# Blockchain-Based Fine-Grained Data Sharing for Multiple Groups in Internet of Things

Authors: Teng Li; Jiawei Zhang; Yangxu Lin; Shengkai Zhang; Jianfeng Ma
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Cloud-based Internet of Things, which is considered as a promising paradigm these days, can provide various applications for our society. However, as massive sensitive and private data in IoT devices are collected and outsourced to cloud for data storage, processing, or sharing for cost saving, the data security has become a bottleneck for its further development. Moreover, in many large-scale IoT systems, multiple group data sharing is practical for users. Thus, how to ensure data security in multiple group data sharing remains an open problem, especially the fine-grained access control and data integrity verification with public auditing. Therefore, in this paper, we propose a blockchain-based fine-grained data sharing scheme for multiple groups in cloud-based IoT systems. In particular, we design a novel multiauthority large universe CP-ABE scheme to guarantee the fine-grained access control and data integrity across multiple groups by integrating group signature into our scheme. Moreover, to ease the need for a trusted third auditor in traditional data public auditing schemes, we introduce blockchain technique to enable a distributed data public auditing. In addition, with the group signature, our scheme also realizes anonymity and traitor tracing. The security analysis and performance evaluation show that our scheme is practical for large-scale IoT systems.


---

## Body

## 1. Introduction

The Internet of Things (IoT) brings the power of the Internet, data processing, and analytics to the real world of physical objects. The fast development of IoT has greatly facilitated a variety of applications all over the world, such as the Internet of Vehicles (IoV), Industrial Internet of Things (IIoT), and Health Internet of Things (HIoT) [1]. All explosive numbers of embedded internet-enabled sensors provide an incredibly rich set of data that device owners can use to gather data about the safety of their operations, track assets, and reduce manual processes. The device providers can also use the IoT to gather data about people’s preferences and behavior, though that can have serious privacy and security implications. Therefore, how to store and share these data can be a challenging problem. With cloud computing assistance, the enormous storage and computation resources can accommodate those massive data in IoT applications. As shown in Figure 1, the ubiquitous IoT devices gather all kinds of data, for example, health records, location data, and personal privacy information, and upload these data to the cloud, which can significantly lower their local burden for data storage, processing, and sharing.Figure 1
: An overview of cloud-based IoT.Although cloud-based IoT provides many conveniences for users, data security and privacy have become serious problems when vast amounts of sensitive and private IoT data are stored and shared in untrusted cloud servers. There have been many catastrophic accidents in data sharing services of cloud, such as iCloud and AWS Cloud. The cloud service providers may unconsciously leak sensitive information or even delete these outsourced user data [2]. Therefore, many researchers have dedicated their research to data security in sharing scenarios. The works in [3–6] solve the data access control for data sharing in various scenarios and the proposals in [7–10] focus on the data integrity verification and public auditing. However, as the scale of data and services in the cloud grows, the multiple group data sharing emerges as a promising application for data sharing between users in different groups [11–13], such as multiple health study organizations and multiple businesses. However, all of the above schemes fail to support data security protection in multiple group data sharing scenarios, which is a big challenge. The approach in [14] proposes a multiple group data sharing scheme that provides the data auditing and integrity verification and trace mechanism with the help of blockchain. Nevertheless, the approach suffers from the lack of data confidentiality and fine-grained access control, especially the single point failure problem in large-scale IoT systems, which can be another challenge for data sharing in multiple groups.To address these challenging issues in multiple group data sharing, we propose a comprehensive data sharing approach to guarantee data security from the aspects of data fine-grained access control, data integrity verification, and public auditing. Besides, with multiauthority attribute-based encryption and blockchain techniques, our proposal enables data integrity without a trusted third party. It makes the data access control more flexible in a large attribute universe, user traceability, and multiple authorities. The security analysis and experimental evaluation demonstrate the security and efficiency of our work. In conclusion, our contribution can be summarized as follows:We firstly present blockchain-based fine-grained data sharing for multiple groups in cloud-based IoT system, which can achieve the data integrity verification, public auditing, and fine-grained access control simultaneously providing a comprehensive security for data security.A multiauthority ciphertext-policy access control scheme is designed for fine-grained data sharing, which can support large attribute universe and avoid single point failure for authority in large-scale systems. Our scheme extends to multiple group data sharing with the group signature and blockchain techniques and enables user anonymity and traceability with data integrity.We present a detailed security analysis to demonstrate that our scheme satisfies the security goals of our system. Extensive experiment with the implementation is also provided, and the evaluation results depict the efficiency of our scheme, which proves that our scheme is secure and practical.The remainder of this paper is structured as follows. Section2 introduces and reviews the related work on identity authentication. Then, in Section 3, a motivating example of our scheme is given together with attacker mode. Our approach’s overview is presented in Section 4. Following this, in Section 5, we describe in detail the system design and, in Section 6, we show the performance evaluation for our proposal. Finally, a conclusion is presented for our work in Section 7.


## 2. Related Work

This section reviews some related works on attribute-based encryption (ABE) and blockchain techniques.


### 2.1. Attribute-Based Encryption

To guarantee data fine-grained access control, ABE was first introduced by literature [15] as a promising paradigm. Then, [16] divided this scheme into two classes: CP-ABE and KP-ABE (Key-Policy ABE), where the former requires the data owner to designate an access policy for ciphertext and the latter for user key. As the access policy is embedded into ciphertext enabling data owner to control data access on his own, CP-ABE attracts great attention and, for the design of flexible access control scheme according to data owner’s requirements, we emphasize on the CP-ABE scheme in our work. Later, many studies dedicated to CP-ABE are proposed, such as large universe CP-ABE [17], traceable CP-ABE, and revocable CP-ABE [18].Traditionally, in design of CP-ABE schemes, the system model involves just one trusted authority for attribute management and key distribution. However, this brings the failure of single point and has become the bottleneck in large-scale system. Thus, literature [19] introduced a decentralized architecture for multiple attribute authority that collaboratively manages users and attribute universe. Recently, the proposal in [20] has realized multiauthority CP-ABE with large attribute universe and white-box traceability, while the ability of user tracing is limited and just suitable for certain scenarios. The multiauthority CP-ABE scheme [21] highlights the efficiency in traceable decentralized CP-ABE scheme, while it also suffers from the same drawback with [20].


### 2.2. Blockchain

Blockchain can be regarded as a distributed database based on blockchain technology [22–25]. It has the characteristics of openness, tamper-resistance, decentralization, and autonomy. The data recorded on the blockchain cannot be tampered with or modified. A blockchain can be regarded as a decentralized, trusted third party. The decentralization of blockchain provides a feasible solution for the construction of a security scheme without a trusted third party. Blockchain enables users to build a shared, distributed, and fault-tolerant database [26]. Ghoshal et al. [27] proposed the first auditing mechanism without a third-party requirement. Blockchain-based data auditing can provide tamper-proof records and enable data accountability in the cloud.At present, blockchain network can be divided into three categories: public blockchain, private blockchain, and alliance blockchain. We present a specific data-sharing scheme for multiple groups based on the concept of consortium blockchain. The nodes in the alliance chain are well connected and the verification efficiency is high. While providing high-speed transaction processing, it can maintain the operation with the minimum cost, reduce the transaction cost, and have good scalability. The data can maintain privacy to a certain extent.


## 2.1. Attribute-Based Encryption

To guarantee data fine-grained access control, ABE was first introduced by literature [15] as a promising paradigm. Then, [16] divided this scheme into two classes: CP-ABE and KP-ABE (Key-Policy ABE), where the former requires the data owner to designate an access policy for ciphertext and the latter for user key. As the access policy is embedded into ciphertext enabling data owner to control data access on his own, CP-ABE attracts great attention and, for the design of flexible access control scheme according to data owner’s requirements, we emphasize on the CP-ABE scheme in our work. Later, many studies dedicated to CP-ABE are proposed, such as large universe CP-ABE [17], traceable CP-ABE, and revocable CP-ABE [18].Traditionally, in design of CP-ABE schemes, the system model involves just one trusted authority for attribute management and key distribution. However, this brings the failure of single point and has become the bottleneck in large-scale system. Thus, literature [19] introduced a decentralized architecture for multiple attribute authority that collaboratively manages users and attribute universe. Recently, the proposal in [20] has realized multiauthority CP-ABE with large attribute universe and white-box traceability, while the ability of user tracing is limited and just suitable for certain scenarios. The multiauthority CP-ABE scheme [21] highlights the efficiency in traceable decentralized CP-ABE scheme, while it also suffers from the same drawback with [20].


## 2.2. Blockchain

Blockchain can be regarded as a distributed database based on blockchain technology [22–25]. It has the characteristics of openness, tamper-resistance, decentralization, and autonomy. The data recorded on the blockchain cannot be tampered with or modified. A blockchain can be regarded as a decentralized, trusted third party. The decentralization of blockchain provides a feasible solution for the construction of a security scheme without a trusted third party. Blockchain enables users to build a shared, distributed, and fault-tolerant database [26]. Ghoshal et al. [27] proposed the first auditing mechanism without a third-party requirement. Blockchain-based data auditing can provide tamper-proof records and enable data accountability in the cloud.At present, blockchain network can be divided into three categories: public blockchain, private blockchain, and alliance blockchain. We present a specific data-sharing scheme for multiple groups based on the concept of consortium blockchain. The nodes in the alliance chain are well connected and the verification efficiency is high. While providing high-speed transaction processing, it can maintain the operation with the minimum cost, reduce the transaction cost, and have good scalability. The data can maintain privacy to a certain extent.


## 3. Preliminaries

The section presents several relevant notions and definitions employed in our paper.


### 3.1. Notations

We summarize several notations used in our scheme as well as their descriptions in Table1.Table 1
Notation description.
NotationsDescriptionsn1,…,nG∗,GT∗Two multiplicative cyclic groupsGPKGlobal public keySKGID,SSecret attribute key for DUAPKAuthority public keyASKAuthority secret keyCsCiphertext component encrypted by symmetric algorithmA,ρLSSS access policyCTpThe ciphertext component encrypted with ABE algorithmsCTThe whole ciphertext


### 3.2. Access Structure

Definition 1 (access structures [3]).
Suppose thatL1,…,Ln is a parties set. One of the collections L⊆2L1,…,Ln is considered to be monotone if∀M,N:M∈LandM⊆M,thenN∈L. An access structure that is monotone is defined as one of the nonempty subsets L of L1,…,Ln,i.e.,L⊆2L1,…,Ln/∅. The elements in L are defined as authorized sets and the other sets are defined as unauthorized sets. Without loss of generality, we can describe users with their attribute set.


### 3.3. Linear Secret Sharing Scheme (LSSS)

Definition 2 (LSSS [28]).
A secret sharing scheme over the attribute set is called linear overℤp if it satisfies the following : 1. the secret share for each attribute can form a vector over ℤp, 2. there is a matrix M with h rows and n columns and a function for Π that maps each row Mj to an attribute. For any j=1,…,h, let the function φ define the attribute that labels the jth row as φj. Given the column vector v⟶=s,x2,…,xnT, in which T is the transpose of the vector v⟶, s is the secret that will be shared, and x2,…,xn∈ℤp are uniformly chosen at random; then Mv⟶ is the vector of h shares of the secret s based on Π. The share Mv⟶j belongs to the attribute φj.
Let attribute setS∈A∧S∈S be any anthorized attribute set, and let J=j|j∈1,…,h∧φj∈S. Then, there exist constants nj∈ℤpj∈J such that if sjj∈J are vaild shares of a secret s according to Π, then Πj∈Jnjsj=S.


### 3.4. Group Signature

First proposed by Chaum and van Heyst in 1991 [29], group signature aims to sign a message in the name of the group for any group member. In a group signature scheme, any group member can sign a message anonymously on behalf of the entire group. Similar to a general digital signature, a group signature is publicly verifiable and can be verified by a single group public key. Moreover, the actual identity of the signer in the system cannot be traced by the verifier. Only the group manager can identify the real signer. A group signature scheme should satisfy the following requirements:Unforgeability. No one can generate a valid group signature except the members of the group.Anonymity. Given a group signature, determining the identity of the signer is computationally infeasible for anyone except the manager of the group.Traceability. The group manager can trace the real identity of a malicious user when a dispute occurs.Unlinkability. Without opening the group signature, it is difficult to distinguish whether two different signatures are made by the same group member.Nonframeability. No one, including the group manager, can generate a valid group signature in the name of other group members.The advantageous property of a group signature is that it enables suitable anonymity in various scenarios.


### 3.5. Merkle Hash Tree

The Merkle hash tree [30] is a specific binary tree that can be used to authenticate data. As shown in Figure 2, assume that we want to use a MHT to authenticate a file F. We divide file F into L file blocks and construct a MHT with L leaves, which store the hash values of f1,…,fL. Figure 2 depicts an example of a MHT. File F has been divided into 4 blocks. The verifier has the root hash value HR and requests f2. He requires authentication of the received file. The prover provides the verifier the auxiliary authentication information Ω=Hf1,HB. The verifier receives Ω and then computes HA=HHf1‖Hf2,HR′=HHA‖HB. Finally, the verifier checks whether HR′ is the same as HR.Figure 2
An example of MHT.


### 3.6. Blockchain

Definition 3 (blockchain [31]).
The blockchain technology was first used for bitcoin, introduced by Nakamoto in 2008 [31]. In recent years, the attitude of bitcoin has been rising and falling in the world, but as one of the underlying technologies of bitcoin, blockchain technology has been paid more and more attention. In the process of bitcoin formation, blocks are storage units one by one, recording all the communication information of each block node in a certain period of time. Each block is linked by random hash (also known as hash algorithm). The latter block contains the hash value of the previous block. With the expansion of information exchange, one block is connected with another block, and the result is called blockchain [32]. In essence, it is a shared database. The data or information stored in it has the characteristics of “unforgeability,” “whole process trace,” “traceability,” “openness and transparency,” and “collective maintenance.” Based on these characteristics, blockchain technology has laid a solid “trust” foundation, created a reliable “cooperation” mechanism, and has broad application prospects.


### 3.7. Cryptographic Background

Definition 4 (bilinear maps [3]).
We consider twop-ordered G0 and G1 groups that are multiplicative cyclic, where p is a prime. ε,ɛ are two generators of group G0. If the map e^:G0×G0⟶G1 satisfies the following properties, then we call it a bilinear map:(1)
Bilinearity:e^εa,ɛb=e^ε,ɛab,∀a,b∈Zp,ε,ɛ∈G(2)
Nondegeneracy:e^ε,ɛ≠1G1, e^ε,ε is a generator of G1(3)
Computability:e^ε,ɛ is efficiently computable for all ε,ɛ∈G0


## 3.1. Notations

We summarize several notations used in our scheme as well as their descriptions in Table1.Table 1
Notation description.
NotationsDescriptionsn1,…,nG∗,GT∗Two multiplicative cyclic groupsGPKGlobal public keySKGID,SSecret attribute key for DUAPKAuthority public keyASKAuthority secret keyCsCiphertext component encrypted by symmetric algorithmA,ρLSSS access policyCTpThe ciphertext component encrypted with ABE algorithmsCTThe whole ciphertext


## 3.2. Access Structure

Definition 1 (access structures [3]).
Suppose thatL1,…,Ln is a parties set. One of the collections L⊆2L1,…,Ln is considered to be monotone if∀M,N:M∈LandM⊆M,thenN∈L. An access structure that is monotone is defined as one of the nonempty subsets L of L1,…,Ln,i.e.,L⊆2L1,…,Ln/∅. The elements in L are defined as authorized sets and the other sets are defined as unauthorized sets. Without loss of generality, we can describe users with their attribute set.


## 3.3. Linear Secret Sharing Scheme (LSSS)

Definition 2 (LSSS [28]).
A secret sharing scheme over the attribute set is called linear overℤp if it satisfies the following : 1. the secret share for each attribute can form a vector over ℤp, 2. there is a matrix M with h rows and n columns and a function for Π that maps each row Mj to an attribute. For any j=1,…,h, let the function φ define the attribute that labels the jth row as φj. Given the column vector v⟶=s,x2,…,xnT, in which T is the transpose of the vector v⟶, s is the secret that will be shared, and x2,…,xn∈ℤp are uniformly chosen at random; then Mv⟶ is the vector of h shares of the secret s based on Π. The share Mv⟶j belongs to the attribute φj.
Let attribute setS∈A∧S∈S be any anthorized attribute set, and let J=j|j∈1,…,h∧φj∈S. Then, there exist constants nj∈ℤpj∈J such that if sjj∈J are vaild shares of a secret s according to Π, then Πj∈Jnjsj=S.


## 3.4. Group Signature

First proposed by Chaum and van Heyst in 1991 [29], group signature aims to sign a message in the name of the group for any group member. In a group signature scheme, any group member can sign a message anonymously on behalf of the entire group. Similar to a general digital signature, a group signature is publicly verifiable and can be verified by a single group public key. Moreover, the actual identity of the signer in the system cannot be traced by the verifier. Only the group manager can identify the real signer. A group signature scheme should satisfy the following requirements:Unforgeability. No one can generate a valid group signature except the members of the group.Anonymity. Given a group signature, determining the identity of the signer is computationally infeasible for anyone except the manager of the group.Traceability. The group manager can trace the real identity of a malicious user when a dispute occurs.Unlinkability. Without opening the group signature, it is difficult to distinguish whether two different signatures are made by the same group member.Nonframeability. No one, including the group manager, can generate a valid group signature in the name of other group members.The advantageous property of a group signature is that it enables suitable anonymity in various scenarios.


## 3.5. Merkle Hash Tree

The Merkle hash tree [30] is a specific binary tree that can be used to authenticate data. As shown in Figure 2, assume that we want to use a MHT to authenticate a file F. We divide file F into L file blocks and construct a MHT with L leaves, which store the hash values of f1,…,fL. Figure 2 depicts an example of a MHT. File F has been divided into 4 blocks. The verifier has the root hash value HR and requests f2. He requires authentication of the received file. The prover provides the verifier the auxiliary authentication information Ω=Hf1,HB. The verifier receives Ω and then computes HA=HHf1‖Hf2,HR′=HHA‖HB. Finally, the verifier checks whether HR′ is the same as HR.Figure 2
An example of MHT.


## 3.6. Blockchain

Definition 3 (blockchain [31]).
The blockchain technology was first used for bitcoin, introduced by Nakamoto in 2008 [31]. In recent years, the attitude of bitcoin has been rising and falling in the world, but as one of the underlying technologies of bitcoin, blockchain technology has been paid more and more attention. In the process of bitcoin formation, blocks are storage units one by one, recording all the communication information of each block node in a certain period of time. Each block is linked by random hash (also known as hash algorithm). The latter block contains the hash value of the previous block. With the expansion of information exchange, one block is connected with another block, and the result is called blockchain [32]. In essence, it is a shared database. The data or information stored in it has the characteristics of “unforgeability,” “whole process trace,” “traceability,” “openness and transparency,” and “collective maintenance.” Based on these characteristics, blockchain technology has laid a solid “trust” foundation, created a reliable “cooperation” mechanism, and has broad application prospects.


## 3.7. Cryptographic Background

Definition 4 (bilinear maps [3]).
We consider twop-ordered G0 and G1 groups that are multiplicative cyclic, where p is a prime. ε,ɛ are two generators of group G0. If the map e^:G0×G0⟶G1 satisfies the following properties, then we call it a bilinear map:(1)
Bilinearity:e^εa,ɛb=e^ε,ɛab,∀a,b∈Zp,ε,ɛ∈G(2)
Nondegeneracy:e^ε,ɛ≠1G1, e^ε,ε is a generator of G1(3)
Computability:e^ε,ɛ is efficiently computable for all ε,ɛ∈G0


## 4. System Model and Security Requirements

We present the system and threat model as well as corresponding security requirements for our work in this section.


### 4.1. System Model

Figure3 shows the model of our system for HTR-DAC. It consists of five entities: cloud service provider (CSP), attribute authorities (AAs), agencies (ACs), data user (DU), and data owner (DO), which are described as follows:CSP: the CSP provides large amounts of resources, such as storage and computation. It can also publish various services.AA: the AA is in charge of attribute assignment and secret key distribution and generation for users.DO: the DO produces a large amount of data and outsources them to CSP for saving cost and data sharing. Before data uploading, he will encrypt the data and designate a specific access policy. He also generates corresponding group signature for data integrity verification.DU: the DU enjoys the data sharing service. Only authorized DU can access and recover the plaintext by his secret key. Any user can publicly audit shared data through blockchain and interaction with CSP.AC: the AC takes charge of user in a group. It is responsible for data uploading and blockchain operation. When a user uploads the data, AC will forward the ciphertext and record corresponding verification information into blockchain for public auditing.Figure 3
An overview of cloud-based IoT.


### 4.2. Threat Model

In our proposal, the AAs, ACs, and DO are regarded as the fully trusted entities, while the CSP is considered to be untrusted, which may intentionally leak the sensitive information or even tamper and delete the shared data of users. Moreover, some unauthorized DU may illegally access the sensitive data by collusion attack, which will break the data security and privacy. Aiming to resist these attacks, we take the following security requirements into consideration:Data confidentiality: DO should guarantee the confidentiality of his data and any DU can access the shared data if and only if his access rights satisfy the access policy of the dataCollusion resistance: any users in the system should not have the ability to combine their secret keys to make them satisfy the access policy and thus access the shared data illegallyAnonymity: as the real identity of user, especially in IoT systems, may contain some privacy, to prevent the user privacy from leakage, the ciphertext should be shared without leaking real identityAuditability: each system user can publicly verify the integrity of the shared data instead of deploying a trusted auditorTraceability: when a dispute occurs, the agencies can trace the real identity of a malicious user for traitor tracingIn addition to these security requirements, we also raise the following performance related design goals for our scheme:Large universe: the system should afford large attribute universe; that is, any string can be employed as an attribute for system users and the system and attribute authorities need no global parameters for each attribute.Multiauthority: the system should support multiple attribute authorities that collaboratively manage the attribute universe. That is, attribute authorities should take charge of user attribute assignment and attribute secret keys generation.


### 4.3. System Framework

According the above system model, the procedure of our system includes several phases as follows:Initialization. In this phase, the system finishes initialization and generates global public key and publishes these parameters to the whole system. Then, the attribute authorities generate their own public keys and secret keys and also publish their public keys in system domain.Authorization. In this phase, each user is registered into the system by a joining request. The attribute authorities collaboratively assign attribute secret key components to each user according to his attribute set. Moreover, the agencies generate signing secret key for each user. At the end, each user can get his secret key after successfully taking part in the system.Encryption. In this phase, each DO encrypts his data produced by himself by a symmetric encryption algorithm with designating a specific access policy for fine-grained access control. Also, the user needs to create group signature for data integrity verification, public auditing, and traitor tracing. When an integrated ciphertext is generated, the user sends it to the agency in charge and, subsequently, the agency checks the ciphertext and uploads it to cloud and records the verification information into blockchain by related algorithms.Data Auditing. In this phase, each user in system can publicly audit the data without a trusted auditor and many computations and communication overhead. As the verification information is recorded in blockchain without being tampered, the user can successfully execute data auditing algorithm and gets its results.Decryption. In this phase, DU requests to access the data file according to the auditing result. If the DU is authorized, that is, he has enough access rights, then DU can decrypt the shared ciphertext and check its integrity.User Tracing. In this phase, as we leverage the group signature and ABE technique, the user identity is hidden from the ciphertexts. Any time a dispute happens, the data owner will be traced by revealing its real identity with the group signature mechanism by corresponding agency. Moreover, the group signature also guarantees the avoidance of being framed.Here, we describe the formal definition of our scheme. A blockchain-based fine-grained data-sharing scheme for multiple groups consists of the following algorithms:SetupGκ,k,l: given the security parameters κ,k,l, the algorithm initializes the whole system and generates global public parameter GPK.SetupAGPK: on inputting the global public parameter GPK, the algorithm generates public key APK and secret key ASK for each attribute authority.KeyGenGPK,GID,S,ASKj: after receiving the global public key GPK, the user’s global identity GID, and attribute set S as well as the corresponding authority public key set ASKj, the algorithm generates secret key for each system user.EncryptGPK,M,A,ρ,APKj: given the global public key GPK, the message to be outsourced M together with its access policy A,ρ, and the authority public key set ASKj, the algorithm computes all components of ciphertext which are encrypted by symmetric encryption and CP-ABE.SigGenGPK,Cs,Cp: the algorithm generates group signature for ciphertext output in Encrypt algorithm and returns the final ciphertext. The algorithm not only uploads the final ciphertext to cloud but also records the verification information into blockchain through relevant transaction.AuditGPK: the algorithm is executed by any system user to verify data stored in cloud publicly. Given the global public key GPK, the algorithm checks the integrity of shared ciphertext with verification information recorded in blockchain and the auxiliary information from cloud.DecryptGPK,CT,SKGID,S: given the global public key GPK, user’s secret key SKGID,S, and the ciphertext CT to be accessed, the algorithm is executed by user GID. It can verify the data with signature verification algorithm and decrypts CT if he has authorized secret key.TraceGPK,SigG: if a dispute happens, the data owner needs to be traced by exposing his real identity executed by corresponding agency ACi. Given the global public key GPK and the signature of the ciphertext SigG, ACi can recover the real identity of data owner denoted by his certificate.


### 4.4. Security Model

In this section, we present a static security model for multiauthority CP-ABE schemes by a security game between an adversary and a challenger.Setup. The challenger runs the global setup algorithm of multiauthority CP-ABE and gives the global parameter GPK to the adversary.Adversary’s Queries. The adversary proceeds as follows:It chooses a corrupt authority setC⊂U and sends the public keys of these corrupt authorities to the challenger.It chooses a good authority setN⊂U and queries the public keys of these good authorities.It makes secret key queries for a sequenceSj,GIDjj=1m, where GIDj is an identity and Sj⊂U is an attributes set. In this sequence, we require that the identities GIDj be different and none of these keys come from a corrupt authority; that is, TSj∩C=∅.It specifies two equal-length messagesM0,M1 and an access structure A,ρ to the challenger for a challenge ciphertext. We require that, for each identity GIDj, this access structure A,ρ cannot be satisfied by SCθ∪Sj, where SCθ is the set of all the attributes that are controlled by the corrupt authorities.Challenger’s Replies. The challenger flips a random coin b∈0,1 and gives the adversary with the following:The public keysPKθθ∈N corresponding to the good authorities NThe secret keysSKSj,GIDjj=1m corresponding to Sj,GIDjj=1mThe challenge ciphertextCT∗⟵EncryptGPK,PK,M,A,ρGuess. The adversary outputs a guess b′ for b. The advantage of the adversary in this game is defined as Prb=b′−1/2.Definition 5.
A multiauthority CP-ABE scheme is statically secure (against static corruption of authorities) if all polynomial time adversaries have at most a negligible advantage in this security game.


## 4.1. System Model

Figure3 shows the model of our system for HTR-DAC. It consists of five entities: cloud service provider (CSP), attribute authorities (AAs), agencies (ACs), data user (DU), and data owner (DO), which are described as follows:CSP: the CSP provides large amounts of resources, such as storage and computation. It can also publish various services.AA: the AA is in charge of attribute assignment and secret key distribution and generation for users.DO: the DO produces a large amount of data and outsources them to CSP for saving cost and data sharing. Before data uploading, he will encrypt the data and designate a specific access policy. He also generates corresponding group signature for data integrity verification.DU: the DU enjoys the data sharing service. Only authorized DU can access and recover the plaintext by his secret key. Any user can publicly audit shared data through blockchain and interaction with CSP.AC: the AC takes charge of user in a group. It is responsible for data uploading and blockchain operation. When a user uploads the data, AC will forward the ciphertext and record corresponding verification information into blockchain for public auditing.Figure 3
An overview of cloud-based IoT.


## 4.2. Threat Model

In our proposal, the AAs, ACs, and DO are regarded as the fully trusted entities, while the CSP is considered to be untrusted, which may intentionally leak the sensitive information or even tamper and delete the shared data of users. Moreover, some unauthorized DU may illegally access the sensitive data by collusion attack, which will break the data security and privacy. Aiming to resist these attacks, we take the following security requirements into consideration:Data confidentiality: DO should guarantee the confidentiality of his data and any DU can access the shared data if and only if his access rights satisfy the access policy of the dataCollusion resistance: any users in the system should not have the ability to combine their secret keys to make them satisfy the access policy and thus access the shared data illegallyAnonymity: as the real identity of user, especially in IoT systems, may contain some privacy, to prevent the user privacy from leakage, the ciphertext should be shared without leaking real identityAuditability: each system user can publicly verify the integrity of the shared data instead of deploying a trusted auditorTraceability: when a dispute occurs, the agencies can trace the real identity of a malicious user for traitor tracingIn addition to these security requirements, we also raise the following performance related design goals for our scheme:Large universe: the system should afford large attribute universe; that is, any string can be employed as an attribute for system users and the system and attribute authorities need no global parameters for each attribute.Multiauthority: the system should support multiple attribute authorities that collaboratively manage the attribute universe. That is, attribute authorities should take charge of user attribute assignment and attribute secret keys generation.


## 4.3. System Framework

According the above system model, the procedure of our system includes several phases as follows:Initialization. In this phase, the system finishes initialization and generates global public key and publishes these parameters to the whole system. Then, the attribute authorities generate their own public keys and secret keys and also publish their public keys in system domain.Authorization. In this phase, each user is registered into the system by a joining request. The attribute authorities collaboratively assign attribute secret key components to each user according to his attribute set. Moreover, the agencies generate signing secret key for each user. At the end, each user can get his secret key after successfully taking part in the system.Encryption. In this phase, each DO encrypts his data produced by himself by a symmetric encryption algorithm with designating a specific access policy for fine-grained access control. Also, the user needs to create group signature for data integrity verification, public auditing, and traitor tracing. When an integrated ciphertext is generated, the user sends it to the agency in charge and, subsequently, the agency checks the ciphertext and uploads it to cloud and records the verification information into blockchain by related algorithms.Data Auditing. In this phase, each user in system can publicly audit the data without a trusted auditor and many computations and communication overhead. As the verification information is recorded in blockchain without being tampered, the user can successfully execute data auditing algorithm and gets its results.Decryption. In this phase, DU requests to access the data file according to the auditing result. If the DU is authorized, that is, he has enough access rights, then DU can decrypt the shared ciphertext and check its integrity.User Tracing. In this phase, as we leverage the group signature and ABE technique, the user identity is hidden from the ciphertexts. Any time a dispute happens, the data owner will be traced by revealing its real identity with the group signature mechanism by corresponding agency. Moreover, the group signature also guarantees the avoidance of being framed.Here, we describe the formal definition of our scheme. A blockchain-based fine-grained data-sharing scheme for multiple groups consists of the following algorithms:SetupGκ,k,l: given the security parameters κ,k,l, the algorithm initializes the whole system and generates global public parameter GPK.SetupAGPK: on inputting the global public parameter GPK, the algorithm generates public key APK and secret key ASK for each attribute authority.KeyGenGPK,GID,S,ASKj: after receiving the global public key GPK, the user’s global identity GID, and attribute set S as well as the corresponding authority public key set ASKj, the algorithm generates secret key for each system user.EncryptGPK,M,A,ρ,APKj: given the global public key GPK, the message to be outsourced M together with its access policy A,ρ, and the authority public key set ASKj, the algorithm computes all components of ciphertext which are encrypted by symmetric encryption and CP-ABE.SigGenGPK,Cs,Cp: the algorithm generates group signature for ciphertext output in Encrypt algorithm and returns the final ciphertext. The algorithm not only uploads the final ciphertext to cloud but also records the verification information into blockchain through relevant transaction.AuditGPK: the algorithm is executed by any system user to verify data stored in cloud publicly. Given the global public key GPK, the algorithm checks the integrity of shared ciphertext with verification information recorded in blockchain and the auxiliary information from cloud.DecryptGPK,CT,SKGID,S: given the global public key GPK, user’s secret key SKGID,S, and the ciphertext CT to be accessed, the algorithm is executed by user GID. It can verify the data with signature verification algorithm and decrypts CT if he has authorized secret key.TraceGPK,SigG: if a dispute happens, the data owner needs to be traced by exposing his real identity executed by corresponding agency ACi. Given the global public key GPK and the signature of the ciphertext SigG, ACi can recover the real identity of data owner denoted by his certificate.


## 4.4. Security Model

In this section, we present a static security model for multiauthority CP-ABE schemes by a security game between an adversary and a challenger.Setup. The challenger runs the global setup algorithm of multiauthority CP-ABE and gives the global parameter GPK to the adversary.Adversary’s Queries. The adversary proceeds as follows:It chooses a corrupt authority setC⊂U and sends the public keys of these corrupt authorities to the challenger.It chooses a good authority setN⊂U and queries the public keys of these good authorities.It makes secret key queries for a sequenceSj,GIDjj=1m, where GIDj is an identity and Sj⊂U is an attributes set. In this sequence, we require that the identities GIDj be different and none of these keys come from a corrupt authority; that is, TSj∩C=∅.It specifies two equal-length messagesM0,M1 and an access structure A,ρ to the challenger for a challenge ciphertext. We require that, for each identity GIDj, this access structure A,ρ cannot be satisfied by SCθ∪Sj, where SCθ is the set of all the attributes that are controlled by the corrupt authorities.Challenger’s Replies. The challenger flips a random coin b∈0,1 and gives the adversary with the following:The public keysPKθθ∈N corresponding to the good authorities NThe secret keysSKSj,GIDjj=1m corresponding to Sj,GIDjj=1mThe challenge ciphertextCT∗⟵EncryptGPK,PK,M,A,ρGuess. The adversary outputs a guess b′ for b. The advantage of the adversary in this game is defined as Prb=b′−1/2.Definition 5.
A multiauthority CP-ABE scheme is statically secure (against static corruption of authorities) if all polynomial time adversaries have at most a negligible advantage in this security game.


## 5. Blockchain-Based Fine-Grained Data Sharing for Multiple Groups

In this section, we describe our proposal by giving the overview of the system and the concrete construction.


### 5.1. Overview

Our scheme aims to protect the shared data across multiple groups. It highlights the aspects of data integrity and fine-grained access simultaneously. To ease the overhead of a trusted third party as auditor, we introduce blockchain to fulfill public data auditing; and the feature of tamper-resistance in blockchain also makes it trusted and public. Moreover, we leverage group signature and ABE to achieve anonymity, fine-grained access control, traceability, and nonframeability.We letUa denote the attribute universe and UA is the authority universe. In our scheme, the attribute universe in Ua is expressed as any string which satisfies the large universe attribute. As in [20], we also define a map H:Ua⟶UA from an attribute to the index of the authority in charge. That is, for ∀atti∈Ua, it belongs to authority AAHatti.


### 5.2. Concrete Construction

Here, we describe the concrete construction of our proposal. In particular, our scheme involves such algorithms:Setup, CreateTopDA, CreateEntity, TKeyGen, Encrypt, TokenGen, Trap, DecryptOUT, DecryptU, and DecVerify, which are described in detail subsequently.


#### 5.2.1. Initialization Phase

This phase consists of two algorithms for system setup and authority setup.SetupGκ,k,l: given the security parameter κ,k,l, the algorithm creates two big primes p,q of κ bits and generates a bilinear group G∗,GT∗,p,g,e^, where G∗,GT∗ are two multiplicative cyclic groups with order p, g is a generator of G∗, and e^:G∗×G∗⟶GT∗ is a bilinear map. It also chooses hash functions H0:0,1∗⟶G∗,H1:Ua⟶G∗,H2:0,1∗⟶Zp and a pair of symmetric encryption algorithms Encs,Decs. Moreover, the algorithm computes Q1=2p+1,Q2=2q+1 and selects elements h,a1,a2,g0,g1,g2,δ1,δ2∈RQRn, where n=Q1Q2 and QRn denotes the quadratic residue of Zp∗. Finally, the algorithm publishes the global public key as GPK=G∗,GT∗,g,h,a1,a2,g0,g1,g2,δ1,δ2,e^,H,H0,H1,H2,Encs,Decs.SetupAGPK: each attribute authority AAi∈UA randomly selects αi,βi∈Zp. Then, it picks θi∈Zp and computes Yi=gθi. Finally, it publishes its public key APKi=e^g,gαi,gβi,Yi and keeps their master key ASKi=αi,βi,θi privately.


#### 5.2.2. Registration Phase

This phase consists of the key generation algorithm to generate secret key for each user according to his attribute set.KeyGenGPK,GID,S,ASKj: given the global public key GPK, the user global identity GID, and his attribute set S as well as the master key ASKj of attribute authorities that each attribute belongs to (different attribute in S may belong to the same authority), for each atti∈S, the corresponding attribute authority AAj (j=Hatti) chooses μ∈RZp and generates the secret attribute key components SKGID,ii∈S for user GID according to attribute set S, where(1)SKGID,i=DGID,i=gαjH0GIDβjH1attiμ,DGID,i′=gμ.Then, the userGID randomly picks dGID∈2u2,eGID∈n and computes fGID,1=g0dGIDg0eGID. The user GID sends fGID,1 to the agency ACi and receives bGID,cGID∈R2u2 from ACi after successfully verifying the user GID by checking if fGID∈QRn. The user GID then computes dGID′=2u1+bGIDdGID+cGIDmod2u2,fGID,2=a1dGID and sends fGID,2 to ACi. After checking fGID,2∈QRn, ACi randomly selects LGID∈B and computes KGID=fGID,2a21/LGID and returns KGID,LGID to the user GID. If successfully checked with a1dGID′a2=KGIDLGID, the algorithm generates the secret key for the user GID as SKGID,S=KGID,LGID,SKGID,ii∈S, where KGID,LGID is the user certificate used for signature generation and user identifying.


#### 5.2.3. Encryption Phase

The phase includes two steps: encrypting and signing. The former algorithm finishes the work of symmetric encryption and attribute-based encryption for fine-grained access, while the latter is responsible for group signature generation to ensure the data integrity and auditing.EncryptGPK,M,A,ρ,PKj: when data owner decides to outsource and share the data M with a designated LSSS access policy A,ρ, where A is a l×m share-generating matrix and ρ is a corresponding map from a row Ax of A to an attribute attx∈Ua, that is, ρAx=attx, where x∈l, we can also infer that, with the map H of GPK, we can get the index j=Hattx of the corresponding attribute authority in charge of the attribute attx; that is, H maps each row Ax to a specific authority AAj.First of all, the algorithm chooses a random elementk∈GT∗ and computes Cs=Encsk,M to get the encrypted data, where Encs is the symmetric encryption algorithm in GPK.Then, the algorithm selects two random vectorsγ=s,γ2,…,γm and γ′=0,γ2′,…,γm′, where s,γi,γi′∈RZp. Thus, it can get λx=Ax⋅γ which is the share component of s for each attribute ρi corresponding to x-th row Ax, and λ′=Ax⋅γ′ which is the share component of 0 for each attribute of access policy. Moreover, the algorithm computes the ciphertext according to the policy after choosing rx∈Zp, where x∈l, and gets Cp=C,Cx,1,Cx,2,,Cx,3,,Cx,4x∈l, where(2)C=k⋅e^g,gs,∀x∈l:Cx,1=e^g,gλx+αHρxrx,Cx,2=grx,Cx,3=gβHρxrxgλx′,Cx,4=H1ρxrx,SigGenGPK,Cs,Cp: after receiving the encrypted data Cs with symmetric encryption, the algorithm divides it into M parts, that is, Cs1,Cs2,…,CsM, and computes hash value of each part with hash function H2 of GPK to get Hf=H2Cs1,…,H2CsM and its root hash value HR according to MHT algorithm. Then, the algorithm selects random values r∈0,12l and computes T1=KGIDYir,T2=g0r,T3=g0LGIDhr. Moreover, the algorithm selects other random numbers r1∈0,1κγ1+k,r2∈0,1κλ2+k,r3∈0,1κγ1+2l+k+1,r4∈0,1κ2l+k and computes d1=T1r1/a1r2Yjr3,d1=T2r1/gr3,d3=gr4,d4=gr1hr4 as well as the hash value Hv=H2ghYa1a2T1T2T3d1d2d3d4HR‖Cp. In addition, it outputs the signature SigG=c,s1,s2,s3,s4,T1,T2,T3, where(3)s1=r1−cei−2γ1,s2=r2−cxi−2λ2,s3=r3−crei,s4=r4−cr.Finally, the algorithm outputs the ciphertextCT=IDf,Cs,Cp,SigG,Hf,HR,M, where IDf is the identity of the file and M is the number of Hf, and outsources it to ACi which is the managing agency in charge of the user GID.Subsequently, the agencyACi needs to verify the shared ciphertext CT by Algorithm 1 and Cs,Hf,HR with MHT verification algorithm. If successful, ACi uploads CT to the cloud and stores the verification information to blockchain as described in Algorithm 2.Algorithm 1: Signature verification.
Input:GPK: system public keyCT: messageσG: the group signature of message MOutput:True/False: the verification result.(1) Compute the following values:d1′=a1cT1s1−c2γ1/a1s2−c2γ1Ys3d2′=T2s1−c2γ1/gs3d3′=T2cgs4d4′=T3cgs1−c2γ1hs4(2) GM randomly selectsei∈B computes Ai=C2a21/ei, then sends Ai,ei to UAVi as its member certificate.(3) UserGID checks if a1xi′a2=Aiei. If successful, then Ai,ei is its signing key.(4)ifc′=cthen(5)returnTrue(6)else(7)returnFalse(8)end ifAlgorithm 2: Storage transaction.
Input:GPK: system public keyVI: verification information HR,M,SigG,IDf,ωOutput:True/False: the verification result.(1) The nodes of the blockchain compute Merkle root valueHR′ with ω, where ω is the information for the nodes to verify Merkle root HR and get verification result Verby execute Algorithm 1 with SigG.(2)ifHR′=HR and Ver=Truethen(3)  create a new block to storeHR,M,SigG,IDf,t where t is the timestamp.(4)else(5) abort(6)end if


#### 5.2.4. Data Auditing

AuditGPK: the algorithm is executed by any system user to audit the shared data. Due to the transparency of data in blockchain, any user can finish data auditing instead of a trusted public auditor. As described in algorithm Encrypt, the verification information of each file is stored in blockchain, and the users in system can get the information including HR,SigG,M. Thus, with the auxiliary information from cloud, each system user audits the data as follows:(1)
The algorithm chooses a numbert∈RN∗ and M%t=0 and divides the leaves of Merkle tree for the file IDf into t subgroups. Then, it computes rs=PRHRt,δ, where PR is a cryptographic pseudorandom generator and δ∈t−1.(2)
After receiving the auxiliary information from cloud, the algorithm computesHR′ by constructing a path to the root of Merkle tree. It checks if HR=HR′ and PRHR′t,δ=rs. If the verification is successful, the data are validated.


#### 5.2.5. Decryption Phase

DecryptGPK,CT,SKGID,S: given the secret key SKGID,S of data user and the ciphertext CT, the algorithm can find a set of constances ωx∈Zp which makes the equation ∑x=1lwxAx=1,0,…,0 hold if the data user is authorized. Then, for each row x∈l of access policy, the algorithm computes(4)Rx=Cx,1⋅e^H0GID,Cx,3⋅e^DGID,ρx′,Cx,4e^DGID,ρx,Cx,2,=e^g,gλxe^H0GID,gλx′.Next, according to the constancesωx, the algorithm computes the following equation:(5)R=∏x=1lRωx=e^g,gs,k=CR,Ml=Decsk,Cs.Finally, the algorithm outputs the recovered plaintextM of data.


#### 5.2.6. User Tracing

TraceGPK,SigG: if there exists a dispute each time, the DO should be traced by recovering his real identity by the agency ACi in charge of the DO. As a member of blockchain, ACi requests the blockchain for traitor tracing. The blockchain responds to the ACi with the disputable data after running consensus protocol by which at least two-thirds of nodes in blockchain confirm the validity of the request and generate the new block as the proof of traitor tracing with synchronization.Then, the algorithm computesKGID=T1/T2θi and gets the corresponding identity of user being traced.


## 5.1. Overview

Our scheme aims to protect the shared data across multiple groups. It highlights the aspects of data integrity and fine-grained access simultaneously. To ease the overhead of a trusted third party as auditor, we introduce blockchain to fulfill public data auditing; and the feature of tamper-resistance in blockchain also makes it trusted and public. Moreover, we leverage group signature and ABE to achieve anonymity, fine-grained access control, traceability, and nonframeability.We letUa denote the attribute universe and UA is the authority universe. In our scheme, the attribute universe in Ua is expressed as any string which satisfies the large universe attribute. As in [20], we also define a map H:Ua⟶UA from an attribute to the index of the authority in charge. That is, for ∀atti∈Ua, it belongs to authority AAHatti.


## 5.2. Concrete Construction

Here, we describe the concrete construction of our proposal. In particular, our scheme involves such algorithms:Setup, CreateTopDA, CreateEntity, TKeyGen, Encrypt, TokenGen, Trap, DecryptOUT, DecryptU, and DecVerify, which are described in detail subsequently.


### 5.2.1. Initialization Phase

This phase consists of two algorithms for system setup and authority setup.SetupGκ,k,l: given the security parameter κ,k,l, the algorithm creates two big primes p,q of κ bits and generates a bilinear group G∗,GT∗,p,g,e^, where G∗,GT∗ are two multiplicative cyclic groups with order p, g is a generator of G∗, and e^:G∗×G∗⟶GT∗ is a bilinear map. It also chooses hash functions H0:0,1∗⟶G∗,H1:Ua⟶G∗,H2:0,1∗⟶Zp and a pair of symmetric encryption algorithms Encs,Decs. Moreover, the algorithm computes Q1=2p+1,Q2=2q+1 and selects elements h,a1,a2,g0,g1,g2,δ1,δ2∈RQRn, where n=Q1Q2 and QRn denotes the quadratic residue of Zp∗. Finally, the algorithm publishes the global public key as GPK=G∗,GT∗,g,h,a1,a2,g0,g1,g2,δ1,δ2,e^,H,H0,H1,H2,Encs,Decs.SetupAGPK: each attribute authority AAi∈UA randomly selects αi,βi∈Zp. Then, it picks θi∈Zp and computes Yi=gθi. Finally, it publishes its public key APKi=e^g,gαi,gβi,Yi and keeps their master key ASKi=αi,βi,θi privately.


### 5.2.2. Registration Phase

This phase consists of the key generation algorithm to generate secret key for each user according to his attribute set.KeyGenGPK,GID,S,ASKj: given the global public key GPK, the user global identity GID, and his attribute set S as well as the master key ASKj of attribute authorities that each attribute belongs to (different attribute in S may belong to the same authority), for each atti∈S, the corresponding attribute authority AAj (j=Hatti) chooses μ∈RZp and generates the secret attribute key components SKGID,ii∈S for user GID according to attribute set S, where(1)SKGID,i=DGID,i=gαjH0GIDβjH1attiμ,DGID,i′=gμ.Then, the userGID randomly picks dGID∈2u2,eGID∈n and computes fGID,1=g0dGIDg0eGID. The user GID sends fGID,1 to the agency ACi and receives bGID,cGID∈R2u2 from ACi after successfully verifying the user GID by checking if fGID∈QRn. The user GID then computes dGID′=2u1+bGIDdGID+cGIDmod2u2,fGID,2=a1dGID and sends fGID,2 to ACi. After checking fGID,2∈QRn, ACi randomly selects LGID∈B and computes KGID=fGID,2a21/LGID and returns KGID,LGID to the user GID. If successfully checked with a1dGID′a2=KGIDLGID, the algorithm generates the secret key for the user GID as SKGID,S=KGID,LGID,SKGID,ii∈S, where KGID,LGID is the user certificate used for signature generation and user identifying.


### 5.2.3. Encryption Phase

The phase includes two steps: encrypting and signing. The former algorithm finishes the work of symmetric encryption and attribute-based encryption for fine-grained access, while the latter is responsible for group signature generation to ensure the data integrity and auditing.EncryptGPK,M,A,ρ,PKj: when data owner decides to outsource and share the data M with a designated LSSS access policy A,ρ, where A is a l×m share-generating matrix and ρ is a corresponding map from a row Ax of A to an attribute attx∈Ua, that is, ρAx=attx, where x∈l, we can also infer that, with the map H of GPK, we can get the index j=Hattx of the corresponding attribute authority in charge of the attribute attx; that is, H maps each row Ax to a specific authority AAj.First of all, the algorithm chooses a random elementk∈GT∗ and computes Cs=Encsk,M to get the encrypted data, where Encs is the symmetric encryption algorithm in GPK.Then, the algorithm selects two random vectorsγ=s,γ2,…,γm and γ′=0,γ2′,…,γm′, where s,γi,γi′∈RZp. Thus, it can get λx=Ax⋅γ which is the share component of s for each attribute ρi corresponding to x-th row Ax, and λ′=Ax⋅γ′ which is the share component of 0 for each attribute of access policy. Moreover, the algorithm computes the ciphertext according to the policy after choosing rx∈Zp, where x∈l, and gets Cp=C,Cx,1,Cx,2,,Cx,3,,Cx,4x∈l, where(2)C=k⋅e^g,gs,∀x∈l:Cx,1=e^g,gλx+αHρxrx,Cx,2=grx,Cx,3=gβHρxrxgλx′,Cx,4=H1ρxrx,SigGenGPK,Cs,Cp: after receiving the encrypted data Cs with symmetric encryption, the algorithm divides it into M parts, that is, Cs1,Cs2,…,CsM, and computes hash value of each part with hash function H2 of GPK to get Hf=H2Cs1,…,H2CsM and its root hash value HR according to MHT algorithm. Then, the algorithm selects random values r∈0,12l and computes T1=KGIDYir,T2=g0r,T3=g0LGIDhr. Moreover, the algorithm selects other random numbers r1∈0,1κγ1+k,r2∈0,1κλ2+k,r3∈0,1κγ1+2l+k+1,r4∈0,1κ2l+k and computes d1=T1r1/a1r2Yjr3,d1=T2r1/gr3,d3=gr4,d4=gr1hr4 as well as the hash value Hv=H2ghYa1a2T1T2T3d1d2d3d4HR‖Cp. In addition, it outputs the signature SigG=c,s1,s2,s3,s4,T1,T2,T3, where(3)s1=r1−cei−2γ1,s2=r2−cxi−2λ2,s3=r3−crei,s4=r4−cr.Finally, the algorithm outputs the ciphertextCT=IDf,Cs,Cp,SigG,Hf,HR,M, where IDf is the identity of the file and M is the number of Hf, and outsources it to ACi which is the managing agency in charge of the user GID.Subsequently, the agencyACi needs to verify the shared ciphertext CT by Algorithm 1 and Cs,Hf,HR with MHT verification algorithm. If successful, ACi uploads CT to the cloud and stores the verification information to blockchain as described in Algorithm 2.Algorithm 1: Signature verification.
Input:GPK: system public keyCT: messageσG: the group signature of message MOutput:True/False: the verification result.(1) Compute the following values:d1′=a1cT1s1−c2γ1/a1s2−c2γ1Ys3d2′=T2s1−c2γ1/gs3d3′=T2cgs4d4′=T3cgs1−c2γ1hs4(2) GM randomly selectsei∈B computes Ai=C2a21/ei, then sends Ai,ei to UAVi as its member certificate.(3) UserGID checks if a1xi′a2=Aiei. If successful, then Ai,ei is its signing key.(4)ifc′=cthen(5)returnTrue(6)else(7)returnFalse(8)end ifAlgorithm 2: Storage transaction.
Input:GPK: system public keyVI: verification information HR,M,SigG,IDf,ωOutput:True/False: the verification result.(1) The nodes of the blockchain compute Merkle root valueHR′ with ω, where ω is the information for the nodes to verify Merkle root HR and get verification result Verby execute Algorithm 1 with SigG.(2)ifHR′=HR and Ver=Truethen(3)  create a new block to storeHR,M,SigG,IDf,t where t is the timestamp.(4)else(5) abort(6)end if


### 5.2.4. Data Auditing

AuditGPK: the algorithm is executed by any system user to audit the shared data. Due to the transparency of data in blockchain, any user can finish data auditing instead of a trusted public auditor. As described in algorithm Encrypt, the verification information of each file is stored in blockchain, and the users in system can get the information including HR,SigG,M. Thus, with the auxiliary information from cloud, each system user audits the data as follows:(1)
The algorithm chooses a numbert∈RN∗ and M%t=0 and divides the leaves of Merkle tree for the file IDf into t subgroups. Then, it computes rs=PRHRt,δ, where PR is a cryptographic pseudorandom generator and δ∈t−1.(2)
After receiving the auxiliary information from cloud, the algorithm computesHR′ by constructing a path to the root of Merkle tree. It checks if HR=HR′ and PRHR′t,δ=rs. If the verification is successful, the data are validated.


### 5.2.5. Decryption Phase

DecryptGPK,CT,SKGID,S: given the secret key SKGID,S of data user and the ciphertext CT, the algorithm can find a set of constances ωx∈Zp which makes the equation ∑x=1lwxAx=1,0,…,0 hold if the data user is authorized. Then, for each row x∈l of access policy, the algorithm computes(4)Rx=Cx,1⋅e^H0GID,Cx,3⋅e^DGID,ρx′,Cx,4e^DGID,ρx,Cx,2,=e^g,gλxe^H0GID,gλx′.Next, according to the constancesωx, the algorithm computes the following equation:(5)R=∏x=1lRωx=e^g,gs,k=CR,Ml=Decsk,Cs.Finally, the algorithm outputs the recovered plaintextM of data.


### 5.2.6. User Tracing

TraceGPK,SigG: if there exists a dispute each time, the DO should be traced by recovering his real identity by the agency ACi in charge of the DO. As a member of blockchain, ACi requests the blockchain for traitor tracing. The blockchain responds to the ACi with the disputable data after running consensus protocol by which at least two-thirds of nodes in blockchain confirm the validity of the request and generate the new block as the proof of traitor tracing with synchronization.Then, the algorithm computesKGID=T1/T2θi and gets the corresponding identity of user being traced.


## 5.2.1. Initialization Phase

This phase consists of two algorithms for system setup and authority setup.SetupGκ,k,l: given the security parameter κ,k,l, the algorithm creates two big primes p,q of κ bits and generates a bilinear group G∗,GT∗,p,g,e^, where G∗,GT∗ are two multiplicative cyclic groups with order p, g is a generator of G∗, and e^:G∗×G∗⟶GT∗ is a bilinear map. It also chooses hash functions H0:0,1∗⟶G∗,H1:Ua⟶G∗,H2:0,1∗⟶Zp and a pair of symmetric encryption algorithms Encs,Decs. Moreover, the algorithm computes Q1=2p+1,Q2=2q+1 and selects elements h,a1,a2,g0,g1,g2,δ1,δ2∈RQRn, where n=Q1Q2 and QRn denotes the quadratic residue of Zp∗. Finally, the algorithm publishes the global public key as GPK=G∗,GT∗,g,h,a1,a2,g0,g1,g2,δ1,δ2,e^,H,H0,H1,H2,Encs,Decs.SetupAGPK: each attribute authority AAi∈UA randomly selects αi,βi∈Zp. Then, it picks θi∈Zp and computes Yi=gθi. Finally, it publishes its public key APKi=e^g,gαi,gβi,Yi and keeps their master key ASKi=αi,βi,θi privately.


## 5.2.2. Registration Phase

This phase consists of the key generation algorithm to generate secret key for each user according to his attribute set.KeyGenGPK,GID,S,ASKj: given the global public key GPK, the user global identity GID, and his attribute set S as well as the master key ASKj of attribute authorities that each attribute belongs to (different attribute in S may belong to the same authority), for each atti∈S, the corresponding attribute authority AAj (j=Hatti) chooses μ∈RZp and generates the secret attribute key components SKGID,ii∈S for user GID according to attribute set S, where(1)SKGID,i=DGID,i=gαjH0GIDβjH1attiμ,DGID,i′=gμ.Then, the userGID randomly picks dGID∈2u2,eGID∈n and computes fGID,1=g0dGIDg0eGID. The user GID sends fGID,1 to the agency ACi and receives bGID,cGID∈R2u2 from ACi after successfully verifying the user GID by checking if fGID∈QRn. The user GID then computes dGID′=2u1+bGIDdGID+cGIDmod2u2,fGID,2=a1dGID and sends fGID,2 to ACi. After checking fGID,2∈QRn, ACi randomly selects LGID∈B and computes KGID=fGID,2a21/LGID and returns KGID,LGID to the user GID. If successfully checked with a1dGID′a2=KGIDLGID, the algorithm generates the secret key for the user GID as SKGID,S=KGID,LGID,SKGID,ii∈S, where KGID,LGID is the user certificate used for signature generation and user identifying.


## 5.2.3. Encryption Phase

The phase includes two steps: encrypting and signing. The former algorithm finishes the work of symmetric encryption and attribute-based encryption for fine-grained access, while the latter is responsible for group signature generation to ensure the data integrity and auditing.EncryptGPK,M,A,ρ,PKj: when data owner decides to outsource and share the data M with a designated LSSS access policy A,ρ, where A is a l×m share-generating matrix and ρ is a corresponding map from a row Ax of A to an attribute attx∈Ua, that is, ρAx=attx, where x∈l, we can also infer that, with the map H of GPK, we can get the index j=Hattx of the corresponding attribute authority in charge of the attribute attx; that is, H maps each row Ax to a specific authority AAj.First of all, the algorithm chooses a random elementk∈GT∗ and computes Cs=Encsk,M to get the encrypted data, where Encs is the symmetric encryption algorithm in GPK.Then, the algorithm selects two random vectorsγ=s,γ2,…,γm and γ′=0,γ2′,…,γm′, where s,γi,γi′∈RZp. Thus, it can get λx=Ax⋅γ which is the share component of s for each attribute ρi corresponding to x-th row Ax, and λ′=Ax⋅γ′ which is the share component of 0 for each attribute of access policy. Moreover, the algorithm computes the ciphertext according to the policy after choosing rx∈Zp, where x∈l, and gets Cp=C,Cx,1,Cx,2,,Cx,3,,Cx,4x∈l, where(2)C=k⋅e^g,gs,∀x∈l:Cx,1=e^g,gλx+αHρxrx,Cx,2=grx,Cx,3=gβHρxrxgλx′,Cx,4=H1ρxrx,SigGenGPK,Cs,Cp: after receiving the encrypted data Cs with symmetric encryption, the algorithm divides it into M parts, that is, Cs1,Cs2,…,CsM, and computes hash value of each part with hash function H2 of GPK to get Hf=H2Cs1,…,H2CsM and its root hash value HR according to MHT algorithm. Then, the algorithm selects random values r∈0,12l and computes T1=KGIDYir,T2=g0r,T3=g0LGIDhr. Moreover, the algorithm selects other random numbers r1∈0,1κγ1+k,r2∈0,1κλ2+k,r3∈0,1κγ1+2l+k+1,r4∈0,1κ2l+k and computes d1=T1r1/a1r2Yjr3,d1=T2r1/gr3,d3=gr4,d4=gr1hr4 as well as the hash value Hv=H2ghYa1a2T1T2T3d1d2d3d4HR‖Cp. In addition, it outputs the signature SigG=c,s1,s2,s3,s4,T1,T2,T3, where(3)s1=r1−cei−2γ1,s2=r2−cxi−2λ2,s3=r3−crei,s4=r4−cr.Finally, the algorithm outputs the ciphertextCT=IDf,Cs,Cp,SigG,Hf,HR,M, where IDf is the identity of the file and M is the number of Hf, and outsources it to ACi which is the managing agency in charge of the user GID.Subsequently, the agencyACi needs to verify the shared ciphertext CT by Algorithm 1 and Cs,Hf,HR with MHT verification algorithm. If successful, ACi uploads CT to the cloud and stores the verification information to blockchain as described in Algorithm 2.Algorithm 1: Signature verification.
Input:GPK: system public keyCT: messageσG: the group signature of message MOutput:True/False: the verification result.(1) Compute the following values:d1′=a1cT1s1−c2γ1/a1s2−c2γ1Ys3d2′=T2s1−c2γ1/gs3d3′=T2cgs4d4′=T3cgs1−c2γ1hs4(2) GM randomly selectsei∈B computes Ai=C2a21/ei, then sends Ai,ei to UAVi as its member certificate.(3) UserGID checks if a1xi′a2=Aiei. If successful, then Ai,ei is its signing key.(4)ifc′=cthen(5)returnTrue(6)else(7)returnFalse(8)end ifAlgorithm 2: Storage transaction.
Input:GPK: system public keyVI: verification information HR,M,SigG,IDf,ωOutput:True/False: the verification result.(1) The nodes of the blockchain compute Merkle root valueHR′ with ω, where ω is the information for the nodes to verify Merkle root HR and get verification result Verby execute Algorithm 1 with SigG.(2)ifHR′=HR and Ver=Truethen(3)  create a new block to storeHR,M,SigG,IDf,t where t is the timestamp.(4)else(5) abort(6)end if


## 5.2.4. Data Auditing

AuditGPK: the algorithm is executed by any system user to audit the shared data. Due to the transparency of data in blockchain, any user can finish data auditing instead of a trusted public auditor. As described in algorithm Encrypt, the verification information of each file is stored in blockchain, and the users in system can get the information including HR,SigG,M. Thus, with the auxiliary information from cloud, each system user audits the data as follows:(1)
The algorithm chooses a numbert∈RN∗ and M%t=0 and divides the leaves of Merkle tree for the file IDf into t subgroups. Then, it computes rs=PRHRt,δ, where PR is a cryptographic pseudorandom generator and δ∈t−1.(2)
After receiving the auxiliary information from cloud, the algorithm computesHR′ by constructing a path to the root of Merkle tree. It checks if HR=HR′ and PRHR′t,δ=rs. If the verification is successful, the data are validated.


## 5.2.5. Decryption Phase

DecryptGPK,CT,SKGID,S: given the secret key SKGID,S of data user and the ciphertext CT, the algorithm can find a set of constances ωx∈Zp which makes the equation ∑x=1lwxAx=1,0,…,0 hold if the data user is authorized. Then, for each row x∈l of access policy, the algorithm computes(4)Rx=Cx,1⋅e^H0GID,Cx,3⋅e^DGID,ρx′,Cx,4e^DGID,ρx,Cx,2,=e^g,gλxe^H0GID,gλx′.Next, according to the constancesωx, the algorithm computes the following equation:(5)R=∏x=1lRωx=e^g,gs,k=CR,Ml=Decsk,Cs.Finally, the algorithm outputs the recovered plaintextM of data.


## 5.2.6. User Tracing

TraceGPK,SigG: if there exists a dispute each time, the DO should be traced by recovering his real identity by the agency ACi in charge of the DO. As a member of blockchain, ACi requests the blockchain for traitor tracing. The blockchain responds to the ACi with the disputable data after running consensus protocol by which at least two-thirds of nodes in blockchain confirm the validity of the request and generate the new block as the proof of traitor tracing with synchronization.Then, the algorithm computesKGID=T1/T2θi and gets the corresponding identity of user being traced.


## 6. Security Analysis

In this section, we give a brief security analysis for our proposal.(6)Rx=Cx,1⋅e^H0GID,Cx,3⋅e^DGID,ρx′,Cx,4e^DGID,ρx,Cx,2=e^g,gλx+αHρxrxe^H0GID,gβHρxrxgλx′e^gαjH0GIDβjH1attiμ,grx⋅e^gμ,H1ρxrxe^gαjH0GIDβjH1attiμ,grx=e^g,gλxe^H0GID,gλx′,R=∏x=1lRωx=∏x=1le^g,gλxe^H0GID,gλx′ωx=e^g,gΣx=1lωxλxe^H0GID,gΣx=1lωxλx′=e^g,gse^H0GID,g0=e^g,gs.Theorem 1.
The scheme satisfies the correctness of decryption.Proof.
Our scheme can guarantee that the data user gets correct plaintext if and only if his attribute setS satisfies the LSSS access policy A,ρ.Theorem 2.
The scheme satisfies the requirement of fine-grained access and collusion resistance.Proof.
In our scheme, on the one hand, the secret values is separated according to secret sharing matrix A, and only the attribute set that is identical to an authorized set in A can satisfy matrix A and reconstruct s. That is, only users with enough access rights which are identical to authorized attribute set can recover the secret and plaintext. On the other hand, the authorities generate the attribute secret key for system users including the hash value of each user’s global identity, which is unique for them. If two or more users want to launch collusion attack against our scheme, they have to combine their secret key components corresponding to different attributes. However, as the key component DGID,i=gαjH0GIDβjH1attiμ embeds H0GID which relates to user identity and μ which is randomized element for each user, it is impossible to conduct successful collusion attack against our scheme.Theorem 3.
The scheme satisfies the requirement of public auditability.Proof.
The security proof of these security requirements is similar to [14].Theorem 4.
The scheme satisfies the requirements of anonymity and traceability.Proof.
The security proof of these security requirements is similar to [14].


## 7. Performance Evaluation

In this section, we give a thorough performance analysis of our scheme by implementation and comparison with another existing related work [20] from theoretical computation and storage complexity and actual time and storage cost.Table2 summarizes the computation and storage complexity comparison between our scheme and the scheme in [20]. We analyze the computation complexity of Encrypt, Decrypt, and KeyGen of the two schemes. From the comparison, we can infer that as our scheme introduces group signature for data integrity verification, Encrypt and KenGen introduce some extra overhead in computation complexity, while the scheme in [20] also incurs some overhead by introducing tracing mechanism. On the other hand, we analyze the storage complexity of the two schemes from SK Size and PP Size, which denote the secret key size and public parameter size, respectively. We note that, for the same reason, the public key size and secret key of system users in our scheme increase for signature generation, while the storage complexity of the other scheme shows the same thing.Table 2
Complexity comparison.
SchemesEncryptDecryptKeyGenSK SizePP SizeScheme [20]6lE1+2l+1E2+lM1+l+1M23E1+lE2+3M1+l+3M2+3P5SE1+2SM13S‖G∗3G∗+GT∗Our scheme4l+8E1+l+1E2+l+4M1+M2lE2+l+3M2+3P4S+1E1+2SM12S+1G∗2G∗+GT∗Figure4 plots the comparison of encryption time cost for our scheme and the scheme in [20]. As we can see, the time cost in encryption algorithm in two schemes is affected by the complexity of policy. It is in proportion to the row number of access policy. We set the number of files from 1 to 5, and, no matter in which condition, the encryption time cost in our scheme is less than that in [20].Figure 4
Encryption cost comparison for different number of files. (a)X¯=0. (b) X¯=2. (c) X¯=4. (d) X¯=6.
(a)(b)(c)(d)Figure5 plots the comparison of encryption time cost for our scheme and the scheme in [20]. It is obvious that the time cost of decryption algorithm in both schemes is affected by policy complexity as in encryption. We test the time cost in different file number condition, and the result shows that the time cost in our scheme is far less than that in the other scheme for the same attribute size and same number of files.Figure 5
Decryption cost comparison for different number of files. (a)F=1. (b) F=2. (c) F=3. (d) F=4.
(a)(b)(c)(d)Figure6 plots the comparison of authority public parameter and user secret key storage cost for our scheme and the scheme in [20]. We note that both schemes have constant public parameter size having no relationship with the size of attribute. This is consistent with the property of large universe. The size of public parameter for each authority in our scheme is far less. Moreover, for the size of secret key, we note that our scheme has a smaller size in key length than the other scheme.Figure 6
Comparison of the storage cost. (a) Public parameter size. (b) User key size.
(a)(b)


## 8. Conclusion

In this paper, we propose a blockchain-based fine-grained data-sharing scheme for multiple groups in cloud-based IoT systems. In our proposal, we design a novel multiauthority large universe CP-ABE scheme to guarantee the fine-grained access control and data integrity across multiple group by integrating group signature into our scheme. Moreover, to ease the need for a third trusted auditor in traditional data public auditing schemes, we introduce blockchain technique to enable a distributed data public auditing. In addition, with the group signature, our scheme also realizes anonymity and traitor tracing. The security analysis and performance evaluation show that our scheme is practical for large-scale IoT systems.



---

*Source: 6689448-2021-02-28.xml*