# Flexible and Lightweight Access Control for Online Healthcare Social Networks in the Context of the Internet of Things

Authors: Zhen Qin; Jianfei Sun; Dajiang Chen; Hu Xiong
Journal: Mobile Information Systems
 (2017)

---

## Abstract

Online healthcare social networks (OHSNs) play an essential role in sharing information among medical experts and patients who are equipped with similar experiences. To access other patients’ data or experts’ diagnosis anywhere and anytime, it is necessary to integrate the OHSN into the Internet as part of the Internet of Things (IoT). Therefore, it is crucial to design an efficient and versatile access control scheme that can grant and revoke a user to access the OHSN. In this paper, we propose novel attribute-based encryption (ABE) features with user revocation and verifiable decryption outsourcing to control the access privilege of the users. The security of the proposed ABE scheme is given in the well-studied random oracle model. With the proposed ABE scheme, the malicious users can be excluded from the system and the user can offload most of the overhead in the decryption to an untrusted cloud server in a verifiable manner. An access control scheme for the OHSN has been given in the context of the IoT based on the proposed ABE scheme. The simulation demonstrates that our access control mechanism is practical.


---

## Body

## 1. Introduction

Fueled with wireless medical sensors implanted or worn on human body, personal health information (PHI) can be extracted anytime and from any location handily. To share the PHI with the medical experts or other patients from the same community, the online healthcare social networks (OHSNs) [1–3] can be formed and integrated into the Internet of Things (IoT) [4–6] by exchanging the PHI via the portable devices such as the smart phones (Figure 1). With the support of OHSN, users can easily identify other users with certain symptoms in the community and share diagnosis information with each other. Furthermore, accurate and positive treatment information from medical experts can also be disseminated in OHSN to improve the online healthcare environment.Figure 1
PHI data sharing system.In OHSNs, PHI data are extremely sensitive since these data are closely related to the patients’ health status. Naturally, one main requirement of PHI data sharing is to ensure that the data owners could fully control the access to their PHI data and hinder unauthorized users from obtaining the PHI data. One simple approach to achieve access control on the PHI data is to encrypt the shared data with the conventional asymmetric encryption by considering the bulky key management overhead of the symmetric encryption. In asymmetric cryptography (also known as public key cryptography), each user is equipped with a public/private key pair where the public key is distributed in the system and the private key is kept a secret by the user. To share PHI data with close friend or medical expert securely, data owner needs to encrypt the shared data under the public key of the receiver. In this way, only the receiver can read this data with his/her private key. However, this approach is not scalable in the system with a huge number of users. Let us consider the following scenario. Assume the user Alice intends to share her PHI data with her attending physician Bob, her colleague Carol, and her friend David with the conventional public key cryptography. To ensure her data can be accessed by these three users, Alice has to perform the encryption over the shared data three times under the public key of Bob, Carol, and David, respectively. Thus, it is not a trivial task to construct an access control mechanism for the OHSNs in the context of the IoT due to the large-scale nature of OHSNs.Attribute-based encryption (ABE) [7, 8] seems to be a possible promising solution to provide flexible and versatile access control over the encrypted sharing data due to its one-to-many encryption pattern. In an (ciphertext policy) ABE system, user’s private key and ciphertext are, respectively, labeled with a set of attributes and an access policy. Without enumerating the public key of all of the intended receivers, the ciphertext can be read by a group of users as long as the set of attributes associated with the users satisfy the access structure embedded in the ciphertext. That is to say, the one-to-many encryption can be achieved by ABE directly, which makes the ABE primitive particularly appropriate to the large-scale OHSNs. However, two major barriers impede ABE schemes from direct deployment in OHSNs. First, tremendous amounts of wireless and portable sensors/devices interconnected in OHSNs can be easily infiltrated or breached by hackers; therefore, the function with revocation should be considered in ABE schemes to deal with this situation. Second, the ciphertext size and the computational cost of ABE usually grow with the complexity of the access policy because of its expressiveness. By considering the limited battery and computational capabilities of the wireless and portable sensors/devices [9, 10], the existing ABE scheme cannot be directly used to secure the OHSNs.The motivation of the paper is to construct a practical access control mechanism suitable for the large-scale OHSNs in the context of the IoT. In OHSNs, the users equipped with portable devices may be compromised and thus excluded from the system. By considering the limited computation capabilities of the mobile users, the mechanism should be designed to be lightweight. To tackle the above-mentioned issues, we design our ABE scheme featured with user revocation and verifiable decryption outsourcing and apply the proposed ABE scheme to OHSNs. The contributions of this paper include the following two points:(1)
We design a novel ABE scheme with user revocation by incorporating the ciphertext update and key update function such that any legitimate users in social group can access the PHI data from other data owners in the community and revoked users cannot read the encrypted data again even if they intend to collude their attributes with other legitimate social group users. Moreover, our scheme offloads most of the computation task on the data sharers’ side to the untrusted cloud server provider. Concretely, the data sharer sends the transformation key to the cloud server, which in turn sends the partially decrypted ciphertexts to the data sharers and thus contributes to offloading the original decryption task. Moreover, the outsourced result can be easily validated by users whether it is true or not.(2)
Based on our ABE scheme, we present a versatile personal health information (PHI) data sharing architecture to achieve flexible and fine-grained access control. Security proof in the random oracle model and simulation result demonstrate that our scheme is secure and practical.Organization. The rest of this paper is organized as follows. Related works are illustrated in Section 2. Some preliminaries are presented in Section 3. Section 4 describes the formal definition of proposed scheme, our system model, and the security model. In Section 5, the concrete construction is given. Sections 6 and 7 show the security analysis and the performance analysis, respectively. Finally, our conclusion is stated in Section 8.


## 2. Related Work

### 2.1. Attribute-Based Encryption

The notion of attribute-based encryption, which was suggested by Sahai and Waters as fuzzy identity-based encryption in [11], was extended by Goyal et al. [7]. Up to now, two flavors of ABE, key policy attribute-based encryption (KP-ABE) [7, 12–14] and ciphertext policy attribute-based encryption (CP-ABE) [8, 15, 16], have been proposed referring to the fact that access control policy is embedded to the private key or the ciphertext. In a KP-ABE system, keys are associated with an access policy and the ciphertext with a set of attributes. Contrarily, in a CP-ABE system, ciphertexts are assigned to an access structure and the key to a set of attributes. A user can decipher the ciphertext, only if the set of attributes holds the access structure.Although ABE enjoys high expressive and versatile access control policies, the ciphertext size and the computational cost grow with the complexity of the access policy in existing ABE schemes. To offload high computational overload, Green et al. [17] introduced the notion of outsourced decryption into ABE systems, which largely eliminates the decryption overhead for users. In [17], user’s secret key was blinded with a random number and then was delivered to a cloud server to translate the ABE ciphertext into a simper ciphertext. Unfortunately, the verifiability of the cloud’s transformation is not guaranteed for users. By offloading all the access policy and attribute related operation to the key generation service provider (KGSP) and the decryption cloud server provider (DSP), respectively, a secure OABE scheme, which was introduced by Li et al. [18], supplied checkability with supporting both outsourced key issuing and decryption. Presently, Lai et al. [19] formally defined the verifiability of ABE and presented an ABE scheme with verifiable outsourced decryption. Although [19] achieved the desirable effect of the verifiability, double overhead on both the length of ciphertext and the computational cost is reluctant to be accepted for users. To resolve the double overhead problem, Ma et al. [20] suggested a verifiable and exculpable outsourced OABE scheme, which not only largely leverages the ciphertext size and computational cost, but also brings the strong verifiability and exculpability, which effectively addresses the dispute between a user and an outsource computation service provider.


### 2.2. User Revocation

The issue of applying ABE to the data outsourcing architecture also faces many challenges with regard to user revocation or attribute revocation. Key revocation mechanisms in KP-ABE and CP-ABE, respectively, first proposed by Bethencourt et al. [8] and Boldyreva et al. [21], was realized by incorporating with encrypting the message to the attribute and its validation time. However, it was confirmed that these schemes [8, 21] had the security degradation problem considering the forward and backward secrecy [22]. In such a data sharing revocable ABE scenario, a revoked user might still be able to retrieve the original data by attribute-collusion even if his/her attributes do not hold access policy. Of course, a new user might be able to access the previous encrypted data before joining the system until the data are reencrypted with the current updated attribute keys. It is not desirable that a user, revoked from a single attribute group, loses all the access rights to the system in many pragmatic scenarios since the other attributes may still be valid. Attrapadung and Imai [23] realized a conjunctive broadcast and attribute-based encryption scheme with revocation ability; in [23], the data owner was able to perform the user direct revocation by maintaining all user membership lists for each attribute group. However, this scheme was unsuitable to be applied to the data sharing system mainly considering that the data owner will no longer take direct control of data after outsourcing data to the cloud storage server. These schemes [24–26] also addressed the user revocation in the ABE-based data sharing system. In [25], in order to revoke users, the trusted authority should generate all secret keys including the proxy key; simultaneously, the server would reencrypt the ciphertext to hamper revoked users from deciphering the ciphertext after receiving the proxy key from the trusted authority. Therefore, the key escrow problem described in [26] may appear. To address this problem, Hur [26] integrated a key issuing protocol with the proxy encryption mechanism. Very recently, Li et al. [24] presented a flexible and fine-grained attribute-based data storage in cloud computing; however, several issues, key-unblinding, unverifiability, and high key-updating times, cannot be well addressed.


### 2.3. Online Healthcare Social Networks

Several research works that are closely related to the online healthcare social networks (OHSNs) have been introduced [27–30]. Chen et al. [27] present an event-aided packet forwarding (EPF) protocol, which enables patients who suffer from the same diseases to discuss health conditions with other wardmates in OHSNs. Zhou et al. [29] show a secure and privacy-preserving key management scheme for cloud-assisted wireless body area network in OHSNs; in [29], it can tamper both time-based and location-based mobile attacks from the collaboration of the patients having the same diseases in the same social group. Jiang et al. [30] propose an efficient and privacy-preserving personal health information sharing scheme in OHSNs; in [30], it provides the privacy-preserving of data recipients by hidden access policy and the lightweight decryption overhead on decryptors’ sides by the server-aided outsourcing technique. However, the above schemes do not consider the dynamicity of social group in OHSNs. Featuring with dynamic group can provide the OHSNs with extendibility, flexibility, and practicability.Most of the existing ABE schemes applied to online healthcare social networks for data sharing can only protect the data confidentiality/privacy. They do not consider the dynamic characteristics of social group and the decryption overhead on recovering the original message. In our paper, the above gaps are bridged well by suggesting a flexible and lightweight access control for online healthcare social networks in the context of the Internet of Things.


## 2.1. Attribute-Based Encryption

The notion of attribute-based encryption, which was suggested by Sahai and Waters as fuzzy identity-based encryption in [11], was extended by Goyal et al. [7]. Up to now, two flavors of ABE, key policy attribute-based encryption (KP-ABE) [7, 12–14] and ciphertext policy attribute-based encryption (CP-ABE) [8, 15, 16], have been proposed referring to the fact that access control policy is embedded to the private key or the ciphertext. In a KP-ABE system, keys are associated with an access policy and the ciphertext with a set of attributes. Contrarily, in a CP-ABE system, ciphertexts are assigned to an access structure and the key to a set of attributes. A user can decipher the ciphertext, only if the set of attributes holds the access structure.Although ABE enjoys high expressive and versatile access control policies, the ciphertext size and the computational cost grow with the complexity of the access policy in existing ABE schemes. To offload high computational overload, Green et al. [17] introduced the notion of outsourced decryption into ABE systems, which largely eliminates the decryption overhead for users. In [17], user’s secret key was blinded with a random number and then was delivered to a cloud server to translate the ABE ciphertext into a simper ciphertext. Unfortunately, the verifiability of the cloud’s transformation is not guaranteed for users. By offloading all the access policy and attribute related operation to the key generation service provider (KGSP) and the decryption cloud server provider (DSP), respectively, a secure OABE scheme, which was introduced by Li et al. [18], supplied checkability with supporting both outsourced key issuing and decryption. Presently, Lai et al. [19] formally defined the verifiability of ABE and presented an ABE scheme with verifiable outsourced decryption. Although [19] achieved the desirable effect of the verifiability, double overhead on both the length of ciphertext and the computational cost is reluctant to be accepted for users. To resolve the double overhead problem, Ma et al. [20] suggested a verifiable and exculpable outsourced OABE scheme, which not only largely leverages the ciphertext size and computational cost, but also brings the strong verifiability and exculpability, which effectively addresses the dispute between a user and an outsource computation service provider.


## 2.2. User Revocation

The issue of applying ABE to the data outsourcing architecture also faces many challenges with regard to user revocation or attribute revocation. Key revocation mechanisms in KP-ABE and CP-ABE, respectively, first proposed by Bethencourt et al. [8] and Boldyreva et al. [21], was realized by incorporating with encrypting the message to the attribute and its validation time. However, it was confirmed that these schemes [8, 21] had the security degradation problem considering the forward and backward secrecy [22]. In such a data sharing revocable ABE scenario, a revoked user might still be able to retrieve the original data by attribute-collusion even if his/her attributes do not hold access policy. Of course, a new user might be able to access the previous encrypted data before joining the system until the data are reencrypted with the current updated attribute keys. It is not desirable that a user, revoked from a single attribute group, loses all the access rights to the system in many pragmatic scenarios since the other attributes may still be valid. Attrapadung and Imai [23] realized a conjunctive broadcast and attribute-based encryption scheme with revocation ability; in [23], the data owner was able to perform the user direct revocation by maintaining all user membership lists for each attribute group. However, this scheme was unsuitable to be applied to the data sharing system mainly considering that the data owner will no longer take direct control of data after outsourcing data to the cloud storage server. These schemes [24–26] also addressed the user revocation in the ABE-based data sharing system. In [25], in order to revoke users, the trusted authority should generate all secret keys including the proxy key; simultaneously, the server would reencrypt the ciphertext to hamper revoked users from deciphering the ciphertext after receiving the proxy key from the trusted authority. Therefore, the key escrow problem described in [26] may appear. To address this problem, Hur [26] integrated a key issuing protocol with the proxy encryption mechanism. Very recently, Li et al. [24] presented a flexible and fine-grained attribute-based data storage in cloud computing; however, several issues, key-unblinding, unverifiability, and high key-updating times, cannot be well addressed.


## 2.3. Online Healthcare Social Networks

Several research works that are closely related to the online healthcare social networks (OHSNs) have been introduced [27–30]. Chen et al. [27] present an event-aided packet forwarding (EPF) protocol, which enables patients who suffer from the same diseases to discuss health conditions with other wardmates in OHSNs. Zhou et al. [29] show a secure and privacy-preserving key management scheme for cloud-assisted wireless body area network in OHSNs; in [29], it can tamper both time-based and location-based mobile attacks from the collaboration of the patients having the same diseases in the same social group. Jiang et al. [30] propose an efficient and privacy-preserving personal health information sharing scheme in OHSNs; in [30], it provides the privacy-preserving of data recipients by hidden access policy and the lightweight decryption overhead on decryptors’ sides by the server-aided outsourcing technique. However, the above schemes do not consider the dynamicity of social group in OHSNs. Featuring with dynamic group can provide the OHSNs with extendibility, flexibility, and practicability.Most of the existing ABE schemes applied to online healthcare social networks for data sharing can only protect the data confidentiality/privacy. They do not consider the dynamic characteristics of social group and the decryption overhead on recovering the original message. In our paper, the above gaps are bridged well by suggesting a flexible and lightweight access control for online healthcare social networks in the context of the Internet of Things.


## 3. Preliminaries

In this section, we briefly describe notion description, bilinear map, hardness assumption, linear secret-sharing scheme, proxy reencryption, and key derivation function.


### 3.1. Notions

The notions used in this paper are listed in Table1.Table 1
Notions for our proposed system.
Notions
Description
G,GT
Two cyclic multiplicative groups with the same prime orderp
e:G×G→GT
A computable bilinear map
Zp∗
The integer modulop
s
←
R
Z
p
∗
Select a random numbers from Zp∗
H:0,1∗→G
A function maps bit strings to a group element inG
H1:G→Zp∗
A function maps an element inG to a random number in Zp∗
u
i
d
User’s identity
gid
Group identity
p
k
/
m
s
k
System public key/system master secret key
gpk/gmk
Group public key/group master secret key
R
e
k
e
y
Reencryption key
t
k
/
r
k
Transformation key/retrieval key
d
s
k
User’s decryption secret key
k
e
y
/
s
s
k
Encapsulated key/session key
TA
The trusted authority
GA
The trusted group administrator
CSS
The cloud storage server
DSP
The decryption cloud service provider
P
P
T
Probabilistic polynomial time
K
D
F
Key derivation function


### 3.2. Bilinear Pairing

LetG represent an algorithm that takes as input a security parameter λ, it outputs a group tuple (p,G,GT,e), where G,GT denote multiplicative cyclic groups with prime order p, and e:G×G→GT is a computable bilinear map such that the following are defined:(1)
Bilinearity: e(g1u,g2v)=e(g1,g2)uv for all g1,g2∈G, and u,v∈Zp∗.(2)
Nondegeneracy: e(g1,g2)≠1, whenever g1,g2≠1G.Definition 1 (DCDH assumption).
Given a group tuple(G,g,gs,gt) with its generator g, where s,t←RZp∗, the divisible computation Diffie-Hellman (DCDH) problem is to output gs/t. Let G be a bilinear generator; we say that the DCDH holds for G if, for all probabilistic polynomial-time (PPT) algorithms A, the function AdvADCDH(λ) is a negligible function of λ.


### 3.3. Linear Secret-Sharing Scheme (LSSS)

A secret-sharing schemeΠ over a set of parties P is called linear (over Zp∗) with two properties: (1) A vector v over Zp∗ is shared by a set of parties. (2) For the secret-sharing scheme Π, a share-generating matrix M with l rows and n columns can be established. Besides, there also exists a function ρ that maps each row of the matrix to an associated party. In other words, for i=1,…,l, the value ρ(i) equals the party associated with row i. When we share a secret s∈Zp, the column vector v=(s,r2,…,rn) is established, where r2,…,rn∈Zp∗. Then Mv is the vector of l shares of the secret s, and the share (Mv)i belongs to party ρ(i).A linear secret-sharing schemeΠ also enjoys the linear reconstruction property: Suppose that there exists a LSSS for the access structure A. Let S∈A denote the attribute set S which satisfies the access structure A, and let I⊂{1,2,…,l} be defined as I={i:(i)∈S}. Then, there exist constants {ωi∈Zp}i∈I such that if {λi} are valid shares of any secret s according to Π, then s=∑i∈Iωiλi.


### 3.4. Proxy Reencryption

Proxy reencryption [24] allows an entity of honest but curious proxy cloud server, using reencryption key, to transform an encrypted message m under A’s public key into an encrypted same message m under B’s public key without exposing any valuable information about m.


### 3.5. Key Derivation Function (KDF)

Key derivation function (KDF [31]), as a cryptographic primitive, provides a key-expansion capability that converts the initial keying material containing semi-secret randomness into one or more pseudorandom keys. The pseudorandom keys derived from KDF are indistinguishable from a randomly and uniformly distributed string of the same length. Furthermore, portion of the bits generated by the KDF cannot disclose knowledge on the other bits. The definition and the security of the KDF are illustrated as follows.Definition 2 (KDF).
Given a sampled values derived from initial keying material and a length value l, a KDF generates a string with length l.Definition 3 (security of KDF).
A KDF is said to be secure against any PPT adversaryA, in case the following advantage is negligible: (1)Pr⁡AKDFs,l=1-PrAR=1,where R refers to a randomly and uniformly chosen string of the length l bits.


## 3.1. Notions

The notions used in this paper are listed in Table1.Table 1
Notions for our proposed system.
Notions
Description
G,GT
Two cyclic multiplicative groups with the same prime orderp
e:G×G→GT
A computable bilinear map
Zp∗
The integer modulop
s
←
R
Z
p
∗
Select a random numbers from Zp∗
H:0,1∗→G
A function maps bit strings to a group element inG
H1:G→Zp∗
A function maps an element inG to a random number in Zp∗
u
i
d
User’s identity
gid
Group identity
p
k
/
m
s
k
System public key/system master secret key
gpk/gmk
Group public key/group master secret key
R
e
k
e
y
Reencryption key
t
k
/
r
k
Transformation key/retrieval key
d
s
k
User’s decryption secret key
k
e
y
/
s
s
k
Encapsulated key/session key
TA
The trusted authority
GA
The trusted group administrator
CSS
The cloud storage server
DSP
The decryption cloud service provider
P
P
T
Probabilistic polynomial time
K
D
F
Key derivation function


## 3.2. Bilinear Pairing

LetG represent an algorithm that takes as input a security parameter λ, it outputs a group tuple (p,G,GT,e), where G,GT denote multiplicative cyclic groups with prime order p, and e:G×G→GT is a computable bilinear map such that the following are defined:(1)
Bilinearity: e(g1u,g2v)=e(g1,g2)uv for all g1,g2∈G, and u,v∈Zp∗.(2)
Nondegeneracy: e(g1,g2)≠1, whenever g1,g2≠1G.Definition 1 (DCDH assumption).
Given a group tuple(G,g,gs,gt) with its generator g, where s,t←RZp∗, the divisible computation Diffie-Hellman (DCDH) problem is to output gs/t. Let G be a bilinear generator; we say that the DCDH holds for G if, for all probabilistic polynomial-time (PPT) algorithms A, the function AdvADCDH(λ) is a negligible function of λ.


## 3.3. Linear Secret-Sharing Scheme (LSSS)

A secret-sharing schemeΠ over a set of parties P is called linear (over Zp∗) with two properties: (1) A vector v over Zp∗ is shared by a set of parties. (2) For the secret-sharing scheme Π, a share-generating matrix M with l rows and n columns can be established. Besides, there also exists a function ρ that maps each row of the matrix to an associated party. In other words, for i=1,…,l, the value ρ(i) equals the party associated with row i. When we share a secret s∈Zp, the column vector v=(s,r2,…,rn) is established, where r2,…,rn∈Zp∗. Then Mv is the vector of l shares of the secret s, and the share (Mv)i belongs to party ρ(i).A linear secret-sharing schemeΠ also enjoys the linear reconstruction property: Suppose that there exists a LSSS for the access structure A. Let S∈A denote the attribute set S which satisfies the access structure A, and let I⊂{1,2,…,l} be defined as I={i:(i)∈S}. Then, there exist constants {ωi∈Zp}i∈I such that if {λi} are valid shares of any secret s according to Π, then s=∑i∈Iωiλi.


## 3.4. Proxy Reencryption

Proxy reencryption [24] allows an entity of honest but curious proxy cloud server, using reencryption key, to transform an encrypted message m under A’s public key into an encrypted same message m under B’s public key without exposing any valuable information about m.


## 3.5. Key Derivation Function (KDF)

Key derivation function (KDF [31]), as a cryptographic primitive, provides a key-expansion capability that converts the initial keying material containing semi-secret randomness into one or more pseudorandom keys. The pseudorandom keys derived from KDF are indistinguishable from a randomly and uniformly distributed string of the same length. Furthermore, portion of the bits generated by the KDF cannot disclose knowledge on the other bits. The definition and the security of the KDF are illustrated as follows.Definition 2 (KDF).
Given a sampled values derived from initial keying material and a length value l, a KDF generates a string with length l.Definition 3 (security of KDF).
A KDF is said to be secure against any PPT adversaryA, in case the following advantage is negligible: (1)Pr⁡AKDFs,l=1-PrAR=1,where R refers to a randomly and uniformly chosen string of the length l bits.


## 4. Formal Definition, System, and Security Model

In this section, the definition of our proposed scheme, system model, and security model are presented as follows.


### 4.1. Formal Definition of Our Proposed Scheme

We now describe the framework of our online healthcare social network by exploiting CP-ABE system. LetS represent a set of attributes, and L=(M,ρ) stands for an access structure LSSS. Our scheme consists of the following algorithms.S
y
s
t
e
m
S
e
t
u
p
(
λ
). TheSystemSetup algorithm, implemented by trusted authority, outputs the system master keymsk and public keypk taking as input a security parameter λ.G
r
o
u
p
S
e
t
u
p
(
p
k
). TheGroupSetup algorithm, executed by trusted group administrator, generates the group master keygmk, the group public keygpk, and a dictionarydic with recording the version status.C
e
r
t
G
e
n
(
p
k
,
u
i
d
,
gmk
v
e
r
). TheCertGen algorithm, also performed by group administrator, takes as input the system public keypk, the user’s identityuid, and the group master secret keygmkver; it generates a certificateδver.K
e
y
G
e
n
(
p
k
,
m
s
k
,
S
,
gpk
v
e
r
,
u
i
d
,
δ
v
e
r
). TheKeyGen algorithm, carried out by trusted authority, takes as input the system public keypk, the system master secret keymsk, attribute set S, the public group public keygpkver, the user’s identityuid, and the user’s authenticated certificate δver; it produces the user decryption keys dskver and the user tuple upver.E
n
c
r
y
p
t
(
p
k
,
gpk
v
e
r
,
M
,
(
M
,
ϱ
)
). With the system public keypk, the group public keygpkver, a message M, and a LSSS access structure L=(M,ϱ), theEncrypt algorithm, run by PHI data owner, generates the ciphertext CTver stored in cloud server.G
r
o
u
p
U
p
d
a
t
e
(
p
k
,
gmk
v
e
r
,
d
i
c
v
e
r
). Given the system public key pk, the group master keygmkver, and a dictionary dicver, theGroupUpdate algorithm, executed by group administrator, updates the group master key as gmkver+1 and the group public key as gpkver+1; besides, it outputs a new dictionary dicver+1 and generates a reencryption key Rekeyver→ver+1 delivered to proxy server.U
s
e
r
U
p
d
a
t
e
(
d
s
k
v
e
r
,
u
p
v
e
r
+
1
). TheUserUpdate algorithm, performed by users themselves, takes as input the user’s decryption secret key dskver and current tuple upver+1; it outputs the updated decryption secret key dskver+1.R
e
E
n
c
r
y
p
t
(
C
T
v
e
r
,
R
e
k
e
y
v
e
r
→
v
e
r
+
1
). TheReEncrypt algorithm, executed by proxy server, takes as input the ciphertext CTver and the reencryption key ReKeyver→ver+1; it generates a updated ciphertext CTver+1.G
e
n
T
K
o
u
t
(
p
k
,
d
s
k
v
e
r
+
1
). TheGenTK algorithm, run by data sharer, takes as input the system public key pk and the user’s decryption secret key dskver+1; it outputs a blinded decryption secret key dskver+1′ and a transformation key tkver+1.T
r
a
n
s
f
o
r
m
o
u
t
(
C
T
v
e
r
+
1
,
t
k
v
e
r
+
1
). TheTransform algorithm, implemented by DSP, takes as input the ciphertext CTver+1 and the transformation key tkver+1 from data sharer (i.e., mobile patients or mobile physicians); if S does not satisfy access structure, it then outputs ⊥. Otherwise, it outputs a transformation ciphertext CTver+1′.D
e
c
r
y
p
t
v
e
r
i
f
y
(
C
T
v
e
r
+
1
′
,
d
s
k
v
e
r
+
1
). TheDecrypt algorithm, run by data sharers, takes as input the transformation ciphertext CTver+1′ and the updated decryption secret key dskver+1; it outputs the decrypted message M if validating the correctness of transformed ciphertext CTver+1′.


### 4.2. System Model

We consider an efficient personal health information (PHI) data sharing architecture [32, 33] by an example that mobile patients featured with the same symptoms [3] or physicians can form a social group and can rent a cloud server to store and share PHI data with each other in a flexible access manner. Based upon the above premise, several different entities are involved in our system model (Figure 2): PHI cloud storage server, trusted authority, decryption cloud server provider, trusted group administrator, and a large number of social group users including PHI data owners and PHI data sharers. The trusted authority undertakes the responsibility concerning attribute authentication and key distribution. The trusted group administrator takes charge of group management, certificate generation, key update for social group users, and ciphertext update for reencryption requests. The users (i.e., mobile patients and mobile physicians) in the same social group share their health conditions and medical care experiences with their mobile devices. PHI cloud storage server, which is assumed to be a honest but curious entity, provides social group users with some storage and reencryption services; that is, it faithfully implements all operations requested by users and purposefully retrieves the stored ciphertext to collect additional valuable PHI information. The decryption cloud server provider [20] offers the services that can help users to convert a complex decryption task into a simple one.Figure 2
Architecture of the proposed PHI data sharing protocol.


### 4.3. Security Model

We now give the definition of the chosen plaintext security (CPA) security for CP-ABE scheme with verifiability. In this security model, the revoked user may collude with unrevoked user to obtain some unauthorized data [34]. We suppose that the revoked user can get private keys that satisfy the access structure; the version however differs from the current version. Contrarily, the unrevoked user can achieve private keys that do not satisfy the access structure, but the version is the current version. To formalize the security model, the game is described between an adversary A and a challenger B as follows.Init. The adversary A gives the challenger B its challenge LSSS access structure L∗={M∗,ϱ∗}, group identity gid∗, and the version ver∗.Setup. B first executesSystemSetup() algorithm to obtain the system master secret keymsk and the public parameterpk. B then performsGroupSetup() algorithm to achieve the group master keygmk0 and the group public keygpk0 for gid∗. Moreover, B runsGroupUpdate() algorithm to get the group master keygmkver, the group public keygpkver, and reencryption key Rekeyver-1→ver, where ver={1,2,…,ver∗}.  B finally sends A the public parameter pk and the group public keys {gpkver}0≤ver≤ver∗ and keeps the system mater key mk, the group master keys {gpkver}0≤ver≤ver∗, and the reencryption key {Rekeyver-1→ver}ver={1,2,…,ver∗}.Phase 1.
A repeatedly issues queries as follows, including Type-A query, Type-B query, User update query, and Reencryption query. (i)
Type-A query:
(1)
Certificate query, on input user’s identity uid, group identity gid∗, and the version number ver, where ver<ver∗: B runs δver←CerGen(pk,uid,gmkver), and then it returns to A the certificate δver.(2)
Private key query, on input user’s identity uid, group identity gid∗, a set of attributes S satisfying the access structure L∗, and the certificate {δver}ver<ver∗: B executes dskver←KeyGen(pk,msk,gpkver,S,uid,δver) and then issues the private secret key dskver to A.(3)
Transformation key query, on input the system public key pk, the version number ver, and the corresponding private key dskver: B runs dskver′←GenTKout(pk,dskver), where dskver′=(rk,tk). Then it issues the new private secret key dskver′ to A.(ii)
Type-B query:
(1)
Certificate query, on input user’s identity uid, group identity gid∗, and the version number ver∗: B runs δver∗←CerGen(pk,uid,gmkver∗) and then returns the certificate δver∗ to A.(2)
Private key query, on input user’s identity uid, group identity gid∗, a set of attributes S dissatisfying the access structure L∗, and the certificate δver∗:  B executes dskver∗←KeyGen(pk,mk,gpkver∗,S,uid,δver∗) and then issues the private key dskver∗ to A.(3)
Transformation key query, on input the system public key PK, the version number ver∗, and the corresponding private key dskver∗: B runs dskver∗′←GenTKout(pk,dskver∗), where dskver∗′=(tk,tk). Then it issues the new private secret key dskver∗′ to A.(iii)
User update query, on user’s identify uid and the decryption private {dskver}ver<ver∗-1: B sends to A the tuple upver+1. Then A performs dskver+1←UserUpdate(dskver,upver+1).(iv)
Reencryption query, on input {CTver}ver<ver∗: B runs CTver+1←ReEncrypt(CTver,Rekeyver→ver+1) and returns CTver+1 to A.Challenge. A submits two equal length messages M0 and M1 to B. B picks a random bit η∈{0,1}, sets CT∗←Encyrpt(pk,gpkver,Mη,L∗), and sends CT∗ to A.Phase 2.
A continues to sendType-A, Type-B, User update, and Reencryption queries as in Phase 1.Guess. A outputs its guess η′∈{0,1} for η and wins the game if η=η′.The advantage of the adversaryA in this game is defined as AdvA=|Pr[η=η′]-1/2|.


## 4.1. Formal Definition of Our Proposed Scheme

We now describe the framework of our online healthcare social network by exploiting CP-ABE system. LetS represent a set of attributes, and L=(M,ρ) stands for an access structure LSSS. Our scheme consists of the following algorithms.S
y
s
t
e
m
S
e
t
u
p
(
λ
). TheSystemSetup algorithm, implemented by trusted authority, outputs the system master keymsk and public keypk taking as input a security parameter λ.G
r
o
u
p
S
e
t
u
p
(
p
k
). TheGroupSetup algorithm, executed by trusted group administrator, generates the group master keygmk, the group public keygpk, and a dictionarydic with recording the version status.C
e
r
t
G
e
n
(
p
k
,
u
i
d
,
gmk
v
e
r
). TheCertGen algorithm, also performed by group administrator, takes as input the system public keypk, the user’s identityuid, and the group master secret keygmkver; it generates a certificateδver.K
e
y
G
e
n
(
p
k
,
m
s
k
,
S
,
gpk
v
e
r
,
u
i
d
,
δ
v
e
r
). TheKeyGen algorithm, carried out by trusted authority, takes as input the system public keypk, the system master secret keymsk, attribute set S, the public group public keygpkver, the user’s identityuid, and the user’s authenticated certificate δver; it produces the user decryption keys dskver and the user tuple upver.E
n
c
r
y
p
t
(
p
k
,
gpk
v
e
r
,
M
,
(
M
,
ϱ
)
). With the system public keypk, the group public keygpkver, a message M, and a LSSS access structure L=(M,ϱ), theEncrypt algorithm, run by PHI data owner, generates the ciphertext CTver stored in cloud server.G
r
o
u
p
U
p
d
a
t
e
(
p
k
,
gmk
v
e
r
,
d
i
c
v
e
r
). Given the system public key pk, the group master keygmkver, and a dictionary dicver, theGroupUpdate algorithm, executed by group administrator, updates the group master key as gmkver+1 and the group public key as gpkver+1; besides, it outputs a new dictionary dicver+1 and generates a reencryption key Rekeyver→ver+1 delivered to proxy server.U
s
e
r
U
p
d
a
t
e
(
d
s
k
v
e
r
,
u
p
v
e
r
+
1
). TheUserUpdate algorithm, performed by users themselves, takes as input the user’s decryption secret key dskver and current tuple upver+1; it outputs the updated decryption secret key dskver+1.R
e
E
n
c
r
y
p
t
(
C
T
v
e
r
,
R
e
k
e
y
v
e
r
→
v
e
r
+
1
). TheReEncrypt algorithm, executed by proxy server, takes as input the ciphertext CTver and the reencryption key ReKeyver→ver+1; it generates a updated ciphertext CTver+1.G
e
n
T
K
o
u
t
(
p
k
,
d
s
k
v
e
r
+
1
). TheGenTK algorithm, run by data sharer, takes as input the system public key pk and the user’s decryption secret key dskver+1; it outputs a blinded decryption secret key dskver+1′ and a transformation key tkver+1.T
r
a
n
s
f
o
r
m
o
u
t
(
C
T
v
e
r
+
1
,
t
k
v
e
r
+
1
). TheTransform algorithm, implemented by DSP, takes as input the ciphertext CTver+1 and the transformation key tkver+1 from data sharer (i.e., mobile patients or mobile physicians); if S does not satisfy access structure, it then outputs ⊥. Otherwise, it outputs a transformation ciphertext CTver+1′.D
e
c
r
y
p
t
v
e
r
i
f
y
(
C
T
v
e
r
+
1
′
,
d
s
k
v
e
r
+
1
). TheDecrypt algorithm, run by data sharers, takes as input the transformation ciphertext CTver+1′ and the updated decryption secret key dskver+1; it outputs the decrypted message M if validating the correctness of transformed ciphertext CTver+1′.


## 4.2. System Model

We consider an efficient personal health information (PHI) data sharing architecture [32, 33] by an example that mobile patients featured with the same symptoms [3] or physicians can form a social group and can rent a cloud server to store and share PHI data with each other in a flexible access manner. Based upon the above premise, several different entities are involved in our system model (Figure 2): PHI cloud storage server, trusted authority, decryption cloud server provider, trusted group administrator, and a large number of social group users including PHI data owners and PHI data sharers. The trusted authority undertakes the responsibility concerning attribute authentication and key distribution. The trusted group administrator takes charge of group management, certificate generation, key update for social group users, and ciphertext update for reencryption requests. The users (i.e., mobile patients and mobile physicians) in the same social group share their health conditions and medical care experiences with their mobile devices. PHI cloud storage server, which is assumed to be a honest but curious entity, provides social group users with some storage and reencryption services; that is, it faithfully implements all operations requested by users and purposefully retrieves the stored ciphertext to collect additional valuable PHI information. The decryption cloud server provider [20] offers the services that can help users to convert a complex decryption task into a simple one.Figure 2
Architecture of the proposed PHI data sharing protocol.


## 4.3. Security Model

We now give the definition of the chosen plaintext security (CPA) security for CP-ABE scheme with verifiability. In this security model, the revoked user may collude with unrevoked user to obtain some unauthorized data [34]. We suppose that the revoked user can get private keys that satisfy the access structure; the version however differs from the current version. Contrarily, the unrevoked user can achieve private keys that do not satisfy the access structure, but the version is the current version. To formalize the security model, the game is described between an adversary A and a challenger B as follows.Init. The adversary A gives the challenger B its challenge LSSS access structure L∗={M∗,ϱ∗}, group identity gid∗, and the version ver∗.Setup. B first executesSystemSetup() algorithm to obtain the system master secret keymsk and the public parameterpk. B then performsGroupSetup() algorithm to achieve the group master keygmk0 and the group public keygpk0 for gid∗. Moreover, B runsGroupUpdate() algorithm to get the group master keygmkver, the group public keygpkver, and reencryption key Rekeyver-1→ver, where ver={1,2,…,ver∗}.  B finally sends A the public parameter pk and the group public keys {gpkver}0≤ver≤ver∗ and keeps the system mater key mk, the group master keys {gpkver}0≤ver≤ver∗, and the reencryption key {Rekeyver-1→ver}ver={1,2,…,ver∗}.Phase 1.
A repeatedly issues queries as follows, including Type-A query, Type-B query, User update query, and Reencryption query. (i)
Type-A query:
(1)
Certificate query, on input user’s identity uid, group identity gid∗, and the version number ver, where ver<ver∗: B runs δver←CerGen(pk,uid,gmkver), and then it returns to A the certificate δver.(2)
Private key query, on input user’s identity uid, group identity gid∗, a set of attributes S satisfying the access structure L∗, and the certificate {δver}ver<ver∗: B executes dskver←KeyGen(pk,msk,gpkver,S,uid,δver) and then issues the private secret key dskver to A.(3)
Transformation key query, on input the system public key pk, the version number ver, and the corresponding private key dskver: B runs dskver′←GenTKout(pk,dskver), where dskver′=(rk,tk). Then it issues the new private secret key dskver′ to A.(ii)
Type-B query:
(1)
Certificate query, on input user’s identity uid, group identity gid∗, and the version number ver∗: B runs δver∗←CerGen(pk,uid,gmkver∗) and then returns the certificate δver∗ to A.(2)
Private key query, on input user’s identity uid, group identity gid∗, a set of attributes S dissatisfying the access structure L∗, and the certificate δver∗:  B executes dskver∗←KeyGen(pk,mk,gpkver∗,S,uid,δver∗) and then issues the private key dskver∗ to A.(3)
Transformation key query, on input the system public key PK, the version number ver∗, and the corresponding private key dskver∗: B runs dskver∗′←GenTKout(pk,dskver∗), where dskver∗′=(tk,tk). Then it issues the new private secret key dskver∗′ to A.(iii)
User update query, on user’s identify uid and the decryption private {dskver}ver<ver∗-1: B sends to A the tuple upver+1. Then A performs dskver+1←UserUpdate(dskver,upver+1).(iv)
Reencryption query, on input {CTver}ver<ver∗: B runs CTver+1←ReEncrypt(CTver,Rekeyver→ver+1) and returns CTver+1 to A.Challenge. A submits two equal length messages M0 and M1 to B. B picks a random bit η∈{0,1}, sets CT∗←Encyrpt(pk,gpkver,Mη,L∗), and sends CT∗ to A.Phase 2.
A continues to sendType-A, Type-B, User update, and Reencryption queries as in Phase 1.Guess. A outputs its guess η′∈{0,1} for η and wins the game if η=η′.The advantage of the adversaryA in this game is defined as AdvA=|Pr[η=η′]-1/2|.


## 5. Concrete Construction

Our scheme is based on flexible and fine-grained attribute-based data storage [24]. In this section, we suggest an efficient CP-ABE scheme based on LSSS structure under the aforementioned DCDH assumption.(
G
,
G
T
) can be denoted as a multiplicative cyclic bilinear group pair and these two group elements in pair have the same large prime order p. Let g be a generator of group G and e:G×G→GT be a bilinear map. Let H:{0,1}∗→G and H1:G→Zp∗ denote that a hash function H maps an identity or an attribute to a group value in G and a hash function H1 maps an elements in G to a random number in Zp, respectively.S
y
s
t
e
m
S
e
t
u
p
(
λ
)
→
(
p
k
,
m
s
k
). This algorithm is executed by trusted authority (TA). TA first picks α,θ,a∈Zp∗ and u,w,v∈G and chooses a key derivation function  KDF with the output length l. Then it calculates gα,gθ,g1/θ,gb,e(g,g)α. Finally, it publishes public parameters pk=(G,g,u,w,v,gθ,e(g,g)α,ga,KDF,l), keeps the master key msk=(gα,θ), and simultaneously issues g1/θ to trusted group administrator (GA) to execute the revocation operation.G
r
o
u
p
S
e
t
u
p
(
p
k
)
→
(
gmk
0
,
gpk
0
,
d
i
c
0
). This algorithm is run by GA. GA first selects a random β∈Zp∗ and sets the group master secret key gmk=β. Then, GA calculates gβ,e(g,g)β. Lastly, it publishes the group public parameters gpk=(gid,gβ,e(g,g)β), where gid denotes group identity. dic0 stands for a dictionary which initializes an empty version. In our system, for example, 0 denotes initial version. The version will be updated to a new version when any user leaves the system. Let ver be the current version.C
e
r
t
G
e
n
(
p
k
,
u
i
d
,
gmk
v
e
r
)
→
δ
v
e
r. This algorithm is implemented by GA. When a new user who wants to join the group system requests a group certificate. Once the GA accepts his/her request, it produces a certificate as δver=gθβver×H(uid)βver and sends it to the user.K
e
y
G
e
n
(
p
k
,
m
s
k
,
S
,
gpk
v
e
r
,
u
i
d
,
δ
v
e
r
)
→
(
d
s
k
v
e
r
,
u
p
v
e
r
). This algorithm is performed by TA. User’s attributes and identity could be authenticated by TA and then this algorithm is run to generate decryption secret key as follows:(1)
TA first validates the authenticity of certificate to recognize whether the user is a group member or not bye(g,σver)=?e(gθ×H(uid),gβver). If the equation is true, then the certificate is valid and goes to the next step. Otherwise, it returns an error symbol ⊥.(2)
TA generates decryption secret keydskver for user according to his/her identity uid and a set of user attributes S. TA picks s1,s2,r,τ,σ∈Zp∗ at random and computes H(uid)βver=δver/(gβvet)θ; then the private key is produced as follows: (2)dskS=D1=gs1α+r/θ+σ·vs1,L=gs1,D2=σ,D3=gas1/θ·Huidβvers1/θ,Kx=Hs1xx∈S,dskgid=D4=gβvers2,D5=Huidβvers2,D6=gs2r·Hgids2τ·vθ+σs2,D7=gs2τ.(3)
TA sets the decryption keydskver=(dskS,dskgid,s1,s2) and sends it to the user in the group; besides, it also delivers the current tuple upver=(uid,d1=H(uid)1/θ,d2=g1/θ) to GA.E
n
c
r
y
p
t
(
p
k
,
gpk
v
e
r
,
M
,
(
M
,
ρ
)
)
→
C
T
v
e
r. This algorithm is run by PHI data owner. This algorithm takes as input the system public key pk, the group public key gpk, a plaintext message M, and a LSSS access structure L=(M,ϱ), where M denotes a l×n matrix and Mk is the vector corresponding to the kth row of M. ϱ is a map from each Mi of M to the party ϱi. The algorithm first picks a random vector v→=(t2,v2,…,vn)∈Zp∗n such that t2 can be shared. For k=1 to l, it is easy to compute λk=v→·Mi. The detailed steps by PHR data owner proceed as follows:(1)
Chooset1∈Zp∗ randomly and generate a new session keyssk with the encapsulated key key=e(g,g)αt1; besides, compute (3)KDFkey,l=ssk∥f,C^=uH1ssk·wH1f,Cver=M·eg,gαt1+βvert2,C1′=gθt1,C2′=gθt2,C1′′=gt1,C2′′=gt2,C3′=Hgidt1.(2)
Pickr1,…,rl∈Zp∗ randomly, and calculate (4)C1=gaλ1·Hρ1-r1,F1=gr1,…,Cl=gaλl·Hρl-rl,Fl=grl.(3)
Output the ciphertext(5)CTver=ver,L,C^,Cver,C1′,C2′,C1′′,C2′′,C3′,Ck,Fkk∈1,l.And, then uploadCTver to CSS.GroupUpdate(pk,gmkver,dicver)→(gmkver+1,gpkver+1,Rekeyver→ver+1,dicver+1). This algorithm is carried out by GA. When social group members leave the group, the group master key and public key should be updated by GA as follows: (1)
Pickβver+1∈Zp∗ as a updated group master key gmkver+1=βver+1, and update the group public key gpkver+1=(gid,gβver+1,e(g,g)βver+1). Moreover, compute a reencryption key Rekeyver→ver+1=g(βver+1-βver)/θ.(2)
Update the current tupleupver+1=(uid,d1=H(uid)(βver+1-βver)/θ,d2=g(βver+1-βver)) and issue upver+1 to each group member.U
s
e
r
U
p
d
a
t
e
(
d
s
k
v
e
r
,
u
p
v
e
r
+
1
)
→
d
s
k
v
e
r
+
1. This algorithm is performed by PHI data sharer in the social group. When a sharer leaves the group, the group keys need to be updated by GA as above. Besides, other sharers in the group also need to update their decryption keys by themselves. dskver+1 is updated as follows:(1)
Calculate(6)D3=D3×d1s1=gas1/θ×Huidβver+1s1/θ,D4=D4×d2s2=gβver+1s2,D5=D5×d1s2=Huidβver+1s2.(2)
Update(7)dskS=D1=gs1α+r/θ+σ·vs1,D2=σ,D3=gas1/θ·Huidβver+1s1/θ,L=gs1,Kx=Hs1xx∈S,dskgid=D4=gβver+1s2,D5=Huidβver+1s2,D6=gs2r·Hgids2τ·vθ+σs2,D7=gs2τ.(3)
The updated decryption secret keydskver+1 is denoted as (8)dskver+1=s1,s2,dskS,dskgid.ReEncrypt(CTver,Rekeyver→ver+1)→CTver+1. This algorithm is executed by CSS. After updating user’s decryption keys, the user who uses his/her updated key dsk cannot decrypt the original ciphertext stored in CSS anymore; therefore, the ciphertext needs to be updated by reencryption operations as follows: (1)
Calculate(9)Cver+1=Cver·eRekeyver→ver+1,C2′=Meg,gαt1+βvert2egβver+1-βver/θ,gθt2=M·eg,gαt1+βver+1t2.(2)
Output the updated ciphertext(10)CTver+1=ver+1,L,C^,Cver+1,C1′,C2′,C1′′,C2′′,C3′,Ck,Dk′k∈1,l.G
e
n
T
K
o
u
t
(
p
k
,
d
s
k
v
e
r
+
1
)
→
d
s
k
v
e
r
+
1
′. This algorithm is run by the existing social group sharer. Given the user’s decryption secret key dskver+1, it can convert the original decryption secret key into a blinded decryption secret key in the following:(1)
Pick a randomz∈Zp∗ and compute (11)s1′=s1z,s2′=s2z,dskS′=D1′=gs1′α+r/θ+σ·vs1′,D2′=σ,D3′=gas1′/θ·Huidβvers1′/θ,L=gs1′,Kx′=Hs1′xx∈S,dskgid′=D4′=gβvers2′,D5′=Huidβvers2′,D6′=gs2′r·Hgids2′τ·vθ+σs2′,D7′=gs2′τ.Note that herein we setD2=D2′=σ which is not blinded.(2)
Set the decryption secret keydskver+1′=(rk,tkver+1), where the blinded transformation key tkver+1=(dskS′,dskgid′) and the retrieval key rk=(s1′,s2′), and then send tkver+1 to the DSP.T
r
a
n
s
f
o
r
m
o
u
t
(
C
T
v
e
r
+
1
,
t
k
v
e
r
+
1
)
→
C
T
v
e
r
+
1
′. This algorithm is performed by DSP. TheTransform algorithm takes as input the ciphertext CTver+1 and the transformation key TKver+1 from user; if S does not satisfy access structure, it then outputs ⊥. Assume that S satisfies the access structure and let I⊆{1,2,…,l} be defined as I={k:ϱ(k)∈S}. It could calculate constants {ωk∈Zp∗}k∈I such that if {λk} are valid shares of any secret s according to M, then ∑k∈Iωkλk=t2. The algorithm partially deciphers the ciphertext as follows and sends the partially decrypted ciphertext CT′ to the PHI data sharer.(1)
Calculate(12)T1=eC2′,D3′eΠk∈ICkωk,L′·Πk∈IeFkωk,Kϱk′=egθt2,gas1/θ×Huidβver+1s1/θ1/zΠk∈Ieg,gs1aλkωk1/z=egθt2,gas1/θ×Huidβver+1s1/θ1/zeg,gs1at2/z=eg,Huidβver+1t2s1/z,T2=eC1′′,D6′eC3′,D7′=egt1,gs2r·Hgids2τ·vθ+σs21/zeHgidt1,gs2τ1/z=eg,gt1s2r/z·eg,vθ+σt1s2/z.(2)
Similarly, compute(13)E1=eC1′′D2′C1′,D1′=egθ+σt1,gs1α+r/θ+σ·vs11/z=eg,gt1α+rs1/zeg,vθ+σt1s1/z,E2=eC2′′,D4′=egt2,gβver+1s21/z=eg,gβver+1s2t2/z,E3=eC2′′,D5′=egt2,Huidβver+1s21/z=eg,Huidβver+1s2t2/z.(3)
DSP issues the partial decrypted ciphertextCTver+1′={C^,Cver+1,T1,T2,E1,E2,E3} to the social group sharers.D
e
c
r
y
p
t
v
e
r
i
f
y
(
C
T
v
e
r
′
,
d
s
k
v
e
r
+
1
′
)
→
M. This algorithm is executed by PHI data sharer. the algorithm could decipher the decrypted ciphertext as follows:(1)
CalculateFr′, Fg′, E1′, E2′ as (14)T1′=T11/s1′=eg,Huidβver+1t2,T2′=T21/s2′=eg,gt1r·eg,vθ+σt1,E1′=E11/s1′=eg,gt1α+reg,vθ+σt1,E2′=E21/s2′=eg,gβver+1t2,E3′=E31/s2′=eg,Huidβver+1t2.(2)
Compute the encapsulated key and the session keyssk as (15)key=E1′·E3′T1′·T2′=eg,gt1α+reg,vθ+σt1·eg,Huidβver+1t2eg,Huidβver+1t2·eg,gt1r·eg,vθ+σt1=eg,gαt1,KDFkey,l=ssk∥f.(3)
IfC^=uH1(ssk)wH1(f), it outputs the encapsulated key key and then retrieves the message M as M=CTver+1·(key·E2′)-1. Otherwise, it outputs ⊥.


## 6. Security Analysis

In this section, we present the security for our proposed CP-ABE scheme. The main issue in our scheme is also to resist the collusion attack between the revoked users and existing legitimate users.Theorem 4.
Suppose that the construction of Li [24] is a selectivelyCPA secure CP-ABE scheme; then our scheme proposed is also selectivelyCPA secure. In our construction, provided that the hash function H is a random oracle, if there exists a probabilistic polynomial-time adversary A that can break our scheme with a nonnegligible advantage ε>0 after l1 Type-A queries and l2 Type-B queries, then there exists a challenger B that can solve the DCDH problem with the advantage (16)AdvA≤ε2l1+l2·l1·l2.LetB be a DCDH attacker who receives a random instance {p,G,GT,e,g,(P,Q)=(gb,gd)} of DCDH problem in G and has to calculate the value of gb/d. A is an adversary who interacts with the attacker B as modeled in aforementioned game of security model. We present how the attacker B can use the adversary A to solve the DCDH problem, that is, how to compute the value of gb/d.To easily understand the proof, the reduction is briefly presented. When the game starts, the attackerB first initializes the instance (P,Q)=(gb,gd) of the DCDH problem and then simulates hash functions as random oracles. During the simulation, the attacker B needs to guess the adversary A’s target identity and message. the attacker B finally will set dskA-i and dskB-i (please consult our proof for the settings). At the end of game, the adversary A can output the value of gb/d=gzi′/ziβver as his answer by the evidence Qzi′=(Hi)βver.Proof.
B is given a challenge instance (17)p,G,GT,e,g,P,Q=gb,gd,where b,d∈Zp∗. B interacts with A as follows.
Init. The adversary A gives the challenger B its challenge LSSS access structure L∗={M∗,ρ∗}, group identity gid∗, and the version ver∗.
Setup. B does the following steps to set the public parameter pk and the group public key gpk:(1)
Choose randoma,x,y,α,θ∈Zp∗, and pick a key derivation function  KDF with the output length l. Also pick a collision-resistant hash function H1:G→Zp∗, and then calculate ga,gθ,e(g,g)α, and set pk=(g,G,ga,u′=gx,w′=gy,gθ,e(g,g)α,KDF,l,H1),msk=(θ,gα).(2)
Pickβ0,β1,…,βver∗-1∈Zp∗ at random, compute {gβver}0≤ver<ver∗∪{Q}ver∗, {e(g,g)βver}0≤ver<ver∗∪{e(g,Q)}ver∗, and set gpkver={gid∗,gβver,e(g,g)βver}0≤ver<ver∗∪{gid∗,B,e(g,Q)}ver∗, gmk={βver}0≤ver<ver∗∪{d}ver∗. Note that d is unknown to B.(3)
Issuepk, gpkver to A, and keep msk, gmk in himself.
H-Queries. B uses three lists Huidlist, Hgidlist,Hϱlist to reply A’s queries (user’s identity, group identity, and ϱ(k) queries). (1)
User’s identity query(Huidi): if uidi already exists in Huidilist as 〈uidi,Hi,zi,ri〉, then B returns Huidi=Hi. Otherwise, B flips a random coin ri with the probability Pr[ri=1]=ϵ. If ri=0, then B picks zi∈Zp∗ randomly and inserts the tuple 〈uidi,Hi=gzi,zi,ri〉 into Huidlist. If ri=1, then B chooses random zi∈Zp∗ and adds the tuple 〈uidi,Hi=Pzi,zi,ri〉 into Huidlist. B gives A the user’s identity query H(uidi)=Hi.(2)
Group identity query(Hgidj): if gidj already exists in Hgidjlist as 〈gidj,Hj,mj〉, then B returns Hgidj=Hj. Otherwise, B chooses random mi∈Zp∗ and adds the tuple 〈gidj,Hj=gmj,mj〉 into the Hgidlist. B gives A the group identity query H(gidj)=Hj.(3)
ϱ(k) query (H(ϱ(k))): if ϱ(k) already exists in Hϱlist as 〈ρ(k),Hk,nk〉, then B returns H(ϱ(k))=Hk. Otherwise, B chooses random nk∈Zp∗ and adds the tuple 〈ϱ(k),Hk=gnk,nk〉 into Hϱlist. B gives A the ρ query H(ϱ(k))=Hk.
Phase 1. A repeatedly issues queries to B as follows; B utilizes two lists to send queries KeyAlist, KeyBlist (initially empty).(i)
Type-A query:
(1)
Certificate query 〈uidi,gid∗,ver〉ver<ver∗: suppose that uidi exists in Huidlist as 〈uidi,Hi,zi,ri〉; otherwise, B runs a request himself as in Huidi. If ri=1, then B generates a certificate δver=gθβver×Pziβver, and if ri=0, then B outputs ⊥.(2)
Private key query 〈uidi,gid∗,S,ver〉ver<ver∗, where S satisfies a LSSS access structure L∗: if uidi has already appeared in KeyBlist as 〈uidi,dskB-i〉, then B outputs ⊥. Otherwise, B first obtains 〈uidi,Hi,zi,ri〉,〈gid∗,H∗,m∗〉 from Huidlist, Hgidlist, respectively, and B picks s1,s2,r,τ,σ∈Zp∗ randomly and calculates the private key as follows:(18)dskS=D1=gs1α+r/θ+σ·vs1,D2=σ,D3=gas1/θ·Pziβvers1/θ,L=gs1,Kx=Hs1xx∈S∧x=ϱk,dskgid=D4=gβvers2,D5=Pziβvers2,D6=gs2r·H∗s2τ·vθ+σs2,D7=gs2τ.(3)
Transformation key query 〈s1,s2,ver,dskS,dskgid∗〉ver<ver∗: B chooses a random exponent z∈Zp∗ and then sets (19)s1′=s1z,s2′=s2z,dskS′=D1′=gs1′α+r/θ+σ·vs1′,D2′=σ,D3′=gas1′/θ·Pziβvers1′/θ,L′=gs1′,Kx′=Hs1′xx∈S,dskgid′=D4′=gβvers2′,D5′=Pziβvers2′,D6′=gs2′r·H∗s2′τ·vθ+σs2′,D7′=gs2′τ.B finally sends dskA-i={rk=(s′1,s′2),tkS=(S,dskS′,dskgid∗′)} to A and adds 〈uidi,dskA-i〉 into the list KeyAlist.(ii)
Type-B query:
(1)
Certificate query uidi,gid∗,ver∗: suppose that uidi exists in Huidlist as 〈uidi,Hi,zi,ri〉; otherwise, B runs a request himself as in Huidi. If ri=0, then B generates a certificate δver∗=Qθ×Qzi, and if ri=1, then B outputs ⊥.(2)
Private key query 〈uidi,gid∗,S,ver〉ver=ver∗, where S dissatisfies a LSSS access structure L∗: if uidi has already appeared in KeyAlist as 〈uidi,dskA-i〉, then B outputs ⊥. Otherwise, B first obtains 〈uidi,Hi,zi,ri〉, 〈gid∗,H∗,m∗〉 from Huidlist,Hgidlist, respectively, and B picks s1,s2,r,τ,σ∈Zp∗ randomly and calculates the private key as follows:(20)dskS=D1=gs1α+r/θ+σ·vs1,D2=σ,D3=gas1/θ·Qzis1/θ,L′=gs1,Kx=Hs1xx∈S∧x=ϱk,dskgid=D4=Qs2,D5=Qzis2,D6=gs2r·H∗s2τ·vθ+σs2,D7=gs2τ.(3)
Transformation key query 〈s1,s2,ver,dskS,dskgid∗〉ver=ver∗: B chooses a random exponent z∈Zp∗ and then sets(21)s1′=s1z,s2′=s2z,dskS′=D1′=gs1′α+r/θ+σ·vs1′,D2′=σ,D3′=gas1′/θ·Qzis1′/θ,L′=gs1′,Kx′=Hs1′xx∈S,dskgid′=D4′=Qs2′,D5′=Qzis2′,D6′=gs2′r·H∗s2′τ·vθ+σs2′,D7′=gs2′τ.B finally sends dskB-i={rk=(s1′,s2′),tkS=(S,dskS′,dskgid∗′)} to A and adds 〈uidi,dskB-i〉 into the list KeyBlist.(iii)
User update query 〈uidi,ver,dskA-i〉ver<ver∗-1, where uidi already exists in Type-A private key query. B achieves 〈uidi,Hi,zi,ri〉 from Huidlist and calculates d1=Pzi·(βver+1-βver)/θ,d2=g(βver+1-βver); then B transmits the tuple upver+1=〈uidi,d1,d2〉 to A; finally A uses the algorithmUserUpdate(dskA,i,upver+1) to update his private key.(iv)
Reencryption query 〈CTver,gid∗〉ver<ver∗: B first calculates reencryption key as Rekeyver→ver+1=g(βver+1-βver)/θ and executes CTver+1←ReEncrypt(CTver,Rekeyver→ver+1). Then B returns CTver+1 to A.
Challenge. A submits two equal length messages M0, M1; B then picks a random η and proceeds as follows: (1)
B selects s1,s2∈Zp∗ randomly and achieves 〈gid∗,H∗,m∗〉 from Hgidlist. Moreover, B chooses c1,…,cl∈Zp∗ at random and obtains 〈ϱ(k),Hk,nk〉 from Hϱlist.(2)
B then generates the challenge ciphertext in the following. (22)CTu=version=ver∗,L∗,gid∗,Cη=Mη·eg,gαt1·eg,Qt2,C1′=gθt1,C2′=gθt2,C1′′=gt1,C2′′=gt2,C3′=H∗t1,Ck=gaλk·Hϱk-ck,Fk=gckk∈0,l.(3)
A runsEncrypt algorithm to obtain key∗=e(g,g)αs1 and selects a random bit r∈{0,1}. If r=0, it sets key=key∗. If r=1, it chooses a random key R∗ and sets key=R∗ and then sends (key,CTη) to B. B computes KDF(key,l)=ssk∗∥f∗, C^=u′H1(ssk∗)w′H1(f∗).(4)
B finally delivers (CTη,C^) to A.
Phase 2. A continues to request the above queries not issues as in Phase 1, and B sends the queries as in Phase 1.
Guess. If A wins the game, then B can compute (23)gx·H1ssk∗+yH1f∗=u′H1SSK∗w′H1f∗=C^.Eventually, B omits A′s output and chooses dskA-i from KeyAlist and dskB-i from KeyBlist randomly. If A wants to decipher the challenge ciphertext, he needs to obtain keys D4′, D5′ of dskB-i and D3′ of dskA-i. Namely, Dj can be achieved from 〈uidi′,Hi′,zi′,ri′=0〉, and D2 can be obtained from 〈uidi,Hi,zi,ri=1〉. Therefore, we could formalize the above theory evidence as Qzi′=(Hi)βver and we have the equation gdzi′=gb·zi·βver. B finally outputs gb/d=gzi′/ziβver as the solution of DCDH problem.
Provided thatA makes l1 Type-A queries and l2 Type-B queries, the probability that B does not return ⊥ in Phase 1 is ϵl1·(1-ϵ)l2. The equation value reaches maximum when ϵ=1/2. Also, the probability that B always selects correct dskA-i, dskB-i is 1/l1l2. Therefore, it is very easy to compute B′s advantage at most ε/2l1+l2·l1·l2.
Analysis. In our security model, we define the attack capability for an adversary A who can not only get private keys (transformation key) that satisfy the access policy, the version not being the current version, but also can receive private keys (transformation key) that do not satisfy the access policy, the version being the current version. The aforementioned statements imply that if the adversary can break our scheme, she/he can of course get(24)dskS=D1=gs1α+r/θ+σ·vs1,D2=σ,D3=gas1/θ·Pziβvers1/θ,L=gs1,Kx=Hs1xx∈S∧x=ϱkfrom dskA,i and (25)dskgid=D4=Qs2,D5=Qzis2,D6=gs2r·H∗s2τ·vθ+σs2,D7=gs2τfrom dskB,i. These two private keys would be used to decrypt the challenge ciphertext as follows: (26)T1′=T1s1=eC2′,D3′eΠk∈ICkωk,L′·Πk∈IeFkωk,Kϱk′=eg,Pβverzit2,T2′=T2s2=eC1′′,D6′eC3′,D7′=eg,gt1r·eg,vθ+σt1,E1′=E1s1=eC1′′D2′C1′,D1′=eg,gt1α+reg,vθ+σt1,E2′=E2s2=eC2′′,D4′=eg,Qt2,E3′=E3s2=eC2′′,D5′=eg,Qzi′s2t2.If an adversary A can break our scheme, then the adversary A can compute (27)key=E1′·E3′T1′·T2′·E2′=eg,gαt1·eg,Qzi′t2·eg,Qt2eg,Pziβvert2.And the key can successfully decipher the challenge ciphertext. That is to say, we can obtain key=e(g,g)αt1·e(g,Q)zi′t2·e(g,Q)t2/e(g,P)ziβvert2=e(g,g)αt1e(g,Q)t2. Therefore, we can get the equation e(g,Q)zi′t2=e(g,P)ziβvert2. If the adversary can break our scheme such that Qzi′=Pziβver, the result gb/d=gzi′/ziβver can be taken as his/her answer.


## 7. Performance Analysis

In this chapter, the performance of our system is first theoretically evaluated concerning the computational overhead of key update, decryption for DSP and user, and communication cost, and the quantitative analysis of our scheme then is given compared to previous Li et al.’s scheme [24].In Li et al.’s proposed scheme [24], the private keys have not been blinded, but partially, to be delivered to the trusted third party (DSP) to transform the original ciphertext into a simple ciphertext. Once receiving the transformed ciphertexts, the decryptor can easily recover the plaintext message without checking the correctness of transformed ciphertexts. However, it is not suitable for real outsourced applications because the third party is generally assumed as an untrusted one. In our proposed scheme, the private keys, first blinded by GenTK algorithm, are divided into the transformation key and retrieval key. After that, the blinded transformation key is sent to the untrusted third party (DSP) to translate the complex ciphertext into a simple one. Finally, once partial decrypted ciphertexts are verified as true, the plaintext message can be recovered by the retrieval key.We express byP, EG, and EGT the time to a pairing computation, an exponentiation in G, and an exponentiation in GT, respectively (other operations are ignored). From Table 2, we can learn that the computational cost of user’s decryption key updating in Li et al.’s [24] follows a linear relationship with the number of attributes while the corresponding cost in our scheme only achieves constant. As for the time-cost of decryption (for server or user), from Table 2, we explicitly learn that the time-efficiency for decryption for DSP in ours is higher than Li et al.’s [24], which indirectly illustrates that the efficiency for decryption for user in ours is higher than Li et al.’s [24] without outsourcing. Besides, our scheme achieves a similar time-efficiency for decryption for user with outsourcing as Li et al.’s [24]. Moreover, our scheme provides the verifiable property of outsourcing while the scheme in Li et al.’s [24] fails. For the communication overhead, our scheme and Li et al.’s [24] also have an approximate size in terms of the ciphertext size and the transformed ciphertext size. Besides, both our scheme and Li et al.’s [24] scheme feature the property of revocation by incorporating the ciphertext update and key update function such that any legitimate users in group can access the data from other data owners in the community. Moreover, revoked users cannot read the encrypted data again even if they intend to collude their attributes with other legitimate group users or revoked group users.Table 2
Comparison of performances.
Scheme
Key update (user)
Decryption (server)
Decryption (user)
Ciphertext Size
Transformed ciphertext size
Access policy
Revocation
Verifiability
Scheme [24]
(
l
+
1
)
E
G
(
2
l
+
5
)
P
+
l
E
G
T
4EGT
2l+4G+GT+2Zp
5GT
Access tree
√
×
Our Scheme
3
E
G
(
l
+
7
)
P
+
(
2
l
+
1
)
E
G
2
E
G
+
5
E
G
T
2
l
+
6
G
+
G
T
+
2
Z
p
G+6GT
LSSS
√
√
Abovel refers to an LSSS access structure with an l×n matrix.Quantitative analyses for ours and Li’s [24] are given as follows. Here we use the experimental results in [35] on MICA2. The experiment in Shim et al.’s [35, 36] is based on a super-singular curve z2+z=x3+x. Table 3 shows the sizes as well as exponentiation and pairing computational time-cost of the elements at an 80-bit security level. Each value in Table 3 was measured based on pabe toolkit and Pairing-Based Cryptography (PBC) library [37] using an Intel(R) Core(TM) i5-4460 CPU @3.2 GHz and 4 G ROM running Windows XP system and VC++ 6.0. From Table 3, the time-costs to calculate a pairing, an exponentiation in G, and an exponentiation in GT need to take 1.9 s, 0.81 s, and 0.9 s. The computational times in ours are 2.43 s, (3.52l+14.92) s, and 6.12 s in terms of user’s key updating, decryption for server, and decryption for user. However, the values in Li’s [24] are (0.81l+0.81) s, (4.7l+9.5) s, and 3.6 s. For communication cost, assuming |gid| = 80 bits, according to [35], the element in group G and group GT can be reduced to 34 bytes and 136 bytes by accessing standard compression technique [35]. Therefore, the communication cost in Li et al.’s [24] and ours can be denoted as (2∗l+4)∗34+136+2∗32=(64l+336) bytes and 5∗136=618 bytes and (2l+6)∗34+136+2∗32=(64l+404) bytes and 6∗136+34=850 bytes, respectively.Table 3
Sizes and time-costs.
Z
p
∗
G
G
T
E
G
E
G
T
P
Byte
34 bytes
136 bytes
0.81 s
0.9 s
1.9 sFrom Figure3(a), we could find that the efficiency of the user’s decryption key updating in our scheme obviously outperforms Li et al.’s [24]. As depicted in Figure 3(b), the performance in ours is better than Li et al.’s [24] without outsourcing. Importantly, our scheme has a similar efficiency to Li et al.’s [24] with achieving the feature of outsourcing. As illustrated in Figure 3(c), communication cost under the same condition in ours and Li et al.’s [24] has an approximate size performance.Figure 3
(a) Comparison of the time-costs for key update. (b) Comparison of the decryption time-costs. (c) Communicational cost comparison of the ciphertext.
(a)
(b)
(c)


## 8. Conclusion

In our paper, we suggested a secure and efficient attribute-based encryption scheme applied to construct an online healthcare social network. With our proposed ABE scheme, we enabled supporting dynamic social group securely and efficiently; when users (i.e., mobile patients or mobile physicians) were revoked from the social group, after updating ciphertext and secret keys with the aid of PHI cloud storage server, revoked users could not access the cloud again even if they colluded their attributes with other legitimate social group users. Moreover, a lightweight decryption efficiency could be achieved by employing the technique of verifiable outsourcing; thus mobile patients or mobile physicians could effectively share personal health information or medical treatment experience with other users. Finally, the security proof and experiment simulations illustrated that our scheme was selective IND-CPA secure and practical.



---

*Source: 7514867-2017-05-28.xml*