# Cross-Department Secures Data Sharing in Food Industry via Blockchain-Cloud Fusion Scheme

Authors: Q. Tao; Q. Chen; H. Ding; I. Adnan; X. Huang; X. Cui
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The barriers of food enterprises and departments caused information asymmetry, which is the root cause of food safety incidents. Simultaneously, it is challenging to solve the information asymmetry by the existing cloud-based food supply-chain regulation system. Establishing a secure and reliable data sharing environment is an effective solution to the information island. Blockchain can construct a security network based on mathematical algorithms, eliminating the third party’s potential security risk, and realize transparently share data. In this paper, on the principle of metadata remaining in the food enterprises, we propose a blockchain-cloud fusion scheme based on Decentralized Attribute-Based Signature (DABS) to realize secure data sharing between departments. It constructs a decentralized and trusting environment for data owners to share data and achieves social co-governance of food safety based on the smart contract. It can also preserve the existing system architecture and complement the performance disadvantage of blockchain and cloud storage. The result achieved from security analysis shows that our scheme supports unconditional full anonymity and can resist collusion attacks of N-1 out of N corrupted attribute authorities.


---

## Body

## 1. Introduction

In the age of big data, the data has a tremendous potential value, and different enterprises and regulators have collected data, such as farmers can only collect the data of crop growth (seeds, fertilizers, pesticides, environment, etc.). Food producers can get the processing data (product formulation, machine, process parameters, inputs, etc.), sellers collect sales data (location, price, customer, etc.), and regulators store the sampling inspection reports and monitoring data. The data owners would not share the data with the disclosure risk of user privacy and commercial secret. It is the primary cause of information asymmetry that has led to some negative market phenomena, like “good money after bad,” “2013 horse meat scandal in the Europe,” and “2017 multistate Salmonella outbreak in the US” [1]. More than 600 million people worldwide fall ill after consuming unsafe food each year [2]. Cross-departmental data sharing in the food industry is a promising solution to food safety incidents and promotes industry development [3]. The traditional cloud-based regulatory system (as Figure 1 shown) provides a solution to share the food data and protect the food quality [4]. According to the Cisco white paper, most companies in the food supply-chain deployed the regulatory system in cloud [5]. Cloud features of pay-on-demand and elastic extension can decrease the cost [6–8]. However, the customers and data in the cloud are not in the same trusted domain, resulting in a lack of trust between customers. Cloud security incidents are frequent. More than 10000 security incidents happened in Malaysia in 2013. According to the 2013 Norton report, the total cost of cybercrime in Australia amounts to AU$1.06 billion [9]. The privacy of 368000 students in Florida Virtual School was leaked in 2018. So, some common defects in the traditional regulatory system need to be addressed: (1) the tampering and hiding of wrong information in the centralization system. (2) the risk of privacy leakage and data loss if the servers are compromised or privileged users’ rights are not adequately monitored. (3) It is difficult to verify the user’s identity, which is hard to guarantee the authenticity of shared data and track down the person responsible for the product accident. (4) The data owners are reluctant to share data due to the lack of trust between the system and food enterprises, and the enterprises would not invest heavily to rebuild their system. More than 40% viewed that food fraud is difficult to monitor by the traditional methods [2].Figure 1
Traditional food supply-chain regulation system (the barriers among enterprises and departments block information sharing in the food supply chain).With the characteristics of tamper-proofing, decentralization, and co-governance, blockchain happens to address the above issues by constructing a trusted network based on a mathematical algorithm. The data are shared transparently by enterprises and regulators. It is immutably for the data in block chain [10]. Smart contract is an intelligent and self-executing logic code without an intermediary, reducing transaction costs and transaction time [11]. Walmart has developed a blockchain-based system to monitor the product quality by sharing information in pork and mangos industries [12]. It helps to effectively track the pork products during serval minutes compared to serval days taken in the past. There are several challenges: (1) the blockchain has the characteristic of pseudoanonymity that cannot protect the privacy information in the signature. The adversary can get the privacy information by analyzing the expenditure information of user account [13]. (2) Performance, cost, and security are the primary bottlenecks for implementing blockchain technology in the food industry.To address the issues, we propose a blockchain-cloud fusion scheme to protect the security of shared data. The enterprises can preserve the existing system architecture and transparently share data in a trusted network without third parties. It adopts the characteristics of low cost, scalability, and high-performance in cloud computing technology to make up for blockchain's performance and cost bottleneck. The metadata remains in the existing enterprise system, and the data’s signature is shared with the blockchain network. It can reduce the storage and performance load of the blockchain network. Besides, the analysis of the signature algorithm in Table1 shows that the Attribute-Based Signature (ABS) is an effective solution to share data with fine-grained control and protect the data owner’s privacy. To address the information leakage risk and adapt to the decentralization feature of our scheme, we propose a Decentralized Attribute-Based Signature (DABS). The enterprises and regulators have equal rights to verify employees in their respective departments. The signature of shared data is entirely secure, which encourages users to monitor food quality actively. Simultaneously, it provides a solution for regulators to track down the person responsible for public safety incidents and rumors. It is meant to promote social co-governance in the food industry.Table 1
Signature algorithm analysis.
AlgorithmFeaturesMain applicationRSA signatureAlgorithm security is based on large prime decomposition.Short message signatureThe private key space is large, the encryption effect is good, but the encryption speed is slow, and it is very complex to the management of the public key authentication and certificate.1 : 1 communication mode.Blind signatureThe message is blind to the signer. Even the signature is leaked by the recipient; it cannot be tracked by the signer; 1 : 1 communication mode.Electronic cash; electronic electionBroadcast signatureTransmit the signed messages to a group of users with an insecure channel;.Pay-tvBut, it is difficult to obtain the size and membership of the receiving group in time under the open mode; enumerate user identities in distributed applications can compromise user privacy.Video conferenceGroup signatureThe anonymous signature is used for group sharing, and the receiver can verify the signature but cannot get the signer’s information.Electronic biddingThe group administrator creates the group with key distribution, which has the risk of identity escrow leakage and signature forging.Digital copyright protectionAttribute-based signature (ABS)Signature and user private key associated with attributes.Fine-grained access control; group key managementFine-grained noninteractive access control and 1 :n communication mode; it reduces the network bandwidth for shared data and the processing overhead for nodes.Privacy protectionResist to collusive attacks, anonymous.


### 1.1. Related Work

#### 1.1.1. ABS

ABS originated from fuzzy identifies encryption that was firstly proposed bySahai and Waters [14]. It could hide user identity information and provide a solution for data owners to share with fine-grained access control. In the ABS, the users received a private key from the Attribute Authority (AA) based on their attributes and defined a shared community for sharing data with a signing predicate. Only if the users’ attributes satisfy with the signing predicate, they could get the share data, such as farmers share a file with an access control strategy of signing predicate ((manager with Level 7 in Food Processing FP1) or regulator), which means that only the manager with Level 7 in Food Processing FP1 and regulators can access the shared file. ABS scheme has a bright application prospect, such as directional broadcast and cloud storage. It has attracted many scholars and presented a lot of research results [15]. Li et al. proposed an Attribute-Based Encryption (ABE) system based on a ring signature scheme [16]. Anyone can select a set of public keys of random signers to hide its public key [17]. However, the above schemes manage the entire system attribute set by a single AA. It quickly causes performance bottlenecks and cannot satisfy the actual needs of multiple departments’ cooperation [18]. So, Chase et al. let numerous authorities manage the attribute set, but the scheme has disclosure risk of Centralized Attribute Authority (CA) because the CA could calculate any user’s private key [19]. Yang et al. proposed an efficient multiauthority CP-ABE scheme based on LSSS access structure without global authority and security under the random oracle model [20]. Liu et al. proposed a security scheme only if the number of colluding users is less than (m+1) [21].


#### 1.1.2. Blockchain

Nakamoto firstly proposed the blockchain architecture [10]. It provided a solution to a trust and equality among different participators by a mathematical algorithm. In addition, it is an effective way to solve the single point validation based on decentralization [22]. Macrinici et al. [11] designed the smart contract to protect users’ privacy and automatic information processing. Blockchain technology has achieved great success in the financial industry [23], like Bitcoin and Ethereum. It demonstrated the application feasibility of blockchain technology. Some promising blockchain applications are being developed to address industry concerns such as medical, agriculture, energy, and food safety. In [24–28], a security data management scheme was proposed with privacy-preserving to share the medical data by encapsulating EHRs based on attribute-based encryption into the blockchain; there is no detailed application. Even in [28], it cannot resist the collusion attack between uses. In [29], it is proposed that blockchain is a solution to optimize the energy industry structure and facilitate sustainable development. Walmart developed a blockchain-based system to monitor pork and mangos from South America to the US [1], where the managers could trace down the product during several minutes compared to several days taken in the past.


#### 1.1.3. Supply Chain and Blockchain

Data-shared barriers among the food enterprises caused information delay and asymmetry, which affected the quality of shared information [30]. Supply chain management is an important application for blockchain technology [31]. Blockchain could record entire life cycle of each product with immutable and shared information between consumers and producers. The ICT electronic agriculture system via blockchain infrastructure guaranteed the integrity of agricultural environment data, conducive to improving sustainable agrarian development [32]. In [33], it is proposed that blockchain applied in the food supply-chain not only could reduce food losses by optimizing product logistics, but it also benefits to improve regulatory efficiency. Saberi et al. explored how blockchain could help supply-chain sustainability and guide industry transformation. Clauson and Breeden discussed the supply-chain management in healthcare, and most blockchain schemes are still in the proof-of-concept or pilot stag [34]. Security and privacy are barriers to the integration of IoT and blockchain. Jangirala et al. proposed a LBRAPS protocol in mobile edge computing to protect the transmit data security [35]. In [36, 37], a AgriBlockIoT system is proposed for food supply-chain management. But, it lacks an effective solution to protect the data security.


### 1.2. Our Contributions

In summary, main contributions of this work are as follows:(1)
This work proposes a food supply-chain regulation system based on a blockchain-cloud fusion scheme. It supports secure data sharing across departments, intelligent regulation, and social co-governance with a smart contract.(2)
This work proposes a DABS scheme by combining the characteristics of ABS and ring signature. It helps to improve the safety of the food supply-chain regulation system. Besides, it provides a solution for regulators to trace down the illegal users, which is useful to prevent the spread of rumors and establish a harmonious network environment.(3)
This work performs a comprehensive security analysis shows that our scheme supports unconditional full anonymity and noncollusion with strong (N-1) (resist collusion attacks of N-1 out of N corrupted Attribute Authorities). The performance evaluation shows our scheme’s performance advantage. Compared with time complexity nO⋅ in traditional schemes, it supports batch-verification with O⋅+n.


### 1.3. Organization

The remainder of this work is as follows: Section2 introduces the definitions of the bilinear map, computational assumption, access structure and LSSS, syntax, and security model of DABS. Section 3 details the blockchain-cloud fusion scheme. Section 4 describes security analysis, and Section 5 presents the performance analysis, while the conclusion is presented in Section 6.


## 1.1. Related Work

### 1.1.1. ABS

ABS originated from fuzzy identifies encryption that was firstly proposed bySahai and Waters [14]. It could hide user identity information and provide a solution for data owners to share with fine-grained access control. In the ABS, the users received a private key from the Attribute Authority (AA) based on their attributes and defined a shared community for sharing data with a signing predicate. Only if the users’ attributes satisfy with the signing predicate, they could get the share data, such as farmers share a file with an access control strategy of signing predicate ((manager with Level 7 in Food Processing FP1) or regulator), which means that only the manager with Level 7 in Food Processing FP1 and regulators can access the shared file. ABS scheme has a bright application prospect, such as directional broadcast and cloud storage. It has attracted many scholars and presented a lot of research results [15]. Li et al. proposed an Attribute-Based Encryption (ABE) system based on a ring signature scheme [16]. Anyone can select a set of public keys of random signers to hide its public key [17]. However, the above schemes manage the entire system attribute set by a single AA. It quickly causes performance bottlenecks and cannot satisfy the actual needs of multiple departments’ cooperation [18]. So, Chase et al. let numerous authorities manage the attribute set, but the scheme has disclosure risk of Centralized Attribute Authority (CA) because the CA could calculate any user’s private key [19]. Yang et al. proposed an efficient multiauthority CP-ABE scheme based on LSSS access structure without global authority and security under the random oracle model [20]. Liu et al. proposed a security scheme only if the number of colluding users is less than (m+1) [21].


### 1.1.2. Blockchain

Nakamoto firstly proposed the blockchain architecture [10]. It provided a solution to a trust and equality among different participators by a mathematical algorithm. In addition, it is an effective way to solve the single point validation based on decentralization [22]. Macrinici et al. [11] designed the smart contract to protect users’ privacy and automatic information processing. Blockchain technology has achieved great success in the financial industry [23], like Bitcoin and Ethereum. It demonstrated the application feasibility of blockchain technology. Some promising blockchain applications are being developed to address industry concerns such as medical, agriculture, energy, and food safety. In [24–28], a security data management scheme was proposed with privacy-preserving to share the medical data by encapsulating EHRs based on attribute-based encryption into the blockchain; there is no detailed application. Even in [28], it cannot resist the collusion attack between uses. In [29], it is proposed that blockchain is a solution to optimize the energy industry structure and facilitate sustainable development. Walmart developed a blockchain-based system to monitor pork and mangos from South America to the US [1], where the managers could trace down the product during several minutes compared to several days taken in the past.


### 1.1.3. Supply Chain and Blockchain

Data-shared barriers among the food enterprises caused information delay and asymmetry, which affected the quality of shared information [30]. Supply chain management is an important application for blockchain technology [31]. Blockchain could record entire life cycle of each product with immutable and shared information between consumers and producers. The ICT electronic agriculture system via blockchain infrastructure guaranteed the integrity of agricultural environment data, conducive to improving sustainable agrarian development [32]. In [33], it is proposed that blockchain applied in the food supply-chain not only could reduce food losses by optimizing product logistics, but it also benefits to improve regulatory efficiency. Saberi et al. explored how blockchain could help supply-chain sustainability and guide industry transformation. Clauson and Breeden discussed the supply-chain management in healthcare, and most blockchain schemes are still in the proof-of-concept or pilot stag [34]. Security and privacy are barriers to the integration of IoT and blockchain. Jangirala et al. proposed a LBRAPS protocol in mobile edge computing to protect the transmit data security [35]. In [36, 37], a AgriBlockIoT system is proposed for food supply-chain management. But, it lacks an effective solution to protect the data security.


## 1.1.1. ABS

ABS originated from fuzzy identifies encryption that was firstly proposed bySahai and Waters [14]. It could hide user identity information and provide a solution for data owners to share with fine-grained access control. In the ABS, the users received a private key from the Attribute Authority (AA) based on their attributes and defined a shared community for sharing data with a signing predicate. Only if the users’ attributes satisfy with the signing predicate, they could get the share data, such as farmers share a file with an access control strategy of signing predicate ((manager with Level 7 in Food Processing FP1) or regulator), which means that only the manager with Level 7 in Food Processing FP1 and regulators can access the shared file. ABS scheme has a bright application prospect, such as directional broadcast and cloud storage. It has attracted many scholars and presented a lot of research results [15]. Li et al. proposed an Attribute-Based Encryption (ABE) system based on a ring signature scheme [16]. Anyone can select a set of public keys of random signers to hide its public key [17]. However, the above schemes manage the entire system attribute set by a single AA. It quickly causes performance bottlenecks and cannot satisfy the actual needs of multiple departments’ cooperation [18]. So, Chase et al. let numerous authorities manage the attribute set, but the scheme has disclosure risk of Centralized Attribute Authority (CA) because the CA could calculate any user’s private key [19]. Yang et al. proposed an efficient multiauthority CP-ABE scheme based on LSSS access structure without global authority and security under the random oracle model [20]. Liu et al. proposed a security scheme only if the number of colluding users is less than (m+1) [21].


## 1.1.2. Blockchain

Nakamoto firstly proposed the blockchain architecture [10]. It provided a solution to a trust and equality among different participators by a mathematical algorithm. In addition, it is an effective way to solve the single point validation based on decentralization [22]. Macrinici et al. [11] designed the smart contract to protect users’ privacy and automatic information processing. Blockchain technology has achieved great success in the financial industry [23], like Bitcoin and Ethereum. It demonstrated the application feasibility of blockchain technology. Some promising blockchain applications are being developed to address industry concerns such as medical, agriculture, energy, and food safety. In [24–28], a security data management scheme was proposed with privacy-preserving to share the medical data by encapsulating EHRs based on attribute-based encryption into the blockchain; there is no detailed application. Even in [28], it cannot resist the collusion attack between uses. In [29], it is proposed that blockchain is a solution to optimize the energy industry structure and facilitate sustainable development. Walmart developed a blockchain-based system to monitor pork and mangos from South America to the US [1], where the managers could trace down the product during several minutes compared to several days taken in the past.


## 1.1.3. Supply Chain and Blockchain

Data-shared barriers among the food enterprises caused information delay and asymmetry, which affected the quality of shared information [30]. Supply chain management is an important application for blockchain technology [31]. Blockchain could record entire life cycle of each product with immutable and shared information between consumers and producers. The ICT electronic agriculture system via blockchain infrastructure guaranteed the integrity of agricultural environment data, conducive to improving sustainable agrarian development [32]. In [33], it is proposed that blockchain applied in the food supply-chain not only could reduce food losses by optimizing product logistics, but it also benefits to improve regulatory efficiency. Saberi et al. explored how blockchain could help supply-chain sustainability and guide industry transformation. Clauson and Breeden discussed the supply-chain management in healthcare, and most blockchain schemes are still in the proof-of-concept or pilot stag [34]. Security and privacy are barriers to the integration of IoT and blockchain. Jangirala et al. proposed a LBRAPS protocol in mobile edge computing to protect the transmit data security [35]. In [36, 37], a AgriBlockIoT system is proposed for food supply-chain management. But, it lacks an effective solution to protect the data security.


## 1.2. Our Contributions

In summary, main contributions of this work are as follows:(1)
This work proposes a food supply-chain regulation system based on a blockchain-cloud fusion scheme. It supports secure data sharing across departments, intelligent regulation, and social co-governance with a smart contract.(2)
This work proposes a DABS scheme by combining the characteristics of ABS and ring signature. It helps to improve the safety of the food supply-chain regulation system. Besides, it provides a solution for regulators to trace down the illegal users, which is useful to prevent the spread of rumors and establish a harmonious network environment.(3)
This work performs a comprehensive security analysis shows that our scheme supports unconditional full anonymity and noncollusion with strong (N-1) (resist collusion attacks of N-1 out of N corrupted Attribute Authorities). The performance evaluation shows our scheme’s performance advantage. Compared with time complexity nO⋅ in traditional schemes, it supports batch-verification with O⋅+n.


## 1.3. Organization

The remainder of this work is as follows: Section2 introduces the definitions of the bilinear map, computational assumption, access structure and LSSS, syntax, and security model of DABS. Section 3 details the blockchain-cloud fusion scheme. Section 4 describes security analysis, and Section 5 presents the performance analysis, while the conclusion is presented in Section 6.


## 2. Preliminaries

This section introduces the definitions of bilinear map, computational assumption and linear secret-sharing schemes. Then, we describe the framework definition of the DABS scheme and security definitions.


### 2.1. Bilinear Map

LetG1, G2, and GT be three multiplicative groups of prime order p. A bilinear map is a map e: G1×G2⟶GT with the following properties:(1)
Bilinearity:efa,hb=ef,habfor∀a,b∈Zp∀f∈G1,∀h∈G2(2)
Nondegeneracy:ef,h≠1(3)
Computability: there is an efficient algorithm to computeef,hwhere∀f∈G1,∀h∈G2If∀f∈G1,∀h∈G2, then ef,h∈GT. The bilinear pairing applied in our proposed scheme is symmetric, where G1 = G2 = G.


### 2.2. Computational Assumption

Definition 1.
Computational Diffie-Hellman problem, CDH: assumeG1is a bilinear group of prime order p. g is a generator of G1, bilinear map e: G1∗G1⟶GT. Giving g,ga,gb for unknown a,b∈Zp to compute gab. We say that the (t, ε)-CDH problem holds if there exists no poly(t)-time algorithm can solve the CDH problem with non-negligible advantagesε.


### 2.3. Access Structure and Linear Secret-Sharing Schemes (LSSS)

Definition 2.
Access structure [38]: let U =  U1,U2,U3,…,Un be a set of parties, and a collection A⊆2U1,U2,U3,…,Un is called monotone if ∀B,C∈2U1,U2,U3,…,Un: ifB∈AandB⊆C,thenC∈A. A monotone access structure is collection A which is a nonempty subsets of U1,U2,U3,…,Un, i.e., A∈2U1,U2,U3,…,Un\ϕ. The set in A is called authorized set, and others is an unauthorized set.Definition 3.
Linear secret sharing scheme [39] (LSSS): a secret sharing scheme ∏ over a set of parties U =  U1,U2,U3,…,Un is LSSS only if(1)
The share for each party forms a vector overZp.(2)
There exists a share generating matrixM with l rows and m columns. For i=1,…l, let the function ρ map the row i of M to the attribute ρi. When we consider the column vector v⟶ = v1,v2,…,vmT, where v1=s∈Zp is the secret to be shared, and v2,…,vm∈Zp are chosen randomly; then Mv⟶ is the vector which shares the secret s by function ∏. The shared secret λi=Mi⋅v belongs to the party ρi.
Suppose that∏ is an LSSS for the access control strategy γ. Let A∈γ is an authorized set, and I⊆1,2,…,l is defined as I=i:ρi∈A. If λi is valid shares of any secret s by function ∏, there exists constant ωi∈Zp and ∑x∈ρSiωi∗λi=s. In [38], it is shown that these constants ωii∈I can be found in polynomial time.


### 2.4. Syntax of Decentralized Attribute-Based Signature Scheme (DABS)

According to [40], we construct the DABS scheme that consists of five algorithms: Setup, Keygen, Sign, Verify, and Trace. Select a random security parameter λ; our scheme works as follows:(i)
Setup (λ). The algorithm takes a random secure parameter λ as input, and it outputs a master key MSK, public key PK, and trace key TK, where TK is used to trace the user identity. Assume that the PK contains the universe of attributes set U, and the default attributes set W.(ii)
KeygenUIDk,MSK,PK. In this algorithm, all attribute authorities AAi share a pseudorandom function PRF⋅. It takes the user’s attribute set UIDk⊆U, MSK, and PK as input; each AA computes the attribute private key SK as output.(iii)
SignγS,ρ∪W⋅,M,PK,SK,IDk. The algorithm takes input signing predicate γS,ρ∪W and shared message M, PK, SK, and IDk, where S,ρ is generated according to the access control strategy of the data owner, S is a share generating matrix, ρ is a map function as shown in Definition 3, and W is a default attribute set. The algorithm outputs a signature δ.(iv)
Verifyδ,PK. The algorithm takes δ and PK as input and outputs a Boolean value.(v)
Traceδ,PK. The algorithm takes input the signature δ and trace key TK and outputs the signer identity IDk.Batch Processing. (Definition 4 [41]): giving BSetup(λ) ⟶(q, g1,g2,G1,G2,GT,e), where q is a prime, λ is a security parameter, and n=polyλ∀j∈1,n,A∈Gi|i=1,2,Tandu=u1,u2,…,un∈Zq∗,if ∏j=1nAuj = ∏j=1nYjuj, then A = Yj.


### 2.5. Security Definitions

This part introduces the security definitions. The ABS scheme supports characters of anonymity and noncollusion. In terms of anonymity, it usually includes computational anonymity and unconditional full anonymity. [16] supports computational anonymity, where the adversary can access the user identity with unlimited computing power. While to the characteristic of unconditional full anonymity, giving a sufficient signature with an access control strategy; adversary Å has unlimited computing power and accesses any users’ attribute key. Still, there is no poly(t)-time algorithm Λ to reveal the signer’s attributes information from the signing predicate. Noncollusion means no poly(t)-time for adversaries to forge the legitimate signature with a set of complementary attributes.


#### 2.5.1. Unconditional Full Anonymity

Our scheme supportsunconditional full anonymity if no adversary Å can win the following games with non-negligible advantagesε.(i)
Setup. An adversary Å selects a random signing predicate γS,ρ∪W⋅. The simulator ℂ calls the algorithm Setup(.) and returns the public key PK and master key MSK to Å. Å can construct a key for any AAi.(ii)
Challenge. In this phase, the Å chooses a random message M′ and two attribute sets UIDii=1,2, where UIDii=1,2 satisfies the signature predicate γS,ρ′. The Å sends two tuples M′,UID1 and M′,UID2 to ℂ. The ℂ calls the algorithm Keygen(.) and returns private keys SKID1andSKID2. Then ℂ chooses a bit, b∈{0, 1}, signs the message M′,UIDb as signature δIDb, and sends it to the Å.(iii)
Guess. The Å outputs the guess result b′ of b and wins the game only if b′=b.


#### 2.5.2. Noncollusion

Our scheme can defend against collusive attack under adaptive selective message and predicate attacks if there is no adversary Å (capable of unlimited computing power) can win the following games with the non-negligible advantagesε.(i)
Initial.(ii)
AssumeγS′,ρ∪W⋅ is a mini-subset of γS,ρ∪W⋅, and γS,ρ∪WS′,ρ = 1. Let the compromised AA group as SA =  AA1,AA2,…,AAt−1. For the predicate γS′,ρ∪W⋅, the adversary Å can forge the signature only if corrupted by another AAt. So, the attack effect of the DABS scheme can be reducible to attack the AAt. Assume that the simulator ℂ chooses a default attributes set Wt from AAt.(iii)
Setup.(iv)
ℂ calls Setup(.) and sends PKto adversary Å.(v)
Query.(vi)
Å queries the random oracleH,H2, SK and signature from ℂ.(vii)
Challenge.(viii)
The adversary Å challenges the security under a collusive attack. It chooses two random usersID0,ID1 with the attribute set UID0andUID1, respectively, where γS′,ρ∪WUID0∪W≠1, γS′,ρ∪WUID1∪W≠1 and γS′,ρ∪WUID0∪UID1∪W=1.(ix)
The adversary Å requires to query private key ofUID0∩Ut,ID0 and UID1∩Ut,ID0; ℂ returns the SKID0,t, SKID1,tto Å, respectively. So, the combined-key is SKIDi′,t=SKID0,t∪SKID1,t.(x)
Forgery.Å constructs a signatureγS′,ρ∪WUID0∪UID1∪W′,M′,δ′ and will win the game only if(1)
Verify (γS′,ρ∪WUID0∪UID1∪W′,M′,δ′) = true.(2)
Å cannot query any private key of the attribute sets′ where γSt′,ρ∪Ws′=1.(3)
Å cannot query any private key of the attribute sets′ where γS′,ρ∪Ws′=1.


## 2.1. Bilinear Map

LetG1, G2, and GT be three multiplicative groups of prime order p. A bilinear map is a map e: G1×G2⟶GT with the following properties:(1)
Bilinearity:efa,hb=ef,habfor∀a,b∈Zp∀f∈G1,∀h∈G2(2)
Nondegeneracy:ef,h≠1(3)
Computability: there is an efficient algorithm to computeef,hwhere∀f∈G1,∀h∈G2If∀f∈G1,∀h∈G2, then ef,h∈GT. The bilinear pairing applied in our proposed scheme is symmetric, where G1 = G2 = G.


## 2.2. Computational Assumption

Definition 1.
Computational Diffie-Hellman problem, CDH: assumeG1is a bilinear group of prime order p. g is a generator of G1, bilinear map e: G1∗G1⟶GT. Giving g,ga,gb for unknown a,b∈Zp to compute gab. We say that the (t, ε)-CDH problem holds if there exists no poly(t)-time algorithm can solve the CDH problem with non-negligible advantagesε.


## 2.3. Access Structure and Linear Secret-Sharing Schemes (LSSS)

Definition 2.
Access structure [38]: let U =  U1,U2,U3,…,Un be a set of parties, and a collection A⊆2U1,U2,U3,…,Un is called monotone if ∀B,C∈2U1,U2,U3,…,Un: ifB∈AandB⊆C,thenC∈A. A monotone access structure is collection A which is a nonempty subsets of U1,U2,U3,…,Un, i.e., A∈2U1,U2,U3,…,Un\ϕ. The set in A is called authorized set, and others is an unauthorized set.Definition 3.
Linear secret sharing scheme [39] (LSSS): a secret sharing scheme ∏ over a set of parties U =  U1,U2,U3,…,Un is LSSS only if(1)
The share for each party forms a vector overZp.(2)
There exists a share generating matrixM with l rows and m columns. For i=1,…l, let the function ρ map the row i of M to the attribute ρi. When we consider the column vector v⟶ = v1,v2,…,vmT, where v1=s∈Zp is the secret to be shared, and v2,…,vm∈Zp are chosen randomly; then Mv⟶ is the vector which shares the secret s by function ∏. The shared secret λi=Mi⋅v belongs to the party ρi.
Suppose that∏ is an LSSS for the access control strategy γ. Let A∈γ is an authorized set, and I⊆1,2,…,l is defined as I=i:ρi∈A. If λi is valid shares of any secret s by function ∏, there exists constant ωi∈Zp and ∑x∈ρSiωi∗λi=s. In [38], it is shown that these constants ωii∈I can be found in polynomial time.


## 2.4. Syntax of Decentralized Attribute-Based Signature Scheme (DABS)

According to [40], we construct the DABS scheme that consists of five algorithms: Setup, Keygen, Sign, Verify, and Trace. Select a random security parameter λ; our scheme works as follows:(i)
Setup (λ). The algorithm takes a random secure parameter λ as input, and it outputs a master key MSK, public key PK, and trace key TK, where TK is used to trace the user identity. Assume that the PK contains the universe of attributes set U, and the default attributes set W.(ii)
KeygenUIDk,MSK,PK. In this algorithm, all attribute authorities AAi share a pseudorandom function PRF⋅. It takes the user’s attribute set UIDk⊆U, MSK, and PK as input; each AA computes the attribute private key SK as output.(iii)
SignγS,ρ∪W⋅,M,PK,SK,IDk. The algorithm takes input signing predicate γS,ρ∪W and shared message M, PK, SK, and IDk, where S,ρ is generated according to the access control strategy of the data owner, S is a share generating matrix, ρ is a map function as shown in Definition 3, and W is a default attribute set. The algorithm outputs a signature δ.(iv)
Verifyδ,PK. The algorithm takes δ and PK as input and outputs a Boolean value.(v)
Traceδ,PK. The algorithm takes input the signature δ and trace key TK and outputs the signer identity IDk.Batch Processing. (Definition 4 [41]): giving BSetup(λ) ⟶(q, g1,g2,G1,G2,GT,e), where q is a prime, λ is a security parameter, and n=polyλ∀j∈1,n,A∈Gi|i=1,2,Tandu=u1,u2,…,un∈Zq∗,if ∏j=1nAuj = ∏j=1nYjuj, then A = Yj.


## 2.5. Security Definitions

This part introduces the security definitions. The ABS scheme supports characters of anonymity and noncollusion. In terms of anonymity, it usually includes computational anonymity and unconditional full anonymity. [16] supports computational anonymity, where the adversary can access the user identity with unlimited computing power. While to the characteristic of unconditional full anonymity, giving a sufficient signature with an access control strategy; adversary Å has unlimited computing power and accesses any users’ attribute key. Still, there is no poly(t)-time algorithm Λ to reveal the signer’s attributes information from the signing predicate. Noncollusion means no poly(t)-time for adversaries to forge the legitimate signature with a set of complementary attributes.


### 2.5.1. Unconditional Full Anonymity

Our scheme supportsunconditional full anonymity if no adversary Å can win the following games with non-negligible advantagesε.(i)
Setup. An adversary Å selects a random signing predicate γS,ρ∪W⋅. The simulator ℂ calls the algorithm Setup(.) and returns the public key PK and master key MSK to Å. Å can construct a key for any AAi.(ii)
Challenge. In this phase, the Å chooses a random message M′ and two attribute sets UIDii=1,2, where UIDii=1,2 satisfies the signature predicate γS,ρ′. The Å sends two tuples M′,UID1 and M′,UID2 to ℂ. The ℂ calls the algorithm Keygen(.) and returns private keys SKID1andSKID2. Then ℂ chooses a bit, b∈{0, 1}, signs the message M′,UIDb as signature δIDb, and sends it to the Å.(iii)
Guess. The Å outputs the guess result b′ of b and wins the game only if b′=b.


### 2.5.2. Noncollusion

Our scheme can defend against collusive attack under adaptive selective message and predicate attacks if there is no adversary Å (capable of unlimited computing power) can win the following games with the non-negligible advantagesε.(i)
Initial.(ii)
AssumeγS′,ρ∪W⋅ is a mini-subset of γS,ρ∪W⋅, and γS,ρ∪WS′,ρ = 1. Let the compromised AA group as SA =  AA1,AA2,…,AAt−1. For the predicate γS′,ρ∪W⋅, the adversary Å can forge the signature only if corrupted by another AAt. So, the attack effect of the DABS scheme can be reducible to attack the AAt. Assume that the simulator ℂ chooses a default attributes set Wt from AAt.(iii)
Setup.(iv)
ℂ calls Setup(.) and sends PKto adversary Å.(v)
Query.(vi)
Å queries the random oracleH,H2, SK and signature from ℂ.(vii)
Challenge.(viii)
The adversary Å challenges the security under a collusive attack. It chooses two random usersID0,ID1 with the attribute set UID0andUID1, respectively, where γS′,ρ∪WUID0∪W≠1, γS′,ρ∪WUID1∪W≠1 and γS′,ρ∪WUID0∪UID1∪W=1.(ix)
The adversary Å requires to query private key ofUID0∩Ut,ID0 and UID1∩Ut,ID0; ℂ returns the SKID0,t, SKID1,tto Å, respectively. So, the combined-key is SKIDi′,t=SKID0,t∪SKID1,t.(x)
Forgery.Å constructs a signatureγS′,ρ∪WUID0∪UID1∪W′,M′,δ′ and will win the game only if(1)
Verify (γS′,ρ∪WUID0∪UID1∪W′,M′,δ′) = true.(2)
Å cannot query any private key of the attribute sets′ where γSt′,ρ∪Ws′=1.(3)
Å cannot query any private key of the attribute sets′ where γS′,ρ∪Ws′=1.


## 2.5.1. Unconditional Full Anonymity

Our scheme supportsunconditional full anonymity if no adversary Å can win the following games with non-negligible advantagesε.(i)
Setup. An adversary Å selects a random signing predicate γS,ρ∪W⋅. The simulator ℂ calls the algorithm Setup(.) and returns the public key PK and master key MSK to Å. Å can construct a key for any AAi.(ii)
Challenge. In this phase, the Å chooses a random message M′ and two attribute sets UIDii=1,2, where UIDii=1,2 satisfies the signature predicate γS,ρ′. The Å sends two tuples M′,UID1 and M′,UID2 to ℂ. The ℂ calls the algorithm Keygen(.) and returns private keys SKID1andSKID2. Then ℂ chooses a bit, b∈{0, 1}, signs the message M′,UIDb as signature δIDb, and sends it to the Å.(iii)
Guess. The Å outputs the guess result b′ of b and wins the game only if b′=b.


## 2.5.2. Noncollusion

Our scheme can defend against collusive attack under adaptive selective message and predicate attacks if there is no adversary Å (capable of unlimited computing power) can win the following games with the non-negligible advantagesε.(i)
Initial.(ii)
AssumeγS′,ρ∪W⋅ is a mini-subset of γS,ρ∪W⋅, and γS,ρ∪WS′,ρ = 1. Let the compromised AA group as SA =  AA1,AA2,…,AAt−1. For the predicate γS′,ρ∪W⋅, the adversary Å can forge the signature only if corrupted by another AAt. So, the attack effect of the DABS scheme can be reducible to attack the AAt. Assume that the simulator ℂ chooses a default attributes set Wt from AAt.(iii)
Setup.(iv)
ℂ calls Setup(.) and sends PKto adversary Å.(v)
Query.(vi)
Å queries the random oracleH,H2, SK and signature from ℂ.(vii)
Challenge.(viii)
The adversary Å challenges the security under a collusive attack. It chooses two random usersID0,ID1 with the attribute set UID0andUID1, respectively, where γS′,ρ∪WUID0∪W≠1, γS′,ρ∪WUID1∪W≠1 and γS′,ρ∪WUID0∪UID1∪W=1.(ix)
The adversary Å requires to query private key ofUID0∩Ut,ID0 and UID1∩Ut,ID0; ℂ returns the SKID0,t, SKID1,tto Å, respectively. So, the combined-key is SKIDi′,t=SKID0,t∪SKID1,t.(x)
Forgery.Å constructs a signatureγS′,ρ∪WUID0∪UID1∪W′,M′,δ′ and will win the game only if(1)
Verify (γS′,ρ∪WUID0∪UID1∪W′,M′,δ′) = true.(2)
Å cannot query any private key of the attribute sets′ where γSt′,ρ∪Ws′=1.(3)
Å cannot query any private key of the attribute sets′ where γS′,ρ∪Ws′=1.


## 3. Cross-Department Secures Data Sharing in the Food Industry via Blockchain-Cloud Fusion Scheme

### 3.1. System Model

Assume the enterprises, regulators, and neutral institutions (such as food commonweal organization) in the whole food supply-chain hope to share data to promote supervision of food quality and public safety incidents. They provide a cloud server as an Attribute Authority server (AA) to store the transmitted data and verify them. Regulators and enterprise legal persons are registered with the regulator AA server, and employees register with the enterprise AA server. Assume neutral institutions’ servers are semicredible that would not eavesdrop or backup users’ registration information. The common consumers, including food enterprise employees, can enter the system by registering with any neutral institution, release supervision information anonymously based on the DABS algorithm (detailed in Section3.3), and realize social co-governance of all links in the food supply chain. Food enterprises own the AAs, regulators, and neutral institutions independently. To standardize terms, we use data owners as the data providers in the following, including enterprises, regulators, and neutral institutions. As Figure 2 shown that our system consists of four modules: cloud network, DABS, blockchain network, and application group. The system details are as follows:(i)
Cloud Network Module. It consists of AA servers’ group to support user identity verification, user management, and data storage. Each AA server is selected from the existing system architecture in the food supply chain. AA server is operated and maintained independently by data owners, which also is used as shared data services to support food quality supervision and traceability. Likely, farms can share data in the cultivation server; storage enterprise shares data with the warehouse server, etc. Processing enterprise shares data with the process server; regulators share sampling inspection reports and monitoring data with the regulator server. It uploads the shared data signature and index from food enterprises and regulators to the blockchain network. And, it shares consumers’ report data with DABS signature to the blockchain.(ii)
DABS Module. It has the security characteristics of unconditional full anonymity and noncollusion (as shown in Section 4). It supports user authentication, secret key assignment, digital signature, and traceability. The AA server generates an anonymous private key for the user with the fuzzy attribute set if the registration information is authenticated. Data owners share data with access control strategy and private key (sign algorithm is detailed in Section 3.3). Furthermore, it provides a way for regulators to trace down the person responsible for rumors and incidents in the food industry (trace algorithm, as shown in Section 3.3), which is helpful to purify the system network. The DABS module is deployed in the AA servers, which works together to maintain the system’s stability and security.(iii)
Blockchain Network Module. It receives the data from data owners’ server, consensus validation with PBFT [39] that more than 2/3 of the servers acknowledge the validity of data, and store the data block into the blockchain (the block structure as shown in Figure 2). Besides, it supports co-governance and traceability of food safety via smart contract (detailed in Section 3.4). If the report is useful, it will give a reward in return, conducive to motivating consumers to participate actively. With the robustness feature of PBFT, the blockchain network can resist no more than 1/3 of the server’s failure attack. This module can be deployed in AA servers to save the system development cost.(iv)
Application Group Module. It composes of consumers and regulators. Any system user should register firstly by AA server. Consumers can query any quality information of food supply-chain as needed from the blockchain network. The system will then get and return the data from the data owner’s server by the data index in the data block. Besides, consumers can take part in food safety supervision. Regulators have the power of supervision to monitor the whole food supply-chain and hold responsible people, including timely warning and accountability of food safety incidents.Figure 2
The food supply-chain regulation system model based on blockchain-cloud fusion scheme. It remains the existing system architecture and industry metadata owned by data owners. Besides, it enables consumers to know the food quality information throughout the whole supply chain. It provides a safe way for any consumer to social co-governance of food safety without fear of cyber-violence. Furthermore, the regulators can track rumor-mongers.


### 3.2. Threat Model and Design Goal

The adversaries can eavesdrop on the public channel’s information, including signature and signing predicate. Besides, there are dishonest server groups that are allowed to collude to infer the signature’s user identity.Based on the above threat model, the food supply-chain regulation system hopes to achieve the following goals.(1)
Privacy Protection. System user privacy information can be deduced by statistical analysis [13]. So, the system should have the characteristic of unconditional full anonymity. It can resist the adversary’s statistical analysis and is secure when no more than N  1/N of the collusion servers.(2)
System Availability. In this work, the system availability includes two aspects. (a) System robustness: on the one hand, it works only if no more than 1/3 servers in the blockchain network fail; on the other hand, it is Strong (N-1) for AA servers that it works as long as more than one server is honest. (b) Traceability: it provides a solution to track the person responsible for rumors and food safety incidents.


### 3.3. Proposed DABS Scheme

Setup (λ). Let G and GT be two cyclic multiplication groups of composite order Ν=pq and the bilinear map e:G∗G⟶GT, where p and q are two large prime numbers. The construction also enables to work on asymmetric pairing groups, where e:G1∗G2⟶GT, and G1≠G2. Denote Gq is the subgroup of order q in G. The universal set of attributes U =  U1,U2,U3,…,Un are managed by the distribution Attribute Authorities GroupAAi|i=1,2,…,n. Each AAi monitors an attribute subset Ui=ai,1,ai,2,…,ai,Ui and issues the corresponding attribute private key to users. Define the default attributes set W=W1,W2,W3,…,Wn, where Wi=ji,1,ji,2,…,ji,Wi. Select two collision-resistant cryptographic hash function H,H2:0,1∗⟶G. Select random generator g∈G, exponent τ∈ZP∗, and compute T=gτ. Select random exponent xi∈ZP∗ for each AAi and compute Pi=gxi. Select random parameter ti,j∈ZP∗for each attribute. Select generator u′,u1,u2,…,uk∈Gandh∈Gq. So, it generates the public key PK, the master key MSK for AA Group, and the trace key TK as follows:(1)PK=e,g,h,T,Pii=1,…,n,W,H,H2,u′,u1,u2,…,uk,MSK=xii=1,…,n,ti,ji=1,…,n,j∈Uj,TK=q.KeygenUIDk,MSK,PK. In this algorithm, all attribute authorities AAi share a pseudorandom function PRF⋅. Assume the user ID possesses an attribute set UID. The AAi calculates ΓIDi|i=1,…,n=PRFID,D0,i|i∈Group=gΓIDi, and D1,i|i∈Group=g−xi. For attribute j∈UID∪Wi, it computes D2,i,j|i∈Group=Hjti,jD0,i. So, the anonymous private key of the user IDk is(2)SK=D0,i,D1,i,D2,i,ji=1,…,n,j∈UID∪Wi.SignγS,ρ∪W⋅,M,PK,SK,ID. In this algorithm, the signer IDk sets an access control strategy UIDk′≠NUll to messageM.The access control strategy is γS,ρ∪W⋅=UID′∪W. The algorithm constructs an LSSS access matrix Sl∗m with an injective functionρ that maps each row of the matrix S to an attribute of UID′.(i)
The algorithm randomly chooses a parameterεi∈ZP∗ for every bit of ID  = {u[1], u[2],…, u[k]}∈0,1k, and ci=uiuihεi,πi=ui2ui−1hεiεi. Define ε=∑i=1,…,kεi and(3)C=u′∏i=1,…,kci=u′∏i=1kuiuihεi=u′∏i=1kuiuihε.Theciandπican prove thatCis well-formed.(ii)
Choose a random parameters∈ZP∗ and a random vector v=s,v1,v2,…,vm−1∈ZP∗m. Define λi=Si⋅v, where Siis the ith row of S. Choose a constant ωi∈ZP∗ and ∑x∈ρSiωi∗Si=1.(iii)
∀attributex∈γS,ρ∪W and select random parameter ri,j∈ZP∗.If x∈ρSi, calculate δ1,x=gri,jD2,i,jTλi; If x∈W, calculate δ1,x=gri,j.(iv)
Select fuzzy factors∀γ∈ZP∗ for userIDk and calculate(4)δ2=H2Mγ∏x∈ρSiδ1ωi∏i∈Group∏x∈WPiD1,iδ1.(v)
Calculate(5)δ3=eg,H2M−γ∏x∈ρSigri,jD2,i,j−ωi,δ4=eg,Ts.(vi)
So, the signature is(6)δ=δ1x∈W,δ2,δ3,δ4,cii=1,…,k,πii=1,…,k.Verifyδ,PK. The algorithm takes the signature δ and PK as input and outputs the result. According to the equation result eg,δ2∗δ3/∏i∈Group∏x∈Weg,δ1=δ4, if the equation is correct, this scheme accepts the signature δand output true, or reject δ and output ⊥.Traceδ,TK,PK. The algorithm takes input the signature δ, trace key TK, and PK and then outputs the signer identity ID. The algorithm describes as follows:(i)
Call algorithm verifiesδ,PK and checks the signature δ is true or not.(ii)
Ifδis true, ∀ciit will check(7)eci,cig−1=ehq,πiq−1,ehq,g=eh,gq.(iii)
Return u[i] = 1 only if the both check pass, else return u[i] = 0. So, the algorithm will output the signer’s identity ID.The effectiveness of algorithm Trace (.) has been proved in detail in [42], and the security of algorithm Trace (.) has been proved in [43], so we would not detail and analysis the algorithm in the paper.Correctness. This scheme outputs the signature δ=δ1x∈W,δ2,δ3,δ4,cii=1,…,k,πii=1,…,kfor the message M. We can prove the correctness of the scheme as follows:(8)eg,δ2δ3∏i∈Group∏x∈Weg,δ1=eg,∏x∈ρSiδ1ωi∏i∈Group∏x∈WPiD1,iδ1eg,∏x∈ρSigri,jD2,i,j−ωi∏i∈Group∏x∈Weg,gri,j=eg,∏x∈ρSiTλiωi=eg,gτs=δ4,According∑x∈ρSiωi∗λi=s.Batch-Verification Processing. According to the scheme [13], we propose a batch-verification processing algorithm to improve the effectiveness of nO⋅ to O⋅+n. It takes inputs the public key PK and a large number of signatures δID1δID2,…,δIDn, and works as follows:(9)eg,δ2ID1δ2ID2,…,δ2IDnδ3ID1δ3ID2,…,δ3IDn∏i∈Group∏x∈Weg,δ1ID1,…,δ1IDn=eg,T∑i=1,…,ns=∏i=1,…,nδ4IDi.


### 3.4. Social Co-Governance of Food Safety Based on Smart Contract

The smart contract enables to automatic execution of the agreement between the parties without an intermediary. It is helpful to improve the efficiency of information processing and social co-governance of food safety.(1)
Data Intelligence Verification. When enterprise servers upload signature δ=δ1x∈W,δ2,δ3,δ4,cii=1,…,k,πii=1,…,k to the blockchain network, it would autorun the smart contract deployed in blockchain servers and intelligent process verification of the signature, as shown in Algorithm 1.(2)
Social Co-Governance of Food Safety. If the quality problem happens in the food supply-chain, any consumer can report it anonymously by the blockchain network. On one hand, smart contract helps regulators timely deal with the potential risk of food safety incidents and investigates the legal liability of the enterprises involved; on the other hand, it will warn someone who spreads rumors. The smart contracts are constructed as shown in Algorithm 2 and 3.Algorithm 1: Automated validation data by enterprises and regulatory agencies.
Input: signature δ and public key PKOutput: success or alarm(1)
Function: verify δ,PK(2)
Ifeg,δ2∗δ3/∏i∈Group∏x∈Weg,δ1=δ4Then(3)
Writeblockchainδ(4)
Authorize (nextstep)(5)
ReturnSuccess(6)
Else(7)
Writeblockchain (false)(8)
Return Alarm (“the signature is invalid”)(9)
End If(10)
End FunctionAlgorithm 2: Report and accountability for food safety problems.
Input：Food safety report, trace key TK and public key PKOutput：Alarm(1)
Function Co-governance (report, TK,PK)(2)
result = Consensus (report)(3)
δ⟸ reporter. getDataSign ()(4)
If result = true Then(5)
ID⟸ Trace (δ,PK,TK)(6)
Writeblockchain (report)(7)
Return Alarm (“the enterprise” + ID + “has food safety problems”)(8)
Else(9)
ID⟸ Trace (δ,PK,TK)(10)
Return Alarm (“the reporter” + ID + “posts a malicious information”)(11)
End If(12)
End FunctionAlgorithm 3: Tracking user identity ID.
Input：Food safety report, trace key TK and public key PKOutput：Identity information ID(1)
Function Trace (δ,PK,TK)(2)
ID⟸ null(3)
If (Verify (δ, PK) = Success) Then(4)
c⟸ reporter. getListC ()(5)
π⟸ reporter. getListπ ()(6)
h⟸PK.getH ()(7)
i⟸ 0(8)
While (i < c.length)(9)
Ifeci,cig−1=ehq,πiq−1andehq,g=eh,gqThen(10)
ID⟸ID + “1”(11)
Else(12)
ID⟸ID + “0”(13)
End If(14)
End While(15)
End If(16)
ReturnID(17)
END Function


### 3.5. Food Supply-Chain Regulation System Based on Blockchain-Cloud Fusion Scheme

With the blockchain-cloud fusion scheme, the food supply-chain regulation system overcomes the pain points of data sharing in the food industry. It is conductive to optimize the processes of information collection, quality inspection and supervision, and supply and marketing management. This part mainly introduces the system workflow.We will describe the system workflow from two aspects of data sharing and data consumption. The shared data consist of consumer reports and food industry shared data.


#### 3.5.1. Industry Data Sharing

On receiving the shared data from enterprises and regulators in the food supply-chain, the system workflow is as shown in Figure3.Figure 3
System workflow of industry data sharing.We will take the food enterprise data sharing as an example to detail the system workflow as follows:(1)
Any system user should authenticate and register by the AA server first; then, the AA server would verify its identity and generate an anonymous private key. Each workflow needs this step so that we would not detail it again in other workflows.(2)
After authentication is completed, the enterprise manager can share data by defining a signing predicate on demand and then sending it to the enterprise AA server.(3)
The AA server generates an anonymity signature and sends the signature and the index of shared data to the blockchain network.(4)
Blockchain server firstly determines the validity of data via smart contract and generates a data block. Validate and then broadcast the block to make a consensus decision with PBFT algorithm.(5)
If more than 2/3 of the servers agree, the new data block will be stored in the blockchain.


#### 3.5.2. Consumer Report

To promote social co-governance in food safety, the system provides an anonymous supervision report function for consumers and gives a reward in return. The system workflow of consumer reports is similar to the front workflow—the workflow is shown in Figure4.(1)
Consumers in the system report the food quality problems anonymously. They can define a signing predicate to generate an anonymous signature.(2)
The AA server would share the report content and signature to the blockchain. Then, verify and generate a new data block with a signal tag. Make a consensus decision and store the block into the block chain.(3)
The blockchain network will send an alert message to regulators to make a decision. The system will give a reward to the consumer in return if the alarm is validated for regulators.Figure 4
System workflow of consumer report.In addition, data consumption consists of consumers inquiring about food quality on-demand and accountability.


#### 3.5.3. Inquire Food Quality on Demand

The system consumers inquire about food information, as shown in Figure5.(1)
Consumers can inquire about the quality information (including quality inspection report, source, process, and transport) of each link’s raw material in the food supply-chain from a blockchain network.(2)
It analyzes the data source index from the data block and gets the target data from the data owner’s server and then shows it to the consumer as a basis for food quality evaluation.Figure 5
System workflow of inquire food information.


#### 3.5.4. Accountability

Due to blockchain’s tamper-proofing feature, the system provides traceability for regulators to track the person responsible for rumors and food quality incidents. We take tracking a rumor-monger as an example to detail the system workflow as follows (as shown in Figure6).(1)
The regulator chooses a rumor to track the monger from the blockchain network. The system will authenticate the regulator and record the action.(2)
Then, the system analyzes the rumor record, generates the rumor-monger’s ID, and returns it to the regulator, which can serve as a basis for the regulator to law enforcement [44].Figure 6
System workflow of accountability.


## 3.1. System Model

Assume the enterprises, regulators, and neutral institutions (such as food commonweal organization) in the whole food supply-chain hope to share data to promote supervision of food quality and public safety incidents. They provide a cloud server as an Attribute Authority server (AA) to store the transmitted data and verify them. Regulators and enterprise legal persons are registered with the regulator AA server, and employees register with the enterprise AA server. Assume neutral institutions’ servers are semicredible that would not eavesdrop or backup users’ registration information. The common consumers, including food enterprise employees, can enter the system by registering with any neutral institution, release supervision information anonymously based on the DABS algorithm (detailed in Section3.3), and realize social co-governance of all links in the food supply chain. Food enterprises own the AAs, regulators, and neutral institutions independently. To standardize terms, we use data owners as the data providers in the following, including enterprises, regulators, and neutral institutions. As Figure 2 shown that our system consists of four modules: cloud network, DABS, blockchain network, and application group. The system details are as follows:(i)
Cloud Network Module. It consists of AA servers’ group to support user identity verification, user management, and data storage. Each AA server is selected from the existing system architecture in the food supply chain. AA server is operated and maintained independently by data owners, which also is used as shared data services to support food quality supervision and traceability. Likely, farms can share data in the cultivation server; storage enterprise shares data with the warehouse server, etc. Processing enterprise shares data with the process server; regulators share sampling inspection reports and monitoring data with the regulator server. It uploads the shared data signature and index from food enterprises and regulators to the blockchain network. And, it shares consumers’ report data with DABS signature to the blockchain.(ii)
DABS Module. It has the security characteristics of unconditional full anonymity and noncollusion (as shown in Section 4). It supports user authentication, secret key assignment, digital signature, and traceability. The AA server generates an anonymous private key for the user with the fuzzy attribute set if the registration information is authenticated. Data owners share data with access control strategy and private key (sign algorithm is detailed in Section 3.3). Furthermore, it provides a way for regulators to trace down the person responsible for rumors and incidents in the food industry (trace algorithm, as shown in Section 3.3), which is helpful to purify the system network. The DABS module is deployed in the AA servers, which works together to maintain the system’s stability and security.(iii)
Blockchain Network Module. It receives the data from data owners’ server, consensus validation with PBFT [39] that more than 2/3 of the servers acknowledge the validity of data, and store the data block into the blockchain (the block structure as shown in Figure 2). Besides, it supports co-governance and traceability of food safety via smart contract (detailed in Section 3.4). If the report is useful, it will give a reward in return, conducive to motivating consumers to participate actively. With the robustness feature of PBFT, the blockchain network can resist no more than 1/3 of the server’s failure attack. This module can be deployed in AA servers to save the system development cost.(iv)
Application Group Module. It composes of consumers and regulators. Any system user should register firstly by AA server. Consumers can query any quality information of food supply-chain as needed from the blockchain network. The system will then get and return the data from the data owner’s server by the data index in the data block. Besides, consumers can take part in food safety supervision. Regulators have the power of supervision to monitor the whole food supply-chain and hold responsible people, including timely warning and accountability of food safety incidents.Figure 2
The food supply-chain regulation system model based on blockchain-cloud fusion scheme. It remains the existing system architecture and industry metadata owned by data owners. Besides, it enables consumers to know the food quality information throughout the whole supply chain. It provides a safe way for any consumer to social co-governance of food safety without fear of cyber-violence. Furthermore, the regulators can track rumor-mongers.


## 3.2. Threat Model and Design Goal

The adversaries can eavesdrop on the public channel’s information, including signature and signing predicate. Besides, there are dishonest server groups that are allowed to collude to infer the signature’s user identity.Based on the above threat model, the food supply-chain regulation system hopes to achieve the following goals.(1)
Privacy Protection. System user privacy information can be deduced by statistical analysis [13]. So, the system should have the characteristic of unconditional full anonymity. It can resist the adversary’s statistical analysis and is secure when no more than N  1/N of the collusion servers.(2)
System Availability. In this work, the system availability includes two aspects. (a) System robustness: on the one hand, it works only if no more than 1/3 servers in the blockchain network fail; on the other hand, it is Strong (N-1) for AA servers that it works as long as more than one server is honest. (b) Traceability: it provides a solution to track the person responsible for rumors and food safety incidents.


## 3.3. Proposed DABS Scheme

Setup (λ). Let G and GT be two cyclic multiplication groups of composite order Ν=pq and the bilinear map e:G∗G⟶GT, where p and q are two large prime numbers. The construction also enables to work on asymmetric pairing groups, where e:G1∗G2⟶GT, and G1≠G2. Denote Gq is the subgroup of order q in G. The universal set of attributes U =  U1,U2,U3,…,Un are managed by the distribution Attribute Authorities GroupAAi|i=1,2,…,n. Each AAi monitors an attribute subset Ui=ai,1,ai,2,…,ai,Ui and issues the corresponding attribute private key to users. Define the default attributes set W=W1,W2,W3,…,Wn, where Wi=ji,1,ji,2,…,ji,Wi. Select two collision-resistant cryptographic hash function H,H2:0,1∗⟶G. Select random generator g∈G, exponent τ∈ZP∗, and compute T=gτ. Select random exponent xi∈ZP∗ for each AAi and compute Pi=gxi. Select random parameter ti,j∈ZP∗for each attribute. Select generator u′,u1,u2,…,uk∈Gandh∈Gq. So, it generates the public key PK, the master key MSK for AA Group, and the trace key TK as follows:(1)PK=e,g,h,T,Pii=1,…,n,W,H,H2,u′,u1,u2,…,uk,MSK=xii=1,…,n,ti,ji=1,…,n,j∈Uj,TK=q.KeygenUIDk,MSK,PK. In this algorithm, all attribute authorities AAi share a pseudorandom function PRF⋅. Assume the user ID possesses an attribute set UID. The AAi calculates ΓIDi|i=1,…,n=PRFID,D0,i|i∈Group=gΓIDi, and D1,i|i∈Group=g−xi. For attribute j∈UID∪Wi, it computes D2,i,j|i∈Group=Hjti,jD0,i. So, the anonymous private key of the user IDk is(2)SK=D0,i,D1,i,D2,i,ji=1,…,n,j∈UID∪Wi.SignγS,ρ∪W⋅,M,PK,SK,ID. In this algorithm, the signer IDk sets an access control strategy UIDk′≠NUll to messageM.The access control strategy is γS,ρ∪W⋅=UID′∪W. The algorithm constructs an LSSS access matrix Sl∗m with an injective functionρ that maps each row of the matrix S to an attribute of UID′.(i)
The algorithm randomly chooses a parameterεi∈ZP∗ for every bit of ID  = {u[1], u[2],…, u[k]}∈0,1k, and ci=uiuihεi,πi=ui2ui−1hεiεi. Define ε=∑i=1,…,kεi and(3)C=u′∏i=1,…,kci=u′∏i=1kuiuihεi=u′∏i=1kuiuihε.Theciandπican prove thatCis well-formed.(ii)
Choose a random parameters∈ZP∗ and a random vector v=s,v1,v2,…,vm−1∈ZP∗m. Define λi=Si⋅v, where Siis the ith row of S. Choose a constant ωi∈ZP∗ and ∑x∈ρSiωi∗Si=1.(iii)
∀attributex∈γS,ρ∪W and select random parameter ri,j∈ZP∗.If x∈ρSi, calculate δ1,x=gri,jD2,i,jTλi; If x∈W, calculate δ1,x=gri,j.(iv)
Select fuzzy factors∀γ∈ZP∗ for userIDk and calculate(4)δ2=H2Mγ∏x∈ρSiδ1ωi∏i∈Group∏x∈WPiD1,iδ1.(v)
Calculate(5)δ3=eg,H2M−γ∏x∈ρSigri,jD2,i,j−ωi,δ4=eg,Ts.(vi)
So, the signature is(6)δ=δ1x∈W,δ2,δ3,δ4,cii=1,…,k,πii=1,…,k.Verifyδ,PK. The algorithm takes the signature δ and PK as input and outputs the result. According to the equation result eg,δ2∗δ3/∏i∈Group∏x∈Weg,δ1=δ4, if the equation is correct, this scheme accepts the signature δand output true, or reject δ and output ⊥.Traceδ,TK,PK. The algorithm takes input the signature δ, trace key TK, and PK and then outputs the signer identity ID. The algorithm describes as follows:(i)
Call algorithm verifiesδ,PK and checks the signature δ is true or not.(ii)
Ifδis true, ∀ciit will check(7)eci,cig−1=ehq,πiq−1,ehq,g=eh,gq.(iii)
Return u[i] = 1 only if the both check pass, else return u[i] = 0. So, the algorithm will output the signer’s identity ID.The effectiveness of algorithm Trace (.) has been proved in detail in [42], and the security of algorithm Trace (.) has been proved in [43], so we would not detail and analysis the algorithm in the paper.Correctness. This scheme outputs the signature δ=δ1x∈W,δ2,δ3,δ4,cii=1,…,k,πii=1,…,kfor the message M. We can prove the correctness of the scheme as follows:(8)eg,δ2δ3∏i∈Group∏x∈Weg,δ1=eg,∏x∈ρSiδ1ωi∏i∈Group∏x∈WPiD1,iδ1eg,∏x∈ρSigri,jD2,i,j−ωi∏i∈Group∏x∈Weg,gri,j=eg,∏x∈ρSiTλiωi=eg,gτs=δ4,According∑x∈ρSiωi∗λi=s.Batch-Verification Processing. According to the scheme [13], we propose a batch-verification processing algorithm to improve the effectiveness of nO⋅ to O⋅+n. It takes inputs the public key PK and a large number of signatures δID1δID2,…,δIDn, and works as follows:(9)eg,δ2ID1δ2ID2,…,δ2IDnδ3ID1δ3ID2,…,δ3IDn∏i∈Group∏x∈Weg,δ1ID1,…,δ1IDn=eg,T∑i=1,…,ns=∏i=1,…,nδ4IDi.


## 3.4. Social Co-Governance of Food Safety Based on Smart Contract

The smart contract enables to automatic execution of the agreement between the parties without an intermediary. It is helpful to improve the efficiency of information processing and social co-governance of food safety.(1)
Data Intelligence Verification. When enterprise servers upload signature δ=δ1x∈W,δ2,δ3,δ4,cii=1,…,k,πii=1,…,k to the blockchain network, it would autorun the smart contract deployed in blockchain servers and intelligent process verification of the signature, as shown in Algorithm 1.(2)
Social Co-Governance of Food Safety. If the quality problem happens in the food supply-chain, any consumer can report it anonymously by the blockchain network. On one hand, smart contract helps regulators timely deal with the potential risk of food safety incidents and investigates the legal liability of the enterprises involved; on the other hand, it will warn someone who spreads rumors. The smart contracts are constructed as shown in Algorithm 2 and 3.Algorithm 1: Automated validation data by enterprises and regulatory agencies.
Input: signature δ and public key PKOutput: success or alarm(1)
Function: verify δ,PK(2)
Ifeg,δ2∗δ3/∏i∈Group∏x∈Weg,δ1=δ4Then(3)
Writeblockchainδ(4)
Authorize (nextstep)(5)
ReturnSuccess(6)
Else(7)
Writeblockchain (false)(8)
Return Alarm (“the signature is invalid”)(9)
End If(10)
End FunctionAlgorithm 2: Report and accountability for food safety problems.
Input：Food safety report, trace key TK and public key PKOutput：Alarm(1)
Function Co-governance (report, TK,PK)(2)
result = Consensus (report)(3)
δ⟸ reporter. getDataSign ()(4)
If result = true Then(5)
ID⟸ Trace (δ,PK,TK)(6)
Writeblockchain (report)(7)
Return Alarm (“the enterprise” + ID + “has food safety problems”)(8)
Else(9)
ID⟸ Trace (δ,PK,TK)(10)
Return Alarm (“the reporter” + ID + “posts a malicious information”)(11)
End If(12)
End FunctionAlgorithm 3: Tracking user identity ID.
Input：Food safety report, trace key TK and public key PKOutput：Identity information ID(1)
Function Trace (δ,PK,TK)(2)
ID⟸ null(3)
If (Verify (δ, PK) = Success) Then(4)
c⟸ reporter. getListC ()(5)
π⟸ reporter. getListπ ()(6)
h⟸PK.getH ()(7)
i⟸ 0(8)
While (i < c.length)(9)
Ifeci,cig−1=ehq,πiq−1andehq,g=eh,gqThen(10)
ID⟸ID + “1”(11)
Else(12)
ID⟸ID + “0”(13)
End If(14)
End While(15)
End If(16)
ReturnID(17)
END Function


## 3.5. Food Supply-Chain Regulation System Based on Blockchain-Cloud Fusion Scheme

With the blockchain-cloud fusion scheme, the food supply-chain regulation system overcomes the pain points of data sharing in the food industry. It is conductive to optimize the processes of information collection, quality inspection and supervision, and supply and marketing management. This part mainly introduces the system workflow.We will describe the system workflow from two aspects of data sharing and data consumption. The shared data consist of consumer reports and food industry shared data.


### 3.5.1. Industry Data Sharing

On receiving the shared data from enterprises and regulators in the food supply-chain, the system workflow is as shown in Figure3.Figure 3
System workflow of industry data sharing.We will take the food enterprise data sharing as an example to detail the system workflow as follows:(1)
Any system user should authenticate and register by the AA server first; then, the AA server would verify its identity and generate an anonymous private key. Each workflow needs this step so that we would not detail it again in other workflows.(2)
After authentication is completed, the enterprise manager can share data by defining a signing predicate on demand and then sending it to the enterprise AA server.(3)
The AA server generates an anonymity signature and sends the signature and the index of shared data to the blockchain network.(4)
Blockchain server firstly determines the validity of data via smart contract and generates a data block. Validate and then broadcast the block to make a consensus decision with PBFT algorithm.(5)
If more than 2/3 of the servers agree, the new data block will be stored in the blockchain.


### 3.5.2. Consumer Report

To promote social co-governance in food safety, the system provides an anonymous supervision report function for consumers and gives a reward in return. The system workflow of consumer reports is similar to the front workflow—the workflow is shown in Figure4.(1)
Consumers in the system report the food quality problems anonymously. They can define a signing predicate to generate an anonymous signature.(2)
The AA server would share the report content and signature to the blockchain. Then, verify and generate a new data block with a signal tag. Make a consensus decision and store the block into the block chain.(3)
The blockchain network will send an alert message to regulators to make a decision. The system will give a reward to the consumer in return if the alarm is validated for regulators.Figure 4
System workflow of consumer report.In addition, data consumption consists of consumers inquiring about food quality on-demand and accountability.


### 3.5.3. Inquire Food Quality on Demand

The system consumers inquire about food information, as shown in Figure5.(1)
Consumers can inquire about the quality information (including quality inspection report, source, process, and transport) of each link’s raw material in the food supply-chain from a blockchain network.(2)
It analyzes the data source index from the data block and gets the target data from the data owner’s server and then shows it to the consumer as a basis for food quality evaluation.Figure 5
System workflow of inquire food information.


### 3.5.4. Accountability

Due to blockchain’s tamper-proofing feature, the system provides traceability for regulators to track the person responsible for rumors and food quality incidents. We take tracking a rumor-monger as an example to detail the system workflow as follows (as shown in Figure6).(1)
The regulator chooses a rumor to track the monger from the blockchain network. The system will authenticate the regulator and record the action.(2)
Then, the system analyzes the rumor record, generates the rumor-monger’s ID, and returns it to the regulator, which can serve as a basis for the regulator to law enforcement [44].Figure 6
System workflow of accountability.


## 3.5.1. Industry Data Sharing

On receiving the shared data from enterprises and regulators in the food supply-chain, the system workflow is as shown in Figure3.Figure 3
System workflow of industry data sharing.We will take the food enterprise data sharing as an example to detail the system workflow as follows:(1)
Any system user should authenticate and register by the AA server first; then, the AA server would verify its identity and generate an anonymous private key. Each workflow needs this step so that we would not detail it again in other workflows.(2)
After authentication is completed, the enterprise manager can share data by defining a signing predicate on demand and then sending it to the enterprise AA server.(3)
The AA server generates an anonymity signature and sends the signature and the index of shared data to the blockchain network.(4)
Blockchain server firstly determines the validity of data via smart contract and generates a data block. Validate and then broadcast the block to make a consensus decision with PBFT algorithm.(5)
If more than 2/3 of the servers agree, the new data block will be stored in the blockchain.


## 3.5.2. Consumer Report

To promote social co-governance in food safety, the system provides an anonymous supervision report function for consumers and gives a reward in return. The system workflow of consumer reports is similar to the front workflow—the workflow is shown in Figure4.(1)
Consumers in the system report the food quality problems anonymously. They can define a signing predicate to generate an anonymous signature.(2)
The AA server would share the report content and signature to the blockchain. Then, verify and generate a new data block with a signal tag. Make a consensus decision and store the block into the block chain.(3)
The blockchain network will send an alert message to regulators to make a decision. The system will give a reward to the consumer in return if the alarm is validated for regulators.Figure 4
System workflow of consumer report.In addition, data consumption consists of consumers inquiring about food quality on-demand and accountability.


## 3.5.3. Inquire Food Quality on Demand

The system consumers inquire about food information, as shown in Figure5.(1)
Consumers can inquire about the quality information (including quality inspection report, source, process, and transport) of each link’s raw material in the food supply-chain from a blockchain network.(2)
It analyzes the data source index from the data block and gets the target data from the data owner’s server and then shows it to the consumer as a basis for food quality evaluation.Figure 5
System workflow of inquire food information.


## 3.5.4. Accountability

Due to blockchain’s tamper-proofing feature, the system provides traceability for regulators to track the person responsible for rumors and food quality incidents. We take tracking a rumor-monger as an example to detail the system workflow as follows (as shown in Figure6).(1)
The regulator chooses a rumor to track the monger from the blockchain network. The system will authenticate the regulator and record the action.(2)
Then, the system analyzes the rumor record, generates the rumor-monger’s ID, and returns it to the regulator, which can serve as a basis for the regulator to law enforcement [44].Figure 6
System workflow of accountability.


## 4. Security Analysis

Blockchain-cloud fusion scheme inherits some essential characteristics of blockchain and cloud service to protect the system’s data. The tamper-proof feature of blockchain ensures data reliability. PBFT-based consensus mechanism can improve the system robustness, and DABS algorithms protect the system’s safety and stability. In this work, system security mainly prevents the leakage of user privacy. Since the data interaction in the scheme is based on the DABS algorithm, and user privacy information is processed and generated by DABS, the DABS algorithm’s security is the most critical factor for the protection of the scheme. We will mainly analyze the security of the DABS algorithm in this section.


### 4.1. Theorem 1: Unconditional Full Anonymity

Proof.
This scheme can construct a sufficient signature if the signature attributes satisfy the signature predicateγS,ρ∪W⋅. With the predicate subset and default attributes mixed in the signature, the adversary Å cannot get signer attributes from the signature predicate. So, our scheme supports unconditional full anonymity if the adversary Å cannot get user identification information. According to the schemes [45], we construct the simulation as follows.(1)
Setup:An adversary Å challenges the access control predicateγS,ρ∪W⋅. The simulator ℂ calls algorithm Setup() and outputs the PK, MSK, and TK. Then, it public the PK and MSK to Å. The adversary Å can construct any private key.(2)
Challenge:In this phase, the Å chooses a random messageM′ and two attribute sets UIDii=1,2, where UIDii=1,2 satisfies the signature predicate γS,ρ′ and then the Å transmit the M′,UID1 and M′,UID2 to ℂ. The ℂ works as follows:(i)
Theℂ calls the algorithm Keygen() and returns the private key: SKID1 = D0,iID1,D1,iID1,D2,i,jID1 and SKID2 = D0,iID2,D1,iID2,D2,i,jID2.(ii)
The simulator chooses a bit,b ∈ {0, 1}, signs the message with M′,UIDb (detailed as Section 3.3), and outputs the signature δIDb to Å:(10)δIDb=δ1IDb,δ2IDb,δ3IDb,δ4IDb,ci∗i=1,…,k,πi∗i=1,…,k.(iii)
The Å guesses theb′ofbinδIDb=δ1IDb,δ2IDb,δ3IDb,δ4IDb, where δ1IDb=gri,jx∈W(11)δ2IDb=H2M′γ∏x∈ρSiδ1IDbωi∏i∈Group∏x∈WPiD1,iδ1δ3IDb=eg,H2M−γ∏x∈ρSigri,jD2,i,jIDb−ωiδ4IDb=eg,TsIDb.(3)
Guess:The adversary submits a guessb′ofb. If b′=b, Å wins the game, which means the scheme cannot support the unconditional full anonymity security. Next, we discuss why the Å cannot win the game.Assume the simulatorℂ selects b = 1, signature predicateγS,ρID1∪WID1⋅,and randomα1ands1. Then, it signs a message with M′,SKID1 and outputs δID1=δ1ID1,δ2ID1,δ3ID1,δ4ID1as follows:(12)δ1ID1=gri,jx∈Wδ2ID1=H2M′γ1∏x∈ρSigri,jgτλiHxtxgID1ΓIDi,kωi∏i∈Group∏x∈WID1gri,j=gτs1+∑i∈GroupΓIDi,1+∑i∈Group,x∈ρSi∪WID1ri,jH2M′γ1Hx∑x∈ρSitxδ3ID1=eg,H2M′−γ1g∑i∈GroupΓIDi,1Hx∑x∈ρSitxδ4ID1=eg,TsIDb=eg,gτs1.AsδID1 shows that only δ2ID1andδ3ID1 involve the user identification information, if there exists γS,ρID1∪WID1UID1=γS,ρID2∪WID2UID2, tx1x∈ρSi1=tx2x∈ρSi2, γID11=γID21, and ∑i∈GroupΓIDi,2+∑x∈ρSi2ri,j,2=∑i∈GroupΓIDi,1+∑x∈ρSi1ri,j,1, the simulator ℂ can generate the same signature δID1=δID2whatever a bit b chose. So, our scheme satisfies absolute full anonymity and does achieve perfect privacy.


### 4.2. Theorem 2: Noncollusion

Our scheme can provide defense against collusive attacks under adaptive selective messages and predicate attacks.Proof.
We describe our DABS scheme’s security model by the next game between simulatorℂ and adversary Å. The security model allows the adversary to query for any private keys that cannot be used to sign the challenge Message M [18]. Assume the adversaries can corrupt authorities statically, and the key queries are adaptively [46].
Assume there is a poly(t)-time algorithm Λ for the adversary Å can break our scheme with non-negligible advantages ε under the adaptive selection message and collusive attack. Define parameters qPRF,qH,qH2,qk,andqs used to label the query number of random oracles PRF, H, and H2, generate the SK and signature, respectively. So, there is a poly(t)-time algorithm Λ that can deal with the CDH problem with a non-negligible advantageε′=ε/qHqH2∏i∈SA∪tqiWiUi. The security simulation proceeds as follows:(1)
Initial:Assume predicateγS′,ρ∪W⋅ is a mini-subset of γS,ρ∪W⋅ and γS,ρ∪WS′,ρ = 1, where the attributes in γS′,ρ∪W⋅are managed by AAii=1,…,t. LetρS′=∑i=1tρSi′, and define the attribute set of users IDk is UIDk.Assume the corrupted AA group is SA =  AA1,AA2,…,AAt−1. The adversary Å can forge the signature only if another AAt is corrupted. So, the collusive attack effect of our scheme can be reducible to attack a signal node AAt. Define qt as the node AAt attacked probability and qt=1/n−t+1. The simulator ℂ chooses a default attributes set Wt for AAt.(2)
Setup:The simulatorℂ selects random exponent τ∈ZP∗. Send Pt=gxtandT=gτto adversary Å Select generators u′,u1,u2,…,uk∈G,h∈Gq and publish to Å.(3)
Query:The adversary Å can query by random oracleH,H2, SK, and signature. The simulator ℂ maintains the empty list LPRF,LH,LH2,andLkey; the processes is as follows:(i)
PRF query: the simulator ℂ maintains the list LPRF to store the result IDi,AAt,PRFtIDk,Υk. When receiving a query request IDi,AAt from Å, ℂ checks LPRF and returns the result if the request had been received. Otherwise, ℂ chooses random parametersak,t,ϱk∈ZP∗,setPRFtIDk=ak,t,Υk=gϱk and publishes to Å and then adds IDi,AAt,PRFtIDk,Υk into LPRF.(ii)
H Query: the simulator ℂ maintains the list LH to store the result jt,Ht,j. When receiving a query request jt from Å, ℂ checks LH and returns the result if the request had been received. Otherwise, ℂ processes as follows:(a)
Ifjt∈UIDk∩Ut∪Wt, it chooses a random parameter φt,j∈ZP∗, set Hjt=gφt,j, publishes to Å and then adds jt,Ht,j into LPRF.(b)
Ifjt∉UIDk∩Ut∪Wt,it chooses random parameters φt,j,ℶt,j∈ZP∗, publishes Hjt=gφt,jgℶt,j to Å and then adds jt,Ht,j into LPRF.(iii)
H2query: the simulator ℂ maintains the list LH2 to store the result Mi,H2,i and chooses random parameter ɛ∈1,qH2. When receiving a query request Mt from Å, ℂ checks LH2 and returns the result if the same value has been queried. Otherwise, C processes as follows:Ift=ɛ, it chooses ηt∈ZP∗ and publishes H2,t=gηt to Å. Then, it adds Mt,H2,t into LH2.Ift≠ɛ, it chooses φt′,ηt∈ZP∗ and publishes H2,t=gηtgφt′ to Å. Then, it adds Mt,H2,t into LH2.(iv)
SK query: the simulator ℂ maintains the list Lkey to store the result UIDk∩Ut,IDk,SKk,Pt. When receiving a query request UIDk∩Ut,IDk from Å, ℂ checks Lkey and returns the result if the same value has been queried. Otherwise, ℂ processes as follows:(a)
IfγSt′,ρ∪WUIDk∪Wt≠1, it returns SKIDk,t=D0,t=gλIDi,t=gak,t, D1,t=g−xt,D2,t,j=Hjti,jD0,i=gφt,jti,jD0,i|∀j∈UIDk∩Ut∪WtandPt=gxttoÅ. Then, adds UIDk∩Ut,IDk,Dt,j,j∈UIDk∩Ut∪Wt,Pt into Lkey.(b)
IfγSt′,ρ∪WUIDk∪Wt=1, it stops and defines the process event as E1.(v)
Signature query: on receiving a signature query of UIDk,IDk,Mt from Å, ℂ processes it as follows:(a)
IfγSt′,ρ∪WUIDk∪Wt=1, it checks UIDk∩Ui,IDk,SKk,Pii∈Group, Mt,H2,ii∈Groupand ji,Hi,ji∈Group,j∈UIDk∪Wt, then calls the algorithm Sign(.), and returns δIDk to Å.(b)
Else, it stops and defines the process event asE2.(7)
Challenge:(vi)
The adversary Å challenges the security under a collusive attack. It chooses any two usersID0,ID1 with the attribute sets UID0andUID1, respectively, whereγS′,ρ∪WUID0∪W≠1, γS′,ρ∪WUID1∪W≠1 and γS′,ρ∪WUID0∪UID1∪W′ = 1.(vii)
The adversary Å requires to queryID0,AAt and ID1,AAt, and ℂ checks LPRF and returns a0,t,a1,t respectively.(viii)
The adversary Å requires to queryUID0∩Ut,ID0 and UID1∩Ut,ID0, and ℂ checks Lkey and processes as follows:(ix)
SKID0,t=D0,t=ga0,t, D1,t=g−xt, D2,t,j=Hjti,jga0,t=gφt,jti,jD0,i|∀j∈UID1∩Ut∪WandPt=gxt.(x)
SKID1,t=D0,t=ga1,t,D1,t=g−xt,D2,t,j=Hjti,jD1,i=gφt,jti,jga1,t|∀j∈UID1∩Ut∪W, D1,t=g−xt, D2,t,j=Hjti,jD1,i=gφt,jti,jga1,t|∀j∈UID1∩Ut∪WandPt=gxt.So, the private key of the userID1 can be reconstructed as ID1′:(13)SKID1′,t=D0,t′=D1,tΥ1a0,t/a1,t=ga0,tgϱk′D1,t′=D1,t=g−xt,D2,t,j′=Hjti,jD0,t′=gφt,jti,jga0,tgϱk′|∀j∈UID1∩Ut∪WPt=gxt.The adversary Å can get the private key isSKID0,t∪SKID1′,t,Ptj∈UID0∪UID1′∪W′.(8)
Forgery:Å constructs a signatureγS′,ρ∪WUID0∪UID1∪W′,M′,δ′ where H2,t=gηt, and ℂ verifies correctness as follows:(14)eg,δ2′∗δ3′∏i∈Group∏x∈Weg,δ1′=eg,∏x∈ρSi0gri,jTλiD2,i,jωi∏x∈ρSi1gri,jTλiD2,i,jωi∏i∈SA∪t∏x∈WgxtD1,igri,j∏i∈SA∪t∏x∈W′eg,gri,j∗eg,∏x∈ρSi0gxiD1,i−ωi∏x∈ρSi1gxiD1,i−ωi=eg,∏x∈ρSi0gτλiωi∏x∈ρSi1gτλiωi=eg,gτs′=δ4′.So, we can getgτs′=δ2′δ3′/∏i∈SA∪t∏x∈Wt′δ1,x′. It means the CDH problem can be solved, and the advantageisε′=ε/qHqH2∏i∈SA∪tqiWiUi, where the probability of Hjt=gφt,j is 1/qH,H2,t=gηtis 1/qH2 and qi=1/n−i+1.


## 4.1. Theorem 1: Unconditional Full Anonymity

Proof.
This scheme can construct a sufficient signature if the signature attributes satisfy the signature predicateγS,ρ∪W⋅. With the predicate subset and default attributes mixed in the signature, the adversary Å cannot get signer attributes from the signature predicate. So, our scheme supports unconditional full anonymity if the adversary Å cannot get user identification information. According to the schemes [45], we construct the simulation as follows.(1)
Setup:An adversary Å challenges the access control predicateγS,ρ∪W⋅. The simulator ℂ calls algorithm Setup() and outputs the PK, MSK, and TK. Then, it public the PK and MSK to Å. The adversary Å can construct any private key.(2)
Challenge:In this phase, the Å chooses a random messageM′ and two attribute sets UIDii=1,2, where UIDii=1,2 satisfies the signature predicate γS,ρ′ and then the Å transmit the M′,UID1 and M′,UID2 to ℂ. The ℂ works as follows:(i)
Theℂ calls the algorithm Keygen() and returns the private key: SKID1 = D0,iID1,D1,iID1,D2,i,jID1 and SKID2 = D0,iID2,D1,iID2,D2,i,jID2.(ii)
The simulator chooses a bit,b ∈ {0, 1}, signs the message with M′,UIDb (detailed as Section 3.3), and outputs the signature δIDb to Å:(10)δIDb=δ1IDb,δ2IDb,δ3IDb,δ4IDb,ci∗i=1,…,k,πi∗i=1,…,k.(iii)
The Å guesses theb′ofbinδIDb=δ1IDb,δ2IDb,δ3IDb,δ4IDb, where δ1IDb=gri,jx∈W(11)δ2IDb=H2M′γ∏x∈ρSiδ1IDbωi∏i∈Group∏x∈WPiD1,iδ1δ3IDb=eg,H2M−γ∏x∈ρSigri,jD2,i,jIDb−ωiδ4IDb=eg,TsIDb.(3)
Guess:The adversary submits a guessb′ofb. If b′=b, Å wins the game, which means the scheme cannot support the unconditional full anonymity security. Next, we discuss why the Å cannot win the game.Assume the simulatorℂ selects b = 1, signature predicateγS,ρID1∪WID1⋅,and randomα1ands1. Then, it signs a message with M′,SKID1 and outputs δID1=δ1ID1,δ2ID1,δ3ID1,δ4ID1as follows:(12)δ1ID1=gri,jx∈Wδ2ID1=H2M′γ1∏x∈ρSigri,jgτλiHxtxgID1ΓIDi,kωi∏i∈Group∏x∈WID1gri,j=gτs1+∑i∈GroupΓIDi,1+∑i∈Group,x∈ρSi∪WID1ri,jH2M′γ1Hx∑x∈ρSitxδ3ID1=eg,H2M′−γ1g∑i∈GroupΓIDi,1Hx∑x∈ρSitxδ4ID1=eg,TsIDb=eg,gτs1.AsδID1 shows that only δ2ID1andδ3ID1 involve the user identification information, if there exists γS,ρID1∪WID1UID1=γS,ρID2∪WID2UID2, tx1x∈ρSi1=tx2x∈ρSi2, γID11=γID21, and ∑i∈GroupΓIDi,2+∑x∈ρSi2ri,j,2=∑i∈GroupΓIDi,1+∑x∈ρSi1ri,j,1, the simulator ℂ can generate the same signature δID1=δID2whatever a bit b chose. So, our scheme satisfies absolute full anonymity and does achieve perfect privacy.


## 4.2. Theorem 2: Noncollusion

Our scheme can provide defense against collusive attacks under adaptive selective messages and predicate attacks.Proof.
We describe our DABS scheme’s security model by the next game between simulatorℂ and adversary Å. The security model allows the adversary to query for any private keys that cannot be used to sign the challenge Message M [18]. Assume the adversaries can corrupt authorities statically, and the key queries are adaptively [46].
Assume there is a poly(t)-time algorithm Λ for the adversary Å can break our scheme with non-negligible advantages ε under the adaptive selection message and collusive attack. Define parameters qPRF,qH,qH2,qk,andqs used to label the query number of random oracles PRF, H, and H2, generate the SK and signature, respectively. So, there is a poly(t)-time algorithm Λ that can deal with the CDH problem with a non-negligible advantageε′=ε/qHqH2∏i∈SA∪tqiWiUi. The security simulation proceeds as follows:(1)
Initial:Assume predicateγS′,ρ∪W⋅ is a mini-subset of γS,ρ∪W⋅ and γS,ρ∪WS′,ρ = 1, where the attributes in γS′,ρ∪W⋅are managed by AAii=1,…,t. LetρS′=∑i=1tρSi′, and define the attribute set of users IDk is UIDk.Assume the corrupted AA group is SA =  AA1,AA2,…,AAt−1. The adversary Å can forge the signature only if another AAt is corrupted. So, the collusive attack effect of our scheme can be reducible to attack a signal node AAt. Define qt as the node AAt attacked probability and qt=1/n−t+1. The simulator ℂ chooses a default attributes set Wt for AAt.(2)
Setup:The simulatorℂ selects random exponent τ∈ZP∗. Send Pt=gxtandT=gτto adversary Å Select generators u′,u1,u2,…,uk∈G,h∈Gq and publish to Å.(3)
Query:The adversary Å can query by random oracleH,H2, SK, and signature. The simulator ℂ maintains the empty list LPRF,LH,LH2,andLkey; the processes is as follows:(i)
PRF query: the simulator ℂ maintains the list LPRF to store the result IDi,AAt,PRFtIDk,Υk. When receiving a query request IDi,AAt from Å, ℂ checks LPRF and returns the result if the request had been received. Otherwise, ℂ chooses random parametersak,t,ϱk∈ZP∗,setPRFtIDk=ak,t,Υk=gϱk and publishes to Å and then adds IDi,AAt,PRFtIDk,Υk into LPRF.(ii)
H Query: the simulator ℂ maintains the list LH to store the result jt,Ht,j. When receiving a query request jt from Å, ℂ checks LH and returns the result if the request had been received. Otherwise, ℂ processes as follows:(a)
Ifjt∈UIDk∩Ut∪Wt, it chooses a random parameter φt,j∈ZP∗, set Hjt=gφt,j, publishes to Å and then adds jt,Ht,j into LPRF.(b)
Ifjt∉UIDk∩Ut∪Wt,it chooses random parameters φt,j,ℶt,j∈ZP∗, publishes Hjt=gφt,jgℶt,j to Å and then adds jt,Ht,j into LPRF.(iii)
H2query: the simulator ℂ maintains the list LH2 to store the result Mi,H2,i and chooses random parameter ɛ∈1,qH2. When receiving a query request Mt from Å, ℂ checks LH2 and returns the result if the same value has been queried. Otherwise, C processes as follows:Ift=ɛ, it chooses ηt∈ZP∗ and publishes H2,t=gηt to Å. Then, it adds Mt,H2,t into LH2.Ift≠ɛ, it chooses φt′,ηt∈ZP∗ and publishes H2,t=gηtgφt′ to Å. Then, it adds Mt,H2,t into LH2.(iv)
SK query: the simulator ℂ maintains the list Lkey to store the result UIDk∩Ut,IDk,SKk,Pt. When receiving a query request UIDk∩Ut,IDk from Å, ℂ checks Lkey and returns the result if the same value has been queried. Otherwise, ℂ processes as follows:(a)
IfγSt′,ρ∪WUIDk∪Wt≠1, it returns SKIDk,t=D0,t=gλIDi,t=gak,t, D1,t=g−xt,D2,t,j=Hjti,jD0,i=gφt,jti,jD0,i|∀j∈UIDk∩Ut∪WtandPt=gxttoÅ. Then, adds UIDk∩Ut,IDk,Dt,j,j∈UIDk∩Ut∪Wt,Pt into Lkey.(b)
IfγSt′,ρ∪WUIDk∪Wt=1, it stops and defines the process event as E1.(v)
Signature query: on receiving a signature query of UIDk,IDk,Mt from Å, ℂ processes it as follows:(a)
IfγSt′,ρ∪WUIDk∪Wt=1, it checks UIDk∩Ui,IDk,SKk,Pii∈Group, Mt,H2,ii∈Groupand ji,Hi,ji∈Group,j∈UIDk∪Wt, then calls the algorithm Sign(.), and returns δIDk to Å.(b)
Else, it stops and defines the process event asE2.(7)
Challenge:(vi)
The adversary Å challenges the security under a collusive attack. It chooses any two usersID0,ID1 with the attribute sets UID0andUID1, respectively, whereγS′,ρ∪WUID0∪W≠1, γS′,ρ∪WUID1∪W≠1 and γS′,ρ∪WUID0∪UID1∪W′ = 1.(vii)
The adversary Å requires to queryID0,AAt and ID1,AAt, and ℂ checks LPRF and returns a0,t,a1,t respectively.(viii)
The adversary Å requires to queryUID0∩Ut,ID0 and UID1∩Ut,ID0, and ℂ checks Lkey and processes as follows:(ix)
SKID0,t=D0,t=ga0,t, D1,t=g−xt, D2,t,j=Hjti,jga0,t=gφt,jti,jD0,i|∀j∈UID1∩Ut∪WandPt=gxt.(x)
SKID1,t=D0,t=ga1,t,D1,t=g−xt,D2,t,j=Hjti,jD1,i=gφt,jti,jga1,t|∀j∈UID1∩Ut∪W, D1,t=g−xt, D2,t,j=Hjti,jD1,i=gφt,jti,jga1,t|∀j∈UID1∩Ut∪WandPt=gxt.So, the private key of the userID1 can be reconstructed as ID1′:(13)SKID1′,t=D0,t′=D1,tΥ1a0,t/a1,t=ga0,tgϱk′D1,t′=D1,t=g−xt,D2,t,j′=Hjti,jD0,t′=gφt,jti,jga0,tgϱk′|∀j∈UID1∩Ut∪WPt=gxt.The adversary Å can get the private key isSKID0,t∪SKID1′,t,Ptj∈UID0∪UID1′∪W′.(8)
Forgery:Å constructs a signatureγS′,ρ∪WUID0∪UID1∪W′,M′,δ′ where H2,t=gηt, and ℂ verifies correctness as follows:(14)eg,δ2′∗δ3′∏i∈Group∏x∈Weg,δ1′=eg,∏x∈ρSi0gri,jTλiD2,i,jωi∏x∈ρSi1gri,jTλiD2,i,jωi∏i∈SA∪t∏x∈WgxtD1,igri,j∏i∈SA∪t∏x∈W′eg,gri,j∗eg,∏x∈ρSi0gxiD1,i−ωi∏x∈ρSi1gxiD1,i−ωi=eg,∏x∈ρSi0gτλiωi∏x∈ρSi1gτλiωi=eg,gτs′=δ4′.So, we can getgτs′=δ2′δ3′/∏i∈SA∪t∏x∈Wt′δ1,x′. It means the CDH problem can be solved, and the advantageisε′=ε/qHqH2∏i∈SA∪tqiWiUi, where the probability of Hjt=gφt,j is 1/qH,H2,t=gηtis 1/qH2 and qi=1/n−i+1.


## 5. Performance Analysis

To evaluate the performance of the schemes, we present theoretical analysis of storage complexity and experimental simulation of computation efficiency. Assume the group order in our scheme has the same length with the group order ofG in comparison schemes. The parameter notation description is shown in Table 2.Table 2
Notations.
NotationsDescriptionUAThe universe AA setUi|i∈UAThe attribute set managed byAAiUIDiThe attribute set of usersIDiUIDi,jThe attribute set ofUIDi∩UjpThe length of the element inZpIDiThe size of the userIDiGThe element size in groupGGTThe element size in the groupGTnThe total number of registered users in the schemeSl∗kThe access control strategy matrix andl is the number of attributesdThe default attribute setNThe number of AA server


### 5.1. Storage Complexity

The storage complexity is one of the most evaluation indexes of the food supply-chain regulation system. Compared with a traditional cloud-based system, our system’s storage cost mainly focuses on the blockchain and DABS algorithm. Since the blockchain network data primarily comes from DABS, we will mainly analyze the DABS algorithm’s storage complexity.As shown in Table3, we analyze the performance of the DABS scheme by comparing it with GSZ18’s scheme [26], LW10’s scheme [40], SZW18’s scheme [27], YJ13’s scheme [47], and RW13’s scheme [48]. These schemes adopt LSSS access control strategy except for [GSZ18] scheme with tree access control strategy. The AA storage overhead, which is used to store the master key and AA’s secret key, is Ui+1p in our scheme. It is significantly less than [LW10], [SZW18], and [GSZ18]. Since the AA in [YJ13] stores all users’ private keys to re-encrypt the ciphertext and update information during the revocation, the AA storage overhead will be less in our scheme if the number of users more than half of Ui. Besides, compared with the normally anonymity for private keys in other schemes, we improve the security of users' private keys to unconditional full anonymity.Table 3
Comparison among different attribute-based signature schemes.
Scheme[YJ13][LW10][SZW18][RW13][GSZ18]OursAA storage overhead2n+1p2Uip∑i∈UAUi2p+GT+GpUi+N+1pUi+1pUserIDi storage overhead3p+∑j∈UAUIDi,j+2GUIDiGUIDiG+p2UIDi+2G+UIDipUIDiG+p+GUIDi+d+2GSignature size4l+3|G|l+1GT+2lGl+1GT+pSl∗kp+ρ+GT+3l+1)GGT+3UIDi+l+3G2GT+d+2IDi+1GMultiauthorityYes, but it needed a fully trusted CANo, but scalableYesNoYesYesPredicateMonotoneMonotoneMonotoneMonotoneMonotoneMonotoneAuthority corruption typeWeakStrong (N -1)Strong (N-1)NoStrong (N-2)Strong (N-1)User storage overhead used to store the users’ private key isUIDi+d+2G in our scheme, that is, better than 2UIDi+2G + UIDip in [RW13] and UIDiG+p+G in [GZW18]. The [GZW18] scheme costs communication time oN2 to communicate with AA to generate user private key, while it costs oN in ours. Further more, our signature size is 2GT+d+2|IDi|+1G that is more effective than [RW13] and [GSZ18]. And, our signature storage overhead has nothing with user attributes, which means that the future expansion of the system has little impact on the DABS algorithm. It provides a solution to track the signer identity by storing each parameter of IDi. If the size of IDi is set appropriately, the storage complexity of our scheme will be superior to the schemes [YJ13], [SZW18], [RW13], and [GSZ18].


### 5.2. Computation Efficiency

We implement our scheme, [LW10] scheme, [RW13] scheme, scheme in [49] (named as [BSW07]), and [27] scheme (named as [SUN18]) in window 10 system with an Intel (R) Core(TM) i7-8565U CPU @ 1.8 GHz 1.99 GHz and 8 GB RAM. And, the server is deployed in VMware® Workstation 15 Pro with the configuration shown in Table 4. It uses the Java Pairing-Based Cryptography (PBC) library version 2.0 to implement the access control schemes. We choose an asymmetric elliptic curve where the order p is a 160 bit length prime. Define the size of plaintext, G generator, and GT generator is 128 Byte. We take the average value of 20 experiments as the final experimental result.Table 4
Deployment environment.
ElementsParametersCPU cores4Processor1CPU modelIntel (R) core(TM) i7-8565U CPU @ 1.8 GHz 1.99 GHzRAM2 GBSCSI60 GBIt mainly compares the time efficiency of setup, private key generation, signature, and verification. Figure7(a) describes the comparison of setup time. Our scheme’s performance is much better than [LW10] scheme and [SUN18] scheme, because they spend too much time calculating the complex pairing operations. Figure 3(b) describes the comparison of key generation time where the number of default attributes is 5. Our scheme’s key generation time is less than [BSW07] scheme and [RW13] scheme. Figure 7(d) describes the comparison of verification time. It shows that our scheme incurs less verification time than others. Besides, our scheme support batch-verification with time complexity O⋅+n compared nO⋅ in other schemes. So, if batch signatures are verified, our system’s advantage will be more significant.Figure 7
Comparison of computation time. (a) Setup. (b) Key generation. (c) Signature generation. (d) Verification.
(a)(b)(c)(d)Figure7(c) describes the performance comparison of signature algorithms, where the number of default attributes is 5. When the size of user attribute set is less than 25, the advantage of our scheme is not obvious compared with other schemes. But, once the user attributes size exceeds 25, the advantages of our scheme will gradually emerge. Because, our scheme takes some computational cost in terms of user attributes anonymity and identity tracking, including calculate 2IDibilinear operation to establish traceable evidence of user identity, which helps government regulators track down the malicious user. So, our scheme is more suitable for large and complex industry network.


## 5.1. Storage Complexity

The storage complexity is one of the most evaluation indexes of the food supply-chain regulation system. Compared with a traditional cloud-based system, our system’s storage cost mainly focuses on the blockchain and DABS algorithm. Since the blockchain network data primarily comes from DABS, we will mainly analyze the DABS algorithm’s storage complexity.As shown in Table3, we analyze the performance of the DABS scheme by comparing it with GSZ18’s scheme [26], LW10’s scheme [40], SZW18’s scheme [27], YJ13’s scheme [47], and RW13’s scheme [48]. These schemes adopt LSSS access control strategy except for [GSZ18] scheme with tree access control strategy. The AA storage overhead, which is used to store the master key and AA’s secret key, is Ui+1p in our scheme. It is significantly less than [LW10], [SZW18], and [GSZ18]. Since the AA in [YJ13] stores all users’ private keys to re-encrypt the ciphertext and update information during the revocation, the AA storage overhead will be less in our scheme if the number of users more than half of Ui. Besides, compared with the normally anonymity for private keys in other schemes, we improve the security of users' private keys to unconditional full anonymity.Table 3
Comparison among different attribute-based signature schemes.
Scheme[YJ13][LW10][SZW18][RW13][GSZ18]OursAA storage overhead2n+1p2Uip∑i∈UAUi2p+GT+GpUi+N+1pUi+1pUserIDi storage overhead3p+∑j∈UAUIDi,j+2GUIDiGUIDiG+p2UIDi+2G+UIDipUIDiG+p+GUIDi+d+2GSignature size4l+3|G|l+1GT+2lGl+1GT+pSl∗kp+ρ+GT+3l+1)GGT+3UIDi+l+3G2GT+d+2IDi+1GMultiauthorityYes, but it needed a fully trusted CANo, but scalableYesNoYesYesPredicateMonotoneMonotoneMonotoneMonotoneMonotoneMonotoneAuthority corruption typeWeakStrong (N -1)Strong (N-1)NoStrong (N-2)Strong (N-1)User storage overhead used to store the users’ private key isUIDi+d+2G in our scheme, that is, better than 2UIDi+2G + UIDip in [RW13] and UIDiG+p+G in [GZW18]. The [GZW18] scheme costs communication time oN2 to communicate with AA to generate user private key, while it costs oN in ours. Further more, our signature size is 2GT+d+2|IDi|+1G that is more effective than [RW13] and [GSZ18]. And, our signature storage overhead has nothing with user attributes, which means that the future expansion of the system has little impact on the DABS algorithm. It provides a solution to track the signer identity by storing each parameter of IDi. If the size of IDi is set appropriately, the storage complexity of our scheme will be superior to the schemes [YJ13], [SZW18], [RW13], and [GSZ18].


## 5.2. Computation Efficiency

We implement our scheme, [LW10] scheme, [RW13] scheme, scheme in [49] (named as [BSW07]), and [27] scheme (named as [SUN18]) in window 10 system with an Intel (R) Core(TM) i7-8565U CPU @ 1.8 GHz 1.99 GHz and 8 GB RAM. And, the server is deployed in VMware® Workstation 15 Pro with the configuration shown in Table 4. It uses the Java Pairing-Based Cryptography (PBC) library version 2.0 to implement the access control schemes. We choose an asymmetric elliptic curve where the order p is a 160 bit length prime. Define the size of plaintext, G generator, and GT generator is 128 Byte. We take the average value of 20 experiments as the final experimental result.Table 4
Deployment environment.
ElementsParametersCPU cores4Processor1CPU modelIntel (R) core(TM) i7-8565U CPU @ 1.8 GHz 1.99 GHzRAM2 GBSCSI60 GBIt mainly compares the time efficiency of setup, private key generation, signature, and verification. Figure7(a) describes the comparison of setup time. Our scheme’s performance is much better than [LW10] scheme and [SUN18] scheme, because they spend too much time calculating the complex pairing operations. Figure 3(b) describes the comparison of key generation time where the number of default attributes is 5. Our scheme’s key generation time is less than [BSW07] scheme and [RW13] scheme. Figure 7(d) describes the comparison of verification time. It shows that our scheme incurs less verification time than others. Besides, our scheme support batch-verification with time complexity O⋅+n compared nO⋅ in other schemes. So, if batch signatures are verified, our system’s advantage will be more significant.Figure 7
Comparison of computation time. (a) Setup. (b) Key generation. (c) Signature generation. (d) Verification.
(a)(b)(c)(d)Figure7(c) describes the performance comparison of signature algorithms, where the number of default attributes is 5. When the size of user attribute set is less than 25, the advantage of our scheme is not obvious compared with other schemes. But, once the user attributes size exceeds 25, the advantages of our scheme will gradually emerge. Because, our scheme takes some computational cost in terms of user attributes anonymity and identity tracking, including calculate 2IDibilinear operation to establish traceable evidence of user identity, which helps government regulators track down the malicious user. So, our scheme is more suitable for large and complex industry network.


## 6. Conclusion

We have proposed a food supply-chain regulation system based on a blockchain-cloud fusion scheme. It did not let the source data not out of data owners to protect enterprises’ benefit and reserves the original system architecture to reduce the cost. Then, we presented a security DABS scheme and proved the scheme withunconditional full anonymity and non-collusion. Our scheme will be more effective in complex industry networks. Besides, the system can promote the social co-governance of food safety, which is essential to the food industry’s sustainable development. The blockchain-cloud fusion scheme is a promising technique applied in democratic elections systems, online social networks, social co-governance in other industries, etc. [43, 50–56]



---

*Source: 6668339-2021-03-27.xml*