# Efficient Hierarchical and Time-Sensitive Data Sharing with User Revocation in Mobile Crowdsensing

Authors: Jiawei Zhang; Jianfeng Ma; Teng Li; Qi Jiang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Recently, cloud-based mobile crowdsensing (MCS) has developed into a promising paradigm which can provide convenient data sensing, collection, storage, and sharing services for resource-constrained terminates. Nevertheless, it also inflicts many security concerns such as illegal access toward user secret and privacy. To protect shared data against unauthorized accesses, many studies on Ciphertext-Policy Attribute-Based Encryption (CP-ABE) have been proposed to achieve data sharing granularity. However, providing a scalable and time-sensitive data-sharing scheme across hierarchical users with compound attribute sets and revocability remains a big issue. In this paper, we investigate this challenge and propose a hierarchical and time-sensitive CP-ABE scheme, named HTR-DAC, which is characteristics of time-sensitive data access control with scalability, revocability, and high efficiency. Particularly, we propose a time-sensitive CP-ABE for hierarchical structured users with recursive attribute sets. Moreover, we design a robust revocable mechanism to achieve direct user revocation in our scheme. We also integrate verifiable outsourced decryption to improve efficiency and guarantee correctness in decryption procedure. Extensive security and performance analysis is presented to demonstrate the security requirement satisfaction and high efficiency for our data-sharing scheme in MCS.


---

## Body

## 1. Introduction

As a promising paradigm, the adoption of the Mobile Crowdsensing (MCS), which can take advantage of individual resource-limited mobile terminals to sense, collect, and analyze data rather than massive static sensors deployment, grows rapidly, and a large number of mobile users are willing to enjoy the convenient services of MCS, such as smart health, smart cities, and intelligent transportation [1]. These days, the wide spread of Internet of Things [2] and the emerging 5G communication network which can support fast speed and massive access [3] also facilitate the application of MCS. Thus, the cloud-based mobile crowdsensing is proposed for optimizing data collection and minimizing the cost in both sensing and reporting [4]. As shown in Figure 1, the sensing data gathered by mobile terminals (e.g., laptops, vehicles, and IoT devices) are transmitted to cloud via 5G communications network or even satellites for data collection, storage, and sharing. However, the sensitive and private in such sensing data may be breached in untrusted cloud, which may prevent the further participation of mobile users, especially when their data are illegally accessed.Figure 1
The application scenario of cloud-based mobile crowdsensing.There have been many data access control solutions, such as access control list (ACL), Bell-La Padula (BLP), BiBa, and role-based access control (RBAC). Nevertheless, all of these solutions suffer from different drawbacks, such as inflexibility, high computation complexity, and coarse-grained access control [5]. In recent years, prospective ciphertext-policy attribute-based encryption (CP-ABE) is proposed to control data access based on attributes to achieve flexibility and fine granularity [6–9]. In CP-ABE, data producers are required to designate a specific access policy to obtain the ciphertext of their data before outsourcing. When accessing these shared contents, users need to decrypt the data with their secret keys and recover the plaintext if and only if they are authorized. However, these solutions cannot be directly utilized in the applications of time-sensitive data sharing across hierarchical users with revocability and recursive attribute set as some challenges remain unsolved.Let us take an example of the smart health record (SHR) sharing system [10]. In general, the mobile users in the SHR system are usually in hierarchical structure and large scale which need a scalable architecture. In the meantime, these users may have the following attribute set:(1)Org:Central Hospital,Dept:Cardiac Surgery,Role:dean,Level:intermediate,Role:surgeon,Level:senior.This recursive attribute set indicates the user that holds corresponding recursive key structure is both an intermediate dean and a senior surgeon of cardiac surgery in central hospital. Furthermore, the SHRs contain a lot of sensitive and private data, such as social security number, health condition, and disease, which need to be protected with fine-grained access control. Besides, many SHRs are time sensitive, that is, the data in high confidentiality are generally accessed by part of users (e.g., the hospital director) at the first time and following another part of users in a timed sequence. In addition, the mobile users in the system are dynamically changing, which requires an effective revocation mechanism. Therefore, it is the key to design a data-sharing scheme that deals with time-sensitive data and supports hierarchical and revocable users with recursive key structure efficiently in MCS.Although these days, the authors in [11] have solved the issues of hierarchical users with compound key structure in CP-ABE by combining the scheme of HIBE and ASBE, and the scheme in [12] proposed a time-based ABE by introducing time-releasing encryption (TRE) into CP-ABE. However, these schemes cannot support user dynamicity. The work in [13] proposed an effective direct user revocation, but it cannot achieve effective security as the revoked users can neglect the related mechanism in decryption to recover the plaintext. Thus, the security cannot be guaranteed. Moreover, all the above schemes incur high computation cost, which cannot adapt to the environment of MCS with resource-limited mobile terminals. Comprehensively, how to design an efficient access control scheme towards time-sensitive data with fine granularity, hierarchical users holding recursive attribute set, and user revocability simultaneously is still a big challenge.In this paper, inspired by the above scenario and the challenges in existing related work, a hierarchical and time-sensitive revocable data access control (HTR-DAC) scheme is put forward. Specifically, we present a scalable CP-ABE scheme for time-sensitive data-sharing service across hierarchical users that holds compound attribute set and can be revoked directly if they conduct malicious activities for illicit purpose. Besides, our scheme can improve efficiency and guarantee the correctness of decryption. Our main contributions are three folds:(i)
We put forward a scalable sharing scheme for time-sensitive data across hierarchical users with structured keys. The users’ keys are issued by the delegation of the domain authorities they belong to. Moreover, a cloud user can access ciphertexts if and only if he is authorized with correct attribute sets and exposed time trapdoors, which ensures the fine-grained and time-sensitive data access control.(ii)
We design a new approach to realize user revocability and high efficiency of our scheme. We integrate the verifiable outsourced decryption and a direct user revocation mechanism into our scheme. The approach can not only greatly improve the efficiency in decryption but also guarantee the correctness of decryption result.(iii)
We present the security analysis for our proposal to show the scheme achieves its security goals. We also implement our scheme and conduct extensive experimental simulations with performance evaluations to display our proposal with better efficiency and practicality.Our paper is outlined as follows. Section2 reviews some related work, and Section 3 gives several relevant notations together with definitions. The system model, adversary model, and design goals are shown in Section 4 following the system definition and of our scheme with its security model presented in Section 5. Based on this, we show the concrete description for our scheme in Section 6. Section 7 presents a thorough analysis for security, and Section 8 displays the performance evaluation for our scheme. In the end, we make a summary for our work in Section 9.


## 2. Related Work

This section reviews some related works on attribute-based encryption (ABE) technique.As a prospective technique, ABE was first introduced in [14] for access control in fine granularity. Later, Goyal et al. [15] divided ABE into two types: CP-ABE and KP-ABE (key-policy ABE). In the former, data owner can flexibly designate the access policy for ciphertext. Thus, we focus on this technique for data access control in MCS. Subsequently, a great many studies were dedicated on CP-ABE, such as large universe CP-ABE [16], multiauthority CP-ABE [17], traceable CP-ABE, and revocable CP-ABE [18].


### 2.1. Hierarchical ABE and Time-Release Encryption

Currently, many ABE schemes only support single authority for managing users’ secret keys. While, in a large scale, it is not suitable to fulfill the large number of user key management tasks. To find out a solution, the researchers in [19] raised the first hierarchical ABE scheme with the idea of hierarchical identity-based encryption. The scheme in [11] solves the problem of hierarchical user structure with key structure by combining the concept of HABE and ASBE (ABE with the attribute set). Recently, Wang and Gao [20] propose a CP-HABE scheme to solve the user privacy in Bitcoin Financial Systems. However, the scheme incurs continuous auxiliary input leakage. To solve the problem, the scheme [21] proposed a leakage-resilience CP-HABE scheme by introducing continuous leakage-resilience mechanism into the CP-ABE scheme. Later on, the work in [8] proposes a lightweight CP-HABE scheme to support flexibility and scalability and user revocation.As many applications in cloud is time-sensitive, time-release encryption (TRE) was first introduced in [22] which introduces a trust time agent to release the access right at a specific time point uniformly. Later, many schemes [23, 24] have integrated TRE to different cryptographic schemes to adapt to different application scenarios. These days, some studies try to combine TRE with ABE. The scheme in [25] proposes a time-sensitive data-sharing scheme in cloud. However, it merely supports coarse-grained access control and incurs a heavy burden for cloud users. Then, the work in [26] proposes a CP-ABE-based data access control scheme with time domain by combining the attribute set of users and access time inspired by [27]. Although the scheme eliminates much of work for data owner, it brings extra overhead for authority. Recently, the work in [12] proposes a time-sensitive CP-ABE scheme with high efficiency and fine-grained access control.


### 2.2. Revocable ABE and Verifiable Outsourced Computing

Current revocable schemes can be classified as user-level and attribute-level ones in which the former involves direct revocation and indirect revocation. In direct user revocation schemes [13, 28–30], the data producer can integrate revocation list into ciphertext and requires no key updates in revocation. While, the indirect user revocation schemes [30–32] periodically update nonrevoked users’ secret key without data producers knowing the revocation list. In particular, the work in [13] proposes a novel direct user revocation CP-ABE scheme. However, the scheme suffers from a low security as, in their revocation mechanism, any data user including revoked and nonrevoked user can recover the plaintext by skipping the revocation procedure in decryption. Later, the proposals in [28–30] extend the direct user revocation mechanisms, but they fail to solve the problem in [13] and the low efficiency caused by direct revocation.As the decryption cost in ABE is very high, many researchers have studied on this topic. The scheme in [33] introduced outsourced computing into ABE scheme to improve the decryption efficiency. Later, many studies are in this direction. In these schemes, the ciphertexts can be translated to a constant-sized ElGamal-typed ones and cloud gains nothing about the content. However, this kind of schemes cannot ensure the ciphertexts are decrypted by the cloud correctly. To overcome this flaw, Lai et al. [34] raise an outsourced decryption scheme with verifiability that ensures the decryption is executed correctly. Then, the scheme in [35] proposes another verifiable scheme by introducing token mechanism which eliminates the pairing computations. The work in [36] proposes a verifiable scheme with exculpability, while the scheme incurs heavy computational overhead. To improve efficiency, the scheme in [37] introduces a verification code for correctness of decryption with high efficiency.


## 2.1. Hierarchical ABE and Time-Release Encryption

Currently, many ABE schemes only support single authority for managing users’ secret keys. While, in a large scale, it is not suitable to fulfill the large number of user key management tasks. To find out a solution, the researchers in [19] raised the first hierarchical ABE scheme with the idea of hierarchical identity-based encryption. The scheme in [11] solves the problem of hierarchical user structure with key structure by combining the concept of HABE and ASBE (ABE with the attribute set). Recently, Wang and Gao [20] propose a CP-HABE scheme to solve the user privacy in Bitcoin Financial Systems. However, the scheme incurs continuous auxiliary input leakage. To solve the problem, the scheme [21] proposed a leakage-resilience CP-HABE scheme by introducing continuous leakage-resilience mechanism into the CP-ABE scheme. Later on, the work in [8] proposes a lightweight CP-HABE scheme to support flexibility and scalability and user revocation.As many applications in cloud is time-sensitive, time-release encryption (TRE) was first introduced in [22] which introduces a trust time agent to release the access right at a specific time point uniformly. Later, many schemes [23, 24] have integrated TRE to different cryptographic schemes to adapt to different application scenarios. These days, some studies try to combine TRE with ABE. The scheme in [25] proposes a time-sensitive data-sharing scheme in cloud. However, it merely supports coarse-grained access control and incurs a heavy burden for cloud users. Then, the work in [26] proposes a CP-ABE-based data access control scheme with time domain by combining the attribute set of users and access time inspired by [27]. Although the scheme eliminates much of work for data owner, it brings extra overhead for authority. Recently, the work in [12] proposes a time-sensitive CP-ABE scheme with high efficiency and fine-grained access control.


## 2.2. Revocable ABE and Verifiable Outsourced Computing

Current revocable schemes can be classified as user-level and attribute-level ones in which the former involves direct revocation and indirect revocation. In direct user revocation schemes [13, 28–30], the data producer can integrate revocation list into ciphertext and requires no key updates in revocation. While, the indirect user revocation schemes [30–32] periodically update nonrevoked users’ secret key without data producers knowing the revocation list. In particular, the work in [13] proposes a novel direct user revocation CP-ABE scheme. However, the scheme suffers from a low security as, in their revocation mechanism, any data user including revoked and nonrevoked user can recover the plaintext by skipping the revocation procedure in decryption. Later, the proposals in [28–30] extend the direct user revocation mechanisms, but they fail to solve the problem in [13] and the low efficiency caused by direct revocation.As the decryption cost in ABE is very high, many researchers have studied on this topic. The scheme in [33] introduced outsourced computing into ABE scheme to improve the decryption efficiency. Later, many studies are in this direction. In these schemes, the ciphertexts can be translated to a constant-sized ElGamal-typed ones and cloud gains nothing about the content. However, this kind of schemes cannot ensure the ciphertexts are decrypted by the cloud correctly. To overcome this flaw, Lai et al. [34] raise an outsourced decryption scheme with verifiability that ensures the decryption is executed correctly. Then, the scheme in [35] proposes another verifiable scheme by introducing token mechanism which eliminates the pairing computations. The work in [36] proposes a verifiable scheme with exculpability, while the scheme incurs heavy computational overhead. To improve efficiency, the scheme in [37] introduces a verification code for correctness of decryption with high efficiency.


## 3. Preliminaries

This section presents several relevant notions and definitions employed in our paper.


### 3.1. Notations

We summarize several notations used in our scheme as well as their descriptions in Table1.Table 1
Notation description.
NotationsDescriptionsn1,…,nG0,G1Two multiplicative cyclic groupsRLUser revocation listSKuSecret attribute key for DUTKuTransformation key pare for DUAKey structure of DUAiith attribute set of DUTAccess policy treeX,X¯Leaf node set and translating node set ofTTokTime token released by TATDxThe trapdoor associated with nodex∈TVCVerification code for ciphertextCTsThe ciphertext encrypted with symmetric algorithmsCTThe whole ciphertext


### 3.2. Access Structure and Key Structure

Definition 1 (access structures, see [38]).
SupposeL1,…,Ln is a party set. One of the collection L⊆2L1,…,Ln is considered to be monotone if∀M,N:M∈LandM⊆M;then,N∈L. An access structure that is monotone is defined as one of the nonempty subsets L of L1,…,Ln,i.e.,L⊆2L1,…,Ln/∅. The elements in L are defined as authorized sets and the other sets are defined as unauthorized sets. Without loss of generality, we can describe users with their attribute set.Definition 2 (key structure, see [11]).
As for most of the practical situations, each user’s attribute setA is organized in a tree-like recursive set structure in which each element of A is an attribute set or a single attribute. As a result, the corresponding key structure of each user is similar to the attribute structure. The depth of A (also, the key structure) is the number of levels for the recursive set. Suppose a 2−depth key structure; the level 1 members can be either attribute sets or attributes, while the level 2 members may only be attributes. The key structure in Figure 2 is of depth=2, denoting that the user is both an intermediate dean and a senior surgeon in cardiac surgery in central hospital. Moreover, in the key structure, each set is assigned a unique label which is a unique index of the recursive set, and each attribute in an element set is labeled by the set’s index together with its name. Suppose a key structure of depth=2 with m attribute sets is represented by A=Ai0≤i≤m, where A0 is the set at depth 1 and other sets Ai are at depth 2. As in Figure 2, A0 = {Org: Central Hospital, Dept: Cardiac Surgery}, A1 = {Role: dean, Staff level: intermediate}, and A2 = {Role:surgeon, Staff level: senior}. Then, the attribute ”Role:dean” can be denoted by (1, Role:dean).Figure 2
An example of key structure.


### 3.3. Access Policy Tree

Definition 3 (access tree, see [39]).
Similar to [39], suppose R is a policy tree with each node x∈R, where we use a threshold gate to represent nonleaf nodes and a leaf node is an attribute attx. As to a threshold gate x∈R, we use numx which is the number of children and the threshold value thx∈1,numx to depict it. Specifically, if thx=1, it is an OR gate, and if thx=numx, it is an AND gate. If x∈T is a leaf node, its threshold value is thx=1.
Moreover, supposer∈R is the root node. If x∈T is a nonleaf node, childx is a collection of its children and parentx denotes the parent node of x. Thus, we can infer that childx=numx. We use the function indexx to signify the unique index value of each node x∈T.
Access Tree Satisfaction. Suppose R is an access tree rooted from node r; then, we use Rx to denote a subtree rooted from node x∈R. Here, we define RxA=1 when and only when A (a attribute set) is satisfactory to the subtree Rx, that is, when a leaf node x has attx=atti∈A, then RxA=1, and when a nonleaf node has ∀zx∈childx, the number of z satisfying RzA=1 exceeds thx, RxA=1.
Moreover, consider the key structureA=A0,A1,…,Am with depth=2, where Ai denotes the ith attribute set and i0≤i≤m denotes the index of each set. If A satisfies R, then RA will return a nonempty label set S. Here, RA is also computed recursively as before and A satisfies access tree T if and only if it consists of at least one set Ai0≤i≤m having all elements required to be satisfactory to R. Generally, combining attributes in different attribute sets of A that are satisfactory to R is impossible without translating nodes in R. Given a is a translating node x∈R, the attributes needed to meet Rx belonging to different sets in A can be combined to make the predicate with parentx hold.


### 3.4. Cryptographic Background

Definition 4 (bilinear maps, see [39]).
We consider twop-ordered G0 and G1 groups that are multiplicative cyclic, where p is a prime. εandϵ are two generators of group G0. If e^:G0×G0⟶G1 satisfies the following properties,(1)
Bilinearity:e^εa,ϵb=e^ε,ϵab,∀a,b∈Zp,ε,ϵ∈G(2)
Nondegeneracy:e^ε,ϵ≠1G1, e^ε,ε is a generator of G1(3)
Computability:e^ε,ϵ is efficiently computable for all ε,ϵ∈G0then, we call it a bilinear map.Definition 5 (decisional bilinear Diffie–Hellman (DBDH) assumption, see [40]).
Given two cyclic groupsE and F and their orders are both the prime p. Suppose a generator h∈E and a bilinear mapping e^:E×E⟶F. The DBDH problem is defined to find out the difference between e^h,hcdm and e^h,hν on inputting the tuple h,hc,hd,hm, where c,d,m,ν∈RZp.
It is considered that DBDH assumption holds when no probabilistic polynomial time (PPT) adversaries can deal with the DBDH problem whose advantages are nonnegligible.


## 3.1. Notations

We summarize several notations used in our scheme as well as their descriptions in Table1.Table 1
Notation description.
NotationsDescriptionsn1,…,nG0,G1Two multiplicative cyclic groupsRLUser revocation listSKuSecret attribute key for DUTKuTransformation key pare for DUAKey structure of DUAiith attribute set of DUTAccess policy treeX,X¯Leaf node set and translating node set ofTTokTime token released by TATDxThe trapdoor associated with nodex∈TVCVerification code for ciphertextCTsThe ciphertext encrypted with symmetric algorithmsCTThe whole ciphertext


## 3.2. Access Structure and Key Structure

Definition 1 (access structures, see [38]).
SupposeL1,…,Ln is a party set. One of the collection L⊆2L1,…,Ln is considered to be monotone if∀M,N:M∈LandM⊆M;then,N∈L. An access structure that is monotone is defined as one of the nonempty subsets L of L1,…,Ln,i.e.,L⊆2L1,…,Ln/∅. The elements in L are defined as authorized sets and the other sets are defined as unauthorized sets. Without loss of generality, we can describe users with their attribute set.Definition 2 (key structure, see [11]).
As for most of the practical situations, each user’s attribute setA is organized in a tree-like recursive set structure in which each element of A is an attribute set or a single attribute. As a result, the corresponding key structure of each user is similar to the attribute structure. The depth of A (also, the key structure) is the number of levels for the recursive set. Suppose a 2−depth key structure; the level 1 members can be either attribute sets or attributes, while the level 2 members may only be attributes. The key structure in Figure 2 is of depth=2, denoting that the user is both an intermediate dean and a senior surgeon in cardiac surgery in central hospital. Moreover, in the key structure, each set is assigned a unique label which is a unique index of the recursive set, and each attribute in an element set is labeled by the set’s index together with its name. Suppose a key structure of depth=2 with m attribute sets is represented by A=Ai0≤i≤m, where A0 is the set at depth 1 and other sets Ai are at depth 2. As in Figure 2, A0 = {Org: Central Hospital, Dept: Cardiac Surgery}, A1 = {Role: dean, Staff level: intermediate}, and A2 = {Role:surgeon, Staff level: senior}. Then, the attribute ”Role:dean” can be denoted by (1, Role:dean).Figure 2
An example of key structure.


## 3.3. Access Policy Tree

Definition 3 (access tree, see [39]).
Similar to [39], suppose R is a policy tree with each node x∈R, where we use a threshold gate to represent nonleaf nodes and a leaf node is an attribute attx. As to a threshold gate x∈R, we use numx which is the number of children and the threshold value thx∈1,numx to depict it. Specifically, if thx=1, it is an OR gate, and if thx=numx, it is an AND gate. If x∈T is a leaf node, its threshold value is thx=1.
Moreover, supposer∈R is the root node. If x∈T is a nonleaf node, childx is a collection of its children and parentx denotes the parent node of x. Thus, we can infer that childx=numx. We use the function indexx to signify the unique index value of each node x∈T.
Access Tree Satisfaction. Suppose R is an access tree rooted from node r; then, we use Rx to denote a subtree rooted from node x∈R. Here, we define RxA=1 when and only when A (a attribute set) is satisfactory to the subtree Rx, that is, when a leaf node x has attx=atti∈A, then RxA=1, and when a nonleaf node has ∀zx∈childx, the number of z satisfying RzA=1 exceeds thx, RxA=1.
Moreover, consider the key structureA=A0,A1,…,Am with depth=2, where Ai denotes the ith attribute set and i0≤i≤m denotes the index of each set. If A satisfies R, then RA will return a nonempty label set S. Here, RA is also computed recursively as before and A satisfies access tree T if and only if it consists of at least one set Ai0≤i≤m having all elements required to be satisfactory to R. Generally, combining attributes in different attribute sets of A that are satisfactory to R is impossible without translating nodes in R. Given a is a translating node x∈R, the attributes needed to meet Rx belonging to different sets in A can be combined to make the predicate with parentx hold.


## 3.4. Cryptographic Background

Definition 4 (bilinear maps, see [39]).
We consider twop-ordered G0 and G1 groups that are multiplicative cyclic, where p is a prime. εandϵ are two generators of group G0. If e^:G0×G0⟶G1 satisfies the following properties,(1)
Bilinearity:e^εa,ϵb=e^ε,ϵab,∀a,b∈Zp,ε,ϵ∈G(2)
Nondegeneracy:e^ε,ϵ≠1G1, e^ε,ε is a generator of G1(3)
Computability:e^ε,ϵ is efficiently computable for all ε,ϵ∈G0then, we call it a bilinear map.Definition 5 (decisional bilinear Diffie–Hellman (DBDH) assumption, see [40]).
Given two cyclic groupsE and F and their orders are both the prime p. Suppose a generator h∈E and a bilinear mapping e^:E×E⟶F. The DBDH problem is defined to find out the difference between e^h,hcdm and e^h,hν on inputting the tuple h,hc,hd,hm, where c,d,m,ν∈RZp.
It is considered that DBDH assumption holds when no probabilistic polynomial time (PPT) adversaries can deal with the DBDH problem whose advantages are nonnegligible.


## 4. System Model

We present the system and adversary model as well as corresponding design goals for our proposal in this section.


### 4.1. System Model

Figure3 shows the model of our system for HTR-DAC. It consists six entities: Cloud Service Provider (CSP), Trusted Authority (TA), several Domain Authorities (DAs), Data User (DU), and Data Owner (DO), which are described below:(i)
CSP: the CSP has unlimited resources, such as computation and storage resources. It can provide cloud users with centralized service, e.g., storage service, data-sharing service, and outsourced computing.(ii)
TA: this entity takes charge of initializing the system with parameters and the master key for the whole system. It also supports user authentication in its domain and enrollment of domain authorities of top level.(iii)
DAs: DAs are in hierarchical structure involving several domain authorities of the top level and authorities of the low level. Each domain authority is responsible for managing the lower level domain authority, i.e., authenticating and generating master keys for the lower-level authorities in its domain. Moreover, each domain authority also takes charge of assigning secret attribute keys and transformation keys for cloud users.(iv)
DO: the DO uploads his important information through all kinds of mobile devices to CSP. Before outsourcing these data, DO needs to encrypt the whole data for confidentiality and unauthorized access prevention by designating specific policy.(v)
DU: the DU downloads the data from CSP according to his requirements and decrypts the data if he has enough rights. He then recovers the correct plaintext after verification. If any DU has malicious activities, it will be revoked directly.Figure 3
The system model of our proposal.Then, we depict an overview for our HTR-DAC scheme based on the above system model involving the following four phases:(i)
Initialization. In this phase, TA initiates the whole system by generating the corresponding public key and master key. All entities are able to get the system public key.(ii)
Enrollment. In this phase, TA authenticates the top-level domain authorities and assigns them with the master keys. Recursively, each domain authority authenticates the domain authorities in the lower level within its domain and also creates master keys for them. Moreover, each domain authority manages cloud users in its domain by generating attribute keys and transformation keys for them after successful user authentication.(iii)
Encryption. In this phase, DO encrypts the sensitive and important data using symmetric encryption algorithm before uploading them to the CSP. Moreover, DO designates an access policy for the ciphertexts outsourced in CSP.(iv)
Decryption. In this phase, DU requests data files that he needs from CSP. After outsourced decryption, CSP returns the DU with the partially decrypted ciphertexts. Then, the DU verifies if the outsourced decryption is correct and recovers the plaintext according to the result of verification.


### 4.2. Adversary Model

In our proposal, the TA, DAs, and DO are regarded as the fully trusted entities, while the CSP is considered to be untrusted which may intentionally leak or modify the content of sensitive data. Moreover, some unauthorized DU may illegally access the sensitive data which will break the data security and privacy. Besides, some DU may conduct malicious activities for extrainterest revenues.According to the ability of adversary, we consider classifying the attacks into two types:(1)
Type-A attack: the adversary has insufficient privileges for data access, even he is not revoked or arrives at release time(2)
Type-B attack: the adversary has enough rights but he conducts accesses before relevant releasing time arrivesFocusing on these attacks, we take the following security requirements into consideration:(i)
Data confidentiality: the data generated by DO and outsourced in CSP should be secured against illegal sniffering and eavesdropping by attackers. Moreover, the outsourced data should also not be accessed by any malicious access without enough access rights.(ii)
Collusion-resistance: the scheme should prevent users anyone of whom is not authorized from colluding through combining their secret keys to access the shared data.(iii)
Revocability: any malicious cloud users that conduct malicious activities should be revoked and the revoked users should get rid of all the access rights.In addition, the following aspects are also in our consideration:(i)
Efficiency: as the resource-limited mobile devices are utilized in cloud-based mobile crowdsensing, it is preferable for DU to outsource the high-computational burden in decryption to CSP to improve efficiency(ii)
Verifiability: due to the untrusted CSP, DU should have the ability to check if the result of outsourced decryption procedure is correct


## 4.1. System Model

Figure3 shows the model of our system for HTR-DAC. It consists six entities: Cloud Service Provider (CSP), Trusted Authority (TA), several Domain Authorities (DAs), Data User (DU), and Data Owner (DO), which are described below:(i)
CSP: the CSP has unlimited resources, such as computation and storage resources. It can provide cloud users with centralized service, e.g., storage service, data-sharing service, and outsourced computing.(ii)
TA: this entity takes charge of initializing the system with parameters and the master key for the whole system. It also supports user authentication in its domain and enrollment of domain authorities of top level.(iii)
DAs: DAs are in hierarchical structure involving several domain authorities of the top level and authorities of the low level. Each domain authority is responsible for managing the lower level domain authority, i.e., authenticating and generating master keys for the lower-level authorities in its domain. Moreover, each domain authority also takes charge of assigning secret attribute keys and transformation keys for cloud users.(iv)
DO: the DO uploads his important information through all kinds of mobile devices to CSP. Before outsourcing these data, DO needs to encrypt the whole data for confidentiality and unauthorized access prevention by designating specific policy.(v)
DU: the DU downloads the data from CSP according to his requirements and decrypts the data if he has enough rights. He then recovers the correct plaintext after verification. If any DU has malicious activities, it will be revoked directly.Figure 3
The system model of our proposal.Then, we depict an overview for our HTR-DAC scheme based on the above system model involving the following four phases:(i)
Initialization. In this phase, TA initiates the whole system by generating the corresponding public key and master key. All entities are able to get the system public key.(ii)
Enrollment. In this phase, TA authenticates the top-level domain authorities and assigns them with the master keys. Recursively, each domain authority authenticates the domain authorities in the lower level within its domain and also creates master keys for them. Moreover, each domain authority manages cloud users in its domain by generating attribute keys and transformation keys for them after successful user authentication.(iii)
Encryption. In this phase, DO encrypts the sensitive and important data using symmetric encryption algorithm before uploading them to the CSP. Moreover, DO designates an access policy for the ciphertexts outsourced in CSP.(iv)
Decryption. In this phase, DU requests data files that he needs from CSP. After outsourced decryption, CSP returns the DU with the partially decrypted ciphertexts. Then, the DU verifies if the outsourced decryption is correct and recovers the plaintext according to the result of verification.


## 4.2. Adversary Model

In our proposal, the TA, DAs, and DO are regarded as the fully trusted entities, while the CSP is considered to be untrusted which may intentionally leak or modify the content of sensitive data. Moreover, some unauthorized DU may illegally access the sensitive data which will break the data security and privacy. Besides, some DU may conduct malicious activities for extrainterest revenues.According to the ability of adversary, we consider classifying the attacks into two types:(1)
Type-A attack: the adversary has insufficient privileges for data access, even he is not revoked or arrives at release time(2)
Type-B attack: the adversary has enough rights but he conducts accesses before relevant releasing time arrivesFocusing on these attacks, we take the following security requirements into consideration:(i)
Data confidentiality: the data generated by DO and outsourced in CSP should be secured against illegal sniffering and eavesdropping by attackers. Moreover, the outsourced data should also not be accessed by any malicious access without enough access rights.(ii)
Collusion-resistance: the scheme should prevent users anyone of whom is not authorized from colluding through combining their secret keys to access the shared data.(iii)
Revocability: any malicious cloud users that conduct malicious activities should be revoked and the revoked users should get rid of all the access rights.In addition, the following aspects are also in our consideration:(i)
Efficiency: as the resource-limited mobile devices are utilized in cloud-based mobile crowdsensing, it is preferable for DU to outsource the high-computational burden in decryption to CSP to improve efficiency(ii)
Verifiability: due to the untrusted CSP, DU should have the ability to check if the result of outsourced decryption procedure is correct


## 5. Security Model

This section presents the formal definition and the security model for our proposed scheme.


### 5.1. Definition of Our HTR-DAC Scheme

We propose a CP-ABE scheme in which the authorities and users are in the hierarchical structure each of which manages the domain authorities at lower level and cloud users in its charge. Moreover, the attribute set of each user is formed in recursive attribute sets. Besides, the scheme can revoke users in a direct way. Specifically, the algorithms in our scheme are as follows:(i)
Setupλ,d⟶PK,MSK0: this procedure is executed by TA to initialize whole system. Given system security parameter λ and d-depth of key structure, it outputs the system public parameters PK and the master key MSK0.(ii)
Create Top DAPK,MSK0,A⟶MSKi: the procedure is executed by TA. Given PK, MSK0, and the compound attribute set A of authority DAi which is at the top level, it outputs the master key MSKi for DAi.(iii)
Create EntityMSKi,ID,A¯⟶MSKi+1/SKu: the procedure is run by top level domain authority DAi or the lower level domain authority managing the cloud user. On inputting MSKi of DAi and the compound attribute set A¯ of the next-level domain authority DAi+1 or a cloud user ID, it returns the master key MSKi+1 for domain authority DAi+1 or the secret attribute key SKu for cloud user ID.(iv)
TKey GenPK,SKu⟶TKu: the procedure is executed by the corresponding domain authority to create transformation key pair for the cloud user. Given PK and the secret attribute key of the cloud user, it outputs the transformation key pair TKu.(v)
EncryptPK,M,T,RL⟶CT: this algorithm is run by DO to generate ciphertexts for fine-grained access control. It takes the system public parameters PK, the message M to be encrypted, the designated access policy tree T, and user revocation list R as input and returns the ciphertext CT of M.(vii)
Token GenPK,t⟶Tokt: the procedure is executed by TA to create time token at different fixed time points orderly. On inputting the system public parameters PK and the time point t, the algorithm outputs the time token Tokt of the time point t.(vii)
TrapPK,Tokt⟶TDx′: the procedure is run by CSP to expose the trapdoor in the access policy tree T of ciphertexts stored in it. Given the system public parameters and time token Tokt, the algorithm outputs the exposed trapdoor TDx′.(viii)
DecryptOUTPK,TPKu,CT⟶CT′: the procedure is executed by CSP to partially decrypt the ciphertext. Given PK, the public transformation key TPKu of DU, and the ciphertext CT to be decrypted, it outputs the partially decrypted ciphertext CT′.(ix)
DecryptUPK,TSKu,CT′⟶M or null: this algorithm is executed by DU to recover the plaintext of the ciphertext. On inputting PK, the secret transformation key TSKu of DU, and CT′ denoting the partially decrypted ciphertext, the algorithm returns the plaintext M.(x)
Dec VerifyPK,R∗,VC,CTs⟶True/False: the procedure is executed by DU to verify if the outsourced decryption is correct. Given the system public parameters PK, the recovered random R∗, verification code VC, and the symmetric ciphertext CTs, the algorithm checks if the recovered random is correct, i.e., if CSP correctly executes outsourced decryption. Finally, it outputs the result True/False of verification.


### 5.2. Security Model

Here, we describe the IND-CPA security model for our HTR-DAC scheme corresponding to the attacks described before and conduct a selective security game between an adversaryA and a challenger C specified as follows:Init:A sends a challenge access policy tree T and user revocation list RL to C.Setup 1:C executes the Setup algorithm of our scheme and outputs the public parameters to A.Phase 1:A issues a polynomial number of queries qii∈n, where qi belongs to the following queries:(1)
SK query:A requests C for secret key with an identity ID∉RL and a recursive attribute set A that is unsatisfactory to T before arriving at a time point t1. As a response, C outputs the secret key and publishes a series of time tokens before t1 and returns them to A.(2)
TK query:A issues queries for transformation key similar to that in SK Query. C executes TKeyGen to generate transformation key pairs and send it to A.Challenge:A finishes the above phase and issues two equal-length data M0 and M1 to C. Then, C randomly picks a bit ϵ∈0,1 and encrypts Mϵ according to T and ID and sends it to A.Phase 2: it is similar to Phase 1 and before a later time pointt2>t1.Guess:A publishes his guess ϵ′ for ϵ. If ϵ′=ϵ, he wins the security game. The advantage of A is defined as AdvA=Prϵ′=ϵ−1/2.Definition 6.
A HTR-DAC scheme is indistinguishable against chosen-plaintext attack (CPA) if all probabilistic polynomial adversaries cannot break the security game.


## 5.1. Definition of Our HTR-DAC Scheme

We propose a CP-ABE scheme in which the authorities and users are in the hierarchical structure each of which manages the domain authorities at lower level and cloud users in its charge. Moreover, the attribute set of each user is formed in recursive attribute sets. Besides, the scheme can revoke users in a direct way. Specifically, the algorithms in our scheme are as follows:(i)
Setupλ,d⟶PK,MSK0: this procedure is executed by TA to initialize whole system. Given system security parameter λ and d-depth of key structure, it outputs the system public parameters PK and the master key MSK0.(ii)
Create Top DAPK,MSK0,A⟶MSKi: the procedure is executed by TA. Given PK, MSK0, and the compound attribute set A of authority DAi which is at the top level, it outputs the master key MSKi for DAi.(iii)
Create EntityMSKi,ID,A¯⟶MSKi+1/SKu: the procedure is run by top level domain authority DAi or the lower level domain authority managing the cloud user. On inputting MSKi of DAi and the compound attribute set A¯ of the next-level domain authority DAi+1 or a cloud user ID, it returns the master key MSKi+1 for domain authority DAi+1 or the secret attribute key SKu for cloud user ID.(iv)
TKey GenPK,SKu⟶TKu: the procedure is executed by the corresponding domain authority to create transformation key pair for the cloud user. Given PK and the secret attribute key of the cloud user, it outputs the transformation key pair TKu.(v)
EncryptPK,M,T,RL⟶CT: this algorithm is run by DO to generate ciphertexts for fine-grained access control. It takes the system public parameters PK, the message M to be encrypted, the designated access policy tree T, and user revocation list R as input and returns the ciphertext CT of M.(vii)
Token GenPK,t⟶Tokt: the procedure is executed by TA to create time token at different fixed time points orderly. On inputting the system public parameters PK and the time point t, the algorithm outputs the time token Tokt of the time point t.(vii)
TrapPK,Tokt⟶TDx′: the procedure is run by CSP to expose the trapdoor in the access policy tree T of ciphertexts stored in it. Given the system public parameters and time token Tokt, the algorithm outputs the exposed trapdoor TDx′.(viii)
DecryptOUTPK,TPKu,CT⟶CT′: the procedure is executed by CSP to partially decrypt the ciphertext. Given PK, the public transformation key TPKu of DU, and the ciphertext CT to be decrypted, it outputs the partially decrypted ciphertext CT′.(ix)
DecryptUPK,TSKu,CT′⟶M or null: this algorithm is executed by DU to recover the plaintext of the ciphertext. On inputting PK, the secret transformation key TSKu of DU, and CT′ denoting the partially decrypted ciphertext, the algorithm returns the plaintext M.(x)
Dec VerifyPK,R∗,VC,CTs⟶True/False: the procedure is executed by DU to verify if the outsourced decryption is correct. Given the system public parameters PK, the recovered random R∗, verification code VC, and the symmetric ciphertext CTs, the algorithm checks if the recovered random is correct, i.e., if CSP correctly executes outsourced decryption. Finally, it outputs the result True/False of verification.


## 5.2. Security Model

Here, we describe the IND-CPA security model for our HTR-DAC scheme corresponding to the attacks described before and conduct a selective security game between an adversaryA and a challenger C specified as follows:Init:A sends a challenge access policy tree T and user revocation list RL to C.Setup 1:C executes the Setup algorithm of our scheme and outputs the public parameters to A.Phase 1:A issues a polynomial number of queries qii∈n, where qi belongs to the following queries:(1)
SK query:A requests C for secret key with an identity ID∉RL and a recursive attribute set A that is unsatisfactory to T before arriving at a time point t1. As a response, C outputs the secret key and publishes a series of time tokens before t1 and returns them to A.(2)
TK query:A issues queries for transformation key similar to that in SK Query. C executes TKeyGen to generate transformation key pairs and send it to A.Challenge:A finishes the above phase and issues two equal-length data M0 and M1 to C. Then, C randomly picks a bit ϵ∈0,1 and encrypts Mϵ according to T and ID and sends it to A.Phase 2: it is similar to Phase 1 and before a later time pointt2>t1.Guess:A publishes his guess ϵ′ for ϵ. If ϵ′=ϵ, he wins the security game. The advantage of A is defined as AdvA=Prϵ′=ϵ−1/2.Definition 6.
A HTR-DAC scheme is indistinguishable against chosen-plaintext attack (CPA) if all probabilistic polynomial adversaries cannot break the security game.


## 6. Proposed HTR-DAC Scheme

This section describes the concrete construction of our proposal. In particular, our scheme involves the following algorithms:Setup, Create Top DA, Create Entity, TKey Gen, Encrypt, Token Gen, Trap, DecryptOUT, DecryptU, and Dec Verify, which are described in detail below.


### 6.1. Initialization Phase

(i)
Setupλ,d⟶PK,MSK0: on inputting the security parameter λ and the depth of the key structure d, the algorithm generates two multiplicative bilinear groups G0 and G1 of prime order p with a generator g of bilinear group G0 and a bilinear map e^:G0×G0⟶G1 and selects random numbers α,βi,γ∈Zp, where i∈d which is used to represent the depth of key structure. Here, we take d=2 as an example. The algorithm chooses a probabilistic symmetric encryption scheme Enc,Dec from a binary string to Zp∗ and selects collision-resistant hash functions H0:G1⟶0,1l1,H1:0,1⟶G0,H2:G1⟶Zp∗,andH3:0,1∗⟶0,1l2, where l1 and l2 are the output length of hash function H0 and H3, respectively. Then, the algorithm sets the time format FT. Next, it computes and outputs the system public key and master key as follows:(2)PK=G0,G1,e^,g,e^g,gα,h1=gβ1,h2=gβ2,η1=g1/β1,η2=g1/β2,δ=gγ,H0,H1,H2,H3,MSK0=gα,β1,β2,γ.Finally, TA publishesPK and stores MSK0 locally in secret.


### 6.2. Domain/User Enrollment Phase

In this phase, TA invokes the algorithmCreate Top DA to generate the master key for a new valid top domain authority DAi after receiving the request to take part in the system from DAi. Subsequently, DAi can manage the next-level domain authorities or users within its domain by calling the algorithm Create Entity. As to a cloud user, TA also takes charge of the generation of transformation keys for users after they get their secret attribute keys from their domain authority:(i)
Create Top DAPK,MSK0,A⟶MSKi: on receiving the request from a domain authority at top level DAi to take part in the system after being checked by TA, the algorithm generates master key for DAi by selecting a random number r△∈Zp. Then, it picks r△,i∈RZp according to Ai∈A, where Ai is each attribute set. Moreover, the algorithm picks r△,i,j∈RZp according to atti,j∈Ai, where atti,j is each attribute and 0≤i≤m and 1≤j≤ni. The algorithm computes the master key for DAi as follows:(3)MSKi=A,D0=gα+r△/β1,∀atti,j∈Ai:Di,j=gr△,i⋅H1atti,jr△,i,j,Di,j′=gr△,i,j∀Ai∈A:Ei=gr△+r△,i/β2.In the master key of a top-level domain authority,Ei is used to translate r△,i of Ai to r△ of A0 at the translating node. Meanwhile, Ei and Ei′ can translate r△,i′ to r△,i by computing Ei/Ei′.(ii)
Create EntityMSKi,ID,A¯⟶MSKi+1/SKu: the algorithm is used to generate master key for a new domain authority or the attribute secret key of a user. Given the master key MSKi=A,D0,Di,j,Di,j′,for0≤i≤m,1≤j≤n,Ei,for0≤i≤m of DAi, the algorithm picks r¯△∈RZp for the user or domain authority, r¯△,i∈RZp for each attribute set Ai∈A¯, and r¯△,i,j∈RZp for each attribute atti,j∈Ai. For different kinds of entity, the algorithm generates corresponding key for the entity.(1)
If the entity is a domain authority (i.e.,DAi+1), the algorithm generates the master key MSKi+1 for DAi+1 as follows:(4)MSKi+1=A¯,D¯0=D0⋅η1r△¯,∀atti,j∈Ai,D¯i,j=Di,j⋅gr△,i¯⋅H1atti,jr△,i,j¯,D¯i,j′=Di,j′⋅gr△,i,j¯,∀Ai∈A¯:E¯i=Ei⋅η2r¯△+r¯△,i.(2)
If the entity is a user with identityID, the algorithm generates the attribute secret key SKu for the user as follows:(iii)
TKey GenPK,SKu⟶TKu: TA selects z∈RZp∗ as the secret transformation key TSKu of the user and computes the public transform key TPKu=A,K0,K1,Ki,j,Ki,j′atti,j∈Ai,E^i′Ai∈A, where(6)K0=D01/z,K1=D11/z,∀atti,j∈Ai:Ki,j=Di,j1/z,Ki,j′=Di,j′1/z,∀Ai∈A:E^i=Ei1/z.Finally, the algorithm outputs the transformation key pairTKu=TPKu,TSKu for the cloud user who keeps the TSKu secret and publishes TPKu.


### 6.3. Encryption Phase

(1)
EncryptPK,M,T,RL⟶CT: on inputting PK, the data M to be encrypted, the designated access policy tree T, and the revocation list RL=ID1,…,IDK, the algorithm consists the following steps:(i)
The algorithm chooses a randomR∈GT and computes ck=H2R as the symmetric encryption key. Then, it encrypts the data M with ck to get CTs=EncM,ck, where Enc is the symmetric encryption algorithm of our scheme. Moreover, the algorithm computes the verification code VC=H3R′‖CTs for CTs, where R′=H0R.(ii)
With the designate access policy treeT whose root node is denoted by R, the algorithm chooses a random number sR0∈Zp as the base secret value of T and computes C0=R⋅e^g,gαsR0. Then, for each node x in T, the algorithm picks two random number sx1∈Zp and sx2∈Zp∗, which satisfy the following equation:(7)sx1⋅sx2=sx0,xis linked to a time trapdoor,sx1=sx0,sx2=1,otherwise.(iii)
Given the user revocation listRL=ID1,…,IDK, the algorithm selects a random δk for IDk∈RL, where ∑k=1Kδk=sR0. Then, the algorithm computes the corresponding ciphertext component C˜,C˜′, where(8)∀IDk∈RL:C˜k=h1δk,C˜k′=h1−IDk⋅δk.(iv)
Then, for a trapdoorTDx related to the time release t∈FT and a secret parameter sx2, DO picks a random number rt∈Zp and generates TDx of node x as follows:(9)TDx=Ax=grt,Bx=sx2+H2eH1t,frt.(v)
Next, the algorithm computes the ciphertext in a top-to-bottom way by executing the following steps:(1)
For each nonleaf nodex with sx1, the DO chooses a polynomial qx whose degree dx=thx−1 and qx0=sx1. For each of x’s child node y∈childx with a unique index indexy, DO sets sy0=qxindexy.(2)
For a leaf nodex with sx1 and related attribute attx, the algorithm generates corresponding ciphertext components CxandCx′ as follows:(10)∀x∈X:Cx=gsx1,Cx′=H1attxsx1,whereX is the leaf node set in T.(3)
For each translating nodex′ in T, the algorithm computes the corresponding ciphertext component C¯x′ as follows:(11)∀x′∈X¯:C¯x′=h2sx′1,whereX¯ is the translating node set in T.Finally, the DO outputs the ciphertextCT=T,RL,CTs,VC,C0,Cx,Cx′x∈X,TDxTDx∈T,C¯x′x′∈X¯,C˜k,C˜k′IDk∈RL and uploads it to CSP.


### 6.4. Time-Release Phase

(i)
Token GenPK,t⟶Tokt: as the system runs at a uniform time and the time is counted by the number of time point here. When each time point t∈FT arrives, TA published a time token Tokt=H1tγ which can be received by each entity in the system.(ii)
TrapPK,Tokt⟶TDx′: when CSP receives a Tokt at releasing time point t published by CA, it finds all trapdoors related to time point t in all access policies of files stored in CSP. For each of these trapdoors TDx=Ax,Bx, the CSP computes the following equation:(12)TDx′=Bx−H2e^Tokt,Ax=sx2+H2eH1t,gγrt−H2e^H1tγ,grt=sx2.Then, the CSP replaces theseTDx with TDx′ for the ciphertexts of related files. Thus, if the above equation is correctly executed, the related trapdoor will be exposed to be TDx′=sx2.


### 6.5. Decryption Phase

The decryption phase involves the following algorithms:(i)
DecryptOUTPK,TPKu,CT⟶CT′: the algorithm is executed by CSP for outsourced decryption of CT. As to each node x∈T, we have the exposed trapdoor, i.e., TDx′=sx2, as follows:(13)sx2=TDx′,xis related to an exposed trapdoor,sx2=1,xis related to no trapdoor.The algorithm first runsTA to check if the key structure A in TPKu satisfies the policy tree T in CT. Then, the algorithm gets a label set Sx for each node x∈T when it recursively runs TxA. If A does not satisfy T, then the algorithm returns null; Otherwise, the algorithm chooses i from label set returned by TA and performs Decrypt NodeCT,TPKu,x,i as follows.For each leaf nodex∈T, if attx=atti,j∈Ai, where Ai∈A belongs to the attribute set A of DU and the trapdoor set upon the node has been correctly exposed, the CSP can execute Decrypt NodeCT,TKu,x,i as follows:(14)Px=Decrypt NodeCT,TPKu,x,i=e^Ki,j,Cxe^Ki,j′,Cx′sx2=e^g,gr△,isx0/z.For each nonleaf nodex∈T with label i, the algorithm directly executes Decrypt NodeCT,TKu,x,i as follows:(i)
Firstly, assumeLx be arbitrary thx-sized set of child nodes y of the node x, and we have y∈Lx only if i∈Sy or i′∈Syi′≠i and x is a translating node. If no such set exists, it returns null.(ii)
Moreover, for each nodey∈Lx, if i∈Sy, the algorithm executes Decrypt NodeCT,TKu,y,i and gets its output Py, and if i′∈Syi′≠i, the algorithm executes Decrypt NodeCT,TKu,y,i′ and gets Py′. Then, the algorithm translates Py′ to Py by computing the following:(15)Py=e^C¯y,E^iE^i′sy2⋅Py′=e^g,gsy0r△,i/z,i≠0,Py=e^C¯y,Ei′sy2Py′=e^g,gsy0r△/z,i=0.(iii)
Furthermore, the algorithm computesPx according to polynomial interpolation by Px=∏y∈LxPy△j,Lx′, where j=indexy and Lx′=indexy:y∈Lx. Thus, it gets the result as(16)Px=e^g,gsx0r△,i/z,i≠0,Px=e^g,gsx0r△,i/z,i=0.(iv)
In addition, the algorithm executesDecryptNodeCT,TKu,R,i on root node and gets PR in a bottom-up way. Then, it outputs the final result P as follows:(17)P=e^C¯R,EisR2PR=e^g,gsR0r△/z,i≠0,P=PR=e^g,gsR0r△/z,i=0.(v)
Later, the algorithm computes:(18)C′=∏k=1Ke^K1,C˜ke^K0,C˜k′1/ID−IDkP=e^g,gsR0α/z.Finally, the CSP sends partially decrypted ciphertextCT′=C′,CTs,VC,C0 to the DU.(i)
DecryptUPK,TSKu,CT′⟶M or null: after receiving the system public parameters PK, the secret transformation key TSKu, and the partially decrypted ciphertext CT′, the algorithm gets the random element R∗ by computing R∗=C0/C′TSKu. If the algorithm Dec Verify returns True, it computes ck∗=H2R∗ and recovers the plaintext M=DecCTs,ck∗. Otherwise, it outputs null.(ii)
Dec VerifyPK,R∗,VC,CTs⟶True/False: on inputting a recovered random element R∗, the DU computes R¯∗=H0R∗ and checks the following equations:(19)VC=?H3R¯∗CTs.If equation (19) holds, the algorithm outputs True. Otherwise, it outputs False.


## 6.1. Initialization Phase

(i)
Setupλ,d⟶PK,MSK0: on inputting the security parameter λ and the depth of the key structure d, the algorithm generates two multiplicative bilinear groups G0 and G1 of prime order p with a generator g of bilinear group G0 and a bilinear map e^:G0×G0⟶G1 and selects random numbers α,βi,γ∈Zp, where i∈d which is used to represent the depth of key structure. Here, we take d=2 as an example. The algorithm chooses a probabilistic symmetric encryption scheme Enc,Dec from a binary string to Zp∗ and selects collision-resistant hash functions H0:G1⟶0,1l1,H1:0,1⟶G0,H2:G1⟶Zp∗,andH3:0,1∗⟶0,1l2, where l1 and l2 are the output length of hash function H0 and H3, respectively. Then, the algorithm sets the time format FT. Next, it computes and outputs the system public key and master key as follows:(2)PK=G0,G1,e^,g,e^g,gα,h1=gβ1,h2=gβ2,η1=g1/β1,η2=g1/β2,δ=gγ,H0,H1,H2,H3,MSK0=gα,β1,β2,γ.Finally, TA publishesPK and stores MSK0 locally in secret.


## 6.2. Domain/User Enrollment Phase

In this phase, TA invokes the algorithmCreate Top DA to generate the master key for a new valid top domain authority DAi after receiving the request to take part in the system from DAi. Subsequently, DAi can manage the next-level domain authorities or users within its domain by calling the algorithm Create Entity. As to a cloud user, TA also takes charge of the generation of transformation keys for users after they get their secret attribute keys from their domain authority:(i)
Create Top DAPK,MSK0,A⟶MSKi: on receiving the request from a domain authority at top level DAi to take part in the system after being checked by TA, the algorithm generates master key for DAi by selecting a random number r△∈Zp. Then, it picks r△,i∈RZp according to Ai∈A, where Ai is each attribute set. Moreover, the algorithm picks r△,i,j∈RZp according to atti,j∈Ai, where atti,j is each attribute and 0≤i≤m and 1≤j≤ni. The algorithm computes the master key for DAi as follows:(3)MSKi=A,D0=gα+r△/β1,∀atti,j∈Ai:Di,j=gr△,i⋅H1atti,jr△,i,j,Di,j′=gr△,i,j∀Ai∈A:Ei=gr△+r△,i/β2.In the master key of a top-level domain authority,Ei is used to translate r△,i of Ai to r△ of A0 at the translating node. Meanwhile, Ei and Ei′ can translate r△,i′ to r△,i by computing Ei/Ei′.(ii)
Create EntityMSKi,ID,A¯⟶MSKi+1/SKu: the algorithm is used to generate master key for a new domain authority or the attribute secret key of a user. Given the master key MSKi=A,D0,Di,j,Di,j′,for0≤i≤m,1≤j≤n,Ei,for0≤i≤m of DAi, the algorithm picks r¯△∈RZp for the user or domain authority, r¯△,i∈RZp for each attribute set Ai∈A¯, and r¯△,i,j∈RZp for each attribute atti,j∈Ai. For different kinds of entity, the algorithm generates corresponding key for the entity.(1)
If the entity is a domain authority (i.e.,DAi+1), the algorithm generates the master key MSKi+1 for DAi+1 as follows:(4)MSKi+1=A¯,D¯0=D0⋅η1r△¯,∀atti,j∈Ai,D¯i,j=Di,j⋅gr△,i¯⋅H1atti,jr△,i,j¯,D¯i,j′=Di,j′⋅gr△,i,j¯,∀Ai∈A¯:E¯i=Ei⋅η2r¯△+r¯△,i.(2)
If the entity is a user with identityID, the algorithm generates the attribute secret key SKu for the user as follows:(iii)
TKey GenPK,SKu⟶TKu: TA selects z∈RZp∗ as the secret transformation key TSKu of the user and computes the public transform key TPKu=A,K0,K1,Ki,j,Ki,j′atti,j∈Ai,E^i′Ai∈A, where(6)K0=D01/z,K1=D11/z,∀atti,j∈Ai:Ki,j=Di,j1/z,Ki,j′=Di,j′1/z,∀Ai∈A:E^i=Ei1/z.Finally, the algorithm outputs the transformation key pairTKu=TPKu,TSKu for the cloud user who keeps the TSKu secret and publishes TPKu.


## 6.3. Encryption Phase

(1)
EncryptPK,M,T,RL⟶CT: on inputting PK, the data M to be encrypted, the designated access policy tree T, and the revocation list RL=ID1,…,IDK, the algorithm consists the following steps:(i)
The algorithm chooses a randomR∈GT and computes ck=H2R as the symmetric encryption key. Then, it encrypts the data M with ck to get CTs=EncM,ck, where Enc is the symmetric encryption algorithm of our scheme. Moreover, the algorithm computes the verification code VC=H3R′‖CTs for CTs, where R′=H0R.(ii)
With the designate access policy treeT whose root node is denoted by R, the algorithm chooses a random number sR0∈Zp as the base secret value of T and computes C0=R⋅e^g,gαsR0. Then, for each node x in T, the algorithm picks two random number sx1∈Zp and sx2∈Zp∗, which satisfy the following equation:(7)sx1⋅sx2=sx0,xis linked to a time trapdoor,sx1=sx0,sx2=1,otherwise.(iii)
Given the user revocation listRL=ID1,…,IDK, the algorithm selects a random δk for IDk∈RL, where ∑k=1Kδk=sR0. Then, the algorithm computes the corresponding ciphertext component C˜,C˜′, where(8)∀IDk∈RL:C˜k=h1δk,C˜k′=h1−IDk⋅δk.(iv)
Then, for a trapdoorTDx related to the time release t∈FT and a secret parameter sx2, DO picks a random number rt∈Zp and generates TDx of node x as follows:(9)TDx=Ax=grt,Bx=sx2+H2eH1t,frt.(v)
Next, the algorithm computes the ciphertext in a top-to-bottom way by executing the following steps:(1)
For each nonleaf nodex with sx1, the DO chooses a polynomial qx whose degree dx=thx−1 and qx0=sx1. For each of x’s child node y∈childx with a unique index indexy, DO sets sy0=qxindexy.(2)
For a leaf nodex with sx1 and related attribute attx, the algorithm generates corresponding ciphertext components CxandCx′ as follows:(10)∀x∈X:Cx=gsx1,Cx′=H1attxsx1,whereX is the leaf node set in T.(3)
For each translating nodex′ in T, the algorithm computes the corresponding ciphertext component C¯x′ as follows:(11)∀x′∈X¯:C¯x′=h2sx′1,whereX¯ is the translating node set in T.Finally, the DO outputs the ciphertextCT=T,RL,CTs,VC,C0,Cx,Cx′x∈X,TDxTDx∈T,C¯x′x′∈X¯,C˜k,C˜k′IDk∈RL and uploads it to CSP.


## 6.4. Time-Release Phase

(i)
Token GenPK,t⟶Tokt: as the system runs at a uniform time and the time is counted by the number of time point here. When each time point t∈FT arrives, TA published a time token Tokt=H1tγ which can be received by each entity in the system.(ii)
TrapPK,Tokt⟶TDx′: when CSP receives a Tokt at releasing time point t published by CA, it finds all trapdoors related to time point t in all access policies of files stored in CSP. For each of these trapdoors TDx=Ax,Bx, the CSP computes the following equation:(12)TDx′=Bx−H2e^Tokt,Ax=sx2+H2eH1t,gγrt−H2e^H1tγ,grt=sx2.Then, the CSP replaces theseTDx with TDx′ for the ciphertexts of related files. Thus, if the above equation is correctly executed, the related trapdoor will be exposed to be TDx′=sx2.


## 6.5. Decryption Phase

The decryption phase involves the following algorithms:(i)
DecryptOUTPK,TPKu,CT⟶CT′: the algorithm is executed by CSP for outsourced decryption of CT. As to each node x∈T, we have the exposed trapdoor, i.e., TDx′=sx2, as follows:(13)sx2=TDx′,xis related to an exposed trapdoor,sx2=1,xis related to no trapdoor.The algorithm first runsTA to check if the key structure A in TPKu satisfies the policy tree T in CT. Then, the algorithm gets a label set Sx for each node x∈T when it recursively runs TxA. If A does not satisfy T, then the algorithm returns null; Otherwise, the algorithm chooses i from label set returned by TA and performs Decrypt NodeCT,TPKu,x,i as follows.For each leaf nodex∈T, if attx=atti,j∈Ai, where Ai∈A belongs to the attribute set A of DU and the trapdoor set upon the node has been correctly exposed, the CSP can execute Decrypt NodeCT,TKu,x,i as follows:(14)Px=Decrypt NodeCT,TPKu,x,i=e^Ki,j,Cxe^Ki,j′,Cx′sx2=e^g,gr△,isx0/z.For each nonleaf nodex∈T with label i, the algorithm directly executes Decrypt NodeCT,TKu,x,i as follows:(i)
Firstly, assumeLx be arbitrary thx-sized set of child nodes y of the node x, and we have y∈Lx only if i∈Sy or i′∈Syi′≠i and x is a translating node. If no such set exists, it returns null.(ii)
Moreover, for each nodey∈Lx, if i∈Sy, the algorithm executes Decrypt NodeCT,TKu,y,i and gets its output Py, and if i′∈Syi′≠i, the algorithm executes Decrypt NodeCT,TKu,y,i′ and gets Py′. Then, the algorithm translates Py′ to Py by computing the following:(15)Py=e^C¯y,E^iE^i′sy2⋅Py′=e^g,gsy0r△,i/z,i≠0,Py=e^C¯y,Ei′sy2Py′=e^g,gsy0r△/z,i=0.(iii)
Furthermore, the algorithm computesPx according to polynomial interpolation by Px=∏y∈LxPy△j,Lx′, where j=indexy and Lx′=indexy:y∈Lx. Thus, it gets the result as(16)Px=e^g,gsx0r△,i/z,i≠0,Px=e^g,gsx0r△,i/z,i=0.(iv)
In addition, the algorithm executesDecryptNodeCT,TKu,R,i on root node and gets PR in a bottom-up way. Then, it outputs the final result P as follows:(17)P=e^C¯R,EisR2PR=e^g,gsR0r△/z,i≠0,P=PR=e^g,gsR0r△/z,i=0.(v)
Later, the algorithm computes:(18)C′=∏k=1Ke^K1,C˜ke^K0,C˜k′1/ID−IDkP=e^g,gsR0α/z.Finally, the CSP sends partially decrypted ciphertextCT′=C′,CTs,VC,C0 to the DU.(i)
DecryptUPK,TSKu,CT′⟶M or null: after receiving the system public parameters PK, the secret transformation key TSKu, and the partially decrypted ciphertext CT′, the algorithm gets the random element R∗ by computing R∗=C0/C′TSKu. If the algorithm Dec Verify returns True, it computes ck∗=H2R∗ and recovers the plaintext M=DecCTs,ck∗. Otherwise, it outputs null.(ii)
Dec VerifyPK,R∗,VC,CTs⟶True/False: on inputting a recovered random element R∗, the DU computes R¯∗=H0R∗ and checks the following equations:(19)VC=?H3R¯∗CTs.If equation (19) holds, the algorithm outputs True. Otherwise, it outputs False.


## 7. Security Analysis

This section presents the formal security analysis for HTR-DAC.Theorem 1.
Our scheme achieves soundness if and only if the data user has enough rights and correct exposed trapdoors.Proof.
If and only if the data user has enough rights and correct exposed trapdoors, we have the following equations.
For each nodex∈T, suppose Y¯=e^g,g, and we have(20)Px=Decrypt NodeCT,TKu,x,i=e^Ki,j,Cxe^Ki,j′,Cx′sx2=e^gr△,i⋅H1atti,jr△,i,j1/z,gsx1e^gr△,i,j1/z,H1attxsx1sx2=Y¯r△,isx1sx2/z&=Y¯r△,isx0/z.
Then, for eachy∈Lx, if i′≠i, the translating procedure is performed as follows:(i)
Ifi≠0,(21)Py=e^C¯y,E^i/E⌢i′sy2⋅Py′=e^h2sy1,gr△+r△,i/β2zgr△+r△,i′/β2zsy2⋅e^g,gr△,i′sy0/z=e^g,gsy1sy2r△,i−r△,i′/z⋅e^g,gr△,i′sy0/z=e^g,gsy0r△,i/z,P=e^C¯R,EisR2PR=e^h2sR1,gr△+r△,i/β2zsR2Y¯sR0r△,i/z=Y¯r△+r△,isR1sR2/zY¯sR0r△,i/z=Y¯r△sR0/z.(ii)
Ifi=0,(22)Py=e^C¯y,E^i′sy2Py′=e^h2sy1,gr△+r△,i′/β2zsy2Y¯r△,i′sy0/z=Y¯sy1sy2r△+r△,i′/zY¯r△,i′sy0/z=Y¯sy0r△/z.
Finally, we have(23)Q=∏k=1Ke^K1,C˜ke^K0,C˜k′1/ID−IDk=∏k=1Ke^gα+r△ID/β1z,h1δk⋅e^gα+r△/β1z,h1−IDk⋅δk1/ID−IDk=∏k=1KY¯α+r△ID−IDkδk/z1/ID−IDk=∏k=1KY¯α+r△δk/z=e^g,gα+r△/z∑k=1kδk=Y¯α+r△sR0/zC′=∑k=1Ke^K1,C˜ke^K0,C˜k′1/ID−IDkP=QP=Y¯α+r△sR0/zY¯sR0r△/z=Y¯sR0α/z.
Therefore, the proposed HTR-DAC is sound if and only if the data user has enough rights and correct exposed trapdoors.Theorem 2.
No PPT adversaries can selectively win the security game of our scheme with an advantage that is nonnegligible on condition the DBDH assumption holds.Proof.
When the advantageς of adversary A is nonnegligible when he selectively breaks the security game against our scheme, we can create a simulator ℬ who is able to distinguish a DBDH parameter from a random parameter with an identical advantage to that of A.Init: the simulatorℬ of DBDH game creates the bilinear group G0,G1,e^,p,g, where e^:G0×G0⟶G1 and g∈G0. It then selects randoms c,d,m,ν∈Zp and ε∈0,1. If ε=0, the challenger ℬ generates a tuple C,D,M,V=gc,gd,gm,e^g,gcdm; otherwise, it generates gc,gd,gm,e^g,gν. ℬ then sends the tuple to C. In the meantime, the adversary A submits a selected challenging access policy tree T, a revocation list RL=ID1,…,IDn, and a time point t1∈FT to challenger C of our scheme.Setup 2: after the challengerC gets the DBDH tuple C,D,M,V and bilinear group from ℬ, it randomly chooses α,β1,β2,γ∈Zp and hash functions H0,H1,H2,andH3. Then, for Type-A attack, C computes δ=gγ, and for Type-B attack, it simulates δ=D. C also simulates H1x=gqx, where qx∈Zp. Finally, C generates system public parameters PK=G0,G1,p,g,e^,e^g,gα,h1=gβ1,h2=gβ2,η1=g1/β1,η2=g1/β2,δ, and the master key MSK=gα,β1,β2,γ,H1. It keeps the MSK privately and sends the PK to the adversary A.Phase 3: the adversaryA submits a series of queries qi for secret key and transformation key as follows:(i)
SK query:A requests for secret key with his identity ID that ID∉RL and a recursive attribute set A that is unsatisfactory to T at time t1. Then, C computes D0=gα+m/β1=M⋅gα1/β1andD1=D0ID. For all atti,j∈A, it generates Di,j=gr△,i⋅H1atti,jr△,i,j,Di,j′=gr△,i,j, and for all Ai∈A, it computes Ei=gm+r△,i/β2, where r△,i and r△,i,j are randomly picked. For Type-B attack, C designate a time point t1′>t1 at which the recursive attribute set A satisfies T and computes H1t=gqtandTokt=Bqt, where t<t1andqt∈RZp. Finally, C returns SKu to A and publishes Toktt<t1.(ii)
TK query: similar to the SK query, the challengerC runs TKeyGen algorithm to generate transformation key pair and sends them to A.Challenge: the adversaryA finishes the Phase 1 and submits two data M0 and M1 with equal length to C. First, C picks ϵ∈R0,1 and computes C0=Mϵ⋅e^M⋅gα,C/V. For each IDk in the submitted user revocation list RL, C chooses a random number δk∈Zp so that ∑k=1Kδk=c and computes C˜k=h1δkandC˜k′=h1−IDk⋅δk. Then, according to the challenging access policy tree T, ∀x∈T, if it is related to a trapdoor, C chooses a random sx2∈Zp; otherwise, it sets sx2=1. Next, C computes Cx=Dqx0,Cx′=H1attxqx0,andTDx=sx2, where qx0=sx/sx2 and qx is a thx-sized polynomial. It also designates the translating node set X¯ in T and computes C¯x′=h2sx′1 for each node x′∈X¯. Finally, the challenger C returns the ciphertext CT∗=T,RL,C0,Cx,Cx′,TDx,C¯x′,C˜k,C˜k′ to C. For Type-B attack, C acts as [12].With respect to the adversaryA, when ε=0, V=e^g,gcdm, and according to the decryption procedure, the adversary can get Mϵ from CT. Nevertheless, when ε=1, V∈G1 is a random element. Thus, A cannot get any information about Mϵ from CT.Phase 4: the adversaryA repeats the procedures in Phase 1 with the same restriction that the ID∉RL and the attribute set S in queries do not satisfy T.Guess: the adversaryA outputs the guess of bit ϵ′. If ϵ=ϵ′, the challenger C guesses Z=e^g,gcdm with his output 0; otherwise, it guesses Z as a random element. If the adversary A has the advantage of ς, then the challenger C can break the DBDH game with advantage ς/2 given that the variables ϵ and ε are independent. The computation of the advantage for C is the same as in [12].In conclusion, if an adversaryA can win the security game of our scheme with a nonnegligible advantage ς, then the challenger C can break the DBDH game with identical advantage. Therefore, our scheme is IND-CPA secure in our security model.


## 8. Performance Evaluation

Here, we analyze the performance for our scheme in functional, theoretical, and experimental respects.First of all, we present the function comparison between our scheme and some existing related CP-ABE schemes, i.e., [8, 12, 37, 41–43], as shown in Table 2. We observe that our HTR-DAC scheme supports hierarchical authorities and users, time-sensitive data sharing, large universe, direct revocability, efficient decryption, and verifiability, simultaneously, which are more flexible and scalable than others. Then, to demonstrate the theoretical performance evaluation, we compare the computation complexity and storage complexity of our scheme with that of the state-of-the-art scheme in [12]. The comparison results are shown in Table 3, which summarizes the complexity of Encrypt, Decrypt, KeyGen, PPSize, and UKeySize denoting the computation complexity of encryption, decryption, and key generation algorithms, as well as the storage complexity of the public parameter size and user key size, respectively.Table 2
Function comparison.
SchemeHierarchical authorityTime-based controlLarge universeRevocabilityHigh efficiencyVerifiabilityScheme [41]××✓✓××Scheme [12]×✓✓×××Scheme [42]××✓✓××Scheme [37]××××✓✓Scheme [43]✓××✓××Scheme [8]✓×××✓×Our scheme✓✓✓✓✓✓Table 3
Storage complexity comparison.
SchemesEncryptDecryptKeyGenPP SizeUKey SizeScheme [12]2X+TD+1EG0+TD+1EG1+MulG1+TDP+X+2TDH3S+kEG1+2S+2MulG1+2S+1P3S+1EG0+SMulG0+SH3G0+G12S+1G0Our scheme2X+TD+X¯+2RLEG0+TD+1EG1+MulG1+TDP+2TD+XHEG1+MulG1+3H3S+AS+1EG0+3S+AS+1MulG0+SH6G0+G1ZpTo obtain precise evaluation of the performance, we implement our scheme and the scheme [12] using Java Programming Language and Java Pairing-Based Cryptography library (JPBC) [44] which supports operations of pairing, exponential, addition, multiplication, and inversion in finite field and groups. In our development, we adopt the Type A curve with prime order. It is defined over a 160 bit elliptic curve group and a 512 bit finite field. Moreover, our experimental simulations are conducted on Windows system equipped with CPU of Intel Core i5 CPU 2.13 GHz and RAM of 8.00 GB.Before our analysis, we letX,k,X¯,TD,andRL denote the size of leaf node set, nonleaf node set, translating node set, trapdoor set in access policy tree T, and the size of revocation list. EG0,MulG0,EG0,MulG1,P,andH denote the exponential operation and the multiplication operation in G0andG1 as well as the pairing and hash function operations. G0,G1,andZp denote the length of elements in G0,G1,andZp, respectively. The symbols ASandS denote the number of sets and attributes in an recursive attribute set.Figure4 shows the actual performance of Encrypt in both schemes. We notice that the computational cost of encryption in the other scheme is affected by the factors of the number of leaf nodes and the number of trapdoors in access policy tree T, while our scheme is affected by the size of translating node set and revocation list in addition. These two additional factors are brought about by the features of user key structure and direct revocation in our scheme and incur extracomputation in encryption. In our experiments, we set RL=5 and adjust the value of X¯. Figure 4 shows the actual time cost in different numbers of translating nodes. With the same access policy and fixed size of revocation list, the time cost in our scheme is more, and as the number of translating nodes grows, the gap becomes larger. However, we notice that the difference between two schemes is tiny on the whole.Figure 4
Encryption cost comparison for different numbers of translating nodes. (a)X¯=0. (b) X¯=2. (c) X¯=4. (d) X¯=6.
(a)(b)(c)(d)In Figure5, we describe the comparison of time cost in Decrypt algorithm for the two schemes. We notice that, within the same size of user attribute set, the decryption time cost in our scheme is smaller and nearly constant as the number of ciphertexts grows, while in scheme [12], it is far more and linear with the growth of the number of ciphertexts. In theory, the computation complexity in our scheme and the other are EG1+MulG1+3H and 3S+kEG1+2S+2MulG1+2S+1P, respectively. In our experiments, we set k=2. It is obvious from the figure that the computation complexity in our scheme is constant and far smaller while that of the other scheme is affected by the size of the user attribute set. Moreover, within the same size of the user attribute set, the time cost of decryption for one data file is far more than that of our scheme, and as the number of ciphertexts grows, the gap becomes larger.Figure 5
Decryption cost comparison for different sizes of user attribute set. (a)S=5. (b) S=10. (c) S=15. (d) S=20.
(a)(b)(c)(d)Figure6 shows the actual performance of key generation procedure in the two schemes. From the theoretical analysis, the computation complexity of our scheme and the other are 3S+AS+1EG0+3S+AS+1MulG0+SH and 3S+1EG0+SMulG0+SH, respectively, which means the time cost in key generation in our scheme is affected by not only the number of attributes of a user but also the attribute sets of a user in his key structure A, which will incur extra time cost. Moreover, as the figure shows, the time cost in our scheme for key generation in the same number of user attributes is nearly the same as that of the scheme [12]. As the number of attribute set in key structure grows, the gap is still very small. We can infer that the difference in time cost for key generation between the two schemes is tiny.Figure 6
Key generation cost comparison for different numbers of attribute set. (a)AS=1. (b) AS=2. (c) AS=3. (d) AS=4.
(a)(b)(c)(d)Figure7 depicts the storage overhead for our scheme and the scheme [12]. We notice that the actual storage overhead in system public parameters, as Figure 7(a) shows, is larger in our scheme as we takes the storage complexity of 6G0+G1 in our scheme which is more than 3G0+G1 of the other scheme. This is because, in our scheme, to adapt to hierarchical users, we need more parameters for each level of user hierarchy. Moreover, in Figure 7(b), the storage overhead of user key size in our scheme is both smaller and constant while that of the other scheme is far more and proportional to the size of user attribute set. As we introduce outsourced decryption, the user key size just costs Zp in storage while that of the other scheme costs 2S+1G0. Thus, we greatly lower the storage cost for key size.Figure 7
Comparison of the storage cost. (a) Public parameter size. (b) User key size.
(a)(b)In conclusion, our scheme outperforms existing related schemes no matter from the respects of efficiency or storage overhead. Thus, it is more suitable for the environment of mobile crowdsensing.


## 9. Conclusion

Ensuring fine granularity for time-sensitive data-sharing service in MCS across hierarchical users with recursive attribute sets and revocability is a big challenge. In our work, we propose a hierarchical and time-sensitive data access control scheme with revocability in cloud-based mobile crowdsensing. Our proposal realizes the properties of fine-grained access control, large attribute universe, hierarchical user, and revocability, which suits for data-sharing applications in MCS. Besides, we discuss the security and display the precise performance evaluation by implementing our scheme and conducting extensive experimental simulations which demonstrates the efficiency and practicality.



---

*Source: 6646445-2021-02-27.xml*