# Novel Searchable Attribute-Based Encryption for the Internet of Things

Authors: Zhenhua Lu; Yuyan Guo; Jiguo Li; Weina Jia; Liping Lv; Jie Shen
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

As the product of the third information technology revolution, the Internet of Things (IoT) has greatly altered our way of lifetime. Cloud storage has gradually become the best choice for data processing due to its scalability and flexibility. However, the cloud is not a completely trusted entity, such as tampering with user data or leaking personal privacy. Therefore, cloud storage usually adopts attribute-based encryption schemes to accomplish data confidentiality and fine-grained access control. However, applying the ABE scheme to the Internet of Things still faces many challenges, such as dynamic user revocation, data sharing, and excessive computational burden. In this paper, we propose a novel searchable attribute encryption system that replaces the traditional key generation center with consortium blockchain to generate and manage partial keys. In addition, our scheme can perform predecryption operations in the cloud, and users only need to spend a small amount of computational cost to achieve decryption operations. Security analysis proves that our scheme achieves security under both the chosen keyword attack and the chosen plaintext attack. Compared with other schemes, this scheme is more economical in terms of computing and storage.


---

## Body

## 1. Introduction

The Internet of Things (IoT) originated in the media field, and it is an important part of the new generation of information technology. It connects all items to the Internet through information sensing devices to achieve positioning, tracking, supervision, and intelligent identification [1]. Simply put, the IoT is the Internet that connects everything. In recent years, the IoT has gradually become digitized in the real world, reduced the dispersion of information, and integrated the digital information between objects. The IoT is widely used in the fields of transportation and logistics, industrial manufacturing, medical care, and smart environments [2–7].Sahai and Waters first proposed the concept of attribute-based encryption (ABE) in 2005 [8]. Because the access structure needs to be more flexible to adapt to more application scenarios, Goyal et al. [9] and Bethencourt et al. [10], respectively, proposed the concepts of key policy ABE (KP-ABE) and ciphertext policy ABE (CP-ABE). In KP-ABE, the ciphertext is associated with a set of attributes, and the access policy is embedded in the key. In contrast, in CP-ABE, the ciphertext is associated with the access policy, and a set of attributes is embedded in the key [11–14].Although IoT has now blossomed in various fields, there are still many problems in applying ABE to the IoT. Compared with the traditional Internet, the IoT lacks standardization. In addition, the IoT itself is a complex network system involving many application domains, which is difficult to manage [15]. This makes it challenging to achieve its security and privacy. Therefore, blockchain technology is widely used in IoT for its persistence, anonymity, and auditability [16].In this article, we will present a new blockchain-aided searchable attribute-based encryption (BC-SABE) scheme. This scheme replaces a traditional centralized server using a distributed consortium blockchain consisting of a predefined set of trusted consensus nodes. Our main contributions can be summarized as follows:(i)
We present a novel BC-SABE scheme. Our scheme uses a distributed consortium blockchain containing a set of credible consensus nodes to achieve the function of key generation. Pedersen secret sharing protocol [17] and reciprocal protocol [18] are used to generate all secret parameters, which also means that the master key is not needed. Our scheme can also support keyword search under cloud assistance. Users only need to provide user identity information and partial token information to the blockchain, and the cloud server will receive the complete token from the blockchain and search for it. Moreover, the scheme can realize predecryption in the cloud, which can greatly reduce the burden of users(ii)
In our scheme, the Pedersen secret sharing protocol enables the sharing of subsecrets between consensus nodes, and each consensus node can combine the subsecrets as the master secret. And the reciprocal protocol ensures that the key information is shared without a trusted party(iii)
In addition, we use blockchain technology to realize the dynamic revocation of users. Because consensus nodes in the blockchain can use time period tags and status tags to update the user revocation list, this also means that we can use the blockchain to update the user revocation list to achieve user revocation. And our scheme does not require the user to re-encrypt the ciphertext for user revocationOur scheme can also be applied in simple medical scenarios. For example, hospital can register admission information for patient and store the admission information in the blockchain. Registered patients can enter their data and information into the cloud server. When searching for relevant information, he/she only needs to submit a partial token to blockchain, and then, blockchain can produce the complete token for him/her and send it to the cloud server for search operations. In addition, patients can access data information from the cloud, which will first generate a predecryption key for them, and the patient can fully decrypt the data with a simple calculation.The remainder of this paper is organized as follows. In Section2, we reviewed some related work, and then, we gave some preliminaries in Section 3, including the complexity assumptions, binary trees, and blockchain. The system model, system procedure, and security model are given in Section 4, and the detailed structure of the system is given in Section 5. We give the security proof of the scheme in Section 6 and compare the performance of the scheme in Section 7, and finally, we give a brief summary in Section 8.


## 2. Related Work

Since the concepts of ABE were introduced, many improved ABE schemes have been proposed, such as traceable ABE [19], anonymous ABE [20, 21], and hierarchical ABE [22–25]. However, the application of ABE to IoT is still an issue that needs to be discussed. The resources of the Internet of Things devices are limited, and most of the ABE algorithm encryption and decryption calculation costs are relatively large, so the outsourcing ABE scheme has been proposed [26–29]. In addition, IoT systems should be able to revoke malicious users and update legitimate users with new attributes. How to implement dynamic user revocation is also an issue. Liu et al. [30] proposed a direct revocation scheme; however, in this scheme, all data owners are required to maintain the revocation list. Recently, Cui et al. [31] proposed a server-aided revocable ABE scheme. This scheme outsources all the workload to the server at the time of user revocation, and each user stores only a fixed size private key.However, this single authorization ABE scheme has limited security and cannot carry a large number of IoT devices. Many multiauthorization-based ABE schemes have been proposed by scholars [32–35]. Chase [32] first presented the concept of multiauthority attribute-based encryption (MA-ABE) in 2007. Recently, Belguith et al. [34] presented a policy-hidden outsourced MA-ABE scheme, which hides the access structure to protect user privacy. In [35], a new MA-CP-ABE scheme was presented by Sethi et al. This system decentralizes authority and can support white box traceability along with outsourcing decryption.Recently, the widespread application of data sharing has deepened the academic research on searchable encryption schemes, and many searchable attribute-based encryption (SABE) schemes have also been proposed [36–44]. In [36], Miao et al. presented a multikeyword SABE scheme, which supports comparable attributes by using 0-encoding and 1-encoding. Xu et al. [37] proposed for the first time a decentralized attribute-based keyword search (ABKS) scheme for multikeyword search in cloud storage. In this scheme, data sharing and data searching can be achieved without a fully trusted central authority. Recently, a seed string searchable ABE (SSS-ABE) solution for sharing and querying encrypted data was proposed by Sun et al. [38]; data users can query the entire ciphertext by substring without presetting keywords.Blockchain technology originated from Bitcoin; the concept of blockchain was first proposed by Satoshi Nakamoto in [45]. Blockchain is a distributed shared ledger and database. Compared with the previous centralized accounting model, blockchain can achieve decentralization, which means removing the trust intermediary, which also makes the transactions on blockchain more open and transparent. Recently, Wu et al. [46] used blockchain technology to propose a privacy-protected and traceable ABE scheme, using blockchain to achieve data integrity and nonrepudiation. In [47], Pournaghi et al. proposed a scheme to share medical data based on blockchain technology and attribute-based encryption (MedSBA), which utilizes blockchain to share medical data. Recently, Liu et al. [48] presented a blockchain-aided attribute-based searchable encryption scheme, and Zheng et al. [49] proposed a fair outsourcing decryption ABE scheme utilizing blockchain and sampling technology. In [50], Guo et al. used blockchain technology to propose an efficient and traceable ABE scheme with dynamic access control, which implements dynamic access control and can flexibly update the access structure.As of late, blockchain technology has been universally exploited in ABE scheme, because compared to the traditional server structure, blockchain has no central node, which allows no single institution or member to achieve control over global data, while any node stops working without affecting the overall operation of the system. In addition, blockchain is also superior to traditional key management center in ensuring the confidentiality of data. Therefore, we adopt blockchain technology to assure the security and robustness of the system.


## 3. Preliminaries

### 3.1. Composite Order Bilinear Groups and Complexity Assumptions

First of all, the concept of bilinear group is reviewed as follows. LetG and G1 be the multiplicative groups of order N=p1p2p3, g is a generator of G, and p1,p2,p3 are three different prime. Then, e:G×G⟶G1 is a bilinear map, and it has these properties as follows:
(1)
Bilinearity: For∀x,y∈ZN, egx,gy=eg,gxy(2)
Nondegeneracy:eg,g≠1G1(3)
Computability: There is an algorithm to calculatee efficientlyNow, we show the definition of the composite order bilinear groups. It is similar to bilinear groups except the order of the group is the product of two or more distinct prime numbers. That is to say,G is a composite order group; Gp1,Gp2,Gp3 are its three subgroups of order p1,p2,p3. For ∀x∈Gpi and ∀y∈Gpj, if x≠y, then ex,y=1.Decisional linear assumption. Giveng1α,g2β,g1,g2,g3, α,β∈ZN, any probabilistic polynomial time (PPT) algorithm is difficult to distinguish g1α,g2β,g3α+β,g1,g2,g3 from g1α,g2β,g1,g2,g3,A, where g1,g2,g3,A∈G and a,b∈Zp are randomly selected.Decisional bilinear Diffie–Hellman problem (DBDH). Givengα,gβ,gγ∈G and P∈G1, any PPT algorithm is difficult to distinguish P=eg,gαβγ from P=eg,gp, where α,β,γ,p∈Zp∗.


### 3.2. Access Structure and Linear Secret Sharing Scheme (LSSS)

Definition 1.
AssumeΟ=attr1,⋯,attrn is a set of attributes, and A⊂2O is a nonempty subset of 2O, where 2O represents the set constituted by all subsets of O; that is, A is a nonempty set constituted by some subsets of O. We call A is an access structure on O. If for any P, Q satisfies the condition P∈A and P⊆Q, namely Q∈A, and then set A⊆O is monotonic. Authorized set refers to the set in A; on the contrary, the unauthorized set is not in A.Definition 2.
In the linear secret sharing matrix formed by the access policy, each row corresponds to an attribute value, that is, row vector and attribute value form a one-to-one mapping relationship. If the following two properties are satisfied, and then, a secret sharing schemeΣ on a set of Ο=attr1,⋯,attrn is called linear.
(1)
The shared secret key for each attribute is a vector formed onZp(2)
In schemeΣ, there is an n×m secret sharing matrix A, whose row label is bi, i∈1,2,⋯,n. Given a secret sharing column vector u=μ,u2,⋯,um, where μ∈Zp is the secret key to be shared, u2,⋯,um is selected at random, Au represents the vector of n shared secret keys according to Σ. Shared γi=Aui, that is the inner product Au belongs to the property bi, where b is a function that maps i∈1,2,⋯,n to biThe LSSS matrix has an important feature, that is, linear reconstruction. SupposeΣ is a LSSS scheme representing access structure A, Q∈A is an authorized set, and then, we can define T⊂n as T=i:bi∈Q. If there has constant βi∈Zpi∈T that can be discovered in polynomial time such that γi are valid shares of the secret key μ, then ∑i∈Tβiγi=μ. There is no such constant for any unauthorized set.


### 3.3. Binary Tree

First, there is a brief review of the definition of binary tree. Suppose UT represents a binary tree, in which there areL leaves corresponding to L users, the root node of BT is Rt. pathφ represents the set of all nodes on the path of leaf node φ from the root to φ. Note that φ and the root node are included here. φl, φr represents the left and right children of nonleaf nodes. The algorithm KUNodes is used to calculate the minimum set of nodes that need to release key updates, and only unrevoked users can decrypt the ciphertext within a period of time. That is, nodes in rl corresponding to time periods before or t do not have any ancestors in the set, and all other leaf nodes have exactly one ancestor in the set. Figure 1 gives the working principle of the KUNodes algorithm, where it first marks all ancestors of the revoked nodes as revoked and then outputs all unrevoked children of the revoked nodes. The Algorithm 1 is the formal definition of the KUNodes algorithm.Algorithm 1: KUNodes.
Inputs: a binary treeUT, a revocation list rl, a time period t, two empty sets P, Q.∀φi,ti∈rl, if ti≤t, then add pathφi to P.∀p∈P, if pl∉P, then add pl to Q.ifpr∉P, add pr to Q.IfQ=∅, then add Rtto Q.ReturnQ.Figure 1
The KUNodes algorithm. This shows a pictorial depiction of the algorithm.


### 3.4. Shamir Secret Sharing [51]

The Shamir secret sharing scheme is based on Lagrange interpolation polynomials, which are described as follows:(1) A trusted dealerD first randomly chooses a polynomial gx=a0+a1x+⋯+al−1xl−1 with order l-1 such that a0=s, where a1,a2,⋯,al−1 are in finite filed Fp=GFp. Then, Dcomputes s1=g1,…,sm=gm and sends si to each shareholder pi secretly(2) More thanl shareholder pr⊂p (pr≤l) work together can reconstruct the secret using the Lagrange interpolating formula


### 3.5. Pedersen (l, m) Secret Sharing [17]

The Pedersen secret sharing scheme allows each dealer (shareholder) to randomly select a secret as a subsecret and can share the subsecret with other shareholders. Therefore, each shareholder can merger all the subsecrets as the master secret. The Pedersen secret sharing scheme is described as follows:(1)
Each shareholderHi(i∈1,⋯,m) randomly independently picks a subsecret Si, and then, the master secret can be described as S=∑i=1mSi(2)
For each subsecretSi, a l-1 polynomial gx is randomly selected by shareholder Hi such that Si=gi0. After that, it calculates sij=gixj,j=1,2,⋯,m for other shareholders by using Shamir’s secret sharing. Finally, Hi sends each sij to other Hj secretly, and each shareholder Hi has m subshares sij(3)
Each shareholderHi calculates its own master share si=∑j=1msji=∑j=1mgjxi(4)
More thanl shareholders pr⊂p (pr≤l) work together can reconstruct the secret by using the Lagrange interpolating formula


### 3.6. Reciprocal Protocol [18]

Suppose that shareholdersHii∈1,⋯,m share a secret μ using Pedersen (l, m) secret sharing protocol. The role of the reciprocal protocol is to get share μ−1 without disclosing relevant message about μ and μ−1. The description of this protocol is as follows:
(1)
Shareholders jointly run the Pedersen (l, m) secret sharing scheme to generate a (l, m) sharing of a random element α∈Zq. Denote all shares α1,α2,⋯,αm as α1,α2,⋯,αm↔l,mα(2)
Shareholders jointly run the Pedersen (2l,m) secret sharing scheme to generate and retain a share of zero value βi(3)
Shareholders need to pass the valueμiαi+βi and interpolating the corresponding 2l degree polynomial to reconstruct the value η=μα(4)
Each shareholders setsδi=η−1αi to calculate it share δi of μ−1


### 3.7. Blockchain

On January 3, 2009, Satoshi Nakamoto generated the first Bitcoin block. A few days later, a second bitcoin block appeared to connect with the first block to form the chain, marking the birth of the blockchain. Because of its four main features, immutability, irreproducible uniqueness, smart contracts, and decentralized self-organization or community, blockchain is widely used in various fields.In simple terms, a hash function (SHA-256) is used to form a blockchain. Each block contains a parent block hash, a timestamp, and a Merkle root. Where the parent block hash stores the hash value of the previous block header and is used to connect the previous block, the timestamp records the approximate time when the block was created, and the Merkle root is the Merkle tree root hash generated by the transaction list. There are three general types of blockchains: public blockchains, consortium blockchains, and private blockchains. Our system uses a consortium blockchain. Figure2 illustrates the basic structure of a consortium blockchain.Figure 2
Consortium blockchain. Consensus node nodes perform the consistency protocol to renovate the blockchain.In our consortium blockchain, consensus node nodes perform the consistency protocol to renovate the blockchain and reserve all nodes in the system with a consistent state. The consortium blockchain used in our system is similar to the scheme [48] in that firstly the consensus nodes can initialize the system parameters using the Pedersen secret sharing scheme and the reciprocity protocol. Secondly, the consensus nodes manage the associated keys of the users. Updating the user revocation list requires the joint participation of all consensus nodes, which effectively improves the system security. Users can submit searches to the blockchain, and the cloud server is able to perform predecryption operations for the users.


## 3.1. Composite Order Bilinear Groups and Complexity Assumptions

First of all, the concept of bilinear group is reviewed as follows. LetG and G1 be the multiplicative groups of order N=p1p2p3, g is a generator of G, and p1,p2,p3 are three different prime. Then, e:G×G⟶G1 is a bilinear map, and it has these properties as follows:
(1)
Bilinearity: For∀x,y∈ZN, egx,gy=eg,gxy(2)
Nondegeneracy:eg,g≠1G1(3)
Computability: There is an algorithm to calculatee efficientlyNow, we show the definition of the composite order bilinear groups. It is similar to bilinear groups except the order of the group is the product of two or more distinct prime numbers. That is to say,G is a composite order group; Gp1,Gp2,Gp3 are its three subgroups of order p1,p2,p3. For ∀x∈Gpi and ∀y∈Gpj, if x≠y, then ex,y=1.Decisional linear assumption. Giveng1α,g2β,g1,g2,g3, α,β∈ZN, any probabilistic polynomial time (PPT) algorithm is difficult to distinguish g1α,g2β,g3α+β,g1,g2,g3 from g1α,g2β,g1,g2,g3,A, where g1,g2,g3,A∈G and a,b∈Zp are randomly selected.Decisional bilinear Diffie–Hellman problem (DBDH). Givengα,gβ,gγ∈G and P∈G1, any PPT algorithm is difficult to distinguish P=eg,gαβγ from P=eg,gp, where α,β,γ,p∈Zp∗.


## 3.2. Access Structure and Linear Secret Sharing Scheme (LSSS)

Definition 1.
AssumeΟ=attr1,⋯,attrn is a set of attributes, and A⊂2O is a nonempty subset of 2O, where 2O represents the set constituted by all subsets of O; that is, A is a nonempty set constituted by some subsets of O. We call A is an access structure on O. If for any P, Q satisfies the condition P∈A and P⊆Q, namely Q∈A, and then set A⊆O is monotonic. Authorized set refers to the set in A; on the contrary, the unauthorized set is not in A.Definition 2.
In the linear secret sharing matrix formed by the access policy, each row corresponds to an attribute value, that is, row vector and attribute value form a one-to-one mapping relationship. If the following two properties are satisfied, and then, a secret sharing schemeΣ on a set of Ο=attr1,⋯,attrn is called linear.
(1)
The shared secret key for each attribute is a vector formed onZp(2)
In schemeΣ, there is an n×m secret sharing matrix A, whose row label is bi, i∈1,2,⋯,n. Given a secret sharing column vector u=μ,u2,⋯,um, where μ∈Zp is the secret key to be shared, u2,⋯,um is selected at random, Au represents the vector of n shared secret keys according to Σ. Shared γi=Aui, that is the inner product Au belongs to the property bi, where b is a function that maps i∈1,2,⋯,n to biThe LSSS matrix has an important feature, that is, linear reconstruction. SupposeΣ is a LSSS scheme representing access structure A, Q∈A is an authorized set, and then, we can define T⊂n as T=i:bi∈Q. If there has constant βi∈Zpi∈T that can be discovered in polynomial time such that γi are valid shares of the secret key μ, then ∑i∈Tβiγi=μ. There is no such constant for any unauthorized set.


## 3.3. Binary Tree

First, there is a brief review of the definition of binary tree. Suppose UT represents a binary tree, in which there areL leaves corresponding to L users, the root node of BT is Rt. pathφ represents the set of all nodes on the path of leaf node φ from the root to φ. Note that φ and the root node are included here. φl, φr represents the left and right children of nonleaf nodes. The algorithm KUNodes is used to calculate the minimum set of nodes that need to release key updates, and only unrevoked users can decrypt the ciphertext within a period of time. That is, nodes in rl corresponding to time periods before or t do not have any ancestors in the set, and all other leaf nodes have exactly one ancestor in the set. Figure 1 gives the working principle of the KUNodes algorithm, where it first marks all ancestors of the revoked nodes as revoked and then outputs all unrevoked children of the revoked nodes. The Algorithm 1 is the formal definition of the KUNodes algorithm.Algorithm 1: KUNodes.
Inputs: a binary treeUT, a revocation list rl, a time period t, two empty sets P, Q.∀φi,ti∈rl, if ti≤t, then add pathφi to P.∀p∈P, if pl∉P, then add pl to Q.ifpr∉P, add pr to Q.IfQ=∅, then add Rtto Q.ReturnQ.Figure 1
The KUNodes algorithm. This shows a pictorial depiction of the algorithm.


## 3.4. Shamir Secret Sharing [51]

The Shamir secret sharing scheme is based on Lagrange interpolation polynomials, which are described as follows:(1) A trusted dealerD first randomly chooses a polynomial gx=a0+a1x+⋯+al−1xl−1 with order l-1 such that a0=s, where a1,a2,⋯,al−1 are in finite filed Fp=GFp. Then, Dcomputes s1=g1,…,sm=gm and sends si to each shareholder pi secretly(2) More thanl shareholder pr⊂p (pr≤l) work together can reconstruct the secret using the Lagrange interpolating formula


## 3.5. Pedersen (l, m) Secret Sharing [17]

The Pedersen secret sharing scheme allows each dealer (shareholder) to randomly select a secret as a subsecret and can share the subsecret with other shareholders. Therefore, each shareholder can merger all the subsecrets as the master secret. The Pedersen secret sharing scheme is described as follows:(1)
Each shareholderHi(i∈1,⋯,m) randomly independently picks a subsecret Si, and then, the master secret can be described as S=∑i=1mSi(2)
For each subsecretSi, a l-1 polynomial gx is randomly selected by shareholder Hi such that Si=gi0. After that, it calculates sij=gixj,j=1,2,⋯,m for other shareholders by using Shamir’s secret sharing. Finally, Hi sends each sij to other Hj secretly, and each shareholder Hi has m subshares sij(3)
Each shareholderHi calculates its own master share si=∑j=1msji=∑j=1mgjxi(4)
More thanl shareholders pr⊂p (pr≤l) work together can reconstruct the secret by using the Lagrange interpolating formula


## 3.6. Reciprocal Protocol [18]

Suppose that shareholdersHii∈1,⋯,m share a secret μ using Pedersen (l, m) secret sharing protocol. The role of the reciprocal protocol is to get share μ−1 without disclosing relevant message about μ and μ−1. The description of this protocol is as follows:
(1)
Shareholders jointly run the Pedersen (l, m) secret sharing scheme to generate a (l, m) sharing of a random element α∈Zq. Denote all shares α1,α2,⋯,αm as α1,α2,⋯,αm↔l,mα(2)
Shareholders jointly run the Pedersen (2l,m) secret sharing scheme to generate and retain a share of zero value βi(3)
Shareholders need to pass the valueμiαi+βi and interpolating the corresponding 2l degree polynomial to reconstruct the value η=μα(4)
Each shareholders setsδi=η−1αi to calculate it share δi of μ−1


## 3.7. Blockchain

On January 3, 2009, Satoshi Nakamoto generated the first Bitcoin block. A few days later, a second bitcoin block appeared to connect with the first block to form the chain, marking the birth of the blockchain. Because of its four main features, immutability, irreproducible uniqueness, smart contracts, and decentralized self-organization or community, blockchain is widely used in various fields.In simple terms, a hash function (SHA-256) is used to form a blockchain. Each block contains a parent block hash, a timestamp, and a Merkle root. Where the parent block hash stores the hash value of the previous block header and is used to connect the previous block, the timestamp records the approximate time when the block was created, and the Merkle root is the Merkle tree root hash generated by the transaction list. There are three general types of blockchains: public blockchains, consortium blockchains, and private blockchains. Our system uses a consortium blockchain. Figure2 illustrates the basic structure of a consortium blockchain.Figure 2
Consortium blockchain. Consensus node nodes perform the consistency protocol to renovate the blockchain.In our consortium blockchain, consensus node nodes perform the consistency protocol to renovate the blockchain and reserve all nodes in the system with a consistent state. The consortium blockchain used in our system is similar to the scheme [48] in that firstly the consensus nodes can initialize the system parameters using the Pedersen secret sharing scheme and the reciprocity protocol. Secondly, the consensus nodes manage the associated keys of the users. Updating the user revocation list requires the joint participation of all consensus nodes, which effectively improves the system security. Users can submit searches to the blockchain, and the cloud server is able to perform predecryption operations for the users.


## 4. System Definition

### 4.1. System Model

Our data management system includes the following four participants:Data owner (DO): The data owner stores the generated index and encrypted data in the cloud, where the index is used for the cloud to perform search operations.Data user (DU): The data user is able to store the generated partial token in the consortium blockchain and is able to get the predecrypted message from the cloud to fully decrypt it using their private key.Blockchain (BC): The consortium blockchain in the system consists of a set of credible predefined consensus nodes, a data pool, and a distributed ledger. The blockchain is responsible for initializing the system, storing the users’ public identity keys, and generating the users’ public decryption keys, key update information, and predecryption keys. In addition, the blockchain is also responsible for generating the complete token and sending it to cloud.Cloud server (CS): Cloud server can search and predecrypt for users, and putting predecryption operations in the cloud can effectively reduce the burden of users.Figure3 shows the system procedure.Figure 3
System procedures. The data management system contains four participants, and each participant operates as shown in the figure.


### 4.2. System Procedure

Based on [48], the basic process of the scheme is defined as follows:


#### 4.2.1. System Init

All consensus nodes runSetup1k,σ⟶GPK algorithm to get the GPK. Pedersen (l, m) secret sharing protocol and reciprocal protocol are used by all consensus nodes to jointly determine the master key, and the exact value of the master parameter is unknown.


#### 4.2.2. User Registration and Revocation

(1)
The data user runs theIdKGGPK,IdU⟶skIdU,pkIdU to get its identity key pair to join the system and sends pkIdU to BC. Then, the user public decryption key is generated by the consensus nodes using pkIdU. In the meantime, the user’s predecryption key is also generated later using the public decryption key(2)
For user revocation, based on a time periodt, a state mark sm, and the revocation list rl, consensus node runs the RvIdU,t,rl,sm⟶rl to updaterl whenever a user wishes to be revoked


#### 4.2.3. Key Gen

In this step, consensus nodes generate three keys:(1)
Public decryption key generation: In this step, consensus nodes use the user identityIdU, an access structure D,b to run PubDecKGGPK,IdU,D,b,sm⟶PubDKIdU,sm algorithm to generate the user public decryption key, which is used to verify whether the user has the attributes included in its attribute set(2)
Updated key generation: Consensus nodes run theUpKGGPK,t,rl,sm⟶Ut,sm to get a key update message afterrl is updated; it inputs a new time period t and a state mark sm, users who have not revoked will use it when generating a predecryption key(3)
Predecryption key generation: Consensus nodes useUt,sm to run PreDecKGGPK,IdU,D,b,pkIdU,Ut⟶PreDKIdU,t; it generates the predecryption key for user


#### 4.2.4. Encryption

First, the data owner selects several keywords related to his/her data to generate a keyword setw, and then, he/she uses a symmetric algorithm with the key ks to encrypt the data. Then, data owner runs the EncGPK,S,t,ks⟶CT to hide the symmetric encryption key and runs the IdxGGPK,S,w⟶Idx to generate an index set, where the same attribute set S is used. Finally, data owner sends CT and Idx to cloud.


#### 4.2.5. Token Gen

(1)
Patrial token generation: first, the data user runs thePTokGGPK,skIdU,w⟶Tok′ to generate the partial token. Then, data user sends Tok′,Hw to BC(2)
Complete token generation: consensus nodes runTokGGPK,IdU,D,b,Tok′⟶Tok algorithm for data user after receiving Tok. Then, data user sends Tok to the cloud


#### 4.2.6. Search

When data users need to search, the cloud runs theSearchGPK,S,Tok,Idx⟶Addr/⊥ algorithm to search.


#### 4.2.7. Decryption

(1)
Predecryption: The predecryption operation is done in the cloud, and the cloud takes as input the predecryption key sent to it by the blockchain, and it runs thePreDGPK,D,b,IdU,PreDKIdU,t,CT,t⟶CT′/⊥ to convert the ciphertext of data users after receiving the requested key. In this phase, most of the calculation costs will be carried out in the cloud(2)
User decryption: Since a portion of the predecryption work has already been done in the cloud, data user runs theDecGPK,skIdU,CT′⟶ks/⊥ to generate the symmetric decryption key. After that, the complete decryption is done by running the symmetric algorithm


### 4.3. Security Model

#### 4.3.1. Ciphertext Indistinguishability

Based on [48], we give a security definition of indistinguishability under chosen plaintext attacks (IND-CPA) for BC-SABE, defined by an indistinguishable game between adversary A and challenge B. Let Um be the authority universe. Adversary A is defined as an (l,m) adversary that can compromise at most l-1 authority; Pedersen (l, m) secret sharing protocol and reciprocity protocol are applied in this security model.Setup. A corrupted authority setUϕ is output by A, where mϕ≤l−1. Then, B runs the Setup1k,σ⟶GPK to get the global public key GPK, a state mark sm and a revocation list rl. Note that rl is initially empty. It outputs GPK,rl,sm,ai,rii∈Uϕ to A.Phase 1. First,B creates an empty list L, and A can perform the following queries adaptively:
(i)
IdKey query: First of all,A issues a IdKey query on an identity IdU, B returns skIdU,pkIdU by running IdKGGPK,IdU algorithm, and then, it adds IdU,skIdU,pkIdU to list L. It returns skIdU to A(ii)
PubDKey query:A issues a PubDKey Query on an identity IdU and an access structure D,b. If IdU has not been issued to PubDKey query, then B returns skIdU,pkIdU by running IdKGGPK,IdU, runs PubDecKGGPK,IdU,D,b,sm⟶PubDKIdU,sm algorithm, and returns IdU,PubDKIdU,sm to A(iii)
Upkey query: AlgorithmA submits a Upkey query on a time period t. B returns the Ut to A by running UpKGGPK,t,rl,sm(iv)
PreDKey query: AlgorithmA submits a PreDKey query on IdU,D,b,t. If IdU has not been issued to PreDKey query, B runs the IdKGGPK,IdU,UpKGGPK,t,rl,sm, PubDecKGGPK,IdU,D,b,sm, and PreDecKGGPK,IdU,D,b,pkIdU,Ut. Then, B returns the PreDKIdU,t to A. Note that this oracle cannot be queried on a time period t before a Upkey query has been queried on t(v)
Revocation query:A submits a PreDKey Query on IdU,t, where t is not queried in UpKey query. B returns an updated revocation list rl to A by running RvIdU,t,rl,stChallenge. A hands over two symmetric keys with same length SK1∗ and SK2∗, an attribute set S∗, and a time period t∗ satisfying the following restrictions:
(i)
If an identityIdU∗ has performed to the IdKey query, S∗ of IdU∗ satisfies a query on IdU∗,D∗,b∗ issued to the PubDKey query. Then, the revocation query must be queried on IdU∗,t∗ with t=t∗ or any t occurs before t∗, and the PreDKey query cannot be queried on IdU∗,t∗(ii)
IfIdU∗ with access structure D∗,b∗ can be satisfied by S∗ is not revoked before or at t∗, then IdU∗ has never been queried by the IdKey queryB picks random ρ∈0,1 and runs EncGPK,S∗,t∗,SKρ∗⟶CT∗ to encrypt SKρ∗, and then, it returns CT∗ to A.Phase 2.A can adaptively perform the same five queries to B as in phase 1; the queries sent by A must also meet the above conditional restrictions.Guess. A makes a guess ρ′ for ρ; if ρ′=ρ, it wins.The advantage of the adversaryA in this game is described as Prρ=ρ′−1/2.If the advantages of any (l, m) PPT adversary defined above are negligible, then a BC-SABE scheme is IND-CPA secure.


#### 4.3.2. Index Indistinguishability

Based on [48], we give a security definition of indistinguishability under selective access structure and chosen keyword attacks (IND-sCKA) for BC-SABE, defined by an indistinguishable game between adversary A and challenge B.Init. Let S∗ be the challenge access structure defined by A.Setup. B returns the global public parameter GPK to A by running Setup1k,σ algorithm.Phase 1. A can adaptively submit the following query:
(i)
IdKey query:A issues a IdKey query on an identity IdU, B returns skIdU,pkIdU by running IdKGGPK,IdU, and then, it adds IdU,skIdU,pkIdU to list L and returns skIdU to A(ii)
Token query:A issues a token query on IdU, an access structure S, and a keyword w. B runs PTokGGPK,skIdU,w⟶Tok′ by using skIdU. Then, B returns Tok to A by running the TokGGPK,IdU,D,ρ,Tok′ algorithm. Note that the challenge access structure does not contain the attribute set S(iii)
Index query:A issues an index query on S and a keyword set w. Then, B returns an index set by running IdxGGPK,S,wChallenge. A submits two keywords K1∗ and K2∗ of the same size. B picks random ρ∈0,1, and then it returns the Ind∗ to A by running the IdxGGPK,S∗,wρ algorithm with the challenge access structure S∗.Phase 2. A can perform IdKey query, token query, and index query to B; the queries sent by A must also meet the above conditional restrictions.Guess. A makes a guess ρ′ for ρ; if ρ′=ρ, it wins.The advantage of the adversaryA in this game is described as Prρ=ρ′−1/2.If the advantages of any PPT adversary defined above are negligible, then a BC-SABE scheme is IND-sCKA secure.


## 4.1. System Model

Our data management system includes the following four participants:Data owner (DO): The data owner stores the generated index and encrypted data in the cloud, where the index is used for the cloud to perform search operations.Data user (DU): The data user is able to store the generated partial token in the consortium blockchain and is able to get the predecrypted message from the cloud to fully decrypt it using their private key.Blockchain (BC): The consortium blockchain in the system consists of a set of credible predefined consensus nodes, a data pool, and a distributed ledger. The blockchain is responsible for initializing the system, storing the users’ public identity keys, and generating the users’ public decryption keys, key update information, and predecryption keys. In addition, the blockchain is also responsible for generating the complete token and sending it to cloud.Cloud server (CS): Cloud server can search and predecrypt for users, and putting predecryption operations in the cloud can effectively reduce the burden of users.Figure3 shows the system procedure.Figure 3
System procedures. The data management system contains four participants, and each participant operates as shown in the figure.


## 4.2. System Procedure

Based on [48], the basic process of the scheme is defined as follows:


### 4.2.1. System Init

All consensus nodes runSetup1k,σ⟶GPK algorithm to get the GPK. Pedersen (l, m) secret sharing protocol and reciprocal protocol are used by all consensus nodes to jointly determine the master key, and the exact value of the master parameter is unknown.


### 4.2.2. User Registration and Revocation

(1)
The data user runs theIdKGGPK,IdU⟶skIdU,pkIdU to get its identity key pair to join the system and sends pkIdU to BC. Then, the user public decryption key is generated by the consensus nodes using pkIdU. In the meantime, the user’s predecryption key is also generated later using the public decryption key(2)
For user revocation, based on a time periodt, a state mark sm, and the revocation list rl, consensus node runs the RvIdU,t,rl,sm⟶rl to updaterl whenever a user wishes to be revoked


### 4.2.3. Key Gen

In this step, consensus nodes generate three keys:(1)
Public decryption key generation: In this step, consensus nodes use the user identityIdU, an access structure D,b to run PubDecKGGPK,IdU,D,b,sm⟶PubDKIdU,sm algorithm to generate the user public decryption key, which is used to verify whether the user has the attributes included in its attribute set(2)
Updated key generation: Consensus nodes run theUpKGGPK,t,rl,sm⟶Ut,sm to get a key update message afterrl is updated; it inputs a new time period t and a state mark sm, users who have not revoked will use it when generating a predecryption key(3)
Predecryption key generation: Consensus nodes useUt,sm to run PreDecKGGPK,IdU,D,b,pkIdU,Ut⟶PreDKIdU,t; it generates the predecryption key for user


### 4.2.4. Encryption

First, the data owner selects several keywords related to his/her data to generate a keyword setw, and then, he/she uses a symmetric algorithm with the key ks to encrypt the data. Then, data owner runs the EncGPK,S,t,ks⟶CT to hide the symmetric encryption key and runs the IdxGGPK,S,w⟶Idx to generate an index set, where the same attribute set S is used. Finally, data owner sends CT and Idx to cloud.


### 4.2.5. Token Gen

(1)
Patrial token generation: first, the data user runs thePTokGGPK,skIdU,w⟶Tok′ to generate the partial token. Then, data user sends Tok′,Hw to BC(2)
Complete token generation: consensus nodes runTokGGPK,IdU,D,b,Tok′⟶Tok algorithm for data user after receiving Tok. Then, data user sends Tok to the cloud


### 4.2.6. Search

When data users need to search, the cloud runs theSearchGPK,S,Tok,Idx⟶Addr/⊥ algorithm to search.


### 4.2.7. Decryption

(1)
Predecryption: The predecryption operation is done in the cloud, and the cloud takes as input the predecryption key sent to it by the blockchain, and it runs thePreDGPK,D,b,IdU,PreDKIdU,t,CT,t⟶CT′/⊥ to convert the ciphertext of data users after receiving the requested key. In this phase, most of the calculation costs will be carried out in the cloud(2)
User decryption: Since a portion of the predecryption work has already been done in the cloud, data user runs theDecGPK,skIdU,CT′⟶ks/⊥ to generate the symmetric decryption key. After that, the complete decryption is done by running the symmetric algorithm


## 4.2.1. System Init

All consensus nodes runSetup1k,σ⟶GPK algorithm to get the GPK. Pedersen (l, m) secret sharing protocol and reciprocal protocol are used by all consensus nodes to jointly determine the master key, and the exact value of the master parameter is unknown.


## 4.2.2. User Registration and Revocation

(1)
The data user runs theIdKGGPK,IdU⟶skIdU,pkIdU to get its identity key pair to join the system and sends pkIdU to BC. Then, the user public decryption key is generated by the consensus nodes using pkIdU. In the meantime, the user’s predecryption key is also generated later using the public decryption key(2)
For user revocation, based on a time periodt, a state mark sm, and the revocation list rl, consensus node runs the RvIdU,t,rl,sm⟶rl to updaterl whenever a user wishes to be revoked


## 4.2.3. Key Gen

In this step, consensus nodes generate three keys:(1)
Public decryption key generation: In this step, consensus nodes use the user identityIdU, an access structure D,b to run PubDecKGGPK,IdU,D,b,sm⟶PubDKIdU,sm algorithm to generate the user public decryption key, which is used to verify whether the user has the attributes included in its attribute set(2)
Updated key generation: Consensus nodes run theUpKGGPK,t,rl,sm⟶Ut,sm to get a key update message afterrl is updated; it inputs a new time period t and a state mark sm, users who have not revoked will use it when generating a predecryption key(3)
Predecryption key generation: Consensus nodes useUt,sm to run PreDecKGGPK,IdU,D,b,pkIdU,Ut⟶PreDKIdU,t; it generates the predecryption key for user


## 4.2.4. Encryption

First, the data owner selects several keywords related to his/her data to generate a keyword setw, and then, he/she uses a symmetric algorithm with the key ks to encrypt the data. Then, data owner runs the EncGPK,S,t,ks⟶CT to hide the symmetric encryption key and runs the IdxGGPK,S,w⟶Idx to generate an index set, where the same attribute set S is used. Finally, data owner sends CT and Idx to cloud.


## 4.2.5. Token Gen

(1)
Patrial token generation: first, the data user runs thePTokGGPK,skIdU,w⟶Tok′ to generate the partial token. Then, data user sends Tok′,Hw to BC(2)
Complete token generation: consensus nodes runTokGGPK,IdU,D,b,Tok′⟶Tok algorithm for data user after receiving Tok. Then, data user sends Tok to the cloud


## 4.2.6. Search

When data users need to search, the cloud runs theSearchGPK,S,Tok,Idx⟶Addr/⊥ algorithm to search.


## 4.2.7. Decryption

(1)
Predecryption: The predecryption operation is done in the cloud, and the cloud takes as input the predecryption key sent to it by the blockchain, and it runs thePreDGPK,D,b,IdU,PreDKIdU,t,CT,t⟶CT′/⊥ to convert the ciphertext of data users after receiving the requested key. In this phase, most of the calculation costs will be carried out in the cloud(2)
User decryption: Since a portion of the predecryption work has already been done in the cloud, data user runs theDecGPK,skIdU,CT′⟶ks/⊥ to generate the symmetric decryption key. After that, the complete decryption is done by running the symmetric algorithm


## 4.3. Security Model

### 4.3.1. Ciphertext Indistinguishability

Based on [48], we give a security definition of indistinguishability under chosen plaintext attacks (IND-CPA) for BC-SABE, defined by an indistinguishable game between adversary A and challenge B. Let Um be the authority universe. Adversary A is defined as an (l,m) adversary that can compromise at most l-1 authority; Pedersen (l, m) secret sharing protocol and reciprocity protocol are applied in this security model.Setup. A corrupted authority setUϕ is output by A, where mϕ≤l−1. Then, B runs the Setup1k,σ⟶GPK to get the global public key GPK, a state mark sm and a revocation list rl. Note that rl is initially empty. It outputs GPK,rl,sm,ai,rii∈Uϕ to A.Phase 1. First,B creates an empty list L, and A can perform the following queries adaptively:
(i)
IdKey query: First of all,A issues a IdKey query on an identity IdU, B returns skIdU,pkIdU by running IdKGGPK,IdU algorithm, and then, it adds IdU,skIdU,pkIdU to list L. It returns skIdU to A(ii)
PubDKey query:A issues a PubDKey Query on an identity IdU and an access structure D,b. If IdU has not been issued to PubDKey query, then B returns skIdU,pkIdU by running IdKGGPK,IdU, runs PubDecKGGPK,IdU,D,b,sm⟶PubDKIdU,sm algorithm, and returns IdU,PubDKIdU,sm to A(iii)
Upkey query: AlgorithmA submits a Upkey query on a time period t. B returns the Ut to A by running UpKGGPK,t,rl,sm(iv)
PreDKey query: AlgorithmA submits a PreDKey query on IdU,D,b,t. If IdU has not been issued to PreDKey query, B runs the IdKGGPK,IdU,UpKGGPK,t,rl,sm, PubDecKGGPK,IdU,D,b,sm, and PreDecKGGPK,IdU,D,b,pkIdU,Ut. Then, B returns the PreDKIdU,t to A. Note that this oracle cannot be queried on a time period t before a Upkey query has been queried on t(v)
Revocation query:A submits a PreDKey Query on IdU,t, where t is not queried in UpKey query. B returns an updated revocation list rl to A by running RvIdU,t,rl,stChallenge. A hands over two symmetric keys with same length SK1∗ and SK2∗, an attribute set S∗, and a time period t∗ satisfying the following restrictions:
(i)
If an identityIdU∗ has performed to the IdKey query, S∗ of IdU∗ satisfies a query on IdU∗,D∗,b∗ issued to the PubDKey query. Then, the revocation query must be queried on IdU∗,t∗ with t=t∗ or any t occurs before t∗, and the PreDKey query cannot be queried on IdU∗,t∗(ii)
IfIdU∗ with access structure D∗,b∗ can be satisfied by S∗ is not revoked before or at t∗, then IdU∗ has never been queried by the IdKey queryB picks random ρ∈0,1 and runs EncGPK,S∗,t∗,SKρ∗⟶CT∗ to encrypt SKρ∗, and then, it returns CT∗ to A.Phase 2.A can adaptively perform the same five queries to B as in phase 1; the queries sent by A must also meet the above conditional restrictions.Guess. A makes a guess ρ′ for ρ; if ρ′=ρ, it wins.The advantage of the adversaryA in this game is described as Prρ=ρ′−1/2.If the advantages of any (l, m) PPT adversary defined above are negligible, then a BC-SABE scheme is IND-CPA secure.


### 4.3.2. Index Indistinguishability

Based on [48], we give a security definition of indistinguishability under selective access structure and chosen keyword attacks (IND-sCKA) for BC-SABE, defined by an indistinguishable game between adversary A and challenge B.Init. Let S∗ be the challenge access structure defined by A.Setup. B returns the global public parameter GPK to A by running Setup1k,σ algorithm.Phase 1. A can adaptively submit the following query:
(i)
IdKey query:A issues a IdKey query on an identity IdU, B returns skIdU,pkIdU by running IdKGGPK,IdU, and then, it adds IdU,skIdU,pkIdU to list L and returns skIdU to A(ii)
Token query:A issues a token query on IdU, an access structure S, and a keyword w. B runs PTokGGPK,skIdU,w⟶Tok′ by using skIdU. Then, B returns Tok to A by running the TokGGPK,IdU,D,ρ,Tok′ algorithm. Note that the challenge access structure does not contain the attribute set S(iii)
Index query:A issues an index query on S and a keyword set w. Then, B returns an index set by running IdxGGPK,S,wChallenge. A submits two keywords K1∗ and K2∗ of the same size. B picks random ρ∈0,1, and then it returns the Ind∗ to A by running the IdxGGPK,S∗,wρ algorithm with the challenge access structure S∗.Phase 2. A can perform IdKey query, token query, and index query to B; the queries sent by A must also meet the above conditional restrictions.Guess. A makes a guess ρ′ for ρ; if ρ′=ρ, it wins.The advantage of the adversaryA in this game is described as Prρ=ρ′−1/2.If the advantages of any PPT adversary defined above are negligible, then a BC-SABE scheme is IND-sCKA secure.


## 4.3.1. Ciphertext Indistinguishability

Based on [48], we give a security definition of indistinguishability under chosen plaintext attacks (IND-CPA) for BC-SABE, defined by an indistinguishable game between adversary A and challenge B. Let Um be the authority universe. Adversary A is defined as an (l,m) adversary that can compromise at most l-1 authority; Pedersen (l, m) secret sharing protocol and reciprocity protocol are applied in this security model.Setup. A corrupted authority setUϕ is output by A, where mϕ≤l−1. Then, B runs the Setup1k,σ⟶GPK to get the global public key GPK, a state mark sm and a revocation list rl. Note that rl is initially empty. It outputs GPK,rl,sm,ai,rii∈Uϕ to A.Phase 1. First,B creates an empty list L, and A can perform the following queries adaptively:
(i)
IdKey query: First of all,A issues a IdKey query on an identity IdU, B returns skIdU,pkIdU by running IdKGGPK,IdU algorithm, and then, it adds IdU,skIdU,pkIdU to list L. It returns skIdU to A(ii)
PubDKey query:A issues a PubDKey Query on an identity IdU and an access structure D,b. If IdU has not been issued to PubDKey query, then B returns skIdU,pkIdU by running IdKGGPK,IdU, runs PubDecKGGPK,IdU,D,b,sm⟶PubDKIdU,sm algorithm, and returns IdU,PubDKIdU,sm to A(iii)
Upkey query: AlgorithmA submits a Upkey query on a time period t. B returns the Ut to A by running UpKGGPK,t,rl,sm(iv)
PreDKey query: AlgorithmA submits a PreDKey query on IdU,D,b,t. If IdU has not been issued to PreDKey query, B runs the IdKGGPK,IdU,UpKGGPK,t,rl,sm, PubDecKGGPK,IdU,D,b,sm, and PreDecKGGPK,IdU,D,b,pkIdU,Ut. Then, B returns the PreDKIdU,t to A. Note that this oracle cannot be queried on a time period t before a Upkey query has been queried on t(v)
Revocation query:A submits a PreDKey Query on IdU,t, where t is not queried in UpKey query. B returns an updated revocation list rl to A by running RvIdU,t,rl,stChallenge. A hands over two symmetric keys with same length SK1∗ and SK2∗, an attribute set S∗, and a time period t∗ satisfying the following restrictions:
(i)
If an identityIdU∗ has performed to the IdKey query, S∗ of IdU∗ satisfies a query on IdU∗,D∗,b∗ issued to the PubDKey query. Then, the revocation query must be queried on IdU∗,t∗ with t=t∗ or any t occurs before t∗, and the PreDKey query cannot be queried on IdU∗,t∗(ii)
IfIdU∗ with access structure D∗,b∗ can be satisfied by S∗ is not revoked before or at t∗, then IdU∗ has never been queried by the IdKey queryB picks random ρ∈0,1 and runs EncGPK,S∗,t∗,SKρ∗⟶CT∗ to encrypt SKρ∗, and then, it returns CT∗ to A.Phase 2.A can adaptively perform the same five queries to B as in phase 1; the queries sent by A must also meet the above conditional restrictions.Guess. A makes a guess ρ′ for ρ; if ρ′=ρ, it wins.The advantage of the adversaryA in this game is described as Prρ=ρ′−1/2.If the advantages of any (l, m) PPT adversary defined above are negligible, then a BC-SABE scheme is IND-CPA secure.


## 4.3.2. Index Indistinguishability

Based on [48], we give a security definition of indistinguishability under selective access structure and chosen keyword attacks (IND-sCKA) for BC-SABE, defined by an indistinguishable game between adversary A and challenge B.Init. Let S∗ be the challenge access structure defined by A.Setup. B returns the global public parameter GPK to A by running Setup1k,σ algorithm.Phase 1. A can adaptively submit the following query:
(i)
IdKey query:A issues a IdKey query on an identity IdU, B returns skIdU,pkIdU by running IdKGGPK,IdU, and then, it adds IdU,skIdU,pkIdU to list L and returns skIdU to A(ii)
Token query:A issues a token query on IdU, an access structure S, and a keyword w. B runs PTokGGPK,skIdU,w⟶Tok′ by using skIdU. Then, B returns Tok to A by running the TokGGPK,IdU,D,ρ,Tok′ algorithm. Note that the challenge access structure does not contain the attribute set S(iii)
Index query:A issues an index query on S and a keyword set w. Then, B returns an index set by running IdxGGPK,S,wChallenge. A submits two keywords K1∗ and K2∗ of the same size. B picks random ρ∈0,1, and then it returns the Ind∗ to A by running the IdxGGPK,S∗,wρ algorithm with the challenge access structure S∗.Phase 2. A can perform IdKey query, token query, and index query to B; the queries sent by A must also meet the above conditional restrictions.Guess. A makes a guess ρ′ for ρ; if ρ′=ρ, it wins.The advantage of the adversaryA in this game is described as Prρ=ρ′−1/2.If the advantages of any PPT adversary defined above are negligible, then a BC-SABE scheme is IND-sCKA secure.


## 5. Construction

### 5.1. System Init

Cu=Cu1,Cu2,⋯,Cum is a consensus node set which has m consensus nodes. First, consensus nodes exploit the Pedersen (l, m) secret sharing protocol [17] and the reciprocal protocol [18] to run the Setup1k,σ⟶GPK to generate the global public key GPK, the user revocation list rl, and the user tree UT, where σ∈0,1polyk is a randomly public string. Let G be groups of a prime order p, g is a generator of G, and e:G×G⟶G1 is a bilinear map. Then, it chooses random u0,⋯,uη,h0,⋯,hτ∈G. Let Px=∏j=0ηujxj and Fx=∏j=0τhjxj, H:0,1∗⟶Zp∗ be the collision-resisted hash function, and D=e,G,G1,p,g,H be the admissible bilinear group parameters. Then, Cui share two secret parameters a,r∈G and using Pedersen (l, m) secret sharing scheme and reciprocal protocol to compute shares of r−1. Based on its shares ai, ri, and ji, each consensus node Cui computes and broadcasts gai, gri, and gji; excess l consensus nodes cooperate to recreate gr−1=∏i=1lgjiLi=g∑i=1lLi⋅ji; and each nodes spreads gai/r. The public parameters of the system are also generated in this way: gr=∏i=1lgriLi=g∑i=1lLi⋅ri, eg,ga=∏i=1leg,gaLi=eg,g∑i=1lLi⋅ai, gα/γ=∏i=1lgai/rLi=g∑i=1lLi⋅ai/r.Finally, it outputs global public key:
(1)GPK=D,Px,Fx,u0,⋯,uη,h0,⋯,hτ,eg,ga,gr,ga/r.


### 5.2. User Registration and Revocation

#### 5.2.1. User Registration

The IdKG algorithm inputs theGPK, the user identity IdU, and UT; it picks random g3∈G and b1,b2∈Zp; and then, it calculates g1=g31/b1, g2=g31/b2. The user runs this algorithm to generate the user public and private key pair pkIdU,skIdU=g1,g2,g2,b1,b2, and then the user sends pkIdU to BC. An undefined leaf node φ is selected by BC from the UT to storage IdU and pkIdU.


#### 5.2.2. User Revocation

The revoke algorithm is run by the consensus node to update the user revocation listrlwhenever user want to be revoked. It inputs the user identity IdU, a state mark st, a time periodt, and rl; then, it will find all nodes y associated with the identity IdU and put (y, t) into the rl list and outputs the revised rl.


### 5.3. Key Generation

#### 5.3.1. Public Decryption Key Gen

Consensus nodes run the PubDecKG algorithm to generate the public decryption keyPubDKIdU; it takes GPK, user identity IdU, and a state mark sm and an access structure D,b as the input, where matrix D is an nD×mD with row label bi, i∈1,2,⋯,l. Then, it selects random the leaf node φ from the UT based on IdU, and compute pathφ. It selects random vy,2,⋯,vy,mD∈Zp and let v⟶=a,vy,2,⋯,vy,mD, and then, it computes vy,i=Di⋅v⟶y for i∈nD, where Di denotes the vector of the i-th row of matrix D. For each y∈pathφ, it takes gy and computes gy,i′=gvy,i/gy and stores gy in the node y. Then, share γ1,γ2,γy,jj∈IdU among consensus nodes by exploiting the Pedersen (l, m) secret sharing scheme, and each consensus nodes computes and spreads gγy,j,i,Fbiγy,j,ij∈IdU based on share γy,j,ij∈IdU. Then, excess l consensus nodes cooperate to compute the public decryption key as follows:
(2)Dy,1,j=g3γ1+γ2⋅gy,i′⋅∏i=1lFbiγy,j,iLi=g3γ1+γ2⋅gvy,j/gy⋅∏i=1lFbiγy,j,iLi=g3γ1+γ2⋅gvy,j/gy⋅Fbi∑i=1lγy,j,i⋅Li,=g3γ1+γ2⋅gvy,j/gy⋅Fbiγy,jDy,2,j=∏i=1lgγy,j,iLi=g∑i=1lγy,j,i⋅Li=grg,i, D3=g1γ1, D4=g2γ2. Finally, BC stores PDKId in the ledger:
(3)PDKId=y,Dy,1,j,Dy,2,ji∈ly∈pathφ,D3,D4.


#### 5.3.2. Key Update Messages Gen

Consensus nodes run the UpKG algorithm to generate the update informationUt; it inputs the GPK, the revocation list rl, a time period t, the user treeUT, and a state mark sm. Share sy among consensus nodes by exploiting the Pedersen (l, m) secret sharing scheme, and each consensus nodes computes and spreads gsy,i,Ptsy,i based on share sy,i.For ally∈KUNodesUT,rl,t, it takes gy from the node y. Then, more than l consensus nodes cooperate to compute the update information as follows: Uy,1=gy⋅∏i=1lPtsy,iLi=gy⋅Pt∑i=1lsy,i⋅Li=gy⋅Ptsy, Uy,2=∏i=1lgsy,iLi=g∑i=1lsy,i⋅Li=gsy. BC stores Ut in the ledger:
(4)Ut=y,Uy,1,Uy,2y∈KUNodesUT,rl,t.


#### 5.3.3. Predecryption Key Gen

Consensus nodes run the PreDecKG algorithm to generate the update informationPreDKt; it inputs the GPK, a time period t, user identity IdU, an access structure D,b, the user tree UT, a state mark sm, the revocation list rl, user public decryption key PubDKId, and a update information Ut. Then, let I=Pathθ and J=KUNodesUT,rl,t, so we have Ut=y,Uy,1,Uy,2y∈J and PDKId=y,Dy,1,j,Dy,2,ji∈ly∈pathφ,D3,D4. If I∩J=∅, it returns ⊥. Then, share sy and γy,jj∈IdU among consensus nodes by exploiting the Pedersen (l, m) secret sharing protocol. Based on share sy,i′ and γy,j,i′j∈IdU, each consensus nodes computes and spreads gγy,j,i′,Fbiγy,j,i′j∈IdU, gsy,i′,Ptsy,i′. Then, more than lconsensus nodes cooperate to compute the predecryption key.
(5)Tk1,j=Dy,1,j⋅Uy,1⋅∏i=1lFbiγy,j,i′⋅Ptsy,iLi=g3γ1+γ2⋅gvy,j/gy⋅gy⋅Ptsx⋅∏i=1lFbiγy,j,i′⋅Ptsy,i′Li=g3γ1+γ2⋅gvy,j⋅Ptsy⋅Fbi∑i=1lγy,j,i′⋅Li⋅Pt∑i=1lsy,i′⋅Li=g3γ1+γ2⋅gvy,j⋅Fbiγy,j+γy,j′⋅Ptsy+sy′,Tk2,j=Dy,2,j⋅∏i=1lgγy,i′Li=gγy+γy′,Tk3=Uy,2⋅∏i=1lgsy,i′Li=Uy,2⋅g∑i=1lsy,i′⋅Li=gsy+sy′. BC stores PreDKIdU,t in the ledger.
(6)PreDKIdU,t=Tk1,j,Tk2,jj∈l,Tk3.


### 5.4. Encryption

#### 5.4.1. Data Encryption

Date owner runs the Enc algorithm to get the ciphertextCT. It inputs the GPK, an attribute set S, and a symmetric key ks and a time period t. Let S=S1,⋯,Sl and choose μ∈Zp. It calculates C0=eg,gaμ⋅ks, C1=gμ, C2,i=FSiμ, and C3=Ptμ and outputs CTsym and CT=S,t,C0,C1,C2,ii∈l,C3.


#### 5.4.2. Index Generation

Date owners run the IdxG algorithm to generate theIdx. It inputs the GPK, the same attribute set S, and a keyword set wll∈Uw, and then, it computes Idx1,l=eg,gaμ⋅Hwl,Idx2=grμ, Idx3,i=grvi, and Idx4,i=Fbivi. Finally, it sent index set Idx along with CTsym and CT to the cloud.
(7)Ind=Idx1,ll∈Uw,Idx2,Idx3,i,Idx4,ii∈nD,S∗.


### 5.5. Token Gen

#### 5.5.1. Partial Token Gen

In this phase, data users run the PTokG algorithm to get the partial token. It inputs theGPK, user private key skIdU, and a keyword w. Then, it randomly selects q∈Zp; it computes the partial token Tok′=ga/rb1+b2+q and the hash value Hw. Finally, it sends Tok′ and Hw to BC.


#### 5.5.2. Complete Token Gen

Blockchain runs the TokG algorithm to get the complete token. It inputs theGPK, the user identity IdU, the same access structure D,b, and the partial token Tok′. Share αjj∈IdU among consensus nodes by exploiting Pedersen (l, m) secret sharing protocol. Based on share αj,ij∈IdU, each consensus nodes computes and spreads gr⋅αj,i,Fbiaj,ij∈IdU. Then, more than l consensus nodes cooperate to compute the complete token as follows:
(8)Tok1,j=Tok′⋅∏i=1lFbiαj,iLi=ga/rb1+b2+r⋅Fbi∑i=1lαj,i⋅Li=ga/rb1+b2+r⋅Fbiαj,Tok2,j=∏i=1lgr⋅αj,iLi=gr⋅∑i=1lαj,i⋅Li=gr⋅αj,Tok3=Tok′⋅ga/rHw=ga/rb1+b2+Hw. Finally, it sends the token Tok to the cloud:
(9)Tok=Tok1,j,Tok2,jj∈IdU,Tok3.


### 5.6. Search

Cloud runs search algorithms to perform search operations; it takes theGPK, the same access structure D,b, the complete token Tok, and the Ind as inputs. It yields the capacity address Addr of related ciphertext if and only if the algorithm runs successfully; otherwise, the algorithm stops. First, it verifies whether the user’s attribute set satisfies the access structure, and if not, it outputs a stop character ⊥. If it is satisfied, let T=i∈nD∣bi∈S, and then the algorithm can calculate a set di∈Zpi∈T which makes ∑i∈TdiDi=1,0,⋯,0mD. Then, it verifies whether the equation described is valid.
(10)Idx1,l=eIdx2,Tok3∏i∈TeTok1,bi,Idx3,i/eTok3,bi,Idx4,idi.If the formula holds, the stored addressAddr is the output.


### 5.7. Decryption

#### 5.7.1. Predecryption

The predecryption operation is performed by the cloud, which runs the PreD algorithm to complete. It inputs theGPK, user identity IdU, the predecryption key PreDKIdU,t, a time period t, the same set T=i∈nD∣bi∈S, and the ciphertext CT. If vi are valid shares of any secret μ from D, then the algorithm can compute a set di∈Zpi∈T which makes ∑i∈Tdivi=μ. It computes
(11)CT′=∏i∈TeC2,i,Tk2,bieC3,Tk3eTk1,bi,C1di=1eg3γ1+γ2,C1eg,C1a.


#### 5.7.2. Decryption

The Dec algorithm inputs theGPK, private user key skIdU, the predecryption ciphertext CT′, and the symmetric decryption algorithm to generate the symmetric decryption key. This algorithm is run by the DU, and it can finish full decryption. The decryption is as follows. Using ks to run symmetric algorithms can enable users to get plaintext, and users will not consume a lot of costs because the previous operations are already performed in the cloud.
(12)ks=CT′⋅eD3b1D4b2,C1⋅C0=eg1b1γ1g2b2γ2,gμ⋅eg,gaμ⋅kseg3γ1+γ2,gμeg,gμa=eg3γ1+γ2,gμ⋅eg,gaμ⋅kseg3γ1+γ2,gμeg,gμa.


## 5.1. System Init

Cu=Cu1,Cu2,⋯,Cum is a consensus node set which has m consensus nodes. First, consensus nodes exploit the Pedersen (l, m) secret sharing protocol [17] and the reciprocal protocol [18] to run the Setup1k,σ⟶GPK to generate the global public key GPK, the user revocation list rl, and the user tree UT, where σ∈0,1polyk is a randomly public string. Let G be groups of a prime order p, g is a generator of G, and e:G×G⟶G1 is a bilinear map. Then, it chooses random u0,⋯,uη,h0,⋯,hτ∈G. Let Px=∏j=0ηujxj and Fx=∏j=0τhjxj, H:0,1∗⟶Zp∗ be the collision-resisted hash function, and D=e,G,G1,p,g,H be the admissible bilinear group parameters. Then, Cui share two secret parameters a,r∈G and using Pedersen (l, m) secret sharing scheme and reciprocal protocol to compute shares of r−1. Based on its shares ai, ri, and ji, each consensus node Cui computes and broadcasts gai, gri, and gji; excess l consensus nodes cooperate to recreate gr−1=∏i=1lgjiLi=g∑i=1lLi⋅ji; and each nodes spreads gai/r. The public parameters of the system are also generated in this way: gr=∏i=1lgriLi=g∑i=1lLi⋅ri, eg,ga=∏i=1leg,gaLi=eg,g∑i=1lLi⋅ai, gα/γ=∏i=1lgai/rLi=g∑i=1lLi⋅ai/r.Finally, it outputs global public key:
(1)GPK=D,Px,Fx,u0,⋯,uη,h0,⋯,hτ,eg,ga,gr,ga/r.


## 5.2. User Registration and Revocation

### 5.2.1. User Registration

The IdKG algorithm inputs theGPK, the user identity IdU, and UT; it picks random g3∈G and b1,b2∈Zp; and then, it calculates g1=g31/b1, g2=g31/b2. The user runs this algorithm to generate the user public and private key pair pkIdU,skIdU=g1,g2,g2,b1,b2, and then the user sends pkIdU to BC. An undefined leaf node φ is selected by BC from the UT to storage IdU and pkIdU.


### 5.2.2. User Revocation

The revoke algorithm is run by the consensus node to update the user revocation listrlwhenever user want to be revoked. It inputs the user identity IdU, a state mark st, a time periodt, and rl; then, it will find all nodes y associated with the identity IdU and put (y, t) into the rl list and outputs the revised rl.


## 5.2.1. User Registration

The IdKG algorithm inputs theGPK, the user identity IdU, and UT; it picks random g3∈G and b1,b2∈Zp; and then, it calculates g1=g31/b1, g2=g31/b2. The user runs this algorithm to generate the user public and private key pair pkIdU,skIdU=g1,g2,g2,b1,b2, and then the user sends pkIdU to BC. An undefined leaf node φ is selected by BC from the UT to storage IdU and pkIdU.


## 5.2.2. User Revocation

The revoke algorithm is run by the consensus node to update the user revocation listrlwhenever user want to be revoked. It inputs the user identity IdU, a state mark st, a time periodt, and rl; then, it will find all nodes y associated with the identity IdU and put (y, t) into the rl list and outputs the revised rl.


## 5.3. Key Generation

### 5.3.1. Public Decryption Key Gen

Consensus nodes run the PubDecKG algorithm to generate the public decryption keyPubDKIdU; it takes GPK, user identity IdU, and a state mark sm and an access structure D,b as the input, where matrix D is an nD×mD with row label bi, i∈1,2,⋯,l. Then, it selects random the leaf node φ from the UT based on IdU, and compute pathφ. It selects random vy,2,⋯,vy,mD∈Zp and let v⟶=a,vy,2,⋯,vy,mD, and then, it computes vy,i=Di⋅v⟶y for i∈nD, where Di denotes the vector of the i-th row of matrix D. For each y∈pathφ, it takes gy and computes gy,i′=gvy,i/gy and stores gy in the node y. Then, share γ1,γ2,γy,jj∈IdU among consensus nodes by exploiting the Pedersen (l, m) secret sharing scheme, and each consensus nodes computes and spreads gγy,j,i,Fbiγy,j,ij∈IdU based on share γy,j,ij∈IdU. Then, excess l consensus nodes cooperate to compute the public decryption key as follows:
(2)Dy,1,j=g3γ1+γ2⋅gy,i′⋅∏i=1lFbiγy,j,iLi=g3γ1+γ2⋅gvy,j/gy⋅∏i=1lFbiγy,j,iLi=g3γ1+γ2⋅gvy,j/gy⋅Fbi∑i=1lγy,j,i⋅Li,=g3γ1+γ2⋅gvy,j/gy⋅Fbiγy,jDy,2,j=∏i=1lgγy,j,iLi=g∑i=1lγy,j,i⋅Li=grg,i, D3=g1γ1, D4=g2γ2. Finally, BC stores PDKId in the ledger:
(3)PDKId=y,Dy,1,j,Dy,2,ji∈ly∈pathφ,D3,D4.


### 5.3.2. Key Update Messages Gen

Consensus nodes run the UpKG algorithm to generate the update informationUt; it inputs the GPK, the revocation list rl, a time period t, the user treeUT, and a state mark sm. Share sy among consensus nodes by exploiting the Pedersen (l, m) secret sharing scheme, and each consensus nodes computes and spreads gsy,i,Ptsy,i based on share sy,i.For ally∈KUNodesUT,rl,t, it takes gy from the node y. Then, more than l consensus nodes cooperate to compute the update information as follows: Uy,1=gy⋅∏i=1lPtsy,iLi=gy⋅Pt∑i=1lsy,i⋅Li=gy⋅Ptsy, Uy,2=∏i=1lgsy,iLi=g∑i=1lsy,i⋅Li=gsy. BC stores Ut in the ledger:
(4)Ut=y,Uy,1,Uy,2y∈KUNodesUT,rl,t.


### 5.3.3. Predecryption Key Gen

Consensus nodes run the PreDecKG algorithm to generate the update informationPreDKt; it inputs the GPK, a time period t, user identity IdU, an access structure D,b, the user tree UT, a state mark sm, the revocation list rl, user public decryption key PubDKId, and a update information Ut. Then, let I=Pathθ and J=KUNodesUT,rl,t, so we have Ut=y,Uy,1,Uy,2y∈J and PDKId=y,Dy,1,j,Dy,2,ji∈ly∈pathφ,D3,D4. If I∩J=∅, it returns ⊥. Then, share sy and γy,jj∈IdU among consensus nodes by exploiting the Pedersen (l, m) secret sharing protocol. Based on share sy,i′ and γy,j,i′j∈IdU, each consensus nodes computes and spreads gγy,j,i′,Fbiγy,j,i′j∈IdU, gsy,i′,Ptsy,i′. Then, more than lconsensus nodes cooperate to compute the predecryption key.
(5)Tk1,j=Dy,1,j⋅Uy,1⋅∏i=1lFbiγy,j,i′⋅Ptsy,iLi=g3γ1+γ2⋅gvy,j/gy⋅gy⋅Ptsx⋅∏i=1lFbiγy,j,i′⋅Ptsy,i′Li=g3γ1+γ2⋅gvy,j⋅Ptsy⋅Fbi∑i=1lγy,j,i′⋅Li⋅Pt∑i=1lsy,i′⋅Li=g3γ1+γ2⋅gvy,j⋅Fbiγy,j+γy,j′⋅Ptsy+sy′,Tk2,j=Dy,2,j⋅∏i=1lgγy,i′Li=gγy+γy′,Tk3=Uy,2⋅∏i=1lgsy,i′Li=Uy,2⋅g∑i=1lsy,i′⋅Li=gsy+sy′. BC stores PreDKIdU,t in the ledger.
(6)PreDKIdU,t=Tk1,j,Tk2,jj∈l,Tk3.


## 5.3.1. Public Decryption Key Gen

Consensus nodes run the PubDecKG algorithm to generate the public decryption keyPubDKIdU; it takes GPK, user identity IdU, and a state mark sm and an access structure D,b as the input, where matrix D is an nD×mD with row label bi, i∈1,2,⋯,l. Then, it selects random the leaf node φ from the UT based on IdU, and compute pathφ. It selects random vy,2,⋯,vy,mD∈Zp and let v⟶=a,vy,2,⋯,vy,mD, and then, it computes vy,i=Di⋅v⟶y for i∈nD, where Di denotes the vector of the i-th row of matrix D. For each y∈pathφ, it takes gy and computes gy,i′=gvy,i/gy and stores gy in the node y. Then, share γ1,γ2,γy,jj∈IdU among consensus nodes by exploiting the Pedersen (l, m) secret sharing scheme, and each consensus nodes computes and spreads gγy,j,i,Fbiγy,j,ij∈IdU based on share γy,j,ij∈IdU. Then, excess l consensus nodes cooperate to compute the public decryption key as follows:
(2)Dy,1,j=g3γ1+γ2⋅gy,i′⋅∏i=1lFbiγy,j,iLi=g3γ1+γ2⋅gvy,j/gy⋅∏i=1lFbiγy,j,iLi=g3γ1+γ2⋅gvy,j/gy⋅Fbi∑i=1lγy,j,i⋅Li,=g3γ1+γ2⋅gvy,j/gy⋅Fbiγy,jDy,2,j=∏i=1lgγy,j,iLi=g∑i=1lγy,j,i⋅Li=grg,i, D3=g1γ1, D4=g2γ2. Finally, BC stores PDKId in the ledger:
(3)PDKId=y,Dy,1,j,Dy,2,ji∈ly∈pathφ,D3,D4.


## 5.3.2. Key Update Messages Gen

Consensus nodes run the UpKG algorithm to generate the update informationUt; it inputs the GPK, the revocation list rl, a time period t, the user treeUT, and a state mark sm. Share sy among consensus nodes by exploiting the Pedersen (l, m) secret sharing scheme, and each consensus nodes computes and spreads gsy,i,Ptsy,i based on share sy,i.For ally∈KUNodesUT,rl,t, it takes gy from the node y. Then, more than l consensus nodes cooperate to compute the update information as follows: Uy,1=gy⋅∏i=1lPtsy,iLi=gy⋅Pt∑i=1lsy,i⋅Li=gy⋅Ptsy, Uy,2=∏i=1lgsy,iLi=g∑i=1lsy,i⋅Li=gsy. BC stores Ut in the ledger:
(4)Ut=y,Uy,1,Uy,2y∈KUNodesUT,rl,t.


## 5.3.3. Predecryption Key Gen

Consensus nodes run the PreDecKG algorithm to generate the update informationPreDKt; it inputs the GPK, a time period t, user identity IdU, an access structure D,b, the user tree UT, a state mark sm, the revocation list rl, user public decryption key PubDKId, and a update information Ut. Then, let I=Pathθ and J=KUNodesUT,rl,t, so we have Ut=y,Uy,1,Uy,2y∈J and PDKId=y,Dy,1,j,Dy,2,ji∈ly∈pathφ,D3,D4. If I∩J=∅, it returns ⊥. Then, share sy and γy,jj∈IdU among consensus nodes by exploiting the Pedersen (l, m) secret sharing protocol. Based on share sy,i′ and γy,j,i′j∈IdU, each consensus nodes computes and spreads gγy,j,i′,Fbiγy,j,i′j∈IdU, gsy,i′,Ptsy,i′. Then, more than lconsensus nodes cooperate to compute the predecryption key.
(5)Tk1,j=Dy,1,j⋅Uy,1⋅∏i=1lFbiγy,j,i′⋅Ptsy,iLi=g3γ1+γ2⋅gvy,j/gy⋅gy⋅Ptsx⋅∏i=1lFbiγy,j,i′⋅Ptsy,i′Li=g3γ1+γ2⋅gvy,j⋅Ptsy⋅Fbi∑i=1lγy,j,i′⋅Li⋅Pt∑i=1lsy,i′⋅Li=g3γ1+γ2⋅gvy,j⋅Fbiγy,j+γy,j′⋅Ptsy+sy′,Tk2,j=Dy,2,j⋅∏i=1lgγy,i′Li=gγy+γy′,Tk3=Uy,2⋅∏i=1lgsy,i′Li=Uy,2⋅g∑i=1lsy,i′⋅Li=gsy+sy′. BC stores PreDKIdU,t in the ledger.
(6)PreDKIdU,t=Tk1,j,Tk2,jj∈l,Tk3.


## 5.4. Encryption

### 5.4.1. Data Encryption

Date owner runs the Enc algorithm to get the ciphertextCT. It inputs the GPK, an attribute set S, and a symmetric key ks and a time period t. Let S=S1,⋯,Sl and choose μ∈Zp. It calculates C0=eg,gaμ⋅ks, C1=gμ, C2,i=FSiμ, and C3=Ptμ and outputs CTsym and CT=S,t,C0,C1,C2,ii∈l,C3.


### 5.4.2. Index Generation

Date owners run the IdxG algorithm to generate theIdx. It inputs the GPK, the same attribute set S, and a keyword set wll∈Uw, and then, it computes Idx1,l=eg,gaμ⋅Hwl,Idx2=grμ, Idx3,i=grvi, and Idx4,i=Fbivi. Finally, it sent index set Idx along with CTsym and CT to the cloud.
(7)Ind=Idx1,ll∈Uw,Idx2,Idx3,i,Idx4,ii∈nD,S∗.


## 5.4.1. Data Encryption

Date owner runs the Enc algorithm to get the ciphertextCT. It inputs the GPK, an attribute set S, and a symmetric key ks and a time period t. Let S=S1,⋯,Sl and choose μ∈Zp. It calculates C0=eg,gaμ⋅ks, C1=gμ, C2,i=FSiμ, and C3=Ptμ and outputs CTsym and CT=S,t,C0,C1,C2,ii∈l,C3.


## 5.4.2. Index Generation

Date owners run the IdxG algorithm to generate theIdx. It inputs the GPK, the same attribute set S, and a keyword set wll∈Uw, and then, it computes Idx1,l=eg,gaμ⋅Hwl,Idx2=grμ, Idx3,i=grvi, and Idx4,i=Fbivi. Finally, it sent index set Idx along with CTsym and CT to the cloud.
(7)Ind=Idx1,ll∈Uw,Idx2,Idx3,i,Idx4,ii∈nD,S∗.


## 5.5. Token Gen

### 5.5.1. Partial Token Gen

In this phase, data users run the PTokG algorithm to get the partial token. It inputs theGPK, user private key skIdU, and a keyword w. Then, it randomly selects q∈Zp; it computes the partial token Tok′=ga/rb1+b2+q and the hash value Hw. Finally, it sends Tok′ and Hw to BC.


### 5.5.2. Complete Token Gen

Blockchain runs the TokG algorithm to get the complete token. It inputs theGPK, the user identity IdU, the same access structure D,b, and the partial token Tok′. Share αjj∈IdU among consensus nodes by exploiting Pedersen (l, m) secret sharing protocol. Based on share αj,ij∈IdU, each consensus nodes computes and spreads gr⋅αj,i,Fbiaj,ij∈IdU. Then, more than l consensus nodes cooperate to compute the complete token as follows:
(8)Tok1,j=Tok′⋅∏i=1lFbiαj,iLi=ga/rb1+b2+r⋅Fbi∑i=1lαj,i⋅Li=ga/rb1+b2+r⋅Fbiαj,Tok2,j=∏i=1lgr⋅αj,iLi=gr⋅∑i=1lαj,i⋅Li=gr⋅αj,Tok3=Tok′⋅ga/rHw=ga/rb1+b2+Hw. Finally, it sends the token Tok to the cloud:
(9)Tok=Tok1,j,Tok2,jj∈IdU,Tok3.


## 5.5.1. Partial Token Gen

In this phase, data users run the PTokG algorithm to get the partial token. It inputs theGPK, user private key skIdU, and a keyword w. Then, it randomly selects q∈Zp; it computes the partial token Tok′=ga/rb1+b2+q and the hash value Hw. Finally, it sends Tok′ and Hw to BC.


## 5.5.2. Complete Token Gen

Blockchain runs the TokG algorithm to get the complete token. It inputs theGPK, the user identity IdU, the same access structure D,b, and the partial token Tok′. Share αjj∈IdU among consensus nodes by exploiting Pedersen (l, m) secret sharing protocol. Based on share αj,ij∈IdU, each consensus nodes computes and spreads gr⋅αj,i,Fbiaj,ij∈IdU. Then, more than l consensus nodes cooperate to compute the complete token as follows:
(8)Tok1,j=Tok′⋅∏i=1lFbiαj,iLi=ga/rb1+b2+r⋅Fbi∑i=1lαj,i⋅Li=ga/rb1+b2+r⋅Fbiαj,Tok2,j=∏i=1lgr⋅αj,iLi=gr⋅∑i=1lαj,i⋅Li=gr⋅αj,Tok3=Tok′⋅ga/rHw=ga/rb1+b2+Hw. Finally, it sends the token Tok to the cloud:
(9)Tok=Tok1,j,Tok2,jj∈IdU,Tok3.


## 5.6. Search

Cloud runs search algorithms to perform search operations; it takes theGPK, the same access structure D,b, the complete token Tok, and the Ind as inputs. It yields the capacity address Addr of related ciphertext if and only if the algorithm runs successfully; otherwise, the algorithm stops. First, it verifies whether the user’s attribute set satisfies the access structure, and if not, it outputs a stop character ⊥. If it is satisfied, let T=i∈nD∣bi∈S, and then the algorithm can calculate a set di∈Zpi∈T which makes ∑i∈TdiDi=1,0,⋯,0mD. Then, it verifies whether the equation described is valid.
(10)Idx1,l=eIdx2,Tok3∏i∈TeTok1,bi,Idx3,i/eTok3,bi,Idx4,idi.If the formula holds, the stored addressAddr is the output.


## 5.7. Decryption

### 5.7.1. Predecryption

The predecryption operation is performed by the cloud, which runs the PreD algorithm to complete. It inputs theGPK, user identity IdU, the predecryption key PreDKIdU,t, a time period t, the same set T=i∈nD∣bi∈S, and the ciphertext CT. If vi are valid shares of any secret μ from D, then the algorithm can compute a set di∈Zpi∈T which makes ∑i∈Tdivi=μ. It computes
(11)CT′=∏i∈TeC2,i,Tk2,bieC3,Tk3eTk1,bi,C1di=1eg3γ1+γ2,C1eg,C1a.


### 5.7.2. Decryption

The Dec algorithm inputs theGPK, private user key skIdU, the predecryption ciphertext CT′, and the symmetric decryption algorithm to generate the symmetric decryption key. This algorithm is run by the DU, and it can finish full decryption. The decryption is as follows. Using ks to run symmetric algorithms can enable users to get plaintext, and users will not consume a lot of costs because the previous operations are already performed in the cloud.
(12)ks=CT′⋅eD3b1D4b2,C1⋅C0=eg1b1γ1g2b2γ2,gμ⋅eg,gaμ⋅kseg3γ1+γ2,gμeg,gμa=eg3γ1+γ2,gμ⋅eg,gaμ⋅kseg3γ1+γ2,gμeg,gμa.


## 5.7.1. Predecryption

The predecryption operation is performed by the cloud, which runs the PreD algorithm to complete. It inputs theGPK, user identity IdU, the predecryption key PreDKIdU,t, a time period t, the same set T=i∈nD∣bi∈S, and the ciphertext CT. If vi are valid shares of any secret μ from D, then the algorithm can compute a set di∈Zpi∈T which makes ∑i∈Tdivi=μ. It computes
(11)CT′=∏i∈TeC2,i,Tk2,bieC3,Tk3eTk1,bi,C1di=1eg3γ1+γ2,C1eg,C1a.


## 5.7.2. Decryption

The Dec algorithm inputs theGPK, private user key skIdU, the predecryption ciphertext CT′, and the symmetric decryption algorithm to generate the symmetric decryption key. This algorithm is run by the DU, and it can finish full decryption. The decryption is as follows. Using ks to run symmetric algorithms can enable users to get plaintext, and users will not consume a lot of costs because the previous operations are already performed in the cloud.
(12)ks=CT′⋅eD3b1D4b2,C1⋅C0=eg1b1γ1g2b2γ2,gμ⋅eg,gaμ⋅kseg3γ1+γ2,gμeg,gμa=eg3γ1+γ2,gμ⋅eg,gaμ⋅kseg3γ1+γ2,gμeg,gμa.


## 6. Security Proof

Theorem 4.
If Pedersen (l, m) secret sharing protocol is IND-CPA secure and the SR-ABE scheme presented by Cui et al. [31] is IND-CPA secure, then our BC-SABE scheme is IND-CPA secure.
Proof: In contrast to the scheme in [31], distributed consortium blockchain is used in our scheme, replacing the centralized server in [31]. This allows the security of the whole system to be improved. Supposing that the adversary in our scheme can compromise at most l-1 authority, the reasons are as follows: Our PubDKey Oracle, the UpKey Oracle, and the PreDKey Oracle have excellent performance because it needs more than l authorities that are required to execute together. In addition, during the challenge phase, we defined related restrictions. Therefore, the proof of this scheme can be deduced from the security proof of the scheme [31] under the security of Pedersen (l, m) secret sharing protocol, and reciprocity protocol.Theorem 5.
Under the DBDH assumption, The BC-SABE scheme is IND-sCKA secure.Proof: Assuming that there is a PPT adversary A who can win the exponential indistinguishability game with an advantage ε that cannot be ignored, then the challenge B is constructed to resolve the DBDH problem with an advantage ε/2 that cannot be ignored.Init. Let S∗ be the challenge access structure defined by A.Setup. B returns the GPKto A by running the Setup1k,σ algorithm, the difference in GPKis eg,ga=egβ,gγ=eg,gβγ and r∈Zp∗, and other parameters are ignored here.Phase 1. A can adaptively execute the following queries:
(i)
IdKey query:A issues a IdKey query on an identity IdU, B returns skIdU,pkIdU by running IdKGGPK,IdU, and then, it adds IdU,skIdU,pkIdU to list L and returns skIdU to A(ii)
Token query:A issues a token query on IdU, an access structure S, and a keyword w. B runs PTokGGPK,skIdU,w⟶Tok′ by using skIdU. Then, B returns Tok to A by running the TokGGPK,IdU,D,ρ,Tok′ algorithm. The attribute set S does not meet challenge access structure(iii)
Index query:A issues an index query on a keyword set w and S. Then, B returns the index set by running IdxGGPK,S,wChallenge. A submits two keywords w1 and w2 of the same size. B picks random ρ∈0,1, and then, it returns the Ind∗=Idx1,l∗l∈Uw,Idx2∗,Idx3,i∗,Idx4,i∗i∈nD,S∗ to A by running the IdxGGPK,S∗,wρ algorithm with the challenge access structure S∗, where Idx1,wρ∗=ZHwρ, Idx2∗=gαr, Idx3,i∗=grvi, and Idx4,i∗=Fbivi.Two different situations require attention as follows:(1)
P=eg,gαβγ. Let μ=α and a=βγ, and then, the index set obtained in this case is the real index. Idx1,wρ∗=eg,gaμ⋅Hwρ, Idx2∗=gμr, Idx3,i∗=grvi,Idx4,i∗=Fbivi(2)
P=eg,gp. In this case, A cannot get information about ρ because of the randomness of pPhase 2. A can perform IdKey query, token query, and index query to B. The queries sent by A must also meet the above conditional restrictions.Guess. A performs a guess ρ′ for ρ; if ρ′=ρ, it wins. If it is case one P=eg,gαβγ, then Prρ′=ρ=ε+1/2; if it is case two P=eg,gp, then Prρ′=ρ=1/2. Finally, we can get that the probability that B can resolve DBDH assumption is
(13)12Prρ′=ρ∣P=eg,gαβγ+12Prρ′=ρ∣P=eg,gz=1212+ε+12⋅12−12=ε2.ε/2 is negligible due to the difficulty of the BDDH problem; that is, it is negligible that A can break the advantage of our scheme; that is to say, our scheme is security.


## 7. Performance Comparison

The performance of other related scheme [34–37] is compared with this scheme in this section. Let Ep and EpT denote exponential operation in G and G1; Pa denotes pairing operation. For convenience, NT indicates the number of attributes in the decryption operation and search operation in the system, Ne indicates the number of attributes in the encryption operation in the system, Ns denotes the number of attributes in the token generation in the system, and Nw indicates the number of attributes in the index generation in the system. Let symmetric encryption and decryption operations expressed as Sym.We use JPBC library version 2.0.0 for related experiments. The experiment was simulated on Windows system with an Intel(R) Core (TM) i5 CPU 3.20GHz and 8.00GB RAM to approximate the actual operation. We have obtained the measured values of exponentiation and pairing operations. The operating times ofEp, Pa, and EpT are 10.9 ms, 7.8 ms, and 0.15 ms, respectively. Table 1 shows the comparison of our scheme with other schemes in terms of encryption cost, decryption cost, and other aspects.Table 1
Performance comparison. Five aspects were compared with the other four schemes.
SchemesEncrypt costIndex genTok genSearchDecrypt cost[34]EpT+5Ne+1EpNoNoNo2NTPa+3EPT+Ep[35]Ne+1Pa+4NeEpNoNoNo5NTPa+EpT[36]SymEnc2Ne+Nw+3Ep2Nt+3EpEpT+2Ns+4PaSymDec[37]3Ne+2Pa+5NeEpNoNoNo5NT+1Pa+2EpTOursSym+Ne+2Ep+EpT2Ne+1Ep+NwEpTUser:EpNTEpT+2NT+1PaUser:2EpT+Sym+PaBC:2NsEp+EpTCloud:2NTEpT+3NTPa.Figure4 shows the comparison of the cost of encryption and decryption between our scheme and the other three multiauthority attribute-based encryption schemes. It is not difficult to see that the encryption and decryption time has a linear relationship with the number of attributes. Our scheme shifts the decryption process to operate on the cloud server, which makes the user’s computational cost effectively reduced.Figure 4
Enc/Dec time cost comparison. It can be seen that our scheme is not very expensive in terms of encryption and decryption.
(a)
Encrypt cost(b)
Decrypt costFigure5 compares our scheme with the scheme [36]. It is not difficult to see from the figure that our scheme is highly efficient in index generation, search, and token generation stages. Among them, in the token generation stage, our scheme transfers the work of token generation to the blockchain node, and users only need to generate part of the token.Figure 5
Other time cost comparison. It can be seen that our scheme is better in terms of index generation, token generation, and search compared to scheme [36].
(a)
Index gen cost(b)
Tok gen cost(c)
Search costObviously, because most of the calculation and storage work in the scheme is handed over to cloud servers and blockchain nodes, this makes our scheme more efficient in all aspects, especially in user decryption and token generation. Although the performance of some algorithms will be affected by the throughput of the blockchain and other factors, the security of the scheme will not be affected.


## 8. Conclusion

In this essay, we have presented a new BC-SABE scheme that replaces the centralized key management server in [31] using a consortium blockchain. The consortium blockchain consist of a trusted set of consensus nodes and is responsible for jointly generating the relevant partial parameters. We can guarantee the confidentiality of data transmission using the Pedersen secret sharing protocol, which enables sharing of subsecrets among consensus nodes, and the reciprocity protocol ensures that key information is shared without a trusted party. The update of the user revocation list is also performed entirely by the blockchain without re-encrypting the ciphertext. In addition, we move the predecryption operations to be performed in the cloud, and users are able to fully decrypt them with only a small amount of computation. Performance analysis shows that this scheme is more efficient compared to other schemes.



---

*Source: 8350006-2022-04-11.xml*