# A Secure and Privacy-Aware Smart Health System with Secret Key Leakage Resilience

Authors: Yinghui Zhang; Pengzhen Lang; Dong Zheng; Menglei Yang; Rui Guo
Journal: Security and Communication Networks
 (2018)

---

## Abstract

With the development of the smart health (s-health), data security and patient privacy are becoming more and more important. However, some traditional cryptographic schemes can not guarantee data security and patient privacy under various forms of leakage attacks. To prevent the adversary from capturing the part of private keys by leakage attacks, we propose a secure leakage-resilient s-health system which realizes privacy protection and the safe transmission of medical information in the case of leakage attacks. The key technique is a promising public key cryptographic primitive called leakage-resilient anonymous Hierarchical Identity-Based Encryption. Our construction is proved to be secure against chosen plaintext attacks in the standard model under the Diffie-Hellman exponent assumption and decisional linear assumption. We also blind the public parameters and ciphertexts by using double exponent technique to achieve the recipient anonymity. Finally, the performance analysis shows the practicability of our scheme, and the leakage rate of the private key approximates to 1/6.


---

## Body

## 1. Introduction

With the development of information technology, the Internet of Things (IoT) has become a very important technology for government departments, businesses, and academic circles in various countries with its huge application scenes. The technology of IoT is based on the Internet to achieve the communication between information and terminal equipment, information, and real goods. At present, IoT has been widely used in many fields, like food safety, smart health (s-health), urban construction, cloud storage, etc. [1–4].The cloud-based s-health systems play an important role in our daily life. At present, doctors use computers to store and retrieve patients’ electronic health records (EHRs). EHRs systems replace paper systems and thus increase efficiency in the recording, storage, and retrieval of patients information [5–7]. However, EHRs which reveal highly confidential personal information stored in the cloud and exchanged over the Internet can be vulnerable to attack [8–10], such as data loss, hackers hijacking information, and integrity. In recent years, a large number of medical information leaks in cloud storage have attracted more and more people’s attention. Data privacy and security is believed to be the major challenge in the deployment of EHR-based healthcare system. There has been a lot of work that deals with data privacy and security problems [11–15].However, the traditional cryptographic schemes may not be secure under various forms of leakage attacks, such as side-channel attacks [16] and cold-boot attack [17]. Such attacks exploit various forms of information leakage by observing physical implementations of cryptosystems, such as running time [18], electromagnetic radiation [19], power consumption, and fault detection [20]. IoT generally adopts discrete network structure, and most of the nodes are located outdoors, which makes it easy for attackers to obtain sensitive information [21–23]. Therefore, it is very meaningful to construct a secure and privacy-aware smart health system with secret key leakage resilience in the case of leakage attacks. Based on the paper of Zhang et al. [24], we construct a leakage-resilient anonymous HIBE scheme in s-health data sharing [25–27] scenarios.


### 1.1. Our Contributions

To address the medical information security and privacy of the patients issues in s-health, we propose a secure s-health system which allows a medical information owner to securely share data in the case of leakage attacks. The main contributions of this paper as follows.(i)
Firstly, we present the system model of a secure s-health system based on a leakage-resilient anonymous HIBE scheme. Our system addresses the problem of key management and reduces the pressure of PKG.(ii)
Secondly, we blind the public parameters and ciphertexts using double exponent technique to achieve the anonymity, so as to achieve the effect of protecting privacy.(iii)
Finally, our scheme is built in prime order groups that are more computationally efficient than composite order groups. The proposed scheme is proved to be secure against chosen plaintext attacks in the standard model.


### 1.2. Related Work

More attention to identity-based encryption (IBE) has been attracted since the notion of IBE was introduced by Shamir [28]. The private key for the user in traditional IBE schemes [29] is generated by the Private Key Generation Center (PKG). However, in a large scale network, such as s-health, the number of users is huge, and the task of PKG is too heavy and it is difficult to manage the user’s private key. In order to solve this problem, the notion of Hierarchical Identity-Based Encryption (HIBE) was proposed [30] and then many HIBE schemes were proposed [31, 32]. What is more, many anonymous HIBE schemes were proposed [33–36] where the ciphertext does not leak the identity of the recipient. However, their sizes of private keys and ciphertexts increase with the depth of identity hierarchy. Zhang et al. [24] proposed an anonymous HIBE scheme over prime order groups where both private keys and ciphertext have a constant size.Dillema et al. [37] proposed a simple cryptographic access control method in the prehospital environment. However, this system provides access privilege if and only if patient and health worker meet in the physical world. Zhang et al. [38] proposed a reference model of the security and privacy issues in the EHR cloud and requirements for secure access of EHR data. A secure EHR system demonstrated to be resilient to various attacks to protect patient privacy and enable emergency healthcare was proposed by Sun et al. [39]. In e-Health and Mobile Health network, Guo et al. [40, 41] proposed a privacy-preserving attribute-based authentication system, which leverages users verifiable attributes to authenticate users while preserving their privacy issues. Kumar et al. [42] proposed a biometric based authentication scheme which is lightweight and solely uses symmetric key based operations. A secure data sharing using IBE scheme for the implementation of data sharing in the e-Healthcare system was proposed by Sudarson et al. [43]. Zhang et al. [44] proposed a system architecture and adversary model of a secure s-health system which realizes fine-grained access control on s-health cloud data and hence ensures users privacy protection. Dawoud et al. [45] defined different scenarios for the integration of the e-health systems with the cloud computing systems and these scenarios discussed the authentication and data processing in the different parts of the system. Zhang et al. [46] proposed a three-factor authenticated key agreement scheme based on a dynamic authentication mechanism to protect the users privacy using for e-health systems, and it was proved to be semantically secure under the real or random model. Sahi et al. [47] reviewed the latest research with regard to privacy preservation in e-Healthcare and explored whether this research offers any possible solutions to patient privacy requirements for e-Healthcare. However, these schemes may not be secure under various forms of leakage attacks.The first leakage-resilient cryptographic scheme was proposed by Dziembowski and Pietrzak [48] that can capture most of the key leakage attacks. However, they constructed the leakage-resilient encryption scheme based on “only computation leaks information” which can not capture the cold-boot attack. To resist the cold-boot attack, the bounded-leakage model [49] was proposed by Akavia et al. What is more, the relative-leakage model [50] was proposed by Naor et al. Leakage resilience (anonymous) IBE schemes have been discussed previously. A leakage-resilient IBE scheme was proposed and showed being secure in the standard model by Alwen et al. [51]. Chow et al. [52] proposed three new leakage-resilient IBE schemes under the respective static assumptions of the original systems. Li et al. [53] proposed a new leakage-resilient public key encryption and showed that it was secure under Decisional Diffie-Hellman (DDH) assumption. Liu et al. [54] showed that the techniques of dual system technique lead to leakage resilience and proposed an anonymous leakage-resilient identity-based encryption scheme. Li et al. [55] proposed a new leakage-resilient IBE scheme in the bounded-leakage model and showed being semantically secure against adaptive chosen ciphertext attack in the standard model.


### 1.3. Organization

Some preliminaries are reviewed in Section2. In Section 3, we define the usage scenario for smart healthcare system and present the system model and leakage-resilient security model. The secure s-health system based on leakage-resilient anonymous HIBE is described in Section 4. In Section 5, our security analysis and leakage resilience analysis are described. Finally, we draw our conclusions in Section 6.


## 1.1. Our Contributions

To address the medical information security and privacy of the patients issues in s-health, we propose a secure s-health system which allows a medical information owner to securely share data in the case of leakage attacks. The main contributions of this paper as follows.(i)
Firstly, we present the system model of a secure s-health system based on a leakage-resilient anonymous HIBE scheme. Our system addresses the problem of key management and reduces the pressure of PKG.(ii)
Secondly, we blind the public parameters and ciphertexts using double exponent technique to achieve the anonymity, so as to achieve the effect of protecting privacy.(iii)
Finally, our scheme is built in prime order groups that are more computationally efficient than composite order groups. The proposed scheme is proved to be secure against chosen plaintext attacks in the standard model.


## 1.2. Related Work

More attention to identity-based encryption (IBE) has been attracted since the notion of IBE was introduced by Shamir [28]. The private key for the user in traditional IBE schemes [29] is generated by the Private Key Generation Center (PKG). However, in a large scale network, such as s-health, the number of users is huge, and the task of PKG is too heavy and it is difficult to manage the user’s private key. In order to solve this problem, the notion of Hierarchical Identity-Based Encryption (HIBE) was proposed [30] and then many HIBE schemes were proposed [31, 32]. What is more, many anonymous HIBE schemes were proposed [33–36] where the ciphertext does not leak the identity of the recipient. However, their sizes of private keys and ciphertexts increase with the depth of identity hierarchy. Zhang et al. [24] proposed an anonymous HIBE scheme over prime order groups where both private keys and ciphertext have a constant size.Dillema et al. [37] proposed a simple cryptographic access control method in the prehospital environment. However, this system provides access privilege if and only if patient and health worker meet in the physical world. Zhang et al. [38] proposed a reference model of the security and privacy issues in the EHR cloud and requirements for secure access of EHR data. A secure EHR system demonstrated to be resilient to various attacks to protect patient privacy and enable emergency healthcare was proposed by Sun et al. [39]. In e-Health and Mobile Health network, Guo et al. [40, 41] proposed a privacy-preserving attribute-based authentication system, which leverages users verifiable attributes to authenticate users while preserving their privacy issues. Kumar et al. [42] proposed a biometric based authentication scheme which is lightweight and solely uses symmetric key based operations. A secure data sharing using IBE scheme for the implementation of data sharing in the e-Healthcare system was proposed by Sudarson et al. [43]. Zhang et al. [44] proposed a system architecture and adversary model of a secure s-health system which realizes fine-grained access control on s-health cloud data and hence ensures users privacy protection. Dawoud et al. [45] defined different scenarios for the integration of the e-health systems with the cloud computing systems and these scenarios discussed the authentication and data processing in the different parts of the system. Zhang et al. [46] proposed a three-factor authenticated key agreement scheme based on a dynamic authentication mechanism to protect the users privacy using for e-health systems, and it was proved to be semantically secure under the real or random model. Sahi et al. [47] reviewed the latest research with regard to privacy preservation in e-Healthcare and explored whether this research offers any possible solutions to patient privacy requirements for e-Healthcare. However, these schemes may not be secure under various forms of leakage attacks.The first leakage-resilient cryptographic scheme was proposed by Dziembowski and Pietrzak [48] that can capture most of the key leakage attacks. However, they constructed the leakage-resilient encryption scheme based on “only computation leaks information” which can not capture the cold-boot attack. To resist the cold-boot attack, the bounded-leakage model [49] was proposed by Akavia et al. What is more, the relative-leakage model [50] was proposed by Naor et al. Leakage resilience (anonymous) IBE schemes have been discussed previously. A leakage-resilient IBE scheme was proposed and showed being secure in the standard model by Alwen et al. [51]. Chow et al. [52] proposed three new leakage-resilient IBE schemes under the respective static assumptions of the original systems. Li et al. [53] proposed a new leakage-resilient public key encryption and showed that it was secure under Decisional Diffie-Hellman (DDH) assumption. Liu et al. [54] showed that the techniques of dual system technique lead to leakage resilience and proposed an anonymous leakage-resilient identity-based encryption scheme. Li et al. [55] proposed a new leakage-resilient IBE scheme in the bounded-leakage model and showed being semantically secure against adaptive chosen ciphertext attack in the standard model.


## 1.3. Organization

Some preliminaries are reviewed in Section2. In Section 3, we define the usage scenario for smart healthcare system and present the system model and leakage-resilient security model. The secure s-health system based on leakage-resilient anonymous HIBE is described in Section 4. In Section 5, our security analysis and leakage resilience analysis are described. Finally, we draw our conclusions in Section 6.


## 2. Preliminaries

### 2.1. Notations

For ease of reference, important notations are summarized in Table1.Table 1
Notations used throughout the paper.
Notation Description Notation Description Notation Description S D statistical distance X , Y random variable Ω finite domain P r probability H ∞ ( X ) min-entropy H ~ ∞ X ∣ Y average min-entropy e bilinear map E x t extractor G , G T cyclic group g generator A , B algorithm ε advantage P K public key M S K master secret key I D identities d I D private key L d I D number of leaked bits D I D rerandomize private keys l ( λ ) leakage parameter f leakage function ⊥ reject symbol M message C T ciphertext p large prime number v i j vector of Identity h i j auxiliary parameters s random seed l maximum depth of HIBE V view without leakage ρ leakage ratio


### 2.2. Random Extractor

We define the statistical distance between two random variablesX and Y over a finite domain Ω to be (1)SDX,Y=12∑w∈ΩPr⁡X=w-Pr⁡Y=w.The min-entropy of a random variable X is defined as (2)H∞X=-log⁡maxx⁡Pr⁡X=x.The average min-entropy of a random variable X conditioned on another random variable Y is defined as follows: (3)H~∞X∣Y=-log⁡Ey←Y2-H∞X∣Y=y.Definition 1.
If, for all pairs of random variables(X,Y) such that X∈0,1u and H~∞X∣Y≥k, it holds that (4)SDExtX,S,S,Y,Um,S,Y≤ε,where S is uniform over 0,1t, we call polynomial-time function Ext:0,1u×0,1t→0,1m an average-case (k,ε)-strong extractor.Lemma 2.
IfY has 2r possible values and Z is random variable, we have (5)H~∞X∣Y,Z≥H~∞X∣Z-r.


### 2.3. Bilinear Groups

LetG and GT be two cyclic groups of prime order p and e:G×G→GT be a bilinear map. We call G a bilinear group if it has the following properties:(i)
Bilinearity: ∀u,v∈G and a,b∈Zp, we have e(ua,vb)=eu,vab.(ii)
Nondegeneracy: for the generator g∈G, we have e(g,g)≠1.(iii)
Computability: ∀u,v∈G, the bilinear map e(u,v) can be efficiently computed.


### 2.4. Computational Assumptions

#### 2.4.1. Bilinear Diffie-Hellman Exponent (BDHE) Assumption

Letg be a generator of group G and α,c∈Zp∗. We define the computational (n+1)-BDHE problem [56] to be (6)input:g,y0,y1,…,yn,yn+2,…,y2n+2∈G,output:eg,y0αn+1=eg,gαn+1c,where y0=gc, yi=gαi. Algorithm A has advantage ε in solving the computational (n+1)-BDHE problem if (7)Pr⁡Ag,y0,y1,…,yn,yn+2,…,y2n+2=eg,y0αn+1≥ε.The decisional version of the(n+1)-BDHE problem is defined in the usual manner. (8)input:g,y0,y1,…,yn,yn+2,…,y2n+2,K,ouput:b∈0,1.Let K′=(g,y0,y1,…,yn,yn+2,…,y2n+2); Algorithm B has advantage ε in solving the decisional (n+1)-BDHE problem if (9)Pr⁡BK′,eg,y0αn+1=0-Pr⁡BK′,K=0≥ε.


#### 2.4.2. Decisional Linear Assumption

The decisional linear problem [57] is defined as (10)input:g,gz1,gz2,gz1z3,gz2z4,K,ouput:b∈0,1.Algorithm A′s goal is to output 1 when K=gz3+z4 or 0 otherwise. We give three weak versions of the decisional linear problem [35] as follows:(i)
Version (1):(11)input:g,gz1,gz2,gz22,…,gz2n+1,gz2n/z1,gz2n+1/z3,gz4,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.(ii)
Version (2):(12)input:g,gz1,gz2,gz22,…,gz2n,gz2n+2,…,gz22n,gz3,gz4,gz4z2,…,gz2nz4,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.(iii)
Version (3):(13)input:g,gz1,gz2,gz22,…,gz2n,gz2n+2,gz22n,…,gz3,gz4,gz4z2,…,gz2nz4,gz1z2,…,gz2nz1,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.


## 2.1. Notations

For ease of reference, important notations are summarized in Table1.Table 1
Notations used throughout the paper.
Notation Description Notation Description Notation Description S D statistical distance X , Y random variable Ω finite domain P r probability H ∞ ( X ) min-entropy H ~ ∞ X ∣ Y average min-entropy e bilinear map E x t extractor G , G T cyclic group g generator A , B algorithm ε advantage P K public key M S K master secret key I D identities d I D private key L d I D number of leaked bits D I D rerandomize private keys l ( λ ) leakage parameter f leakage function ⊥ reject symbol M message C T ciphertext p large prime number v i j vector of Identity h i j auxiliary parameters s random seed l maximum depth of HIBE V view without leakage ρ leakage ratio


## 2.2. Random Extractor

We define the statistical distance between two random variablesX and Y over a finite domain Ω to be (1)SDX,Y=12∑w∈ΩPr⁡X=w-Pr⁡Y=w.The min-entropy of a random variable X is defined as (2)H∞X=-log⁡maxx⁡Pr⁡X=x.The average min-entropy of a random variable X conditioned on another random variable Y is defined as follows: (3)H~∞X∣Y=-log⁡Ey←Y2-H∞X∣Y=y.Definition 1.
If, for all pairs of random variables(X,Y) such that X∈0,1u and H~∞X∣Y≥k, it holds that (4)SDExtX,S,S,Y,Um,S,Y≤ε,where S is uniform over 0,1t, we call polynomial-time function Ext:0,1u×0,1t→0,1m an average-case (k,ε)-strong extractor.Lemma 2.
IfY has 2r possible values and Z is random variable, we have (5)H~∞X∣Y,Z≥H~∞X∣Z-r.


## 2.3. Bilinear Groups

LetG and GT be two cyclic groups of prime order p and e:G×G→GT be a bilinear map. We call G a bilinear group if it has the following properties:(i)
Bilinearity: ∀u,v∈G and a,b∈Zp, we have e(ua,vb)=eu,vab.(ii)
Nondegeneracy: for the generator g∈G, we have e(g,g)≠1.(iii)
Computability: ∀u,v∈G, the bilinear map e(u,v) can be efficiently computed.


## 2.4. Computational Assumptions

### 2.4.1. Bilinear Diffie-Hellman Exponent (BDHE) Assumption

Letg be a generator of group G and α,c∈Zp∗. We define the computational (n+1)-BDHE problem [56] to be (6)input:g,y0,y1,…,yn,yn+2,…,y2n+2∈G,output:eg,y0αn+1=eg,gαn+1c,where y0=gc, yi=gαi. Algorithm A has advantage ε in solving the computational (n+1)-BDHE problem if (7)Pr⁡Ag,y0,y1,…,yn,yn+2,…,y2n+2=eg,y0αn+1≥ε.The decisional version of the(n+1)-BDHE problem is defined in the usual manner. (8)input:g,y0,y1,…,yn,yn+2,…,y2n+2,K,ouput:b∈0,1.Let K′=(g,y0,y1,…,yn,yn+2,…,y2n+2); Algorithm B has advantage ε in solving the decisional (n+1)-BDHE problem if (9)Pr⁡BK′,eg,y0αn+1=0-Pr⁡BK′,K=0≥ε.


### 2.4.2. Decisional Linear Assumption

The decisional linear problem [57] is defined as (10)input:g,gz1,gz2,gz1z3,gz2z4,K,ouput:b∈0,1.Algorithm A′s goal is to output 1 when K=gz3+z4 or 0 otherwise. We give three weak versions of the decisional linear problem [35] as follows:(i)
Version (1):(11)input:g,gz1,gz2,gz22,…,gz2n+1,gz2n/z1,gz2n+1/z3,gz4,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.(ii)
Version (2):(12)input:g,gz1,gz2,gz22,…,gz2n,gz2n+2,…,gz22n,gz3,gz4,gz4z2,…,gz2nz4,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.(iii)
Version (3):(13)input:g,gz1,gz2,gz22,…,gz2n,gz2n+2,gz22n,…,gz3,gz4,gz4z2,…,gz2nz4,gz1z2,…,gz2nz1,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.


## 2.4.1. Bilinear Diffie-Hellman Exponent (BDHE) Assumption

Letg be a generator of group G and α,c∈Zp∗. We define the computational (n+1)-BDHE problem [56] to be (6)input:g,y0,y1,…,yn,yn+2,…,y2n+2∈G,output:eg,y0αn+1=eg,gαn+1c,where y0=gc, yi=gαi. Algorithm A has advantage ε in solving the computational (n+1)-BDHE problem if (7)Pr⁡Ag,y0,y1,…,yn,yn+2,…,y2n+2=eg,y0αn+1≥ε.The decisional version of the(n+1)-BDHE problem is defined in the usual manner. (8)input:g,y0,y1,…,yn,yn+2,…,y2n+2,K,ouput:b∈0,1.Let K′=(g,y0,y1,…,yn,yn+2,…,y2n+2); Algorithm B has advantage ε in solving the decisional (n+1)-BDHE problem if (9)Pr⁡BK′,eg,y0αn+1=0-Pr⁡BK′,K=0≥ε.


## 2.4.2. Decisional Linear Assumption

The decisional linear problem [57] is defined as (10)input:g,gz1,gz2,gz1z3,gz2z4,K,ouput:b∈0,1.Algorithm A′s goal is to output 1 when K=gz3+z4 or 0 otherwise. We give three weak versions of the decisional linear problem [35] as follows:(i)
Version (1):(11)input:g,gz1,gz2,gz22,…,gz2n+1,gz2n/z1,gz2n+1/z3,gz4,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.(ii)
Version (2):(12)input:g,gz1,gz2,gz22,…,gz2n,gz2n+2,…,gz22n,gz3,gz4,gz4z2,…,gz2nz4,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.(iii)
Version (3):(13)input:g,gz1,gz2,gz22,…,gz2n,gz2n+2,gz22n,…,gz3,gz4,gz4z2,…,gz2nz4,gz1z2,…,gz2nz1,K,ouput:b∈0,1.AlgorithmA′s goal is to output 1 when K=gz1(z3+z4) or 0 otherwise.


## 3. System Model

### 3.1. Usage Scenario

The hospital uses the system software developed by our proposal, and each member of the hospital is registered in the system at a certain level. The system allocates private keys to them through the key generation algorithm; however, the private key generated may be leaked partly by malicious attackers through various forms of leakage attacks.A patient, named Alice, visits a doctor in this hospital. According to condition, a nurse assigns Alice to the doctor named Bob. Through diagnosis, Bob thinks that Alice needs the doctor named Carol to treat the illness together. And Bob uploads Alice’s EHRs to the cloud server with public key of Carol through the system. Carol uses his private key to download and decrypt Alice’s EHRs. They complete the diagnosis and treatment of Alice.During the entire process, Bob sends Alice’s EHRs to Carol through the cloud, but Carol’s private key may have leaked partly. If the general system is used, Alice’s EHRs may be leaked, but our program can ensure that Alice’s EHRs will not be leaked. Thus, the patient’s EHRs have been protected safely.


### 3.2. System Model

We divide the system model into two parts, and the first part is shown in Figure1, which is to produce the private keys to the different level of users (patients, doctors). The S-Health Authority (SHA) is an entity that produces the public key parameters and the master secret key. In our system, the level is divided into l levels. The private key of users in the first level is defined as the root private key. The private key of the k-th level users is related to the private key of the (k-1)-th level users, where k≤l.Figure 1
The generation of the private keys.The second part is shown in Figure2, which is to share medical information among all users. It is described in the picture where doctor A shares medical information to patient B. A encrypts medical information with B’s public key (identity) and then uploads it to the s-health cloud (SHC). Then B decrypts medical information with its own private key. The adversary A can know part of the private keys information of B through the leak attack.Figure 2
The sharing of medical information.We define an description of the proposed secure s-health system:(i)
Initialization: SHA produces the public key parameters PK and the master secret key MSK. All users can obtain PK.(ii)
User Registration: A user (a patient, a doctor) can join the s-health system by confirming its level to SHA.(iii)
Information Upload: A user encrypts medical information based on a leakage-resilient anonymous HIBE scheme and uploads the final ciphertext to SHC.(iv)
Information Access: A user downloads a ciphertext from SHC. The ciphertext can be decrypted if and only if the private keys correspond to the public key used for encryption.


### 3.3. Leakage-Resilient Security Model for Anonymous HIBE

The security of leakage-resilient anonymous HIBE is defined by the following game (Gamereal) between an adversary A and a challenger C.(i)
Init: The adversary A gives the challenge identity ID∗ to the challenger C.(ii)
Setup: C computes (PK,MSK)←Setup(λ). C gives PK to A and keeps MSK to itself. C will initialize a set S=∅, which will be the set of tuples of identities; private keys have been created and the number of leaked bits corresponds to the private key dID  (ID,dID,LdID). Let l(λ) be a leakage parameter.(iii)
Phase 1: A adaptively issues the following two kinds of queries:
(a)
Private Key Queries: A adaptively queries C with ID where ID≠ID∗ and ID is not a prefix of ID∗; C responds with the private key dID corresponding to the identity ID.(b)
Leak Queries: A gives a polynomial-time leakage function f:{0,1}→{0,1} and adaptively queries C with ID. C finds the tuple (ID,dID,LdID) and replies with f(dID) when LdID+|f(dID)|≤l(λ) or a reject symbol ⊥.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C chooses a random bit b←{0,1} and gives CT=Encrypt(params,ID∗,Mb) to A.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.Definition 3.
We say that an anonymous HIBE scheme is leakage-resilient and selectively secure against chosen plaintext attacks (ANO-IND-sID-CPA) if all polynomial-time adversariesA’s advantage is negligible in the above game. We define A’s advantage to be (14)AdvHIBE,AANO-IND-sID-CPA=Pr⁡b=b′-12.


## 3.1. Usage Scenario

The hospital uses the system software developed by our proposal, and each member of the hospital is registered in the system at a certain level. The system allocates private keys to them through the key generation algorithm; however, the private key generated may be leaked partly by malicious attackers through various forms of leakage attacks.A patient, named Alice, visits a doctor in this hospital. According to condition, a nurse assigns Alice to the doctor named Bob. Through diagnosis, Bob thinks that Alice needs the doctor named Carol to treat the illness together. And Bob uploads Alice’s EHRs to the cloud server with public key of Carol through the system. Carol uses his private key to download and decrypt Alice’s EHRs. They complete the diagnosis and treatment of Alice.During the entire process, Bob sends Alice’s EHRs to Carol through the cloud, but Carol’s private key may have leaked partly. If the general system is used, Alice’s EHRs may be leaked, but our program can ensure that Alice’s EHRs will not be leaked. Thus, the patient’s EHRs have been protected safely.


## 3.2. System Model

We divide the system model into two parts, and the first part is shown in Figure1, which is to produce the private keys to the different level of users (patients, doctors). The S-Health Authority (SHA) is an entity that produces the public key parameters and the master secret key. In our system, the level is divided into l levels. The private key of users in the first level is defined as the root private key. The private key of the k-th level users is related to the private key of the (k-1)-th level users, where k≤l.Figure 1
The generation of the private keys.The second part is shown in Figure2, which is to share medical information among all users. It is described in the picture where doctor A shares medical information to patient B. A encrypts medical information with B’s public key (identity) and then uploads it to the s-health cloud (SHC). Then B decrypts medical information with its own private key. The adversary A can know part of the private keys information of B through the leak attack.Figure 2
The sharing of medical information.We define an description of the proposed secure s-health system:(i)
Initialization: SHA produces the public key parameters PK and the master secret key MSK. All users can obtain PK.(ii)
User Registration: A user (a patient, a doctor) can join the s-health system by confirming its level to SHA.(iii)
Information Upload: A user encrypts medical information based on a leakage-resilient anonymous HIBE scheme and uploads the final ciphertext to SHC.(iv)
Information Access: A user downloads a ciphertext from SHC. The ciphertext can be decrypted if and only if the private keys correspond to the public key used for encryption.


## 3.3. Leakage-Resilient Security Model for Anonymous HIBE

The security of leakage-resilient anonymous HIBE is defined by the following game (Gamereal) between an adversary A and a challenger C.(i)
Init: The adversary A gives the challenge identity ID∗ to the challenger C.(ii)
Setup: C computes (PK,MSK)←Setup(λ). C gives PK to A and keeps MSK to itself. C will initialize a set S=∅, which will be the set of tuples of identities; private keys have been created and the number of leaked bits corresponds to the private key dID  (ID,dID,LdID). Let l(λ) be a leakage parameter.(iii)
Phase 1: A adaptively issues the following two kinds of queries:
(a)
Private Key Queries: A adaptively queries C with ID where ID≠ID∗ and ID is not a prefix of ID∗; C responds with the private key dID corresponding to the identity ID.(b)
Leak Queries: A gives a polynomial-time leakage function f:{0,1}→{0,1} and adaptively queries C with ID. C finds the tuple (ID,dID,LdID) and replies with f(dID) when LdID+|f(dID)|≤l(λ) or a reject symbol ⊥.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C chooses a random bit b←{0,1} and gives CT=Encrypt(params,ID∗,Mb) to A.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.Definition 3.
We say that an anonymous HIBE scheme is leakage-resilient and selectively secure against chosen plaintext attacks (ANO-IND-sID-CPA) if all polynomial-time adversariesA’s advantage is negligible in the above game. We define A’s advantage to be (14)AdvHIBE,AANO-IND-sID-CPA=Pr⁡b=b′-12.


## 4. Secure s-Health System

### 4.1. A Leakage-Resilient Anonymous HIBE Scheme

For an HIBE of maximum depthl and an identity IDj=(v1,···,vj) where 1≤j≤l, a leakage-resilient anonymous HIBE scheme is defined as follows:(i)
Setup(λ)→(PK,MSK): TheSetup algorithm takes a security parameter λ and produces the public key parameters PK and the master secret key MSK. All users can obtain PK.(ii)
KenGen(PK,IDj,dID∣j-1)→dID∣j: TheKenGen algorithm takes as input the public key PK, an identity IDj=(v1,…,vj), and the private key dID∣j-1 corresponding to the identity (v1,…,vj-1). It outputs the private key dID∣j.(iii)
Encrypt(PK,IDj,M)→CT: TheEncrypt algorithm takes as input the public key PK, an identity IDj=(v1,…,vj), and a message M. It outputs a ciphertext CT.(iv)
Decrypt(PK,dID∣j,CT)→M: TheDecrypt algorithm takes as input the public key PK, a ciphertext CT, and the private key dID∣j corresponding to the identity IDj=(v1,…,vj). It outputs the message M or a reject symbol ⊥ if the ciphertext is invalid.


### 4.2. Description of Secure s-Health System

Letp be a large prime number and G be a group of order p. Let l be the HIBE of maximum depth and represent identity information as bit strings of length n [58].(i)
Initialization: SHA randomly chooses α,t1,t2,t3∈Zp. Set v=gt1, g1=vα, u=gt2, x=gt3, and then pick g2,w in group G at random. The public key parameters are (15)PK=g,g1,g2,v,u,x,w.The master secret key isMSK=g2α.(ii)
User Registration: The user joins the s-health system and gets its private keys. The user initiates the following key generation protocol.KeyGen: TheKeyGen algorithm is defined as follows.
(a)
Root private keys: For the first level user ID1=(v1) where v1=(v11,…,v1n) and v1i∈{0,1}, root PKG randomly chooses {α11,…,α1n,β11,…,β1n}∈Zp and produces the auxiliary parameters (16)h1i=h1i-1α1iv1iβ1i1-v1i,whereh10=g, 1≤i≤n, and h1n is outputted as the public key. Root PKG outputs the private key for ID1 as (17)dID1=d10,d11,d12,d13,d14,d15=g2αh1nr1,gr1,vr1,wr1,ur1t1,xr1t1and(18)DID1=D10,D11,D12,D13,D14,D15=h1nr2,gr2,vr2,wr2,ur2t1,xr2t1,wherer1,r2∈Zp and DID1 are used to rerandomize the private keys.(b)
Delegate: For the k-th level user IDk=(v1,…,vk) where k≤l, vi=(vi1,…,vin) and vij∈{0,1}, by using the private key dID∣k-1 corresponding to the (k-1)-th level user IDk-1=(v1,…,vk-1):(19)dIDk-1=dk-10,dk-11,dk-12,dk-13,dk-14,dk-15=g2α∏i=1k-1hinr1′,gr1′,vr1′,wr1′,ur1′t1,xr1′t1and(20)DIDk-1=Dk-10,Dk-11,Dk-12,Dk-13,Dk-14,Dk-15=∏i=1k-1hinr2′,gr2′,vr2′,wr2′,ur2′t1,xr2′t1.PKGk randomly chooses (21)αk1,…,αkn,βk1,…,βkn∈Zp,and it produces the auxiliary parameters(22)hkj′=hkj-1′αkjvkjβkj1-vkj=gr1′∏j=1nαkjvkjβkj1-vkj,hkj′′=hkj-1′′αkjvkjβkj1-vkj=gr2′∏j=1nαkjvkjβkj1-vkj,wherehk0′=d(k-1)1,hk0′′=D(k-1)1 and 1≤j≤n.Lethkn=g∏j=1n‍αkjvkjβkj1-vkj; then one can obtain hkn′=hknr1′ and hkn′′=hknr2′. PKGk outputs the private key for IDk as (23)dIDk=dk0,dk1,dk2,dk3,dk4,dk5=dk-10hkn′Dk-10hkn′′r′,dk-11Dk-11r′,dk-12Dk-12r′,dk-13Dk-13r′,dk-14Dk-14r′,dk-15Dk-15r′=g2α∏i=1khinr1,gr1,vr1,wr1,ur1t1,xr1t1and(24)DIDk=Dk0,Dk1,Dk2,Dk3,Dk4,Dk5=Dk-10hkn′′r′,Dk-11r′,Dk-12r′,Dk-13r′,Dk-14r′,Dk-15r′=∏i=1khinr2,gr2,vr2,wr2,ur2t1,xr2t1,wherer1=r1′+r′r2′,r2=r′r2′,r′∈Zp∗.(iii)
Information Upload: A user encrypts medical information based on a leakage-resilient anonymous HIBE scheme as follows.Encrypt: The encryptor randomly chooses s1,s2∈Zp and a random seed s∈0,1t. The encryptor creates the ciphertext as follows: (25)CT=C0,C1,C2,C3,C4,C5=M⊕Exteg1,g2s1,s,∏i=1khins1us2,ws1xs2,gs2,vs1,s.(iv)
Information Access: A user downloads and decrypts a ciphertext from SHC as follows.Decrypt: The k-th level user decrypts a ciphertext CT using the private key dID∣k and computes (26)M=Extedk0,C4edk4dk5,C3edk3,C4eC1,dk2eC2,dk2,C5⊕C0.


### 4.3. Correctness

The correctness can be checked:(27)edk0,C4edk4dk5,C3edk3,C4eC1,dk2eC2,dk2=eg2α∏i=1khinr1,vs1euxr1t1,gs2ewr1,vs1e∏i=1khins1us2,vr1ews1xs2,vr1=eg1,g2s1.


## 4.1. A Leakage-Resilient Anonymous HIBE Scheme

For an HIBE of maximum depthl and an identity IDj=(v1,···,vj) where 1≤j≤l, a leakage-resilient anonymous HIBE scheme is defined as follows:(i)
Setup(λ)→(PK,MSK): TheSetup algorithm takes a security parameter λ and produces the public key parameters PK and the master secret key MSK. All users can obtain PK.(ii)
KenGen(PK,IDj,dID∣j-1)→dID∣j: TheKenGen algorithm takes as input the public key PK, an identity IDj=(v1,…,vj), and the private key dID∣j-1 corresponding to the identity (v1,…,vj-1). It outputs the private key dID∣j.(iii)
Encrypt(PK,IDj,M)→CT: TheEncrypt algorithm takes as input the public key PK, an identity IDj=(v1,…,vj), and a message M. It outputs a ciphertext CT.(iv)
Decrypt(PK,dID∣j,CT)→M: TheDecrypt algorithm takes as input the public key PK, a ciphertext CT, and the private key dID∣j corresponding to the identity IDj=(v1,…,vj). It outputs the message M or a reject symbol ⊥ if the ciphertext is invalid.


## 4.2. Description of Secure s-Health System

Letp be a large prime number and G be a group of order p. Let l be the HIBE of maximum depth and represent identity information as bit strings of length n [58].(i)
Initialization: SHA randomly chooses α,t1,t2,t3∈Zp. Set v=gt1, g1=vα, u=gt2, x=gt3, and then pick g2,w in group G at random. The public key parameters are (15)PK=g,g1,g2,v,u,x,w.The master secret key isMSK=g2α.(ii)
User Registration: The user joins the s-health system and gets its private keys. The user initiates the following key generation protocol.KeyGen: TheKeyGen algorithm is defined as follows.
(a)
Root private keys: For the first level user ID1=(v1) where v1=(v11,…,v1n) and v1i∈{0,1}, root PKG randomly chooses {α11,…,α1n,β11,…,β1n}∈Zp and produces the auxiliary parameters (16)h1i=h1i-1α1iv1iβ1i1-v1i,whereh10=g, 1≤i≤n, and h1n is outputted as the public key. Root PKG outputs the private key for ID1 as (17)dID1=d10,d11,d12,d13,d14,d15=g2αh1nr1,gr1,vr1,wr1,ur1t1,xr1t1and(18)DID1=D10,D11,D12,D13,D14,D15=h1nr2,gr2,vr2,wr2,ur2t1,xr2t1,wherer1,r2∈Zp and DID1 are used to rerandomize the private keys.(b)
Delegate: For the k-th level user IDk=(v1,…,vk) where k≤l, vi=(vi1,…,vin) and vij∈{0,1}, by using the private key dID∣k-1 corresponding to the (k-1)-th level user IDk-1=(v1,…,vk-1):(19)dIDk-1=dk-10,dk-11,dk-12,dk-13,dk-14,dk-15=g2α∏i=1k-1hinr1′,gr1′,vr1′,wr1′,ur1′t1,xr1′t1and(20)DIDk-1=Dk-10,Dk-11,Dk-12,Dk-13,Dk-14,Dk-15=∏i=1k-1hinr2′,gr2′,vr2′,wr2′,ur2′t1,xr2′t1.PKGk randomly chooses (21)αk1,…,αkn,βk1,…,βkn∈Zp,and it produces the auxiliary parameters(22)hkj′=hkj-1′αkjvkjβkj1-vkj=gr1′∏j=1nαkjvkjβkj1-vkj,hkj′′=hkj-1′′αkjvkjβkj1-vkj=gr2′∏j=1nαkjvkjβkj1-vkj,wherehk0′=d(k-1)1,hk0′′=D(k-1)1 and 1≤j≤n.Lethkn=g∏j=1n‍αkjvkjβkj1-vkj; then one can obtain hkn′=hknr1′ and hkn′′=hknr2′. PKGk outputs the private key for IDk as (23)dIDk=dk0,dk1,dk2,dk3,dk4,dk5=dk-10hkn′Dk-10hkn′′r′,dk-11Dk-11r′,dk-12Dk-12r′,dk-13Dk-13r′,dk-14Dk-14r′,dk-15Dk-15r′=g2α∏i=1khinr1,gr1,vr1,wr1,ur1t1,xr1t1and(24)DIDk=Dk0,Dk1,Dk2,Dk3,Dk4,Dk5=Dk-10hkn′′r′,Dk-11r′,Dk-12r′,Dk-13r′,Dk-14r′,Dk-15r′=∏i=1khinr2,gr2,vr2,wr2,ur2t1,xr2t1,wherer1=r1′+r′r2′,r2=r′r2′,r′∈Zp∗.(iii)
Information Upload: A user encrypts medical information based on a leakage-resilient anonymous HIBE scheme as follows.Encrypt: The encryptor randomly chooses s1,s2∈Zp and a random seed s∈0,1t. The encryptor creates the ciphertext as follows: (25)CT=C0,C1,C2,C3,C4,C5=M⊕Exteg1,g2s1,s,∏i=1khins1us2,ws1xs2,gs2,vs1,s.(iv)
Information Access: A user downloads and decrypts a ciphertext from SHC as follows.Decrypt: The k-th level user decrypts a ciphertext CT using the private key dID∣k and computes (26)M=Extedk0,C4edk4dk5,C3edk3,C4eC1,dk2eC2,dk2,C5⊕C0.


## 4.3. Correctness

The correctness can be checked:(27)edk0,C4edk4dk5,C3edk3,C4eC1,dk2eC2,dk2=eg2α∏i=1khinr1,vs1euxr1t1,gs2ewr1,vs1e∏i=1khins1us2,vr1ews1xs2,vr1=eg1,g2s1.


## 5. Analysis

### 5.1. Security Analysis

Following [59], the security proof can be completed by a series of hybrid games. Let (C0,C1,C2,C3,C4,C5) denote the challenge ciphertext given to the adversary during a  Gamereal. We define the hybrid games to be(1)
Game 1: C=(C0,C1,C2,C3,C4,C5);(2)
Game 2: C=(R0,C1,C2,C3,C4,C5);(3)
Game 3: C=(R0,R1,C2,C3,C4,C5);(4)
Game 4: C=(R0,R1,R2,C3,C4,C5),whereR0∈GT and R1,R2∈G.We will show these games are indistinguishable in the following lemmas.Lemma 4.
Suppose the decision(n+1)-BDHE assumption holds, there is no polynomial-time adversary that can distinguish Game 1 and Game 2.Proof.
The proof follows from the security of the Boneh-Boyen selective-ID scheme [60] and Abdalla’s security analysis [58]. Suppose there is adversary A that can distinguish between Game 1 and Game 2 with advantage ε. Then challenge C will be made to solve the decision (n+1)-BDHE assumption.
C receives a challenge tuple (g,y0,y1,···,yn,yn+2,···,y2n+2,K) where y0=gc, yi=gαi, and K is either eg,gαn+1c or a random element of GT. C interacts with A as follows:(i)
Init: The adversary A gives the challenge identity ID∗=(v1∗,…,vk∗) to the challenger C where k≤l.(ii)
Setup: C randomly chooses t,t1,t2,t3,γ,αij,βij∈Zp∗, where 1≤i≤l, 1≤j≤n. It sets (28)v=gt1,g1=y1t1,u=gt2,x=gt3,w=gt,g2=yngγ.The public key parameters arePK={g,g1,g2,v,u,x,w}. The master secret key is MSK=g2α=y1γyn+1, which is unknown to C.(iii)
Phase 1: A adaptively queries C with ID=(v1,…,vk) where ID≠ID∗ and ID is not a prefix of ID∗. This condition ensures that there is j∈{1,…,k} such that vj≠vj∗. C produces the private key corresponding to the identity IDj=(v1,…,vj), where j denotes the first element such that vj≠vj∗. Let τ be the number of sites such that vji=vji∗ in vj. To respond to the query, C produces the auxiliary parameters as follows. For 1≤i≤j, compute(29)hi1=gαi1vi1βi11-vi1ifvi1≠vi1∗,hi1=y1αi1vi1βi11-vi1ifvi1=vi1∗.hi2=hi1αi2vi2βi21-vi2ifvi2≠vi2∗,hi2=y1αi2vi2βi21-vi2ifvi2=vi2∗∧vi1≠vi1∗,hi2=y2αi2vi2βi21-vi2ifvi2=vi2∗∧vi1=vi1∗.Finally, the auxiliary parameters can be computed as follows.(30)h1n=ynTv1,…,hj-1n=ynTvj-1,hjn=yτTvj,whereT(vi)=∏j=1n‍αijvijβij1-vij,for1≤i≤j,τ≤n.C randomly chooses r1′∈Zp and sets r1=r1′-αn-τ+1/T(vj). The private keys corresponding to the identity IDj are simulated as follows. (31)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′,dj1=gr1′yn-τ+1-1/Tvj,dj2=gr1′t1yn-τ+1-t1/Tvj,dj3=gr1′tyn-τ+1-t/Tvj,dj4=gr1′t1t2yn-τ+1-t1t2/Tvj,dj5=gr1′t1t3yn-τ+1-t1t3/Tvj.In fact,(32)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′=yn+1y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yτTvj-αn-τ+1/Tvj=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′-αn-τ+1/Tvj=g2α∏i=1j-1ynTvir1′-αn-τ+1/Tvj×yτTvjr1′-αn-τ+1/Tvj=g2α∏i=1jhinr1′-αn-τ+1/Tvj=g2α∏i=1jhinr1.In addition,(33)dj1=gr1′yn-τ+1-1/Tvj=gr1,dj2=gr1′t1yn-τ+1-t1/Tvj=vr1,dj3=gr1′tyn-τ+1-t/Tvj=vr1=wr1,dj4=gr1′t1t2yn-τ+1-t1t2/Tvj=ur1t1,dj5=gr1′t1t3yn-τ+1-t1t3/Tvj=xr1t1.Then we can obtain(34)dIDj=dj0,dj1,dj2,dj3,dj4,dj5=g2α∏i=1jhinr1,gr1,vr1,wr1,ur1t1,xr1t1.C also produces DIDj. C uses dIDj to derive a private key for the descendant identity IDk and gives A the result.Then,A submits the leak queries to C.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C first produces the auxiliary parameters as hin=gTi∗ for challenge identity ID∗, where Ti∗=T(vi∗). C then randomly chooses s1,s2∈Zp and a random seed s∈0,1t and responds to the ciphertexts as(35)CT∗=C0∗,C1∗,C2∗,C3∗,C4∗,C5∗=Mb⊕ExtKt1ey1γ,y0t1,s,y0∑i=1kTi∗gs2t2,y0tgs2t3,gs2,y0t1,s,whereb∈{0,1}.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that the A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.
From the above game, we can see that ifT=eg,gαn+1c, C is playing Game 1. The challenge ciphertexts are valid encryption to Mb. In fact, let c=s1. Then one can obtain (36)C0∗=Mb⊕ExtKt1ey1γ,y0t1,s=Mb⊕Exteg,gαn+1ct1ey1γ,y0t1,s=Mb⊕Extegαn,gαct1ey1γ,y0t1,s=Mb⊕Exteyn,y1t1cegγ,y1t1c,s=Mb⊕Exteyngγ,y1t1c,s=Mb⊕Exteg1,g2c,s=Mb⊕Exteg1,g2s1,s,C1∗=y0∑i=1kTi∗gs2t2=∏i=1khincus2=∏i=1khins1us2,C2∗=y0tgs2t3=wcxs2=ws1xs2,C3∗=gs2,C4∗=y0t1=vc=vs1,C5∗=s.Otherwise, K is a random element in GT; C is playing Game 2. Thus, Game 1 and Game 2 are computationally indistinguishable.Lemma 5.
Suppose the decisional linear assumption holds. ThenGame 2 and Game 3 are indistinguishable.Proof.
Suppose there is adversaryA that can distinguish betweenGame 2 andGame 3 with advantage ε. Then a challenge C will be made to solve the decision linear problem.
C receives a challenge tuple (37)g,gz1,gz2,gz22,…,gz2n,gz2n+2,…,gz22n,gz3,gz4,gz4z2,…,gz2nz4,K,K is either gz1(z3+z4) or a random element of G. C interacts with A as follows:(i)
Init: The adversary A gives the challenge identity ID∗=(v1∗,…,vk∗) to the challenger C where k≤l.(ii)
Setup: C randomly chooses t,t1,t3,γ,αij,βij∈Zp∗ where 1≤i≤l, 1≤j≤n. It sets (38)v=gt1,g1=gt1z2,u=gz4∑ki=1Ti∗,w=gt,x=gt3,g2=gz2ngγ,whereTi∗=T(vi∗). The public key parameters are PK={g,g1,g2,v,u,w,x}. The master secret key is MSK=g2z2=y1γgz2n+1 which is unknown to C, where yi=gz2i.(iii)
Phase 1: A adaptively queries C with ID=(v1,…,vk) where ID≠ID∗ and ID is not a prefix of ID∗. This condition ensures that there is j∈{1,…,k} such that vj≠vj∗. C produces the private key corresponding to the identity IDj=(v1,…,vj) where j denotes the first element such that vj≠vj∗. Let τ be the number of sites such that vji=vji∗ in vj. To respond to the query, C produces the auxiliary parameters as follows. For 1≤i≤j, (39)hi1=gαi1vi1βi11-vi1ifvi1≠vi1∗,hi1=gz2αi1vi1βi11-vi1ifvi1=vi1∗.hi2=hi1αi2vi2βi21-vi2ifvi2≠vi2∗,hi2=gz2αi2vi2βi21-vi2ifvi2=vi2∗∩vi1≠vi1∗,hi2=gz22αi2vi2βi21-vi2ifvi2=vi2∗∩vi1=vi1∗.Finally, the auxiliary information parameters can be computed as follows.(40)h1n=ynTv1,…,hj-1n=ynTvj-1,hjn=yτTvj,where(41)Tvi=∏j=1nαijvijβij1-vij,yi=gz2i,1≤i≤j,τ≤n.C randomly chooses r1′∈Zp and sets r1=r1′-z2n-τ+1/T(vj). The private keys corresponding to the identity IDj are simulated as follows. (42)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′,dj1=gr1′yn-τ+1-1/Tvj,dj2=gr1′t1yn-τ+1-t1/Tvj,dj3=gr1′tyn-τ+1-t/Tvj,dj4=ur1′t1yn-τ+1-t1z4∑i=1kTi∗/Tvj,dj5=xr1′t1yn-τ+1-t1t3/Tvj.In fact,(43)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′=yn+1y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2z2∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yτTvj-z2n-τ+1/Tvj=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′-z2n-τ+1/Tvj=g2α∏i=1j-1ynTvir1′-z2n-τ+1/Tvj×yτTvjr1′-z2n-τ+1/Tvj=g2α∏i=1jhinr1′-z2n-τ+1/Tvj=g2α∏i=1jhinr1.In addition,(44)dj1=gr1′yn-τ+1-1/Tvj=gr1,dj2=gr1′t1yn-τ+1-t1/Tvj=vr1,dj3=gr1′tyn-τ+1-t/Tvj=vr1=wr1,dj4=ur1′t1yn-τ+1-t1z4∑i=1kTi∗/Tvj=ur1t1,dj5=xr1′t1yn-τ+1-t1t3/Tvj=xr1t1.Then we can obtain(45)dIDj=dj0,dj1,dj2,dj3,dj4,dj5=g2α∏i=1jhinr1,gr1,vr1,wr1,ur1t1,xr1t1.C also produces DIDj. C uses dIDj to derive a private key for the descendant identity IDk and gives A the result.Then,A submits the leak queries to C.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C first produces the auxiliary parameters as hin=gz1Ti∗ for challenge identity ID∗, where Ti∗=T(vi∗). C then randomly chooses R0∈GT and a random seed s∈0,1t and responds to the ciphertexts as(46)CT∗=C0∗,C1∗,C2∗,C3∗,C4∗,C5∗=R0,K∑i=1nTi∗,gz3tgz1z3,gz1,gt1z3,s.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.
From the above game, we can see that ifK=gz1(z3+z4), C is playingGame 2. In fact, let z3=s1,z1=s2. Then one can obtain (47)C1∗=K∑i=1nTi∗=gz1z3+z4∑i=1nTi∗=gz1∑i=1nTi∗z3gz4∑i=1kTi∗z1=∏i=1khins1us2,C2∗=gz3tgz1z3=ws1xs2,C3∗=gz1=gs2,C4∗=gt1z3=vs1,C5∗=s.
Otherwise,K is a random element in G, and C is playingGame 3. Thus,Game 2 andGame 3 are computationally indistinguishable.Lemma 6.
Suppose the decisional linear assumption holds. ThenGame 3 andGame 4 are indistinguishable.Proof.
This proof is similar to Lemma5. C receives a challenge tuple (48)g,gz1,gz2,gz22,…,gz2n,gz2n+2,…,gz22n,gz3,gz4,gz4z2,…,gz2nz4,gz1z2,…,gz2nz1,K,K is either gz1(z3+z4) or a random element of G. C interacts with A as follows:(i)
Init: adversary A gives the challenge identity ID∗=(v1∗,…,vk∗) to the challenger C where k≤l.(ii)
Setup: C randomly chooses t,t1,t2,γ,αij,βij∈Zp∗ where 1≤i≤l, 1≤j≤n. It sets (49)v=gt1,g1=gt1z2,u=gt2,w=gtz1,x=gtz4,g2=gz2ngγ.The public key parameters arePK={g,g1,g2,v,u,w,x}. The master secret key is MSK=g2z2=y1γgz2n+1 which is unknown to C, where yi=gz2i.(iii)
Phase 1: this section is similar to Lemma 5.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C randomly chooses R0∈GT, R1∈G, and a random seed s∈0,1t and responds to the ciphertexts as (50)CT∗=C0∗,C1∗,C2∗,C3∗,C4∗,C5∗=R0,R1,Kt,gz1,gt1z3,s.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.
From the above game, we can see that ifK=gz1(z3+z4), C is playingGame 3. In fact, let z3=s1,z1=s2. Then one can obtain (51)C2∗=Kt=gz1z3+z4t=gtz1z3gtz1z4=ws1xs2,C3∗=gz1=gs2,C4∗=gt1z3=vs1,C5∗=s.Otherwise, K is a random element in G, and C is playingGame 4. Thus,Game 3 andGame 4 are computationally indistinguishable.Theorem 7.
If the decision(n+1)-BDHE assumption and the decisional linear assumption hold, then our anonymous HIBE scheme is l(λ)-leakage resilience secure.


### 5.2. Leakage Resilience Analysis

LetV be used to represent a view that adversary A sees without leakage, we have H~∞A∣V=log⁡p. From the above leakage-resilient security model, one can know that, for the challenge identity ID∗, the adversary can get the most l(λ) leak information when doing leak queries. We set l(λ) as ξ bit; in other words, l(λ) has 2ξ values. From Lemma 2, one can obtain (52)H~∞A∣lλ,V≥H~∞A∣V-ξ=log⁡p-ξ.Therefore, as long as the extractor’s strength is (log⁡p-ξ,ε), one can obtain (53)SDExteg1,g2s1,s,s,lλ,V,U,s,lλ,V≤ε,where U is uniform distribution and s∈0,1t. The premise is that extractor performance is good enough; one can obtain ξ≈log⁡p. Hence the distance between C0=Mb⊕Exteg1,g2s1,s and uniform distribution is ε and the statistical distance between two ciphertexts is at most 2ε. Therefore, no PPT adversary can distinguish the two challenge ciphertexts with the advantage of more than 2ε. The leakage ratio of our scheme is (54)ρ=lλ6log⁡p=ξ6log⁡p≈log⁡p6log⁡p=16.We compare our work with schemes [24, 35, 54] in Table 2, where pk.size, sk.size, c.size, and LR mean the public key size, the secret key size, the ciphertext size, and leakage-resilience, respectively. We define l as the maximum depth of HIBE, k represents the user identity depth, and the symbol “-” represents the fact that the corresponding scheme does not have this feature. It is noted that our scheme supports anonymity and leakage-resilience where both private keys and ciphertext have a constant size.Table 2
Comparisons of different schemes.
Scheme p k . s i z e s k . s i z e c . s i z e Anonymity LR [35] O ( l ) O ( l ) O ( 1 ) ✓ - [24] O ( 1 ) O ( 1 ) O ( 1 ) ✓ - [55] O ( 1 ) O ( 1 ) O ( 1 ) - ✓ Ours O ( 1 ) O ( 1 ) O ( 1 ) ✓ ✓Our scheme has no obvious advantage in computational efficiency, but the public key length and private key length of our HIBE scheme are both inO(1) time. However, we mainly solve the problem of key leakage in the acceptable range between computational efficiency and security balance.


## 5.1. Security Analysis

Following [59], the security proof can be completed by a series of hybrid games. Let (C0,C1,C2,C3,C4,C5) denote the challenge ciphertext given to the adversary during a  Gamereal. We define the hybrid games to be(1)
Game 1: C=(C0,C1,C2,C3,C4,C5);(2)
Game 2: C=(R0,C1,C2,C3,C4,C5);(3)
Game 3: C=(R0,R1,C2,C3,C4,C5);(4)
Game 4: C=(R0,R1,R2,C3,C4,C5),whereR0∈GT and R1,R2∈G.We will show these games are indistinguishable in the following lemmas.Lemma 4.
Suppose the decision(n+1)-BDHE assumption holds, there is no polynomial-time adversary that can distinguish Game 1 and Game 2.Proof.
The proof follows from the security of the Boneh-Boyen selective-ID scheme [60] and Abdalla’s security analysis [58]. Suppose there is adversary A that can distinguish between Game 1 and Game 2 with advantage ε. Then challenge C will be made to solve the decision (n+1)-BDHE assumption.
C receives a challenge tuple (g,y0,y1,···,yn,yn+2,···,y2n+2,K) where y0=gc, yi=gαi, and K is either eg,gαn+1c or a random element of GT. C interacts with A as follows:(i)
Init: The adversary A gives the challenge identity ID∗=(v1∗,…,vk∗) to the challenger C where k≤l.(ii)
Setup: C randomly chooses t,t1,t2,t3,γ,αij,βij∈Zp∗, where 1≤i≤l, 1≤j≤n. It sets (28)v=gt1,g1=y1t1,u=gt2,x=gt3,w=gt,g2=yngγ.The public key parameters arePK={g,g1,g2,v,u,x,w}. The master secret key is MSK=g2α=y1γyn+1, which is unknown to C.(iii)
Phase 1: A adaptively queries C with ID=(v1,…,vk) where ID≠ID∗ and ID is not a prefix of ID∗. This condition ensures that there is j∈{1,…,k} such that vj≠vj∗. C produces the private key corresponding to the identity IDj=(v1,…,vj), where j denotes the first element such that vj≠vj∗. Let τ be the number of sites such that vji=vji∗ in vj. To respond to the query, C produces the auxiliary parameters as follows. For 1≤i≤j, compute(29)hi1=gαi1vi1βi11-vi1ifvi1≠vi1∗,hi1=y1αi1vi1βi11-vi1ifvi1=vi1∗.hi2=hi1αi2vi2βi21-vi2ifvi2≠vi2∗,hi2=y1αi2vi2βi21-vi2ifvi2=vi2∗∧vi1≠vi1∗,hi2=y2αi2vi2βi21-vi2ifvi2=vi2∗∧vi1=vi1∗.Finally, the auxiliary parameters can be computed as follows.(30)h1n=ynTv1,…,hj-1n=ynTvj-1,hjn=yτTvj,whereT(vi)=∏j=1n‍αijvijβij1-vij,for1≤i≤j,τ≤n.C randomly chooses r1′∈Zp and sets r1=r1′-αn-τ+1/T(vj). The private keys corresponding to the identity IDj are simulated as follows. (31)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′,dj1=gr1′yn-τ+1-1/Tvj,dj2=gr1′t1yn-τ+1-t1/Tvj,dj3=gr1′tyn-τ+1-t/Tvj,dj4=gr1′t1t2yn-τ+1-t1t2/Tvj,dj5=gr1′t1t3yn-τ+1-t1t3/Tvj.In fact,(32)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′=yn+1y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yτTvj-αn-τ+1/Tvj=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′-αn-τ+1/Tvj=g2α∏i=1j-1ynTvir1′-αn-τ+1/Tvj×yτTvjr1′-αn-τ+1/Tvj=g2α∏i=1jhinr1′-αn-τ+1/Tvj=g2α∏i=1jhinr1.In addition,(33)dj1=gr1′yn-τ+1-1/Tvj=gr1,dj2=gr1′t1yn-τ+1-t1/Tvj=vr1,dj3=gr1′tyn-τ+1-t/Tvj=vr1=wr1,dj4=gr1′t1t2yn-τ+1-t1t2/Tvj=ur1t1,dj5=gr1′t1t3yn-τ+1-t1t3/Tvj=xr1t1.Then we can obtain(34)dIDj=dj0,dj1,dj2,dj3,dj4,dj5=g2α∏i=1jhinr1,gr1,vr1,wr1,ur1t1,xr1t1.C also produces DIDj. C uses dIDj to derive a private key for the descendant identity IDk and gives A the result.Then,A submits the leak queries to C.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C first produces the auxiliary parameters as hin=gTi∗ for challenge identity ID∗, where Ti∗=T(vi∗). C then randomly chooses s1,s2∈Zp and a random seed s∈0,1t and responds to the ciphertexts as(35)CT∗=C0∗,C1∗,C2∗,C3∗,C4∗,C5∗=Mb⊕ExtKt1ey1γ,y0t1,s,y0∑i=1kTi∗gs2t2,y0tgs2t3,gs2,y0t1,s,whereb∈{0,1}.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that the A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.
From the above game, we can see that ifT=eg,gαn+1c, C is playing Game 1. The challenge ciphertexts are valid encryption to Mb. In fact, let c=s1. Then one can obtain (36)C0∗=Mb⊕ExtKt1ey1γ,y0t1,s=Mb⊕Exteg,gαn+1ct1ey1γ,y0t1,s=Mb⊕Extegαn,gαct1ey1γ,y0t1,s=Mb⊕Exteyn,y1t1cegγ,y1t1c,s=Mb⊕Exteyngγ,y1t1c,s=Mb⊕Exteg1,g2c,s=Mb⊕Exteg1,g2s1,s,C1∗=y0∑i=1kTi∗gs2t2=∏i=1khincus2=∏i=1khins1us2,C2∗=y0tgs2t3=wcxs2=ws1xs2,C3∗=gs2,C4∗=y0t1=vc=vs1,C5∗=s.Otherwise, K is a random element in GT; C is playing Game 2. Thus, Game 1 and Game 2 are computationally indistinguishable.Lemma 5.
Suppose the decisional linear assumption holds. ThenGame 2 and Game 3 are indistinguishable.Proof.
Suppose there is adversaryA that can distinguish betweenGame 2 andGame 3 with advantage ε. Then a challenge C will be made to solve the decision linear problem.
C receives a challenge tuple (37)g,gz1,gz2,gz22,…,gz2n,gz2n+2,…,gz22n,gz3,gz4,gz4z2,…,gz2nz4,K,K is either gz1(z3+z4) or a random element of G. C interacts with A as follows:(i)
Init: The adversary A gives the challenge identity ID∗=(v1∗,…,vk∗) to the challenger C where k≤l.(ii)
Setup: C randomly chooses t,t1,t3,γ,αij,βij∈Zp∗ where 1≤i≤l, 1≤j≤n. It sets (38)v=gt1,g1=gt1z2,u=gz4∑ki=1Ti∗,w=gt,x=gt3,g2=gz2ngγ,whereTi∗=T(vi∗). The public key parameters are PK={g,g1,g2,v,u,w,x}. The master secret key is MSK=g2z2=y1γgz2n+1 which is unknown to C, where yi=gz2i.(iii)
Phase 1: A adaptively queries C with ID=(v1,…,vk) where ID≠ID∗ and ID is not a prefix of ID∗. This condition ensures that there is j∈{1,…,k} such that vj≠vj∗. C produces the private key corresponding to the identity IDj=(v1,…,vj) where j denotes the first element such that vj≠vj∗. Let τ be the number of sites such that vji=vji∗ in vj. To respond to the query, C produces the auxiliary parameters as follows. For 1≤i≤j, (39)hi1=gαi1vi1βi11-vi1ifvi1≠vi1∗,hi1=gz2αi1vi1βi11-vi1ifvi1=vi1∗.hi2=hi1αi2vi2βi21-vi2ifvi2≠vi2∗,hi2=gz2αi2vi2βi21-vi2ifvi2=vi2∗∩vi1≠vi1∗,hi2=gz22αi2vi2βi21-vi2ifvi2=vi2∗∩vi1=vi1∗.Finally, the auxiliary information parameters can be computed as follows.(40)h1n=ynTv1,…,hj-1n=ynTvj-1,hjn=yτTvj,where(41)Tvi=∏j=1nαijvijβij1-vij,yi=gz2i,1≤i≤j,τ≤n.C randomly chooses r1′∈Zp and sets r1=r1′-z2n-τ+1/T(vj). The private keys corresponding to the identity IDj are simulated as follows. (42)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′,dj1=gr1′yn-τ+1-1/Tvj,dj2=gr1′t1yn-τ+1-t1/Tvj,dj3=gr1′tyn-τ+1-t/Tvj,dj4=ur1′t1yn-τ+1-t1z4∑i=1kTi∗/Tvj,dj5=xr1′t1yn-τ+1-t1t3/Tvj.In fact,(43)dj0=y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/TvjyτTvjr1′=yn+1y1γ∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2z2∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yn+1-1=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′yτTvj-z2n-τ+1/Tvj=g2α∏i=1j-1ynTvir1′∏i=1j-1y2n-τ+1-Tvi/Tvj·yτTvjr1′-z2n-τ+1/Tvj=g2α∏i=1j-1ynTvir1′-z2n-τ+1/Tvj×yτTvjr1′-z2n-τ+1/Tvj=g2α∏i=1jhinr1′-z2n-τ+1/Tvj=g2α∏i=1jhinr1.In addition,(44)dj1=gr1′yn-τ+1-1/Tvj=gr1,dj2=gr1′t1yn-τ+1-t1/Tvj=vr1,dj3=gr1′tyn-τ+1-t/Tvj=vr1=wr1,dj4=ur1′t1yn-τ+1-t1z4∑i=1kTi∗/Tvj=ur1t1,dj5=xr1′t1yn-τ+1-t1t3/Tvj=xr1t1.Then we can obtain(45)dIDj=dj0,dj1,dj2,dj3,dj4,dj5=g2α∏i=1jhinr1,gr1,vr1,wr1,ur1t1,xr1t1.C also produces DIDj. C uses dIDj to derive a private key for the descendant identity IDk and gives A the result.Then,A submits the leak queries to C.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C first produces the auxiliary parameters as hin=gz1Ti∗ for challenge identity ID∗, where Ti∗=T(vi∗). C then randomly chooses R0∈GT and a random seed s∈0,1t and responds to the ciphertexts as(46)CT∗=C0∗,C1∗,C2∗,C3∗,C4∗,C5∗=R0,K∑i=1nTi∗,gz3tgz1z3,gz1,gt1z3,s.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.
From the above game, we can see that ifK=gz1(z3+z4), C is playingGame 2. In fact, let z3=s1,z1=s2. Then one can obtain (47)C1∗=K∑i=1nTi∗=gz1z3+z4∑i=1nTi∗=gz1∑i=1nTi∗z3gz4∑i=1kTi∗z1=∏i=1khins1us2,C2∗=gz3tgz1z3=ws1xs2,C3∗=gz1=gs2,C4∗=gt1z3=vs1,C5∗=s.
Otherwise,K is a random element in G, and C is playingGame 3. Thus,Game 2 andGame 3 are computationally indistinguishable.Lemma 6.
Suppose the decisional linear assumption holds. ThenGame 3 andGame 4 are indistinguishable.Proof.
This proof is similar to Lemma5. C receives a challenge tuple (48)g,gz1,gz2,gz22,…,gz2n,gz2n+2,…,gz22n,gz3,gz4,gz4z2,…,gz2nz4,gz1z2,…,gz2nz1,K,K is either gz1(z3+z4) or a random element of G. C interacts with A as follows:(i)
Init: adversary A gives the challenge identity ID∗=(v1∗,…,vk∗) to the challenger C where k≤l.(ii)
Setup: C randomly chooses t,t1,t2,γ,αij,βij∈Zp∗ where 1≤i≤l, 1≤j≤n. It sets (49)v=gt1,g1=gt1z2,u=gt2,w=gtz1,x=gtz4,g2=gz2ngγ.The public key parameters arePK={g,g1,g2,v,u,w,x}. The master secret key is MSK=g2z2=y1γgz2n+1 which is unknown to C, where yi=gz2i.(iii)
Phase 1: this section is similar to Lemma 5.(iv)
Challenge: A selects two messages M0,M1 on which it wishes to be challenged. C randomly chooses R0∈GT, R1∈G, and a random seed s∈0,1t and responds to the ciphertexts as (50)CT∗=C0∗,C1∗,C2∗,C3∗,C4∗,C5∗=R0,R1,Kt,gz1,gt1z3,s.(v)
Phase 2: C answers the queries in the same way as phase 1 with the added restriction that A can not execute leakage queries.(vi)
Guess: A outputs a bit b′∈{0,1} and wins if b′=b.
From the above game, we can see that ifK=gz1(z3+z4), C is playingGame 3. In fact, let z3=s1,z1=s2. Then one can obtain (51)C2∗=Kt=gz1z3+z4t=gtz1z3gtz1z4=ws1xs2,C3∗=gz1=gs2,C4∗=gt1z3=vs1,C5∗=s.Otherwise, K is a random element in G, and C is playingGame 4. Thus,Game 3 andGame 4 are computationally indistinguishable.Theorem 7.
If the decision(n+1)-BDHE assumption and the decisional linear assumption hold, then our anonymous HIBE scheme is l(λ)-leakage resilience secure.


## 5.2. Leakage Resilience Analysis

LetV be used to represent a view that adversary A sees without leakage, we have H~∞A∣V=log⁡p. From the above leakage-resilient security model, one can know that, for the challenge identity ID∗, the adversary can get the most l(λ) leak information when doing leak queries. We set l(λ) as ξ bit; in other words, l(λ) has 2ξ values. From Lemma 2, one can obtain (52)H~∞A∣lλ,V≥H~∞A∣V-ξ=log⁡p-ξ.Therefore, as long as the extractor’s strength is (log⁡p-ξ,ε), one can obtain (53)SDExteg1,g2s1,s,s,lλ,V,U,s,lλ,V≤ε,where U is uniform distribution and s∈0,1t. The premise is that extractor performance is good enough; one can obtain ξ≈log⁡p. Hence the distance between C0=Mb⊕Exteg1,g2s1,s and uniform distribution is ε and the statistical distance between two ciphertexts is at most 2ε. Therefore, no PPT adversary can distinguish the two challenge ciphertexts with the advantage of more than 2ε. The leakage ratio of our scheme is (54)ρ=lλ6log⁡p=ξ6log⁡p≈log⁡p6log⁡p=16.We compare our work with schemes [24, 35, 54] in Table 2, where pk.size, sk.size, c.size, and LR mean the public key size, the secret key size, the ciphertext size, and leakage-resilience, respectively. We define l as the maximum depth of HIBE, k represents the user identity depth, and the symbol “-” represents the fact that the corresponding scheme does not have this feature. It is noted that our scheme supports anonymity and leakage-resilience where both private keys and ciphertext have a constant size.Table 2
Comparisons of different schemes.
Scheme p k . s i z e s k . s i z e c . s i z e Anonymity LR [35] O ( l ) O ( l ) O ( 1 ) ✓ - [24] O ( 1 ) O ( 1 ) O ( 1 ) ✓ - [55] O ( 1 ) O ( 1 ) O ( 1 ) - ✓ Ours O ( 1 ) O ( 1 ) O ( 1 ) ✓ ✓Our scheme has no obvious advantage in computational efficiency, but the public key length and private key length of our HIBE scheme are both inO(1) time. However, we mainly solve the problem of key leakage in the acceptable range between computational efficiency and security balance.


## 6. Conclusion and Future Work

In this paper, we present a secure s-health system based on a leakage-resilient anonymous HIBE scheme in the bounded-leakage model. Our scheme can protect the patient’s privacy well, even when the private key is partially leaked. Our system also achieves the safe transmission of the patient’s EHRs in the case of leakage attacks. And we provide an example to show the systems feasibility. The proposed scheme was proved to be secure against chosen plaintext attacks in the standard model under the Diffie-Hellman exponent assumption and decisional linear assumption. However, the doctors may reveal the privacy of patients in a malicious way; thus, in the future work, we can increase tracking technology to limit doctors’ malicious information disclosure. In the future work, we can also study how to construct a secure s-health system which allows the master-key leakage.



---

*Source: 7202598-2018-06-24.xml*