# SACS-ABE&B: Supervised Access Control Scheme Based on Attribute-Based Encryption and Blockchain

Authors: Guo Kaiyang; Han Yiliang; Wu Riming; Liu Kai
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Aiming at the problem of illegal data sharing of malicious users in the access control scheme based on attribute-based encryption, an access control scheme that can restrict the sending ability of data owners is proposed. By adding a sanitizer to sanitize the ciphertext, it can ensure that parties who do not adhere to the system control policy cannot share information effectively. The scheme is constructed based on blockchain, and the traceability of access process can be realized. Off-chain storage can also lower the blockchain storage load. The scheme meets the No-Read and No-Write rules, achieves chosen-plaintext attack security under the random oracle model, and can against quantum attacks. As a result of theoretical analysis and experimental simulation, the scheme has certain feasibility and practical significance.


---

## Body

## 1. Introduction

For the increasing needs of information security, cryptography and information security technology have attracted more and more attention. Access control can protect data resources from unauthorized access, which is an important component of information security technology [1]. The rapid growth of data in cyberspace poses a new challenge to the research of access control: how to develop the traditional access control technology to solve the new cloud data security problem. As a public key encryption technology, attribute-based encryption (ABE) can not only encrypt data, but also realize fine-grained access control of data, which provides a method to solve problems [2, 3]. As a powerful advanced cryptographic primitive, compared with traditional public key encryption, one of its biggest features is that ABE can realize “one to many” secure data sharing and can improve data sharing efficiency [4].Although the ABE has certain advantages in access control, there are still some problems that cannot be ignored from the real practical application. These problems include the inherent problems of ABE, such as attribute revocation [5–7], preserve privacy [8–10] and traceable [11–13]. In addition, there are other potential security issues that need to be attended. For example, in ciphertext policy attribute-based encryption (CP-ABE), the data owner determines the access object of the data, and in this case once a malicious user carries out illegal data sharing in the public channel, the system will not be able to intervene effectively. In addition to security issues, efficiency issues also deserve attention. Most of the existing attribute encryption schemes are based on bilinear pairing, but bilinear pairing has been criticized for its high cost. With the increase of data volume and attributes, the performance of the scheme based on bilinear pairing will inevitably decline. In addition, with the development of quantum computing technology, the security of schemes based on traditional number theory will also be threatened.At present, cryptography has been widely used in data access control, such as digital signature [14, 15], secret sharing [16, 17], ABE [18], access control encryption (ACE) [19] and so on. The following briefly introduces some schemes combining cryptography and access control. The first attribute-based encryption scheme was proposed by Sahai and Waters on the basis of identity-based encryption at the Eurocrypt in 2005 [20]. CP-ABE is the data access object determined by the data owner’s policy, and compared with Key-policy attribute-based encryption (KP-ABE), CP-ABE has a broader application prospect in data access control. In 2010, Yu et al. proposed a secure, scalable and fine-grained data access control scheme in cloud environment based on ABE and proxy re-encryption [21]. In 2015, Zhou et al. proposed a multi-agency attribute-based encryption scheme with white-box traceable and revocable properties [22], which realized multi-level privacy protection in the electronic medical cloud computing system. In 2017, Yang et al. embedded the hierarchical attribute hierarchy dominance relationship into the ABE [23], realizing the Hierarchical Authorization feature of access control and storage data isolation, but the system has high complexity. In 2019, Li and Sato proposed a blockchain access control scheme based on MACP-ABE [24], and data users can combine secret keys from different sources to match ciphertext policies. In 2019, Wu et al. proposed an efficient traceable key scheme in blockchain to solve the problem of key abuse [25], so that the blockchain has publicly verifiable traceability to the key. The signature attribute of the user and the master key of the authorization centre are embedded into the user’s key through CP-ABE. In 2021, Yu and Ma designed a model of Attribute and Trust-Based RBAC [26]. On the basis of RBAC, attribute/trust management module is added to grant users a set of attribute sets and embed access structure for roles. In 2021, Zhang and Yu proposed a blockchain data sharing model based on ABE [27], focusing on privacy protection and data security in the current blockchain data sharing mechanism.In 2016, as a new cryptographic primitive, access control encryption was first proposed by Damgård et al. [19]. Different from other access control schemes, ACE focuses on the sending authority of the data owner, considers the security of the whole access process from another perspective, and expands the security research of access control schemes. In 2017, Kim and Yu proposed the first ACE scheme for arbitrary policies from standard assumptions [28], and they concluded by introducing several extensions to the ACE framework to support dynamic and more fine-grained access control policies. In 2020, Wang et al. constructed a basic ACE scheme based on DBDH assumption to achieve information flow control in Internet of Energy [29], and this scheme can control not only what users can read but also what they can write.


### 1.1. Security and Function Requirements

A complete access control system should provide corresponding functions and security services to ensure data sharing among entities. In some units and places with high security requirements, stricter measures should be taken to ensure the high security of information.


#### 1.1.1. Fine-Grained Access Control

It should ensure fine-grained access control between user entities in the system. Users can freely decide who can access the data they own, and can also access the data shared by other users as needed.


#### 1.1.2. Data Security and User Privacy Protection

The system should provide strong security protection for the data shared by users, and no one can get any valid information from the data except the users who can access the data specified by the data owner. Users’ privacy should be protected. Except for trusted entities, other entities cannot obtain users’ personal information during data sharing and access.


#### 1.1.3. Supervision and Mandatory Control

When corrupt users are found in the system, the system should be able to deal with this situation in a timely manner. At the same time, for units with high security requirements, in order to ensure the security of information, the system should have a set of controls that override the user access policies to eliminate the harmful data sharing behaviour of the unit.


#### 1.1.4. Tailored Forensics

The system shall provide certain evidence collection mechanism to ensure that the transaction has certain integrity and traceability. This is also to ensure that the data can be monitored during the sharing process, prevent controversial situations, and play a positive role in protecting specific units.


### 1.2. Contribution

Based on the idea of access control encryption, the security of sending authority of the data owner in attribute-based encryption is concerned, and an access control scheme based on blockchain is designed. The main contributions of this paper are listed as follows.(1)
On the basis of the data owner’s free decision on the access object, the system supervision function is added. While controlling the user’s right to receive data, it can also provide restrictions on its sending permission, to prevent malicious users in the system from illegal data sharing through the public channel.(2)
Based on blockchain, the traceability of the access process is realized, and the access records cannot be tampered with. At the same time, off-chain storage is adopted to reduce the storage burden on the chain and improve the efficiency of the system.(3)
The scheme is constructed based on the learning with error over the ring (RLWE) on lattice and has the characteristics of anti-quantum attack. Compared with the scheme constructed by the learning with error (LWE), the ciphertext size and key size are shorter and the efficiency is higher.


### 1.3. Paper Structure

The remainder of this paper is organized as follows. In Section2, we review some mathematical knowledge. In Section 3, we give the system model and security model, definition of scheme and construction. The scheme is analysed in Section 4, mainly including security analysis, performance analysis and experimental analysis. Finally, we conclude our paper in Section 5.


## 1.1. Security and Function Requirements

A complete access control system should provide corresponding functions and security services to ensure data sharing among entities. In some units and places with high security requirements, stricter measures should be taken to ensure the high security of information.


### 1.1.1. Fine-Grained Access Control

It should ensure fine-grained access control between user entities in the system. Users can freely decide who can access the data they own, and can also access the data shared by other users as needed.


### 1.1.2. Data Security and User Privacy Protection

The system should provide strong security protection for the data shared by users, and no one can get any valid information from the data except the users who can access the data specified by the data owner. Users’ privacy should be protected. Except for trusted entities, other entities cannot obtain users’ personal information during data sharing and access.


### 1.1.3. Supervision and Mandatory Control

When corrupt users are found in the system, the system should be able to deal with this situation in a timely manner. At the same time, for units with high security requirements, in order to ensure the security of information, the system should have a set of controls that override the user access policies to eliminate the harmful data sharing behaviour of the unit.


### 1.1.4. Tailored Forensics

The system shall provide certain evidence collection mechanism to ensure that the transaction has certain integrity and traceability. This is also to ensure that the data can be monitored during the sharing process, prevent controversial situations, and play a positive role in protecting specific units.


## 1.1.1. Fine-Grained Access Control

It should ensure fine-grained access control between user entities in the system. Users can freely decide who can access the data they own, and can also access the data shared by other users as needed.


## 1.1.2. Data Security and User Privacy Protection

The system should provide strong security protection for the data shared by users, and no one can get any valid information from the data except the users who can access the data specified by the data owner. Users’ privacy should be protected. Except for trusted entities, other entities cannot obtain users’ personal information during data sharing and access.


## 1.1.3. Supervision and Mandatory Control

When corrupt users are found in the system, the system should be able to deal with this situation in a timely manner. At the same time, for units with high security requirements, in order to ensure the security of information, the system should have a set of controls that override the user access policies to eliminate the harmful data sharing behaviour of the unit.


## 1.1.4. Tailored Forensics

The system shall provide certain evidence collection mechanism to ensure that the transaction has certain integrity and traceability. This is also to ensure that the data can be monitored during the sharing process, prevent controversial situations, and play a positive role in protecting specific units.


## 1.2. Contribution

Based on the idea of access control encryption, the security of sending authority of the data owner in attribute-based encryption is concerned, and an access control scheme based on blockchain is designed. The main contributions of this paper are listed as follows.(1)
On the basis of the data owner’s free decision on the access object, the system supervision function is added. While controlling the user’s right to receive data, it can also provide restrictions on its sending permission, to prevent malicious users in the system from illegal data sharing through the public channel.(2)
Based on blockchain, the traceability of the access process is realized, and the access records cannot be tampered with. At the same time, off-chain storage is adopted to reduce the storage burden on the chain and improve the efficiency of the system.(3)
The scheme is constructed based on the learning with error over the ring (RLWE) on lattice and has the characteristics of anti-quantum attack. Compared with the scheme constructed by the learning with error (LWE), the ciphertext size and key size are shorter and the efficiency is higher.


## 1.3. Paper Structure

The remainder of this paper is organized as follows. In Section2, we review some mathematical knowledge. In Section 3, we give the system model and security model, definition of scheme and construction. The scheme is analysed in Section 4, mainly including security analysis, performance analysis and experimental analysis. Finally, we conclude our paper in Section 5.


## 2. Preliminaries

### 2.1. Lattice

Definition 1 (Lattice).
Λ is called lattice if there are m linearly independent n-dimensional vectors in Λ, such that any vector in Λ is an integer linear combination of B=b1,b2,…,bm, that is Λ=Λb1,b2,…,bm=∑i=1msibi,si∈Z, n is the dimension of lattice Λ, m is the rank of lattice Λ, and B is a set of bases of lattice Λ.Definition 2 (Ideal Lattice).
There is a ringR=x/<f and an ideal I⊆R , A lattice Λ∈Zn is an ideal lattice if Λ is associated with I.Definition 3 (DecisionRLWEd,q,χ Problem [30]).
Given the security parameterλ, select the integer d,q based on λ, let R=Zx/fx, where fx=xd+1 and Rq=R/q. Given discrete distribution χ⊂Rq based on λ, there is an unspecified challenge model O in the Decision RLWEd,q,χ Problem, that is to determine whether the challenge model is a noisy pseudo-random sampler Os or a real random sampler Os′ for random secret key, K∈Rq, which perform respectively as follows:
Os: outputs ω,v=ω,ωK+e∈Rq×Rq.The element ω is uniformly random from Rq, where ω←Rq and the K←Rq fixed for all samples. The element e←Rq is a small error term that generated with a distribution χ.
Os′: outputs truly random samples ω,v∈Rq×Rq.


### 2.2. Access Control Structure

Definition 4 (Monotone Access Structure).
LetU=u1,u2,…,un be a set of attributes. A collection D⊆U is monotone if ∀B,C:B∈D,B⊆C⇒C∈D. The sets in Α are called as authorized sets, and the sets not in D are called as unauthorized sets.Definition 5 (Linear Secret Sharing Scheme (LSSS) [31]).
The∏ is a secret sharing scheme over a set of attributes U if the following properties are met:(1)
All sharers have a secret sharing vector based onRq;(2)
There is a share-generating matrixF∈Rqn×m for ∏, with row labels ρi∈U,∀i∈n. Given a column vector, v⟶=s,r2,…,rm, where s∈Rq is the secret to be shared and r2,…,rm←Rq are randomly chosen. Let δi=Fi×v∈R,qi∈1,n represent attribute ρi, where ρi is a function from i to U.
Linear secret sharing scheme has linear reconstruction characteristics. Suppose that∏ is an LSSS that represents the access structure Α. Let A∈Α be an authorized set, and I⊂1,…,n, I=i:ρi∈D. There exist constants ωi∈Rqi∈I then ∑i∈Iδiωi=s such that of δi are valid shares of a secret s according to ∏. Furthermore, these constants ωi can be calculated through the share-generating matrix F in polynomial time. For unauthorized sets, it cannot be calculated, that is, any information of secret sharing value cannot be obtained.


## 2.1. Lattice

Definition 1 (Lattice).
Λ is called lattice if there are m linearly independent n-dimensional vectors in Λ, such that any vector in Λ is an integer linear combination of B=b1,b2,…,bm, that is Λ=Λb1,b2,…,bm=∑i=1msibi,si∈Z, n is the dimension of lattice Λ, m is the rank of lattice Λ, and B is a set of bases of lattice Λ.Definition 2 (Ideal Lattice).
There is a ringR=x/<f and an ideal I⊆R , A lattice Λ∈Zn is an ideal lattice if Λ is associated with I.Definition 3 (DecisionRLWEd,q,χ Problem [30]).
Given the security parameterλ, select the integer d,q based on λ, let R=Zx/fx, where fx=xd+1 and Rq=R/q. Given discrete distribution χ⊂Rq based on λ, there is an unspecified challenge model O in the Decision RLWEd,q,χ Problem, that is to determine whether the challenge model is a noisy pseudo-random sampler Os or a real random sampler Os′ for random secret key, K∈Rq, which perform respectively as follows:
Os: outputs ω,v=ω,ωK+e∈Rq×Rq.The element ω is uniformly random from Rq, where ω←Rq and the K←Rq fixed for all samples. The element e←Rq is a small error term that generated with a distribution χ.
Os′: outputs truly random samples ω,v∈Rq×Rq.


## 2.2. Access Control Structure

Definition 4 (Monotone Access Structure).
LetU=u1,u2,…,un be a set of attributes. A collection D⊆U is monotone if ∀B,C:B∈D,B⊆C⇒C∈D. The sets in Α are called as authorized sets, and the sets not in D are called as unauthorized sets.Definition 5 (Linear Secret Sharing Scheme (LSSS) [31]).
The∏ is a secret sharing scheme over a set of attributes U if the following properties are met:(1)
All sharers have a secret sharing vector based onRq;(2)
There is a share-generating matrixF∈Rqn×m for ∏, with row labels ρi∈U,∀i∈n. Given a column vector, v⟶=s,r2,…,rm, where s∈Rq is the secret to be shared and r2,…,rm←Rq are randomly chosen. Let δi=Fi×v∈R,qi∈1,n represent attribute ρi, where ρi is a function from i to U.
Linear secret sharing scheme has linear reconstruction characteristics. Suppose that∏ is an LSSS that represents the access structure Α. Let A∈Α be an authorized set, and I⊂1,…,n, I=i:ρi∈D. There exist constants ωi∈Rqi∈I then ∑i∈Iδiωi=s such that of δi are valid shares of a secret s according to ∏. Furthermore, these constants ωi can be calculated through the share-generating matrix F in polynomial time. For unauthorized sets, it cannot be calculated, that is, any information of secret sharing value cannot be obtained.


## 3. Supervised Access Control Scheme Based on Attribute-Based Encryption and Blockchain

### 3.1. System Model

The proposed system includes six entities: Authority, Data Owner (DO), Inter-Planetary File System (IPFS), Sanitizer, Data User (DU) and Blockchain. The relationship among the entities is shown in Figure1.(1)
Authority. The authority generates the system’s public parameters PP and master private key MSK, manages the users in the system, and constructs the secret key for each user according to the user’s identity and authority, then the authority generates a sanitizer key sk according to the system control policy when accessing data. We assume that authority is completely trusted, it always correctly implements the requirements put forward by all entities in the scheme, and will not disclose any information or attempt to obtain user information. Generally speaking, the authority of the system, as a separate trusted entity, can also be deployed separately in this scheme. However, in combination with the characteristics of the private chain, in order to facilitate data processing, it is expanded and deployed on the nodes of the blockchain.(2)
Data Owner (DO). The data owner generates ciphertext tag based on data and encrypts data with a symmetric key k, then uploads encrypted data into the Inter-Planetary File System (IPFS). After that, DO sets the access policy of the data, and encrypts the symmetric key and address, then DO uploads this ciphertext CT and tag Sc to blockchain.(3)
Inter-Planetary File System (IPFS). The IPFS is responsible for storing data and returning an address. IPFS is honest but curious, always correctly implement the requirements put forward by all entities in the scheme, but attempts to decrypt the ciphertext content.(4)
Sanitizer. The sanitizer encrypts the ciphertext CT according to the sanitizer key sk. For sanitizer, it is equivalent to re encrypting the ciphertext. Its input and output are in the form of ciphertext without much effective information. Therefore, it is implemented in the form of smart contract. The sanitizer is honest but curious, always correctly implement the requirements put forward by all entities in the scheme, but attempts to decrypt the ciphertext content.(5)
Data User (DU). The data user can access data according to their needs after registration. Generally, when the user’s identity is normal, his access right to certain data is determined by the data owner, but the system has the ability to change the user’s access right when the system suspects that the communication is abnormal.(6)
Blockchain. The blockchain is used to store CT and tag Sc. Records of key distribution and data access can be formed into transactions and recorded on the blockchain. Since this scheme provides a powerful system supervision for a small range of organizations and institutions, the private chain technology is mainly used here to strengthen the system supervision through certain control, and provide faster response and tamper proof recording services.Figure 1
System model.


### 3.2. Overview of the SACS-ABE&B Scheme

The priority in the system is, user identity permission>system control policy>user access policy. The user identity permission is granted by the system according to user registration information. System control policies are generated by the system as needed and can be adjusted in time. User access policies are generated by the data owner.When a user registers, the authority generates a unique ID for each user. In order to protect the privacy and security of users, only the user and the authority can obtain the ID. The identity permission of each user isui∈0,1, 0 means that the user is illegal and does not have any read and write permissions; 1 means that the user is normal, which means that data can be read or write. The default permission of the user is 1. System control policy refers to a representation of whether users can communicate with each other. An access control matrix can be set to determine whether users can communicate through the values in the matrix, where the value 1 indicates that communication is allowed and the value 0 indicates that communication is rejected. For example, in the example given in Table 1, we can know that the system prohibits communication between u1 and u3 through the matrix.Table 1
Example of access control matrix.
u1u2u3⋯uiu1110⋯1u2111⋯1u3011⋯1⋮⋮⋮⋮⋯⋮ui111⋯1When the user needs to share data, the DO first generates a ciphertext tag. The ciphertext tag is the unique identification symbol generated by the timestamp and the user’s ID encrypted. The timestamp is to ensure that the identification generated after each encryption is different, to prevent the enemy from obtaining the user’s privacy information by analysing the identification. In the second step, the DO needs to encrypt the data with a symmetric key, send it to ITFS and return an address, then encrypt the symmetric key and address according to access policy, and send the ciphertext and tag to the blockchain.DU first obtains the ciphertext tag of the data and sends an access request to the blockchain when accessing data. The access request includes the ciphertext tag and access tag. The access tag is also encrypted by the timestamp and the user’s ID. After receiving the request, the authority obtains the ID of both the DO and the DU through decryption tags, then judges whether they meet the system control policy, then generates sanitizer keysk and send it to sanitizer. Sanitizer uses the sk to encrypt the ciphertext, and then forwards the re-encrypted ciphertext to the DU. Finally, the DU decrypts the ciphertext according to his key. If both parties meet the requirements of identity permission, system control policy and user access policy, the DU can successfully obtain the data.The process is shown in Figure2.Figure 2
Access flow chart.The scheme consists of the following eight algorithms.Setupλ,U⟶PP,MSK. The algorithm is executed by authority. Given the security parameter λ, and the collection of all attributes U in the system, This algorithm outputs public parameters PP and master secret key MSK.KeyGenMSK,D,ID⟶K. The algorithm is executed by authority. Input master secret key MSK, user’s attribute set D. This algorithm outputs the secret key K for the user.SymEncDT,k⟶ED. The algorithm is executed by DO. The DO randomly generates a symmetric key k and encrypts the data DT with this key to obtain the ciphertext ED, then upload the ciphertext ED to IPFS and return an address T, let M=T||k.EncPP,IDc,Kc,M,A,tc⟶CT,Sc. The algorithm is executed by DO. Input public parameters PP, master key MSK, user’s secret key Kc, the message M about T||k, user’s access policy A and timestamp tc. This algorithm outputs the ciphertext CT and tag Sc.SGenIDr,Kr,tr⟶Sr. The algorithm is executed by DU. Input public parameters PP, user’s IDr and timestamp tc. This algorithm outputs the access tag Sr.SkeyGenSc,Sr,P⟶sk. The algorithm is executed by authority. Input ciphertext tag Sc, access tag Sr and system control policy P. This algorithm outputs the sanitizer key sk.SanCT,sk⟶CT∗. The algorithm is executed by sanitizer. Input ciphertext CT and sanitizer key sk. This algorithm outputs the ciphertext CT∗.DecPP,CT∗,K⟶M. The algorithm is executed by DU. Input public parameters PP, ciphertext CT∗, user’s secret key K. This algorithm outputs M=T‖k, then the DU can download the data through the address T and decrypt it with the key sk to obtain DT.


### 3.3. Security Model

We define three security models: No-Read Rule, No-Write Rule and Chosen-plaintext attack Security. No-Read Rule means that DU cannot obtain any valid data without the permission of system control policy. No-Write Rule means that the DO cannot send any valid data without the permission of the system control policy.Pui,uj=1 indicates that communication between the data owner ui and the data user uj is allowed, and Pui,uj=0 indicates that communication between the data owner ui and the data user uj is prohibited. Three models are defined as follows.Definition 6.
(Correctness [32]). Given attribute universe U and all message M∈Μ, for all i,j∈n×n such that Pui,uj=1 and D satisfied with A :(1)PrDecPP,SanEncM,sk,K≠M≤neglλ,where Setupλ,U⟶PP,MSK, KeyGenMSK,D,ID⟶K, SkeyGenSc,Sr,P⟶sk.
Correctness captures the feature that DO withKc can deliver a message to DU for which DU’s attribute set D satisfied with DO′ policy A and PDO,DU=1. In this case, the sanitizer should pass the message to DU smoothly, and DU should be able to decrypt CT∗ by K.Definition 7.
(No-Read Rule [32]). Consider the following game between a challenger and an adversary over the attribute universe U, message space M, and it is assumed that for a challenge access structure A∗ , the adversary cannot request the key that meets A∗. The game is as shown in Table 2.
IfA wins the game, it must meet b=b′, M0=M1, u0,u1∈0,1, and comply with Payload Privacy or Sender Anonymity.
Payload Privacy. For all queriesq to OG about uj, it holds that Pu0,uj=Pu1,uj=0.
Sender Anonymity. For all queriesq to OG about uj, it holds that Pu0,uj=Pu1,uj and M0=M1.
The formal definition of No-Read Rule isadvA=2⋅PrAwin the No−Read game−1/2≤neglλ.
That is the probability ofA winning the No-Read game is negligible, which ensures that when DO sends the message, the probability of successfully decrypting the message for all users with Pui,uj=0 or uj=0 is negligible. Only the intended recipients who meet the conditions can obtain valid information (Payload Privacy) and no one can learn about the identity of DO (Sender Anonymity).Table 2
No-read rule.
No-read ruleGame definitionOracle definition1.Setupλ,U⟶PP,MSKOGuj:2.AOG⋅,OE⋅PP⟶M0,M1,u0,u1KeyGenMSK,D,ID⟶K3.0,1⟶$bOEui,M:4.EncPP,Kuib,Mb,A∗⟶CTKeyGenMSK,D,ID⟶K5.AOG⋅,OE⋅CT⟶b′KeyGenMSK,D,ID⟶KDefinition 8.
(No-Write Rule [32]). Consider the following game between a challenger and an adversary over the attribute universe U, message space Μ, and it is assumed that for a challenge access structure A∗, the adversary cannot request the key that meets A∗. The game is as shown in Table 3.
LetIS be the set of identify about all queries for key. A wins the game if ui′∈IS∪0 and Pui,uj=0,∀ui,uj∈IS when b=b′.The formal definition of No-Write Rule is advA=2⋅PrAwin the No−Write game−1/2|≤neglλ.
That is, the probability of theA winning the No-Write game is negligible, which ensures that the probability of successfully information exchange with other users is negligible when Pui,uj=0 or uj=0. There are two other explanations about No-Write Rule as follows.Table 3
No-write rule.
No-write ruleGame definitionOracle definition1.Setupλ,U⟶PP,MSKOSuj:2.AOE.,OS.PP⟶CT,ui′KeyGenMSK,D,ID⟶K3.KeyGenMSK,ID,D⟶Kui′SkeyGenSc,Sr,P⟶sk4.SkeyGenSc,Sr,P⟶skORuj:5.Μ⟶rMKeyGenMSK,D,ID⟶K6.0,1⟶$b−ifb=0SanCT,sk⟶CT∗−ifb=1SanEncPP,Kui′,rM,A∗,sk⟶CT∗SkeyGenSc,Sr,P⟶skOEui,M:7.AOE⋅,OR⋅CT∗⟶b′KeyGenMSK,D,ID⟶KuiEncPP,Kui,M,A∗⟶CTSanCT,sk⟶CT∗Note 1.
The target ciphertextCT in CT,ui′ is obtained only in two cases, one is generated by legal encryption key queried, and the other is chosen uniformly from ciphertext space.Note 2.
The sanitizer should be honest, and it is required that the adversary does not corrupt the sanitizer as an unavoidable condition.Definition 9.
(Chosen-plaintext attack Security [33]). The definition is given by describing the game between adversary A and simulator ℬ. The scheme satisfies the security of chosen-plaintext attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A selects an access structure A∗ and sends it to ℬ.
Setup. The simulator ℬ generates public parameters PP and master keys MSK and sends them to A.
Inquiry Phase 1. The adversary A asks the simulator ℬ for the secret key, but A’s attribute set does not meet the access structure. The simulator runs the KeyGen algorithm to generate the secret key and send it to A.
Challenge. The adversary A chooses two messages M0,M1∈0,1 and send them to simulator ℬ, then ℬ randomly select b∈0,1 to calculate the challenge ciphertext and send it to A.
Inquiry Phase 2. A asks for the key as in phase 1.
Guess. Adversary A outputs his guess b′ about b. The advantage of A in this game is defined as advA=Prb′=b−1/2.


### 3.4. Construction of the SACS-ABE&B Scheme

Setupλ,U⟶PP,MSK. Given the security parameter λ, and the collection of all attributes U in the system, randomly select a large prime number q=1mod2λ and a small positive integer p, where p≪q and gcdp,q=1. Let fx=xd+1, where d is a power of 2. Let Rq=Zqx/fx be the ring of integer polynomials modulo both fx and q. Let χ=χλ be an error distribution over Rq. Select a uniformly random SK0←Rq and random element a←Rq, then choose a small noise term e0←χ. Compute PK0=aSK0+pe0∈Rq. Next, select a pair of uniformly random SKi,SKi−1←Rq for each attribute in U, where SKi−1 is the inverse of SKi in Rq, and select a small noise term ei←χ, then compute PKi=SKi+pei∈Rq. Lastly, outputs the public parameters PP=a,PK0,PKii=1n and the master secret key MSK=SK0,SKii=1n,SKi−1i=1n.KeyGenMSK,D,ID⟶K. Input master key MSK, user’s attribute set D, then choose a small noise term e″←χ, select a pair of uniformly random ti,ti−1←Rq and choose small noise term ei←χ for each attribute in D. Compute K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei″∈Rq,∀i∈D, outputs the secret key K=K0,Ki. If the user’s identity permission is 0, K0′←Rq, Ki′←Rq,∀i∈D outputs the secret key K=K0′,Ki′.SymEncDT,k⟶ED. Input the DO’s data DT and symmetric key k, output the ciphertext data ED, then upload the ciphertext ED to IPFS and return an address T, let M=T‖k.EncPP,IDc,Kc,M,A,tc⟶CT,Sc. Input public parameters PP, user’s IDc, the secret key Kc, the message M about T‖k, user’s access policy A and timestamp tc. Set access policy A=F,ρ, F∈Rqn×m with row labels ρj∈H, ∀j∈n, H∈A. Generate a vector v=s,r2,…,rm, where r2,…,rm←Rq and s∈Rq is the secret to be shared. δj=Fj×v∈Rq where Fj is the vector corresponding to jth row of F, then choose a uniformly random element r←Rq, and noise terms e′,ej′←χ, Compute C0=PK0rs+M+pe′∈Rq, Cj=arPKjδj+pj′∈Rq, Sc=Kc0+IDc||tc , output CT=C0,Cj and Sc.SGenIDr,Kr,tr⟶Sr. Input user’s IDr, the secret key Kr=Kr0,Kri and timestamp tc, then compute Sr=Kr0+IDr‖tr.Skey GenSc,Sr,P⟶sk. Input ciphertext tag Sc, access tag Sr and system control policy P, compute IDc‖tc=Sc−Kc0 and IDr‖tr=Sr−Kr0, then judge whether IDc and IDr meet the communication requirements according to the system control policy P. If the identities of both parties are legal and meet the requirements of access control policy, then let sk′=1, otherwise select a uniformly random sk′←Rq, output the sanitizer key sk=sk′.SanCT,sk⟶CT∗. Input ciphertext CT and sanitizer key sk, compute C0′=skC0∈Rq, Cj′=Cj∈Rq, output CT∗=C0′,Cj′.DecPP,CT∗,K⟶M. Input public parameters PP, ciphertext CT∗, user’s secret key K. If the DU meets the access control policy P, the ciphertext CT∗ is equivalent to the original ciphertext CT, as long as the DU’s attribute meets the access structure A, I⊂1,…,n, I=i:ρi∈A, compute a set of constants ωi∈Rqi∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδiωi=s, compute M′=C0′−K0∑i∈ICiωiKi, M=M′modp, the DU can download the data through the address T and decrypt it with the key sk to obtain DT.The correctness of the successful decryption of the scheme is explained as follows.(2)M′=C0′−K0∑i∈ICiωiKi=1⋅C0−K0∑i∈IaPKirδi+pei′ωiKi=C0−K0∑i∈IaPKirsKi−p⋅K0∑i∈Iei′ωiKi=C0−K0∑i∈IarsSKi+peiSKi−1t+pej″−p⋅K0∑i∈Iei′ωiKi=M+PK0rs+pe′−SK0t−1+pe″arst−parsK0∑i∈ISKiei″+eiSKi−1+eipei″−p⋅K0∑i∈Iei′ωiKi=M+pe0rs+pe′−pe″tars−parsK0∑i∈ISKi⋅ei″+ei⋅SKi−1+ei⋅p⋅ei″−p⋅K0∑i∈Iei′⋅ωi⋅Ki.ThenM=M′modp, and in order to ensure the correctness of the scheme, the noise term in the schememust meet be small enough compared to the ratio of q to p.


## 3.1. System Model

The proposed system includes six entities: Authority, Data Owner (DO), Inter-Planetary File System (IPFS), Sanitizer, Data User (DU) and Blockchain. The relationship among the entities is shown in Figure1.(1)
Authority. The authority generates the system’s public parameters PP and master private key MSK, manages the users in the system, and constructs the secret key for each user according to the user’s identity and authority, then the authority generates a sanitizer key sk according to the system control policy when accessing data. We assume that authority is completely trusted, it always correctly implements the requirements put forward by all entities in the scheme, and will not disclose any information or attempt to obtain user information. Generally speaking, the authority of the system, as a separate trusted entity, can also be deployed separately in this scheme. However, in combination with the characteristics of the private chain, in order to facilitate data processing, it is expanded and deployed on the nodes of the blockchain.(2)
Data Owner (DO). The data owner generates ciphertext tag based on data and encrypts data with a symmetric key k, then uploads encrypted data into the Inter-Planetary File System (IPFS). After that, DO sets the access policy of the data, and encrypts the symmetric key and address, then DO uploads this ciphertext CT and tag Sc to blockchain.(3)
Inter-Planetary File System (IPFS). The IPFS is responsible for storing data and returning an address. IPFS is honest but curious, always correctly implement the requirements put forward by all entities in the scheme, but attempts to decrypt the ciphertext content.(4)
Sanitizer. The sanitizer encrypts the ciphertext CT according to the sanitizer key sk. For sanitizer, it is equivalent to re encrypting the ciphertext. Its input and output are in the form of ciphertext without much effective information. Therefore, it is implemented in the form of smart contract. The sanitizer is honest but curious, always correctly implement the requirements put forward by all entities in the scheme, but attempts to decrypt the ciphertext content.(5)
Data User (DU). The data user can access data according to their needs after registration. Generally, when the user’s identity is normal, his access right to certain data is determined by the data owner, but the system has the ability to change the user’s access right when the system suspects that the communication is abnormal.(6)
Blockchain. The blockchain is used to store CT and tag Sc. Records of key distribution and data access can be formed into transactions and recorded on the blockchain. Since this scheme provides a powerful system supervision for a small range of organizations and institutions, the private chain technology is mainly used here to strengthen the system supervision through certain control, and provide faster response and tamper proof recording services.Figure 1
System model.


## 3.2. Overview of the SACS-ABE&B Scheme

The priority in the system is, user identity permission>system control policy>user access policy. The user identity permission is granted by the system according to user registration information. System control policies are generated by the system as needed and can be adjusted in time. User access policies are generated by the data owner.When a user registers, the authority generates a unique ID for each user. In order to protect the privacy and security of users, only the user and the authority can obtain the ID. The identity permission of each user isui∈0,1, 0 means that the user is illegal and does not have any read and write permissions; 1 means that the user is normal, which means that data can be read or write. The default permission of the user is 1. System control policy refers to a representation of whether users can communicate with each other. An access control matrix can be set to determine whether users can communicate through the values in the matrix, where the value 1 indicates that communication is allowed and the value 0 indicates that communication is rejected. For example, in the example given in Table 1, we can know that the system prohibits communication between u1 and u3 through the matrix.Table 1
Example of access control matrix.
u1u2u3⋯uiu1110⋯1u2111⋯1u3011⋯1⋮⋮⋮⋮⋯⋮ui111⋯1When the user needs to share data, the DO first generates a ciphertext tag. The ciphertext tag is the unique identification symbol generated by the timestamp and the user’s ID encrypted. The timestamp is to ensure that the identification generated after each encryption is different, to prevent the enemy from obtaining the user’s privacy information by analysing the identification. In the second step, the DO needs to encrypt the data with a symmetric key, send it to ITFS and return an address, then encrypt the symmetric key and address according to access policy, and send the ciphertext and tag to the blockchain.DU first obtains the ciphertext tag of the data and sends an access request to the blockchain when accessing data. The access request includes the ciphertext tag and access tag. The access tag is also encrypted by the timestamp and the user’s ID. After receiving the request, the authority obtains the ID of both the DO and the DU through decryption tags, then judges whether they meet the system control policy, then generates sanitizer keysk and send it to sanitizer. Sanitizer uses the sk to encrypt the ciphertext, and then forwards the re-encrypted ciphertext to the DU. Finally, the DU decrypts the ciphertext according to his key. If both parties meet the requirements of identity permission, system control policy and user access policy, the DU can successfully obtain the data.The process is shown in Figure2.Figure 2
Access flow chart.The scheme consists of the following eight algorithms.Setupλ,U⟶PP,MSK. The algorithm is executed by authority. Given the security parameter λ, and the collection of all attributes U in the system, This algorithm outputs public parameters PP and master secret key MSK.KeyGenMSK,D,ID⟶K. The algorithm is executed by authority. Input master secret key MSK, user’s attribute set D. This algorithm outputs the secret key K for the user.SymEncDT,k⟶ED. The algorithm is executed by DO. The DO randomly generates a symmetric key k and encrypts the data DT with this key to obtain the ciphertext ED, then upload the ciphertext ED to IPFS and return an address T, let M=T||k.EncPP,IDc,Kc,M,A,tc⟶CT,Sc. The algorithm is executed by DO. Input public parameters PP, master key MSK, user’s secret key Kc, the message M about T||k, user’s access policy A and timestamp tc. This algorithm outputs the ciphertext CT and tag Sc.SGenIDr,Kr,tr⟶Sr. The algorithm is executed by DU. Input public parameters PP, user’s IDr and timestamp tc. This algorithm outputs the access tag Sr.SkeyGenSc,Sr,P⟶sk. The algorithm is executed by authority. Input ciphertext tag Sc, access tag Sr and system control policy P. This algorithm outputs the sanitizer key sk.SanCT,sk⟶CT∗. The algorithm is executed by sanitizer. Input ciphertext CT and sanitizer key sk. This algorithm outputs the ciphertext CT∗.DecPP,CT∗,K⟶M. The algorithm is executed by DU. Input public parameters PP, ciphertext CT∗, user’s secret key K. This algorithm outputs M=T‖k, then the DU can download the data through the address T and decrypt it with the key sk to obtain DT.


## 3.3. Security Model

We define three security models: No-Read Rule, No-Write Rule and Chosen-plaintext attack Security. No-Read Rule means that DU cannot obtain any valid data without the permission of system control policy. No-Write Rule means that the DO cannot send any valid data without the permission of the system control policy.Pui,uj=1 indicates that communication between the data owner ui and the data user uj is allowed, and Pui,uj=0 indicates that communication between the data owner ui and the data user uj is prohibited. Three models are defined as follows.Definition 6.
(Correctness [32]). Given attribute universe U and all message M∈Μ, for all i,j∈n×n such that Pui,uj=1 and D satisfied with A :(1)PrDecPP,SanEncM,sk,K≠M≤neglλ,where Setupλ,U⟶PP,MSK, KeyGenMSK,D,ID⟶K, SkeyGenSc,Sr,P⟶sk.
Correctness captures the feature that DO withKc can deliver a message to DU for which DU’s attribute set D satisfied with DO′ policy A and PDO,DU=1. In this case, the sanitizer should pass the message to DU smoothly, and DU should be able to decrypt CT∗ by K.Definition 7.
(No-Read Rule [32]). Consider the following game between a challenger and an adversary over the attribute universe U, message space M, and it is assumed that for a challenge access structure A∗ , the adversary cannot request the key that meets A∗. The game is as shown in Table 2.
IfA wins the game, it must meet b=b′, M0=M1, u0,u1∈0,1, and comply with Payload Privacy or Sender Anonymity.
Payload Privacy. For all queriesq to OG about uj, it holds that Pu0,uj=Pu1,uj=0.
Sender Anonymity. For all queriesq to OG about uj, it holds that Pu0,uj=Pu1,uj and M0=M1.
The formal definition of No-Read Rule isadvA=2⋅PrAwin the No−Read game−1/2≤neglλ.
That is the probability ofA winning the No-Read game is negligible, which ensures that when DO sends the message, the probability of successfully decrypting the message for all users with Pui,uj=0 or uj=0 is negligible. Only the intended recipients who meet the conditions can obtain valid information (Payload Privacy) and no one can learn about the identity of DO (Sender Anonymity).Table 2
No-read rule.
No-read ruleGame definitionOracle definition1.Setupλ,U⟶PP,MSKOGuj:2.AOG⋅,OE⋅PP⟶M0,M1,u0,u1KeyGenMSK,D,ID⟶K3.0,1⟶$bOEui,M:4.EncPP,Kuib,Mb,A∗⟶CTKeyGenMSK,D,ID⟶K5.AOG⋅,OE⋅CT⟶b′KeyGenMSK,D,ID⟶KDefinition 8.
(No-Write Rule [32]). Consider the following game between a challenger and an adversary over the attribute universe U, message space Μ, and it is assumed that for a challenge access structure A∗, the adversary cannot request the key that meets A∗. The game is as shown in Table 3.
LetIS be the set of identify about all queries for key. A wins the game if ui′∈IS∪0 and Pui,uj=0,∀ui,uj∈IS when b=b′.The formal definition of No-Write Rule is advA=2⋅PrAwin the No−Write game−1/2|≤neglλ.
That is, the probability of theA winning the No-Write game is negligible, which ensures that the probability of successfully information exchange with other users is negligible when Pui,uj=0 or uj=0. There are two other explanations about No-Write Rule as follows.Table 3
No-write rule.
No-write ruleGame definitionOracle definition1.Setupλ,U⟶PP,MSKOSuj:2.AOE.,OS.PP⟶CT,ui′KeyGenMSK,D,ID⟶K3.KeyGenMSK,ID,D⟶Kui′SkeyGenSc,Sr,P⟶sk4.SkeyGenSc,Sr,P⟶skORuj:5.Μ⟶rMKeyGenMSK,D,ID⟶K6.0,1⟶$b−ifb=0SanCT,sk⟶CT∗−ifb=1SanEncPP,Kui′,rM,A∗,sk⟶CT∗SkeyGenSc,Sr,P⟶skOEui,M:7.AOE⋅,OR⋅CT∗⟶b′KeyGenMSK,D,ID⟶KuiEncPP,Kui,M,A∗⟶CTSanCT,sk⟶CT∗Note 1.
The target ciphertextCT in CT,ui′ is obtained only in two cases, one is generated by legal encryption key queried, and the other is chosen uniformly from ciphertext space.Note 2.
The sanitizer should be honest, and it is required that the adversary does not corrupt the sanitizer as an unavoidable condition.Definition 9.
(Chosen-plaintext attack Security [33]). The definition is given by describing the game between adversary A and simulator ℬ. The scheme satisfies the security of chosen-plaintext attack if all polynomial algorithm adversaries’ advantage is negligible in the game. The specific process of the game is as follows.
Initialization. The adversary A selects an access structure A∗ and sends it to ℬ.
Setup. The simulator ℬ generates public parameters PP and master keys MSK and sends them to A.
Inquiry Phase 1. The adversary A asks the simulator ℬ for the secret key, but A’s attribute set does not meet the access structure. The simulator runs the KeyGen algorithm to generate the secret key and send it to A.
Challenge. The adversary A chooses two messages M0,M1∈0,1 and send them to simulator ℬ, then ℬ randomly select b∈0,1 to calculate the challenge ciphertext and send it to A.
Inquiry Phase 2. A asks for the key as in phase 1.
Guess. Adversary A outputs his guess b′ about b. The advantage of A in this game is defined as advA=Prb′=b−1/2.


## 3.4. Construction of the SACS-ABE&B Scheme

Setupλ,U⟶PP,MSK. Given the security parameter λ, and the collection of all attributes U in the system, randomly select a large prime number q=1mod2λ and a small positive integer p, where p≪q and gcdp,q=1. Let fx=xd+1, where d is a power of 2. Let Rq=Zqx/fx be the ring of integer polynomials modulo both fx and q. Let χ=χλ be an error distribution over Rq. Select a uniformly random SK0←Rq and random element a←Rq, then choose a small noise term e0←χ. Compute PK0=aSK0+pe0∈Rq. Next, select a pair of uniformly random SKi,SKi−1←Rq for each attribute in U, where SKi−1 is the inverse of SKi in Rq, and select a small noise term ei←χ, then compute PKi=SKi+pei∈Rq. Lastly, outputs the public parameters PP=a,PK0,PKii=1n and the master secret key MSK=SK0,SKii=1n,SKi−1i=1n.KeyGenMSK,D,ID⟶K. Input master key MSK, user’s attribute set D, then choose a small noise term e″←χ, select a pair of uniformly random ti,ti−1←Rq and choose small noise term ei←χ for each attribute in D. Compute K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei″∈Rq,∀i∈D, outputs the secret key K=K0,Ki. If the user’s identity permission is 0, K0′←Rq, Ki′←Rq,∀i∈D outputs the secret key K=K0′,Ki′.SymEncDT,k⟶ED. Input the DO’s data DT and symmetric key k, output the ciphertext data ED, then upload the ciphertext ED to IPFS and return an address T, let M=T‖k.EncPP,IDc,Kc,M,A,tc⟶CT,Sc. Input public parameters PP, user’s IDc, the secret key Kc, the message M about T‖k, user’s access policy A and timestamp tc. Set access policy A=F,ρ, F∈Rqn×m with row labels ρj∈H, ∀j∈n, H∈A. Generate a vector v=s,r2,…,rm, where r2,…,rm←Rq and s∈Rq is the secret to be shared. δj=Fj×v∈Rq where Fj is the vector corresponding to jth row of F, then choose a uniformly random element r←Rq, and noise terms e′,ej′←χ, Compute C0=PK0rs+M+pe′∈Rq, Cj=arPKjδj+pj′∈Rq, Sc=Kc0+IDc||tc , output CT=C0,Cj and Sc.SGenIDr,Kr,tr⟶Sr. Input user’s IDr, the secret key Kr=Kr0,Kri and timestamp tc, then compute Sr=Kr0+IDr‖tr.Skey GenSc,Sr,P⟶sk. Input ciphertext tag Sc, access tag Sr and system control policy P, compute IDc‖tc=Sc−Kc0 and IDr‖tr=Sr−Kr0, then judge whether IDc and IDr meet the communication requirements according to the system control policy P. If the identities of both parties are legal and meet the requirements of access control policy, then let sk′=1, otherwise select a uniformly random sk′←Rq, output the sanitizer key sk=sk′.SanCT,sk⟶CT∗. Input ciphertext CT and sanitizer key sk, compute C0′=skC0∈Rq, Cj′=Cj∈Rq, output CT∗=C0′,Cj′.DecPP,CT∗,K⟶M. Input public parameters PP, ciphertext CT∗, user’s secret key K. If the DU meets the access control policy P, the ciphertext CT∗ is equivalent to the original ciphertext CT, as long as the DU’s attribute meets the access structure A, I⊂1,…,n, I=i:ρi∈A, compute a set of constants ωi∈Rqi∈I with a linear reconstruction algorithm of LSSS, then ∑i∈Iδiωi=s, compute M′=C0′−K0∑i∈ICiωiKi, M=M′modp, the DU can download the data through the address T and decrypt it with the key sk to obtain DT.The correctness of the successful decryption of the scheme is explained as follows.(2)M′=C0′−K0∑i∈ICiωiKi=1⋅C0−K0∑i∈IaPKirδi+pei′ωiKi=C0−K0∑i∈IaPKirsKi−p⋅K0∑i∈Iei′ωiKi=C0−K0∑i∈IarsSKi+peiSKi−1t+pej″−p⋅K0∑i∈Iei′ωiKi=M+PK0rs+pe′−SK0t−1+pe″arst−parsK0∑i∈ISKiei″+eiSKi−1+eipei″−p⋅K0∑i∈Iei′ωiKi=M+pe0rs+pe′−pe″tars−parsK0∑i∈ISKi⋅ei″+ei⋅SKi−1+ei⋅p⋅ei″−p⋅K0∑i∈Iei′⋅ωi⋅Ki.ThenM=M′modp, and in order to ensure the correctness of the scheme, the noise term in the schememust meet be small enough compared to the ratio of q to p.


## 4. Analysis

### 4.1. Security Analysis

#### 4.1.1. Security Assumptions

The underlying data of the blockchain and the data on the IPFS are secure, and there will be no leakage or physical attack.All underlying crypto primitives used are secure, including symmetric encryption, public key encryption and other encryption operations.All relevant keys that are externally managed have not been compromised.It should be noted that legitimate users, illegal users and external attackers are allowed to collude to attack, and it is assumed that all algorithms can calculate accurately and there are no attack and destruction of physical conditions.The adversary has polynomially bounded computer resources.


#### 4.1.2. Security Proof

This section examines the security of the SACS-ABE&B scheme through three theorems. Before proving, it should be noted that these three theorems prove the different properties of the scheme through the indistinguishability of the ciphertext, and there is no strict progressive relationship between them. Theorems1 and 2 mainly prove the no read and no write rules, and Theorem 3 mainly proves the part of attribute-based encryption in the scheme. Assuming that in all games, the answers to all legitimate queries are correct.Theorem 1.
If there is no a Probabilistic Polynomial Time (PPT) algorithm adversaryA can win the game in Definition 7, the SACS-ABE&B scheme satisfies the No-Read Rule.Proof.
According to the Definition7, the Payload Privacy and Sender Anonymity of the scheme are proved as follows.
Payload Privacy. According to the definition, access control policy Pui0,uj=Pui1,uj=0 must be met for uj who query the decryption key to OG. According to the identity permission of the ui0 and the ui1, three situations are discussed below.(a)
ui0=ui1=0, that means ui0 and ui1 have no right to read and write, their secret key K←Rq is randomly generated in EncPP,K,M,A⟶CT, and CT is randomly generated and independent of Mb, where b=0 or b=1. So A has no special advantage to distinguish Mb, then PrAwin the No−Read game=Prb=b′, we can conclude advA=2⋅PrAwin the No−Read game−1/2=2⋅Prb=b′−1/2≤neglλ.(b)
ui0=ui1=1, that means ui0 and ui1 are legal and they can obtain valid secret key K, the CT are indistinguishable because of the difficulty of the decision RLWEd,q,χ problem (Theorem 3), we attain advA=ε/2≤neglλ.(c)
ui0=0,ui1=1 or ui0=1,ui1=0. When ui0=0,ui1=1, ui1 can get valid secret key K, and compute normal CT, and C0,Cj∈Rq are uniformly distributed in the ciphertext space in the CT; ui0 cannot get K, his CT is randomly generated in the ciphertext space. It can be seen from case b) that the two CT are indistinguishable, then advA=2⋅PrAwin the No−Read game−1/2=2⋅Prb=b′−1/2≤neglλ. When ui0=1,ui1=0, the situation is consistent with ui0=0,ui1=1.
Sender Anonymity. According to the definition, access control policy Pui0,uj=Pui1,uj and M0=M1 must be met for all users uj who query the decryption key to OG. According to the identity permission of the ui0 and the ui1, three situations are discussed below.(a)
ui0=ui1=0. This case is same as a) in Payload Privacy. So advA≤neglλ.(b)
ui0=ui1=1. If uj=1 and Pui0,uj=Pui1,uj=1, A can decrypt the challenge ciphertexts. However, the encryption key and the message in the challenge ciphertexts are completely identical. So EncPP,Kc,Mb,A⟶CT for b=0 or b=1 are identical, obviously advA=2⋅Prwin the No−Read game−1/2≤neglλ.(c)
ui0=0,ui1=1 or ui0=1,ui1=0. This case is same as c) in Payload Privacy. So advA≤neglλ.
Now we complete the proof of Theorem1.Theorem 2.
If there is no a PPT algorithm adversaryA can win the game in Definition 8, the SACS-ABE&B scheme satisfies the No-Write Rule.Proof.
According to the Definition8, the identities of the sender are just 0 or 1, so IS=∅ or IS=1 in the secret key query before giving the attack target. That is, the sender’s secret key is queried or the sender’s secret key is not queried, two situations are discussed below.(a)
IS=1. Because ui′∈IS∪0 in definition, so ui′∈0,1 and Pui,uj=0,∀ui,uj∈IS. Because Pui,uj=0, sk←Rq are randomly selected. When b=0, SanCT,sk⟶CT∗ and CT is the originally specified plaintext encrypted by the encryption algorithm EncPP,Kc,M,A⟶CT; When b=1, SanEncPP,Kc,rM,A,sk⟶CT∗ and rM is a random plaintext. Obviously, both of CT∗ are all uniform distribution in Rq and all ciphertexts are indistinguishable. A has no special advantage to distinguish which situation, so PrAwin the No−Write game=Prb=b′, then advA=2⋅PrAwin the No−Write game−1/2=2⋅Prb=b′−1/2≤neglλ.(b)
IS=∅. We can get ui′=0, so the adversary can query the key before or after generating the attack target according Pui,uj=0,∀ui,uj∈IS. It is necessary to prove that even if the adversary has keys, it still cannot distinguish the challenge ciphertext. At this time, it is only necessary to prove that in this case, except for the negligible probability, the output and input of Sanitizer are independent. C0=PK0rs+M+pe′∈Rq is uniform distribution in Rq over Enc algorithm and C0′=skC0∈Rq is uniform distribution in Rq over San algorithm, where sk←Rq. In this case, the C0 and C0′ are independent. So, it still cannot distinguish the challenge ciphertext, then we can conclude that advA=2⋅PrAwin the No−Write game−1/2=2⋅Prb=b′−1/2≤neglλ.
Now we complete the proof of Theorem2.Theorem 3.
If there exists a PPT algorithm adversaryA with the advantage ε to win the game in Definition 8, then there exists a PPT simulator ℬ can decide Decision R−LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionRLWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudo-random Os or a truly random Os′, then the simulator ℬ differentiate O by adversary A. First, ℬ queries the oracle and receives (t + 1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,…,t, then proceed as follows.
Initialization Phase. Given a set of attributes U. The adversary A selects an access structure A∗ that wishes to be challenged and sends it to ℬ.
Setup. ℬ runs Setupλ,U⟶PP,MSK, let PK0=pω0∈Rq, select a pair of uniformly random SKi,SKi−1←Rq for each attribute in U.Let PKi=pωi∈Rq if i∈A∗; otherwise, let PKi=SKi+pei∈Rq. Then ℬ send PP=a,PK0,PKii=1n to A.
Inquiry Phase 1. A sends secret key queries for D∗=D1∗,D2∗,…,Dj∗, where D∗ does not meet the access policy A∗. ℬ runs KeyGen, computes K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei″∈Rq,∀i∈D∗, and send K=K0,Ki to A.
Challenge. A chooses two messages M0,M1∈0,1 and send them to simulator ℬ, then ℬ randomly select b∈0,1 , if b=0, ℬ randomly choose x←Rq and let C0=px0∈Rq, Cj=pxj∈Rq; if b=1, let C0=pv0+M∈Rq, Cj=pvj∈Rq for j∈A∗.
Inquiry Phase 2. A asks for the key as in phase 1.
Guess. Adversary A outputs his guess b′ about b to ℬ. If b′=b, output O′=Os, otherwise, output O′=Os′. The advantage of A in this game is defined as advA=Prb′=b−1/2, so the oracle O is:
A noisy pseudo-randomOs: the advantage of A is ε, then Prb′=b|O=Os1/2+ε and(3)PrO′=O|O=Os=1/2+ε.
A truly randomOs′: A has no advantage ε and unable to get information about b, then Prb′≠b|O=Os′=1/2, PrO′=O|O=Os′=1/2.
Then the advantage of simulatorℬ is as follows.(4)12PrO′=O|O=Os+12PrO′=O|O=Os′−12=1212+ε+1212−12=ε2.
Now we complete the proof of Theorem 3.


#### 4.1.3. Security and Privacy Evaluation

(1)
Fine-grained access control. The system implements fine-grained access control by CP-ABE. Within the scope allowed by the system policy, legitimate users in the system can formulate their own access policies to determine the users who can access data.(2)
Data security. All data are encrypted before uploading to the cyberspace. The data stored in IPFS is symmetrically encrypted. Even if it is stolen, it will not cause the leakage of effective information. The symmetric key is encrypted through CP-ABE. The security of the encryption scheme is also proved in the previous section.(3)
Privacy protection. In addition to trusted entities, users will not expose personally identifiable information or get other users’ personally identifiable information during access.(4)
Supervision and mandatory control. The system ensures that the data will strictly comply with the access policy formulated by the system through the sanitizer before sharing, and can effectively prevent the communication between corrupt users. Even after the data is uploaded, it can also play an immediate control. Such behaviour can strictly prevent any data sharing that violates the system control policy.(5)
Tailored forensics. The system saves the user’s access process on the private chain in the form of transactions through the private chain, and uses the tamper proof nature of the blockchain to realize the traceability of the process, so as to facilitate the evidence collection in case of disputes in the future.


### 4.2. Performance Analysis

The core of this scheme is constructed based on the ciphertext policy attribute-based encryption, which will be analysed first. Some ciphertext policy attribute-based encryption schemes on lattice are selected and compared from the aspects of access structure, problem, user secret key size, ciphertext size and encryption byte. LetAc is the number of attributes in ciphertext, and Au is the number of user’s attribute. m1,m2 and n are the parameters from lattice, η means the columns of matrix in scheme. The comparison is listed in Table 4.Table 4
Comparison with other attribute-based encryption schemes.
SchemeAccess structureProblemSecret key sizeCiphertext sizeEncryption byte[34]ANDLWE2m1Aulogq2m1Ac+1logq1[35]ShamirRLWEnAu+nlogqnAc+1logqn[36]LSSSRLWE1+nηAulogqnη+1+m2nAclogqnOurLSSSRLWEnAu+nlogqnAc+1logqnIt adopts threshold access structure in scheme [34], which is not flexible enough, and the scheme does not support privacy protection and system control. The schemes of [35, 36] are similar to our scheme in the function and flexibility of the access structure, but they do not support system control, and scheme [35] does not support privacy protection. Scheme [34] is based on the LWE problem on the standard lattice, the encryption byte of the scheme is 1, and the other three schemes are based on the RLWE, and the encryption byte is n. We can know from scheme [34, 36], that m1≥5nlogq and m2≥6nlogq, the size of the user secret key and ciphertext in our scheme are smaller than scheme [34, 36], which are consistent with scheme [35].It is an interesting research direction to use the combination of attribute-based encryption and blockchain to achieve better performance in data access control. In order to better explain the characteristics of this scheme, some schemes based on blockchain and attribute-based encryption are selected to analyse from the function and characteristics. The comparison of some functions is listed in Table5.Table 5
Comparison with other access control schemes on blockchain.
SchemeConfidentialityFine-grained access controlPrivacy protectionOff chain storageAnti- quantum attackSystem control[37]√√√×××[38]√√√√××[39]√√√√××[40]√√√√××[41]√√√×××Our√√√√√√It proposed a new trustworthy secure and attribute hiding access control scheme based on blockchain in [37], the scheme can reduce the trust cost, reduce the single point of failure, and realize distributed and trusted access control management. ElGamal homomorphic encryption was used to ensure the attribute privacy during authorization validation. The scheme takes advantage of the decentralization of blockchain and pays attention to the security risks caused by the transparency of blockchain.It proposed a blockchain-based security sharing scheme for personal data named BSSPD in [38], and the feature of this scheme is user-centric. There is no other entity between the data owner and the data user. The data owner can fully control its shared data, ensuring privacy and security, and it can provide ciphertext keyword search. Although this improves the security of the data, the data owner needs to process the requests from the data users, which will sacrifice the time and energy of the data owner.In order to solve the problems of access control in the medical industry, SHDPCPC-CP-ABE scheme was proposed in [39]. The scheme focuses on the data storage and policy optimization in medical treatment, and ensures the privacy of users in the claim process through homomorphic encryption. The scheme makes use of the immutability of blockchain to realize the user’s medical record.In scheme [40], the medical data problem is also concerned, especially how to solve the data sharing problem caused by remote devices. This scheme combines blockchain and other technologies to propose an architecture, which realizes data exchange between different fields without strong trust assumption, and can also provide the inherent forensics mechanism tailored.In order to solve the security and efficiency problems of cloud data, the scheme of user-centric block level attribute-based encryption is proposed based on the traditional blockchain in [41], and Data Level Access Trust is used to provide certain privacy services.All of the above schemes are based on the decentralization of blockchain to reduce the trust cost. They focus more on avoiding single point of failure and implementing distributed management, which is a wide range of data sharing and access control between different fields. The difference is that the scheme proposed in this paper is aimed at those units and organizations with high security requirements, such as the military and government departments with high level of confidentiality. These units need to be under certain supervision and control, but also need data sharing and access control. At present, there are few papers focusing on this aspect, so we cannot make a similar comparison. To solve this problem, we give a specific scheme based on private chain and ABE, which can resist quantum attacks. Although fully trusted entities are required, which increases the trust cost, these sacrifices are necessary for scenarios with high security requirements.


### 4.3. Experimental Analysis

This section analyses the operation efficiency of this scheme in different stages, including six algorithms: system initialization, key generation, tag generation, sanitizer key generation, sanitize and decryption, and simulates the operation time of these algorithms when the number of attributes ranges from 5 to 100.The experiment is performed on a 64 bit Windows 10 operating system with inter (R) core ™ i7-6700HQ CPU @ 2.60 GHz processor and 16 GB of memory. The parameters selected in this experiment areq = 67108289, p = 3. In order to better analyse the performance of the scheme, the degrees of polynomials are 16, 32, 64, 128, 256, 512 respectively.As shown in Figure3, the system initialization time of our scheme is linear with the number of attributes. As the degree increases, the running time increases with the number of attributes, and the change trend is more and more obvious. Like Figure 3, Figures 4 and 5 show a linear relationship between running time and the number of attributes. Because the key generation stage and encryption stage need multiple multiplication operations, it takes a long time. The specific number of multiplications is related to the number of attributes. However, in general, there are not so many attributes in the policy and in the attribute set of a single user. Figures 6 and 7 show that the running time of the algorithm has nothing to do with the number of attributes, and the algorithm takes a short time and does not bring too much burden to the system, which is also consistent with the theoretical analysis. Figure 8 shows a linear relationship between running time of the decryption and the number of attributes, and there is little difference in the performance of the algorithms below d = 128.Figure 3
Run time of system initialization.Figure 4
Run time of key generation.Figure 5
Run time of ciphertext generation.Figure 6
Run time of tag generation.Figure 7
Run time of sanitizing.Figure 8
Run time of decryption.


## 4.1. Security Analysis

### 4.1.1. Security Assumptions

The underlying data of the blockchain and the data on the IPFS are secure, and there will be no leakage or physical attack.All underlying crypto primitives used are secure, including symmetric encryption, public key encryption and other encryption operations.All relevant keys that are externally managed have not been compromised.It should be noted that legitimate users, illegal users and external attackers are allowed to collude to attack, and it is assumed that all algorithms can calculate accurately and there are no attack and destruction of physical conditions.The adversary has polynomially bounded computer resources.


### 4.1.2. Security Proof

This section examines the security of the SACS-ABE&B scheme through three theorems. Before proving, it should be noted that these three theorems prove the different properties of the scheme through the indistinguishability of the ciphertext, and there is no strict progressive relationship between them. Theorems1 and 2 mainly prove the no read and no write rules, and Theorem 3 mainly proves the part of attribute-based encryption in the scheme. Assuming that in all games, the answers to all legitimate queries are correct.Theorem 1.
If there is no a Probabilistic Polynomial Time (PPT) algorithm adversaryA can win the game in Definition 7, the SACS-ABE&B scheme satisfies the No-Read Rule.Proof.
According to the Definition7, the Payload Privacy and Sender Anonymity of the scheme are proved as follows.
Payload Privacy. According to the definition, access control policy Pui0,uj=Pui1,uj=0 must be met for uj who query the decryption key to OG. According to the identity permission of the ui0 and the ui1, three situations are discussed below.(a)
ui0=ui1=0, that means ui0 and ui1 have no right to read and write, their secret key K←Rq is randomly generated in EncPP,K,M,A⟶CT, and CT is randomly generated and independent of Mb, where b=0 or b=1. So A has no special advantage to distinguish Mb, then PrAwin the No−Read game=Prb=b′, we can conclude advA=2⋅PrAwin the No−Read game−1/2=2⋅Prb=b′−1/2≤neglλ.(b)
ui0=ui1=1, that means ui0 and ui1 are legal and they can obtain valid secret key K, the CT are indistinguishable because of the difficulty of the decision RLWEd,q,χ problem (Theorem 3), we attain advA=ε/2≤neglλ.(c)
ui0=0,ui1=1 or ui0=1,ui1=0. When ui0=0,ui1=1, ui1 can get valid secret key K, and compute normal CT, and C0,Cj∈Rq are uniformly distributed in the ciphertext space in the CT; ui0 cannot get K, his CT is randomly generated in the ciphertext space. It can be seen from case b) that the two CT are indistinguishable, then advA=2⋅PrAwin the No−Read game−1/2=2⋅Prb=b′−1/2≤neglλ. When ui0=1,ui1=0, the situation is consistent with ui0=0,ui1=1.
Sender Anonymity. According to the definition, access control policy Pui0,uj=Pui1,uj and M0=M1 must be met for all users uj who query the decryption key to OG. According to the identity permission of the ui0 and the ui1, three situations are discussed below.(a)
ui0=ui1=0. This case is same as a) in Payload Privacy. So advA≤neglλ.(b)
ui0=ui1=1. If uj=1 and Pui0,uj=Pui1,uj=1, A can decrypt the challenge ciphertexts. However, the encryption key and the message in the challenge ciphertexts are completely identical. So EncPP,Kc,Mb,A⟶CT for b=0 or b=1 are identical, obviously advA=2⋅Prwin the No−Read game−1/2≤neglλ.(c)
ui0=0,ui1=1 or ui0=1,ui1=0. This case is same as c) in Payload Privacy. So advA≤neglλ.
Now we complete the proof of Theorem1.Theorem 2.
If there is no a PPT algorithm adversaryA can win the game in Definition 8, the SACS-ABE&B scheme satisfies the No-Write Rule.Proof.
According to the Definition8, the identities of the sender are just 0 or 1, so IS=∅ or IS=1 in the secret key query before giving the attack target. That is, the sender’s secret key is queried or the sender’s secret key is not queried, two situations are discussed below.(a)
IS=1. Because ui′∈IS∪0 in definition, so ui′∈0,1 and Pui,uj=0,∀ui,uj∈IS. Because Pui,uj=0, sk←Rq are randomly selected. When b=0, SanCT,sk⟶CT∗ and CT is the originally specified plaintext encrypted by the encryption algorithm EncPP,Kc,M,A⟶CT; When b=1, SanEncPP,Kc,rM,A,sk⟶CT∗ and rM is a random plaintext. Obviously, both of CT∗ are all uniform distribution in Rq and all ciphertexts are indistinguishable. A has no special advantage to distinguish which situation, so PrAwin the No−Write game=Prb=b′, then advA=2⋅PrAwin the No−Write game−1/2=2⋅Prb=b′−1/2≤neglλ.(b)
IS=∅. We can get ui′=0, so the adversary can query the key before or after generating the attack target according Pui,uj=0,∀ui,uj∈IS. It is necessary to prove that even if the adversary has keys, it still cannot distinguish the challenge ciphertext. At this time, it is only necessary to prove that in this case, except for the negligible probability, the output and input of Sanitizer are independent. C0=PK0rs+M+pe′∈Rq is uniform distribution in Rq over Enc algorithm and C0′=skC0∈Rq is uniform distribution in Rq over San algorithm, where sk←Rq. In this case, the C0 and C0′ are independent. So, it still cannot distinguish the challenge ciphertext, then we can conclude that advA=2⋅PrAwin the No−Write game−1/2=2⋅Prb=b′−1/2≤neglλ.
Now we complete the proof of Theorem2.Theorem 3.
If there exists a PPT algorithm adversaryA with the advantage ε to win the game in Definition 8, then there exists a PPT simulator ℬ can decide Decision R−LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionRLWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudo-random Os or a truly random Os′, then the simulator ℬ differentiate O by adversary A. First, ℬ queries the oracle and receives (t + 1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,…,t, then proceed as follows.
Initialization Phase. Given a set of attributes U. The adversary A selects an access structure A∗ that wishes to be challenged and sends it to ℬ.
Setup. ℬ runs Setupλ,U⟶PP,MSK, let PK0=pω0∈Rq, select a pair of uniformly random SKi,SKi−1←Rq for each attribute in U.Let PKi=pωi∈Rq if i∈A∗; otherwise, let PKi=SKi+pei∈Rq. Then ℬ send PP=a,PK0,PKii=1n to A.
Inquiry Phase 1. A sends secret key queries for D∗=D1∗,D2∗,…,Dj∗, where D∗ does not meet the access policy A∗. ℬ runs KeyGen, computes K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei″∈Rq,∀i∈D∗, and send K=K0,Ki to A.
Challenge. A chooses two messages M0,M1∈0,1 and send them to simulator ℬ, then ℬ randomly select b∈0,1 , if b=0, ℬ randomly choose x←Rq and let C0=px0∈Rq, Cj=pxj∈Rq; if b=1, let C0=pv0+M∈Rq, Cj=pvj∈Rq for j∈A∗.
Inquiry Phase 2. A asks for the key as in phase 1.
Guess. Adversary A outputs his guess b′ about b to ℬ. If b′=b, output O′=Os, otherwise, output O′=Os′. The advantage of A in this game is defined as advA=Prb′=b−1/2, so the oracle O is:
A noisy pseudo-randomOs: the advantage of A is ε, then Prb′=b|O=Os1/2+ε and(3)PrO′=O|O=Os=1/2+ε.
A truly randomOs′: A has no advantage ε and unable to get information about b, then Prb′≠b|O=Os′=1/2, PrO′=O|O=Os′=1/2.
Then the advantage of simulatorℬ is as follows.(4)12PrO′=O|O=Os+12PrO′=O|O=Os′−12=1212+ε+1212−12=ε2.
Now we complete the proof of Theorem 3.


### 4.1.3. Security and Privacy Evaluation

(1)
Fine-grained access control. The system implements fine-grained access control by CP-ABE. Within the scope allowed by the system policy, legitimate users in the system can formulate their own access policies to determine the users who can access data.(2)
Data security. All data are encrypted before uploading to the cyberspace. The data stored in IPFS is symmetrically encrypted. Even if it is stolen, it will not cause the leakage of effective information. The symmetric key is encrypted through CP-ABE. The security of the encryption scheme is also proved in the previous section.(3)
Privacy protection. In addition to trusted entities, users will not expose personally identifiable information or get other users’ personally identifiable information during access.(4)
Supervision and mandatory control. The system ensures that the data will strictly comply with the access policy formulated by the system through the sanitizer before sharing, and can effectively prevent the communication between corrupt users. Even after the data is uploaded, it can also play an immediate control. Such behaviour can strictly prevent any data sharing that violates the system control policy.(5)
Tailored forensics. The system saves the user’s access process on the private chain in the form of transactions through the private chain, and uses the tamper proof nature of the blockchain to realize the traceability of the process, so as to facilitate the evidence collection in case of disputes in the future.


## 4.1.1. Security Assumptions

The underlying data of the blockchain and the data on the IPFS are secure, and there will be no leakage or physical attack.All underlying crypto primitives used are secure, including symmetric encryption, public key encryption and other encryption operations.All relevant keys that are externally managed have not been compromised.It should be noted that legitimate users, illegal users and external attackers are allowed to collude to attack, and it is assumed that all algorithms can calculate accurately and there are no attack and destruction of physical conditions.The adversary has polynomially bounded computer resources.


## 4.1.2. Security Proof

This section examines the security of the SACS-ABE&B scheme through three theorems. Before proving, it should be noted that these three theorems prove the different properties of the scheme through the indistinguishability of the ciphertext, and there is no strict progressive relationship between them. Theorems1 and 2 mainly prove the no read and no write rules, and Theorem 3 mainly proves the part of attribute-based encryption in the scheme. Assuming that in all games, the answers to all legitimate queries are correct.Theorem 1.
If there is no a Probabilistic Polynomial Time (PPT) algorithm adversaryA can win the game in Definition 7, the SACS-ABE&B scheme satisfies the No-Read Rule.Proof.
According to the Definition7, the Payload Privacy and Sender Anonymity of the scheme are proved as follows.
Payload Privacy. According to the definition, access control policy Pui0,uj=Pui1,uj=0 must be met for uj who query the decryption key to OG. According to the identity permission of the ui0 and the ui1, three situations are discussed below.(a)
ui0=ui1=0, that means ui0 and ui1 have no right to read and write, their secret key K←Rq is randomly generated in EncPP,K,M,A⟶CT, and CT is randomly generated and independent of Mb, where b=0 or b=1. So A has no special advantage to distinguish Mb, then PrAwin the No−Read game=Prb=b′, we can conclude advA=2⋅PrAwin the No−Read game−1/2=2⋅Prb=b′−1/2≤neglλ.(b)
ui0=ui1=1, that means ui0 and ui1 are legal and they can obtain valid secret key K, the CT are indistinguishable because of the difficulty of the decision RLWEd,q,χ problem (Theorem 3), we attain advA=ε/2≤neglλ.(c)
ui0=0,ui1=1 or ui0=1,ui1=0. When ui0=0,ui1=1, ui1 can get valid secret key K, and compute normal CT, and C0,Cj∈Rq are uniformly distributed in the ciphertext space in the CT; ui0 cannot get K, his CT is randomly generated in the ciphertext space. It can be seen from case b) that the two CT are indistinguishable, then advA=2⋅PrAwin the No−Read game−1/2=2⋅Prb=b′−1/2≤neglλ. When ui0=1,ui1=0, the situation is consistent with ui0=0,ui1=1.
Sender Anonymity. According to the definition, access control policy Pui0,uj=Pui1,uj and M0=M1 must be met for all users uj who query the decryption key to OG. According to the identity permission of the ui0 and the ui1, three situations are discussed below.(a)
ui0=ui1=0. This case is same as a) in Payload Privacy. So advA≤neglλ.(b)
ui0=ui1=1. If uj=1 and Pui0,uj=Pui1,uj=1, A can decrypt the challenge ciphertexts. However, the encryption key and the message in the challenge ciphertexts are completely identical. So EncPP,Kc,Mb,A⟶CT for b=0 or b=1 are identical, obviously advA=2⋅Prwin the No−Read game−1/2≤neglλ.(c)
ui0=0,ui1=1 or ui0=1,ui1=0. This case is same as c) in Payload Privacy. So advA≤neglλ.
Now we complete the proof of Theorem1.Theorem 2.
If there is no a PPT algorithm adversaryA can win the game in Definition 8, the SACS-ABE&B scheme satisfies the No-Write Rule.Proof.
According to the Definition8, the identities of the sender are just 0 or 1, so IS=∅ or IS=1 in the secret key query before giving the attack target. That is, the sender’s secret key is queried or the sender’s secret key is not queried, two situations are discussed below.(a)
IS=1. Because ui′∈IS∪0 in definition, so ui′∈0,1 and Pui,uj=0,∀ui,uj∈IS. Because Pui,uj=0, sk←Rq are randomly selected. When b=0, SanCT,sk⟶CT∗ and CT is the originally specified plaintext encrypted by the encryption algorithm EncPP,Kc,M,A⟶CT; When b=1, SanEncPP,Kc,rM,A,sk⟶CT∗ and rM is a random plaintext. Obviously, both of CT∗ are all uniform distribution in Rq and all ciphertexts are indistinguishable. A has no special advantage to distinguish which situation, so PrAwin the No−Write game=Prb=b′, then advA=2⋅PrAwin the No−Write game−1/2=2⋅Prb=b′−1/2≤neglλ.(b)
IS=∅. We can get ui′=0, so the adversary can query the key before or after generating the attack target according Pui,uj=0,∀ui,uj∈IS. It is necessary to prove that even if the adversary has keys, it still cannot distinguish the challenge ciphertext. At this time, it is only necessary to prove that in this case, except for the negligible probability, the output and input of Sanitizer are independent. C0=PK0rs+M+pe′∈Rq is uniform distribution in Rq over Enc algorithm and C0′=skC0∈Rq is uniform distribution in Rq over San algorithm, where sk←Rq. In this case, the C0 and C0′ are independent. So, it still cannot distinguish the challenge ciphertext, then we can conclude that advA=2⋅PrAwin the No−Write game−1/2=2⋅Prb=b′−1/2≤neglλ.
Now we complete the proof of Theorem2.Theorem 3.
If there exists a PPT algorithm adversaryA with the advantage ε to win the game in Definition 8, then there exists a PPT simulator ℬ can decide Decision R−LWEd,q,χ Problem with advantage ε/2.Proof.
The DecisionRLWEd,q,χ Problem is to determine whether the oracle O is a noisy pseudo-random Os or a truly random Os′, then the simulator ℬ differentiate O by adversary A. First, ℬ queries the oracle and receives (t + 1) samples ωk,υk∈Rq×Rq, where k∈0,1,2,…,t, then proceed as follows.
Initialization Phase. Given a set of attributes U. The adversary A selects an access structure A∗ that wishes to be challenged and sends it to ℬ.
Setup. ℬ runs Setupλ,U⟶PP,MSK, let PK0=pω0∈Rq, select a pair of uniformly random SKi,SKi−1←Rq for each attribute in U.Let PKi=pωi∈Rq if i∈A∗; otherwise, let PKi=SKi+pei∈Rq. Then ℬ send PP=a,PK0,PKii=1n to A.
Inquiry Phase 1. A sends secret key queries for D∗=D1∗,D2∗,…,Dj∗, where D∗ does not meet the access policy A∗. ℬ runs KeyGen, computes K0=SK0t−1+pe″∈Rq, Ki=SKi−1t+pei″∈Rq,∀i∈D∗, and send K=K0,Ki to A.
Challenge. A chooses two messages M0,M1∈0,1 and send them to simulator ℬ, then ℬ randomly select b∈0,1 , if b=0, ℬ randomly choose x←Rq and let C0=px0∈Rq, Cj=pxj∈Rq; if b=1, let C0=pv0+M∈Rq, Cj=pvj∈Rq for j∈A∗.
Inquiry Phase 2. A asks for the key as in phase 1.
Guess. Adversary A outputs his guess b′ about b to ℬ. If b′=b, output O′=Os, otherwise, output O′=Os′. The advantage of A in this game is defined as advA=Prb′=b−1/2, so the oracle O is:
A noisy pseudo-randomOs: the advantage of A is ε, then Prb′=b|O=Os1/2+ε and(3)PrO′=O|O=Os=1/2+ε.
A truly randomOs′: A has no advantage ε and unable to get information about b, then Prb′≠b|O=Os′=1/2, PrO′=O|O=Os′=1/2.
Then the advantage of simulatorℬ is as follows.(4)12PrO′=O|O=Os+12PrO′=O|O=Os′−12=1212+ε+1212−12=ε2.
Now we complete the proof of Theorem 3.


## 4.1.3. Security and Privacy Evaluation

(1)
Fine-grained access control. The system implements fine-grained access control by CP-ABE. Within the scope allowed by the system policy, legitimate users in the system can formulate their own access policies to determine the users who can access data.(2)
Data security. All data are encrypted before uploading to the cyberspace. The data stored in IPFS is symmetrically encrypted. Even if it is stolen, it will not cause the leakage of effective information. The symmetric key is encrypted through CP-ABE. The security of the encryption scheme is also proved in the previous section.(3)
Privacy protection. In addition to trusted entities, users will not expose personally identifiable information or get other users’ personally identifiable information during access.(4)
Supervision and mandatory control. The system ensures that the data will strictly comply with the access policy formulated by the system through the sanitizer before sharing, and can effectively prevent the communication between corrupt users. Even after the data is uploaded, it can also play an immediate control. Such behaviour can strictly prevent any data sharing that violates the system control policy.(5)
Tailored forensics. The system saves the user’s access process on the private chain in the form of transactions through the private chain, and uses the tamper proof nature of the blockchain to realize the traceability of the process, so as to facilitate the evidence collection in case of disputes in the future.


## 4.2. Performance Analysis

The core of this scheme is constructed based on the ciphertext policy attribute-based encryption, which will be analysed first. Some ciphertext policy attribute-based encryption schemes on lattice are selected and compared from the aspects of access structure, problem, user secret key size, ciphertext size and encryption byte. LetAc is the number of attributes in ciphertext, and Au is the number of user’s attribute. m1,m2 and n are the parameters from lattice, η means the columns of matrix in scheme. The comparison is listed in Table 4.Table 4
Comparison with other attribute-based encryption schemes.
SchemeAccess structureProblemSecret key sizeCiphertext sizeEncryption byte[34]ANDLWE2m1Aulogq2m1Ac+1logq1[35]ShamirRLWEnAu+nlogqnAc+1logqn[36]LSSSRLWE1+nηAulogqnη+1+m2nAclogqnOurLSSSRLWEnAu+nlogqnAc+1logqnIt adopts threshold access structure in scheme [34], which is not flexible enough, and the scheme does not support privacy protection and system control. The schemes of [35, 36] are similar to our scheme in the function and flexibility of the access structure, but they do not support system control, and scheme [35] does not support privacy protection. Scheme [34] is based on the LWE problem on the standard lattice, the encryption byte of the scheme is 1, and the other three schemes are based on the RLWE, and the encryption byte is n. We can know from scheme [34, 36], that m1≥5nlogq and m2≥6nlogq, the size of the user secret key and ciphertext in our scheme are smaller than scheme [34, 36], which are consistent with scheme [35].It is an interesting research direction to use the combination of attribute-based encryption and blockchain to achieve better performance in data access control. In order to better explain the characteristics of this scheme, some schemes based on blockchain and attribute-based encryption are selected to analyse from the function and characteristics. The comparison of some functions is listed in Table5.Table 5
Comparison with other access control schemes on blockchain.
SchemeConfidentialityFine-grained access controlPrivacy protectionOff chain storageAnti- quantum attackSystem control[37]√√√×××[38]√√√√××[39]√√√√××[40]√√√√××[41]√√√×××Our√√√√√√It proposed a new trustworthy secure and attribute hiding access control scheme based on blockchain in [37], the scheme can reduce the trust cost, reduce the single point of failure, and realize distributed and trusted access control management. ElGamal homomorphic encryption was used to ensure the attribute privacy during authorization validation. The scheme takes advantage of the decentralization of blockchain and pays attention to the security risks caused by the transparency of blockchain.It proposed a blockchain-based security sharing scheme for personal data named BSSPD in [38], and the feature of this scheme is user-centric. There is no other entity between the data owner and the data user. The data owner can fully control its shared data, ensuring privacy and security, and it can provide ciphertext keyword search. Although this improves the security of the data, the data owner needs to process the requests from the data users, which will sacrifice the time and energy of the data owner.In order to solve the problems of access control in the medical industry, SHDPCPC-CP-ABE scheme was proposed in [39]. The scheme focuses on the data storage and policy optimization in medical treatment, and ensures the privacy of users in the claim process through homomorphic encryption. The scheme makes use of the immutability of blockchain to realize the user’s medical record.In scheme [40], the medical data problem is also concerned, especially how to solve the data sharing problem caused by remote devices. This scheme combines blockchain and other technologies to propose an architecture, which realizes data exchange between different fields without strong trust assumption, and can also provide the inherent forensics mechanism tailored.In order to solve the security and efficiency problems of cloud data, the scheme of user-centric block level attribute-based encryption is proposed based on the traditional blockchain in [41], and Data Level Access Trust is used to provide certain privacy services.All of the above schemes are based on the decentralization of blockchain to reduce the trust cost. They focus more on avoiding single point of failure and implementing distributed management, which is a wide range of data sharing and access control between different fields. The difference is that the scheme proposed in this paper is aimed at those units and organizations with high security requirements, such as the military and government departments with high level of confidentiality. These units need to be under certain supervision and control, but also need data sharing and access control. At present, there are few papers focusing on this aspect, so we cannot make a similar comparison. To solve this problem, we give a specific scheme based on private chain and ABE, which can resist quantum attacks. Although fully trusted entities are required, which increases the trust cost, these sacrifices are necessary for scenarios with high security requirements.


## 4.3. Experimental Analysis

This section analyses the operation efficiency of this scheme in different stages, including six algorithms: system initialization, key generation, tag generation, sanitizer key generation, sanitize and decryption, and simulates the operation time of these algorithms when the number of attributes ranges from 5 to 100.The experiment is performed on a 64 bit Windows 10 operating system with inter (R) core ™ i7-6700HQ CPU @ 2.60 GHz processor and 16 GB of memory. The parameters selected in this experiment areq = 67108289, p = 3. In order to better analyse the performance of the scheme, the degrees of polynomials are 16, 32, 64, 128, 256, 512 respectively.As shown in Figure3, the system initialization time of our scheme is linear with the number of attributes. As the degree increases, the running time increases with the number of attributes, and the change trend is more and more obvious. Like Figure 3, Figures 4 and 5 show a linear relationship between running time and the number of attributes. Because the key generation stage and encryption stage need multiple multiplication operations, it takes a long time. The specific number of multiplications is related to the number of attributes. However, in general, there are not so many attributes in the policy and in the attribute set of a single user. Figures 6 and 7 show that the running time of the algorithm has nothing to do with the number of attributes, and the algorithm takes a short time and does not bring too much burden to the system, which is also consistent with the theoretical analysis. Figure 8 shows a linear relationship between running time of the decryption and the number of attributes, and there is little difference in the performance of the algorithms below d = 128.Figure 3
Run time of system initialization.Figure 4
Run time of key generation.Figure 5
Run time of ciphertext generation.Figure 6
Run time of tag generation.Figure 7
Run time of sanitizing.Figure 8
Run time of decryption.


## 5. Conclusion

This paper focuses on how to carry out data sharing and access control in the case of high security requirements. Based on the combination of private chain and attribute-based encryption, a sanitizer is set up to supervise the shared data, avoiding data sharing that violates the system control policy. Although higher trust assumptions are required, higher security and reliability can be obtained, which is of certain significance in specific situations. Through analysis, the scheme meets the No-Read and No-Write rules and the security under chosen-plaintext attack. In terms of performance, the scheme is constructed based on RLWE problem, and its efficiency is better than the scheme based on LWE. In terms of function, it focuses on providing system control and resisting quantum attacks compared with other schemes. Of course, other schemes also have many features that this scheme does not have, such as the problem of updating attributes and policies, the problem of searching ciphertext and so on. In addition, the paper also carries out experimental simulation on the attribute-based encryption and decryption part of the scheme. Unfortunately, the paper does not simulate the whole access process in combination with the blockchain platform. These are the work we need to do in the next step.



---

*Source: 7067812-2022-09-23.xml*