# Fully Constant-Size CP-ABE with Privacy-Preserving Outsourced Decryption for Lightweight Devices in Cloud-Assisted IoT

Authors: Zhishuo Zhang; Wei Zhang; Zhiguang Qin
Journal: Security and Communication Networks
 (2021)

---

## Abstract

In recent years, ciphertext-policy attribute-based encryption (CP-ABE) has been recognized as a solution to the challenge of the information privacy and data confidentiality in cloud-assisted Internet-of-Things (IoT). Since the devices in cloud-assisted IoT are generally resource-constrained, the lightweight CP-ABE is more suitable for the cloud-assisted IoT. So how to construct the lightweight CP-ABE for the cloud-assisted IoT to achieve the fine-grained access control and ensure the privacy and confidentiality simultaneously is a prominent challenge. Thus, in this paper, we propose a constant-size CP-ABE scheme with outsourced decryption for the cloud-assisted IoT. In our scheme, the ciphertexts and the attribute-based private keys for users are both of constant size, which can alleviate the transmission overhead and reduce the occupied storage space. Our outsourced decryption algorithm is privacy-protective, which means the proxy server cannot know anything about the access policy of the ciphertext and the attributes set of the user during performing the online partial decryption algorithm. This will prevent the privacy from leaking out to the proxy server. And we rigorously prove that our scheme is selectively indistinguishably secure under the chosen ciphertext attacks (IND-CCA) in the random oracle model (ROM). Finally, by evaluating and implementing our scheme as well as other CP-ABE schemes, we can observe that our scheme is more suitable and applicable for cloud-assisted IoT.


---

## Body

## 1. Introduction

IoT has been recognized as a new paradigm in the network and information area in recent years [1, 2]. By means of the widespread deployment of spatially distributed devices, such as sensors, radio-frequency identification (RFID), wireless devices, and smartphones, IoT has the perfect sensing and actuation capabilities and makes the existing information system intelligent. Though IoT gives a new dimension to the Internet and has envisioned a future in which digital and physical entities can be linked in anywhere [3–5], security is still a critical obstacle for enabling the widespread adoption of the cloud-assisted IoT. To solve the security and privacy problem in IoT environment, many works design some authentication protocols [6], signature schemes [7] for Industrial Internet of Things (IIoT) [8, 9], Internet of Vehicles (IoV) [10, 11], and RFID networks [12]. But how to design a one-to-many and fine-grained access control encryption mechanism for the cloud-assisted IoT is still being an open issue.In cloud-assisted IoT, the data owners and the users all use the smart IoT devices. In traditional cloud-assisted IoT system, data owners transmit the data to the cloud server over the transmission media and the users download the data from the cloud storage. A hacker can easily access and steal the data in cleartext stored on the cloud storage. So, an encryption mechanism should be deployed in the cloud-assisted IoT architecture to ensure the data confidentiality and prevent the unauthorized access of the data [13, 14]. Figure 1 shows the comparison of the traditional cloud-assisted IoT system and the encryption mechanism-based cloud-assisted IoT system.Figure 1
The comparison of the traditional cloud-assisted IoT system and the encryption mechanism-based cloud-assisted IoT system.ABE [15] is a new cryptographic primitive widely researched in recent years which supports one-to-many encryption and refines the access control to the attribute level. So, ABE has been regarded as a powerful encryption mechanism for the cloud-assisted IoT. Particularly, CP-ABE [16–18], which is a type of ABE, enables the data owner to customize an access formula over a set of attributes for each ciphertext and only if the user’s attributes set meets the access policy, the user can decrypt the ciphertext. So, in CP-ABE, the data owner can precisely control the access to his/her data, and this makes CP-ABE a more applicable encryption tool for the cloud-based system. Nevertheless, in cloud-assisted IoT, the devices are generally resource-constrained (e.g., limited battery life, storage, and computing capability); the traditional CP-ABE is too complex to be fit-for-purpose. In typical CP-ABE, as [16–18], the ciphertext length grows linearly with the number of the attributes in the access policy and the size of the user’s attribute-based private key also grows linearly with the size of the user’s attributes set. Furthermore, as the access structure becomes more complex, the decryption time by the user will become longer, which not only increases the power consumption of the user’s portable devices, but also makes the system less useful. To make CP-ABE applicable for the lightweight devices in the cloud-assisted IoT, in this paper, we propose a lightweight CP-ABE scheme with both constant-size ciphertexts and private keys. And we also invent a privacy-preserving outsourced decryption algorithm for the users to alleviate their computing burden. The privacy-preserving outsourced decryption algorithm can protect the privacy of the users and the data owners from divulging to the proxy server that means during performing the online partial decryption phase, the proxy server cannot know anything about the access policy associated with the ciphertext and the attributes set of the user. This will prevent the privacy from leaking out to the proxy server. To rigorously prove that our scheme is selectively IND-CCA secure in ROM, we reduce our scheme to n-aMSE-DDH problem [19–21].


### 1.1. Related Works

Lately, some researchers improve CP-ABE in two approaches to make the pure CP-ABE schemes applicable for the resource-constrained devices in IoT environment. One way is to construct the lightweight CP-ABE to mitigate the transmission overhead of the system. And another way is outsourcing the decryption phase to proxy server to relieve the computing burden of the users used IoT devices.


#### 1.1.1. Constant-Size CP-ABE

These works [20, 22] construct the constant-size ciphertext CP-ABE schemes which are using “Threshold policy” as their access structures. The scheme in [21] improves the work [20] to make a constant-size ciphertext CP-ABE scheme based on “Threshold policy” without dummy attributes. Emura et al. [23] build a fully constant-size CP-ABE scheme with both constant-size ciphertexts and private keys, but the access structure in their scheme [23] is using the less expressive “Strict AND-gate Policy.” And these works [24, 25] use [23] as their base construction also using the less expressive “Strict AND-gate Policy.” To make a trade-off between the expressiveness of the access structure and scale of the scheme, Yang et.al [26], Doshi and Jinwala [27], and Han et al. [28] use “AND-gate Policy with Wildcards” as their access structures to build the CP-ABE schemes with constant-size ciphertexts. To further lighten the CP-ABE schemes and reduce the transmission pressure, these schemes [19, 29] use “Tolerant AND-gate Policy based on Bits String” as their access structures which encoding an access structure to a bit string.


#### 1.1.2. Outsourced Decryption

Green et al. firstly proposed a new cryptographic primitive of outsourced decryption CP-ABE in [30]. But in their schemes, a malicious proxy server could return a wrong transformed ciphertext to the user by disloyally running the outsourced transforming algorithm. Thus, their scheme [30] does not strictly guarantee the correctness of the transformed ciphertext sent to users. To solve this flaw, Lai et al. [31] add a verification function to [30], but their scheme [31] adds some redundant components to the original ciphertext; this will make their ciphertext being twice length of the original ciphertext. To increase the efficiency of [31], Lin et al. [32], Qin et al. [33], and Mao et al. [34], respectively, designed a CP-ABE scheme with outsourced decryption and efficient decryption verification simultaneously. And all the schemes above [30–34] are based on [17]. Recently, Ning et al. [35] proposed an auditable σtime outsourced CP-ABE scheme based on [18], which can achieve higher security and can resist various types of attacks such as key-leakage attacks. And some schemes [36–38] with different properties combine with the outsourced decryption to make their schemes more suitable for IoT devices. But the users in all the above outsourced CP-ABE schemes will expose their attribute sets to the proxy server for running the semidecryption, which will lead to the disclosure of the privacy.


## 1.1. Related Works

Lately, some researchers improve CP-ABE in two approaches to make the pure CP-ABE schemes applicable for the resource-constrained devices in IoT environment. One way is to construct the lightweight CP-ABE to mitigate the transmission overhead of the system. And another way is outsourcing the decryption phase to proxy server to relieve the computing burden of the users used IoT devices.


### 1.1.1. Constant-Size CP-ABE

These works [20, 22] construct the constant-size ciphertext CP-ABE schemes which are using “Threshold policy” as their access structures. The scheme in [21] improves the work [20] to make a constant-size ciphertext CP-ABE scheme based on “Threshold policy” without dummy attributes. Emura et al. [23] build a fully constant-size CP-ABE scheme with both constant-size ciphertexts and private keys, but the access structure in their scheme [23] is using the less expressive “Strict AND-gate Policy.” And these works [24, 25] use [23] as their base construction also using the less expressive “Strict AND-gate Policy.” To make a trade-off between the expressiveness of the access structure and scale of the scheme, Yang et.al [26], Doshi and Jinwala [27], and Han et al. [28] use “AND-gate Policy with Wildcards” as their access structures to build the CP-ABE schemes with constant-size ciphertexts. To further lighten the CP-ABE schemes and reduce the transmission pressure, these schemes [19, 29] use “Tolerant AND-gate Policy based on Bits String” as their access structures which encoding an access structure to a bit string.


### 1.1.2. Outsourced Decryption

Green et al. firstly proposed a new cryptographic primitive of outsourced decryption CP-ABE in [30]. But in their schemes, a malicious proxy server could return a wrong transformed ciphertext to the user by disloyally running the outsourced transforming algorithm. Thus, their scheme [30] does not strictly guarantee the correctness of the transformed ciphertext sent to users. To solve this flaw, Lai et al. [31] add a verification function to [30], but their scheme [31] adds some redundant components to the original ciphertext; this will make their ciphertext being twice length of the original ciphertext. To increase the efficiency of [31], Lin et al. [32], Qin et al. [33], and Mao et al. [34], respectively, designed a CP-ABE scheme with outsourced decryption and efficient decryption verification simultaneously. And all the schemes above [30–34] are based on [17]. Recently, Ning et al. [35] proposed an auditable σtime outsourced CP-ABE scheme based on [18], which can achieve higher security and can resist various types of attacks such as key-leakage attacks. And some schemes [36–38] with different properties combine with the outsourced decryption to make their schemes more suitable for IoT devices. But the users in all the above outsourced CP-ABE schemes will expose their attribute sets to the proxy server for running the semidecryption, which will lead to the disclosure of the privacy.


## 1.1.1. Constant-Size CP-ABE

These works [20, 22] construct the constant-size ciphertext CP-ABE schemes which are using “Threshold policy” as their access structures. The scheme in [21] improves the work [20] to make a constant-size ciphertext CP-ABE scheme based on “Threshold policy” without dummy attributes. Emura et al. [23] build a fully constant-size CP-ABE scheme with both constant-size ciphertexts and private keys, but the access structure in their scheme [23] is using the less expressive “Strict AND-gate Policy.” And these works [24, 25] use [23] as their base construction also using the less expressive “Strict AND-gate Policy.” To make a trade-off between the expressiveness of the access structure and scale of the scheme, Yang et.al [26], Doshi and Jinwala [27], and Han et al. [28] use “AND-gate Policy with Wildcards” as their access structures to build the CP-ABE schemes with constant-size ciphertexts. To further lighten the CP-ABE schemes and reduce the transmission pressure, these schemes [19, 29] use “Tolerant AND-gate Policy based on Bits String” as their access structures which encoding an access structure to a bit string.


## 1.1.2. Outsourced Decryption

Green et al. firstly proposed a new cryptographic primitive of outsourced decryption CP-ABE in [30]. But in their schemes, a malicious proxy server could return a wrong transformed ciphertext to the user by disloyally running the outsourced transforming algorithm. Thus, their scheme [30] does not strictly guarantee the correctness of the transformed ciphertext sent to users. To solve this flaw, Lai et al. [31] add a verification function to [30], but their scheme [31] adds some redundant components to the original ciphertext; this will make their ciphertext being twice length of the original ciphertext. To increase the efficiency of [31], Lin et al. [32], Qin et al. [33], and Mao et al. [34], respectively, designed a CP-ABE scheme with outsourced decryption and efficient decryption verification simultaneously. And all the schemes above [30–34] are based on [17]. Recently, Ning et al. [35] proposed an auditable σtime outsourced CP-ABE scheme based on [18], which can achieve higher security and can resist various types of attacks such as key-leakage attacks. And some schemes [36–38] with different properties combine with the outsourced decryption to make their schemes more suitable for IoT devices. But the users in all the above outsourced CP-ABE schemes will expose their attribute sets to the proxy server for running the semidecryption, which will lead to the disclosure of the privacy.


## 2. Preliminaries

### 2.1. AND-gate Access Structures

#### 2.1.1. Strict AND-gate Policy

LetN=name1,name2,…,namen be the set of the attribute names. And Si=vi,1,vi,2,…,vi,ni is the possible values set of the name namei. L=l1,l2,…,ln is the attribute set of a user, where li is an element in Sili∈Si,1≤i≤n. The W=w1,w2,…,wn is a strict AND-gate policy where wi is an element in Siwi∈Si,1≤i≤n. Iff for all i∈1,n, li=wi holds, we call L satisfies the policy W. The scheme in [23] uses the “Strict AND-gate Policy” as its access structure.


#### 2.1.2. AND-Gate Policy with Wildcards

LetN=name1,name2,…,namen be the set of the attribute names. And Si=vi,1,vi,2,…,vi,ni is the possible values set of the name namei. L=l1,l2,…,ln is the attribute set of a user where li is an element in Sili∈Si,1≤i≤n. The W=w1,w2,…,wn is an AND-gate policy with wildcards where wi is an element in Si or the wildcard ∗wi∈Si,∗,1≤i≤n. IW is the set of indices i1≤i≤n in which wi≠∗; that is, IW=i|1≤i≤n,wi≠∗. Iff for all i∈IW, li=wi holds, we call L satisfies the policy W. The schemes in [26, 27] use the “AND-gate Policy with Wildcards” as their access structure.


#### 2.1.3. Tolerant AND-Gate Policy Based on Bits String

LetU=Attr1,Attr2,...,Attrn be the attribute universe. L=l1l2,…,ln is an n-bit string used to denote a user’s attribute set where li∈0,11≤i≤n. If li=1, it means that the user has the attribute Attri and if li=0, it means that the user does not have the attribute Attri. And W=w1w2,…,wnwi∈0,1,1≤i≤n is the policy n-bit string. If wi=1, it means that the access policy W needs the attribute Attri and if wi=0, it means that the access policy W does not care about attribute Attri. IW is the set of indices i1≤i≤n in which wi=1; that is, IW=i|1≤i≤n,wi=1. IW denotes the size of IW. Iff for all i∈IW, li=wi=1 holds, we call the attributes set L satisfies the access policy W. For instance, suppose U=Attr1,Attr2,Attr3,Attr4,Attr5 and two attribute sets as L1=10011 and L2=00111. The access policy is W=10001. So, we can observe that L1 can satisfy W and L2 cannot meet W. The schemes in [19, 39] use the “Tolerant AND-gate Policy based on Bits String” as their access structure.Through the description of the three types of AND-gate access structures, we can observe that the “AND-gate Policy with Wildcards” and “Tolerant AND-gate Policy based on Bits String” are more flexible and expressive than the “Strict AND-gate Policy.” Furthermore, encoding an access structure to a bit string can compress the size of the access structure and which also can mitigate the communication burden. Our scheme uses the “Tolerant AND-gate Policy Based on Bits String” as the access structure.


### 2.2. Bilinear Pairings

G1,G2 are two elliptic groups and GT is a multiplicative group. g0 is a generator of G1 and h0 is a generator of G2. G1,G2,GT are all with prime order p. e:G1×G2⟶GT is called the bilinear pairing if(i)
For anyg∈G1,h∈G2 and a,b∈ℤp∗, we have ega,hb=eg,hab.(ii)
Ifg0 is a generator of G1 and h0 is a generator of G2, eg0,h0 is a generator of GT.(iii)
Group operations inG1,G2 and e:G1×G2⟶GT are both efficiently computable. If G1 and G2 are the same group, that is, G1=G2=G, we call e:G×G⟶GT the symmetric bilinear pairing.And, the termsBP=G1,G2,GT,p,g0,h0,e are called the bilinear pairing terms.


### 2.3. n-aMSE-DDH Problem [19–21]

LetBP=G1,G2,GT,p,g0,h0,e be the bilinear pairing terms. Let fx and θx be two coprime polynomials in ℤpx. Choose a,γ←Rℤp∗ where “←R” means “randomly choose from.” Give T,p⟶ to any probabilistic polynomial-time (PPT) adversary. Then, no adversary has the nonnegligible advantage to distinguish T=eg0,h0γfa or T=R, where R is a random element in GT. And p⟶=(1)g0ai0≤i≤n−1,g0afa,g0γafa;h0ai0≤i≤n,h0γ;h0ai/θa0≤i≤n.


## 2.1. AND-gate Access Structures

### 2.1.1. Strict AND-gate Policy

LetN=name1,name2,…,namen be the set of the attribute names. And Si=vi,1,vi,2,…,vi,ni is the possible values set of the name namei. L=l1,l2,…,ln is the attribute set of a user, where li is an element in Sili∈Si,1≤i≤n. The W=w1,w2,…,wn is a strict AND-gate policy where wi is an element in Siwi∈Si,1≤i≤n. Iff for all i∈1,n, li=wi holds, we call L satisfies the policy W. The scheme in [23] uses the “Strict AND-gate Policy” as its access structure.


### 2.1.2. AND-Gate Policy with Wildcards

LetN=name1,name2,…,namen be the set of the attribute names. And Si=vi,1,vi,2,…,vi,ni is the possible values set of the name namei. L=l1,l2,…,ln is the attribute set of a user where li is an element in Sili∈Si,1≤i≤n. The W=w1,w2,…,wn is an AND-gate policy with wildcards where wi is an element in Si or the wildcard ∗wi∈Si,∗,1≤i≤n. IW is the set of indices i1≤i≤n in which wi≠∗; that is, IW=i|1≤i≤n,wi≠∗. Iff for all i∈IW, li=wi holds, we call L satisfies the policy W. The schemes in [26, 27] use the “AND-gate Policy with Wildcards” as their access structure.


### 2.1.3. Tolerant AND-Gate Policy Based on Bits String

LetU=Attr1,Attr2,...,Attrn be the attribute universe. L=l1l2,…,ln is an n-bit string used to denote a user’s attribute set where li∈0,11≤i≤n. If li=1, it means that the user has the attribute Attri and if li=0, it means that the user does not have the attribute Attri. And W=w1w2,…,wnwi∈0,1,1≤i≤n is the policy n-bit string. If wi=1, it means that the access policy W needs the attribute Attri and if wi=0, it means that the access policy W does not care about attribute Attri. IW is the set of indices i1≤i≤n in which wi=1; that is, IW=i|1≤i≤n,wi=1. IW denotes the size of IW. Iff for all i∈IW, li=wi=1 holds, we call the attributes set L satisfies the access policy W. For instance, suppose U=Attr1,Attr2,Attr3,Attr4,Attr5 and two attribute sets as L1=10011 and L2=00111. The access policy is W=10001. So, we can observe that L1 can satisfy W and L2 cannot meet W. The schemes in [19, 39] use the “Tolerant AND-gate Policy based on Bits String” as their access structure.Through the description of the three types of AND-gate access structures, we can observe that the “AND-gate Policy with Wildcards” and “Tolerant AND-gate Policy based on Bits String” are more flexible and expressive than the “Strict AND-gate Policy.” Furthermore, encoding an access structure to a bit string can compress the size of the access structure and which also can mitigate the communication burden. Our scheme uses the “Tolerant AND-gate Policy Based on Bits String” as the access structure.


## 2.1.1. Strict AND-gate Policy

LetN=name1,name2,…,namen be the set of the attribute names. And Si=vi,1,vi,2,…,vi,ni is the possible values set of the name namei. L=l1,l2,…,ln is the attribute set of a user, where li is an element in Sili∈Si,1≤i≤n. The W=w1,w2,…,wn is a strict AND-gate policy where wi is an element in Siwi∈Si,1≤i≤n. Iff for all i∈1,n, li=wi holds, we call L satisfies the policy W. The scheme in [23] uses the “Strict AND-gate Policy” as its access structure.


## 2.1.2. AND-Gate Policy with Wildcards

LetN=name1,name2,…,namen be the set of the attribute names. And Si=vi,1,vi,2,…,vi,ni is the possible values set of the name namei. L=l1,l2,…,ln is the attribute set of a user where li is an element in Sili∈Si,1≤i≤n. The W=w1,w2,…,wn is an AND-gate policy with wildcards where wi is an element in Si or the wildcard ∗wi∈Si,∗,1≤i≤n. IW is the set of indices i1≤i≤n in which wi≠∗; that is, IW=i|1≤i≤n,wi≠∗. Iff for all i∈IW, li=wi holds, we call L satisfies the policy W. The schemes in [26, 27] use the “AND-gate Policy with Wildcards” as their access structure.


## 2.1.3. Tolerant AND-Gate Policy Based on Bits String

LetU=Attr1,Attr2,...,Attrn be the attribute universe. L=l1l2,…,ln is an n-bit string used to denote a user’s attribute set where li∈0,11≤i≤n. If li=1, it means that the user has the attribute Attri and if li=0, it means that the user does not have the attribute Attri. And W=w1w2,…,wnwi∈0,1,1≤i≤n is the policy n-bit string. If wi=1, it means that the access policy W needs the attribute Attri and if wi=0, it means that the access policy W does not care about attribute Attri. IW is the set of indices i1≤i≤n in which wi=1; that is, IW=i|1≤i≤n,wi=1. IW denotes the size of IW. Iff for all i∈IW, li=wi=1 holds, we call the attributes set L satisfies the access policy W. For instance, suppose U=Attr1,Attr2,Attr3,Attr4,Attr5 and two attribute sets as L1=10011 and L2=00111. The access policy is W=10001. So, we can observe that L1 can satisfy W and L2 cannot meet W. The schemes in [19, 39] use the “Tolerant AND-gate Policy based on Bits String” as their access structure.Through the description of the three types of AND-gate access structures, we can observe that the “AND-gate Policy with Wildcards” and “Tolerant AND-gate Policy based on Bits String” are more flexible and expressive than the “Strict AND-gate Policy.” Furthermore, encoding an access structure to a bit string can compress the size of the access structure and which also can mitigate the communication burden. Our scheme uses the “Tolerant AND-gate Policy Based on Bits String” as the access structure.


## 2.2. Bilinear Pairings

G1,G2 are two elliptic groups and GT is a multiplicative group. g0 is a generator of G1 and h0 is a generator of G2. G1,G2,GT are all with prime order p. e:G1×G2⟶GT is called the bilinear pairing if(i)
For anyg∈G1,h∈G2 and a,b∈ℤp∗, we have ega,hb=eg,hab.(ii)
Ifg0 is a generator of G1 and h0 is a generator of G2, eg0,h0 is a generator of GT.(iii)
Group operations inG1,G2 and e:G1×G2⟶GT are both efficiently computable. If G1 and G2 are the same group, that is, G1=G2=G, we call e:G×G⟶GT the symmetric bilinear pairing.And, the termsBP=G1,G2,GT,p,g0,h0,e are called the bilinear pairing terms.


## 2.3. n-aMSE-DDH Problem [19–21]

LetBP=G1,G2,GT,p,g0,h0,e be the bilinear pairing terms. Let fx and θx be two coprime polynomials in ℤpx. Choose a,γ←Rℤp∗ where “←R” means “randomly choose from.” Give T,p⟶ to any probabilistic polynomial-time (PPT) adversary. Then, no adversary has the nonnegligible advantage to distinguish T=eg0,h0γfa or T=R, where R is a random element in GT. And p⟶=(1)g0ai0≤i≤n−1,g0afa,g0γafa;h0ai0≤i≤n,h0γ;h0ai/θa0≤i≤n.


## 3. Our Constant-Size CP-ABE Scheme with Privacy-Preserving Outsourced Decryption

### 3.1. System Architecture

The framework of our cloud-assisted IoT system used our scheme is shown in Figure2. There are six entities involved in our system which are stated as follows.Figure 2
Our system framework.


#### 3.1.1. Attribute Authority (AA)

AA is in charge of initializing the system and generating the private keys for users.


#### 3.1.2. Cloud Storage

The cloud storage stores the ciphertexts for data owners (DOs).


#### 3.1.3. Data Owner (DOs)

DOs encrypt the data to ciphertexts and upload the ciphertexts to the cloud.


#### 3.1.4. Users

The users download the ciphertexts from the cloud storage then retrieve the plaintext by the decryption algorithm. The users have two types. One type is Users with PCs and the other is Users with smart IoT devices.(i)
Users with PCs: users with PCs retrieve the plaintext by running the local-decryption phase(ii)
Users with IoT devices: the users with smartphones or the smart tablets can retrieve the data by performing the privacy-preserving outsourced decryption phase


#### 3.1.5. Proxy Server

Proxy servers take charge of running the online partial decryption algorithm for the users with smart IoT devices. Note that the proxy servers cannot know anything about the user’s attributes and the access policy associated with the ciphertext during running the partial decryption.


### 3.2. Algorithm Definitions

The workflow of our cloud-assisted IoT system used in our scheme is shown in Figure3. There are four algorithms in our scheme described as below.Figure 3
Our system framework.


#### 3.2.1. Setup

AA initializes the system by executing the Setup algorithm to export the public parametersPK and master private key MK of the system. AA preserves the private master key privately and publishes the public parameters to all the entities in the system.


#### 3.2.2. AttrKeyGen

A user forms his attribute set as a bit string then sends his/her bit string-based attribute set to the AA; AA runs the AttrKeyGen algorithm to generate the constant-size attribute-based private key for the user. Then, the user will preserve the attribute-based key privately. If the user’s attribute set can meet the access policy associated with the ciphertext, he/she can use his/her private key to decrypt the ciphertext.


#### 3.2.3. Encrypt

A DO customizes a bit string formed attribute-based access policy for the data; then, by the Encrypt algorithm, the DO encrypts the data under the customized access policy to a ciphertext, which is constant size. Then, the DO uploads the ciphertext with the bit string formed access policy onto the cloud storage.


#### 3.2.4. Decrypt

A user downloads the ciphertext with the access policy from the cloud storage. If the user’s attribute set meets the access policy, then he/she can retrieve the data by running the Decrypt algorithm. And, the Decrypt algorithm has two modes. One mode is local decryption. The local decryption means all the computations are running on the user’s local device, and this mode is suitable for the users with PCs. If the user is using the smart IoT devices, then the user can choose the other decryption mode called privacy-preserving outsourced decryption to securely and privately outsource some complex computations to the proxy server. This will reduce the decryption time of the user and save the battery power of the user’s smart IoT device. Note that the proxy servers cannot know anything about the user’s attributes and the access policy associated with the ciphertext during partially decrypting the ciphertext.


### 3.3. Security Model

We define a selectively IND-CCA security game for our scheme which involves an adversary algorithmA and a challenge algorithm C in.(i)
Initialization. A sends a bit string based AND-gate challenge access structure W∗ to C.(ii)
Setup. C runs setup algorithm to generate the master private key MK and public parameters PK. Then, C sends PK to A.(iii)
Key Query 1. A queries a list of bit strings to C for the key queries. Note that all the key queries cannot satisfy the challenge access structure W∗.(iv)
Decryption Query 1. A queries the decryption of ciphertext EncryptWi,Mi from C.(v)
Challenge. A sends two messages M0∈0,1lm and M1∈0,1lm to C for challenge. Cb←R0,1 and sends W∗,EncryptW∗,Mb back to A.(vi)
Key Query 2. Same as Key Query 1. Notice that all key queries in this phase also cannot satisfy the access structure W∗.(vii)
Decryption Query 2. Same as Decryption Query 1. And notice that the decryption queries cannot be the challenge messages M0 and M1.(viii)
Guess. A outputs a guess b′b.AdvA=Prb′=b−1/2. A wins the confidentiality game if AdvA is nonnegligible.


### 3.4. Scheme Construction

#### 3.4.1. Setup

AA performs the Setup phase to initialize the system by the following steps.(i)
AA exports a bilinear pairingBP=G1,G2,GT,p,g,h,e from the security parameter κ. g is a generator of G1 and h is a generator of G2. Then, AA chooses four one-way collision-resistance hash function as H1,H′:0,1∗ℤp∗, H2:GT0,1lβ, H3:0,1lβ0,1lm.(ii)
AA defines the attribute universeU=Attr1,Attr2,…,Attrn of the system, n=U. Then, AA a,k1,k2←Rℤp∗ and computes hi=hai,ui=hk1ai,vi=hk2aii=0n.(iii)
Finally, AA preserves the master private key (MK) and publishes the public parameters (PK) as(2)MK=g,a,k1,k2;PK=U,hi,ui,vii=0n,H1,H2,H3,H′,eg,h,ga.


#### 3.4.2. AttrKeyGen

A user forms his attribute set as a bit stringL=l1l2,…,ln where li∈0,11≤i≤n and then sends L to the AA via a secure channel. Then, AA generates the attribute-based private key for the user by the following steps.(i)
AA generates ann−degree at most polynomial function fx,L=∏i=1nx+H′Attri1−li in ℤpx by using the bit string L. Then, AA computes fa,L=∏i=1na+H′Attri1−li.(ii)
AAru←Rℤp∗ and computes su with the condition 1/fa,L=k1su+k2ru, that is, su=1/fa,L−k2ru/k1.(iii)
Finally, AA computes the attribute-based private keyKu=Ku,1=gru,Ku,2=gsu for the user and sends Ku to the user via a secure channel.


#### 3.4.3. Encrypt

DO performs the following steps to encrypt the dataM∈0,1lm.(i)
DO customizes an AND-gate access structure based on bit string asW=w1w2,…,wn where wi∈0,11≤i≤n for the data M∈0,1lm. Iw is the set of indices i1≤i≤nin which wi=1, that is, Iw=i|1≤i≤n,wi=1. And Iw denotes the size of Iw. Notice that Iw>0. Then, DO generates a n−IW−degree polynomial fx,W=∏i=1nx+H′Attri1−wi in ℤpx by using the access bit string W. Let fi,W be the coefficient of xi in fx,W.(ii)
DOβm←R0,1lβ and computes rm=H1W,M,βm.(iii)
Finally, DO computes the ciphertext for the dataM∈0,1lm as CT=C1,C2,C3,C4,C5 and then sends CT,W to the cloud storage.(3)C1=garm;C2=∏i=0n−|IW|uifi,Wrm=hrmk1∑i=0n−|IW|aifi,W=hrmk1fa,W;C3=∏i=0n−IWvifi,Wrm=hrmk2∑i=0n−|IW|aifi,W=hrmk2fa,W;C4=H2eg,hrm⊕βm;C5=H3βm⊕M.


#### 3.4.4. Decryption

The user downloads the ciphertextCT,W from the cloud storage. If the user’s attributes set L can meet the access policy W associated with the ciphertext, the user can decrypt the ciphertext in two ways. One way is the local decryption and another is the privacy-preserving outsourced decryption. If the user uses the PC, he/she can use the local decryption algorithm to obtain the data. Or if the user uses the IoT device, such as smartphone, he/she can use the privacy-preserving outsourced decryption to obtain the data without the computing pressure. Notice that if and only if L meets W, the user can generate a n−IW−degree at most polynomial Fx,L,W=fx,W/fx,L=∏i=1nx+H′Attrili−wi=∑i=0n−IWxiFi,L,W in ℤpx where Fi,L,W is the coefficient of xi and it is clear that F0,L,W≠0. F⟶=F0,L,W,F1,L,W,…,Fn−IW,L,W is the coefficient vector of Fx,L,W in ℤp∗.Local decryption: the user runs the local decryption by the following steps:(4)W=eC1,∏i=1n−IWhi−1Fi,L,W=egarm,∏i=1n−IWhai−1Fi,L,W=eg,harm∑i=1n−IWai−1Fi,L,W=eg,hrm∑i=1n−IWaiFi,L,W=eg,hrm∑i=1n−IWaiFi,L,W+F0,L,W−F0,L,W=eg,hrmFa,L,W−rmF0,L,W,U=eKu,2,C2=eg,hk1fa,Wrmsu,V=eKu,1,C3=eg,hk2fa,Wrmru,UV=eg,hk1fa,Wrmsu+k2fa,Wrmru=eg,hrmfa,Wk1su+k2ru=eg,hrmfa,W/fa,L=eg,hrmFa,L,WUVW1/F0,L,W=eg,hrmFa,L,Weg,hrmFa,L,W−rmF0,L,W1/F0,L,W=eg,hrm=V1,βm′=C4⊕H2V1M′=C5⊕H3βm′.Then, the user computesrm′=H1W,M′,βm′ and verifies V1=?eg,hrm′. If the equation holds, this indicates the user decrypts the ciphertext successfully M′=M.Privacy-preserving outsourced decryption: the useru1,u2←Rℤp∗ and computes the blinded coefficient vector BV⟶ in ℤp∗ and the blinded private key BK as(5)BV⟶=0,u1F1,L,W,…,u1Fn−IW,L,Wmodp;BK=BKu,1=Ku,1u2,BKu,2=Ku,2u2.Then, the user sendsC1,C2,C3,BV⟶,BK to the proxy server. It is clear that the proxy server only cannot know anything about L and W from the blind coefficient vector BV⟶ and the blind private key BK. The proxy server uses C1,C2,C3,BV⟶,BK to compute(6)P1=eC1,∏i=1n−IWhi−1u1Fi,L,W=egarm,∏i=1n−IWhai−1u1Fi,L,W=eg,harm∑i=1n−IWai−1u1Fi,L,W=eg,hu1rm∑i=1n−IWaiFi,L,W=eg,hu1rm∑i=1n−IWaiFi,L,W+F0,L,W−F0,L,W=eg,hu1rmFa,L,W−rmF0,L,W,U′=eBKu,2,C2=eg,hu2k1fa,Wrmsu,V′=eBKu,1,C3=eg,hu2k2fa,Wrmru,P2=U′V′=eg,hu2k1fa,Wrmsu+k2fa,Wrmru=eg,hu2rmfa,Wk1su+k2ru=eg,hu2rmfa,W/fa,L=eg,hu2rmFa,L,W.Then, proxy server sendsP1,P2 back to the user. The user uses C4,C5,P1,P2,u1,u2 to compute(7)W=P11/u1=eg,hrmFa,L,W−rmF0,L,W;J=P21/u2=eg,hrmFa,L,W;JW1/F0,L,W=eg,hrmFa,L,Weg,hrmFa,L,W−rmF0,L,W1/F0,L,W=eg,hrm=V1,βm′=C4⊕H2V1,M′=C5⊕H3βm′.Then, the user computesrm′=H1W,M′,βm′ and verifies V1=?eg,hrm′. If the equation holds, this indicates the user decrypts the ciphertext successfully M′=M.


### 3.5. Security Analysis

Theorem. If the n-aMSE-DDH problem holds, then our scheme is selectively IND-CCA-secure.Proof. Suppose there is a PPT adversary A who can break the security of our scheme with a nonnegligible advantage AdvA. Then, we can construct a PPT simulator algorithm C which is able to solve the n-aMSE-DDH problem with the nonnegligible advantage AdvA−qH2/p by interacting with A in the following manner where p is the order of group GT and qH2 is the number of the queries to the oracle H2.


#### 3.5.1. Initialization

Note that there aren attributes U=Attr1,Attr2,…,Attrn in the scheme. A submits the challenge access bit string W∗=w1∗w2∗,…,wn∗ where wi∗∈0,11≤i≤n to C. IW∗=i|1≤i≤n,wi∗=1. IW∗ is the size of IW∗. Cv1,v2,…,vn←Rℤp∗ and sets(8)θx=fx,W∗=∏i=1nx+vi1−wi∗;fx=∏i=1nx+viwi∗,θx is a n−IW∗−degree polynomial in ℤpx and fx is a n−degree polynomial in ℤpx.C sends θx and fx to the n-aMSE-DHH problem and receives the problem instances p⟶,T from n-aMSE-DHH problem. T is the challenge term and T=eg0,h0γfa or T=R where R is a random element in GT. And p⟶=(9)g0ai0≤i≤n−1,g0afa,g0γafa;h0ai0≤i≤n,h0γ;h0ai/θa0≤i≤n,where g0 is a generator of G1 and h0 is a generator of G2 and e:G1×G2⟶GT mod p.


#### 3.5.2. Setup

Cw1,w2←Rℤp∗ and implicitly sets master private key MK as(10)g=g0fa,a=a,k1=w1θa,k2=w2θa.The public parametersPK are computed as(11)h=h0,eg,h=eg0,h0fa,ga=g0afa;hi=h0ai,ui=h0ai/θaw1,vi=h0ai/θaw2i=1n.Finally,C sends PK to A.


#### 3.5.3. Hash Queries

A can access the hash oracles H′,H1,H2,H3, and C maintains the hash lists ℒH′,ℒH1,ℒH2,ℒH3 to record the queries and responses, respectively. If the query has a previous response and the output result recorded in the hash lists, C will respond with the recorded result in the hash lists. Otherwise, C will perform as follows.(i)
H′Oracle. Let the input of H′ be in U=Attr1,Attr2,…,Attrn. If the input of H′ is Attri, C sets vi as the output. And the term Attri:vi will be recorded i ℒH′.(ii)
H1Oracle. Let the input of H1 be Wi,Mi,βi. C responds H1Wi,Mi,βi with a random ri∈ℤp∗. And the term Wi,Mi,βi:ri will be recorded in ℒH1.(iii)
H2Oracle. Let the query to H2 be eg,hri. C responds H2eg,hri with a random Ri∈0,1lβ. And the term eg,hri:Ri will be recorded in ℒH2.(iv)
H3Oracle. Let the query to H3 be βi. C responds H3βi with a random Qi∈0,1lm. And the term βi:Qi will be recorded in ℒH3.


#### 3.5.4. Key Query 1

A sends an attribute bit string L=l1l2,…,ln where li∈0,11≤i≤n to C for one key query. Note that L cannot meet the challenge policy W∗. C sets(12)fx,L=∏i=1nx+H′Attri1−li=ffx,Lfθx,L,ffx,L are the terms in fx and fθx,L are the terms in θx. fx,L can be computed by the part of terms in fx and θx. And if L does not fulfill the challenge access structure W∗, the degree of the polynomial ffx,L is nonzero.Cr←Rℤp∗ and implicitly sets ru=k1ra/k2 by computing(13)gru=g0afaw1r/w2.Implicitly set(14)su=1k11fa,L−k2ru=θaw1fa,L−ra.C computes gsu as(15)gsu=gθa/w1fa,L−ra=g0faθa/w1fa,Lg0afa−r.We denote(16)fxθxw1fx,L=1w1∏i=1nx+H′Attri∏i=1nx+H′Attri1−li=1w1∏i=1nx+H′Attrili=f^x,L.Letf^i,L be the coefficient of xi in f^x,L. f^x,L is a n−1−degree at most polynomial in ℤpx.g0f^a,L can be computed by the terms in p⟶ as(17)g0f^a,L=g01/w1∑i=0n−1f^i,Lai=∏i=0n−1g0aif^i,L1/w1.So,gsu can be computed as(18)gsu=g0f^a,Lg0afa−r.Finally,C sends Ku=Ku,1=gru,Ku,2=gsu to A.


#### 3.5.5. Decryption Query 1

For any decryption query onEncryptWi,Mi, if there exists Wi,Mi,βi,ri,Ri,Qi in the hash lists ℒH′,ℒH1,ℒH2,ℒH3 such that the ciphertext is generated using ri, C sets Mi as the output of the decryption query to A. Otherwise, C outputs null. No query will be aborted since all valid encryptions need the response from hash oracles H′,H1,H2,H3, and the response contains the random number ri which is used in encryption.


#### 3.5.6. Challenge

A sends two messages M0∈0,1lm and M1∈0,1lm to C for challenge. C implicitly defines rm=γ by setting(19)C1=g0afaγ;C2=h0γw1;C3=h0γw2.Then,C randomly chooses βm∈0,1lβ,b∈0,1 and computes(20)C4=H2T⊕βm;C5=H3βm⊕Mb.Finally,C sends W∗,C1,C2,C3,C4,C5 to A.


#### 3.5.7. Key Query 2

It is the same as Key Query 1. Notice that all key queries in this phase also cannot satisfy the access structureW∗.


#### 3.5.8. Decryption Query 2

It is the same as Decryption Query 1. And notice that the decryption queries cannot be the challenge messagesM0 and M1.


#### 3.5.9. Guess

Eventually,A gives the guess b′ of b to the simulator C.Ifb′=b, the simulator C outputs 0 and guesses T=eg0,h0γfa; otherwise, C outputs 1 and guesses T=R.If the n-aMSE-DHH problem sendsT=eg0,h0γfa to the simulator C. The attacker A plays the real security game as our actual scheme. Referring to our supposition, the attacker has AdvA selectively breaking our actual scheme. So,(21)Prb′=b∣T=eg0,h0γfa=12+AdvA;PrCp⟶,T=eg0,h0γfa=0=12+AdvA.If the n-aMSE-DHH problem sendsT=R to C, all the bits in Mb are hidden due to R. So,(22)Prb′=b∣T=R=12.The only error event is thatT=R, but it is queried to H2 oracle. This occurs with probability qH2/p at most where p is the order of group GT and qH2 is the number of the queries to the oracle H2. So,(23)PrCp⟶,T=R=0=12+qH2p, (24)PrCp⟶,T=eg0,h0γfa=0−PrCp⟶,T=R=0=AdvA−qH2p.So, the simulatorC can solve the n-aMSE-DHH problem in PPT.


## 3.1. System Architecture

The framework of our cloud-assisted IoT system used our scheme is shown in Figure2. There are six entities involved in our system which are stated as follows.Figure 2
Our system framework.


### 3.1.1. Attribute Authority (AA)

AA is in charge of initializing the system and generating the private keys for users.


### 3.1.2. Cloud Storage

The cloud storage stores the ciphertexts for data owners (DOs).


### 3.1.3. Data Owner (DOs)

DOs encrypt the data to ciphertexts and upload the ciphertexts to the cloud.


### 3.1.4. Users

The users download the ciphertexts from the cloud storage then retrieve the plaintext by the decryption algorithm. The users have two types. One type is Users with PCs and the other is Users with smart IoT devices.(i)
Users with PCs: users with PCs retrieve the plaintext by running the local-decryption phase(ii)
Users with IoT devices: the users with smartphones or the smart tablets can retrieve the data by performing the privacy-preserving outsourced decryption phase


### 3.1.5. Proxy Server

Proxy servers take charge of running the online partial decryption algorithm for the users with smart IoT devices. Note that the proxy servers cannot know anything about the user’s attributes and the access policy associated with the ciphertext during running the partial decryption.


## 3.1.1. Attribute Authority (AA)

AA is in charge of initializing the system and generating the private keys for users.


## 3.1.2. Cloud Storage

The cloud storage stores the ciphertexts for data owners (DOs).


## 3.1.3. Data Owner (DOs)

DOs encrypt the data to ciphertexts and upload the ciphertexts to the cloud.


## 3.1.4. Users

The users download the ciphertexts from the cloud storage then retrieve the plaintext by the decryption algorithm. The users have two types. One type is Users with PCs and the other is Users with smart IoT devices.(i)
Users with PCs: users with PCs retrieve the plaintext by running the local-decryption phase(ii)
Users with IoT devices: the users with smartphones or the smart tablets can retrieve the data by performing the privacy-preserving outsourced decryption phase


## 3.1.5. Proxy Server

Proxy servers take charge of running the online partial decryption algorithm for the users with smart IoT devices. Note that the proxy servers cannot know anything about the user’s attributes and the access policy associated with the ciphertext during running the partial decryption.


## 3.2. Algorithm Definitions

The workflow of our cloud-assisted IoT system used in our scheme is shown in Figure3. There are four algorithms in our scheme described as below.Figure 3
Our system framework.


### 3.2.1. Setup

AA initializes the system by executing the Setup algorithm to export the public parametersPK and master private key MK of the system. AA preserves the private master key privately and publishes the public parameters to all the entities in the system.


### 3.2.2. AttrKeyGen

A user forms his attribute set as a bit string then sends his/her bit string-based attribute set to the AA; AA runs the AttrKeyGen algorithm to generate the constant-size attribute-based private key for the user. Then, the user will preserve the attribute-based key privately. If the user’s attribute set can meet the access policy associated with the ciphertext, he/she can use his/her private key to decrypt the ciphertext.


### 3.2.3. Encrypt

A DO customizes a bit string formed attribute-based access policy for the data; then, by the Encrypt algorithm, the DO encrypts the data under the customized access policy to a ciphertext, which is constant size. Then, the DO uploads the ciphertext with the bit string formed access policy onto the cloud storage.


### 3.2.4. Decrypt

A user downloads the ciphertext with the access policy from the cloud storage. If the user’s attribute set meets the access policy, then he/she can retrieve the data by running the Decrypt algorithm. And, the Decrypt algorithm has two modes. One mode is local decryption. The local decryption means all the computations are running on the user’s local device, and this mode is suitable for the users with PCs. If the user is using the smart IoT devices, then the user can choose the other decryption mode called privacy-preserving outsourced decryption to securely and privately outsource some complex computations to the proxy server. This will reduce the decryption time of the user and save the battery power of the user’s smart IoT device. Note that the proxy servers cannot know anything about the user’s attributes and the access policy associated with the ciphertext during partially decrypting the ciphertext.


## 3.2.1. Setup

AA initializes the system by executing the Setup algorithm to export the public parametersPK and master private key MK of the system. AA preserves the private master key privately and publishes the public parameters to all the entities in the system.


## 3.2.2. AttrKeyGen

A user forms his attribute set as a bit string then sends his/her bit string-based attribute set to the AA; AA runs the AttrKeyGen algorithm to generate the constant-size attribute-based private key for the user. Then, the user will preserve the attribute-based key privately. If the user’s attribute set can meet the access policy associated with the ciphertext, he/she can use his/her private key to decrypt the ciphertext.


## 3.2.3. Encrypt

A DO customizes a bit string formed attribute-based access policy for the data; then, by the Encrypt algorithm, the DO encrypts the data under the customized access policy to a ciphertext, which is constant size. Then, the DO uploads the ciphertext with the bit string formed access policy onto the cloud storage.


## 3.2.4. Decrypt

A user downloads the ciphertext with the access policy from the cloud storage. If the user’s attribute set meets the access policy, then he/she can retrieve the data by running the Decrypt algorithm. And, the Decrypt algorithm has two modes. One mode is local decryption. The local decryption means all the computations are running on the user’s local device, and this mode is suitable for the users with PCs. If the user is using the smart IoT devices, then the user can choose the other decryption mode called privacy-preserving outsourced decryption to securely and privately outsource some complex computations to the proxy server. This will reduce the decryption time of the user and save the battery power of the user’s smart IoT device. Note that the proxy servers cannot know anything about the user’s attributes and the access policy associated with the ciphertext during partially decrypting the ciphertext.


## 3.3. Security Model

We define a selectively IND-CCA security game for our scheme which involves an adversary algorithmA and a challenge algorithm C in.(i)
Initialization. A sends a bit string based AND-gate challenge access structure W∗ to C.(ii)
Setup. C runs setup algorithm to generate the master private key MK and public parameters PK. Then, C sends PK to A.(iii)
Key Query 1. A queries a list of bit strings to C for the key queries. Note that all the key queries cannot satisfy the challenge access structure W∗.(iv)
Decryption Query 1. A queries the decryption of ciphertext EncryptWi,Mi from C.(v)
Challenge. A sends two messages M0∈0,1lm and M1∈0,1lm to C for challenge. Cb←R0,1 and sends W∗,EncryptW∗,Mb back to A.(vi)
Key Query 2. Same as Key Query 1. Notice that all key queries in this phase also cannot satisfy the access structure W∗.(vii)
Decryption Query 2. Same as Decryption Query 1. And notice that the decryption queries cannot be the challenge messages M0 and M1.(viii)
Guess. A outputs a guess b′b.AdvA=Prb′=b−1/2. A wins the confidentiality game if AdvA is nonnegligible.


## 3.4. Scheme Construction

### 3.4.1. Setup

AA performs the Setup phase to initialize the system by the following steps.(i)
AA exports a bilinear pairingBP=G1,G2,GT,p,g,h,e from the security parameter κ. g is a generator of G1 and h is a generator of G2. Then, AA chooses four one-way collision-resistance hash function as H1,H′:0,1∗ℤp∗, H2:GT0,1lβ, H3:0,1lβ0,1lm.(ii)
AA defines the attribute universeU=Attr1,Attr2,…,Attrn of the system, n=U. Then, AA a,k1,k2←Rℤp∗ and computes hi=hai,ui=hk1ai,vi=hk2aii=0n.(iii)
Finally, AA preserves the master private key (MK) and publishes the public parameters (PK) as(2)MK=g,a,k1,k2;PK=U,hi,ui,vii=0n,H1,H2,H3,H′,eg,h,ga.


### 3.4.2. AttrKeyGen

A user forms his attribute set as a bit stringL=l1l2,…,ln where li∈0,11≤i≤n and then sends L to the AA via a secure channel. Then, AA generates the attribute-based private key for the user by the following steps.(i)
AA generates ann−degree at most polynomial function fx,L=∏i=1nx+H′Attri1−li in ℤpx by using the bit string L. Then, AA computes fa,L=∏i=1na+H′Attri1−li.(ii)
AAru←Rℤp∗ and computes su with the condition 1/fa,L=k1su+k2ru, that is, su=1/fa,L−k2ru/k1.(iii)
Finally, AA computes the attribute-based private keyKu=Ku,1=gru,Ku,2=gsu for the user and sends Ku to the user via a secure channel.


### 3.4.3. Encrypt

DO performs the following steps to encrypt the dataM∈0,1lm.(i)
DO customizes an AND-gate access structure based on bit string asW=w1w2,…,wn where wi∈0,11≤i≤n for the data M∈0,1lm. Iw is the set of indices i1≤i≤nin which wi=1, that is, Iw=i|1≤i≤n,wi=1. And Iw denotes the size of Iw. Notice that Iw>0. Then, DO generates a n−IW−degree polynomial fx,W=∏i=1nx+H′Attri1−wi in ℤpx by using the access bit string W. Let fi,W be the coefficient of xi in fx,W.(ii)
DOβm←R0,1lβ and computes rm=H1W,M,βm.(iii)
Finally, DO computes the ciphertext for the dataM∈0,1lm as CT=C1,C2,C3,C4,C5 and then sends CT,W to the cloud storage.(3)C1=garm;C2=∏i=0n−|IW|uifi,Wrm=hrmk1∑i=0n−|IW|aifi,W=hrmk1fa,W;C3=∏i=0n−IWvifi,Wrm=hrmk2∑i=0n−|IW|aifi,W=hrmk2fa,W;C4=H2eg,hrm⊕βm;C5=H3βm⊕M.


### 3.4.4. Decryption

The user downloads the ciphertextCT,W from the cloud storage. If the user’s attributes set L can meet the access policy W associated with the ciphertext, the user can decrypt the ciphertext in two ways. One way is the local decryption and another is the privacy-preserving outsourced decryption. If the user uses the PC, he/she can use the local decryption algorithm to obtain the data. Or if the user uses the IoT device, such as smartphone, he/she can use the privacy-preserving outsourced decryption to obtain the data without the computing pressure. Notice that if and only if L meets W, the user can generate a n−IW−degree at most polynomial Fx,L,W=fx,W/fx,L=∏i=1nx+H′Attrili−wi=∑i=0n−IWxiFi,L,W in ℤpx where Fi,L,W is the coefficient of xi and it is clear that F0,L,W≠0. F⟶=F0,L,W,F1,L,W,…,Fn−IW,L,W is the coefficient vector of Fx,L,W in ℤp∗.Local decryption: the user runs the local decryption by the following steps:(4)W=eC1,∏i=1n−IWhi−1Fi,L,W=egarm,∏i=1n−IWhai−1Fi,L,W=eg,harm∑i=1n−IWai−1Fi,L,W=eg,hrm∑i=1n−IWaiFi,L,W=eg,hrm∑i=1n−IWaiFi,L,W+F0,L,W−F0,L,W=eg,hrmFa,L,W−rmF0,L,W,U=eKu,2,C2=eg,hk1fa,Wrmsu,V=eKu,1,C3=eg,hk2fa,Wrmru,UV=eg,hk1fa,Wrmsu+k2fa,Wrmru=eg,hrmfa,Wk1su+k2ru=eg,hrmfa,W/fa,L=eg,hrmFa,L,WUVW1/F0,L,W=eg,hrmFa,L,Weg,hrmFa,L,W−rmF0,L,W1/F0,L,W=eg,hrm=V1,βm′=C4⊕H2V1M′=C5⊕H3βm′.Then, the user computesrm′=H1W,M′,βm′ and verifies V1=?eg,hrm′. If the equation holds, this indicates the user decrypts the ciphertext successfully M′=M.Privacy-preserving outsourced decryption: the useru1,u2←Rℤp∗ and computes the blinded coefficient vector BV⟶ in ℤp∗ and the blinded private key BK as(5)BV⟶=0,u1F1,L,W,…,u1Fn−IW,L,Wmodp;BK=BKu,1=Ku,1u2,BKu,2=Ku,2u2.Then, the user sendsC1,C2,C3,BV⟶,BK to the proxy server. It is clear that the proxy server only cannot know anything about L and W from the blind coefficient vector BV⟶ and the blind private key BK. The proxy server uses C1,C2,C3,BV⟶,BK to compute(6)P1=eC1,∏i=1n−IWhi−1u1Fi,L,W=egarm,∏i=1n−IWhai−1u1Fi,L,W=eg,harm∑i=1n−IWai−1u1Fi,L,W=eg,hu1rm∑i=1n−IWaiFi,L,W=eg,hu1rm∑i=1n−IWaiFi,L,W+F0,L,W−F0,L,W=eg,hu1rmFa,L,W−rmF0,L,W,U′=eBKu,2,C2=eg,hu2k1fa,Wrmsu,V′=eBKu,1,C3=eg,hu2k2fa,Wrmru,P2=U′V′=eg,hu2k1fa,Wrmsu+k2fa,Wrmru=eg,hu2rmfa,Wk1su+k2ru=eg,hu2rmfa,W/fa,L=eg,hu2rmFa,L,W.Then, proxy server sendsP1,P2 back to the user. The user uses C4,C5,P1,P2,u1,u2 to compute(7)W=P11/u1=eg,hrmFa,L,W−rmF0,L,W;J=P21/u2=eg,hrmFa,L,W;JW1/F0,L,W=eg,hrmFa,L,Weg,hrmFa,L,W−rmF0,L,W1/F0,L,W=eg,hrm=V1,βm′=C4⊕H2V1,M′=C5⊕H3βm′.Then, the user computesrm′=H1W,M′,βm′ and verifies V1=?eg,hrm′. If the equation holds, this indicates the user decrypts the ciphertext successfully M′=M.


## 3.4.1. Setup

AA performs the Setup phase to initialize the system by the following steps.(i)
AA exports a bilinear pairingBP=G1,G2,GT,p,g,h,e from the security parameter κ. g is a generator of G1 and h is a generator of G2. Then, AA chooses four one-way collision-resistance hash function as H1,H′:0,1∗ℤp∗, H2:GT0,1lβ, H3:0,1lβ0,1lm.(ii)
AA defines the attribute universeU=Attr1,Attr2,…,Attrn of the system, n=U. Then, AA a,k1,k2←Rℤp∗ and computes hi=hai,ui=hk1ai,vi=hk2aii=0n.(iii)
Finally, AA preserves the master private key (MK) and publishes the public parameters (PK) as(2)MK=g,a,k1,k2;PK=U,hi,ui,vii=0n,H1,H2,H3,H′,eg,h,ga.


## 3.4.2. AttrKeyGen

A user forms his attribute set as a bit stringL=l1l2,…,ln where li∈0,11≤i≤n and then sends L to the AA via a secure channel. Then, AA generates the attribute-based private key for the user by the following steps.(i)
AA generates ann−degree at most polynomial function fx,L=∏i=1nx+H′Attri1−li in ℤpx by using the bit string L. Then, AA computes fa,L=∏i=1na+H′Attri1−li.(ii)
AAru←Rℤp∗ and computes su with the condition 1/fa,L=k1su+k2ru, that is, su=1/fa,L−k2ru/k1.(iii)
Finally, AA computes the attribute-based private keyKu=Ku,1=gru,Ku,2=gsu for the user and sends Ku to the user via a secure channel.


## 3.4.3. Encrypt

DO performs the following steps to encrypt the dataM∈0,1lm.(i)
DO customizes an AND-gate access structure based on bit string asW=w1w2,…,wn where wi∈0,11≤i≤n for the data M∈0,1lm. Iw is the set of indices i1≤i≤nin which wi=1, that is, Iw=i|1≤i≤n,wi=1. And Iw denotes the size of Iw. Notice that Iw>0. Then, DO generates a n−IW−degree polynomial fx,W=∏i=1nx+H′Attri1−wi in ℤpx by using the access bit string W. Let fi,W be the coefficient of xi in fx,W.(ii)
DOβm←R0,1lβ and computes rm=H1W,M,βm.(iii)
Finally, DO computes the ciphertext for the dataM∈0,1lm as CT=C1,C2,C3,C4,C5 and then sends CT,W to the cloud storage.(3)C1=garm;C2=∏i=0n−|IW|uifi,Wrm=hrmk1∑i=0n−|IW|aifi,W=hrmk1fa,W;C3=∏i=0n−IWvifi,Wrm=hrmk2∑i=0n−|IW|aifi,W=hrmk2fa,W;C4=H2eg,hrm⊕βm;C5=H3βm⊕M.


## 3.4.4. Decryption

The user downloads the ciphertextCT,W from the cloud storage. If the user’s attributes set L can meet the access policy W associated with the ciphertext, the user can decrypt the ciphertext in two ways. One way is the local decryption and another is the privacy-preserving outsourced decryption. If the user uses the PC, he/she can use the local decryption algorithm to obtain the data. Or if the user uses the IoT device, such as smartphone, he/she can use the privacy-preserving outsourced decryption to obtain the data without the computing pressure. Notice that if and only if L meets W, the user can generate a n−IW−degree at most polynomial Fx,L,W=fx,W/fx,L=∏i=1nx+H′Attrili−wi=∑i=0n−IWxiFi,L,W in ℤpx where Fi,L,W is the coefficient of xi and it is clear that F0,L,W≠0. F⟶=F0,L,W,F1,L,W,…,Fn−IW,L,W is the coefficient vector of Fx,L,W in ℤp∗.Local decryption: the user runs the local decryption by the following steps:(4)W=eC1,∏i=1n−IWhi−1Fi,L,W=egarm,∏i=1n−IWhai−1Fi,L,W=eg,harm∑i=1n−IWai−1Fi,L,W=eg,hrm∑i=1n−IWaiFi,L,W=eg,hrm∑i=1n−IWaiFi,L,W+F0,L,W−F0,L,W=eg,hrmFa,L,W−rmF0,L,W,U=eKu,2,C2=eg,hk1fa,Wrmsu,V=eKu,1,C3=eg,hk2fa,Wrmru,UV=eg,hk1fa,Wrmsu+k2fa,Wrmru=eg,hrmfa,Wk1su+k2ru=eg,hrmfa,W/fa,L=eg,hrmFa,L,WUVW1/F0,L,W=eg,hrmFa,L,Weg,hrmFa,L,W−rmF0,L,W1/F0,L,W=eg,hrm=V1,βm′=C4⊕H2V1M′=C5⊕H3βm′.Then, the user computesrm′=H1W,M′,βm′ and verifies V1=?eg,hrm′. If the equation holds, this indicates the user decrypts the ciphertext successfully M′=M.Privacy-preserving outsourced decryption: the useru1,u2←Rℤp∗ and computes the blinded coefficient vector BV⟶ in ℤp∗ and the blinded private key BK as(5)BV⟶=0,u1F1,L,W,…,u1Fn−IW,L,Wmodp;BK=BKu,1=Ku,1u2,BKu,2=Ku,2u2.Then, the user sendsC1,C2,C3,BV⟶,BK to the proxy server. It is clear that the proxy server only cannot know anything about L and W from the blind coefficient vector BV⟶ and the blind private key BK. The proxy server uses C1,C2,C3,BV⟶,BK to compute(6)P1=eC1,∏i=1n−IWhi−1u1Fi,L,W=egarm,∏i=1n−IWhai−1u1Fi,L,W=eg,harm∑i=1n−IWai−1u1Fi,L,W=eg,hu1rm∑i=1n−IWaiFi,L,W=eg,hu1rm∑i=1n−IWaiFi,L,W+F0,L,W−F0,L,W=eg,hu1rmFa,L,W−rmF0,L,W,U′=eBKu,2,C2=eg,hu2k1fa,Wrmsu,V′=eBKu,1,C3=eg,hu2k2fa,Wrmru,P2=U′V′=eg,hu2k1fa,Wrmsu+k2fa,Wrmru=eg,hu2rmfa,Wk1su+k2ru=eg,hu2rmfa,W/fa,L=eg,hu2rmFa,L,W.Then, proxy server sendsP1,P2 back to the user. The user uses C4,C5,P1,P2,u1,u2 to compute(7)W=P11/u1=eg,hrmFa,L,W−rmF0,L,W;J=P21/u2=eg,hrmFa,L,W;JW1/F0,L,W=eg,hrmFa,L,Weg,hrmFa,L,W−rmF0,L,W1/F0,L,W=eg,hrm=V1,βm′=C4⊕H2V1,M′=C5⊕H3βm′.Then, the user computesrm′=H1W,M′,βm′ and verifies V1=?eg,hrm′. If the equation holds, this indicates the user decrypts the ciphertext successfully M′=M.


## 3.5. Security Analysis

Theorem. If the n-aMSE-DDH problem holds, then our scheme is selectively IND-CCA-secure.Proof. Suppose there is a PPT adversary A who can break the security of our scheme with a nonnegligible advantage AdvA. Then, we can construct a PPT simulator algorithm C which is able to solve the n-aMSE-DDH problem with the nonnegligible advantage AdvA−qH2/p by interacting with A in the following manner where p is the order of group GT and qH2 is the number of the queries to the oracle H2.


### 3.5.1. Initialization

Note that there aren attributes U=Attr1,Attr2,…,Attrn in the scheme. A submits the challenge access bit string W∗=w1∗w2∗,…,wn∗ where wi∗∈0,11≤i≤n to C. IW∗=i|1≤i≤n,wi∗=1. IW∗ is the size of IW∗. Cv1,v2,…,vn←Rℤp∗ and sets(8)θx=fx,W∗=∏i=1nx+vi1−wi∗;fx=∏i=1nx+viwi∗,θx is a n−IW∗−degree polynomial in ℤpx and fx is a n−degree polynomial in ℤpx.C sends θx and fx to the n-aMSE-DHH problem and receives the problem instances p⟶,T from n-aMSE-DHH problem. T is the challenge term and T=eg0,h0γfa or T=R where R is a random element in GT. And p⟶=(9)g0ai0≤i≤n−1,g0afa,g0γafa;h0ai0≤i≤n,h0γ;h0ai/θa0≤i≤n,where g0 is a generator of G1 and h0 is a generator of G2 and e:G1×G2⟶GT mod p.


### 3.5.2. Setup

Cw1,w2←Rℤp∗ and implicitly sets master private key MK as(10)g=g0fa,a=a,k1=w1θa,k2=w2θa.The public parametersPK are computed as(11)h=h0,eg,h=eg0,h0fa,ga=g0afa;hi=h0ai,ui=h0ai/θaw1,vi=h0ai/θaw2i=1n.Finally,C sends PK to A.


### 3.5.3. Hash Queries

A can access the hash oracles H′,H1,H2,H3, and C maintains the hash lists ℒH′,ℒH1,ℒH2,ℒH3 to record the queries and responses, respectively. If the query has a previous response and the output result recorded in the hash lists, C will respond with the recorded result in the hash lists. Otherwise, C will perform as follows.(i)
H′Oracle. Let the input of H′ be in U=Attr1,Attr2,…,Attrn. If the input of H′ is Attri, C sets vi as the output. And the term Attri:vi will be recorded i ℒH′.(ii)
H1Oracle. Let the input of H1 be Wi,Mi,βi. C responds H1Wi,Mi,βi with a random ri∈ℤp∗. And the term Wi,Mi,βi:ri will be recorded in ℒH1.(iii)
H2Oracle. Let the query to H2 be eg,hri. C responds H2eg,hri with a random Ri∈0,1lβ. And the term eg,hri:Ri will be recorded in ℒH2.(iv)
H3Oracle. Let the query to H3 be βi. C responds H3βi with a random Qi∈0,1lm. And the term βi:Qi will be recorded in ℒH3.


### 3.5.4. Key Query 1

A sends an attribute bit string L=l1l2,…,ln where li∈0,11≤i≤n to C for one key query. Note that L cannot meet the challenge policy W∗. C sets(12)fx,L=∏i=1nx+H′Attri1−li=ffx,Lfθx,L,ffx,L are the terms in fx and fθx,L are the terms in θx. fx,L can be computed by the part of terms in fx and θx. And if L does not fulfill the challenge access structure W∗, the degree of the polynomial ffx,L is nonzero.Cr←Rℤp∗ and implicitly sets ru=k1ra/k2 by computing(13)gru=g0afaw1r/w2.Implicitly set(14)su=1k11fa,L−k2ru=θaw1fa,L−ra.C computes gsu as(15)gsu=gθa/w1fa,L−ra=g0faθa/w1fa,Lg0afa−r.We denote(16)fxθxw1fx,L=1w1∏i=1nx+H′Attri∏i=1nx+H′Attri1−li=1w1∏i=1nx+H′Attrili=f^x,L.Letf^i,L be the coefficient of xi in f^x,L. f^x,L is a n−1−degree at most polynomial in ℤpx.g0f^a,L can be computed by the terms in p⟶ as(17)g0f^a,L=g01/w1∑i=0n−1f^i,Lai=∏i=0n−1g0aif^i,L1/w1.So,gsu can be computed as(18)gsu=g0f^a,Lg0afa−r.Finally,C sends Ku=Ku,1=gru,Ku,2=gsu to A.


### 3.5.5. Decryption Query 1

For any decryption query onEncryptWi,Mi, if there exists Wi,Mi,βi,ri,Ri,Qi in the hash lists ℒH′,ℒH1,ℒH2,ℒH3 such that the ciphertext is generated using ri, C sets Mi as the output of the decryption query to A. Otherwise, C outputs null. No query will be aborted since all valid encryptions need the response from hash oracles H′,H1,H2,H3, and the response contains the random number ri which is used in encryption.


### 3.5.6. Challenge

A sends two messages M0∈0,1lm and M1∈0,1lm to C for challenge. C implicitly defines rm=γ by setting(19)C1=g0afaγ;C2=h0γw1;C3=h0γw2.Then,C randomly chooses βm∈0,1lβ,b∈0,1 and computes(20)C4=H2T⊕βm;C5=H3βm⊕Mb.Finally,C sends W∗,C1,C2,C3,C4,C5 to A.


### 3.5.7. Key Query 2

It is the same as Key Query 1. Notice that all key queries in this phase also cannot satisfy the access structureW∗.


### 3.5.8. Decryption Query 2

It is the same as Decryption Query 1. And notice that the decryption queries cannot be the challenge messagesM0 and M1.


### 3.5.9. Guess

Eventually,A gives the guess b′ of b to the simulator C.Ifb′=b, the simulator C outputs 0 and guesses T=eg0,h0γfa; otherwise, C outputs 1 and guesses T=R.If the n-aMSE-DHH problem sendsT=eg0,h0γfa to the simulator C. The attacker A plays the real security game as our actual scheme. Referring to our supposition, the attacker has AdvA selectively breaking our actual scheme. So,(21)Prb′=b∣T=eg0,h0γfa=12+AdvA;PrCp⟶,T=eg0,h0γfa=0=12+AdvA.If the n-aMSE-DHH problem sendsT=R to C, all the bits in Mb are hidden due to R. So,(22)Prb′=b∣T=R=12.The only error event is thatT=R, but it is queried to H2 oracle. This occurs with probability qH2/p at most where p is the order of group GT and qH2 is the number of the queries to the oracle H2. So,(23)PrCp⟶,T=R=0=12+qH2p, (24)PrCp⟶,T=eg0,h0γfa=0−PrCp⟶,T=R=0=AdvA−qH2p.So, the simulatorC can solve the n-aMSE-DHH problem in PPT.


## 3.5.1. Initialization

Note that there aren attributes U=Attr1,Attr2,…,Attrn in the scheme. A submits the challenge access bit string W∗=w1∗w2∗,…,wn∗ where wi∗∈0,11≤i≤n to C. IW∗=i|1≤i≤n,wi∗=1. IW∗ is the size of IW∗. Cv1,v2,…,vn←Rℤp∗ and sets(8)θx=fx,W∗=∏i=1nx+vi1−wi∗;fx=∏i=1nx+viwi∗,θx is a n−IW∗−degree polynomial in ℤpx and fx is a n−degree polynomial in ℤpx.C sends θx and fx to the n-aMSE-DHH problem and receives the problem instances p⟶,T from n-aMSE-DHH problem. T is the challenge term and T=eg0,h0γfa or T=R where R is a random element in GT. And p⟶=(9)g0ai0≤i≤n−1,g0afa,g0γafa;h0ai0≤i≤n,h0γ;h0ai/θa0≤i≤n,where g0 is a generator of G1 and h0 is a generator of G2 and e:G1×G2⟶GT mod p.


## 3.5.2. Setup

Cw1,w2←Rℤp∗ and implicitly sets master private key MK as(10)g=g0fa,a=a,k1=w1θa,k2=w2θa.The public parametersPK are computed as(11)h=h0,eg,h=eg0,h0fa,ga=g0afa;hi=h0ai,ui=h0ai/θaw1,vi=h0ai/θaw2i=1n.Finally,C sends PK to A.


## 3.5.3. Hash Queries

A can access the hash oracles H′,H1,H2,H3, and C maintains the hash lists ℒH′,ℒH1,ℒH2,ℒH3 to record the queries and responses, respectively. If the query has a previous response and the output result recorded in the hash lists, C will respond with the recorded result in the hash lists. Otherwise, C will perform as follows.(i)
H′Oracle. Let the input of H′ be in U=Attr1,Attr2,…,Attrn. If the input of H′ is Attri, C sets vi as the output. And the term Attri:vi will be recorded i ℒH′.(ii)
H1Oracle. Let the input of H1 be Wi,Mi,βi. C responds H1Wi,Mi,βi with a random ri∈ℤp∗. And the term Wi,Mi,βi:ri will be recorded in ℒH1.(iii)
H2Oracle. Let the query to H2 be eg,hri. C responds H2eg,hri with a random Ri∈0,1lβ. And the term eg,hri:Ri will be recorded in ℒH2.(iv)
H3Oracle. Let the query to H3 be βi. C responds H3βi with a random Qi∈0,1lm. And the term βi:Qi will be recorded in ℒH3.


## 3.5.4. Key Query 1

A sends an attribute bit string L=l1l2,…,ln where li∈0,11≤i≤n to C for one key query. Note that L cannot meet the challenge policy W∗. C sets(12)fx,L=∏i=1nx+H′Attri1−li=ffx,Lfθx,L,ffx,L are the terms in fx and fθx,L are the terms in θx. fx,L can be computed by the part of terms in fx and θx. And if L does not fulfill the challenge access structure W∗, the degree of the polynomial ffx,L is nonzero.Cr←Rℤp∗ and implicitly sets ru=k1ra/k2 by computing(13)gru=g0afaw1r/w2.Implicitly set(14)su=1k11fa,L−k2ru=θaw1fa,L−ra.C computes gsu as(15)gsu=gθa/w1fa,L−ra=g0faθa/w1fa,Lg0afa−r.We denote(16)fxθxw1fx,L=1w1∏i=1nx+H′Attri∏i=1nx+H′Attri1−li=1w1∏i=1nx+H′Attrili=f^x,L.Letf^i,L be the coefficient of xi in f^x,L. f^x,L is a n−1−degree at most polynomial in ℤpx.g0f^a,L can be computed by the terms in p⟶ as(17)g0f^a,L=g01/w1∑i=0n−1f^i,Lai=∏i=0n−1g0aif^i,L1/w1.So,gsu can be computed as(18)gsu=g0f^a,Lg0afa−r.Finally,C sends Ku=Ku,1=gru,Ku,2=gsu to A.


## 3.5.5. Decryption Query 1

For any decryption query onEncryptWi,Mi, if there exists Wi,Mi,βi,ri,Ri,Qi in the hash lists ℒH′,ℒH1,ℒH2,ℒH3 such that the ciphertext is generated using ri, C sets Mi as the output of the decryption query to A. Otherwise, C outputs null. No query will be aborted since all valid encryptions need the response from hash oracles H′,H1,H2,H3, and the response contains the random number ri which is used in encryption.


## 3.5.6. Challenge

A sends two messages M0∈0,1lm and M1∈0,1lm to C for challenge. C implicitly defines rm=γ by setting(19)C1=g0afaγ;C2=h0γw1;C3=h0γw2.Then,C randomly chooses βm∈0,1lβ,b∈0,1 and computes(20)C4=H2T⊕βm;C5=H3βm⊕Mb.Finally,C sends W∗,C1,C2,C3,C4,C5 to A.


## 3.5.7. Key Query 2

It is the same as Key Query 1. Notice that all key queries in this phase also cannot satisfy the access structureW∗.


## 3.5.8. Decryption Query 2

It is the same as Decryption Query 1. And notice that the decryption queries cannot be the challenge messagesM0 and M1.


## 3.5.9. Guess

Eventually,A gives the guess b′ of b to the simulator C.Ifb′=b, the simulator C outputs 0 and guesses T=eg0,h0γfa; otherwise, C outputs 1 and guesses T=R.If the n-aMSE-DHH problem sendsT=eg0,h0γfa to the simulator C. The attacker A plays the real security game as our actual scheme. Referring to our supposition, the attacker has AdvA selectively breaking our actual scheme. So,(21)Prb′=b∣T=eg0,h0γfa=12+AdvA;PrCp⟶,T=eg0,h0γfa=0=12+AdvA.If the n-aMSE-DHH problem sendsT=R to C, all the bits in Mb are hidden due to R. So,(22)Prb′=b∣T=R=12.The only error event is thatT=R, but it is queried to H2 oracle. This occurs with probability qH2/p at most where p is the order of group GT and qH2 is the number of the queries to the oracle H2. So,(23)PrCp⟶,T=R=0=12+qH2p, (24)PrCp⟶,T=eg0,h0γfa=0−PrCp⟶,T=R=0=AdvA−qH2p.So, the simulatorC can solve the n-aMSE-DHH problem in PPT.


## 4. Evaluation and Implementation

### 4.1. Properties Evaluation

In this section, we compare our scheme with some related CP-ABE schemes in terms of the properties in Table1. From Table 1, we can know that only our scheme provides “constant-size ciphertext,” “constant-size private key,” and “privacy-preserving outsourced decryption” simultaneously. The schemes in [23, 24] are also with constant-size ciphertext and constant-size private key, but their access structures—“Strict AND-gate Policy” are less expressive and too strict. Thus, these schemes [23, 24] cannot achieve fine-grained access control. And the work [25] based on [23] also uses the less expressive “Strict AND-gate Policy” as its access structure. So, the data owner in [25] also cannot customize the flexible access policy for his/her ciphertext. And these works [20–22] apply the Threshold policy in their schemes, so their schemes [20–22] cannot realize the precise and flexible attribute-based access control.Table 1
Properties comparison.
SchemeAccess structureConstant-size ciphertextConstant-size private keyOutsourced decryptionSecurityBilinear group[23]Strict AND-gate Policy√√×Selectively IND-CPA securePrime order[20]Threshold√××Selectively IND-CPA securePrime order[21]Threshold√××Selectively IND-CPA securePrime order[16]Access tree×××Selectively IND-CPA securePrime order[17]Linear secret sharing schemes (LSSS) [40]×××Selectively IND-CPA-securePrime order[18]LSSS×××Selectively IND-CPA securePrime order[41]LSSS×××Fully (adaptively) IND-CPA secureComposite order[26]AND-gate policy with wildcards√××Selectively IND-CPA securePrime order[27]AND-gate policy with wildcards√××Fully (adaptively) IND-CPA secureComposite order[19]Tolerant AND-gate Policy based on bits string×√×Selectively IND-CCA securePrime order[31]LSSS××√(not privacy-preserving)Selectively IND-CPA securePrime order[34]LSSS××√(not privacy-preserving)Selectively IND-CPA securePrime order[33]LSSS××√(not privacy-preserving)Selectively IND-CPA securePrime order[29]Tolerant AND-gate policy based on bits string√××Selectively IND-CPA securePrime order[25]Strict AND-gate policy√××Selectively IND-CPA securePrime order[22]Threshold√××Selectively IND-CCA2 securePrime order[24]Strict AND-gate policy√√×Selectively IND-CPA securePrime order[28]AND-gate policy with wildcards√××Selectively IND-CPA securePrime orderOursTolerant AND-gate policy based on bits string√√√(privacy-preserving)Selectively IND-CCA securePrime order


### 4.2. Theoretical Analysis and Simulation Experiments

In this section, we choose some representative schemes [19–21, 23, 26, 29, 34] in Table 1 as well as our scheme for theoretical analysis in terms of the transmission load and computational complexity. To make the theoretical comparison clearer, we adopt the symmetric bilinear pairing e:G×G⟶GT for the schemes to be compared and evaluated. The definitions of the notations for theoretical analysis are presented in Table 2. The evaluation of the transmission load is shown in Table 3. From Table 3, we can observe that in our scheme, no matter how many attributes a user has and how complexity an access policy is, the length of the user’s private key is only 2G and the size of the ciphertext is only 3G. The comparison of the computational complexity in terms of the five algorithms as AttrKeyGen, Encrypt, Blind KeyGen (by user), Online Decryption (by proxy server), and Offline Decryption (by users) is presented in Table 4.Table 2
Notations for comparison.
NotationsMeaningℤp∗/G/GTSize of element in the groupℤp∗/G/GT. e:G×G⟶GT mod p is a symmetric bilinear pairing.TeGTime for a group exponential operation inG(3.351 ms).TeGTTime for a group exponential operation inGT(0.538 ms).TpTime for a symmetric bilinear pairinge:G×G⟶GT mod p (5.325 ms).lThe number of rows of the LSSS matrix.nThe number of the attributes in system.SThe number of the attributes in the user’s attribute set.WThe bit string-based AND-gate access policyW=w1w2,…,wn, where wi∈0,1,1≤i≤n.IWThe size ofIW=i|1≤i≤n,wi=1.ℐThe size of the setℐ. ℐ is one subset of 1,2,…,l, that is, ℐ⊆1,2,…,l; all the attributes in ℐ can satisfy the LSSS access policy.tThe threshold of the threshold policy.naThe number of the attributes in the threshold policy.Table 3
Transmission load comparison.
SchemePrivate key lengthCiphertext length[20]S‖G+n−1G+G2G+GT[21]S‖G+n−1G+G2G+GT[23]2GGT+2G[24]2GGT+2G[26]S‖GGT+2G[34]2G+S‖GGT+G+2lG+G[19]2GG+n−IW+1G[29]2G+S‖G2G+GTOurs2G3GTable 4
Computational complexity comparison.
SchemeAttrKeyGenEncryptOnline decryption (by proxy server)Blind KeyGen (by user)/offline decryption (by user)[20]STeG+n−1TeG+TeGTeG+TeGT+TeG+n+tTeG××/t−1+1t/2TeG+Tp+n−1TeG+Tp+TeG+Tp[21]STeG+n−1TeG+TeGTeG+na+1TeG+TeG+Tp+TeGT××/t−1+1t/2TeG+Tp+na−tTeG+Tp[23]3TeGTeGT+2TeG××/2Tp[24]nTeG+3TeGTeGT+3TeG+nTeG××/6Tp[26]2STeGTeGT+TeG+TeG××/2Tp[34]3TeG+STeGTeGT+TeG+3lTeG+2TeGTp+2|ℐ|Tp+|ℐ|TeGT2TeG+STeG/3TeG[19]2TeG2n−IW+1TeG+TeG+TeGT××/n−IWTeG+n−IW+1TeG+3Tp+TeG[29]2TeG+STeG2TeG+TeGT××/3TpOurs2TeGTeG+2n−IW+2TeG+TeGTn−|IW|TeG+Tp+2Tp2TeG/3TeGTo evaluate the actual performance in terms of the transmission overhead and computational complexity of our scheme, we use the PBC [42] cryptographic library to run the simulation experiments of our scheme as well as the scheme in [19, 29], which are also using the “Tolerant AND-gate Policy based on Bits String” as their access policies to ensure the single-variable principle. The hardware for the experiments is the i5-1135G7 2.4 GHz with 16 GB 3200 MHz RAM and OS is Windows 10 1909. To realize the symmetric bilinear pairing e:G×GGT with the security level of 80 bits, we adopt the supersingular (symmetric) curve EFq:y2=x3+xmodq with embedding degree k=2 in the field Fq with the prime q of 512 bits. And G is an additive subgroup in the EFq with the prime order r of 160 bits. In this case, G=GT=512bits×2=1024bits=128bytes, ℤp∗=160bits=20bytes. The execution time of the cryptographic operations has been listed in Table 2. The results of the experiments are shown in Figures 4 and 5. And we compare the consumption time of local decryption algorithm and privacy-preserving outsourced decryption algorithm by performing a comparison simulation experiment between the two algorithms. And the result of the comparison simulation experiment is shown in Figure 6. By doing this, we can easily detect that our privacy-preserving outsourced decryption algorithm can greatly ease the computing burden of IoT devices. If the user uses the local decryption algorithm to retrieve the data, the decryption time is positively correlated with the complexity of access structure. And what is more, by using our privacy-preserving outsourced decryption algorithm, the decryption time by the IoT devices is constant.Figure 4
Algorithms’ complexity.
(a)(b)(c)Figure 5
Comparison of occupied storage space (private key length) and transmission overhead (ciphertext length).
(a)(b)Figure 6
Comparison of decryption time between our two decryption modes.


## 4.1. Properties Evaluation

In this section, we compare our scheme with some related CP-ABE schemes in terms of the properties in Table1. From Table 1, we can know that only our scheme provides “constant-size ciphertext,” “constant-size private key,” and “privacy-preserving outsourced decryption” simultaneously. The schemes in [23, 24] are also with constant-size ciphertext and constant-size private key, but their access structures—“Strict AND-gate Policy” are less expressive and too strict. Thus, these schemes [23, 24] cannot achieve fine-grained access control. And the work [25] based on [23] also uses the less expressive “Strict AND-gate Policy” as its access structure. So, the data owner in [25] also cannot customize the flexible access policy for his/her ciphertext. And these works [20–22] apply the Threshold policy in their schemes, so their schemes [20–22] cannot realize the precise and flexible attribute-based access control.Table 1
Properties comparison.
SchemeAccess structureConstant-size ciphertextConstant-size private keyOutsourced decryptionSecurityBilinear group[23]Strict AND-gate Policy√√×Selectively IND-CPA securePrime order[20]Threshold√××Selectively IND-CPA securePrime order[21]Threshold√××Selectively IND-CPA securePrime order[16]Access tree×××Selectively IND-CPA securePrime order[17]Linear secret sharing schemes (LSSS) [40]×××Selectively IND-CPA-securePrime order[18]LSSS×××Selectively IND-CPA securePrime order[41]LSSS×××Fully (adaptively) IND-CPA secureComposite order[26]AND-gate policy with wildcards√××Selectively IND-CPA securePrime order[27]AND-gate policy with wildcards√××Fully (adaptively) IND-CPA secureComposite order[19]Tolerant AND-gate Policy based on bits string×√×Selectively IND-CCA securePrime order[31]LSSS××√(not privacy-preserving)Selectively IND-CPA securePrime order[34]LSSS××√(not privacy-preserving)Selectively IND-CPA securePrime order[33]LSSS××√(not privacy-preserving)Selectively IND-CPA securePrime order[29]Tolerant AND-gate policy based on bits string√××Selectively IND-CPA securePrime order[25]Strict AND-gate policy√××Selectively IND-CPA securePrime order[22]Threshold√××Selectively IND-CCA2 securePrime order[24]Strict AND-gate policy√√×Selectively IND-CPA securePrime order[28]AND-gate policy with wildcards√××Selectively IND-CPA securePrime orderOursTolerant AND-gate policy based on bits string√√√(privacy-preserving)Selectively IND-CCA securePrime order


## 4.2. Theoretical Analysis and Simulation Experiments

In this section, we choose some representative schemes [19–21, 23, 26, 29, 34] in Table 1 as well as our scheme for theoretical analysis in terms of the transmission load and computational complexity. To make the theoretical comparison clearer, we adopt the symmetric bilinear pairing e:G×G⟶GT for the schemes to be compared and evaluated. The definitions of the notations for theoretical analysis are presented in Table 2. The evaluation of the transmission load is shown in Table 3. From Table 3, we can observe that in our scheme, no matter how many attributes a user has and how complexity an access policy is, the length of the user’s private key is only 2G and the size of the ciphertext is only 3G. The comparison of the computational complexity in terms of the five algorithms as AttrKeyGen, Encrypt, Blind KeyGen (by user), Online Decryption (by proxy server), and Offline Decryption (by users) is presented in Table 4.Table 2
Notations for comparison.
NotationsMeaningℤp∗/G/GTSize of element in the groupℤp∗/G/GT. e:G×G⟶GT mod p is a symmetric bilinear pairing.TeGTime for a group exponential operation inG(3.351 ms).TeGTTime for a group exponential operation inGT(0.538 ms).TpTime for a symmetric bilinear pairinge:G×G⟶GT mod p (5.325 ms).lThe number of rows of the LSSS matrix.nThe number of the attributes in system.SThe number of the attributes in the user’s attribute set.WThe bit string-based AND-gate access policyW=w1w2,…,wn, where wi∈0,1,1≤i≤n.IWThe size ofIW=i|1≤i≤n,wi=1.ℐThe size of the setℐ. ℐ is one subset of 1,2,…,l, that is, ℐ⊆1,2,…,l; all the attributes in ℐ can satisfy the LSSS access policy.tThe threshold of the threshold policy.naThe number of the attributes in the threshold policy.Table 3
Transmission load comparison.
SchemePrivate key lengthCiphertext length[20]S‖G+n−1G+G2G+GT[21]S‖G+n−1G+G2G+GT[23]2GGT+2G[24]2GGT+2G[26]S‖GGT+2G[34]2G+S‖GGT+G+2lG+G[19]2GG+n−IW+1G[29]2G+S‖G2G+GTOurs2G3GTable 4
Computational complexity comparison.
SchemeAttrKeyGenEncryptOnline decryption (by proxy server)Blind KeyGen (by user)/offline decryption (by user)[20]STeG+n−1TeG+TeGTeG+TeGT+TeG+n+tTeG××/t−1+1t/2TeG+Tp+n−1TeG+Tp+TeG+Tp[21]STeG+n−1TeG+TeGTeG+na+1TeG+TeG+Tp+TeGT××/t−1+1t/2TeG+Tp+na−tTeG+Tp[23]3TeGTeGT+2TeG××/2Tp[24]nTeG+3TeGTeGT+3TeG+nTeG××/6Tp[26]2STeGTeGT+TeG+TeG××/2Tp[34]3TeG+STeGTeGT+TeG+3lTeG+2TeGTp+2|ℐ|Tp+|ℐ|TeGT2TeG+STeG/3TeG[19]2TeG2n−IW+1TeG+TeG+TeGT××/n−IWTeG+n−IW+1TeG+3Tp+TeG[29]2TeG+STeG2TeG+TeGT××/3TpOurs2TeGTeG+2n−IW+2TeG+TeGTn−|IW|TeG+Tp+2Tp2TeG/3TeGTo evaluate the actual performance in terms of the transmission overhead and computational complexity of our scheme, we use the PBC [42] cryptographic library to run the simulation experiments of our scheme as well as the scheme in [19, 29], which are also using the “Tolerant AND-gate Policy based on Bits String” as their access policies to ensure the single-variable principle. The hardware for the experiments is the i5-1135G7 2.4 GHz with 16 GB 3200 MHz RAM and OS is Windows 10 1909. To realize the symmetric bilinear pairing e:G×GGT with the security level of 80 bits, we adopt the supersingular (symmetric) curve EFq:y2=x3+xmodq with embedding degree k=2 in the field Fq with the prime q of 512 bits. And G is an additive subgroup in the EFq with the prime order r of 160 bits. In this case, G=GT=512bits×2=1024bits=128bytes, ℤp∗=160bits=20bytes. The execution time of the cryptographic operations has been listed in Table 2. The results of the experiments are shown in Figures 4 and 5. And we compare the consumption time of local decryption algorithm and privacy-preserving outsourced decryption algorithm by performing a comparison simulation experiment between the two algorithms. And the result of the comparison simulation experiment is shown in Figure 6. By doing this, we can easily detect that our privacy-preserving outsourced decryption algorithm can greatly ease the computing burden of IoT devices. If the user uses the local decryption algorithm to retrieve the data, the decryption time is positively correlated with the complexity of access structure. And what is more, by using our privacy-preserving outsourced decryption algorithm, the decryption time by the IoT devices is constant.Figure 4
Algorithms’ complexity.
(a)(b)(c)Figure 5
Comparison of occupied storage space (private key length) and transmission overhead (ciphertext length).
(a)(b)Figure 6
Comparison of decryption time between our two decryption modes.


## 5. Conclusion

In this paper, we propose a lightweight CP-ABE scheme with both constant-size ciphertexts and private keys for the IoT devices in cloud-assisted IoT environment. And users can outsource the decryption mission to the proxy server in a secure and private manner by using our privacy-preserving outsourced decryption algorithm. Our scheme can not only protect the privacy of users and confidentiality of the data but also reduce the communication overhead of the cloud-assisted IoT system and the computing pressure of users. Then, we rigorously prove that our scheme is selectively IND-CCA secure by reducing the indistinguishability of our scheme to the n-aMSE-DHH problem. Finally, we compare our scheme with other CP-ABE schemes in terms of properties, transmission overhead, and computational complexity to show that our scheme is more applicable for the cloud-assisted IoT system. The main limitation and defect of our scheme is that our scheme cannot support the large universe attributes; that means users only can use the attributes which are defined by the AA in advance. In future research, to improve the flexibility and practicality of our scheme, we will make our scheme support the large universe attributes.



---

*Source: 6676862-2021-05-05.xml*