Table 1
Comparative analysis of computational efficiency.
SchemesReference [18]Reference [8]Reference [14]Reference [15]Reference [13]Author’s schemeKey generationAA2+SEG4+SEG3EG05+2SEG0KG-CSP4S+3EG2S+6EGEncryptionDO2l+1EG+1EGT2EG+EGT6EG+2EGT1EGT1EGT3EG+1EGTE-CSP3UEG5l+1EG3l+1EG2l+1EGDecryptionDUsEGT+2s+1p1EGT2EG+2EGT1EGT1EGT3EGTD-CSPsEG+sEGT+3s+2p4p2s+2EG+sEGT+3s+2p3s+1EG+sEGT+2s+1psEGT+2s+4pVerifiabilityNoNoYesNoYesYesOutsourceNoYesYesYesYesYesThe comparison of calculation efficiency of each scheme is shown in Table1. The work by Waters [18] is a CP-ABE-based scheme, which is also a solution without outsourcing. In [18], attribute authorization agencies, data users, and data owners need to compute a large number of pairwise and exponential operations. And, this paper proposes the author’s scheme based on [18]. The scheme achieves a verifiable and complete outsourcing function. This scheme can reduce the computational burden of AA, DO, and DU and considerably ease the computational burden of computing resource-constrained terminals. Li et al. [14] only support outsourced decryption calculation and can verify the correctness of the calculation results. Although the work [14] does not support the outsourcing computing function of key generation and encryption, it achieves the constant length of ciphertext and requires less computation in the key generation and encryption stage. The disadvantage is that [14] only supports the “AND” gate access strategy and has limited expressive ability. Wang et al. [8] support offline/online encryption and decryption outsourcing but the scheme does not support validation of the correctness of outsourcing decryption, and AA requires a large number of exponential operations. Kai et al. [13] support encryption and decryption outsourcing and verify the correctness of the calculation results but their AA requires numerous exponential operations. Rui et al. [15] and the author’s scheme realize the outsourcing functions of key generation, encryption, and decryption. However, Rui et al. [15] does not support verifiability and cannot guarantee the correctness of the calculation results.The comprehensive analysis shows that only the author’s scheme achieves the outsourcing computing functions of key generation, encryption, and decryption, reduces the computing load of the terminal, and supports verifiability. Outsourcing computing is important for mobile devices with limited electricity and computing resources. Therefore, the author’s scheme is effective and practical.


## 5.2. Experimental Analysis

Via theoretical analysis, the author’s scheme has advantages of function and efficiency. To further evaluate the actual performance of the author’s scheme, the author tested the computational time of [15] and the author’s scheme in terms of private key generation, data encryption, and data decryption by the following experimental environments. The experimental environment configuration is shown in Table 2.Table 2
Configuration of the experimental environment.
NameParameterRemarksHardwareCPUIntel(R) CoreTM i5-2400 @ 3.10 GHZ8 M cacheI/O reading speed 2 MMemoryDDR3 1333/1600 MHz, 4GHard disk256 GB PCIe × 4 NVMe SSDNetworkGuangzhou TelecomSoftwareOperating systemUbuntu 12.04NothingPBC LibraryPBC-0.5.14Encryption modeOpenSSL-1.0.0c, 128Bit, AESIn the CP-ABE scheme, access complexity affects the time of encryption and decryption. To illustrate this point, this paper usesS1ANDS2AND…Sn’s access strategy to simulate the most complex situation, where each Si is an attribute. This method ensures that all ciphertext components are involved in decryption computation. In this form, each time increment is 10, from 10 to 100, which produces 10 different access strategies. For each access strategy, 20 experiments are repeated, each experiment is completely independent, and the average is considered the experimental result.Attribute-based encryption usually cooperates with symmetric encryption to encrypt plaintext data, that is, encrypt plaintext with the symmetric key, and then encapsulates the symmetric key with attribute-based encryption. Therefore, to obtain benchmark results, a 128 bit symmetric key is encapsulated based on the previously mentioned access strategy. The experimental results are shown in Figure2.Figure 2
Comparison of simulation time. (a) Key generation of KG-CSP and AA. (b) Encryption of E-CSP and DO. (c) Decryption of D-CSP and DU.
(a)(b)(c)Figure2 has three subgraphs. Each subgraph compares the execution time of the author’s scheme and Rui et al.’s [15] scheme.Figure2(a) shows that KG−CSP undertakes most of the key generation, and the time of key generation linearly increases with the number of attributes. Attribute authorization agencies only need to undertake a small amount of computation to complete the key generation. In the foregoing section, the author analyses that the calculation amount of AA is 0. The author disregards multiplication and hash operations as they are secondary factors.Figure2(b) shows that E−CSP undertakes most of the encryption work, and the encryption time linearly increases with the complexity of the access policy. The data owner only requires a constant amount of computation to complete the encryption work.Figure2(c) shows that D−CSP undertakes most of the decryption work, and the ciphertext conversion time linearly increases with the complexity of the access strategy. User decryption only requires constant computation to complete the decryption work, which is unrelated to the complexity of the access policy.Figure2 shows that the key generation time, encryption time, and decryption time increase with the complexity of the attribute sets or access policies. By comparing the two schemes, the computing cost of the author’s scheme in the cloud is less than that of [15]. This advantage becomes more distinct with an increase of the number of attributes or the complexity of the access strategy. Figure 2(a) illustrates that both [15] and AA of the author’s scheme require less computation to complete the key generation, and the efficiency is comparable. Figures 2(b) and 2(c) show that DO and DU in [15] require less computation than the author’s scheme. However, this gap is very small and does not change with the number of attributes or the complexity of the access policies.The computation of the author’s scheme in the cloud is less than that in [15] and becomes more distinct with an increase in the number of attributes or the complexity of the access strategy, which helps AA and enables users to rent less cloud computing resources and reduce costs. The local computational complexity of the author’s scheme is slightly higher than that of [15]. However, this gap is very small and does not change with an increase in the number of attributes or the complexity of the access strategy. In addition, the author’s scheme supports the verifiability of decryption outsourcing, which is not available in [15].


## 6. Concluding Remarks

To improve the efficiency of the CP-ABE scheme, the author proposes a verifiable full outsourcing scheme. The scheme can simultaneously realize the outsourcing function of key generation, encryption, and decryption calculation and verify the correctness of the outsourcing calculation results. This scheme can effectively alleviate the computational burden of attribute authorization agencies, data owners, and data users, especially for cloud storage systems with a large number of users and users with limited resources, and the advantages are more distinct. With the random oracle model, the indistinguishable security of the author’s scheme against a plaintext attack and the verifiability of the author’s scheme are proved. The theoretical analysis and experimental verification show that the author’s scheme has advantages of functionality and efficiency and is more suitable for practical application [19–24].



---

*Source: 6617669-2021-08-17.xml*