# Privacy Protection of Task in Crowdsourcing: Policy-Hiding and Attribute Updating Attribute-Based Access Control Based on Blockchain

Authors: Kunwei Yang; Bo Yang; Yanwei Zhou; Tao Wang; Linming Gong
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Crowdsourcing is a new way to solve complex problems by using human intelligence. However, the tasks and user information privacy concerned in crowdsourcing have not been adequately addressed. It is necessary to design a privacy protection mechanism for tasks that need to be restricted to specific user groups. Ciphertext-policy attribute-based encryption (CP-ABE) is an efficient and feasible cryptographic tool, particularly for crowdsourcing systems. The encryptor can choose the access policy independently, which limits the scope of decryption users. At present, most CP-ABE schemes adopt a centralized management platform, which poses problems such as high trust-building costs, DDoS attacks, and single point of failure. In this paper, we propose a new access control scheme based on CP-ABE and blockchain, which has the properties of policy hiding and attribute updating. To protect the privacy of worker’s attributes, we adopt a test algorithm based on a fully homomorphic cryptosystem to confidentially judge whether the worker’s attribute lists match the hidden attributes policy in ciphertext or not before the decryption. Experiment results and comprehensive comparisons show that our mechanism is more flexible, private, and scalable than existing schemes.


---

## Body

## 1. Introduction

With the rapid development of science and technology, a new generation of information technology represented by 5G, Internet of Things, edge intelligence, and blockchain has emerged, which has realized a comprehensive link between people, machines, and things, and built new infrastructure, application mode, industrial ecology, and service system [1–7]. In the application of new technologies, people are most concerned about information security and privacy protection. Researchers have conducted extensive and in-depth research in many fields to promote the healthy development of related application technologies [8–13].In recent years, crowdsourcing as a distributed problem-solving model has been widely concerned by researchers. As in Figure1, the model consists of three parties: requesters, workers, and a crowdsourcing platform. Requester submits tasks through the crowdsourcing platform. Workers get tasks from the platform and get corresponding rewards after completing tasks. At present, many crowdsourcing applications are widely used, such as UBER and Waze [14]. These applications have been integrated into many aspects of daily life.Figure 1
The model of crowdsourcing.Due to the diversity of perceptual tasks, it is necessary to select appropriate policies for the privacy protection of specific perceptual tasks. However, the traditional crowdsourcing systems based on a centralized management platform have the following weaknesses. First, it is vulnerable to DDoS attacks, remote hijackings, and so on. Second, there is a potential danger of a single point of failure. Third, users’ sensitive information and task solutions are exposed to the risks of leakage. Fourth, from the perspective of privacy protection, it is impossible to implement the task hiding publishing mechanism within a limited receiver scope. The above problems seriously restrict the development of crowdsourcing system applications.To solve these problems, we use blockchain [15] and CP-ABE [16] technologies to construct a credible task hiding access control mechanism in crowdsourcing. By using cryptography, timestamps, consensus mechanism, and incentives mechanism, blockchain enables point-to-point transaction and collaboration. Applying blockchain technology to a crowdsourcing system solves problems such as trust, incentive, and decentralization. CP-ABE is a branch of ABE mechanism [17], in which the access control policy is determined by an encryptor. The user’s decryption key is associated with its own attribute set, which can be decrypted correctly only when the user attributes meet the policy requirements. Due to this special property, CP-ABE has been widely used in various scenarios.In this paper, we integrate blockchain with CP-ABE cryptosystems to implement an access control mechanism for task privacy publishing. The main innovations of this paper are summarized as follows.(i)
We propose a new access control mechanism based on blockchain under the crowdsensing system, which has decentralized, fine-grained, flexible, and security features. It can be applied in the task distribution phase that ensuring crowdsourcing tasks can only be accessed by users who meet the requirements of the access policy. The system establishes a secure way to exercise access control between requesters and workers, which is more suitable for complex crowdsensing systems than other schemes(ii)
We propose a new CP-ABE scheme with policy hiding property. In the encryption phase, the access policy is not displayed in the ciphertext tuple, which ensures the privacy of the access policy. Different from the present CP-ABE schemes, in which decryptors need to do excessive calculations to determine whether their attributes meet the access policy in the decryption phase, the new scheme adds a test phase before the decryption. With much less computation than decryption itself, the test uses a fully homomorphic cryptosystem to ensure the privacy of policy and attributes(iii)
Our CP-ABE scheme features attribute updating. It is very flexible to add new attributes in the access policy because we can only generate the public key parameters for the new attributes and the existing public key can remain unchanged. To decrypt the ciphertext with newly added attributes in the access policy, the decryptors must obtain a new secret key including the newly added attributes again. The feature of attribute updating can greatly improve the flexibility and scalability of our schemeThe remainder of the paper is organized as follows. In Section2, we present the related work. The preliminaries are given in Section 3, an overview of the new access control system in Section 4. Section 5 describes the proposed system, including an access control mechanism and a CP-ABE scheme. We analyze the security of our access control system in Section 6 and make comparisons and performance evaluation of our scheme in Section 7. The last section is the conclusion.


## 2. Related Work

In a heterogeneous and complex network environment, research on access control technology is heading towards the direction of fine granularity, which takes into consideration users, resources, operation, environment, and other factors. In this section, we would introduce some related work in the field of blockchain-based access control and CP-ABE schemes.


### 2.1. Blockchain-Based Access Control

Because of the low management efficiency, lack of flexibility, poor scalability, and other problems existing in the current centralized access control mechanism, researchers began to pay attention to the blockchain-based access control mechanism. [18] proposed a privacy-preserving authorization management framework for IoT by using blockchain that enables users to own and control their data. The data access control is implemented through a series of transactions that are used to grant, get, delegate, and revoke access. [19] realized the transfer of user rights through blockchain transactions and stores the transaction results on the blockchain to ensure that the executed access authorization operation cannot be denied. In view of the data privacy problem of cloud, [20] proposed a fine-grained access control scheme based on the blockchain model and attribute-based cryptosystem, which has the nature of privacy-preserving and user-controlled. In the scheme, a smart contract is used to ensure the scalability of the access control. [21] proposed an access management system for cloud federations. It allows federated organizations to enforce attribute-based access control policies on their data in a privacy-preserving fashion. By using blockchain and Intel SGX trusted hardware, the integrity of the policy evaluation process in the scheme is ensured. To address the problem that roles are used across organizations in the network, [22] used smart contract as the trusted basis in access control and employed the challenge-response mechanism to realize the verification of user roles. [23] proposed a blockchain-based big data access control mechanism based on the attribute-based access control (ABAC) model. To ensure the tamper-resistant, auditability, and verifiability of access control information, the scheme described a transaction-based access control policy and entity attribute information management method. [24] proposed an access control model called timely CP-ABE, where the user legitimacy is verified by blockchain nodes and file sharing is based on a CP-ABE scheme that adds temporal dimension. [25] proposed an access control mechanism in a smart grid scenario based on an identity-based combined encryption, signature, and signcryption scheme. A new consensus algorithm in the power system is designed to solve the key escrow problem. [26] proposed to define an access control system that guarantee the auditability of access control policy evaluation. The core idea of the scheme is to codify access control policies as smart contracts and deploy them on a blockchain. In this way, the decision process of the policy can be executed automatically. By using CP-ABE, [27] proposed a ciphertext policy and attribute hiding access control scheme based on blockchain. To ensure the attribute privacy during authorization validation, they use the ElGamal cryptosystem [28] to secretly match user attributes and access policies. However, we point out that the ElGamal cryptosystem does not have additive homomorphism; so, there are loopholes in the access policy match phase. In addition, the scheme adopts a secure channel to transmit secret key, which increases the communication cost.


### 2.2. CP-ABE Schemes

The notion of ABE was first introduced by Sahai and Waters in [17], where both ciphertexts and secret keys are associated with sets of attributes. There are two variants of ABE: key-policy ABE (KP-ABE) [29] and ciphertext policy ABE (CP-ABE) [16]. In a KP-ABE scheme, the decryption key is associated with an access policy, and the ciphertext is associated with a set of attributes. In the decryption phase, the ciphertext can be decrypted if and only if the attribute set of the ciphertext satisfies the access policy of the decryption key. On the contrary, in a CP-ABE scheme, the ciphertext is associated with an access policy, and the decryption key is generated over a set of attributes. CP-ABE is perfectly suitable for fine-grained access control environments because it enables data owners to formulate and enforce access policies themselves.Since [17] proposed the first CP-ABE scheme, researchers have proposed many specific CP-ABE schemes. In the CP-ABE mechanism, the more complex the policy, the more complicated the system is designed, and the more difficult to obtain the security proof of the mechanism. Researches on CP-ABE focus mainly on the design of access policy, which is generally classified into AND gates, access tree, and LSSS matrix. Cheung and Newport [30] presented a CP-ABE-based AND gates that is proven to be secure under the standard model. Subsequently, Nishide et al. [31] and Emura et al. [32] realized policy hiding and efficiency improvement, respectively, on the basis of the scheme [30]. Lai et al. [33] proposed a ciphertext policy hiding CP-ABE scheme, which can be expressed as AND gates on multivalued attributes with wildcards, and proved that it is fully secure. Different from the above types, there are many CP-ABE schemes [16, 34–36] with tree, linear secret sharing scheme (LSSS), and 0-1 coding as access structures, which have strong policy expression ability. For application scenarios that access policies need to be hidden and updated, many anonymous ABE schemes [27, 37–39] have been proposed. In an anonymous ABE, the access policy is hidden so that the user has no idea about the attribute content in the policy. However, most previous schemes cannot securely add new attributes in the access policy because these schemes have a common flaw that a decryptor can combine all old secret key components to reconstruct the exponent for decryption.


## 2.1. Blockchain-Based Access Control

Because of the low management efficiency, lack of flexibility, poor scalability, and other problems existing in the current centralized access control mechanism, researchers began to pay attention to the blockchain-based access control mechanism. [18] proposed a privacy-preserving authorization management framework for IoT by using blockchain that enables users to own and control their data. The data access control is implemented through a series of transactions that are used to grant, get, delegate, and revoke access. [19] realized the transfer of user rights through blockchain transactions and stores the transaction results on the blockchain to ensure that the executed access authorization operation cannot be denied. In view of the data privacy problem of cloud, [20] proposed a fine-grained access control scheme based on the blockchain model and attribute-based cryptosystem, which has the nature of privacy-preserving and user-controlled. In the scheme, a smart contract is used to ensure the scalability of the access control. [21] proposed an access management system for cloud federations. It allows federated organizations to enforce attribute-based access control policies on their data in a privacy-preserving fashion. By using blockchain and Intel SGX trusted hardware, the integrity of the policy evaluation process in the scheme is ensured. To address the problem that roles are used across organizations in the network, [22] used smart contract as the trusted basis in access control and employed the challenge-response mechanism to realize the verification of user roles. [23] proposed a blockchain-based big data access control mechanism based on the attribute-based access control (ABAC) model. To ensure the tamper-resistant, auditability, and verifiability of access control information, the scheme described a transaction-based access control policy and entity attribute information management method. [24] proposed an access control model called timely CP-ABE, where the user legitimacy is verified by blockchain nodes and file sharing is based on a CP-ABE scheme that adds temporal dimension. [25] proposed an access control mechanism in a smart grid scenario based on an identity-based combined encryption, signature, and signcryption scheme. A new consensus algorithm in the power system is designed to solve the key escrow problem. [26] proposed to define an access control system that guarantee the auditability of access control policy evaluation. The core idea of the scheme is to codify access control policies as smart contracts and deploy them on a blockchain. In this way, the decision process of the policy can be executed automatically. By using CP-ABE, [27] proposed a ciphertext policy and attribute hiding access control scheme based on blockchain. To ensure the attribute privacy during authorization validation, they use the ElGamal cryptosystem [28] to secretly match user attributes and access policies. However, we point out that the ElGamal cryptosystem does not have additive homomorphism; so, there are loopholes in the access policy match phase. In addition, the scheme adopts a secure channel to transmit secret key, which increases the communication cost.


## 2.2. CP-ABE Schemes

The notion of ABE was first introduced by Sahai and Waters in [17], where both ciphertexts and secret keys are associated with sets of attributes. There are two variants of ABE: key-policy ABE (KP-ABE) [29] and ciphertext policy ABE (CP-ABE) [16]. In a KP-ABE scheme, the decryption key is associated with an access policy, and the ciphertext is associated with a set of attributes. In the decryption phase, the ciphertext can be decrypted if and only if the attribute set of the ciphertext satisfies the access policy of the decryption key. On the contrary, in a CP-ABE scheme, the ciphertext is associated with an access policy, and the decryption key is generated over a set of attributes. CP-ABE is perfectly suitable for fine-grained access control environments because it enables data owners to formulate and enforce access policies themselves.Since [17] proposed the first CP-ABE scheme, researchers have proposed many specific CP-ABE schemes. In the CP-ABE mechanism, the more complex the policy, the more complicated the system is designed, and the more difficult to obtain the security proof of the mechanism. Researches on CP-ABE focus mainly on the design of access policy, which is generally classified into AND gates, access tree, and LSSS matrix. Cheung and Newport [30] presented a CP-ABE-based AND gates that is proven to be secure under the standard model. Subsequently, Nishide et al. [31] and Emura et al. [32] realized policy hiding and efficiency improvement, respectively, on the basis of the scheme [30]. Lai et al. [33] proposed a ciphertext policy hiding CP-ABE scheme, which can be expressed as AND gates on multivalued attributes with wildcards, and proved that it is fully secure. Different from the above types, there are many CP-ABE schemes [16, 34–36] with tree, linear secret sharing scheme (LSSS), and 0-1 coding as access structures, which have strong policy expression ability. For application scenarios that access policies need to be hidden and updated, many anonymous ABE schemes [27, 37–39] have been proposed. In an anonymous ABE, the access policy is hidden so that the user has no idea about the attribute content in the policy. However, most previous schemes cannot securely add new attributes in the access policy because these schemes have a common flaw that a decryptor can combine all old secret key components to reconstruct the exponent for decryption.


## 3. Preliminaries

In this section, we showcase the associated basic knowledge. See Table1 for the notations used herein.Table 1
Notation description.
NotationsDescriptionsG,GTTwo cyclic multiplicative groupsU=A1,A2,⋯,AnThe attribute universeAAn attribute setℙAn access policyAiAn attributekA security parameterB.PKA public key registered in blockchainB.SKA private key registered in blockchainPKA public key in CP-ABESKA secret key in CP-ABEMSKA master secret key in CP-ABEMTask informationE·A fully homomorphic cryptosystemHA collision-free hash functionCTA CP-ABE ciphertextTxA transaction on the blockchain


### 3.1. Blockchain

Blockchain was originally known as the underlying technology of Bitcoin. It was not until 2015 that blockchain became a prominent concept by researchers. Consisting of peer-to-peer (P2P) network, consensus protocol, transaction, smart contract, and a series of other technologies, blockchain can provide a trusted and distributed network environment. This new technology has solved the security risks brought by the centralization model. Applications based on blockchain technology can provide a new direction to reduce the middleman role.


#### 3.1.1. P2P Network

Unlike the traditional client/server mode, the P2P network is a net system in which information is exchanged entirely by nodes without a central server. In a P2P network, blockchain nodes can join and exit freely, and the network system can expand and shrink freely.


#### 3.1.2. Consensus Protocol

The consensus mechanism is the cornerstone of blockchain and an important guarantee for the security of the blockchain system. It can be used to solve the consistency problem caused by block distributed storage. The consensus mechanism is the foundation for building trust in the blockchain and contains an incentive mechanism for the effective operation of the blockchain system. The common consensus protocol includes POW [15], POS [40], BFT [41], and mixture of various mechanisms.


#### 3.1.3. Transaction

Blockchain adopts a transaction data model composed of input, output, and digital signature to ensure that every transaction can be tracked. Merkel hash tree is used to package and aggregate all transaction information in a period of time to ensure that the transaction data will not be tampered.


#### 3.1.4. Smart Contract

The concept of smart contract was put forward by Nick Szabo [42] in 1994. It is a computer program that executes and verifies the contract in an information way. The birth of blockchain provides a credible execution environment for smart contracts and accelerates the development of smart contracts. At the same time, the application of smart contracts expands blockchain technology from the earliest monetary system to a wider range of practical application scenarios.


### 3.2. Attribute and Access Structure

We define the attribute and access structure as provided in [43]. Let U=A1,A2,⋯,An represent the attribute universe and A represent the user’s attribute set, where A⊂U. In this paper, we use n-bit string a1a2⋯an to represent the user’s attribute information.
(1)ai=1,Ai∈A,ai=0,Ai∉A.For instance, letn=5. A=10011 means that the attribute set consists of the attributes A1,A4,A5.We also represent the access policyℙ with an n-bit string b1b2⋯bn defined as follows.
(2)bi=1,Ai∈ℙ,bi=0,Ai∉ℙ.For instance, letn=5. The ℙ=10111 means the access policy ℙ requires A1,A3,A4,A5 attributes.In the attribute universe, each ofAi can be represented in terms of a group element gi∈G, where G is a cyclic group of order N. There is a αi∈ZN∗ that satisfies gi=gαi. Let us assume that the ℙ has z elements equal to 1. We compute A·ℙ=a1b1+a2b2+⋯+anbn. This implies that if an attribute set A fulfills the access policy ℙ, then A·ℙ must be z. On the contrary, if A does not fulfills ℙ, the result of A·ℙ must be less than z.


### 3.3. Fully Homomorphic Cryptosystem

The concept of fully homomorphic encryption [44] was proposed by Rivest et al. in 1970s, and it has become an important technology to solve the security problem arising in cloud service. The way to construct such schemes has been a hard problem for cryptographers. The first fully homomorphic cryptosystem based on ideal lattice was proposed by [45]. This scheme can perform any computation on the encrypted data without decrypting and does not affect the confidentiality of the data. The fully homomorphic cryptosystem means that it satisfies the properties of both additive and multiplicative homomorphisms simultaneously. It can be expressed by the following formula.
(3)fEm1,Em2,⋯,Emk=Efm1,m2,⋯,mk.Iff is an arbitrary function, it is called fully homomorphic encryption.


### 3.4. Composite Order Bilinear Groups

The concept of composite order bilinear groups was proposed in [46]. In this paper, we select two prime numbers of equal length as the order of two subgroups of group G.LetG1κ be a group generation algorithm and κ denote a security parameter. The algorithm outputs public parameters G=g,p,r,G,GT,e·,·, such that (1) g is a generator of G, (2) G and GT are two multiplicative cyclic groups of prime order N=pr, and (3) e:G×G⟶GT denotes a computable bilinear map that satisfies the following properties:
(i)
Bilinearity:eua,vb=eu,vab, for all a,b⟵RℤN∗ and u,v⟵RG(ii)
Nondegeneracy:eg,g≠1GT, where 1GT is the generator of GT(iii)
Computability: given the elementsv,u∈G, eu,v can be computed efficientlyFurthermore, letGp,Gr denote two subgroups of G with order p, r, and hp∈Gp, hr∈Gr. Then, we have ehp,hr=1.


### 3.5. Complexity Assumptions

Let the definition ofG=g,N,p,r,G,GT,e·,· be the same as above, and S be an adversary whose purpose is to solve DBDH problem.Definition 1. (DBDH problem).
For the exponentsa,b,c,z randomly selected from ℤN∗, two tuples T1=g,ga,gb,gc,eg,gabc and T0=g,ga,gb,gc,eg,gz are computationally indistinguishable. The advantage of adversary S in solving DBDH problem is defined as
(4)AdvSDBDHκ=PrST1=1−PrST0=1.
We say that the DBDH assumption holds if for all adversariesS, we have
(5)AdvSDBDHκ≤neglκ.


### 3.6. Definition of CP-ABE Scheme

A CP-ABE scheme consists of Setup, Encrypt, KeyGen, and Decrypt algorithms. The specific process is as follows.Setup1κ: the setup algorithm takes the security parameter κ as input and outputs a public key PK and a master secret key MKKeyGenMK,A: given the master secret key MK and an attribute list A, the keyGen algorithm returns a secret key SKAEncryptPK,M,ℙ.: given PK, a message M, and an access policy ℙ, the encrypt algorithm returns a ciphertext CTDecryptCT,SKA: given a ciphertext CT and a secret key SKA, the decrypt algorithm returns the message M if A⊨ℙ. Otherwise, it returns ⊥ with overwhelming probabilitySetup1κ: the setup algorithm takes the security parameter κ as input and outputs a public key PK and a master secret key MK


### 3.7. Security Model for CP-ABE

In this paper, we use the security model proposed by [30]. A CP-ABE scheme is secure against chosen plaintext attacks (CPA) if no probabilistic polynomial time adversary has a nonnegligible advantage in the following game.
(i)
Init: the adversary defines the target access policyℙ and sends it to the challenger(ii)
Setup: the challenger executes the setup algorithm and sendsPK to the adversary(iii)
Phase 1: the adversary makes key generation queries by submitting an attribute listA. The challenger answers with a secret key SKA if A⊨ℙ. The process can be repeated adaptively(iv)
Challenge: the adversary selects two equal-length messagesM0 and M1 and sends them to the challenger. After selecting a random bit μ∈0,1, the challenger generates a ciphertext CT by encrypting Mμ with ℙ. Then, it sends CT to the adversary(v)
Phase 2: the adversary makes key generation queries, and the challenger answers as Phase 1(vi)
Guess: finally, the adversary outputs a guessμ′∈0,1. If μ′=μ, the challenger outputs 0; otherwise, it outputs 1


## 3.1. Blockchain

Blockchain was originally known as the underlying technology of Bitcoin. It was not until 2015 that blockchain became a prominent concept by researchers. Consisting of peer-to-peer (P2P) network, consensus protocol, transaction, smart contract, and a series of other technologies, blockchain can provide a trusted and distributed network environment. This new technology has solved the security risks brought by the centralization model. Applications based on blockchain technology can provide a new direction to reduce the middleman role.


### 3.1.1. P2P Network

Unlike the traditional client/server mode, the P2P network is a net system in which information is exchanged entirely by nodes without a central server. In a P2P network, blockchain nodes can join and exit freely, and the network system can expand and shrink freely.


### 3.1.2. Consensus Protocol

The consensus mechanism is the cornerstone of blockchain and an important guarantee for the security of the blockchain system. It can be used to solve the consistency problem caused by block distributed storage. The consensus mechanism is the foundation for building trust in the blockchain and contains an incentive mechanism for the effective operation of the blockchain system. The common consensus protocol includes POW [15], POS [40], BFT [41], and mixture of various mechanisms.


### 3.1.3. Transaction

Blockchain adopts a transaction data model composed of input, output, and digital signature to ensure that every transaction can be tracked. Merkel hash tree is used to package and aggregate all transaction information in a period of time to ensure that the transaction data will not be tampered.


### 3.1.4. Smart Contract

The concept of smart contract was put forward by Nick Szabo [42] in 1994. It is a computer program that executes and verifies the contract in an information way. The birth of blockchain provides a credible execution environment for smart contracts and accelerates the development of smart contracts. At the same time, the application of smart contracts expands blockchain technology from the earliest monetary system to a wider range of practical application scenarios.


## 3.1.1. P2P Network

Unlike the traditional client/server mode, the P2P network is a net system in which information is exchanged entirely by nodes without a central server. In a P2P network, blockchain nodes can join and exit freely, and the network system can expand and shrink freely.


## 3.1.2. Consensus Protocol

The consensus mechanism is the cornerstone of blockchain and an important guarantee for the security of the blockchain system. It can be used to solve the consistency problem caused by block distributed storage. The consensus mechanism is the foundation for building trust in the blockchain and contains an incentive mechanism for the effective operation of the blockchain system. The common consensus protocol includes POW [15], POS [40], BFT [41], and mixture of various mechanisms.


## 3.1.3. Transaction

Blockchain adopts a transaction data model composed of input, output, and digital signature to ensure that every transaction can be tracked. Merkel hash tree is used to package and aggregate all transaction information in a period of time to ensure that the transaction data will not be tampered.


## 3.1.4. Smart Contract

The concept of smart contract was put forward by Nick Szabo [42] in 1994. It is a computer program that executes and verifies the contract in an information way. The birth of blockchain provides a credible execution environment for smart contracts and accelerates the development of smart contracts. At the same time, the application of smart contracts expands blockchain technology from the earliest monetary system to a wider range of practical application scenarios.


## 3.2. Attribute and Access Structure

We define the attribute and access structure as provided in [43]. Let U=A1,A2,⋯,An represent the attribute universe and A represent the user’s attribute set, where A⊂U. In this paper, we use n-bit string a1a2⋯an to represent the user’s attribute information.
(1)ai=1,Ai∈A,ai=0,Ai∉A.For instance, letn=5. A=10011 means that the attribute set consists of the attributes A1,A4,A5.We also represent the access policyℙ with an n-bit string b1b2⋯bn defined as follows.
(2)bi=1,Ai∈ℙ,bi=0,Ai∉ℙ.For instance, letn=5. The ℙ=10111 means the access policy ℙ requires A1,A3,A4,A5 attributes.In the attribute universe, each ofAi can be represented in terms of a group element gi∈G, where G is a cyclic group of order N. There is a αi∈ZN∗ that satisfies gi=gαi. Let us assume that the ℙ has z elements equal to 1. We compute A·ℙ=a1b1+a2b2+⋯+anbn. This implies that if an attribute set A fulfills the access policy ℙ, then A·ℙ must be z. On the contrary, if A does not fulfills ℙ, the result of A·ℙ must be less than z.


## 3.3. Fully Homomorphic Cryptosystem

The concept of fully homomorphic encryption [44] was proposed by Rivest et al. in 1970s, and it has become an important technology to solve the security problem arising in cloud service. The way to construct such schemes has been a hard problem for cryptographers. The first fully homomorphic cryptosystem based on ideal lattice was proposed by [45]. This scheme can perform any computation on the encrypted data without decrypting and does not affect the confidentiality of the data. The fully homomorphic cryptosystem means that it satisfies the properties of both additive and multiplicative homomorphisms simultaneously. It can be expressed by the following formula.
(3)fEm1,Em2,⋯,Emk=Efm1,m2,⋯,mk.Iff is an arbitrary function, it is called fully homomorphic encryption.


## 3.4. Composite Order Bilinear Groups

The concept of composite order bilinear groups was proposed in [46]. In this paper, we select two prime numbers of equal length as the order of two subgroups of group G.LetG1κ be a group generation algorithm and κ denote a security parameter. The algorithm outputs public parameters G=g,p,r,G,GT,e·,·, such that (1) g is a generator of G, (2) G and GT are two multiplicative cyclic groups of prime order N=pr, and (3) e:G×G⟶GT denotes a computable bilinear map that satisfies the following properties:
(i)
Bilinearity:eua,vb=eu,vab, for all a,b⟵RℤN∗ and u,v⟵RG(ii)
Nondegeneracy:eg,g≠1GT, where 1GT is the generator of GT(iii)
Computability: given the elementsv,u∈G, eu,v can be computed efficientlyFurthermore, letGp,Gr denote two subgroups of G with order p, r, and hp∈Gp, hr∈Gr. Then, we have ehp,hr=1.


## 3.5. Complexity Assumptions

Let the definition ofG=g,N,p,r,G,GT,e·,· be the same as above, and S be an adversary whose purpose is to solve DBDH problem.Definition 1. (DBDH problem).
For the exponentsa,b,c,z randomly selected from ℤN∗, two tuples T1=g,ga,gb,gc,eg,gabc and T0=g,ga,gb,gc,eg,gz are computationally indistinguishable. The advantage of adversary S in solving DBDH problem is defined as
(4)AdvSDBDHκ=PrST1=1−PrST0=1.
We say that the DBDH assumption holds if for all adversariesS, we have
(5)AdvSDBDHκ≤neglκ.


## 3.6. Definition of CP-ABE Scheme

A CP-ABE scheme consists of Setup, Encrypt, KeyGen, and Decrypt algorithms. The specific process is as follows.Setup1κ: the setup algorithm takes the security parameter κ as input and outputs a public key PK and a master secret key MKKeyGenMK,A: given the master secret key MK and an attribute list A, the keyGen algorithm returns a secret key SKAEncryptPK,M,ℙ.: given PK, a message M, and an access policy ℙ, the encrypt algorithm returns a ciphertext CTDecryptCT,SKA: given a ciphertext CT and a secret key SKA, the decrypt algorithm returns the message M if A⊨ℙ. Otherwise, it returns ⊥ with overwhelming probabilitySetup1κ: the setup algorithm takes the security parameter κ as input and outputs a public key PK and a master secret key MK


## 3.7. Security Model for CP-ABE

In this paper, we use the security model proposed by [30]. A CP-ABE scheme is secure against chosen plaintext attacks (CPA) if no probabilistic polynomial time adversary has a nonnegligible advantage in the following game.
(i)
Init: the adversary defines the target access policyℙ and sends it to the challenger(ii)
Setup: the challenger executes the setup algorithm and sendsPK to the adversary(iii)
Phase 1: the adversary makes key generation queries by submitting an attribute listA. The challenger answers with a secret key SKA if A⊨ℙ. The process can be repeated adaptively(iv)
Challenge: the adversary selects two equal-length messagesM0 and M1 and sends them to the challenger. After selecting a random bit μ∈0,1, the challenger generates a ciphertext CT by encrypting Mμ with ℙ. Then, it sends CT to the adversary(v)
Phase 2: the adversary makes key generation queries, and the challenger answers as Phase 1(vi)
Guess: finally, the adversary outputs a guessμ′∈0,1. If μ′=μ, the challenger outputs 0; otherwise, it outputs 1


## 4. The Specific Process of Access Control System

### 4.1. System Architecture

Our system architecture is shown in Figure2, which involves four entities, namely, requesters, workers, cloud, and blockchain.Figure 2
System architecture.Requesters need to set an access policy first and then encrypt the task information using our CP-ABE scheme. Finally, they post the ciphertext of the task to the cloud and send the ciphertext address of the task to the blockchain via a storage transaction. When the task is completed, the requester will reward workers accordingly.Workers are a group of users with different attributes who compete for the task to get rewards. The attributes of the workers determine whether the workers can get the plaintext of the task.Cloud has an extremely large storage capacity to offer data storage services. In our system, the cloud is a data storage platform for storing encrypted task information.Blockchain is a distributed platform to record relevant transaction information, which is open and transparent to requesters and workers.


### 4.2. Specific Process

Next, we describe the specific process of the system in detail.Step 1.
In the first step, the requester performs the setup algorithm of CP-ABE as follows.Setup1κ: our construction takes a security parameter κ as input and runs the group generator to get N=pr,G,GT,e, where G=Gp×Gr. It picks the generators gp of Gp. Let the attribute universe U=A1,A2,⋯,An be the set of n attributes. For each attribute Ai where 1≤i≤n, choose random values αi1≤i≤n from ZN∗, set Ai=gpαi. Algorithm selects random elements ω,β∈ZN∗. Let Y=egp,gpω and B=gpβ. The public key is PK=gp,Y,B,Ai1≤i≤n. And the master secret key is MSK=ω,β,αi1≤i≤n.Step 2.
The requester sets an access policyℙ=b1,b2,⋯,bn and encrypts the task by using Encryption algorithm.
EncryptPK,M,ℙ: the requester picks up random values ri∈ZN∗ for bi=1, set r=∑bi=1‍ri. Then, the requester computes C0=Br,C~=MYr, and Ci,1,Ci,2 as follows:(6)Ci,1,Ci,2=gpri,Airi,ifbi=1,Ti,Ti′,ifbi=0,
whereM∈GT,Ti,Ti′∈RGr. The ciphertext is CT=C0,C~,Ci,1,Ci,21≤i≤n.Step 3.
The requester uploads the ciphertext of the task to the cloud server.Step 4.
In the storage phase, the requester only needs to publish the ciphertext address of the task to the blockchain through a storage transaction, to reduce the storage cost of the blockchain. The specific process is as follows.
The requester takes (IDs,Br.SK,CT,AddressCT, ℙ,z) as input, where IDs is the identifier of the current storage transaction, AddressCT is the cloud storage address of the ciphertext CT, and z is the number of attributes in the access policy. Then, the requester makes the following calculation.
(1)
Calculate the hash value of theCT:(7)hc=HCT.(2)
Calculate the ciphertext of access policy vector encrypted by the fully homomorphic cryptosystem(8)Eℙ=Eb1,Eb2,⋯,Ebn.(3)
Calculate the hash value of the storage transaction:(9)hs=HIDs,AddressCT,z,Eℙ,hc.(4)
Use the private keyBr.SK to sign the hash value of the storage transaction. It generates a signhs.
Finally, the requester generates a transaction:(10)Txstorage=IDs,AddressCT,z,Eℙ,hc,signhsand publishes it on the blockchain.Step 5.
Workers submit an attribute authentication transaction and get attribute certification by calling smart contract SC. AA that is used to provide attribute management services for workers. Then, workers’ attributes are authenticated and endorsed by SC. AA. Meanwhile, the attributes of workers recorded on the blockchain will not change anymore.Step 6.
After getting the authentication of attributes, a worker sends the ciphertext of attributes to the blockchain via an attribute test transaction. It takesIDt,Bw.SK,A,IDs as input and makes the following calculation.
(1)
Calculate the ciphertext of the worker’s attribute vector encrypted by a fully homomorphic cryptosystem(11)EA=Ea1,Ea2,⋯,Ean.(2)
Calculate the hash value of the test transaction(12)ht=HIDt,EA,IDs.(3)
Use the private keyBw.SK to sign the hash value of the test transaction. It generates signht.
Finally, the worker generates a transaction:(13)Txtest=IDt,EA,IDs,signhtand publishes it on the blockchain.Step 7.
It can getEA, Eℙ,z through the identifier IDt and IDs. The smart contract SC.PD calculates EA×Eℙ by using the above fully homomorphic cryptosystem.
(14)EA×Eℙ=Ea1·Eb1+Ea2·Eb2+⋯+Ean·Ebn=Ea1b1+Ea2b2+⋯+Eanbn=Ez′.
Finally, the smart contract SC. PD returns the valueEz′.Step 8.
The requester decryptsEz′ to get z′. If z′=z, it can determine that the worker’s attributes satisfy the CP-ABE policy. Then, the requester will run the KeyGen algorithm to generate the CP-ABE secret key SKA. Afterwards, the requester encrypts SKA with Bw.PK and sends the ciphertext of SKA to the blockchain.
KeyGenMSK,A. Firstly, the requester selects a random s from ZN∗ and let D0=gpω+s/β. Then, for every i∈1,⋯,n, the requester picks up random values λi∈ZN∗ and computes(15)Di,1,Di,2=gps+αiλi,gpλi.
The secret keySKA=D0,Di,1,Di,21≤i≤n.Step 9.
The worker downloads the ciphertext of the task from the cloud viaCT address of Txstorage. At the same time, the worker can decrypt and obtain SKA by using Bw.SK.Step 10.
By using the private keySKA, the worker runs the decryption algorithm Decrypt to obtain the task data.
DeryptCT,SKA: the worker tries to decrypt the CT=C0,C~,Ci,1,Ci,21≤i≤n without knowing ℙ by using his SKA=D0,Di,1,Di,21≤i≤n associated with the attribute list A. The decryption process is as follows:(16)M=C~∏i=1neCi,1,Di,1eC0,D0∏i=1n‍eCi,2,Di,2=M·egp,gpω·r∏bi=1egpri,gps+αi·λiegpβ·r,gpω+s/β∏bi=1egpαi·ri,gpλi=M·∏bi=1egpri,gpsegpr,gps=M.


### 4.3. Main Idea

Through such a CP-ABE scheme, we can achieve a policy hiding, updatable, and fine-grained access control scheme in crowdsourcing. For requesters, they only want workers who meet the policy requirements to get the task. For workers, they need to do a policy test confidentially to prove whether their attributes meet the policy requirements. The implementation of policy hiding and attribute updating is as follows.To achieve the goal of policy hiding, it means that the ciphertextCT does not contain policy ℙ, and the workers can decrypt CT without knowing the access policy ℙ. As mentioned above, we use n−bit string a1a2⋯an and b1b2⋯bn to represent the user’s attribute set A and access policy ℙ, respectively. We chose a composite order group G with order N=pr. In the encrypt phase, if bi=1, let Ci,1,Ci,2 be well-formed parameters chosen from Gp. If bi=0, we set Ci,1,Ci,2 as two random elements of Gr. If an attribute Ai is required in a policy, then the worker’s attribute set must also have that attribute to be validated by SC.PD. Each worker that satisfies the attribute can obtain the decryption key. Thus, if the set of attributes for the workers meet the policy requirements, it does not need to know the access policy ℙ to complete the decryption.The attribute update feature requires that it is easy to update the attribute information in the access policy, even after the setup phase is executed. The reason the previous scheme does not have this feature is that the decryptors can use their old secret key that does not contain new attributes to decrypt the new ciphertext. These schemes have a common flaw that the decryptors may combine all old secret key components to reconstruct the exponent of the secret key for decryption. In our scheme, we embed the composition factorri of the random number r in the ciphertext tuple instead of the private key, which forces workers to obtain the private key components corresponding to all attributes specified in the new access policy. If any new attributes were added into the access policy after the workers got their private keys, they cannot decrypt correctly until getting the new secret key components.


## 4.1. System Architecture

Our system architecture is shown in Figure2, which involves four entities, namely, requesters, workers, cloud, and blockchain.Figure 2
System architecture.Requesters need to set an access policy first and then encrypt the task information using our CP-ABE scheme. Finally, they post the ciphertext of the task to the cloud and send the ciphertext address of the task to the blockchain via a storage transaction. When the task is completed, the requester will reward workers accordingly.Workers are a group of users with different attributes who compete for the task to get rewards. The attributes of the workers determine whether the workers can get the plaintext of the task.Cloud has an extremely large storage capacity to offer data storage services. In our system, the cloud is a data storage platform for storing encrypted task information.Blockchain is a distributed platform to record relevant transaction information, which is open and transparent to requesters and workers.


## 4.2. Specific Process

Next, we describe the specific process of the system in detail.Step 1.
In the first step, the requester performs the setup algorithm of CP-ABE as follows.Setup1κ: our construction takes a security parameter κ as input and runs the group generator to get N=pr,G,GT,e, where G=Gp×Gr. It picks the generators gp of Gp. Let the attribute universe U=A1,A2,⋯,An be the set of n attributes. For each attribute Ai where 1≤i≤n, choose random values αi1≤i≤n from ZN∗, set Ai=gpαi. Algorithm selects random elements ω,β∈ZN∗. Let Y=egp,gpω and B=gpβ. The public key is PK=gp,Y,B,Ai1≤i≤n. And the master secret key is MSK=ω,β,αi1≤i≤n.Step 2.
The requester sets an access policyℙ=b1,b2,⋯,bn and encrypts the task by using Encryption algorithm.
EncryptPK,M,ℙ: the requester picks up random values ri∈ZN∗ for bi=1, set r=∑bi=1‍ri. Then, the requester computes C0=Br,C~=MYr, and Ci,1,Ci,2 as follows:(6)Ci,1,Ci,2=gpri,Airi,ifbi=1,Ti,Ti′,ifbi=0,
whereM∈GT,Ti,Ti′∈RGr. The ciphertext is CT=C0,C~,Ci,1,Ci,21≤i≤n.Step 3.
The requester uploads the ciphertext of the task to the cloud server.Step 4.
In the storage phase, the requester only needs to publish the ciphertext address of the task to the blockchain through a storage transaction, to reduce the storage cost of the blockchain. The specific process is as follows.
The requester takes (IDs,Br.SK,CT,AddressCT, ℙ,z) as input, where IDs is the identifier of the current storage transaction, AddressCT is the cloud storage address of the ciphertext CT, and z is the number of attributes in the access policy. Then, the requester makes the following calculation.
(1)
Calculate the hash value of theCT:(7)hc=HCT.(2)
Calculate the ciphertext of access policy vector encrypted by the fully homomorphic cryptosystem(8)Eℙ=Eb1,Eb2,⋯,Ebn.(3)
Calculate the hash value of the storage transaction:(9)hs=HIDs,AddressCT,z,Eℙ,hc.(4)
Use the private keyBr.SK to sign the hash value of the storage transaction. It generates a signhs.
Finally, the requester generates a transaction:(10)Txstorage=IDs,AddressCT,z,Eℙ,hc,signhsand publishes it on the blockchain.Step 5.
Workers submit an attribute authentication transaction and get attribute certification by calling smart contract SC. AA that is used to provide attribute management services for workers. Then, workers’ attributes are authenticated and endorsed by SC. AA. Meanwhile, the attributes of workers recorded on the blockchain will not change anymore.Step 6.
After getting the authentication of attributes, a worker sends the ciphertext of attributes to the blockchain via an attribute test transaction. It takesIDt,Bw.SK,A,IDs as input and makes the following calculation.
(1)
Calculate the ciphertext of the worker’s attribute vector encrypted by a fully homomorphic cryptosystem(11)EA=Ea1,Ea2,⋯,Ean.(2)
Calculate the hash value of the test transaction(12)ht=HIDt,EA,IDs.(3)
Use the private keyBw.SK to sign the hash value of the test transaction. It generates signht.
Finally, the worker generates a transaction:(13)Txtest=IDt,EA,IDs,signhtand publishes it on the blockchain.Step 7.
It can getEA, Eℙ,z through the identifier IDt and IDs. The smart contract SC.PD calculates EA×Eℙ by using the above fully homomorphic cryptosystem.
(14)EA×Eℙ=Ea1·Eb1+Ea2·Eb2+⋯+Ean·Ebn=Ea1b1+Ea2b2+⋯+Eanbn=Ez′.
Finally, the smart contract SC. PD returns the valueEz′.Step 8.
The requester decryptsEz′ to get z′. If z′=z, it can determine that the worker’s attributes satisfy the CP-ABE policy. Then, the requester will run the KeyGen algorithm to generate the CP-ABE secret key SKA. Afterwards, the requester encrypts SKA with Bw.PK and sends the ciphertext of SKA to the blockchain.
KeyGenMSK,A. Firstly, the requester selects a random s from ZN∗ and let D0=gpω+s/β. Then, for every i∈1,⋯,n, the requester picks up random values λi∈ZN∗ and computes(15)Di,1,Di,2=gps+αiλi,gpλi.
The secret keySKA=D0,Di,1,Di,21≤i≤n.Step 9.
The worker downloads the ciphertext of the task from the cloud viaCT address of Txstorage. At the same time, the worker can decrypt and obtain SKA by using Bw.SK.Step 10.
By using the private keySKA, the worker runs the decryption algorithm Decrypt to obtain the task data.
DeryptCT,SKA: the worker tries to decrypt the CT=C0,C~,Ci,1,Ci,21≤i≤n without knowing ℙ by using his SKA=D0,Di,1,Di,21≤i≤n associated with the attribute list A. The decryption process is as follows:(16)M=C~∏i=1neCi,1,Di,1eC0,D0∏i=1n‍eCi,2,Di,2=M·egp,gpω·r∏bi=1egpri,gps+αi·λiegpβ·r,gpω+s/β∏bi=1egpαi·ri,gpλi=M·∏bi=1egpri,gpsegpr,gps=M.


## 4.3. Main Idea

Through such a CP-ABE scheme, we can achieve a policy hiding, updatable, and fine-grained access control scheme in crowdsourcing. For requesters, they only want workers who meet the policy requirements to get the task. For workers, they need to do a policy test confidentially to prove whether their attributes meet the policy requirements. The implementation of policy hiding and attribute updating is as follows.To achieve the goal of policy hiding, it means that the ciphertextCT does not contain policy ℙ, and the workers can decrypt CT without knowing the access policy ℙ. As mentioned above, we use n−bit string a1a2⋯an and b1b2⋯bn to represent the user’s attribute set A and access policy ℙ, respectively. We chose a composite order group G with order N=pr. In the encrypt phase, if bi=1, let Ci,1,Ci,2 be well-formed parameters chosen from Gp. If bi=0, we set Ci,1,Ci,2 as two random elements of Gr. If an attribute Ai is required in a policy, then the worker’s attribute set must also have that attribute to be validated by SC.PD. Each worker that satisfies the attribute can obtain the decryption key. Thus, if the set of attributes for the workers meet the policy requirements, it does not need to know the access policy ℙ to complete the decryption.The attribute update feature requires that it is easy to update the attribute information in the access policy, even after the setup phase is executed. The reason the previous scheme does not have this feature is that the decryptors can use their old secret key that does not contain new attributes to decrypt the new ciphertext. These schemes have a common flaw that the decryptors may combine all old secret key components to reconstruct the exponent of the secret key for decryption. In our scheme, we embed the composition factorri of the random number r in the ciphertext tuple instead of the private key, which forces workers to obtain the private key components corresponding to all attributes specified in the new access policy. If any new attributes were added into the access policy after the workers got their private keys, they cannot decrypt correctly until getting the new secret key components.


## 5. Security Analysis

Our scheme satisfies several security properties, and the specific analysis is as follows.(1)
Collusion resistance: for an attribute-based encryption scheme, it is very important to prevent collusion attacks between adversaries. In our CP-ABE scheme, to decrypt the ciphertext, adversaries have to getegpr,gps. When an adversary does not possess an attribute, he needs to conspire with a coconspirator who possesses the attribute. However, in the process of secret key generation, the private key of different adversaries uses different random numbers. By means of collusion, the adversary must get ∏ai≠0‍egpri,gps·egpri,gps∗ in the decryption phase. However, s is the random number in the adversary’s secret key, and s∗ is the random number in the coconspirator’s secret key; so, they cannot calculate egpr,gps together. That is why this scheme has the character of resisting collusion attacks(2)
Task confidentiality: this is the most basic security feature to ensure the security of the task. In our system, the task is encrypted and uploaded to the cloud server platform, which is considered to be curious. In the worst case, the cloud server platform may attempt to restore the task information; however, it either does not have a secret key or the attribute does not satisfy the access policy. Therefore, the scheme can ensure the privacy of the task(3)
Decentration: by using blockchain, we can realize an end-to-end crowdsourcing task management. In this process, requesters and workers can interact directly. It avoids DDoS attacks, single point of failure, and leakage of important data that may be encountered on a centralized management platform(4)
Policy privacy protection: in our scheme, the policy is treated as private data that need to be protected. We propose the CP-ABE with policy-hiding property. In the encryption phase, the generated ciphertext does not contain access policy information, which can protect the privacy of the policy. To authenticate the worker’s attributes, a policy test algorithm that uses a fully homomorphic cryptosystem is adopted to estimate whether the attribute lists match the hidden attributes policy in ciphertext or not before the decryption. Such an approach ensures the privacy of the policy(5)
Integrity and traceability: our scheme can ensure the integrity of task data and the traceability of access control information through blockchain. Workers can compare the hash value of the task ciphertext in the cloud server platform with the information stored in the blockchain to determine whether the task has been modified. Meanwhile, all authorization records are stored as immutable access transactions in the blockchain; therefore, no one can deny their behavior(6)
Security analysis of CP-ABE: we now prove that the above CP-ABE scheme is selectively secure under the DBDH assumptionTheorem 1.
Assume that there is a probabilistic polynomial-time adversaryS which can break out our CP-ABE scheme in a chosen plaintext attacks model with nonnegligible advantage εκ, then a simulator can be constructed to distinguish the DBDH tuple g,ga,gb,gc,eg,gabc from the random tuple g,ga,gb,gc,eg,gz with nonnegligible advantage 1/2εκ.Proof.
We first let the Sim set the security parameterκ and run the group generator to get the public parameters N=pr,gp,G,GT,e, where G=Gp×Gr,gp∈Gp. The DBDH challenger gives a DBDH tuple gp,gpa,gpb,gpc,Z∈G4×GT to Sim, where Z is either egp,gpabc or egp,gpz with equal probability. The Sim proceeds as follows:
(i)
Init: during this phase, Sim receives the challenge access policyℙ from S(ii)
Setup: to provide a public key toS, Sim sets Y to be egpa,gpb=egp,gpab. This implies ω=ab. Let the attribute universe be U=A1,A2,⋯,An, Sim chooses random α1,⋯,αn,β∈ZN∗, sets Ai=gpαi1≤i≤n and B=gpβ. Then, Sim publishes PK as in the real scheme(iii)
Phase 1:S submits a set A=a1,a2,⋯,an, providedA⊨ℙ, and it means that there is at least one k∈1,⋯,n that satisfies bk=1, but ak=0. Sim answers with a secret key SKA for A as follows:
Sim picks up random valuess′∈ZN∗. For every i∈1,⋯,n, Sim chooses random λi′∈ZN∗. It sets s=βs′−ω, and the D0 component of the secret key can be computed as D0=gpω+s/β=gps′. Sim computes the components Di,1,Di,2=gpβs′+αiλi′,gpλi′+ω/αi. When λi=λi′+ω/αi, the components Di,1,Di,2 are as follows:
(17)Di,1=gpβs′+αiλi′=gpβs′+αiλi−ωαi=gps+αiλi,Di,2=gpλi′+ωαi=gpλi.
The secret keySKA=D0,Di,1,Di,21≤i≤n.
(iv)
Challenge.S submits two challenge messages M0 and M1 of equal length. Sim chooses μ∈0,1 at random and encrypts Mμ based on ℙ. Then, sets C0=gcβ,C~=MμZ. For the policy ℙ, Sim continues chooses random values ri∈ZN∗ for bi=1, set r=∑bi=1‍ri. Obviously, Sim can compute the ciphertext components Ci,1,Ci,2 easily(v)
Phase 2: same as Phase 1(vi)
Guess:S produces a guess μ′ of μ. If μ′=μ, Sim outputs 1 and otherwise outputs 0. If Z=egp,gpabc, then CT is a valid ciphertext, in which case the advantage of S is ε. Hence,(18)Prμ′=μ∣Z=egp,gpabc−12=εk.
IfZ=egp,gpz, then C~ is completely random from the view of S. Therefore,
(19)Prμ′=μ∣Z=egp,gpz−12=neglk,
whereneglk is negligible. Hence,
(20)Prμ′=μ=PrZ=egp,gpabcPrμ′=μ∣Z=egp,gpabc+PrZ=egp,gpzPrμ′=μ∣Z=egp,gpz=1212±εk+1212±neglk=12±12εk±12neglk,AdvSCPAk=Prμ′=μ−12=12εk±neglk≈12εk.
From the above analysis, we can see that the Sim’s advantage in the DBDH game is1/2εk.


## 6. Comparisons and Efficiency Evaluation

In this section, we first make comprehensive comparisons of our scheme with related work in terms of security, efficiency, and performance features. Then, we implement our CP-ABE scheme to analyze the efficiency of the algorithm.


### 6.1. Comparisons

We make a horizontal comparison with the relevant blockchain-based access control schemes in terms of important features, including policy privacy, fine granularity, attribute update, policy test, decentration, and framework. As seen in Table2, these schemes do not consider the privacy of the policy except [27]. There is a potential problem that the attacker may infer the scope of the user group through the policy information. Centralized entities are introduced in schemes [22, 25], which results in some privacy and security concerns. Meanwhile, these three schemes can only achieve coarse-grained access control. [19, 23] support dynamic updating of policy attributes, which makes the schemes extensible. Only the scheme [27] is capable of supporting the policy test to judge whether the attribute lists match the hidden attributes policy in ciphertext or not before the decryption. However, there is an obvious mistake in the paper that the ElGamal cryptosystem does not have additive homomorphism; so, there are loopholes in the access policy match phase. Therefore, none of these blockchain-based access control schemes can support policy hiding and testing. Our scheme adopts a policy-hiding CP-ABE scheme and a fully homomorphic cryptosystem to realize policy hiding and testing. At the same time, our scheme supports attribute updating. Furthermore, a secure communication channel is not necessary anymore in our system.Table 2
Comparisons of blockchain-based access control schemes.
SchemePolicy privacyFine granularityAttribute updatePolicy testDecentration[22]×××××[23]×✓✓×✓[26]×✓××✓[25]×××××[19]×✓✓×✓[18]×✓××✓[24]×✓××✓[27]✓✓×✓✓Our✓✓✓✓✓Aiming at the efficiency problem, we compare our CP-ABE scheme with some related CP-ABE schemes. In Table3, the symbols PK, MK, SK, and CT represent the public key, the master secret key, the secret key, and the task ciphertext, respectively. We use LG, LGT, and LZp to denote the number of groups G, the target group GT, and prime group Zq, respectively. Let n, l, AA, Aℙ denote the number of attributes, the number of elements in an attribute category, the number of elements in the user A’s attribute set, and the number of attributes in the policy set. Through the horizontal comparison, we can see that under the premise of obtaining the relevant security features, our scheme does not reduce the efficiency and even outperforms the relevant schemes in terms of ciphertext size. It is better for saving storage space on the cloud.Table 3
Comparison of size of keys and ciphertext in CP-ABE scheme.
SchemePKMKSKCT[30]3n+1LG+LGT3n+1LZq2n+1LGn+1LG+LGT[31]nl+1LG+LGTnlLG+2LZq2n+1LGnl+n+1LG+LGT[17]3LG+LGTLG+LZq2AA+1LG2∣Aℙ∣+1LG+LGT[32]nl+2LG+LGTnl+1LZq2LG2LG+LGT[47]n+1LG+LGTn+1LZqAA+1LGAℙ+1LG+LGT[36]n+2LG+LGTLG∣AA∣+2LG2Aℙ+1LG+LGT[35]n+2LG+LGTLG+LZqAA+2LG2Aℙ+1LG+LGT[27]3LG+LGTLG+2LZqn+1LGnl+1LG+LGTOurn+2LG+LGTn+2LZq2n+1LG2n+1LG+LGT


### 6.2. Efficiency Evaluation

We implement our CP-ABE scheme based on pairing-based cryptography (PBC) library on a laptop with Windows 10, Intel Core i5-8250U CPU, 2.90 GHz, and 16 GB RAM. The size of public parameters and message size is important indicators to evaluate the calculated performance of a CP-ABE scheme. In this experiment, we use type A1 pairing and let the compositeN be the universe size. The composite N in our experiments consists of two prime numbers of 517 bits, which means that ZN=G=GT=1024 bits.Our main concern is how the efficiency of the scheme changes with the increase of the number of attributes. The execution result of the algorithm is shown in Figure3. For each phase, we run the algorithm 10 times and then adopt the average value. As is illustrated, the two phase algorithm time increases as the number of attributes grows. This is due to the calculation of variables in each algorithm depending on the number of attributes. Compared with other algorithms, the advantage of our algorithm is that it can support attribute update, policy hide, policy test, and other properties at the same time, while the efficiency of the algorithm does not decrease too much. Therefore, our scheme is more suitable for the crowdsourcing system with higher requirements for privacy protection.Figure 3
Performance analysis of our CP-ABE scheme.


## 6.1. Comparisons

We make a horizontal comparison with the relevant blockchain-based access control schemes in terms of important features, including policy privacy, fine granularity, attribute update, policy test, decentration, and framework. As seen in Table2, these schemes do not consider the privacy of the policy except [27]. There is a potential problem that the attacker may infer the scope of the user group through the policy information. Centralized entities are introduced in schemes [22, 25], which results in some privacy and security concerns. Meanwhile, these three schemes can only achieve coarse-grained access control. [19, 23] support dynamic updating of policy attributes, which makes the schemes extensible. Only the scheme [27] is capable of supporting the policy test to judge whether the attribute lists match the hidden attributes policy in ciphertext or not before the decryption. However, there is an obvious mistake in the paper that the ElGamal cryptosystem does not have additive homomorphism; so, there are loopholes in the access policy match phase. Therefore, none of these blockchain-based access control schemes can support policy hiding and testing. Our scheme adopts a policy-hiding CP-ABE scheme and a fully homomorphic cryptosystem to realize policy hiding and testing. At the same time, our scheme supports attribute updating. Furthermore, a secure communication channel is not necessary anymore in our system.Table 2
Comparisons of blockchain-based access control schemes.
SchemePolicy privacyFine granularityAttribute updatePolicy testDecentration[22]×××××[23]×✓✓×✓[26]×✓××✓[25]×××××[19]×✓✓×✓[18]×✓××✓[24]×✓××✓[27]✓✓×✓✓Our✓✓✓✓✓Aiming at the efficiency problem, we compare our CP-ABE scheme with some related CP-ABE schemes. In Table3, the symbols PK, MK, SK, and CT represent the public key, the master secret key, the secret key, and the task ciphertext, respectively. We use LG, LGT, and LZp to denote the number of groups G, the target group GT, and prime group Zq, respectively. Let n, l, AA, Aℙ denote the number of attributes, the number of elements in an attribute category, the number of elements in the user A’s attribute set, and the number of attributes in the policy set. Through the horizontal comparison, we can see that under the premise of obtaining the relevant security features, our scheme does not reduce the efficiency and even outperforms the relevant schemes in terms of ciphertext size. It is better for saving storage space on the cloud.Table 3
Comparison of size of keys and ciphertext in CP-ABE scheme.
SchemePKMKSKCT[30]3n+1LG+LGT3n+1LZq2n+1LGn+1LG+LGT[31]nl+1LG+LGTnlLG+2LZq2n+1LGnl+n+1LG+LGT[17]3LG+LGTLG+LZq2AA+1LG2∣Aℙ∣+1LG+LGT[32]nl+2LG+LGTnl+1LZq2LG2LG+LGT[47]n+1LG+LGTn+1LZqAA+1LGAℙ+1LG+LGT[36]n+2LG+LGTLG∣AA∣+2LG2Aℙ+1LG+LGT[35]n+2LG+LGTLG+LZqAA+2LG2Aℙ+1LG+LGT[27]3LG+LGTLG+2LZqn+1LGnl+1LG+LGTOurn+2LG+LGTn+2LZq2n+1LG2n+1LG+LGT


## 6.2. Efficiency Evaluation

We implement our CP-ABE scheme based on pairing-based cryptography (PBC) library on a laptop with Windows 10, Intel Core i5-8250U CPU, 2.90 GHz, and 16 GB RAM. The size of public parameters and message size is important indicators to evaluate the calculated performance of a CP-ABE scheme. In this experiment, we use type A1 pairing and let the compositeN be the universe size. The composite N in our experiments consists of two prime numbers of 517 bits, which means that ZN=G=GT=1024 bits.Our main concern is how the efficiency of the scheme changes with the increase of the number of attributes. The execution result of the algorithm is shown in Figure3. For each phase, we run the algorithm 10 times and then adopt the average value. As is illustrated, the two phase algorithm time increases as the number of attributes grows. This is due to the calculation of variables in each algorithm depending on the number of attributes. Compared with other algorithms, the advantage of our algorithm is that it can support attribute update, policy hide, policy test, and other properties at the same time, while the efficiency of the algorithm does not decrease too much. Therefore, our scheme is more suitable for the crowdsourcing system with higher requirements for privacy protection.Figure 3
Performance analysis of our CP-ABE scheme.


## 7. Conclusion and Future Work

In this paper, we present a privacy protection mechanism for tasks in crowdsourcing, which realizes autonomous access control by adding blockchain to avoid a series of problems faced by central institutions. To solve the privacy of crowdsourcing tasks and access policies, we propose a new CP-ABE scheme with an expressive AND gate access structure that supports policy hiding and attribute updating. At the same time, we adopt a test algorithm based on a fully homomorphic cryptosystem to confidentially judge whether the worker’s attribute lists match the hidden attributes policy in ciphertext or not before the decryption. Compared with previous schemes, our scheme has more advantages in flexibility, scalability, and privacy. In the future, we will consider an expressive and constant-size attribute-based access control based on blockchain.



---

*Source: 7787866-2022-03-24.xml*