# CD-ABSE: Attribute-Based Searchable Encryption Scheme Supporting Cross-Domain Sharing on Blockchain

Authors: Kaiyang Guo; Yiliang Han; Riming Wu; Kai Liu
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The network security situation is grim, and the problem of “information isolated island” is becoming increasingly prominent. In view of the low efficiency and insufficient security of data cross-domain sharing in the open network environment, a searchable data sharing scheme supporting cross-domain is proposed based on attribute encryption technology. Firstly, different types of nodes on the blockchain are used to realize the data sharing of users in different domains. Secondly, the flexible ciphertext-search function is realized through the search form of keyword strategy. Moreover, the scheme adopts the mode of storage under the chain, which reduces the operation pressure of the blockchain. At the same time, according to the characteristics of the blockchain, the traceability and tamper-proof of the access process can be realized. Finally, the analysis shows that the scheme can resist quantum attack and collusive attack while avoiding complex bilinear operation and meet the security of trapdoor search and indistinguishability under chosen-plaintext attack. Compared with other searchable attribute-based encryption schemes, the scheme has certain advantages in function and performance.


---

## Body

## 1. Introduction

With the increasing data resources in cyberspace, the security and efficiency problems have attracted much attention. How to use information safely and efficiently to create greater value has become one of the urgent issues to be solved in this era. With the increase of the amount of individual data, there are more and more network attacks, and the data security situation is severe, which makes the cross-domain access that is already difficult to maintain permissions and low access efficiency more difficult. The failure to share data safely and efficiently will greatly reduce the value of data, resulting in a waste of resources and restricting development. However, traditional access control models, such as Discretionary Access Control, Mandatory Access Control model, and Role-Based Access Control model, have some limitations on the face of current needs. In order to ensure that the data in cyberspace can be shared more safely and efficiently, more and more scholars begin to study new access control models that are more in line with the actual needs.Wang et al. proposed a cross-domain access control method for large organizations by applying ABAC model in distributed authoritative domain [1]. Yang and Wang proposed a new cross-domain access control model based on trust measurement [2] that can realize dynamic authorization and fine-grained access in a simple way. Shuang and Chen had built an efficient trusted cross-domain access control system by combining role mapping technology and blockchain [3]. Blockchain is used to record user roles, mapping rules, and access policies and rely on efficient smart contracts to make access decisions; Bai et al. proposed a multidomain access control service for intelligent city service system [4], which transmits data based on attribute encryption and improves the mapping efficiency through the combination of digital attribute table and B + tree. The scheme can also rely on third-party outsourcing to reduce the computational burden. Ullah et al. designed a lightweight provable cross-domain access control scheme based on the wireless body area network on the Internet of Things [5]; the computing and communication costs are reduced under the condition of ensuring security.As a new functional public key encryption technology, it has unique advantages in data security sharing, the biggest feature of attribute-based encryption is to integrate data confidentiality and access control and determine the object of data sharing through the matching of attributes and policies. The concept of attribute-based encryption was first proposed by Sahai and Waters on the basis of identity-based encryption in 2005 [6]. Later, it is usually divided into ciphertext-policy attribute-based encryption (CP-ABE) and key-policy attribute-based encryption (KP-ABE) [7]. The ciphertext-policy is formulated by the data owner, and it is more flexible in data sharing and more widely used in research and application compared with the key-policy. In 2007, Bethencourt et al. proposed the first CP-ABE scheme [8], but it does not have provable security; in the same year, Cheung et al. proposed the first scheme that can prove security under the standard model [9], but the expression ability of access structure of AND gate is limited; Waters constructed a CP-ABE scheme with flexible strategy based on linear secret sharing scheme (LSSS) in 2011 [10]. After that, many scholars put forward schemes with more perfect functions, but most of these schemes are based on bilinear map, and the complex bilinear pairing operation restricts the efficiency of the scheme. Therefore, some scholars began to try to construct attribute-based encryption schemes based on other mathematical systems. In 2012, Agrawel et al. discussed the possibility of constructing attribute-based encryption on lattice scheme [11]; in 2013, Wang proposed the CP-ABE scheme based on the learning with errors (LWE) problem on the basis of Agrawel’s theory [12]. In 2015, Tan and Azmasn proposed the CP-ABE scheme based on the learning with errors over ring (RLWE) problem [13], which is significantly improved in size and efficiency compared with the scheme on the LWE problem. The research of ABE on lattice has been paid more and more attention by scholars, and the traditional problems such as access structure [14], attribute revocation, and key abuse have been deeply discussed.With the deepening of the research on attribute-based encryption, its potential in data protection and access control has gradually attracted extensive attention in the academic community. Basu and Tripathy improved the efficiency by using CP-ABE scheme based on the security multicast requirements in the Internet of Things (IOT) [15]. In 2019, Yao and Wang protected the security of data exchanged with IOT devices based on ABE and equality testing technology [16]; Challagidad and Birje proposed a multiauthority access control scheme [17], which combined the Role Hierarchy Algorithm with the ABE, and the hierarchical access structure significantly improves the efficiency. Tian et al. applied ABE to blockchain to protect transaction privacy and realize traceability information sharing [18]. Sandoval et al. proposed a data storage method based on ABE in the cloud [19], which supports the sharing and search of encrypted data. Niu et al. used the characteristics of blockchain to improve the security of CP-ABE scheme [20]; Zhang et al. proposed an accountable data sharing model combining blockchain and ABE [21]. Based on the need of medical data, Niu et al. designed a data sharing scheme that can protect users’ privacy by using ABE [22]. Kanimozhi and Victoire proposed a scheme for data sharing of the IOT based on attribute-based encryption [23]. By performing clustering and the collected data and then encrypting it in the cloud, the confidentiality and integrity of the data are guaranteed. Li and Tan proposed an electronic certificate sharing scheme based on blockchain and attribute-based searchable encryption to achieve fine-grained access control [24].


### 1.1. Security and Function Requirements

A complete access control system should provide corresponding functions and security services to ensure data sharing among entities.(1)
Fine-grained access control. Users can freely decide who can access the data they own and can also access the data shared by other users as needed(2)
Data security and user privacy protection. Users’ data in the process of data sharing should be safe and effective, and their personal identity information should be in a safe state(3)
Security of index and trapdoor. During the search process, the index and trapdoor should be safe and reliable. Attackers cannot obtain more information through the index and trapdoor, nor can they destroy the system through the search process(4)
Tailored forensics. The system shall provide certain evidence collection mechanism to ensure that the transaction has certain integrity and traceability


### 1.2. Contribution

In order to solve the problem of data sharing between different domains, this paper proposes a cross-domain access control scheme, which is based on CP-ABE to ensure data security and fine-grained access control. The cross-domain sharing of data is realized by connecting blockchains of different domains through cross-domain nodes. At the same time, the scheme also supports flexible ciphertext-search function. The main contributions of this paper are listed as follows.(1)
Through the combination of blockchain and CP-ABE, users in the same domain and users in different domains can share data safely(2)
The scheme supports ciphertext-search function before data access. By generating search traps in the form of keyword policy, the search of multiple keywords can be realized while ensuring privacy, which improves the flexibility of search(3)
Using the way of ciphertext off chain storage, only a small part of the data needs to be uploaded to the blockchain, which reduces the calculation and storage pressure of the blockchain. Through encrypted storage, even if there is data leakage, it can ensure the security of information, and according to the characteristics of the blockchain, the traceability and tamper-proof of the access process can be realized(4)
The scheme is constructed based on RLWE, without complex bilinear pairing, and has the characteristics of antiquantum attack


### 1.3. Paper Structure

The remainder of this paper is organized as follows. In Section2, we review some mathematical knowledge and define the security model. In Section 3, we give the system model, definition of scheme, and construction. The scheme is analyzed in Section 4, mainly including security analysis and performance analysis. Finally, we conclude our paper in Section 5.


## 1.1. Security and Function Requirements

A complete access control system should provide corresponding functions and security services to ensure data sharing among entities.(1)
Fine-grained access control. Users can freely decide who can access the data they own and can also access the data shared by other users as needed(2)
Data security and user privacy protection. Users’ data in the process of data sharing should be safe and effective, and their personal identity information should be in a safe state(3)
Security of index and trapdoor. During the search process, the index and trapdoor should be safe and reliable. Attackers cannot obtain more information through the index and trapdoor, nor can they destroy the system through the search process(4)
Tailored forensics. The system shall provide certain evidence collection mechanism to ensure that the transaction has certain integrity and traceability


## 1.2. Contribution

In order to solve the problem of data sharing between different domains, this paper proposes a cross-domain access control scheme, which is based on CP-ABE to ensure data security and fine-grained access control. The cross-domain sharing of data is realized by connecting blockchains of different domains through cross-domain nodes. At the same time, the scheme also supports flexible ciphertext-search function. The main contributions of this paper are listed as follows.(1)
Through the combination of blockchain and CP-ABE, users in the same domain and users in different domains can share data safely(2)
The scheme supports ciphertext-search function before data access. By generating search traps in the form of keyword policy, the search of multiple keywords can be realized while ensuring privacy, which improves the flexibility of search(3)
Using the way of ciphertext off chain storage, only a small part of the data needs to be uploaded to the blockchain, which reduces the calculation and storage pressure of the blockchain. Through encrypted storage, even if there is data leakage, it can ensure the security of information, and according to the characteristics of the blockchain, the traceability and tamper-proof of the access process can be realized(4)
The scheme is constructed based on RLWE, without complex bilinear pairing, and has the characteristics of antiquantum attack


## 1.3. Paper Structure

The remainder of this paper is organized as follows. In Section2, we review some mathematical knowledge and define the security model. In Section 3, we give the system model, definition of scheme, and construction. The scheme is analyzed in Section 4, mainly including security analysis and performance analysis. Finally, we conclude our paper in Section 5.


## 2. Preliminaries

### 2.1. Lattice

Definition 1 (lattice).
Λ is called lattice if there are m linearly independent n-dimensional vectors in Λ, such that any vector in Λ is an integer linear combination of B=b1,b2,⋯,bm, that is, Λ=Λb1,b2,⋯,bm=∑i=1msibi,si∈ℤ, n is the dimension of lattice Λ, m is the rank of lattice Λ, and B is a set of bases of lattice Λ.Definition 2 (ideal lattice).
There is a ringR=x/f and an ideal I⊆R; a lattice Λ∈Zn is an ideal lattice if Λ is associated with I.Definition 3 (DecisionR‐LWEd,q,χ Problem [25]).
Given the security parameterλ, select the integer d,q based on λ, let R=Zx/fx, where fx=xd+1 and Rq=R/q. Given discrete distribution χ⊂Rq based on λ, there is an unspecified challenge model O in the Decision R‐LWEd,q,χ Problem, that is, to determine whether the challenge model is a noisy pseudorandom sampler Os or a real random sampler Os′ for random secret key, K∈Rq, which perform, respectively, as follows:
Os: outputs ω,v=ω,ωK+e∈Rq×Rq. The element ω is uniformly random from Rq, where ω⟵Rq and the K⟵Rq fixed for all samples. The element e⟵Rq is a small error term that generated with a distribution χ.
Os′: outputs truly random samples ω,v∈Rq×Rq.


### 2.2. Access Control Structure

Definition 4 (Monotone Access Structure).
LetU=u1,u2,⋯,un be a set of attributes. A collection D⊆U is monotone if ∀B,C:B∈D,B⊆C⇒C∈D. The sets in Α are called as authorized sets, and the sets not in D are called as unauthorized sets.Definition 5 (linear secret sharing scheme (LSSS) [13]).
The∏ is a secret sharing scheme over a set of attributes U if the following properties are met:
(1)
All sharers have a secret sharing vector based onRq(2)
There is a share-generating matrixF∈Rqn×m for ∏, with row labels ρi∈U,∀i∈n. Given a column vector, v⟶=s,r2,⋯,rm, where s∈Rq is the secret to be shared and r2,⋯,rm⟵Rq are randomly chosen. Let δi=Fi×v∈Rq,i∈1,n represent attribute ρi, where ρi is a function from i to U
Linear secret sharing scheme has linear reconstruction characteristics. Suppose that∏ is an LSSS that represents the access structure Α. Let A∈Α be an authorized set, and I⊂1,⋯,n, I=i:ρi∈D. There exist constants ωi∈Rqi∈I then ∑i∈Iδiωi=s such that of δi are valid shares of a secret s according to ∏. Furthermore, these constants ωi can be calculated through the share-generating matrix F in polynomial time. For unauthorized sets, it cannot be calculated, that is, any information of secret sharing value cannot be obtained.


## 2.1. Lattice

Definition 1 (lattice).
Λ is called lattice if there are m linearly independent n-dimensional vectors in Λ, such that any vector in Λ is an integer linear combination of B=b1,b2,⋯,bm, that is, Λ=Λb1,b2,⋯,bm=∑i=1msibi,si∈ℤ, n is the dimension of lattice Λ, m is the rank of lattice Λ, and B is a set of bases of lattice Λ.Definition 2 (ideal lattice).
There is a ringR=x/f and an ideal I⊆R; a lattice Λ∈Zn is an ideal lattice if Λ is associated with I.Definition 3 (DecisionR‐LWEd,q,χ Problem [25]).
Given the security parameterλ, select the integer d,q based on λ, let R=Zx/fx, where fx=xd+1 and Rq=R/q. Given discrete distribution χ⊂Rq based on λ, there is an unspecified challenge model O in the Decision R‐LWEd,q,χ Problem, that is, to determine whether the challenge model is a noisy pseudorandom sampler Os or a real random sampler Os′ for random secret key, K∈Rq, which perform, respectively, as follows:
Os: outputs ω,v=ω,ωK+e∈Rq×Rq. The element ω is uniformly random from Rq, where ω⟵Rq and the K⟵Rq fixed for all samples. The element e⟵Rq is a small error term that generated with a distribution χ.
Os′: outputs truly random samples ω,v∈Rq×Rq.


## 2.2. Access Control Structure

Definition 4 (Monotone Access Structure).
LetU=u1,u2,⋯,un be a set of attributes. A collection D⊆U is monotone if ∀B,C:B∈D,B⊆C⇒C∈D. The sets in Α are called as authorized sets, and the sets not in D are called as unauthorized sets.Definition 5 (linear secret sharing scheme (LSSS) [13]).
The∏ is a secret sharing scheme over a set of attributes U if the following properties are met:
(1)
All sharers have a secret sharing vector based onRq(2)
There is a share-generating matrixF∈Rqn×m for ∏, with row labels ρi∈U,∀i∈n. Given a column vector, v⟶=s,r2,⋯,rm, where s∈Rq is the secret to be shared and r2,⋯,rm⟵Rq are randomly chosen. Let δi=Fi×v∈Rq,i∈1,n represent attribute ρi, where ρi is a function from i to U
Linear secret sharing scheme has linear reconstruction characteristics. Suppose that∏ is an LSSS that represents the access structure Α. Let A∈Α be an authorized set, and I⊂1,⋯,n, I=i:ρi∈D. There exist constants ωi∈Rqi∈I then ∑i∈Iδiωi=s such that of δi are valid shares of a secret s according to ∏. Furthermore, these constants ωi can be calculated through the share-generating matrix F in polynomial time. For unauthorized sets, it cannot be calculated, that is, any information of secret sharing value cannot be obtained.


## 3. Attribute-Based Searchable Encryption Scheme Supporting Cross-Domain Sharing on Blockchain

### 3.1. System Model

The model in this scheme can be divided into three layers, such as storage layer, blockchain service layer, and application layer from bottom to top. The model is shown in Figure1.Figure 1
System model.The storage layer is responsible for providing data storage, which is divided into blockchain data storage and IPFS (Inter Planetary File System) data storage. Blockchain data mainly includes system initialization parameters, relevant information applied by users, indexes, and initial ciphertext, etc., and these data will be stored in the form of transactions; IPFS mainly stores the encrypted data uploaded by users. In the blockchain service layer, it is mainly divided into Unit-chain and Region-chain, in which Unit-chain is mainly responsible for internal data services, including data recording and access services; The Region-chain is mainly responsible for cross domain data services between different units. Based on the weak credit environment, this model is based on the Consortium Blockchain, and only licensed nodes can operate. At the same time, the credit consensus mechanism is adopted, and the nodes with violations will be revoked and removed from the system. The nodes in this model are mainly divided into general nodes and cross domain nodes. General nodes mainly maintain blockchain services within their own units, and cross domain nodes are responsible for connecting blockchains between two different domains, providing cross domain access services, and deploying the authority on cross domain nodes to improve work efficiency and resource utilization. The application layer provides various functional applications.The proposed system includes five entities:Authority, Data Owner (DO), Inter Planetary File System (IPFS), Data User (DU), and Blockchain. The Authority is deployed on the Blockchain. The relationship among the entities is shown in Figure 2.
(1)
Authority. The authority generates the system’s public parameters and master key, manages the users in the system, and constructs the private key for each user according to the user’s identity and authority, then the authority generates temporary keys for users in other domains and search traps for users during cross-domain access. We assume that the authority is completely trusted, will faithfully perform various operations, and will not disclose users’ personal information. In order to facilitate operation and data processing, we deploy the authority to the cross-domain nodes of the blockchain(2)
Data Owner (DO). The data owner generates keyword index Iw based on data and encrypts data with symmetric key k, then uploads encrypted data to the IPFS. After that, DO sets the access policy of the data and encrypts the symmetric key and address, then DO uploads this ciphertext ct and index Iw to blockchain(3)
Inter Planetary File System (IPFS). The IPFS is responsible for storing data and returning an address. IPFS is honest but curious, always correctly implement the requirements put forward by all entities in the scheme, but attempts to decrypt the ciphertext content(4)
Data User (DU). The data user can access data according to their needs. Apply to the authority for a search trapdoor as needed and send it to the blockchain node. After obtaining the returned initial ciphertext, DU decrypts the ciphertext according to private key. After obtaining the address, download the corresponding data from IPFS, then DU can decrypt the data according to the symmetric key(5)
Blockchain. The blockchain performs smart contract and runs algorithm, and important events in the access process will form blocks in the form of transactions and be saved in the blockchain. Due to the guarantee of trust proof of work, the node will faithfully perform operations. We assume that the entity is not completely trusted and may try to decipher user’s dataFigure 2
System architecture.


### 3.2. Overview of the Scheme

Based on ABE and blockchain, the scheme realizes the data access control of users in the same domain or between different domains and can also provide ciphertext-search function. In order to ensure the traceability and tamper-proof of the search process, important events in the access process will be formed into blocks in the form of transactions and stored in the blockchain. The information contained in the release record can be determined according to the specific situation. If the privacy is strong, it can be released in the form of pseudo-ID or other forms, which is not the focus of the scheme and will not be discussed too much. The access process of the scheme is shown in Figure3. The specific contents of the scheme are as follows.
(1)
Initialize accounts, deploy smart contracts, and initialize systems(2)
The user submits the registration information to authority, which verifies and generates the corresponding private key(3)
DO extracts keywords from the data to be shared and generates an indexIw, then encrypts the data through a symmetric algorithm, and uploads the encrypted data to IPFS, then gets address L, then encrypts the address and symmetric key k according to own strategy to get the initial ciphertext ct, and finally, embeds ct and Iw into a transaction, and publishes it to the blockchain(4)
When DU needs to access the data in their own domain, DU sends an application to their authority, which contains the visitor’s information, keyword combination, and signature. The authority first verifies the user’s identity. If the user is forged or illegal, it will refuse access; if the identity is valid, the trapdoorTw′ is generated through keyword combination and is sent to the node for search(5)
When DU needs to access the data of other domains, they first apply to their authority. After receiving the application, the cross-domain node, as the user’s agent, submits a temporary access application to the authority of the target domain. After verification, the authority of the target domain assigns a temporary private key. The private key has time or times limit when used, and then follow step (4)(6)
According to the incentive mechanism, after receiving the search trapdoorTw′, the node runs the algorithm for matching search that to get reward. When the keywords match, the node will return the corresponding initial ciphertext ct; otherwise, it will return ⊥(7)
When DUs receive the initial ciphertextct, they decrypt it with their own private key. If their own attributes meet the policies formulated by the DO, it can be decrypted smoothly to obtain the address L and symmetric key k. Once decrypted successfully, the user’s “wallet” will publish the access record to the blockchain; otherwise, it will return ⊥(8)
Finally, DU submits the address to IPFS, downloads the corresponding encrypted data, and then, decrypts it with symmetric keyk to obtain the dataFigure 3
Access flow chart.The scheme consists of the following eight algorithms.Setup1λ1,U⟶PK,MSK. The algorithm is executed by authority. Given the security parameter λ1, and the collection of all attributes U in the system, this algorithm outputs public parameters PK and master secret key MSK.Setup2λ2,W⟶PP,MK. The algorithm is executed by authority. Given the security parameter λ2, and the collection of all attributes W in the system, this algorithm outputs public parameters PP and master key MK.IGenPP,Dw⟶Iw. The algorithm is executed by DO. Input public parameters PP, a set of keywords Dw used to describe data. This algorithm outputs index Iw.EncPK,M,A⟶ct. The algorithm is executed by DO. Input public parameters PK, the message M about address and symmetric key M=kL, and user’s access policy A. This algorithm outputs the ciphertext ct.keyGenMSK,D⟶sk. The algorithm is executed by authority. Input master secret key MSK and user’s attribute set D. This algorithm outputs the secret key sk for the user.TGenMK,Aw′⟶Tw′. The algorithm is executed by authority. Input master key MK and user’s keyword policy Aw′. This algorithm outputs a trapdoor Tw′.SearchPP,Iw,Tw′⟶ct. The algorithm is executed by a node of blockchain. Input public parameters PP, index Iw, and a trapdoor Tw′; if keywords match the corresponding data, the ciphertext ct is returned; otherwise, it return ⊥.DecPK,ct,sk⟶M. The algorithm is executed by DU. Input public parameters PK, ciphertext ct, and user’s secret key sk. This algorithm outputs M=kL, then the DU can download the data through the address L and decrypt it with the symmetric key k to obtain the data.


### 3.3. Security Model

It is assumed that the authority is a fully trusted entity. IPFS and blockchain are semitrusted entities. They will faithfully perform operations, but they may try to decipher user data; IPFS and blockchain may collude with attackers. Assuming that the channel between users and authority is a secure channel, consider the following attacker and security models.(1)
The scheme should meet the basic data security requirements and ensure the confidentiality of the data in the sharing process. The attacker 1 mainly focuses on the security problems in the system of ABE and attempts to decrypt the encrypted data(2)
Based on the characteristics of ABE, the scheme should be able to resist collusion attack. We define attacker 2 as malicious legitimate users, who can obtain any number of keys and attempt to collude to expand their decryption ability. It is defined that if the advantage of attacker 2 can be ignored in any polynomial time, the scheme meets the security of anticollusion attack(3)
The scheme should meet the privacy security of the index, and the attacker should not be able to distinguish the index corresponding to different keywords. Define that attacker 3 attempts to obtain information from the index(4)
The scheme should meet the privacy security of the trapdoor, and the attacker should not be able to distinguish the trapdoor corresponding to different keywords. Define that attacker 4 attempts to obtain information from the trapdoorDefinition 6 (IND-CPA security).
The definition is given by describing the game between adversaryA and simulator B. The scheme satisfies the security of chosen-plaintext attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A selects an access structure A∗ and sends it to B.
Setup. The simulator B generates public parameters PK and master key MSK and sends PK to A.
Inquiry Phase 1. The adversary A asks the simulator B for the private key, but A’s attribute set does not meet the access structure. The simulator runs the KeyGen algorithm to generate the private key and send it to A.
Challenge. The adversary A chooses two messages M0,M1∈0,1 and sends them to simulator B, then B randomly selects b∈0,1 to calculate the challenge ciphertext and sends it to A.
Inquiry Phase 2.A asks for the key as in phase 1.
Guess. Adversary A outputs his guess b′ about b. The advantage of A in this game is defined as advA=Prb′=b−1/2.Definition 7 (IND-CKA security).
The definition is given by describing the game between adversaryA3 and simulator B3. The scheme satisfies the security of chosen-keyword attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A3 selects Dw0∗ and Dw1∗ as two keywords with the same length and sends them to B3.
Setup. The simulator B3 generates public parameters PP and master key MK and sends PP to A3.
Inquiry Phase 1.A3 sends Dwi∗ keywords to B3, then B3 runs the IGenPP,Dw⟶Iw algorithm to generate Iwi and send it to A3. Note that the keyword set of the query cannot be the same as the keyword set of the challenge.
Challenge.B3 randomly selects b∈0,1 to calculate the challenge index Iwb and send it to A3.
Inquiry Phase 2.A3 asks for the index as in phase 1.
Guess. Adversary A3 outputs his guess b′ about b. The advantage of A3 in this game is defined as advA3=Prb′=b−1/2.Definition 8 (IND-IKGA security).
The definition is given by describing the game between adversaryA4 and simulator B4. The scheme satisfies the security of internal-keyword guessing attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A4 selects Aw0 and Aw1 as two keyword policies with the same length and sends them to B4.
Setup. The simulator B4 generates public parameters PP and master key MK and sends PP to A4.
Inquiry Phase 1.A4 sends Awi∗ keyword policy to B4, then B4 runs the TGenMK,Aw′⟶Tw′ algorithm to generate Twi and send it to A4. Note that the keyword set of the query cannot be the same as the keyword set of the challenge.
Challenge.B4 randomly selects b∈0,1 to calculate the challenge keyword-policy Awb and send it to A4.
Inquiry Phase 2.A4 asks for the trapdoor as in phase 1.
Guess. Adversary A4 outputs his guess b′ about b. The advantage of A4 in this game is defined as advA4=Prb′=b−1/2.


### 3.4. Construction of the CD-ABSE Scheme

#### 3.4.1. Initialization Phase

This phase mainly includes the initialization of the authority and the blockchain system, in which the blockchain system completes the setting of the corresponding accounts and nodes, etc. The initialization of the authority mainly includes the following two algorithms.Setup1λ1,U⟶PK,MSK. Given the security parameter λ1 and the collection of all attributes U in the system, randomly select a large prime number q1=1mod2λ1 and a small positive integer p1, where p1≪q1 and gcdp1,q1=1. Let fx=xd+1, where d is a power of 2. Let Rq1=Zq1x/<fx> be the ring of integer polynomials modulo both fx and q1. Let χ1=χ1λ be an error distribution over Rq1. Select a uniformly random SK0⟵Rq1 and random element a1⟵Rq1, then choose a small noise term e0⟵χ1. Compute PK0=aSK0+pe0∈Rq1. Next, select a pair of uniformly random SKi,SKi−1⟵Rq1 for each attribute in U, where SKi−1 is the inverse of SKi in Rq1, and select a small noise term ei⟵χ1, then compute PKi=SKi+pei∈Rq1. Lastly, output the public parameters PK=a,PK0,PKii=1n and the master secret key MSK=SK0,SKii=1n,SKi−1i=1n.Setup2λ2,W⟶PP,MK. Given the security parameter λ2, and the collection of all keywords W in the system, randomly select a large prime number q2=1mod2λ2 and a small positive integer p2, where p2≪q2 and gcdp2,q2=1. Let fx=xd+1, where d is a power of 2. Let Rq2=Zq2x/<fx> be the ring of integer polynomials modulo both fx and q2. Let χ2=χ2λ be an error distribution over Rq2. Select a uniformly random pk0⟵Rq2 and random element a2⟵Rq2, then choose a small noise term e_0⟵χ2. Compute sk0=a2pk0+pe_0∈Rq2. Next, select a pair of uniformly random pki,pki−1⟵Rq2 for each keyword in W, where pki−1 is the inverse of pki in Rq2, and select a small noise term e_i⟵χ2, then compute ski=pki+pe_i∈Rq2. Lastly, output the public parameters PP=pk0,pkii=1n,pki−1i=1n and the master secret key MK=a2,sk0,skii=1n.


#### 3.4.2. Registration Phase

This phase mainly refers to that the user submits a registration application to the authority, and the authority runs the following algorithm to generate a key for the user.keyGenMSK,D⟶sk. Input master key MSK, user’s attribute set D, then choose small noise term e″,ei′′⟵χ1, and select a pair of uniformly random t,t−1⟵Rq1 for each attribute in D. Compute K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei′′∈Rq,∀i∈D; output the secret key sk=K0,Ki.


#### 3.4.3. Data Preparation Phase

This phase mainly refers to the operation when the data owner shares the data, including symmetrically encrypting the data, sending the encrypted data to IPFS and obtaining the address, and then, encrypting the address and the symmetric key to obtain the ciphertext. In addition, the user also needs to generate a ciphertext index for this data. The algorithm for index generation and encryption is as follows:IGenPP,Dw⟶Iw. Input public parameters PP and a keyword set Dw of data. Select a pair of uniformly random t′,t′−1⟵Rq2, and choose small noise term e_′′,e_i′′⟵χ2 for each keyword in Dw. Compute I0=pk0t−1+pe_′′∈Rq2, Ii=pki−1t+pe_i′′∈Rq2,∀i∈Dw; output an index Iw=I0,Ii.EncPK,M,A⟶ct. Input public parameters PK, the message M∈0,1n about kL, and set access policy A=F,ρ, F∈Rq1n×m with row labels ρj∈H, ∀j∈n, H∈A. Generate a vector v=s1,r2,⋯,rm, where r2,⋯,rm⟵Rq1, and s1∈Rq1 is the secret to be shared. δi=Fi×v∈Rq1,i∈1,n, where Fi is the vector corresponding to ith row of F. Then, choose a uniformly random element r1⟵Rq1 and noise terms e′,ei′⟵χ1; compute c0=PK0r1s1+M+p⋅e′∈Rq1, ci=ar1PKiδi+pei′∈Rq1, and output ct=c0,ci.After completing the above steps, DO embeds the ciphertextct and index Iw into the transaction TX and signs it to TY, then broadcasts TX to the whole blockchain. After the transaction is verified, it is recorded on the blockchain by the miner. The data structure is as shown in Table 1.Table 1
Blockchain data structure in data preparation phase.
IdentificationFromToActionTimestampSignatureTransactionID_1DOBCPublishTimestamp1Sig1TX,TY


#### 3.4.4. Access Preparation Phase

The user sends the data keywords to be accessed to the authority, and the authority executes the following algorithm to generate a search trapdoor for the user.TGenMK,Aw′⟶Tw′. Input master key MK, a keyword set Dw of data, and set keyword policy Aw′=Fw,ρ, Fw∈Rq2n×m with row labels ρj∈H, ∀j∈n, H∈Aw′. Generate a vector v=s2,r2,⋯,rm, where r2,⋯,rm⟵Rq2, and s2∈Rq2 is the secret to be shared. δi′=Fwi×v∈Rq2,i∈1,n, where Fwi is the vector corresponding to ith row of Fw. Then, choose a uniformly random element r1′⟵Rq2, and noise terms e_′.e_i′⟵χ2; compute T0=sk0r2s2+pe_′∈Rq2, Ti=a2skir2δi′+pe_i′∈Rq2, and output trapdoor Tw′=T0,Ti.


#### 3.4.5. Search Phase

The search phase mainly involves two parts. The first is that DU embeds trapdoorTw′ into TX, then publishes it to the smart contract address of the blockchain, and then invokes the search contract for calculation and retrieval. After the search is completed, the blockchain returns the data to DU through the user address. The two data structures are shown in Table 2.Table 2
Blockchain data structure in search phase.
IdentificationFromToActionTimestampSignatureTransactionID_2DUBCCalculationTimestamp2Sig2TX,TYID_3BCDUPublishTimestamp3Sig3TX,TYSearchPP,Iw,Tw′⟶ct. Input public parameters PP, index Iw, and trapdoor Tw′. If the set of keyword meets the keyword policy Aw′ and I⊂1,⋯,n, I=i:ρi∈Aw′, compute a set of constants ωi∈Rq2i∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδi′ωi=s2, and compute J=T0−I0∑i∈IIiωiTimodp; if J=0, the search is successful, and ct is returned; otherwise, it return ⊥. The correctness of the successful search of the scheme is explained as follows.
(1)J′=T0−I0∑i∈IIiωiTi=T0−I0∑i∈IIiωia2skir2δi′+pe_i′=T0−I0a2r2s2∑i∈IskiIi−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2∑i∈Ipki+pe_ipki−1t+pe_i′′−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2∑i∈It+pe_ipki−1t+pkipe_i′′+p2e_ie_i′′−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2t−pI0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−I0p∑i∈Ie_i′ωiIi=sk0r2s2+pe_′−pk0t−1+pe_′′a2r2s2t−pT0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−T0p∑i∈Ie_i′ωiIi=pe_0r2s2+pe_′−pe_′′a2r2s2t−pT0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−T0p∑i∈Ie_i′ωiIi.If the conditions are met, thenJ=J′modp=0. Otherwise, there will be ∑i∈Iδi′ωi≠s2 and J=J′modp≠0; the access will be terminated.The above algorithm will be executed in the smart contract, and the design of smart contract is shown in Table3.Table 3
Implementation process of contract.
Search contractInputUser ID, trapdoor, DU addressOutputCiphertext set (ct.row) or ⊥1.While (true) do2.CalculateJ by executing ..3.If (J==0) then4.Addct to ct.row5.Else6.Return (⊥)7.End if8.Continue9.End while


#### 3.4.6. Decryption Phase

After receiving the ciphertext, the user decrypts it according to his own key. The decryption algorithm is as follows.DecPK,ct,sk⟶M. Input public parameters PK, ciphertext ct, and user’s secret key sk. If the DU meets the access control policy A, I⊂1,⋯,n, I=i:ρi∈A, compute a set of constants ωi∈Rq1i∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδi⋅ωi=s1; compute M′=C0−K0∑i∈ICiωiKi, M=M′modp; the DU can download the data through the address L and decrypt it with the symmetric key k to obtain data.The correctness of the successful decryption of the scheme is explained as follows.(2)M′=C0−K0∑i∈ICiωiKi=C0−K0∑i∈IarPKiδi+pei′ωiKi=C0−K0ar1s∑i∈IPKi⋅Ki−K0p∑i∈Iei′ωiKi=C0−K0ar1s∑i∈ISKi+peiSKi−1t+pei′′−K0p∑i∈Iei′ωiKi=C0−K0ar1s1∑i∈It+SKipei′′+peiSKi−1t+p2eiei′′−K0p∑i∈Iei′ωiKi=C0−K0ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=PK0r1s1+M+pe′−K0ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=aSK0+pe0r1s1+M+pe′−SK0t−1+pe″ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=pe0r1s1+M+pe′−pe″ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi.Then,M=M′modp, and in order to ensure the correctness of the scheme, the noise term in the scheme must be small enough compared to the ratio of q to p.After successful decryption, the user obtains the data address and the symmetric key and decrypts the data with the symmetric key after obtaining the data from IPFS to obtain the original data.


## 3.1. System Model

The model in this scheme can be divided into three layers, such as storage layer, blockchain service layer, and application layer from bottom to top. The model is shown in Figure1.Figure 1
System model.The storage layer is responsible for providing data storage, which is divided into blockchain data storage and IPFS (Inter Planetary File System) data storage. Blockchain data mainly includes system initialization parameters, relevant information applied by users, indexes, and initial ciphertext, etc., and these data will be stored in the form of transactions; IPFS mainly stores the encrypted data uploaded by users. In the blockchain service layer, it is mainly divided into Unit-chain and Region-chain, in which Unit-chain is mainly responsible for internal data services, including data recording and access services; The Region-chain is mainly responsible for cross domain data services between different units. Based on the weak credit environment, this model is based on the Consortium Blockchain, and only licensed nodes can operate. At the same time, the credit consensus mechanism is adopted, and the nodes with violations will be revoked and removed from the system. The nodes in this model are mainly divided into general nodes and cross domain nodes. General nodes mainly maintain blockchain services within their own units, and cross domain nodes are responsible for connecting blockchains between two different domains, providing cross domain access services, and deploying the authority on cross domain nodes to improve work efficiency and resource utilization. The application layer provides various functional applications.The proposed system includes five entities:Authority, Data Owner (DO), Inter Planetary File System (IPFS), Data User (DU), and Blockchain. The Authority is deployed on the Blockchain. The relationship among the entities is shown in Figure 2.
(1)
Authority. The authority generates the system’s public parameters and master key, manages the users in the system, and constructs the private key for each user according to the user’s identity and authority, then the authority generates temporary keys for users in other domains and search traps for users during cross-domain access. We assume that the authority is completely trusted, will faithfully perform various operations, and will not disclose users’ personal information. In order to facilitate operation and data processing, we deploy the authority to the cross-domain nodes of the blockchain(2)
Data Owner (DO). The data owner generates keyword index Iw based on data and encrypts data with symmetric key k, then uploads encrypted data to the IPFS. After that, DO sets the access policy of the data and encrypts the symmetric key and address, then DO uploads this ciphertext ct and index Iw to blockchain(3)
Inter Planetary File System (IPFS). The IPFS is responsible for storing data and returning an address. IPFS is honest but curious, always correctly implement the requirements put forward by all entities in the scheme, but attempts to decrypt the ciphertext content(4)
Data User (DU). The data user can access data according to their needs. Apply to the authority for a search trapdoor as needed and send it to the blockchain node. After obtaining the returned initial ciphertext, DU decrypts the ciphertext according to private key. After obtaining the address, download the corresponding data from IPFS, then DU can decrypt the data according to the symmetric key(5)
Blockchain. The blockchain performs smart contract and runs algorithm, and important events in the access process will form blocks in the form of transactions and be saved in the blockchain. Due to the guarantee of trust proof of work, the node will faithfully perform operations. We assume that the entity is not completely trusted and may try to decipher user’s dataFigure 2
System architecture.


## 3.2. Overview of the Scheme

Based on ABE and blockchain, the scheme realizes the data access control of users in the same domain or between different domains and can also provide ciphertext-search function. In order to ensure the traceability and tamper-proof of the search process, important events in the access process will be formed into blocks in the form of transactions and stored in the blockchain. The information contained in the release record can be determined according to the specific situation. If the privacy is strong, it can be released in the form of pseudo-ID or other forms, which is not the focus of the scheme and will not be discussed too much. The access process of the scheme is shown in Figure3. The specific contents of the scheme are as follows.
(1)
Initialize accounts, deploy smart contracts, and initialize systems(2)
The user submits the registration information to authority, which verifies and generates the corresponding private key(3)
DO extracts keywords from the data to be shared and generates an indexIw, then encrypts the data through a symmetric algorithm, and uploads the encrypted data to IPFS, then gets address L, then encrypts the address and symmetric key k according to own strategy to get the initial ciphertext ct, and finally, embeds ct and Iw into a transaction, and publishes it to the blockchain(4)
When DU needs to access the data in their own domain, DU sends an application to their authority, which contains the visitor’s information, keyword combination, and signature. The authority first verifies the user’s identity. If the user is forged or illegal, it will refuse access; if the identity is valid, the trapdoorTw′ is generated through keyword combination and is sent to the node for search(5)
When DU needs to access the data of other domains, they first apply to their authority. After receiving the application, the cross-domain node, as the user’s agent, submits a temporary access application to the authority of the target domain. After verification, the authority of the target domain assigns a temporary private key. The private key has time or times limit when used, and then follow step (4)(6)
According to the incentive mechanism, after receiving the search trapdoorTw′, the node runs the algorithm for matching search that to get reward. When the keywords match, the node will return the corresponding initial ciphertext ct; otherwise, it will return ⊥(7)
When DUs receive the initial ciphertextct, they decrypt it with their own private key. If their own attributes meet the policies formulated by the DO, it can be decrypted smoothly to obtain the address L and symmetric key k. Once decrypted successfully, the user’s “wallet” will publish the access record to the blockchain; otherwise, it will return ⊥(8)
Finally, DU submits the address to IPFS, downloads the corresponding encrypted data, and then, decrypts it with symmetric keyk to obtain the dataFigure 3
Access flow chart.The scheme consists of the following eight algorithms.Setup1λ1,U⟶PK,MSK. The algorithm is executed by authority. Given the security parameter λ1, and the collection of all attributes U in the system, this algorithm outputs public parameters PK and master secret key MSK.Setup2λ2,W⟶PP,MK. The algorithm is executed by authority. Given the security parameter λ2, and the collection of all attributes W in the system, this algorithm outputs public parameters PP and master key MK.IGenPP,Dw⟶Iw. The algorithm is executed by DO. Input public parameters PP, a set of keywords Dw used to describe data. This algorithm outputs index Iw.EncPK,M,A⟶ct. The algorithm is executed by DO. Input public parameters PK, the message M about address and symmetric key M=kL, and user’s access policy A. This algorithm outputs the ciphertext ct.keyGenMSK,D⟶sk. The algorithm is executed by authority. Input master secret key MSK and user’s attribute set D. This algorithm outputs the secret key sk for the user.TGenMK,Aw′⟶Tw′. The algorithm is executed by authority. Input master key MK and user’s keyword policy Aw′. This algorithm outputs a trapdoor Tw′.SearchPP,Iw,Tw′⟶ct. The algorithm is executed by a node of blockchain. Input public parameters PP, index Iw, and a trapdoor Tw′; if keywords match the corresponding data, the ciphertext ct is returned; otherwise, it return ⊥.DecPK,ct,sk⟶M. The algorithm is executed by DU. Input public parameters PK, ciphertext ct, and user’s secret key sk. This algorithm outputs M=kL, then the DU can download the data through the address L and decrypt it with the symmetric key k to obtain the data.


## 3.3. Security Model

It is assumed that the authority is a fully trusted entity. IPFS and blockchain are semitrusted entities. They will faithfully perform operations, but they may try to decipher user data; IPFS and blockchain may collude with attackers. Assuming that the channel between users and authority is a secure channel, consider the following attacker and security models.(1)
The scheme should meet the basic data security requirements and ensure the confidentiality of the data in the sharing process. The attacker 1 mainly focuses on the security problems in the system of ABE and attempts to decrypt the encrypted data(2)
Based on the characteristics of ABE, the scheme should be able to resist collusion attack. We define attacker 2 as malicious legitimate users, who can obtain any number of keys and attempt to collude to expand their decryption ability. It is defined that if the advantage of attacker 2 can be ignored in any polynomial time, the scheme meets the security of anticollusion attack(3)
The scheme should meet the privacy security of the index, and the attacker should not be able to distinguish the index corresponding to different keywords. Define that attacker 3 attempts to obtain information from the index(4)
The scheme should meet the privacy security of the trapdoor, and the attacker should not be able to distinguish the trapdoor corresponding to different keywords. Define that attacker 4 attempts to obtain information from the trapdoorDefinition 6 (IND-CPA security).
The definition is given by describing the game between adversaryA and simulator B. The scheme satisfies the security of chosen-plaintext attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A selects an access structure A∗ and sends it to B.
Setup. The simulator B generates public parameters PK and master key MSK and sends PK to A.
Inquiry Phase 1. The adversary A asks the simulator B for the private key, but A’s attribute set does not meet the access structure. The simulator runs the KeyGen algorithm to generate the private key and send it to A.
Challenge. The adversary A chooses two messages M0,M1∈0,1 and sends them to simulator B, then B randomly selects b∈0,1 to calculate the challenge ciphertext and sends it to A.
Inquiry Phase 2.A asks for the key as in phase 1.
Guess. Adversary A outputs his guess b′ about b. The advantage of A in this game is defined as advA=Prb′=b−1/2.Definition 7 (IND-CKA security).
The definition is given by describing the game between adversaryA3 and simulator B3. The scheme satisfies the security of chosen-keyword attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A3 selects Dw0∗ and Dw1∗ as two keywords with the same length and sends them to B3.
Setup. The simulator B3 generates public parameters PP and master key MK and sends PP to A3.
Inquiry Phase 1.A3 sends Dwi∗ keywords to B3, then B3 runs the IGenPP,Dw⟶Iw algorithm to generate Iwi and send it to A3. Note that the keyword set of the query cannot be the same as the keyword set of the challenge.
Challenge.B3 randomly selects b∈0,1 to calculate the challenge index Iwb and send it to A3.
Inquiry Phase 2.A3 asks for the index as in phase 1.
Guess. Adversary A3 outputs his guess b′ about b. The advantage of A3 in this game is defined as advA3=Prb′=b−1/2.Definition 8 (IND-IKGA security).
The definition is given by describing the game between adversaryA4 and simulator B4. The scheme satisfies the security of internal-keyword guessing attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A4 selects Aw0 and Aw1 as two keyword policies with the same length and sends them to B4.
Setup. The simulator B4 generates public parameters PP and master key MK and sends PP to A4.
Inquiry Phase 1.A4 sends Awi∗ keyword policy to B4, then B4 runs the TGenMK,Aw′⟶Tw′ algorithm to generate Twi and send it to A4. Note that the keyword set of the query cannot be the same as the keyword set of the challenge.
Challenge.B4 randomly selects b∈0,1 to calculate the challenge keyword-policy Awb and send it to A4.
Inquiry Phase 2.A4 asks for the trapdoor as in phase 1.
Guess. Adversary A4 outputs his guess b′ about b. The advantage of A4 in this game is defined as advA4=Prb′=b−1/2.


## 3.4. Construction of the CD-ABSE Scheme

### 3.4.1. Initialization Phase

This phase mainly includes the initialization of the authority and the blockchain system, in which the blockchain system completes the setting of the corresponding accounts and nodes, etc. The initialization of the authority mainly includes the following two algorithms.Setup1λ1,U⟶PK,MSK. Given the security parameter λ1 and the collection of all attributes U in the system, randomly select a large prime number q1=1mod2λ1 and a small positive integer p1, where p1≪q1 and gcdp1,q1=1. Let fx=xd+1, where d is a power of 2. Let Rq1=Zq1x/<fx> be the ring of integer polynomials modulo both fx and q1. Let χ1=χ1λ be an error distribution over Rq1. Select a uniformly random SK0⟵Rq1 and random element a1⟵Rq1, then choose a small noise term e0⟵χ1. Compute PK0=aSK0+pe0∈Rq1. Next, select a pair of uniformly random SKi,SKi−1⟵Rq1 for each attribute in U, where SKi−1 is the inverse of SKi in Rq1, and select a small noise term ei⟵χ1, then compute PKi=SKi+pei∈Rq1. Lastly, output the public parameters PK=a,PK0,PKii=1n and the master secret key MSK=SK0,SKii=1n,SKi−1i=1n.Setup2λ2,W⟶PP,MK. Given the security parameter λ2, and the collection of all keywords W in the system, randomly select a large prime number q2=1mod2λ2 and a small positive integer p2, where p2≪q2 and gcdp2,q2=1. Let fx=xd+1, where d is a power of 2. Let Rq2=Zq2x/<fx> be the ring of integer polynomials modulo both fx and q2. Let χ2=χ2λ be an error distribution over Rq2. Select a uniformly random pk0⟵Rq2 and random element a2⟵Rq2, then choose a small noise term e_0⟵χ2. Compute sk0=a2pk0+pe_0∈Rq2. Next, select a pair of uniformly random pki,pki−1⟵Rq2 for each keyword in W, where pki−1 is the inverse of pki in Rq2, and select a small noise term e_i⟵χ2, then compute ski=pki+pe_i∈Rq2. Lastly, output the public parameters PP=pk0,pkii=1n,pki−1i=1n and the master secret key MK=a2,sk0,skii=1n.


### 3.4.2. Registration Phase

This phase mainly refers to that the user submits a registration application to the authority, and the authority runs the following algorithm to generate a key for the user.keyGenMSK,D⟶sk. Input master key MSK, user’s attribute set D, then choose small noise term e″,ei′′⟵χ1, and select a pair of uniformly random t,t−1⟵Rq1 for each attribute in D. Compute K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei′′∈Rq,∀i∈D; output the secret key sk=K0,Ki.


### 3.4.3. Data Preparation Phase

This phase mainly refers to the operation when the data owner shares the data, including symmetrically encrypting the data, sending the encrypted data to IPFS and obtaining the address, and then, encrypting the address and the symmetric key to obtain the ciphertext. In addition, the user also needs to generate a ciphertext index for this data. The algorithm for index generation and encryption is as follows:IGenPP,Dw⟶Iw. Input public parameters PP and a keyword set Dw of data. Select a pair of uniformly random t′,t′−1⟵Rq2, and choose small noise term e_′′,e_i′′⟵χ2 for each keyword in Dw. Compute I0=pk0t−1+pe_′′∈Rq2, Ii=pki−1t+pe_i′′∈Rq2,∀i∈Dw; output an index Iw=I0,Ii.EncPK,M,A⟶ct. Input public parameters PK, the message M∈0,1n about kL, and set access policy A=F,ρ, F∈Rq1n×m with row labels ρj∈H, ∀j∈n, H∈A. Generate a vector v=s1,r2,⋯,rm, where r2,⋯,rm⟵Rq1, and s1∈Rq1 is the secret to be shared. δi=Fi×v∈Rq1,i∈1,n, where Fi is the vector corresponding to ith row of F. Then, choose a uniformly random element r1⟵Rq1 and noise terms e′,ei′⟵χ1; compute c0=PK0r1s1+M+p⋅e′∈Rq1, ci=ar1PKiδi+pei′∈Rq1, and output ct=c0,ci.After completing the above steps, DO embeds the ciphertextct and index Iw into the transaction TX and signs it to TY, then broadcasts TX to the whole blockchain. After the transaction is verified, it is recorded on the blockchain by the miner. The data structure is as shown in Table 1.Table 1
Blockchain data structure in data preparation phase.
IdentificationFromToActionTimestampSignatureTransactionID_1DOBCPublishTimestamp1Sig1TX,TY


### 3.4.4. Access Preparation Phase

The user sends the data keywords to be accessed to the authority, and the authority executes the following algorithm to generate a search trapdoor for the user.TGenMK,Aw′⟶Tw′. Input master key MK, a keyword set Dw of data, and set keyword policy Aw′=Fw,ρ, Fw∈Rq2n×m with row labels ρj∈H, ∀j∈n, H∈Aw′. Generate a vector v=s2,r2,⋯,rm, where r2,⋯,rm⟵Rq2, and s2∈Rq2 is the secret to be shared. δi′=Fwi×v∈Rq2,i∈1,n, where Fwi is the vector corresponding to ith row of Fw. Then, choose a uniformly random element r1′⟵Rq2, and noise terms e_′.e_i′⟵χ2; compute T0=sk0r2s2+pe_′∈Rq2, Ti=a2skir2δi′+pe_i′∈Rq2, and output trapdoor Tw′=T0,Ti.


### 3.4.5. Search Phase

The search phase mainly involves two parts. The first is that DU embeds trapdoorTw′ into TX, then publishes it to the smart contract address of the blockchain, and then invokes the search contract for calculation and retrieval. After the search is completed, the blockchain returns the data to DU through the user address. The two data structures are shown in Table 2.Table 2
Blockchain data structure in search phase.
IdentificationFromToActionTimestampSignatureTransactionID_2DUBCCalculationTimestamp2Sig2TX,TYID_3BCDUPublishTimestamp3Sig3TX,TYSearchPP,Iw,Tw′⟶ct. Input public parameters PP, index Iw, and trapdoor Tw′. If the set of keyword meets the keyword policy Aw′ and I⊂1,⋯,n, I=i:ρi∈Aw′, compute a set of constants ωi∈Rq2i∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδi′ωi=s2, and compute J=T0−I0∑i∈IIiωiTimodp; if J=0, the search is successful, and ct is returned; otherwise, it return ⊥. The correctness of the successful search of the scheme is explained as follows.
(1)J′=T0−I0∑i∈IIiωiTi=T0−I0∑i∈IIiωia2skir2δi′+pe_i′=T0−I0a2r2s2∑i∈IskiIi−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2∑i∈Ipki+pe_ipki−1t+pe_i′′−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2∑i∈It+pe_ipki−1t+pkipe_i′′+p2e_ie_i′′−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2t−pI0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−I0p∑i∈Ie_i′ωiIi=sk0r2s2+pe_′−pk0t−1+pe_′′a2r2s2t−pT0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−T0p∑i∈Ie_i′ωiIi=pe_0r2s2+pe_′−pe_′′a2r2s2t−pT0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−T0p∑i∈Ie_i′ωiIi.If the conditions are met, thenJ=J′modp=0. Otherwise, there will be ∑i∈Iδi′ωi≠s2 and J=J′modp≠0; the access will be terminated.The above algorithm will be executed in the smart contract, and the design of smart contract is shown in Table3.Table 3
Implementation process of contract.
Search contractInputUser ID, trapdoor, DU addressOutputCiphertext set (ct.row) or ⊥1.While (true) do2.CalculateJ by executing ..3.If (J==0) then4.Addct to ct.row5.Else6.Return (⊥)7.End if8.Continue9.End while


### 3.4.6. Decryption Phase

After receiving the ciphertext, the user decrypts it according to his own key. The decryption algorithm is as follows.DecPK,ct,sk⟶M. Input public parameters PK, ciphertext ct, and user’s secret key sk. If the DU meets the access control policy A, I⊂1,⋯,n, I=i:ρi∈A, compute a set of constants ωi∈Rq1i∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδi⋅ωi=s1; compute M′=C0−K0∑i∈ICiωiKi, M=M′modp; the DU can download the data through the address L and decrypt it with the symmetric key k to obtain data.The correctness of the successful decryption of the scheme is explained as follows.(2)M′=C0−K0∑i∈ICiωiKi=C0−K0∑i∈IarPKiδi+pei′ωiKi=C0−K0ar1s∑i∈IPKi⋅Ki−K0p∑i∈Iei′ωiKi=C0−K0ar1s∑i∈ISKi+peiSKi−1t+pei′′−K0p∑i∈Iei′ωiKi=C0−K0ar1s1∑i∈It+SKipei′′+peiSKi−1t+p2eiei′′−K0p∑i∈Iei′ωiKi=C0−K0ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=PK0r1s1+M+pe′−K0ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=aSK0+pe0r1s1+M+pe′−SK0t−1+pe″ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=pe0r1s1+M+pe′−pe″ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi.Then,M=M′modp, and in order to ensure the correctness of the scheme, the noise term in the scheme must be small enough compared to the ratio of q to p.After successful decryption, the user obtains the data address and the symmetric key and decrypts the data with the symmetric key after obtaining the data from IPFS to obtain the original data.


## 3.4.1. Initialization Phase

This phase mainly includes the initialization of the authority and the blockchain system, in which the blockchain system completes the setting of the corresponding accounts and nodes, etc. The initialization of the authority mainly includes the following two algorithms.Setup1λ1,U⟶PK,MSK. Given the security parameter λ1 and the collection of all attributes U in the system, randomly select a large prime number q1=1mod2λ1 and a small positive integer p1, where p1≪q1 and gcdp1,q1=1. Let fx=xd+1, where d is a power of 2. Let Rq1=Zq1x/<fx> be the ring of integer polynomials modulo both fx and q1. Let χ1=χ1λ be an error distribution over Rq1. Select a uniformly random SK0⟵Rq1 and random element a1⟵Rq1, then choose a small noise term e0⟵χ1. Compute PK0=aSK0+pe0∈Rq1. Next, select a pair of uniformly random SKi,SKi−1⟵Rq1 for each attribute in U, where SKi−1 is the inverse of SKi in Rq1, and select a small noise term ei⟵χ1, then compute PKi=SKi+pei∈Rq1. Lastly, output the public parameters PK=a,PK0,PKii=1n and the master secret key MSK=SK0,SKii=1n,SKi−1i=1n.Setup2λ2,W⟶PP,MK. Given the security parameter λ2, and the collection of all keywords W in the system, randomly select a large prime number q2=1mod2λ2 and a small positive integer p2, where p2≪q2 and gcdp2,q2=1. Let fx=xd+1, where d is a power of 2. Let Rq2=Zq2x/<fx> be the ring of integer polynomials modulo both fx and q2. Let χ2=χ2λ be an error distribution over Rq2. Select a uniformly random pk0⟵Rq2 and random element a2⟵Rq2, then choose a small noise term e_0⟵χ2. Compute sk0=a2pk0+pe_0∈Rq2. Next, select a pair of uniformly random pki,pki−1⟵Rq2 for each keyword in W, where pki−1 is the inverse of pki in Rq2, and select a small noise term e_i⟵χ2, then compute ski=pki+pe_i∈Rq2. Lastly, output the public parameters PP=pk0,pkii=1n,pki−1i=1n and the master secret key MK=a2,sk0,skii=1n.


## 3.4.2. Registration Phase

This phase mainly refers to that the user submits a registration application to the authority, and the authority runs the following algorithm to generate a key for the user.keyGenMSK,D⟶sk. Input master key MSK, user’s attribute set D, then choose small noise term e″,ei′′⟵χ1, and select a pair of uniformly random t,t−1⟵Rq1 for each attribute in D. Compute K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei′′∈Rq,∀i∈D; output the secret key sk=K0,Ki.


## 3.4.3. Data Preparation Phase

This phase mainly refers to the operation when the data owner shares the data, including symmetrically encrypting the data, sending the encrypted data to IPFS and obtaining the address, and then, encrypting the address and the symmetric key to obtain the ciphertext. In addition, the user also needs to generate a ciphertext index for this data. The algorithm for index generation and encryption is as follows:IGenPP,Dw⟶Iw. Input public parameters PP and a keyword set Dw of data. Select a pair of uniformly random t′,t′−1⟵Rq2, and choose small noise term e_′′,e_i′′⟵χ2 for each keyword in Dw. Compute I0=pk0t−1+pe_′′∈Rq2, Ii=pki−1t+pe_i′′∈Rq2,∀i∈Dw; output an index Iw=I0,Ii.EncPK,M,A⟶ct. Input public parameters PK, the message M∈0,1n about kL, and set access policy A=F,ρ, F∈Rq1n×m with row labels ρj∈H, ∀j∈n, H∈A. Generate a vector v=s1,r2,⋯,rm, where r2,⋯,rm⟵Rq1, and s1∈Rq1 is the secret to be shared. δi=Fi×v∈Rq1,i∈1,n, where Fi is the vector corresponding to ith row of F. Then, choose a uniformly random element r1⟵Rq1 and noise terms e′,ei′⟵χ1; compute c0=PK0r1s1+M+p⋅e′∈Rq1, ci=ar1PKiδi+pei′∈Rq1, and output ct=c0,ci.After completing the above steps, DO embeds the ciphertextct and index Iw into the transaction TX and signs it to TY, then broadcasts TX to the whole blockchain. After the transaction is verified, it is recorded on the blockchain by the miner. The data structure is as shown in Table 1.Table 1
Blockchain data structure in data preparation phase.
IdentificationFromToActionTimestampSignatureTransactionID_1DOBCPublishTimestamp1Sig1TX,TY


## 3.4.4. Access Preparation Phase

The user sends the data keywords to be accessed to the authority, and the authority executes the following algorithm to generate a search trapdoor for the user.TGenMK,Aw′⟶Tw′. Input master key MK, a keyword set Dw of data, and set keyword policy Aw′=Fw,ρ, Fw∈Rq2n×m with row labels ρj∈H, ∀j∈n, H∈Aw′. Generate a vector v=s2,r2,⋯,rm, where r2,⋯,rm⟵Rq2, and s2∈Rq2 is the secret to be shared. δi′=Fwi×v∈Rq2,i∈1,n, where Fwi is the vector corresponding to ith row of Fw. Then, choose a uniformly random element r1′⟵Rq2, and noise terms e_′.e_i′⟵χ2; compute T0=sk0r2s2+pe_′∈Rq2, Ti=a2skir2δi′+pe_i′∈Rq2, and output trapdoor Tw′=T0,Ti.


## 3.4.5. Search Phase

The search phase mainly involves two parts. The first is that DU embeds trapdoorTw′ into TX, then publishes it to the smart contract address of the blockchain, and then invokes the search contract for calculation and retrieval. After the search is completed, the blockchain returns the data to DU through the user address. The two data structures are shown in Table 2.Table 2
Blockchain data structure in search phase.
IdentificationFromToActionTimestampSignatureTransactionID_2DUBCCalculationTimestamp2Sig2TX,TYID_3BCDUPublishTimestamp3Sig3TX,TYSearchPP,Iw,Tw′⟶ct. Input public parameters PP, index Iw, and trapdoor Tw′. If the set of keyword meets the keyword policy Aw′ and I⊂1,⋯,n, I=i:ρi∈Aw′, compute a set of constants ωi∈Rq2i∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδi′ωi=s2, and compute J=T0−I0∑i∈IIiωiTimodp; if J=0, the search is successful, and ct is returned; otherwise, it return ⊥. The correctness of the successful search of the scheme is explained as follows.
(1)J′=T0−I0∑i∈IIiωiTi=T0−I0∑i∈IIiωia2skir2δi′+pe_i′=T0−I0a2r2s2∑i∈IskiIi−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2∑i∈Ipki+pe_ipki−1t+pe_i′′−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2∑i∈It+pe_ipki−1t+pkipe_i′′+p2e_ie_i′′−I0p∑i∈Ie_i′ωiIi=T0−I0a2r2s2t−pI0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−I0p∑i∈Ie_i′ωiIi=sk0r2s2+pe_′−pk0t−1+pe_′′a2r2s2t−pT0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−T0p∑i∈Ie_i′ωiIi=pe_0r2s2+pe_′−pe_′′a2r2s2t−pT0a2r2s2∑i∈Ie_ipki−1t+kipe_i′′+pe_ie_i′′−T0p∑i∈Ie_i′ωiIi.If the conditions are met, thenJ=J′modp=0. Otherwise, there will be ∑i∈Iδi′ωi≠s2 and J=J′modp≠0; the access will be terminated.The above algorithm will be executed in the smart contract, and the design of smart contract is shown in Table3.Table 3
Implementation process of contract.
Search contractInputUser ID, trapdoor, DU addressOutputCiphertext set (ct.row) or ⊥1.While (true) do2.CalculateJ by executing ..3.If (J==0) then4.Addct to ct.row5.Else6.Return (⊥)7.End if8.Continue9.End while


## 3.4.6. Decryption Phase

After receiving the ciphertext, the user decrypts it according to his own key. The decryption algorithm is as follows.DecPK,ct,sk⟶M. Input public parameters PK, ciphertext ct, and user’s secret key sk. If the DU meets the access control policy A, I⊂1,⋯,n, I=i:ρi∈A, compute a set of constants ωi∈Rq1i∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδi⋅ωi=s1; compute M′=C0−K0∑i∈ICiωiKi, M=M′modp; the DU can download the data through the address L and decrypt it with the symmetric key k to obtain data.The correctness of the successful decryption of the scheme is explained as follows.(2)M′=C0−K0∑i∈ICiωiKi=C0−K0∑i∈IarPKiδi+pei′ωiKi=C0−K0ar1s∑i∈IPKi⋅Ki−K0p∑i∈Iei′ωiKi=C0−K0ar1s∑i∈ISKi+peiSKi−1t+pei′′−K0p∑i∈Iei′ωiKi=C0−K0ar1s1∑i∈It+SKipei′′+peiSKi−1t+p2eiei′′−K0p∑i∈Iei′ωiKi=C0−K0ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=PK0r1s1+M+pe′−K0ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=aSK0+pe0r1s1+M+pe′−SK0t−1+pe″ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi=pe0r1s1+M+pe′−pe″ar1s1t−K0ar1s1p∑i∈ISKiei′′+eiSKi−1t+peiei′′−K0p∑i∈Iei′ωiKi.Then,M=M′modp, and in order to ensure the correctness of the scheme, the noise term in the scheme must be small enough compared to the ratio of q to p.After successful decryption, the user obtains the data address and the symmetric key and decrypts the data with the symmetric key after obtaining the data from IPFS to obtain the original data.


## 4. Analysis

### 4.1. Security Analysis

This section will discuss the security of the scheme from four aspects according to the security definition in Section3.3.
(1)
Analysis of IND-CPA securityTheorem 9.
If there exists a Probabilistic Polynomial Time (PPT) algorithm adversaryA, with the advantage ε to win the game in Definition 6, then there exists a PPT simulator B which can decide Decision R‐LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionR‐LWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudorandom Os or a truly random Os′, then the simulator B differentiates O by adversary A. First, B queries the oracle and receives (t+1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,⋯,t, then proceed as follows.Initialization phase. Given a set of attributes U, the adversary A selects an access structure A∗ that wishes to be challenged and sends it to B.Setup.B runs Setupλ,U⟶PP,MSK, let PK0=pω0∈Rq, and select a pair of uniformly random SKi,SKi−1⟵Rq for each attribute in U. Let PKi=pωi∈Rq if i∈A∗; otherwise, let PKi=SKi+pei∈Rq. Then, B sends PK=a,PK0,PKii=1n to A.Inquiry Phase 1.A sends private key queries for D∗=D1∗,D2∗,⋯,Dj∗, where D∗ does not meet the access policy A∗. B runs KeyGen, computes K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei′′∈Rq,∀i∈D∗, and sends K=K0,Ki to A.Challenge.A chooses two messages M0,M1∈0,1 and sends them to simulator B, then B randomly selects b∈0,1, if b=0, B randomly chooses x⟵Rq and lets C0=px0∈Rq, Cj=pxj∈Rq; if b=1, let C0=pv0+M∈Rq, Cj=pvj∈Rq for j∈A∗.Inquiry Phase 2.A asks for the key as in phase 1.Guess. Adversary A outputs his guess b′ about b to B. If b′=b, output O′=Os; otherwise, output O′=Os′. The advantage of A in this game is defined as advA=Prb′=b−1/2, so the oracle O has the following two cases.O is a noisy pseudorandom Os. The advantage of A is ε, then Prb′=bO=Os=1/2+ε and PrO′=OO=Os=1/2+ε.O is a truly random Os′. A has no advantage ε and unable to get information about b, then Prb′≠bO=Os′=1/2 and PrO′=OO=Os′=1/2.Then, the advantage of simulatorB is as follows.
(3)12PrO′=OO=Os+12PrO′=OO=Os′−12=1212+ε+1212−12=ε2.Hence, Theorem9 is proved, and this means that the scheme meets IND-CPA security.
(2)
Analysis of anticollusion attack securityThe private key generated by the authority to the user contains the randomly selected reciprocal elementt,t−1⟵Rq1, which ensures the uniqueness of the key. At the same time, from the assumption of learning with error, it is difficult for malicious users to restore effective parameter information from their own key. Even if the attributes of colluding users are combined to contain the attributes of the target they want to attack, it is difficult to generate an effective new private key by effective means.
(3)
Analysis of IND-CKA securityTheorem 10.
If there exists a Probabilistic Polynomial Time (PPT) algorithm adversaryA3, with the advantage ε to win the game in Definition 7, then there exists a PPT simulator B3 which can decide Decision R‐LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionR‐LWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudorandom Os or a truly random Os′, then the simulator B3 differentiates O by adversary A3. First, B3 queries the oracle and receives (t+1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,⋯,t, then proceed as follows.Initialization phase. Given a set of keywords W, the adversary A3 selects Dw0∗ and Dw1∗ as two keywords with the same length that wishes to be challenged and sends them to B3.Setup.B3 runs Setupλ2,W⟶PP,MK, let sk0=pω0∈Rq2, and select a pair of uniformly random pki,pki−1⟵Rq2 for each keyword in W. Let ski=pki+pe_i∈Rq2. Then, B3 sends PP=pk0,pkii=1n,pki−1i=1n to A3.Inquiry Phase 1.A3 sends index queries for Dwi∗, where the keyword set of the query cannot be the same as the keyword set of the challenge. B3 runs IGenPP,Dwi⟶Iwi, computes I0=pk0t−1+pe_′′∈Rq2, Ii=pki−1t+pe_i′′∈Rq2,∀i∈Dwi∗, and sends Iwi=I0,Ii to A3.Challenge.B3 randomly selects b∈0,1; if b=0, B3 randomly chooses x⟵Rq and lets I0=px0∈Rq, Ii=pxi∈Rq; if b=1, let I0=pk0t−1+pe_′′∈Rq2, and Ii=pki−1t+pe_i′′∈Rq2, then send Iwb=I0,Ii to A3.Inquiry Phase 2.A3 asks for the index as in phase 1.Guess. Adversary A3 outputs his guess b′ about b to B3. If b′=b, output O′=Os; otherwise, output O′=Os′. The advantage of A3 in this game is defined as advA=Prb′=b−1/2, so the oracle O has the following two cases.O is a noisy pseudorandom Os. The advantage of A3 is ε, then Prb′=bO=Os=1/2+ε, andPrO′=OO=Os=1/2+ε.O is a truly random Os′. A3 has no advantage ε and unable to get information about b, then Prb′≠bO=Os′=1/2, and PrO′=OO=Os′=1/2.Then, the advantage of simulatorB3 is as follows.
(4)12PrO′=OO=Os+12PrO′=OO=Os′−12=1212+ε+1212−12=ε2.Hence, Theorem10 is proved, and this means that the scheme meets IND-CKA security.
(4)
Analysis of IND-IKGA securityTheorem 11.
If there exists a Probabilistic Polynomial Time (PPT) algorithm adversaryA4, with the advantage ε to win the game in Definition 8, then there exists a PPT simulator B4 which can decide Decision R‐LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionR‐LWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudorandom Os or a truly random Os′, then the simulator B4 differentiate O by adversary A4. First, B4 queries the oracle and receives (t+1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,⋯,t, then proceed as follows.Initialization phase. Given a set of keywords W, the adversary A4 selects Aw0 and Aw1 as two keyword policies with the same length that wishes to be challenged and sends them to B3.Setup.B4 runs Setupλ2,W⟶PP,MK, let sk0=pω0∈Rq2, and select a pair of uniformly random pki,pki−1⟵Rq2 for each keyword in W. Let ski=pki+pe_i∈Rq2. Then, B4 sends PP=pk0,pkii=1n,pki−1i=1n to A4.Inquiry Phase 1.A4 sends trapdoor queries for Awi∗, where the keyword set of the query cannot be the same as the keyword set of the challenge. B4 runs TGenMK,Aw′⟶Tw′, set keyword policy Awi∗=Fw,ρ, Fw∈Rq2n×m with row labels ρj∈H, ∀j∈n, H∈Aw′. Generate a vector v=s2,r2,⋯,rm, where r2,⋯,rm⟵Rq2, and s2∈Rq2 is the secret to be shared. δi′=Fwi×v∈Rq2,i∈1,n, where Fwi is the vector corresponding to ith row of Fw. Then, choose a uniformly random element r1′⟵Rq2, and noise terms e_′.e_i′⟵χ2 computes T0=sk0r2s2+pe_′∈Rq2, Ti=a2skir2δi′+pe_i′∈Rq2, and sends Twi=T0,Ti to A4.Challenge.B4 randomly selects b∈0,1; if b=0, B4 randomly chooses x⟵Rq and lets T0=px0∈Rq, Ti=pxi∈Rq; if b=1, let I0=pk0t−1+pe_′′∈Rq2, Ii=pki−1t+pe_i′′∈Rq2, then send Twb=T0,Ti to A4.Inquiry Phase 2.A4 asks for the trapdoor as in phase 1.Guess. Adversary A4 outputs his guess b′ about b to B4. If b′=b, output O′=Os; otherwise, output O′=Os′. The advantage of A4 in this game is defined as advA=Prb′=b−1/2, so the oracle O has the following two cases.O is a noisy pseudorandom Os. The advantage of A4 is ε, then Prb′=bO=Os=1/2+ε, andPrO′=OO=Os=1/2+ε.O is a truly random Os′. A4 has no advantage ε and unable to get information about b, then Prb′≠bO=Os′=1/2, and PrO′=OO=Os′=1/2.Then, the advantage of simulatorB4 is as follows.
(5)12PrO′=OO=Os+12PrO′=OO=Os′−12=1212+ε+1212−12=ε2.Hence, Theorem11 is proved, and this means that the scheme meets IND-IKGA security.


### 4.2. Performance Analysis

Since the scheme in this paper is mainly constructed on the basis of CP-ABE, some schemes based on attribute-based encryption are selected for comparison, including searchable schemes, schemes combined with blockchain and lattice schemes. These schemes are selected to compare their functions, the cost of storage, calculation, and communication.(1)
Different attribute-based encryption schemes are selected for function comparison. The results are shown in Table4Table 4
Comparison with other schemes.
SchemeProblemAccess structureSearchableKeywordCross-domainAntiquantum attackBlockchain[20]DBDHAccess tree√1××√[26]SDPLSSS√1×××[27]DBDHAccess tree×—××√[28]DBDHAccess tree×—×××[29]DBDHLSSS√1××√[30]LWELSSS√1×√×[31]LWEAND√1×√√OursRLWELSSS√n√√√Scheme [20] uses searchable encryption technology to realize the search of a single keyword on the blockchain and implements access control according to CP-ABE. The scheme is constructed by bilinear pairing, which has great application prospects in social networks and medical information fields, but the scheme cannot resist quantum attacks.Scheme [26] pays attention to the problems of high computing cost and low efficiency of searching data in ABE scheme, reduces the local computing cost of users by using outsourcing technology, and proves that the scheme meets adaptive security. However, the scheme only supports single keyword search and cannot resist quantum attacks.For medical data protection, scheme [27] combines ABE and blockchain technology to enable data to be shared efficiently and safely among patients, hospitals, and other entities. The scheme does not support ciphertext search and cannot resist quantum attacks.In the Internet of Things environment, scheme [28] outsources the decryption operation in content encryption to fog nodes, solves the problem that computing is difficult due to the limited resources of Internet of Things devices and also protects users’ privacy by constructing false attributes. The scheme does not support ciphertext search and quantum attack resistance.Scheme [29] combines blockchain and ABE to realize data sharing. The scheme realizes decentralization and avoids the risk of privacy disclosure by third parties and supports ciphertext search. However, the scheme cannot resist quantum attacks.Scheme [30] solves the problem of ciphertext search in the cloud environment. The scheme only supports single-keyword search. The biggest feature is that it is based on LWE construction and can resist quantum attacks.Scheme [31] relies on the technical characteristics of Ethereum to solve the problem of single point of failure in traditional systems, and can resist quantum attacks based on the LWE problem. At the same time, the scheme enables data users to generate private keys for visitors, avoiding key abuse caused by third parties. Due to the use of AND gate multivalue access strategy, its expression ability is slightly weak.Based on RLWE, our scheme can resist quantum attacks, and LSSS has rich access structure, and the scheme realizes cross-domain access based on blockchain and can realize search of multiple keywords.(2)
Since schemes [20, 26–29] are not based on lattice structure, it is mainly compared with scheme [30, 31]. In schemes [30, 31], m and n are the parameters from lattice, m≥5nlogq, and l is the security parameter in the keyword matching algorithm in scheme [30]. N1 represents the number of all attributes in the system, N2 represents the number of all keywords in the system, Au represents the number of attributes in the user attribute set, and Aw represents the number of keywords in index, Aw′ indicates the number of keywords in the trapdoor. The results are shown in Table 5; this scheme is superior to scheme [30, 31] in size of system public key, master key, user private key, index, and trapdoor. As shown in Figure 4, the three schemes are analyzed by numerical simulation for visual representation, where n=64, q=129, N1=50, N2=50, m=5nlogq, Au=20, Aw=10, Aw′=5,l=32(3)
The comparison results with schemes [30, 31] in terms of computational cost are shown in Table 6. Since the cost of addition operation is small, it is not included in the analysis here. Ad represents the number of keywords required for successful matching, the mul represents the multiplication between vectors on the ring, and the mod represents modular operation, and other parameters have the same meaning as (2). For visual representation, numerical simulation analysis is carried out, the calculation amount of index generation, trapdoor generation, and single matching is shown in Figure 5. When the index’s number in the system is 100-1000, the search matching overhead is as shown in Figure 6(4)
The main objects of communication cost include ciphertext and index. The encrypted information in the ciphertext is mainly the address of data storage returned by IPFS and the symmetric key used for symmetric encryption of the original data. Set the sum of the two elements as 1280 bit; the index mainly includes the keyword combination of data. Now, simulate the ciphertext overhead of the number of attributes included in the attribute strategy from 5 to 50 when the keywords are 3, 6, 9, and 12, respectively. The results are shown in Figure7(5)
Experimental analysisTable 5
Storage cost.
SchemePublic keyMaster keyPrivate keyIndexTrapdoor[30]nm+m2N+2n+m2logqm2logq2nmlogq2nmAwlogq2mlogq[31]nm+m2N+n+m2logqm2logq2nmlogqm+1llogqmlogqOursnN1+2N2+3logqn2N1+N2+3logqnAu+1logqnAw+1logqnAw′+1logqFigure 4
The comparison of storage cost.Table 6
Calculation cost.
SchemeCost of index generationCost of trapdoor generationCost of single matching[30]2mnmul2mnmul4m+2mul[31]lm+1mul2mmulmlmulOursAw+1mul3Aw′+2mul2Ad+1mul+modFigure 5
The comparison of calculation cost.Figure 6
The calculation cost for indexes ranging from 100 to 1000.Figure 7
The communication cost for indexes ranging.In order to further analyze the performance of the scheme, we tested 8 algorithms in the scheme. Because there are few simulation experiments related to the lattice attribute-based encryption scheme, it is difficult to effectively compare and analyze with other schemes. Here, the efficiency of the algorithm is mainly tested and analyzed. The experimental environment is AMD ryzen 7-5800H processor 3.20 GHz, 16.0 GB memory, 64-bit Windows 11 operating system. The experimental program is written in c++ language and implemented in QT creator development environment based on NTL library. In this experiment, setting parametersq=8380417, p=3, mainly test the running time of each algorithm when the number of attributes or keywords is from 1 to 10. Since the search part of this scheme is similar to the attribute-based encryption system, two algorithms with similar principles are put into the same diagram for analysis. It can be seen from Figure 8 that the running time of the algorithm is proportional to the number of attributes or keywords contained in the algorithm process, and the experimental results are consistent with the theoretical analysis results.Figure 8
Relationship between the number of attributes or keywords and the running time of algorithm.


## 4.1. Security Analysis

This section will discuss the security of the scheme from four aspects according to the security definition in Section3.3.
(1)
Analysis of IND-CPA securityTheorem 9.
If there exists a Probabilistic Polynomial Time (PPT) algorithm adversaryA, with the advantage ε to win the game in Definition 6, then there exists a PPT simulator B which can decide Decision R‐LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionR‐LWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudorandom Os or a truly random Os′, then the simulator B differentiates O by adversary A. First, B queries the oracle and receives (t+1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,⋯,t, then proceed as follows.Initialization phase. Given a set of attributes U, the adversary A selects an access structure A∗ that wishes to be challenged and sends it to B.Setup.B runs Setupλ,U⟶PP,MSK, let PK0=pω0∈Rq, and select a pair of uniformly random SKi,SKi−1⟵Rq for each attribute in U. Let PKi=pωi∈Rq if i∈A∗; otherwise, let PKi=SKi+pei∈Rq. Then, B sends PK=a,PK0,PKii=1n to A.Inquiry Phase 1.A sends private key queries for D∗=D1∗,D2∗,⋯,Dj∗, where D∗ does not meet the access policy A∗. B runs KeyGen, computes K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei′′∈Rq,∀i∈D∗, and sends K=K0,Ki to A.Challenge.A chooses two messages M0,M1∈0,1 and sends them to simulator B, then B randomly selects b∈0,1, if b=0, B randomly chooses x⟵Rq and lets C0=px0∈Rq, Cj=pxj∈Rq; if b=1, let C0=pv0+M∈Rq, Cj=pvj∈Rq for j∈A∗.Inquiry Phase 2.A asks for the key as in phase 1.Guess. Adversary A outputs his guess b′ about b to B. If b′=b, output O′=Os; otherwise, output O′=Os′. The advantage of A in this game is defined as advA=Prb′=b−1/2, so the oracle O has the following two cases.O is a noisy pseudorandom Os. The advantage of A is ε, then Prb′=bO=Os=1/2+ε and PrO′=OO=Os=1/2+ε.O is a truly random Os′. A has no advantage ε and unable to get information about b, then Prb′≠bO=Os′=1/2 and PrO′=OO=Os′=1/2.Then, the advantage of simulatorB is as follows.
(3)12PrO′=OO=Os+12PrO′=OO=Os′−12=1212+ε+1212−12=ε2.Hence, Theorem9 is proved, and this means that the scheme meets IND-CPA security.
(2)
Analysis of anticollusion attack securityThe private key generated by the authority to the user contains the randomly selected reciprocal elementt,t−1⟵Rq1, which ensures the uniqueness of the key. At the same time, from the assumption of learning with error, it is difficult for malicious users to restore effective parameter information from their own key. Even if the attributes of colluding users are combined to contain the attributes of the target they want to attack, it is difficult to generate an effective new private key by effective means.
(3)
Analysis of IND-CKA securityTheorem 10.
If there exists a Probabilistic Polynomial Time (PPT) algorithm adversaryA3, with the advantage ε to win the game in Definition 7, then there exists a PPT simulator B3 which can decide Decision R‐LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionR‐LWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudorandom Os or a truly random Os′, then the simulator B3 differentiates O by adversary A3. First, B3 queries the oracle and receives (t+1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,⋯,t, then proceed as follows.Initialization phase. Given a set of keywords W, the adversary A3 selects Dw0∗ and Dw1∗ as two keywords with the same length that wishes to be challenged and sends them to B3.Setup.B3 runs Setupλ2,W⟶PP,MK, let sk0=pω0∈Rq2, and select a pair of uniformly random pki,pki−1⟵Rq2 for each keyword in W. Let ski=pki+pe_i∈Rq2. Then, B3 sends PP=pk0,pkii=1n,pki−1i=1n to A3.Inquiry Phase 1.A3 sends index queries for Dwi∗, where the keyword set of the query cannot be the same as the keyword set of the challenge. B3 runs IGenPP,Dwi⟶Iwi, computes I0=pk0t−1+pe_′′∈Rq2, Ii=pki−1t+pe_i′′∈Rq2,∀i∈Dwi∗, and sends Iwi=I0,Ii to A3.Challenge.B3 randomly selects b∈0,1; if b=0, B3 randomly chooses x⟵Rq and lets I0=px0∈Rq, Ii=pxi∈Rq; if b=1, let I0=pk0t−1+pe_′′∈Rq2, and Ii=pki−1t+pe_i′′∈Rq2, then send Iwb=I0,Ii to A3.Inquiry Phase 2.A3 asks for the index as in phase 1.Guess. Adversary A3 outputs his guess b′ about b to B3. If b′=b, output O′=Os; otherwise, output O′=Os′. The advantage of A3 in this game is defined as advA=Prb′=b−1/2, so the oracle O has the following two cases.O is a noisy pseudorandom Os. The advantage of A3 is ε, then Prb′=bO=Os=1/2+ε, andPrO′=OO=Os=1/2+ε.O is a truly random Os′. A3 has no advantage ε and unable to get information about b, then Prb′≠bO=Os′=1/2, and PrO′=OO=Os′=1/2.Then, the advantage of simulatorB3 is as follows.
(4)12PrO′=OO=Os+12PrO′=OO=Os′−12=1212+ε+1212−12=ε2.Hence, Theorem10 is proved, and this means that the scheme meets IND-CKA security.
(4)
Analysis of IND-IKGA securityTheorem 11.
If there exists a Probabilistic Polynomial Time (PPT) algorithm adversaryA4, with the advantage ε to win the game in Definition 8, then there exists a PPT simulator B4 which can decide Decision R‐LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionR‐LWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudorandom Os or a truly random Os′, then the simulator B4 differentiate O by adversary A4. First, B4 queries the oracle and receives (t+1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,⋯,t, then proceed as follows.Initialization phase. Given a set of keywords W, the adversary A4 selects Aw0 and Aw1 as two keyword policies with the same length that wishes to be challenged and sends them to B3.Setup.B4 runs Setupλ2,W⟶PP,MK, let sk0=pω0∈Rq2, and select a pair of uniformly random pki,pki−1⟵Rq2 for each keyword in W. Let ski=pki+pe_i∈Rq2. Then, B4 sends PP=pk0,pkii=1n,pki−1i=1n to A4.Inquiry Phase 1.A4 sends trapdoor queries for Awi∗, where the keyword set of the query cannot be the same as the keyword set of the challenge. B4 runs TGenMK,Aw′⟶Tw′, set keyword policy Awi∗=Fw,ρ, Fw∈Rq2n×m with row labels ρj∈H, ∀j∈n, H∈Aw′. Generate a vector v=s2,r2,⋯,rm, where r2,⋯,rm⟵Rq2, and s2∈Rq2 is the secret to be shared. δi′=Fwi×v∈Rq2,i∈1,n, where Fwi is the vector corresponding to ith row of Fw. Then, choose a uniformly random element r1′⟵Rq2, and noise terms e_′.e_i′⟵χ2 computes T0=sk0r2s2+pe_′∈Rq2, Ti=a2skir2δi′+pe_i′∈Rq2, and sends Twi=T0,Ti to A4.Challenge.B4 randomly selects b∈0,1; if b=0, B4 randomly chooses x⟵Rq and lets T0=px0∈Rq, Ti=pxi∈Rq; if b=1, let I0=pk0t−1+pe_′′∈Rq2, Ii=pki−1t+pe_i′′∈Rq2, then send Twb=T0,Ti to A4.Inquiry Phase 2.A4 asks for the trapdoor as in phase 1.Guess. Adversary A4 outputs his guess b′ about b to B4. If b′=b, output O′=Os; otherwise, output O′=Os′. The advantage of A4 in this game is defined as advA=Prb′=b−1/2, so the oracle O has the following two cases.O is a noisy pseudorandom Os. The advantage of A4 is ε, then Prb′=bO=Os=1/2+ε, andPrO′=OO=Os=1/2+ε.O is a truly random Os′. A4 has no advantage ε and unable to get information about b, then Prb′≠bO=Os′=1/2, and PrO′=OO=Os′=1/2.Then, the advantage of simulatorB4 is as follows.
(5)12PrO′=OO=Os+12PrO′=OO=Os′−12=1212+ε+1212−12=ε2.Hence, Theorem11 is proved, and this means that the scheme meets IND-IKGA security.


## 4.2. Performance Analysis

Since the scheme in this paper is mainly constructed on the basis of CP-ABE, some schemes based on attribute-based encryption are selected for comparison, including searchable schemes, schemes combined with blockchain and lattice schemes. These schemes are selected to compare their functions, the cost of storage, calculation, and communication.(1)
Different attribute-based encryption schemes are selected for function comparison. The results are shown in Table4Table 4
Comparison with other schemes.
SchemeProblemAccess structureSearchableKeywordCross-domainAntiquantum attackBlockchain[20]DBDHAccess tree√1××√[26]SDPLSSS√1×××[27]DBDHAccess tree×—××√[28]DBDHAccess tree×—×××[29]DBDHLSSS√1××√[30]LWELSSS√1×√×[31]LWEAND√1×√√OursRLWELSSS√n√√√Scheme [20] uses searchable encryption technology to realize the search of a single keyword on the blockchain and implements access control according to CP-ABE. The scheme is constructed by bilinear pairing, which has great application prospects in social networks and medical information fields, but the scheme cannot resist quantum attacks.Scheme [26] pays attention to the problems of high computing cost and low efficiency of searching data in ABE scheme, reduces the local computing cost of users by using outsourcing technology, and proves that the scheme meets adaptive security. However, the scheme only supports single keyword search and cannot resist quantum attacks.For medical data protection, scheme [27] combines ABE and blockchain technology to enable data to be shared efficiently and safely among patients, hospitals, and other entities. The scheme does not support ciphertext search and cannot resist quantum attacks.In the Internet of Things environment, scheme [28] outsources the decryption operation in content encryption to fog nodes, solves the problem that computing is difficult due to the limited resources of Internet of Things devices and also protects users’ privacy by constructing false attributes. The scheme does not support ciphertext search and quantum attack resistance.Scheme [29] combines blockchain and ABE to realize data sharing. The scheme realizes decentralization and avoids the risk of privacy disclosure by third parties and supports ciphertext search. However, the scheme cannot resist quantum attacks.Scheme [30] solves the problem of ciphertext search in the cloud environment. The scheme only supports single-keyword search. The biggest feature is that it is based on LWE construction and can resist quantum attacks.Scheme [31] relies on the technical characteristics of Ethereum to solve the problem of single point of failure in traditional systems, and can resist quantum attacks based on the LWE problem. At the same time, the scheme enables data users to generate private keys for visitors, avoiding key abuse caused by third parties. Due to the use of AND gate multivalue access strategy, its expression ability is slightly weak.Based on RLWE, our scheme can resist quantum attacks, and LSSS has rich access structure, and the scheme realizes cross-domain access based on blockchain and can realize search of multiple keywords.(2)
Since schemes [20, 26–29] are not based on lattice structure, it is mainly compared with scheme [30, 31]. In schemes [30, 31], m and n are the parameters from lattice, m≥5nlogq, and l is the security parameter in the keyword matching algorithm in scheme [30]. N1 represents the number of all attributes in the system, N2 represents the number of all keywords in the system, Au represents the number of attributes in the user attribute set, and Aw represents the number of keywords in index, Aw′ indicates the number of keywords in the trapdoor. The results are shown in Table 5; this scheme is superior to scheme [30, 31] in size of system public key, master key, user private key, index, and trapdoor. As shown in Figure 4, the three schemes are analyzed by numerical simulation for visual representation, where n=64, q=129, N1=50, N2=50, m=5nlogq, Au=20, Aw=10, Aw′=5,l=32(3)
The comparison results with schemes [30, 31] in terms of computational cost are shown in Table 6. Since the cost of addition operation is small, it is not included in the analysis here. Ad represents the number of keywords required for successful matching, the mul represents the multiplication between vectors on the ring, and the mod represents modular operation, and other parameters have the same meaning as (2). For visual representation, numerical simulation analysis is carried out, the calculation amount of index generation, trapdoor generation, and single matching is shown in Figure 5. When the index’s number in the system is 100-1000, the search matching overhead is as shown in Figure 6(4)
The main objects of communication cost include ciphertext and index. The encrypted information in the ciphertext is mainly the address of data storage returned by IPFS and the symmetric key used for symmetric encryption of the original data. Set the sum of the two elements as 1280 bit; the index mainly includes the keyword combination of data. Now, simulate the ciphertext overhead of the number of attributes included in the attribute strategy from 5 to 50 when the keywords are 3, 6, 9, and 12, respectively. The results are shown in Figure7(5)
Experimental analysisTable 5
Storage cost.
SchemePublic keyMaster keyPrivate keyIndexTrapdoor[30]nm+m2N+2n+m2logqm2logq2nmlogq2nmAwlogq2mlogq[31]nm+m2N+n+m2logqm2logq2nmlogqm+1llogqmlogqOursnN1+2N2+3logqn2N1+N2+3logqnAu+1logqnAw+1logqnAw′+1logqFigure 4
The comparison of storage cost.Table 6
Calculation cost.
SchemeCost of index generationCost of trapdoor generationCost of single matching[30]2mnmul2mnmul4m+2mul[31]lm+1mul2mmulmlmulOursAw+1mul3Aw′+2mul2Ad+1mul+modFigure 5
The comparison of calculation cost.Figure 6
The calculation cost for indexes ranging from 100 to 1000.Figure 7
The communication cost for indexes ranging.In order to further analyze the performance of the scheme, we tested 8 algorithms in the scheme. Because there are few simulation experiments related to the lattice attribute-based encryption scheme, it is difficult to effectively compare and analyze with other schemes. Here, the efficiency of the algorithm is mainly tested and analyzed. The experimental environment is AMD ryzen 7-5800H processor 3.20 GHz, 16.0 GB memory, 64-bit Windows 11 operating system. The experimental program is written in c++ language and implemented in QT creator development environment based on NTL library. In this experiment, setting parametersq=8380417, p=3, mainly test the running time of each algorithm when the number of attributes or keywords is from 1 to 10. Since the search part of this scheme is similar to the attribute-based encryption system, two algorithms with similar principles are put into the same diagram for analysis. It can be seen from Figure 8 that the running time of the algorithm is proportional to the number of attributes or keywords contained in the algorithm process, and the experimental results are consistent with the theoretical analysis results.Figure 8
Relationship between the number of attributes or keywords and the running time of algorithm.


## 5. Conclusion

In this paper, a searchable attribute-based encryption scheme supporting cross-domain access is constructed based on the RLWE. The whole process can be traced based on the blockchain, and the combined search of multiple keywords is supported at the same time. Through analysis, the scheme meets trapdoor search security, anticollusion attack, and the indistinguishability under chosen-plaintext attack. Compared with other schemes, it has certain advantages in function and performance, but the scheme does not consider the change of user attributes. The next step will study the security and efficiency of attribute revocation and update on this basis.



---

*Source: 6719302-2022-10-06.xml*