# Secure Outsourced Medical Data against Unexpected Leakage with Flexible Access Control in a Cloud Storage System

Authors: Xingguang Zhou; Jianwei Liu; Zongyang Zhang; Qianhong Wu
Journal: Security and Communication Networks
 (2020)

---

## Abstract

The application of cloud storage system has been deployed widely in recent years. A lot of electronic medical records (EMRs) are collected and uploaded to the cloud for scalable sharing among the authority users. It is necessary to guarantee the confidentiality of EMRs and the privacy of EMR owners. To achieve this target, we summarize a series of attack behaviors in the cloud storage system and present the security model against many types of unexpected privacy leakage. Privacy of unassailed EMRs is guaranteed in this model, and the influence of privacy leakage is controlled in a certain scope. We also propose a role-based access control scheme to achieve flexible access control on these private EMRs. One can access medical records only if his/her role satisfies the defined access policy, which implies a fine-grained access control. Theoretical and experimental analyses show the efficiency of our scheme in terms of computation and communication.


---

## Body

## 1. Introduction

Cloud communication has been envisioned as one of the most influential technologies in the medical field. Without being measured face-to-face, medical staff could give guidance to patients in a real-time way, which greatly improves the healthcare quality. For instance, a patient with heart disease history can deploy a medical sensor at home for the purpose of health monitoring. His health data are uploaded to cloud server and used by remote hospitals. The doctors in their duties could download his EMR and prepare the patient for treatment if needed. This method brings convenience for both patients and hospitals. However, once a patient’s data are uploaded to the cloud storage system, they lose the physical control over the data and the cloud provider can obtain the access on it. Privacy threats experienced by users of Google Inc., Apple Inc., and Amazon Inc. [1] clearly indicate that cloud is intrinsically insecure from the users’ point of view [2]. Most users would like to keep their personal information confidential to outsiders, let alone those patients whose EMRs include a lot of sensitive information. Data confidentiality is one of the important security concerns in the cloud storage system.A common solution for data confidentiality is to encrypt them using public key encryption [3] before transmitting to the cloud system. We first generate two cryptographic keys: one is public and the other is secret. The public key is distributed by the data owner who is responsible for encryption. The secret key is private and assigned to each recipient in duty for decryption, such as the medical staff who is responsible for a patient.While public key encryption ensures data confidentiality commendably, we admit that no matter what measures we take, unexpected privacy leakage sometimes happens. There are mainly three potential leakage risks in a typical cloud storage system: vulnerable medical devices, a semitrust cloud server, and the association among EMRs themselves. In the first type of risk, the data collected by medical devices will be firstly handled in a local but relatively open place (such as in a ward or on an ambulance), then it is uploaded to the cloud. The data are easily accessible for unauthorized persons in an emergency. In the second type of risk, since the cloud provider is a semitrusted organization, it honestly follows the rules but does everything possible to spy on the stored files. Patients’ information might be leaked by internal staff of the cloud provider. The third type of risk is due to EMRs’ internal association for a patient and his family, i.e., a father’s heart attack record may reflect a similar heart disease of his son. Leaking one record might infer unassailed ones. Besides the above three potential risks, we also need to consider that there are many malicious adversaries who keep trying to gain access to the cloud storage system, i.e., the communication among the devices (such as body sensors), the cloud and the EMR recipients. There are lots of ways to do this [4]. One way is to break the random-number generator (RNG) [5] and thus gain the randomness used for encryption. Another way is to break into the cloud part. For instance, Albrecht and Paterson [6] introduced a powerful attack that an adversary runs malicious JavaScript in a targeted browser and completely recovers HTTP session cookies or user credentials such as passwords.All these unexpected events might cause parts of database corrupted and data exposed. The cloud storage system should be resilient in the case of security breach. In other words, once the privacy leakage happens, the leakage effect should be controllable, so that the confidentiality of the “unleaked” information is guaranteed. Therefore, controllability of privacy leakage is another important security concern in the cloud storage system.Furthermore, we need to consider that the cloud storage system is usually associated with a multiparty communication environment, as Figure1 describes. The health data are scalably shared among authorized users. From the recipients’ point of view, the access control manner needs to be flexible enough to deal with the changes of users’ roles and permissions [7].Figure 1
A medical cloud communication environment.


### 1.1. Our Contributions

Based on the aforementioned security concerns in the cloud storage system, we propose a leakage controllable scheme to achieve data confidentiality with a flexible access manner. Since our scheme is based on a multiuser access policy, it quite matches the real world’s scenario which includes many users in a hierarchical organization. Specific techniques are highlighted as follows.Privacy Leakage Controllability. As unexpected privacy leakage always happens in various forms, we propose new security models, called role-based access control against unexpected leakage (RBAC-UL) to capture further leakage on the remaining “unleaked” EMRs. RBAC-UL security is achieved if confidentiality of unassailed EMRs is still guaranteed.Flexible Access Control. We offer an efficient approach to support fine-grained access control for a hierarchical healthcare organization. A user can comprehend an EMR only if his identity satisfies the associated access policy.Scalable Data Sharing. It is achieved by letting higher-level medical staff delegate access privilege for his subordinates.Constant Size Ciphertext. Our scheme achieves constant size of encapsulated EMR no matter how many users satisfy the defined access policy.Rigorous Security Analysis. To ensure that our proposal is qualified enough for the series of security concerns, we present rigorous security analysis. The analysis shows that our proposal achieves a high privacy-preserving capacity, where data confidentiality, leakage controllability, and access control flexibility can be achieved simultaneously in the cloud storage system.


## 1.1. Our Contributions

Based on the aforementioned security concerns in the cloud storage system, we propose a leakage controllable scheme to achieve data confidentiality with a flexible access manner. Since our scheme is based on a multiuser access policy, it quite matches the real world’s scenario which includes many users in a hierarchical organization. Specific techniques are highlighted as follows.Privacy Leakage Controllability. As unexpected privacy leakage always happens in various forms, we propose new security models, called role-based access control against unexpected leakage (RBAC-UL) to capture further leakage on the remaining “unleaked” EMRs. RBAC-UL security is achieved if confidentiality of unassailed EMRs is still guaranteed.Flexible Access Control. We offer an efficient approach to support fine-grained access control for a hierarchical healthcare organization. A user can comprehend an EMR only if his identity satisfies the associated access policy.Scalable Data Sharing. It is achieved by letting higher-level medical staff delegate access privilege for his subordinates.Constant Size Ciphertext. Our scheme achieves constant size of encapsulated EMR no matter how many users satisfy the defined access policy.Rigorous Security Analysis. To ensure that our proposal is qualified enough for the series of security concerns, we present rigorous security analysis. The analysis shows that our proposal achieves a high privacy-preserving capacity, where data confidentiality, leakage controllability, and access control flexibility can be achieved simultaneously in the cloud storage system.


## 2. Related Work

Privacy-preserving access control in the cloud storage system has received more and more attention recently. Cryptography and authentication methods are utilized in the cloud network to offer secure healthcare services via wireless communications [8]. For the security of EMR, encryption is an efficient and cost-saving choice to guarantee patients’ privacy. A lot of prominent schemes have been proposed to achieve this target. The scheme applying identity-based encryption (IBE) [9, 10] presents efficient solutions for the body sensor network. While considering fine-grained sharing of encrypted data, attribute-based encryption (ABE) [11, 12] is promising. This is because ABE provides differential access privileges for a set of users such as healthcare providers and allows flexibility in designating the access privileges of individual users over the encrypted data [13]. An immediate attribute modification method is used to achieve fine-grained user revocation and the outsourced e-health records security [14]. The searchable ABE scheme is a promising technique that can ensure the protection of patients’ private information without compromising on performance [15]. When applying ABE schemes in the medical systems, it shows the security and flexibility as the user tries to access the outsourced EMRs. Besides, a role-based access control framework [16, 17] is proposed by using hierarchical identity-based broadcast encryption (HIBBE) [18] without ABE, which ensures the security, scalability, and flexibility for the outsourced EMRs. A secure role-based cloud storage system for encrypted patient-centric health records is achieved in commercial healthcare systems [19]. An auditing revocable privacy-preserving access control scheme for the e-health records shows the efficiency of RBAC in terms of communication and computation [20]. An enhancing medical data security scheme in the cloud using RBAC provides security to the data over an alien environment [21].Although the aforementioned schemes devote to securing the outsourced EMRs, they are unable to deal with the situation of unexpected privacy leakage, let alone to minimize its effect. In a cloud storage system, the leakage threats mainly include secret credential leakage [22, 23], encapsulation-related randomness leakage [24, 25], internal files, accounts or other records leakage, etc. The target of our paper is to minimize the impact of leakage in the event that these unexpected issues happen. We notice that a lot of schemes have been put forward theoretically against these unexpected leakages, including the public-key encryption [26–28] and the identity-based encryption schemes [29–31]. They are different from our RBAC-UL mechanism. The former mainly guarantee the confidentiality of the remaining “unleaked” records, while ours not only ensures the confidentiality of “unleaked” data, but also achieves scalable sharing and flexible access control of all the outsourced EMRs.


## 3. Preliminaries

This section provides some mathematical basis for our proposal. The notations that are used in our scheme are given in Table1. For ease of description, some of them are borrowed from [16, 17].Table 1
Notations.
Notation
Description
λ
Security parameter
R
Atom role for medical staff
R
⟶
Role for medical staff
S
R
⟶
Atom role set forR⟶
P
Access policy
S
P
Atom role set forP
MSK
Master secret key
EMR
Electronic medical record
PPT
Probabilistic polynomial time
SC
R
⟶
Secret credential for a roleR⟶
En
The encapsulated EMR
Pref
R
⟶
Prefix ofR⟶, defined as R1,…,Rd′:d′≤d
Pref
P
Prefix ofP, defined as ∪R⟶∈PPrefR⟶


### 3.1. Bilinear Groups

LetG be a group generation algorithm that takes a security parameter λ as input and outputs the description of a bilinear group N,G,GT,e. In our case, G outputs N=p1p2p3p4,G,GT,e where p1,p2,p3,p4 are distinct prime factors, G and GT are cyclic groups of order N=p1p2p3p4, and e:G×G⟶GT is an efficient bilinear map satisfying the two properties: (i) bilinearity: For all g,h∈G and all a,b∈ℤN, ega,hb=eg,hab; (ii) nondegeneracy: there exists at least a generator g in G such that eg,g generates GT. We, respectively, denote the subgroups of order p1,p2,p3,p4 in G by Gp1,Gp2,Gp3, and Gp4. We use Gpipj 1≤i,j≤4 to denote the subgroup of order pipj in G. These four subgroups additionally satisfy the orthogonality property, i.e., ∀hi∈Gpi and hj∈Gpj for i≠j, ehj,hj=1. This orthogonality property will be a principal tool in our constructions. Composite-order bilinear groups were first introduced in [32].


### 3.2. Theoretical Assumptions

Our security analysis is based on the following mathematical assumptions.Assumption 1.
Given a group generatorG, we define the following distribution:(1)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g3⟵RGp3,g4⟵RGp4,D=G,g1,g3,g4.
Assumption1 determines whether a given element T is randomly chosen from G or from Gp1p3p4, namely, T⟵RG or T⟵RGp1p3p4. The advantage of an algorithm A that outputs a bit b∈0,1 in breaking Assumption 1 is defined as(2)Adv1Aλ=PrAD,T⟵RG=1−PrAD,T⟵RGp1p3p4=1−12.Definition 1.
G satisfies Assumption 1 if Adv1Aλ is a negligible function for any PPT algorithm A.Assumption 2.
Given a group generatorG, we define the following distribution:(3)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g3⟵RGp3,g4⟵RGp4,D=G,g1,g3,g4.
Assumption2 determines whether a given element is T⟵RGp1p2p4 or T⟵RGp1p4. The advantage of an algorithm A that outputs b∈0,1 in breaking the Assumption 2 is defined as(4)Adv2Aλ=PrAD,T⟵RGp1p2p4=1−PrAD,T⟵RGp1p4=1−12.Definition 2.
G satisfies the Assumption 2 if Adv2Aλ is a negligible function for any PPT algorithm A.Assumption 3.
Given a group generatorG, we define the following distribution:(5)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g3⟵RGp3,g4⟵RGp4,D23⟵RGp2p3,A12⟵RGp1p2,D=G,g1,g3,g4,D23,A12.
Assumption3 determines whether a given element is T⟵RGp1p2p3 or T⟵RGp1p3. The advantage of an algorithm A that outputs b∈0,1 in breaking Assumption 3 is defined as(6)Adv3Aλ=PrAD,T⟵RGp1p2p3=1−PrAD,T⟵RGp1p3=1−12.Definition 3.
G satisfies Assumption 3 if Adv3Aλ is a negligible function for any PPT algorithm A.Assumption 4.
Given a group generatorG, we define the following distribution:(7)G=N=p1p2p3p4,G,GT,e⟵RG,g2⟵RGp2,g3⟵RGp3,g4⟵RGp4,W14⟵RGp1p4,E12⟵RGp1p2,D=G,g2,g3,g4,W14,E12.
Assumption4 determines whether a given element is T⟵RGp2p4 or T⟵RGp1p2p4. The advantage of an algorithm A that outputs b∈0,1 in breaking Assumption 4 is defined as(8)Adv4Aλ=PrAD,T⟵RGp2p4=1−PrAD,T⟵RGp1p2p4=1−12.Definition 4.
G satisfies Assumption 4 if Adv4Aλ is a negligible function for any PPT algorithm A.Assumption 5.
Given a group generatorG, we define the following distribution:(9)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g4⟵RGp4,D23⟵RGp2p3,D=G,g1,g4,D23.
Assumption5 determines whether a given element is T⟵RG or T⟵RGp1p2p4. The advantage of an algorithm A that outputs b∈0,1 in breaking Assumption 5 is defined as(10)Adv5Aλ=PrAD,T⟵RG=1−PrAD,T⟵RGp1p2p4=1−12.Definition 5.
G satisfies Assumption 5 if Adv5Aλ is a negligible function for any PPT algorithm A.


## 3.1. Bilinear Groups

LetG be a group generation algorithm that takes a security parameter λ as input and outputs the description of a bilinear group N,G,GT,e. In our case, G outputs N=p1p2p3p4,G,GT,e where p1,p2,p3,p4 are distinct prime factors, G and GT are cyclic groups of order N=p1p2p3p4, and e:G×G⟶GT is an efficient bilinear map satisfying the two properties: (i) bilinearity: For all g,h∈G and all a,b∈ℤN, ega,hb=eg,hab; (ii) nondegeneracy: there exists at least a generator g in G such that eg,g generates GT. We, respectively, denote the subgroups of order p1,p2,p3,p4 in G by Gp1,Gp2,Gp3, and Gp4. We use Gpipj 1≤i,j≤4 to denote the subgroup of order pipj in G. These four subgroups additionally satisfy the orthogonality property, i.e., ∀hi∈Gpi and hj∈Gpj for i≠j, ehj,hj=1. This orthogonality property will be a principal tool in our constructions. Composite-order bilinear groups were first introduced in [32].


## 3.2. Theoretical Assumptions

Our security analysis is based on the following mathematical assumptions.Assumption 1.
Given a group generatorG, we define the following distribution:(1)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g3⟵RGp3,g4⟵RGp4,D=G,g1,g3,g4.
Assumption1 determines whether a given element T is randomly chosen from G or from Gp1p3p4, namely, T⟵RG or T⟵RGp1p3p4. The advantage of an algorithm A that outputs a bit b∈0,1 in breaking Assumption 1 is defined as(2)Adv1Aλ=PrAD,T⟵RG=1−PrAD,T⟵RGp1p3p4=1−12.Definition 1.
G satisfies Assumption 1 if Adv1Aλ is a negligible function for any PPT algorithm A.Assumption 2.
Given a group generatorG, we define the following distribution:(3)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g3⟵RGp3,g4⟵RGp4,D=G,g1,g3,g4.
Assumption2 determines whether a given element is T⟵RGp1p2p4 or T⟵RGp1p4. The advantage of an algorithm A that outputs b∈0,1 in breaking the Assumption 2 is defined as(4)Adv2Aλ=PrAD,T⟵RGp1p2p4=1−PrAD,T⟵RGp1p4=1−12.Definition 2.
G satisfies the Assumption 2 if Adv2Aλ is a negligible function for any PPT algorithm A.Assumption 3.
Given a group generatorG, we define the following distribution:(5)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g3⟵RGp3,g4⟵RGp4,D23⟵RGp2p3,A12⟵RGp1p2,D=G,g1,g3,g4,D23,A12.
Assumption3 determines whether a given element is T⟵RGp1p2p3 or T⟵RGp1p3. The advantage of an algorithm A that outputs b∈0,1 in breaking Assumption 3 is defined as(6)Adv3Aλ=PrAD,T⟵RGp1p2p3=1−PrAD,T⟵RGp1p3=1−12.Definition 3.
G satisfies Assumption 3 if Adv3Aλ is a negligible function for any PPT algorithm A.Assumption 4.
Given a group generatorG, we define the following distribution:(7)G=N=p1p2p3p4,G,GT,e⟵RG,g2⟵RGp2,g3⟵RGp3,g4⟵RGp4,W14⟵RGp1p4,E12⟵RGp1p2,D=G,g2,g3,g4,W14,E12.
Assumption4 determines whether a given element is T⟵RGp2p4 or T⟵RGp1p2p4. The advantage of an algorithm A that outputs b∈0,1 in breaking Assumption 4 is defined as(8)Adv4Aλ=PrAD,T⟵RGp2p4=1−PrAD,T⟵RGp1p2p4=1−12.Definition 4.
G satisfies Assumption 4 if Adv4Aλ is a negligible function for any PPT algorithm A.Assumption 5.
Given a group generatorG, we define the following distribution:(9)G=N=p1p2p3p4,G,GT,e⟵RG,g1⟵RGp1,g4⟵RGp4,D23⟵RGp2p3,D=G,g1,g4,D23.
Assumption5 determines whether a given element is T⟵RG or T⟵RGp1p2p4. The advantage of an algorithm A that outputs b∈0,1 in breaking Assumption 5 is defined as(10)Adv5Aλ=PrAD,T⟵RG=1−PrAD,T⟵RGp1p2p4=1−12.Definition 5.
G satisfies Assumption 5 if Adv5Aλ is a negligible function for any PPT algorithm A.


## 4. System Model

In Figure1, we describe a typical medical cloud storage system. It is a multiuser setting environment consisting of four entities: an EMR owner, a cloud server, an EMR recipient, and a trusted key authority (TKA).The EMR owner is usually a patient who is monitored by different types of medical sensors. His/her medical records are sent via wireless networks. Each record is encrypted and associated with its own access policy and then stored on the cloud server for sharing with the entitled medical staff.The cloud provides a large number of servers for many organizations. It is honest but curious, i.e., it obeys rules of the cloud system, but could do everything possible to spy on the stored EMRs.The EMR recipient consists of groups of medical staff who are entitled to read the patients’ EMRs and provide services for them. The medical staff are semitrusted. If they are authorized, they do not reveal any information. Otherwise, they might be potential adversaries. The staff at the higher-level is responsible for managing lower-level ones, which derives a tree-like organization. For example, the role of a nurse consisting of ordered atom roles “department psychiatry, chief doctor, head nurse, nurse,” is administrated by the head nurse whose role is “department psychiatry, chief doctor, head nurse.” The head nurse is administrated by the chief doctor and so on. We group the chief doctor, the head nurse, and the nurse in one access policy, where all of them are responsible for a certain patient. The patient is identified by his name or identity information. Each medical staff can encapsulate the patient’s EMR, but only the one whose role satisfies the corresponding access policy can decapsulate it.The TKA is responsible for generating and distributing system parameters.A role-based access control scheme consists of the following algorithms:PK,MSK⟵Setupλ,n: the setup algorithm is run by TKA. It takes as inputs a security parameter λ and a maximal size n of users. It outputs a masker key MSK and a public key PK.SCR⟶⟵SCGenPK,MSK,R⟶: the secret credential generation algorithm of medical staff takes as inputs a public key PK, a master key MSK, and a role R⟶ for a medical staff. It outputs a secret credential SCR⟶ for the medical staff with role R⟶.SCR⟶⟵SCDelegPK,SCR′⟶,R: the secret credential delegation algorithm of medical staff takes as inputs a public key PK, a secret credential SCR′⟶ for a medical staff with role R′⟶, and an atom role R. It returns the secret credential SCR⟶ for the medical staff with role R⟶=R′⟶,R. The medical staff with role R′⟶ is the supervisor of the one with role R⟶.En⟵EMREncPK,P,EMR: the EMR encapsulation algorithm takes as inputs a public key PK, an access policy P, and an EMR file EMR. It outputs an encapsulated EMR file En.EMR⟵EMRDecPK,R⟶,En,SCR⟶: the EMR decapsulation algorithm takes as inputs a public key PK, a medical staff’s role R, an encapsulated EMR En, and a secret credential SCR⟶ for the medical staff with role R⟶. It outputs an EMR file EMR.


## 5. Security Requirements

In practice, all entities except TKA are likely to attack the cloud storage system. A dishonest party may try to get useful information from the encapsulated EMRs, which is not authorized to access or derive from the leaked EMRs. In the context of such attack, our scheme is expected to meet the following security requirements.(i)
Data privacy: EMRs need to be obfuscated before being uploaded and securely stored on cloud servers, until an authorized user downloads and deobfuscates them.(ii)
Leakage controllability: when a privacy leakage happens unavoidably, it must be possible to minimize the leakage effect, which means the privacy of nonleaked EMRs should be guaranteed.


### 5.1. The Adversary Model for RBAC-UL

The adversary model for RBAC-UL is aimed to satisfy the requirement ofleakage controllability. Since the content of EMRs may be internally related, partial leakage might expose information on those EMRs. Therefore, it is necessary to clarify what it means for the unleaked EMRs to remain confidential. In the RBAC-UL model, we assume two roles: an adversary and a simulator. The adversary’s goal is to collect as much information from the unleaked EMRs as possible, i.e., the corrupted EMRs, the encapsulated EMRs, and the randomness used for encapsulation. The simulator acts like a normal person with neutral characters: he can get the same input as the adversary when a leakage happens, and he has the ability to corrupt the EMR owners to learn their EMRs. Apart from that, the simulator cannot get any further information. We claim that if any adversary cannot obtain more information from the unleaked EMRs than the simulator, then the security of the remaining EMRs is guaranteed.We formally define the adversary model for RBAC-UL, which is inspired by the work [29]. In the model, the corrputed EMR is encapsulated with a target access policy set P∗ containing all the medical staff who are allowed to decapsulate. The adversary is allowed to do the following: (a) it can obtain secret credentials associated with roles R∉PrefP∗, which implies the adversary can collude any medical staff with roles that do not satisfy the target access policy; (b) it can obtain all the targeted encapsulated EMRs, En⟶=En1,En2,…,Enn; (c) it can randomly corrupt any encapsulated EMRs from En⟶ and then obtain their files EMRii∈1,n with the randomness used for encapsulation rii∈1,n, which implies that the adversary has the ability to corrupt the EMR owners.We use two security games for further illustration. The first one is played between an adversaryA and a challenger C. It describes what an adversary could obtain in the real world. The second one is played between a simulator S and a challenger C. It describes what a simulator could obtain in an ideal experiment.The real gameGamereal,Aλ of RBAC-UL:Setup: the challengerC runs Setup to obtain the system parameter PK and gives PK to the adversary A.Challenge:A outputs a set of EMRs, EMR⟶=EMR1,EMR2,…,EMRn on which it wishes to challenge, together with a set of access policy P∗=P1∗,P2∗,…,Pn∗ including all the broadcast groups that it wishes to attack. In our case, a broadcast group represents a group of medical staff who are eligible to read a certain kind of EMR. For example, the medical staff in the access policy group P2∗ are authorized to fetch EMR2, but no authority for other EMRs. Each access policy Pi∗ should satisfy that for all the secret credential queries issued in Query Phase 1, there is R⟶∉PrefPi∗. C randomly chooses ri⟵Zp for each EMRi, where p=G and i∈1,2,…,n, and computes Eni⟵EncPK,Pi∗,EMRi,ri. Finally, the challenger C returns the encapsulated EMRs En⟶=En1,En2,…,Enn to A.Query Phase 1:A issues a secret credential query for a medical staff associated with role R⟶. The challenger C generates a secret credential for R⟶ and returns it to A.Challenge:A outputs a set of EMRs, EMR⟶=EMR1,EMR2,…,EMRn on which it wishes to challenge, together with a set of access policy P∗=P1∗,P2∗,…,Pn∗ including all the broadcast groups that it wishes to attack. In our case, a broadcast group represents a group of medical staff who are eligible to read a certain kind of EMR. For example, the medical staff in the access policy group P2∗ are authorized to fetch EMR2, but no authority for other EMRs. Each access policy Pi∗ should satisfy that for all the secret credential queries issued in Query Phase 1, there is R⟶∉PrefPi∗. C randomly chooses ri⟵Zp for each EMRi, where p=G and i∈1,2,…,n, and computes Eni⟵EncPK,Pi∗,EMRi,ri. Finally, the challenger C returns the encapsulated EMRs En⟶=En1,En2,…,Enn to A.Corrupt: the adversaryA outputs a set I⊆1,n to C on which A wishes to corrupt. C corrupts the corresponding EMRs to get EMRi,rii∈I and returns them to the adversary.Query Phase 2:A issues a secret credential query for the medical staff with role R⟶ such that R⟶∉PrefP∗. The challenger responds the same as Query Phase 1.Output: the adversaryA outputs a bit OutA.The simulated gameGamesim,Sλ of RBAC-UL:Setup: the simulatorS gets system parameters from the challenger C.Challenge:S outputs a set of EMRs, EMR⟶=EMR1,EMR2,…,EMRn on which it wishes to challenge, together with a set of access policy P∗=P1∗,P2∗,…,Pn∗ including all the broadcast groups that it wishes to attack. The challenger C gets these inputs, but gives no feedback to the adversary A.Corrupt:S outputs a set I⊆1,n to C. The challenger C picks up the corresponding EMRii∈I and returns them to the simulator.Output: the simulatorS outputs a bit OutS.We claim that if for every PPT adversary there exists a PPT simulator who can generate an indistinguishable output without seeing any encapsulated EMR and randomness, then the scheme achieves RBAC-UL security.Definition 6.
The advantage of a RBAC-UL adversaryA against a RBAC scheme Γ with a simulator S is defined as follows:(11)AdvΓ,S,ARBAC−ULA=PrGamereal,Aλ=1−PrGamesim,Sλ=1.Definition 7.
(RBAC-UL Security). Given an RBAC scheme, if no PPT distinguisherD can distinguish the output from Gamereal,A and Gamesim,S, namely,(12)PrDOutA=1−PrDOutS=1=ϵ,where ϵ is a negligible function in the security parameter, then we claim that the scheme achieves RBAC-UL security.


### 5.2. The Adversary Model for RBAC-IND

The adversary model for RBAC-Indistinguishability (RBAC-IND) is aimed to satisfy the requirement ofdata privacy. The indistinguishability can be illustrated as follows: a recipient (the medical staff who are eligible to get access on one EMR) generates a credential pair; a sender (EMR owner) encapsulates one out of two EMRs and send it to the adversary; the RBAC-IND adversary tries to find out which one it was. Here, importantly, the adversary has the authority to issue secret credential query. If the adversary cannot distinguish an encapsulation of challenge EMR from an encapsulation of random message, we claim that our system achieves RBAC-IND security.The RBAC-IND model is defined by a security game played between a challengerC and an adversary A. We apply the full security notion [33, 34] to the RBAC-IND model. That means the adversary can adaptively output the access policy that it wishes to attack during the system interaction.The security gameGameΓ,ARBAC−INDλ: let Γ=Setup,SCGen,SCDeleg,EMREnc,EMRDec be a role-based access control scheme.Setup: the challenger runs the setup algorithm to obtain a public keyPK and gives it to the adversary A.Query Phase 1:A issues a secret credential query for the medical staff with role R⟶. The challenger generates a secret credential for R⟶ and gives it to the adversary.Challenge: the adversaryA outputs two equal-length EMR files, EMR0, and EMR1 on which it wishes to challenge. A outputs a challenge access policy P∗ either. The access policy P∗ should satisfy that for all the secret credential queries for R⟶ issued in Query Phase, R⟶∉PrefP∗. The challenger flips a random coin β∈0,1 and encapsulates EMRβ under the challenge access policy P∗. Then, it returns the encapsulated EMR to A.Query Phase 2:A issues a credential query for the medical staff with role R⟶ such that R⟶∉PrefP∗. The challenger responds the same as in Query Phase.Guess: the adversaryA guesses β′∈0,1. It ouputs 1 if β=β′ and 0 otherwise. We say A succeeds if β=β′.Definition 8.
Given an RBAC schemeΓ, we define the probability advantage for an RBAC-IND adversary A of winning the security game GameΓ,ARBAC−INDλ to be(13)AdvΓ,ARBAC−INDλ=2⋅PrGameΓ,ARBAC−INDλ=1−1.Definition 9 (RBAC-IND security).
Given an RBAC schemeΓ, if for each polynomial-time RBAC-IND adversary, its advantage AdvΓ,ARBAC−INDλ is a negligible function in security parameter λ, then the scheme Γ achieves RBAC-IND security.


## 5.1. The Adversary Model for RBAC-UL

The adversary model for RBAC-UL is aimed to satisfy the requirement ofleakage controllability. Since the content of EMRs may be internally related, partial leakage might expose information on those EMRs. Therefore, it is necessary to clarify what it means for the unleaked EMRs to remain confidential. In the RBAC-UL model, we assume two roles: an adversary and a simulator. The adversary’s goal is to collect as much information from the unleaked EMRs as possible, i.e., the corrupted EMRs, the encapsulated EMRs, and the randomness used for encapsulation. The simulator acts like a normal person with neutral characters: he can get the same input as the adversary when a leakage happens, and he has the ability to corrupt the EMR owners to learn their EMRs. Apart from that, the simulator cannot get any further information. We claim that if any adversary cannot obtain more information from the unleaked EMRs than the simulator, then the security of the remaining EMRs is guaranteed.We formally define the adversary model for RBAC-UL, which is inspired by the work [29]. In the model, the corrputed EMR is encapsulated with a target access policy set P∗ containing all the medical staff who are allowed to decapsulate. The adversary is allowed to do the following: (a) it can obtain secret credentials associated with roles R∉PrefP∗, which implies the adversary can collude any medical staff with roles that do not satisfy the target access policy; (b) it can obtain all the targeted encapsulated EMRs, En⟶=En1,En2,…,Enn; (c) it can randomly corrupt any encapsulated EMRs from En⟶ and then obtain their files EMRii∈1,n with the randomness used for encapsulation rii∈1,n, which implies that the adversary has the ability to corrupt the EMR owners.We use two security games for further illustration. The first one is played between an adversaryA and a challenger C. It describes what an adversary could obtain in the real world. The second one is played between a simulator S and a challenger C. It describes what a simulator could obtain in an ideal experiment.The real gameGamereal,Aλ of RBAC-UL:Setup: the challengerC runs Setup to obtain the system parameter PK and gives PK to the adversary A.Challenge:A outputs a set of EMRs, EMR⟶=EMR1,EMR2,…,EMRn on which it wishes to challenge, together with a set of access policy P∗=P1∗,P2∗,…,Pn∗ including all the broadcast groups that it wishes to attack. In our case, a broadcast group represents a group of medical staff who are eligible to read a certain kind of EMR. For example, the medical staff in the access policy group P2∗ are authorized to fetch EMR2, but no authority for other EMRs. Each access policy Pi∗ should satisfy that for all the secret credential queries issued in Query Phase 1, there is R⟶∉PrefPi∗. C randomly chooses ri⟵Zp for each EMRi, where p=G and i∈1,2,…,n, and computes Eni⟵EncPK,Pi∗,EMRi,ri. Finally, the challenger C returns the encapsulated EMRs En⟶=En1,En2,…,Enn to A.Query Phase 1:A issues a secret credential query for a medical staff associated with role R⟶. The challenger C generates a secret credential for R⟶ and returns it to A.Challenge:A outputs a set of EMRs, EMR⟶=EMR1,EMR2,…,EMRn on which it wishes to challenge, together with a set of access policy P∗=P1∗,P2∗,…,Pn∗ including all the broadcast groups that it wishes to attack. In our case, a broadcast group represents a group of medical staff who are eligible to read a certain kind of EMR. For example, the medical staff in the access policy group P2∗ are authorized to fetch EMR2, but no authority for other EMRs. Each access policy Pi∗ should satisfy that for all the secret credential queries issued in Query Phase 1, there is R⟶∉PrefPi∗. C randomly chooses ri⟵Zp for each EMRi, where p=G and i∈1,2,…,n, and computes Eni⟵EncPK,Pi∗,EMRi,ri. Finally, the challenger C returns the encapsulated EMRs En⟶=En1,En2,…,Enn to A.Corrupt: the adversaryA outputs a set I⊆1,n to C on which A wishes to corrupt. C corrupts the corresponding EMRs to get EMRi,rii∈I and returns them to the adversary.Query Phase 2:A issues a secret credential query for the medical staff with role R⟶ such that R⟶∉PrefP∗. The challenger responds the same as Query Phase 1.Output: the adversaryA outputs a bit OutA.The simulated gameGamesim,Sλ of RBAC-UL:Setup: the simulatorS gets system parameters from the challenger C.Challenge:S outputs a set of EMRs, EMR⟶=EMR1,EMR2,…,EMRn on which it wishes to challenge, together with a set of access policy P∗=P1∗,P2∗,…,Pn∗ including all the broadcast groups that it wishes to attack. The challenger C gets these inputs, but gives no feedback to the adversary A.Corrupt:S outputs a set I⊆1,n to C. The challenger C picks up the corresponding EMRii∈I and returns them to the simulator.Output: the simulatorS outputs a bit OutS.We claim that if for every PPT adversary there exists a PPT simulator who can generate an indistinguishable output without seeing any encapsulated EMR and randomness, then the scheme achieves RBAC-UL security.Definition 6.
The advantage of a RBAC-UL adversaryA against a RBAC scheme Γ with a simulator S is defined as follows:(11)AdvΓ,S,ARBAC−ULA=PrGamereal,Aλ=1−PrGamesim,Sλ=1.Definition 7.
(RBAC-UL Security). Given an RBAC scheme, if no PPT distinguisherD can distinguish the output from Gamereal,A and Gamesim,S, namely,(12)PrDOutA=1−PrDOutS=1=ϵ,where ϵ is a negligible function in the security parameter, then we claim that the scheme achieves RBAC-UL security.


## 5.2. The Adversary Model for RBAC-IND

The adversary model for RBAC-Indistinguishability (RBAC-IND) is aimed to satisfy the requirement ofdata privacy. The indistinguishability can be illustrated as follows: a recipient (the medical staff who are eligible to get access on one EMR) generates a credential pair; a sender (EMR owner) encapsulates one out of two EMRs and send it to the adversary; the RBAC-IND adversary tries to find out which one it was. Here, importantly, the adversary has the authority to issue secret credential query. If the adversary cannot distinguish an encapsulation of challenge EMR from an encapsulation of random message, we claim that our system achieves RBAC-IND security.The RBAC-IND model is defined by a security game played between a challengerC and an adversary A. We apply the full security notion [33, 34] to the RBAC-IND model. That means the adversary can adaptively output the access policy that it wishes to attack during the system interaction.The security gameGameΓ,ARBAC−INDλ: let Γ=Setup,SCGen,SCDeleg,EMREnc,EMRDec be a role-based access control scheme.Setup: the challenger runs the setup algorithm to obtain a public keyPK and gives it to the adversary A.Query Phase 1:A issues a secret credential query for the medical staff with role R⟶. The challenger generates a secret credential for R⟶ and gives it to the adversary.Challenge: the adversaryA outputs two equal-length EMR files, EMR0, and EMR1 on which it wishes to challenge. A outputs a challenge access policy P∗ either. The access policy P∗ should satisfy that for all the secret credential queries for R⟶ issued in Query Phase, R⟶∉PrefP∗. The challenger flips a random coin β∈0,1 and encapsulates EMRβ under the challenge access policy P∗. Then, it returns the encapsulated EMR to A.Query Phase 2:A issues a credential query for the medical staff with role R⟶ such that R⟶∉PrefP∗. The challenger responds the same as in Query Phase.Guess: the adversaryA guesses β′∈0,1. It ouputs 1 if β=β′ and 0 otherwise. We say A succeeds if β=β′.Definition 8.
Given an RBAC schemeΓ, we define the probability advantage for an RBAC-IND adversary A of winning the security game GameΓ,ARBAC−INDλ to be(13)AdvΓ,ARBAC−INDλ=2⋅PrGameΓ,ARBAC−INDλ=1−1.Definition 9 (RBAC-IND security).
Given an RBAC schemeΓ, if for each polynomial-time RBAC-IND adversary, its advantage AdvΓ,ARBAC−INDλ is a negligible function in security parameter λ, then the scheme Γ achieves RBAC-IND security.


## 6. Proposed Solution

Our technical solution leverages hierarchical identity-based encryption (HIBE) [35] and extends it to a multireceiver scenario. In HIBE, an encryptor can only encrypt a single path, which implies either repetitive encryption or constrained access policy for multiple receivers. Our role-based access control solution supports fine-grained access by encapsulating EMRs to any subset of hierarchically organized users, which is based on HIBBE. Furthermore, it resists many types of unexpected leakage, so that the leakage effect can be controlled in a certain scope. The following subsections show how we achieve this target. In Section 6.1, we construct a one-bit RBAC scheme with one-sided public leakage (1SPL) functionality. 1SPL means there exists a public procedure that given the one-bit encapsulation message En1 of “1” can compute the randomness r under which the encapsulation applied to “1” would generate En1. En1 is used to denote the encapsulation message of “1.” The idea comes from the notion of one-side public openability [36]. In Section 6.2, we provide security analysis for the proposed one-bit RBAC scheme with 1SPL. In Section 6.4, we provide a reduction showing that if a one-bit RBAC scheme with 1SPL functionality is secure, the normal multibit scheme with RBAC-UL model is secure. Our solution achieves data privacy, leakage controllability, and flexible access control.


### 6.1. Construction of One-Bit RBAC Scheme with 1SPL

Setupλ,n. The system setup algorithm is run by TKA. It chooses a bilinear group G of order N, and random elements g1,g2,g3,g4 from Gp1,Gp2,Gp3,Gp4, random exponents u11,u12,…,u1n,u4,x1,x4,ω4⟵RZN, and computes U1i⟵Rg1u1i, U4⟵Rg4u4, X1⟵Rg1x1, X4⟵Rg4x4, W4⟵Rg4ω4, U1i,4⟵RU1iU4, W14⟵Rg1W4, X14⟵RX1X4 for i∈1,n. It outputs a public key PK=N,U1i,4i∈1,n,X14,W14,g4 and a master secret key MSK=g1,g3,U1ii∈1,n,X1.
SCGenPK,MSK,R⟶. This is the secret credential generation algorithm. For the medical staff with role R⟶=R1,…,Rd, we denote I=i:Ri∈SR⟶. When a medical staff at the top-level joins a hospital organization, TKA generates a secret credential SCR⟶ for them:
(14)
K
1
=
g
1
r
g
3
r
3
,
K
2
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
⋅
g
3
r
3
′
,
E
j
=
U
1
j
r
⋅
g
3
r
j
j
∈
i
,
n
/
I
,
wherer,r3,r3′,rjj∈1,n/I⟵RZN.
SCDelegPK,SCR′⟶,R. This is the secret credential delegation algorithm. A junior medical staff with role R⟶=R′⟶,R is authenticated by a supervisor with role R′⟶. His supervisor delegates a secret credential for them:
(15)
K
1
=
K
1
′
g
1
r
′
g
3
r
3
˜
,
K
2
=
K
2
′
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
′
⋅
E
i
′
i
∈
I
/
I
′
R
⋅
g
3
r
^
3
′
,
E
j
=
E
j
′
⋅
U
1
,
j
r
′
⋅
g
3
r
j
′
j
∈
1
,
n
/
I
=
U
1
,
j
r
+
r
′
⋅
g
3
r
j
′
+
r
j
j
∈
1
,
n
/
I
,
whereI′=i:Ri∈SR′⟶ and r′,r3˜,r3′˜,rj′j∈i,n/I⟵RZN. It can be computed as
(16)
K
1
=
g
1
r
^
g
3
r
^
3
,
K
2
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
^
⋅
g
3
r
^
3
′
,
E
j
=
U
1
j
r
^
⋅
g
3
r
^
j
j
∈
i
,
n
/
I
.The delegated credential is well formed as if it is generated by TKA with SCGen algorithm.EMREncPK,P,EMR: this is the EMR encapsulation algorithm. For an access policy P, we denote II=i:Ri∈SP. When a single bit 0 from EMR data needs to be encapsulated under P, a medical staff chooses random s,t4,t4′⟵RZN and computes En1=∏i∈IU1i,4Ri⋅X14sg4t4,En2=W14g4t4′. When a single bit 1 needs to be encapsulated, a medical staff sets En1,En2⟵RG.EMRDecPK,R⟶,En,SCR⟶: this is the EMR decapsulation algorithm. The medical staff with role satisfied by an access policy P can use his secret credential to recover all one-bit messages for EMR data. If eEn1,K1=eEn2,K2, a medical staff returns bit 0. Otherwise, he returns bit 1.Correctness: We need to verify when input a well-formed encapsulationEn=En1,En2 with a valid credential SCR⟶ for 0 bit, whether eEn1,K1=eEn2,K2 holds.(17)eEn1,K1=e∏jU1j,4idj⋅X14sg4t4,g1rg3r,eEn2,K2=eg1s⋅g4ω4s+t4′,g1u11⋅id1⋯g1u1j⋅idj⋅g1x1r⋅g3r3′.Due to the orthogonality property, we geteEn1,K1=eEn2,K2=eg1s,g1r⋅∑i=1ju1i⋅id1+x1. Therefore, when En=En1,En2 is a well-formed EMR encapsulation, the decapsulation algorithm can correctly recover EMR with a valid credential SCR⟶.


### 6.2. Security Analysis of One-Bit RBAC Scheme

We prove the security by contradiction. Assume a PPT adversary can break the one-bit RBAC scheme in polynomial time. Then we solve a series of hard-to-solve problems based on subgroup decision assumptions, which are introduced inSection 3.2. Since no PPT algorithm could solve these problems, we reach a contradiction and conclude our proposed scheme is secure.Theorem 1.
SupposeG is a group of composite order N=p1p2p3p4, equipped with an efficient bilinear map. Suppose that the Assumption 1–5 hold in G. Then our one-bit RBAC scheme is secure under the formal security model.We apply the dual system encapsulation technique [37] to the one-bit RBAC scheme, where the encapsulated message En and the credential SC can take one of two indistinguishable form: normal form and semifunctional form. The correlation between them is shown in Table 2. “√” means is decapsulation allowed and “×” means decapsulation is not allowed. When all the EMR encapsulations and credentials are semifunctional, the adversary obtains no information for the challenge encapsulated EMR since none of the given credential is useful to decapsulate it.In the next section, we show that no PPT algorithm can distinguish betweenGamereal and Gamefinal. All the components in the encapsulation of Gamefinal are random elements, so it does not leak any EMR information. The indistinguishability between those games proves Theorem 1.Table 2
Correlation of normal and semifunctional forms.
NormalEn
SemifunctionalEn
NormalSC
√
√
SemifunctionalSC
√
×Semifunctional ciphertext: a user runs EHRGen to construct a normal ciphertextEn1′,En1′. Then they pick up random exponents x,zc∈ZN and sets En1=En1′g2xzc, En2=En2′g2x.
Semifunctional secret credential TKA runs the algorithm SCGenM to generate a normal keyK1′,K2′,Ejj∈1,n/I. It chooses random exponents γ,zk,zjj∈1,n/I∈ZN. The semifunctional key is set as K1=K1′g2γ,K2=K2′g2γ⋅zk, Ej=EjAg2γzj.
It is straightforward that the EHRDecM algorithm correctly outputsEHR when decrypting a semifunctional ciphertext by a semifunctional key since the added elements in Gp2 can be cleared due to orthogonality property. However, the blinding factor is multiplied by an additional term eg2,g2γxzk+∑i∈I/IziRi−zc. If zc=zk+∑i∈I/IziRi, decryption still works. In this case, we call the secret credential is nominally semifunctional. We prove Theorem 1 through following games between an adversary and a challenger.
Game
real: this is the real game.
Game
real
′: this game is the same as Gamereal except that all the secret credential queries are answered by the secret credential generation algorithm, not by the secret credential delegation algorithm.
Game
res: this game is the same as Gamereal’ except that the adversary cannot ask for secret credentials for the roles which are the prefixes of the challenge role modulo p2. Namely, it is not allowed that, for any queried role R⟶=R1,…,Rd, ∃R∗⟶=R1∗,R2∗,…,Rd′∗∈PrefP∗ with d′≤d, s.t.∀i∈1,d′,Ri=Ri∗modp2. P∗ is the set of challenge access policy.
Game
k: this game is identical with Gameres except that the EMR encapsulation given to adversary is semifunctional and the first k credentials are semifunctional (0≤k≤q) for bit 0. We notice that in Gameq, the EMR encapsulation and all credentials are semifunctional.
Game
final
′: this game is identical with Gameq except that challenge EMR encapsulation is a semifunctional encapsulation for a random message in subgroup of G for bit 0, not one of the messages given by the adversary.
Game
final: this game is identical with Gamefinal′ except that Gamefinal replaces the challenge EMR encapsulation of 0 by a pair of random points in the full group G.


### 6.3. Proof of Theorem 1

In this section, we use six lemmas to prove Theorem1. Each lemma demonstrates the indistinguishability between the neighbouring games.Lemma 1.
For any PPT algorithmA, it holds that: GamerealAdvAλ=Gamereal′AdvAλ.Proof of Lemma 1.
We note that the secret credentials are identically distributed whether they are generated by the credential generated algorithm or by the credential delegation algorithm. So, there is no difference betweenGamerealAdvA and Gamereal′AdvA from the adversary’s view.Lemma 2.
Suppose there exists a PPT algorithmA such that Gamereal′AdvAλ−GameresAdvAλ=ϵ1. Then, we can build a polynomial-time algorithm ℬ with advantage ε1/3 in breaking Assumption 1.Proof of Lemma 2.
If there exists a PPT adversaryA that distinguishes Gamereal′ and Gameres with probability ε1, by the definition of Gameres, A knows that it issues a secret credential query for the medical staff with role R⟶=R1,…,Rd from others satisfying that ∃R∗⟶=R1∗,R2∗,…,Rd′∗∈PrefP∗ with d′≤d, s.t.∀i∈1,d′,Ri=Ri∗modp2. Then the factor of N can be extracted by computing gcdRi−Ri∗,N, from which we design an algorithm ℬ breaking Assumption 1 as follows.
ℬ receives g1,g3,g4, and produces a nontrivial factor of N by computing r=gcdRi−Ri∗,N. We want to use r to generate a point in GQ, where GQ denotes the unique subgroup with order ∏j∈Qpj Q⊆4. We set 2∈Q but k∉Q so that GQ can be used to test T with orthogonality. Enumerate the cases for r, N/r, and the resulting k and Q in Table 3. As N/r is the complementary set of r, it covers all the possibilities for the subgroup with different orders.
Due to the rule that2∈Q but k∉Q, we get from Table 3 at least one choice of k that allows us to use r or N/r to construct a point in GQ. ℬ immediately decides T by orthogonality. For example, if r is p1, T is chosen from Gp1 or Gp1p2. Also we can get elements from GQ, i.e., we select X⟵RGp2p3p4. Then ℬ learns whether T has a Gp2 component or not by testing if eT,X=1. If not, T has a Gp2 component. From the point of A’s view, the choice of i is independent, and ℬ at least has 1/3 chance to pick an i that works.
Compared withGameres, the challenge encapsulation of a 0 bit is replaced with a semifunctional one in Game0, meaning its components are multiplied by points in Gp2. As the adversary does not know the factor of N=p1p2p3p4, it cannot determine whether the components of the challenge encapsulation of a 0 are in Gp1p4 or in Gp1p2p4. Hence, the adversary is not able to know which form the given challenge encapsulation is.Table 3
Possibilities forr,N/r,k,Q.
r
N/r
k
Q
p
1
p
2
p
3
p
4
1
2
3
4
p
2
p
1
p
3
p
4
1
3
4
2
p
3
p
1
p
2
p
4
3
1
2
4
p
4
p
1
p
2
p
3
4
1
2
3
p
1
p
2
p
3
p
4
3
4
1
2
p
1
p
3
p
2
p
4
1
3
2
4
p
1
p
4
p
2
p
3
1
4
2
3Lemma 3.
Suppose there exists a PPT algorithmA such that GameresAdvAλ−Game0AdvAλ=ϵ2. We can build a polynomial-time algorithm ℬ with advantage ϵ2 in breaking Assumption 2.Proof of Lemma 3.
The input of algorithmℬ is the challenge tuple g1,g3,g4,T of Assumption 2. ℬ has to decide whether T is in Gp1p4 or in Gp1p2p4.Setup: on inputsg1,g3,g4,T, ℬ picks random exponents aii∈1,n,b,x,y,ω from ZN, and sets U1i⟵Rg1ai, X1⟵Rg1b,X4⟵Rg4x,U4⟵Rg4y,W4⟵Rg4ω,U1i,4⟵RU1iU4,X14⟵RX1X4, W14⟵Rg1W4. It sends public paramter N,U1i,4,X14,W14,g4i∈1,ntoAQuery Phase 1: when the adversaryA issues a secret credential query for a medical staff with role R⟶=R1,…,Rd, ℬ randomly chooses exponents r,r3,r3′,rjj∈1,n/I⟵RZN where I=i:Ri∈SR⟶ and sets(18)K1=g1rg3r3,K2=∏i∈IU1iRi⋅X1r⋅g3r3′,Ej=U1jr⋅g3rjj∈i,n/I.
It has the same distribution as that of the normal secret credential.
Challenge:A outputs two EMR files EMR0 and EMR1 and a challenge access policy P∗. The challenge access policy P∗ must satisfy the property that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks a random coin β⟵R0,1 and gives the challenge EMR encapsulation as following. We denote that II∗=i:Ri∗∈SP∗.(i)
EMRβ=0. ℬ lets zc=∑i∈I∗aiRi∗+b and sets En1⟵RTzc,En2⟵RT. If ℬ’s challenge bit β=0, T⟵RGp1p2p4. We write T=g1W4sg4t4′g2x2 for random s,t4′,x2⟵RZN and get
(19)
En
1
=
g
1
W
4
s
g
4
t
4
′
g
2
x
2
z
c
=
∏
i
∈
II
∗
U
1
i
,
4
R
i
⋅
X
14
s
g
4
s
ω
+
t
4
′
⋅
z
c
−
y
∑
i
∈
I
∗
i
d
i
+
x
s
⋅
g
2
x
2
⋅
z
c
,
En
2
=
g
1
W
4
s
g
4
t
4
′
g
2
x
2
=
W
14
s
g
4
t
4
′
g
2
x
2
.
This implicitly setst4=sω+t4′⋅zc−y∑i∈I∗Ri+xsmodp4 and x2′=x2⋅zcmodp2. The challenge encapsulation is semifunctional formed in Game0A. If ℬ’s challenge bit β=1, T⟵RGp1p4. We write T=g1W4sg4t4′ for random s,t4′⟵RZN, and get
(20)
En
1
=
g
1
W
4
s
g
4
t
4
′
Z
c
=
∏
i
∈
II
∗
U
1
i
,
4
R
i
⋅
X
14
s
g
4
s
ω
+
t
4
′
⋅
z
c
−
y
∑
i
∈
II
∗
i
d
i
+
x
s
,
En
2
=
g
1
W
4
s
g
4
t
4
′
=
W
14
s
g
4
t
4
′
.
This implicitly setst4=sω+t4′⋅zc−y∑i∈II∗Ri+xsmodp4. The challenge EMR encapsulation is normally formed in Gameres.
(ii)
EMR
β
=
1. ℬ sets En1,En2⟵RG.
Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefP∗.
Guess: the adversaryA outputs a guess that it is in Game0 or Gameres. The simulator ℬ guesses T⟵RGp1p4 if A decides it is in Gameres β=1. ℬ outputs T⟵RGp1p2p4 if A decides it is in Game0 β=0. If A has the advantage ε2 to distinguish Gameres and Game0, ℬ can break Assumption 2 with advantage ϵ2.
Game
k
−
1 and Gamek are two distinguishable games. The way to decide whether the kth queried credential is normal or semifunctional is to decide whether the credential components are in Gp1p3 or in Gp1p2p3. This is computationally difficult without knowing factor N=p1p2p3p4.Lemma 4.
Suppose there exists a PPT algorithmA such that Gamek−1AdvAλ−GamekAdvAλ=ε3. Then, we can build a polynomial-time algorithm ℬ with advantage ε3 in breaking Assumption 3.Proof of Lemma 4.
The input ofℬ is the challenge tuple g1,g3,g4,D23,A12,T of Assumption 3. ℬ has to decide whether T is in Gp1p3 or in Gp1p2p3.Setup:ℬ receives g1,g3,g4,D23,A12,T. It picks random exponents a1i∈1,n,b,x,y,ω from ZN, and sets U1i⟵Rg1ai, X1⟵Rg1b,X4⟵Rg4x,U4⟵Rg4y,W4⟵Rg4ω,U1i,4⟵RU1iU4,X14⟵RX1X4,W14⟵Rg1W4 and k⟵R0,q. It sends the public parameters N,U1i,4,X14,W14,g4i∈1,n to A.Query Phase 1: whenA requests the ℓth credential for R⟶=R1,…,Rd where I=i:Ri∈SR⟶, we consider three cases: ℓ<k, ℓ>k, and ℓ=k.(i)
Whenℓ<k, ℬ creates a semifunction credential by picking up random exponents r,z,zA,zjj∈1,n/I from ZN and setting(21)K1=g1rD23z,K2=∏i∈IU1iRi⋅X1r⋅D23z′,Ej=U1,jrD23zjj∈1,n/I.
ConsiderD23 as g2y2g3y3 for random y2,y3⟵RZN, then
(22)
K
1
=
g
1
r
g
2
y
2
z
g
3
y
3
z
,
K
2
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
⋅
g
2
z
′
y
2
g
3
z
′
y
3
,
E
j
=
U
1
,
j
r
g
3
y
3
⋅
z
j
g
2
y
2
⋅
z
j
j
∈
1
,
n
/
I
.
This is a properly distributed semifunctional credential.
(ii)
Whenℓ>k, ℬ creates a normal credential by invoking the usual credential generation algorithm.
(iii)
Whenℓ=k, ℬ creates the kth credential. ℬ lets zk=∑i∈IaiRi+b and sets
(23)
K
1
⟵
R
T
,
K
2
⟵
R
T
z
k
,
E
j
⟵
R
T
a
j
j
∈
1
,
n
/
I
.
IfT⟵RGp1p3, T=g1rg3r3 for random r,r3⟵RZN, then
(24)
K
1
=
g
1
r
g
3
r
3
,
K
2
=
g
1
r
g
3
r
3
z
k
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
g
3
r
3
⋅
z
k
,
E
j
=
g
1
r
g
3
r
3
a
j
j
∈
1
,
n
/
I
=
U
1
,
j
r
g
3
r
3
⋅
a
j
j
∈
1
,
n
/
I
.
It has the same distribution as the normal credential.
IfT⟵RGp1p2p3, we write T=g1rg3r3g2t2 for random r,r3,t2⟵RZN, then
(25)
K
1
=
g
1
r
g
3
r
3
g
2
t
2
,
K
2
=
g
1
r
g
3
r
3
g
2
t
2
Z
k
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
g
3
r
3
⋅
z
k
g
2
t
2
⋅
z
k
,
E
j
=
g
1
r
g
3
r
3
g
2
t
2
a
j
=
U
1
,
j
r
g
3
r
3
⋅
a
j
g
2
t
2
⋅
a
j
j
∈
1
,
n
/
I
.
It has the same distribution as the semifunctional credential.
Challenge: at some points,A decides that it obtains enough secret credentials, it outputs two EMR files EMR0 and EMR1 and a challenge access policy P∗. This policy must satisfy that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks up a random coin ℬ⟵R0,1 and gives the challenge EMR encapsulation as follows:
(i)
EMR
β
=
0. ℬ picks up s4,s4′⟵RZN and sets En1⟵RA12zcg4s4,En2⟵RA12g4s4′. Consider A12 as g1sg2x2 for random s,x2⟵RZN, and get
(26)
En
1
=
∏
i
∈
II
∗
U
1
i
R
i
∗
⋅
X
14
s
⋅
g
2
x
2
⋅
z
c
⋅
g
4
s
4
−
x
s
−
y
s
∑
i
∈
II
∗
R
i
∗
,
En
2
=
g
1
s
g
2
x
2
g
4
s
4
′
=
g
1
g
4
ω
s
⋅
g
4
s
′
−
ω
s
⋅
g
2
x
2
=
g
1
s
W
4
s
g
4
s
4
′
−
ω
s
g
2
x
2
=
W
14
s
g
4
t
4
′
g
2
x
2
.
This implicitly setst4=s4−xs−ys∑i∈II∗Ri∗modp4, x2′=x2⋅zcmodp2 and t4′=s′−ωsmodp4 for I∗=i:Ri∗∈SP∗.
(ii)
EMR
β
=
1.
ℬ
sets
En
1
,
En
2
⟵
R
G.
The challenge encapsulation forEMRβ=0 is formed as the semifunctional form with zc=∑i∈II∗aiRi∗+b. Since from Gameres, the role R⟶=R1,…,Rd associated with the kth secret credential is not a prefix of the challenge receiver role R⟶∗=R1∗,…,Rd′∗ modulo p2, the variables zc and zk are randomly distributed to the adversary A. The relationship between zc and zk do not help A to distinguish the two games.
Query Phase 2: Query Phase 1 is repeated exceptR⟶∉PrefP∗.
Guess: the adversaryA outputs a guess that it is in Gamek−1 or Gamek.
ℬ outputs T⟵RGp1p3 if A decides it is in Gamek−1, where all components in the kth secret credential by algorithm ℬ are in Gp1p3. Otherwise, ℬ outputs T⟵RGp1p2p3 if A decides it is in Gamek, where all components in the kth secret credential by algorithm ℬ are in Gp1p2p3. If A has the advantage ε3 to distinguish Gamek−1 and Gamek, ℬ can break Assumption 3 with advantage ϵ3.Lemma 5.
Suppose there exists a PPT algorithmA such that GameqAdvAλ−Gamefinal′AdvAλ=ε4. Then we can build a polynomial-time algorithm ℬ with advantage ϵ4 in breaking Assumption 4.Proof of Lemma 5.
The input of algorithmℬ is the challenge tuple g2,g3,g4,W14,E12,T of Assumption 4. Algorithm ℬ has to answer whether T is in Gp2p4 or in Gp1p2p4.Setup:ℬ first receives g2,g3,g4,W14,E12,T. It then picks random exponents aii∈1,n,b from ZN, and sets U1i,4⟵RW14ai, X14⟵RW14b. It sends these public parameters N,U1i,4,X14,W14,g4i∈1,n to A.Query Phase 1: WhenA requests the secret credential for the medical staff with role R⟶=R1,…,Rd, ℬ lets zk=∑i∈IaiRi+b, randomly chooses exponents t,y,y′,r3,r3′, rjj∈1,n/I,yjj∈1,n/I⟵RZN where I=i:Ri∈SR⟶, and sets(27)K1=E12g2yg3r3,K2=E12t⋅zkg2y′g3r3′,Ej=E12t⋅ajg3rjg2yjj∈1,n/I.ConsiderE12=g1e1g2e2 for random e1,e2⟵RZN, and get(28)K1=g1te1g2te2+yg3r3,K2=∏i∈IU1iRi⋅X1te1⋅g2zkte2+y′⋅g3r3′,Ej=U1,jte1⋅g2te2⋅aj+yj⋅g3rjj∈1,n/I.This implicitly setsr=te1, t2=te2+y, t2′=zkte2+y′, U1i=g1ai, X1=g1b, and tj=te2⋅aj+yj. The simulated key is distributed as the semifunctional credential.Challenge:A outputs two EMR files EMR0 and EMR1, and a challenge access policy P∗. This policy must satisfy that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks a random coin β⟵R0,1 and gives the challenge EMR encapsulation as follows. We denote that II∗=i:Ri∗∈SP∗.
(i)
EMR
β
=
0.
ℬ randomly chooses s,x2′⟵RZN and sets(29)En1⟵R∏i∈II∗U1i,4Ri⋅X14sTx2′,En2⟵RW14sT.(a)
Ifℬ’s challenge bit is β=1, then T⟵RGp1p2p4. Hence, the challenge ciphertexts En1 and En2 are random in Gp1p2p4 as in Gamefinal′.(b)
Ifℬ’s challenge bit is β=0, then T⟵RGp2p4. We write T=g4t4′g2x2 for random t4′,x2⟵RZN and get(30)En1=∏i∈I∗U1i,4Ri⋅X14s⋅g4t4′x2′g2x2x2′,En2=W14sg4t4′g2x2.(c)
This implicitly setst4=t4′x2′ mod p4. The challenge encapsulation is formed as the semifunctional form in Gameq.
(ii)
EMR
β
=
1. ℬ sets En1,En2⟵RG.
Query Phase 2: Query Phase 1 is repeated adaptively exceptR⟶∉PrefP∗.
Guess: the adversaryA outputs a guess that it is in Gameq or Gamefinal′.
The simulatorℬ guesses T⟵RGp2p4 if A decides it is in Gameq β=0. Otherwise, ℬ outputs T⟵RGp1p2p4 β=1. If A has an advantage ε4 to distinguish Gameq and Gamefinal′, ℬ breaks Assumption 4 with advantage ε4. Since all the credentials and EMR encapsulations are semifunctional in Gameq, A cannot get any information about the challenge EMR encapsulation due to none of the given credentials are useful to decapsulate it. Hence, A cannot find that the challenge EMR encapsulation has been replaced by a random component. This implies the indistinguishability between Gameq and Gamefinal′.Lemma 6.
Suppose there exists a PPT algorithmA such that Gamefinal′AdvAλ−GamefinalAdvAλ=ε5. Then we construct a PPT algorithm ℬ with advantage ϵ5 in breaking Assumption 5.Proof of Lemma 6.
The input ofℬ is the challenge tuple g1,g4,D23,T of Assumption 5. ℬ has to answer T is in Gp1p2p4 or in G.Setup:ℬ first receives g1,g4,D23,T. It then picks up random exponents aii∈1,n,b from ZN, and sets U1i⟵Rg1ai, X1⟵Rg1b,X4⟵Rg4x,U4⟵Rg4y,W4⟵Rg4ω,U1i,4⟵RU1iU4,X14⟵RX1X4,W14⟵Rg1W4. It sends the public parameters N,U1i,4,X14,W14,g4i∈1,n to A.Query Phase 1: whenA requests a secret credential for a medical staff with role R⟶=R1,…,Rd, ℬ lets zk=∑i∈IaiRi+b, chooses exponents r,d,d′,djj∈1,n/I⟵RZN where I=i:Ri∈SR⟶, and sets(31)K1=g1rD23d,K2=∏i∈IU1iRi⋅X1rD23d′,Ej=U1jrD23djj∈1,n/I.We writeD23=g2e2g3e3 for random e2,e3⟵RZN and get(32)K1=g1rg2e2dg3e3d,K2=∏i∈IU1iRi⋅X1rg2ed′⋅g3e3d′,Ej=U1jrg3e3dj⋅g2e2djj∈i∈1,n/I.This implicitly setsr3=e3d, t2=e2d, r3′=e3d′, t2′=e2d′, rj=e3dj, and tj=e2dj. The simulated credential is distributed as the semifunctional credential.Challenge:A outputs two EMR files EMR0 and EMR1, and a challenge access policy P∗. This policy must satisfy that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks up a random exponent z and a random coin β⟵R0,1. It gives the challenge encapsulation: En1⟵RT,En2⟵RTz. If ℬ’s challenge bit is β=0 then T⟵RG. Hence, the challenge ciphertexts En1 and En2 are random components in G as in Gamefinal.
Ifℬ’s challenge bit is β=1, then T⟵RGp1p2p4. Hence, the challenge ciphertexts En1 and En2 are random components in Gp1p2p4 as in Gamefinal′.Query Phase 2: repeat Query phase 1 exceptR⟶∉PrefP∗.Guess: the adversaryA outputs a guess whether it is in Gamefinal′ or in Gamefinal. The simulator ℬ guesses T⟵RGp1p2p4 if A decides it is in Gamefinal′ β=1. Otherwise, ℬ outputs T⟵RG β=0. If A has the advantage ε5 to distinguish Gamefinal′ and Gamefinal, ℬ can break Assumption 5 with advantage ε5. Gamefinal replaces the challenge encapsulation of 0 by a pair of random points in the full group. From the view of adversary, it cannot find that the challenge EMR encapsulation has been replaced by a random component in the full group or in the subgroup. Hence, it implies the indistinguishability between Gamefinal′ and Gamefinal.Proof of Theorem 1.
If a group generator algorithmG satisfies Assumption i with advantage εi′1≤i≤5, then Lemmas 0–5 show that there is no polynomial time adversary to distinguish Gamereal and Gamefinal with advantage GamerealAdvAλ−GamefinalAdvAλ, which can be expanded as follows:(33)GamerealAdvAλ−GamefinalAdvAλ≤GamerealAdvAλ−Gamereal′AdvAλ+Gamereal′AdvAλ−GameresAdvAλ+GameresAdvAλ−Game0AdvAλ+Game0AdvAλ−Game1AdvAλ+Game1AdvAλ−Game2AdvAλ+⋯+Gameq−1AdvAλ−GameqAdvAλGameqAdvAλ−Gamefinal′AdvAλ+Gamefinal′AdvAλ−GamefinalAdvAλ=3ε1′+ε2′+ε3′+ε4′+ε5′.
All the components inGamefinal are random elements in G, and the messages are hidden from the adversary. Therefore, if the group G with composite order N=p1p2p3p4 satisfies Assumption 1–5 with advantage ε1′,ε2′,ε3′,ε4′,ε5′ respectively, then our one-bit RBAC is secure with advantage 3ε1′+ε2′+ε3′+ε4′+ε5′.


### 6.4. From One-Bit RBAC with 1SPL to Multibit RBAC-UL

We provide security analysis for the RBAC-UL model. The key point is to reduce RBAC-UL security from a secured one-bit RBAC with 1SPL functionality. We use a specific 1SPL algorithm “LeakToOne” which exposes the randomness as if it is randomly chosen for bit 1, and fails with probability δ when it cannot find out the randomness to 1. In the security analysis, we assume that all the roles in the access policy set or its subset are ordered from high-level staff to the lower level one.Theorem 2.
LetΓ be a one-bit RBAC scheme, and Γℓ be the ℓ-bit RBAC scheme built from it. Let k be the number of leaked EMRs and δ be the failing probability of LeakToOne. Suppose there exists an RBAC-UL adversary A, RBAC-UL simulator S, and RBAC adversary ℬ. If Γ is secure with AdvΓ,ℬRBAC−INDλ, then Γℓ is secure with AdvΓℓ,S,ARBAC−ULλ≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ.We prove it by a series of game transitions.(i)
GamerealA: this is the real game.(ii)
Gamereal1A: this game reselects the randomness for the “0” bit encapsulation at Corrupt phase.(iii)
Gamereal2A: this game runs LeakToOne algorithm for the “0” bit encapsulation at Corrupt phase. If LeakToOne fails, it reselects the randomness as Gamereal1A does.(iv)
Gamereal3A: compared with Gamereal2A, it does nothing if LeakToOne algorithm fails.(v)
GamevA: the first v bits from the challenge EMRs are replaced by bit “0” and then encapsulated. The remaining bits are encapsulated normally. At Corrupt phase, if it needs to open an encapsulation component to a “0” bit, it directly gives A the randomness it used when creating the encapsulation. If it needs to open an encapsulation to a “1” bit, it runs LeakToOne to find the randomness.(vi)
GamekℓA: all the bits from challenge EMRs are replaced by “0” and all the “0” bits are encapsulated.(vii)
GamesimS: this game is run by the simulator S.In the next subsection, we show that no PPT algorithm can distinguish betweenGamerealA and Gamereal1A and between Gamereal1A and Gamereal2A. Then we demonstrate that, if any execution of LeakToOne fails at most δ, no PPT algorithm has advantage kℓδ to distinguish between Gamereal2A and Gamereal3A. Following that, if no adversary ℬ has the advantage AdvΓ,ℬRBAC−INDλ to break one-bit RBAC scheme, then no algorithm has the advantage AdvΓ,ℬRBAC−INDλ to distinguish between GamevA and Gamev+1A, so that no algorithm has the advantage kℓ⋅AdvΓ,ℬRBAC−INDλ to distinguish between Gamereal3A and GamekℓA. From the above deductions, we get PrGamerealAλ=1−PrGamekℓAλ=1≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ. We also show that the simulator S runs identically to the GamekℓA, which means the GamekℓA is distinguishable from the GamesimS. Finally, we get AdvΓ,S,ARBAC−ULλ=PrGamerealAλ=1−PrGamesimSλ=1 which is defined in Definition 6.


### 6.5. Proof of Theorem 2

LetA be a RBAC-UL adversary against Γℓ. We can construct a simulator S that runs Setup to generate PK and MSK. It runs A to answer the following queries. (1) When A outputs the set of EMRs on which it wishes to challenge, S then generates a set of EMR encapsulations where each encryption is an encryption of the all-zero message 0ℓ and returns them to A. (2) When A decides to corrupt some of these EMR encapsulations, the simulator S queries its own Corrupt procedure, learns the EMRs it needs to corrupt, and opens them bit-by-bit. If it needs to open an encapsulation component to a 0, it directly gives A the randomness it used when creating the encapsulation. Otherwise, S needs to open an encapsulation to a 1, it runs LeakToOne algorithm to find the randomness. (3) When A issues a secret credential query, S simply uses MSK to answer correctly. Through the above ways, the simulator S can generate the same output as A. We use Gamereal and Gamesim to describe the games that A and S runs, respectively. Based on Definition 6, the target of Theorem 2 is to prove(34)PrGamerealAλ=1−PrGamesimSλ=1≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ.Lemma 7.
For any PPT algorithmA, GamerealAAdvAλ=Gamereal1AAdvAλ.Proof of Lemma 7.
Since the randomness inGamerealA and Gamereal1A are uniformly and independently chosen from Zp, they are identically distributed from the view of A.Lemma 8.
For any PPT algorithmA, Gamereal1AAdvAλ=Gamereal2AAdvAλ.Proof of Lemma 8.
IfLeakToOne does not fail, its output is identically distributed as that in Gamereal1A from the view of A’s. If LeakToOne does fail, Gamereal2A does the same operations as that in Gamereal1A.Lemma 9.
Suppose that any execution ofLeakToOne fails at most δ. For any PPT algorithm A, the following holds:(35)Gamereal2AAdvAλ−Gamereal3AAdvAλ≤kℓ⋅δ.Proof of Lemma 9.
Since there are at mostkℓ bits that have to be opened by LeakToOne algorithm in phase Corrupt, the worst event is that all the kℓ bits are failed to be opened and Gamereal3A does not make any response to the failure. The probability for the worst event is kℓ⋅δ.Lemma 10.
If a PPT adversaryℬ can break the one-bit RBAC-IND scheme with AdvΓ,ℬRBAC−INDλ, then there exists a PPT algorithm A so that(36)GamevAAdvAλ−Gamev+1AAdvAλ=AdvΓ,ℬRBAC−INDλ.Proof of Lemma 10.
SupposeEvv+11GamevA is the event that in the execution of GamevA, the v+1st bits sampled from the set of EMR are 1.
LetGamevAEvv+11GamevA denote that GamevA is run in the condition that the event Evv+11GamevA happens. Ev0 is the complementary event for Ev1. Notice that in the event that the v+1st bit sampled in GamevA is 0, the game Gamev+1A and GamevA are identical, because Gamev+1A ignores the actual bit and encapsulates it as a bit 0 based on its definition, and GamevA encapsulates the actual v+1st bit which is 0. Thus, Evv+10Gamev+1=Evv+10Gamev. Next, we compute GamevAAdvAλ−Gamev+1AAdvAλ as follows (we use G to represent Game):(37)GamevAAdvA−Gamev+1AAdvA=PrGvA&Evv+10GvA+PrGvA&Evv+11GvA−PrGv+1A&Evv+10Gv+1A+PrGv+1A&Evv+11Gv+1A=PrEvv+10GvA⋅PrGvAEvv+10GvA−PrEvv+10Gv+1A⋅PrGvAEvv+10Gv+1A+PrEvv+11GvA⋅PrGvAEvv+11GvA−PrEvv+11Gv+1A⋅PrGv+1AEvv+11Gv+1A=PrEvv+10GvA⋅PrGvAEvv+10GvA−PrGv+1AEvv+10Gv+1A+PrEvv+11GvA⋅PrGvAEvv+11GvA−PrEvv+11Gv+1A⋅PrGv+1AEvv+11Gv+1A.
Since in the eventEvv+10 both Gamev+1A and GamevA are identical, the first item in the above formula is 0. It means that(38)GamevAAdvA−Gamev+1AAdvA=PrEvv+11GamevA⋅PrGamevAEvv+11GamevA−PrEvv+11Gamev+1A⋅PrGamev+1AEvv+11Gamev+1A.
Next, we consider the adversaryℬ against the one-bit RBAC scheme with 1SPL. ℬ runs A while simulating its RBAC-IND environment as in either GamevAEvv+11GamevA or Gamev+1AEvv+11Gamev+1A. Note that ChallengeB is used to denote that the adversary ℬ runs the Challenge phase in the RBAC-IND experiment.Setup:ℬ generates a public key PK by running the system setup algorithm, and it sends PK to A.Query Phase 1:A issues a secret credential query for the medical staff associated with role R⟶. ℬ creates the secret credential by running the credential generation algorithm and return the secret credential to A.Challenge: the adversaryA outputs a set of EMR files EMR⟶=M1,M2,…,Mk and a challenge access policy set P∗=P1∗,P2∗,…,Pk∗ to ℬ. Each challenge access policy Pi∗ in the set should satisfy that for all the secret credential queries for R⟶ issued in Query Phase 1, R⟶∉PrefPi∗. We note that each EMR file EMRi for i∈1,k constitutes of ℓ bits since we let the Γℓ be a ℓ-bit RBAC scheme. ℬ randomly chooses i⟵R1,ℓ and j⟵R1,k. For each i∈1,ℓ and j∈1,k, we consider three cases:(i)
Wheni−1⋅ℓ+j≤v, EMRij is ignored and replaced by 0. ℬ randomly chooses rij⟵RZp, computes Enij⟵REMREncPK,Pi∗,0,rij, and returns it to A.(ii)
Wheni−1⋅ℓ+j=v+1, ℬ encrypts the v+1st bit in two different conditions. If EMRij=1, ℬ runs the Challengeℬ algorithm against the RBAC-IND scheme. Specifically speaking, ℬ flips a random coin to decide whether it encapsulates 0 or 1 under the challenge access policy Pi∗. Then ℬ returns the cihpertext to A. If EMRij=0, EMRij is encapsulated normally. ℬ randomly chooses rij⟵RZp, executes Enij⟵REMREncPK,Pi∗,EMRij,rij and returns it to A.(iii)
Wheni−1⋅ℓ+j>v+1, EMRij is encapsulated normally. ℬ randomly chooses rij⟵RZp, computes Enij⟵REMREncPK,Pi∗,EMRij,rij, and returns it to A.Corrupt:A outputs a set I⊆1,n and then ℬ learns EMR⟶I. For each index i∈I and each j∈1,ℓ, ℬ generates the randomness as follows:(i)
IfEMRij=0, ℬ returns the actual randomness it used to generated Eni.(ii)
IfEMRij=1, ℬ runs LeakToOne algorithm to get randomness under which the EMREnc algorithm applied to 1 would produce Enij, namely,(39)rij⟵RLeak to onePK,Pi∗,Enij.
Finally,ℬ returns Mij,riji∈1,kj∈1,ℓ to A.Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefPi∗.Output: whenA halts with out, ℬ halts and outputs EMR⟶,P∗,I,out.
The adversaryℬ only runs Challengeℬ in the event Evv+11 EMRij=1 in the Challenge phase, such that all of its advantage comes from this case. It means that PrEvv+11Gamev=1 and PrEvv+11Gamev+1=1. It is important to notice that in the event Evv+11, if ℬ decides to encapsulate 1, it simulates its environment as in playing GamevA with A. If ℬ decides to encapsulate 0, it simulates the environment as in Gamev+1A. Therefore, the advantage of A to distinguish GamevAEvv+11GamevA and Gamev+1AEvv+11Gamev+1A depends on the advantage of ℬ to distinguish that the challenge EMR-encapsulation is for 1 or 0. It is easy to see that(40)AdvΓ,ℬRBAC−INDλ=PrGamevAEvv+11GamevA−PrGamev+1AEvv+11Gamev+1A.
Combined with equation (38), we get(41)GamevAAdvAλ−Gamev+1AAdvAλ=AdvΓ,ℬRBAC−INDλ.
Furthermore, since(42)Game0AAdvAλ−GamekℓAAdvAλ=∑v=0kℓ−1GamevAAdvAλ−Gamev+1AAdvAλ,we conclude(43)Game0AAdvAλ−GamekℓAAdvAλ=kℓ⋅AdvΓ,ℬRBAC−INDλ.Lemma 11.
For any PPT algorithmA,(44)GamekℓAAdvAλ=GamesimSAdvSλ.Proof of Lemma 11.
First, we compare two gamesGamekℓA and GamesimS.
Game
k
ℓ
A works as follows:Setup:A receives a public key from the challenger C.Query Phase 1:A issues a secret credential query for the medical staff associated with role R⟶. The challenger C creates the secret credential by running the credential generation algorithm and returns the secret credential to A.Challenge: the adversaryA outputs a set of EMR files EMR⟶=EMR1EMR2,…,EMRk and the challenge access policy set P∗=P1∗,P2∗,…,Pk∗ to the challenger C. Each challenge access policy Pi∗ in the set should satisfy that for all the access credential queries for R⟶ issued in Query Phase 1, R⟶∉PrefPi∗. C randomly chooses elements r1,r2,…,rk⟵RZp where p=G. We denote r⟶=r1,r2,…,rk. C ignores the input EMRs and regards the components as all-0 messages. Then it encrypts each 0ℓ message as follows:(45)Eni⟵REncPK,Pi∗,0ℓ,ri,C returns the set of EMR encapsulation En⟶=En1,En2,…,Enk to A.Corrupt:A outputs a set I⊆1,n and then C opens the corresponding ciphertext to get EMR⟶I. For each index i∈I and each j∈1,ℓ, C makes the randomness as follows:(i)
IfEMRij=0, C returns the actual randomness it used to generated Eni.(ii)
IfEMRij=1, C runs LeakToOne to get the randomness used by EMREnc to compute Enij when encrypting 1, namely, rij⟵RLeak to onePK,Pi∗,Enij.Finally,C returns EMRij,riji∈,k,j∈1,ℓ to A.Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefPi∗.Output: When the adversaryA halts with out, C halts and outputs EMR⟶,P∗,I,out.
Game
sim
S works as follows:Setup:S generates the public key PK by running the system setup algorithm and then sends the public key to A.Query Phase 1:A requests the secret credential for the medical staff associated with role R⟶. S creates the secret credential by running the credential generation algorithm and return the secret credential to A.Challenge:A outputs a set of EMR EMR⟶=M1,M2,…,Mk and the challenge access policy set P∗=P1∗,P2∗,…,Pk∗ to ℬ. Each challenge access policy Pi∗ in the set should satisfy that for all the access credential queries for R⟶ issued in Query Phase 1, R⟶∉PrefPi∗. Note that each EMRi for i∈1,k consists of ℓ bits since we let Γℓ be a ℓ-bit RBAC scheme. S randomly chooses elements r1,r2,…,rk⟵RZp where p=G. We denote r⟶=r1,r2,…,rk. S ignores the input EMRs and regards the components as all-0 messages. Then it encapsulates each 0ℓ message as Eni⟵REncPK,Pi∗,0ℓ,ri. Finally, S returns the EMR encapsulations En⟶=En1,En2,…,Enk to A.Corrupt:A outputs a set I⊆1,n and then S learns EMR⟶I. For each index i∈I and each j∈1,ℓ, S makes the randomness as follows:(i)
IfEMRij=0, S returns the actual randomness used to generate Eni.(ii)
IfEMRij=1, S runs LeakToOne to get randomness used by EMREnc to compute Enij for encapsulation of 1, namely, rij⟵RLeak to onePK,Pi∗,0ℓ,Enij.Finally,S returns EMRij,riji∈1,k,j∈1,ℓ to A.Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefPi∗.Output: whenA halts with output out, S halts and outputs EMR⟶,P∗,I,out.
S queries its own Corrupt procedure on I and learns EMR⟶I instead of getting them directly as in GamekℓA. From the view of the adversary A, there is no difference of the corrupted EMRs and the sampled randomness. Therefore, S runs identically with GamekℓA.Proof of Theorem 2.
From the above analysis, the simulatorS described in GamesimS runs identically to GamekℓA. So we have GamekℓAAdvAλ=GamesimSAdvSλ. Combining all the above lemmas, we get(46)GamerealAAdvAλ−GamesimSAdvSλ≤GamerealAAdvAλ−Gamereal1AAdvAλ+Gamereal1AAdvAλ−Gamereal2AAdvAλ+Gamereal2AAdvAλ−Gamereal3AAdvAλ+∑v=0kℓ−1GamevAAdvAλ−Gamev+1AAdvAλ+GamekℓAAdvAλ−GamesimSAdvSλ≤kℓ⋅δ+kℓ⋅AdvΓ,ℬRBAC−INDλ.
According to Definition6, we get AdvΓℓ,S,ARBAC−ULλ≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ, which proves Theorem 2.


## 6.1. Construction of One-Bit RBAC Scheme with 1SPL

Setupλ,n. The system setup algorithm is run by TKA. It chooses a bilinear group G of order N, and random elements g1,g2,g3,g4 from Gp1,Gp2,Gp3,Gp4, random exponents u11,u12,…,u1n,u4,x1,x4,ω4⟵RZN, and computes U1i⟵Rg1u1i, U4⟵Rg4u4, X1⟵Rg1x1, X4⟵Rg4x4, W4⟵Rg4ω4, U1i,4⟵RU1iU4, W14⟵Rg1W4, X14⟵RX1X4 for i∈1,n. It outputs a public key PK=N,U1i,4i∈1,n,X14,W14,g4 and a master secret key MSK=g1,g3,U1ii∈1,n,X1.
SCGenPK,MSK,R⟶. This is the secret credential generation algorithm. For the medical staff with role R⟶=R1,…,Rd, we denote I=i:Ri∈SR⟶. When a medical staff at the top-level joins a hospital organization, TKA generates a secret credential SCR⟶ for them:
(14)
K
1
=
g
1
r
g
3
r
3
,
K
2
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
⋅
g
3
r
3
′
,
E
j
=
U
1
j
r
⋅
g
3
r
j
j
∈
i
,
n
/
I
,
wherer,r3,r3′,rjj∈1,n/I⟵RZN.
SCDelegPK,SCR′⟶,R. This is the secret credential delegation algorithm. A junior medical staff with role R⟶=R′⟶,R is authenticated by a supervisor with role R′⟶. His supervisor delegates a secret credential for them:
(15)
K
1
=
K
1
′
g
1
r
′
g
3
r
3
˜
,
K
2
=
K
2
′
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
′
⋅
E
i
′
i
∈
I
/
I
′
R
⋅
g
3
r
^
3
′
,
E
j
=
E
j
′
⋅
U
1
,
j
r
′
⋅
g
3
r
j
′
j
∈
1
,
n
/
I
=
U
1
,
j
r
+
r
′
⋅
g
3
r
j
′
+
r
j
j
∈
1
,
n
/
I
,
whereI′=i:Ri∈SR′⟶ and r′,r3˜,r3′˜,rj′j∈i,n/I⟵RZN. It can be computed as
(16)
K
1
=
g
1
r
^
g
3
r
^
3
,
K
2
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
^
⋅
g
3
r
^
3
′
,
E
j
=
U
1
j
r
^
⋅
g
3
r
^
j
j
∈
i
,
n
/
I
.The delegated credential is well formed as if it is generated by TKA with SCGen algorithm.EMREncPK,P,EMR: this is the EMR encapsulation algorithm. For an access policy P, we denote II=i:Ri∈SP. When a single bit 0 from EMR data needs to be encapsulated under P, a medical staff chooses random s,t4,t4′⟵RZN and computes En1=∏i∈IU1i,4Ri⋅X14sg4t4,En2=W14g4t4′. When a single bit 1 needs to be encapsulated, a medical staff sets En1,En2⟵RG.EMRDecPK,R⟶,En,SCR⟶: this is the EMR decapsulation algorithm. The medical staff with role satisfied by an access policy P can use his secret credential to recover all one-bit messages for EMR data. If eEn1,K1=eEn2,K2, a medical staff returns bit 0. Otherwise, he returns bit 1.Correctness: We need to verify when input a well-formed encapsulationEn=En1,En2 with a valid credential SCR⟶ for 0 bit, whether eEn1,K1=eEn2,K2 holds.(17)eEn1,K1=e∏jU1j,4idj⋅X14sg4t4,g1rg3r,eEn2,K2=eg1s⋅g4ω4s+t4′,g1u11⋅id1⋯g1u1j⋅idj⋅g1x1r⋅g3r3′.Due to the orthogonality property, we geteEn1,K1=eEn2,K2=eg1s,g1r⋅∑i=1ju1i⋅id1+x1. Therefore, when En=En1,En2 is a well-formed EMR encapsulation, the decapsulation algorithm can correctly recover EMR with a valid credential SCR⟶.


## 6.2. Security Analysis of One-Bit RBAC Scheme

We prove the security by contradiction. Assume a PPT adversary can break the one-bit RBAC scheme in polynomial time. Then we solve a series of hard-to-solve problems based on subgroup decision assumptions, which are introduced inSection 3.2. Since no PPT algorithm could solve these problems, we reach a contradiction and conclude our proposed scheme is secure.Theorem 1.
SupposeG is a group of composite order N=p1p2p3p4, equipped with an efficient bilinear map. Suppose that the Assumption 1–5 hold in G. Then our one-bit RBAC scheme is secure under the formal security model.We apply the dual system encapsulation technique [37] to the one-bit RBAC scheme, where the encapsulated message En and the credential SC can take one of two indistinguishable form: normal form and semifunctional form. The correlation between them is shown in Table 2. “√” means is decapsulation allowed and “×” means decapsulation is not allowed. When all the EMR encapsulations and credentials are semifunctional, the adversary obtains no information for the challenge encapsulated EMR since none of the given credential is useful to decapsulate it.In the next section, we show that no PPT algorithm can distinguish betweenGamereal and Gamefinal. All the components in the encapsulation of Gamefinal are random elements, so it does not leak any EMR information. The indistinguishability between those games proves Theorem 1.Table 2
Correlation of normal and semifunctional forms.
NormalEn
SemifunctionalEn
NormalSC
√
√
SemifunctionalSC
√
×Semifunctional ciphertext: a user runs EHRGen to construct a normal ciphertextEn1′,En1′. Then they pick up random exponents x,zc∈ZN and sets En1=En1′g2xzc, En2=En2′g2x.
Semifunctional secret credential TKA runs the algorithm SCGenM to generate a normal keyK1′,K2′,Ejj∈1,n/I. It chooses random exponents γ,zk,zjj∈1,n/I∈ZN. The semifunctional key is set as K1=K1′g2γ,K2=K2′g2γ⋅zk, Ej=EjAg2γzj.
It is straightforward that the EHRDecM algorithm correctly outputsEHR when decrypting a semifunctional ciphertext by a semifunctional key since the added elements in Gp2 can be cleared due to orthogonality property. However, the blinding factor is multiplied by an additional term eg2,g2γxzk+∑i∈I/IziRi−zc. If zc=zk+∑i∈I/IziRi, decryption still works. In this case, we call the secret credential is nominally semifunctional. We prove Theorem 1 through following games between an adversary and a challenger.
Game
real: this is the real game.
Game
real
′: this game is the same as Gamereal except that all the secret credential queries are answered by the secret credential generation algorithm, not by the secret credential delegation algorithm.
Game
res: this game is the same as Gamereal’ except that the adversary cannot ask for secret credentials for the roles which are the prefixes of the challenge role modulo p2. Namely, it is not allowed that, for any queried role R⟶=R1,…,Rd, ∃R∗⟶=R1∗,R2∗,…,Rd′∗∈PrefP∗ with d′≤d, s.t.∀i∈1,d′,Ri=Ri∗modp2. P∗ is the set of challenge access policy.
Game
k: this game is identical with Gameres except that the EMR encapsulation given to adversary is semifunctional and the first k credentials are semifunctional (0≤k≤q) for bit 0. We notice that in Gameq, the EMR encapsulation and all credentials are semifunctional.
Game
final
′: this game is identical with Gameq except that challenge EMR encapsulation is a semifunctional encapsulation for a random message in subgroup of G for bit 0, not one of the messages given by the adversary.
Game
final: this game is identical with Gamefinal′ except that Gamefinal replaces the challenge EMR encapsulation of 0 by a pair of random points in the full group G.


## 6.3. Proof of Theorem 1

In this section, we use six lemmas to prove Theorem1. Each lemma demonstrates the indistinguishability between the neighbouring games.Lemma 1.
For any PPT algorithmA, it holds that: GamerealAdvAλ=Gamereal′AdvAλ.Proof of Lemma 1.
We note that the secret credentials are identically distributed whether they are generated by the credential generated algorithm or by the credential delegation algorithm. So, there is no difference betweenGamerealAdvA and Gamereal′AdvA from the adversary’s view.Lemma 2.
Suppose there exists a PPT algorithmA such that Gamereal′AdvAλ−GameresAdvAλ=ϵ1. Then, we can build a polynomial-time algorithm ℬ with advantage ε1/3 in breaking Assumption 1.Proof of Lemma 2.
If there exists a PPT adversaryA that distinguishes Gamereal′ and Gameres with probability ε1, by the definition of Gameres, A knows that it issues a secret credential query for the medical staff with role R⟶=R1,…,Rd from others satisfying that ∃R∗⟶=R1∗,R2∗,…,Rd′∗∈PrefP∗ with d′≤d, s.t.∀i∈1,d′,Ri=Ri∗modp2. Then the factor of N can be extracted by computing gcdRi−Ri∗,N, from which we design an algorithm ℬ breaking Assumption 1 as follows.
ℬ receives g1,g3,g4, and produces a nontrivial factor of N by computing r=gcdRi−Ri∗,N. We want to use r to generate a point in GQ, where GQ denotes the unique subgroup with order ∏j∈Qpj Q⊆4. We set 2∈Q but k∉Q so that GQ can be used to test T with orthogonality. Enumerate the cases for r, N/r, and the resulting k and Q in Table 3. As N/r is the complementary set of r, it covers all the possibilities for the subgroup with different orders.
Due to the rule that2∈Q but k∉Q, we get from Table 3 at least one choice of k that allows us to use r or N/r to construct a point in GQ. ℬ immediately decides T by orthogonality. For example, if r is p1, T is chosen from Gp1 or Gp1p2. Also we can get elements from GQ, i.e., we select X⟵RGp2p3p4. Then ℬ learns whether T has a Gp2 component or not by testing if eT,X=1. If not, T has a Gp2 component. From the point of A’s view, the choice of i is independent, and ℬ at least has 1/3 chance to pick an i that works.
Compared withGameres, the challenge encapsulation of a 0 bit is replaced with a semifunctional one in Game0, meaning its components are multiplied by points in Gp2. As the adversary does not know the factor of N=p1p2p3p4, it cannot determine whether the components of the challenge encapsulation of a 0 are in Gp1p4 or in Gp1p2p4. Hence, the adversary is not able to know which form the given challenge encapsulation is.Table 3
Possibilities forr,N/r,k,Q.
r
N/r
k
Q
p
1
p
2
p
3
p
4
1
2
3
4
p
2
p
1
p
3
p
4
1
3
4
2
p
3
p
1
p
2
p
4
3
1
2
4
p
4
p
1
p
2
p
3
4
1
2
3
p
1
p
2
p
3
p
4
3
4
1
2
p
1
p
3
p
2
p
4
1
3
2
4
p
1
p
4
p
2
p
3
1
4
2
3Lemma 3.
Suppose there exists a PPT algorithmA such that GameresAdvAλ−Game0AdvAλ=ϵ2. We can build a polynomial-time algorithm ℬ with advantage ϵ2 in breaking Assumption 2.Proof of Lemma 3.
The input of algorithmℬ is the challenge tuple g1,g3,g4,T of Assumption 2. ℬ has to decide whether T is in Gp1p4 or in Gp1p2p4.Setup: on inputsg1,g3,g4,T, ℬ picks random exponents aii∈1,n,b,x,y,ω from ZN, and sets U1i⟵Rg1ai, X1⟵Rg1b,X4⟵Rg4x,U4⟵Rg4y,W4⟵Rg4ω,U1i,4⟵RU1iU4,X14⟵RX1X4, W14⟵Rg1W4. It sends public paramter N,U1i,4,X14,W14,g4i∈1,ntoAQuery Phase 1: when the adversaryA issues a secret credential query for a medical staff with role R⟶=R1,…,Rd, ℬ randomly chooses exponents r,r3,r3′,rjj∈1,n/I⟵RZN where I=i:Ri∈SR⟶ and sets(18)K1=g1rg3r3,K2=∏i∈IU1iRi⋅X1r⋅g3r3′,Ej=U1jr⋅g3rjj∈i,n/I.
It has the same distribution as that of the normal secret credential.
Challenge:A outputs two EMR files EMR0 and EMR1 and a challenge access policy P∗. The challenge access policy P∗ must satisfy the property that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks a random coin β⟵R0,1 and gives the challenge EMR encapsulation as following. We denote that II∗=i:Ri∗∈SP∗.(i)
EMRβ=0. ℬ lets zc=∑i∈I∗aiRi∗+b and sets En1⟵RTzc,En2⟵RT. If ℬ’s challenge bit β=0, T⟵RGp1p2p4. We write T=g1W4sg4t4′g2x2 for random s,t4′,x2⟵RZN and get
(19)
En
1
=
g
1
W
4
s
g
4
t
4
′
g
2
x
2
z
c
=
∏
i
∈
II
∗
U
1
i
,
4
R
i
⋅
X
14
s
g
4
s
ω
+
t
4
′
⋅
z
c
−
y
∑
i
∈
I
∗
i
d
i
+
x
s
⋅
g
2
x
2
⋅
z
c
,
En
2
=
g
1
W
4
s
g
4
t
4
′
g
2
x
2
=
W
14
s
g
4
t
4
′
g
2
x
2
.
This implicitly setst4=sω+t4′⋅zc−y∑i∈I∗Ri+xsmodp4 and x2′=x2⋅zcmodp2. The challenge encapsulation is semifunctional formed in Game0A. If ℬ’s challenge bit β=1, T⟵RGp1p4. We write T=g1W4sg4t4′ for random s,t4′⟵RZN, and get
(20)
En
1
=
g
1
W
4
s
g
4
t
4
′
Z
c
=
∏
i
∈
II
∗
U
1
i
,
4
R
i
⋅
X
14
s
g
4
s
ω
+
t
4
′
⋅
z
c
−
y
∑
i
∈
II
∗
i
d
i
+
x
s
,
En
2
=
g
1
W
4
s
g
4
t
4
′
=
W
14
s
g
4
t
4
′
.
This implicitly setst4=sω+t4′⋅zc−y∑i∈II∗Ri+xsmodp4. The challenge EMR encapsulation is normally formed in Gameres.
(ii)
EMR
β
=
1. ℬ sets En1,En2⟵RG.
Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefP∗.
Guess: the adversaryA outputs a guess that it is in Game0 or Gameres. The simulator ℬ guesses T⟵RGp1p4 if A decides it is in Gameres β=1. ℬ outputs T⟵RGp1p2p4 if A decides it is in Game0 β=0. If A has the advantage ε2 to distinguish Gameres and Game0, ℬ can break Assumption 2 with advantage ϵ2.
Game
k
−
1 and Gamek are two distinguishable games. The way to decide whether the kth queried credential is normal or semifunctional is to decide whether the credential components are in Gp1p3 or in Gp1p2p3. This is computationally difficult without knowing factor N=p1p2p3p4.Lemma 4.
Suppose there exists a PPT algorithmA such that Gamek−1AdvAλ−GamekAdvAλ=ε3. Then, we can build a polynomial-time algorithm ℬ with advantage ε3 in breaking Assumption 3.Proof of Lemma 4.
The input ofℬ is the challenge tuple g1,g3,g4,D23,A12,T of Assumption 3. ℬ has to decide whether T is in Gp1p3 or in Gp1p2p3.Setup:ℬ receives g1,g3,g4,D23,A12,T. It picks random exponents a1i∈1,n,b,x,y,ω from ZN, and sets U1i⟵Rg1ai, X1⟵Rg1b,X4⟵Rg4x,U4⟵Rg4y,W4⟵Rg4ω,U1i,4⟵RU1iU4,X14⟵RX1X4,W14⟵Rg1W4 and k⟵R0,q. It sends the public parameters N,U1i,4,X14,W14,g4i∈1,n to A.Query Phase 1: whenA requests the ℓth credential for R⟶=R1,…,Rd where I=i:Ri∈SR⟶, we consider three cases: ℓ<k, ℓ>k, and ℓ=k.(i)
Whenℓ<k, ℬ creates a semifunction credential by picking up random exponents r,z,zA,zjj∈1,n/I from ZN and setting(21)K1=g1rD23z,K2=∏i∈IU1iRi⋅X1r⋅D23z′,Ej=U1,jrD23zjj∈1,n/I.
ConsiderD23 as g2y2g3y3 for random y2,y3⟵RZN, then
(22)
K
1
=
g
1
r
g
2
y
2
z
g
3
y
3
z
,
K
2
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
⋅
g
2
z
′
y
2
g
3
z
′
y
3
,
E
j
=
U
1
,
j
r
g
3
y
3
⋅
z
j
g
2
y
2
⋅
z
j
j
∈
1
,
n
/
I
.
This is a properly distributed semifunctional credential.
(ii)
Whenℓ>k, ℬ creates a normal credential by invoking the usual credential generation algorithm.
(iii)
Whenℓ=k, ℬ creates the kth credential. ℬ lets zk=∑i∈IaiRi+b and sets
(23)
K
1
⟵
R
T
,
K
2
⟵
R
T
z
k
,
E
j
⟵
R
T
a
j
j
∈
1
,
n
/
I
.
IfT⟵RGp1p3, T=g1rg3r3 for random r,r3⟵RZN, then
(24)
K
1
=
g
1
r
g
3
r
3
,
K
2
=
g
1
r
g
3
r
3
z
k
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
g
3
r
3
⋅
z
k
,
E
j
=
g
1
r
g
3
r
3
a
j
j
∈
1
,
n
/
I
=
U
1
,
j
r
g
3
r
3
⋅
a
j
j
∈
1
,
n
/
I
.
It has the same distribution as the normal credential.
IfT⟵RGp1p2p3, we write T=g1rg3r3g2t2 for random r,r3,t2⟵RZN, then
(25)
K
1
=
g
1
r
g
3
r
3
g
2
t
2
,
K
2
=
g
1
r
g
3
r
3
g
2
t
2
Z
k
=
∏
i
∈
I
U
1
i
R
i
⋅
X
1
r
g
3
r
3
⋅
z
k
g
2
t
2
⋅
z
k
,
E
j
=
g
1
r
g
3
r
3
g
2
t
2
a
j
=
U
1
,
j
r
g
3
r
3
⋅
a
j
g
2
t
2
⋅
a
j
j
∈
1
,
n
/
I
.
It has the same distribution as the semifunctional credential.
Challenge: at some points,A decides that it obtains enough secret credentials, it outputs two EMR files EMR0 and EMR1 and a challenge access policy P∗. This policy must satisfy that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks up a random coin ℬ⟵R0,1 and gives the challenge EMR encapsulation as follows:
(i)
EMR
β
=
0. ℬ picks up s4,s4′⟵RZN and sets En1⟵RA12zcg4s4,En2⟵RA12g4s4′. Consider A12 as g1sg2x2 for random s,x2⟵RZN, and get
(26)
En
1
=
∏
i
∈
II
∗
U
1
i
R
i
∗
⋅
X
14
s
⋅
g
2
x
2
⋅
z
c
⋅
g
4
s
4
−
x
s
−
y
s
∑
i
∈
II
∗
R
i
∗
,
En
2
=
g
1
s
g
2
x
2
g
4
s
4
′
=
g
1
g
4
ω
s
⋅
g
4
s
′
−
ω
s
⋅
g
2
x
2
=
g
1
s
W
4
s
g
4
s
4
′
−
ω
s
g
2
x
2
=
W
14
s
g
4
t
4
′
g
2
x
2
.
This implicitly setst4=s4−xs−ys∑i∈II∗Ri∗modp4, x2′=x2⋅zcmodp2 and t4′=s′−ωsmodp4 for I∗=i:Ri∗∈SP∗.
(ii)
EMR
β
=
1.
ℬ
sets
En
1
,
En
2
⟵
R
G.
The challenge encapsulation forEMRβ=0 is formed as the semifunctional form with zc=∑i∈II∗aiRi∗+b. Since from Gameres, the role R⟶=R1,…,Rd associated with the kth secret credential is not a prefix of the challenge receiver role R⟶∗=R1∗,…,Rd′∗ modulo p2, the variables zc and zk are randomly distributed to the adversary A. The relationship between zc and zk do not help A to distinguish the two games.
Query Phase 2: Query Phase 1 is repeated exceptR⟶∉PrefP∗.
Guess: the adversaryA outputs a guess that it is in Gamek−1 or Gamek.
ℬ outputs T⟵RGp1p3 if A decides it is in Gamek−1, where all components in the kth secret credential by algorithm ℬ are in Gp1p3. Otherwise, ℬ outputs T⟵RGp1p2p3 if A decides it is in Gamek, where all components in the kth secret credential by algorithm ℬ are in Gp1p2p3. If A has the advantage ε3 to distinguish Gamek−1 and Gamek, ℬ can break Assumption 3 with advantage ϵ3.Lemma 5.
Suppose there exists a PPT algorithmA such that GameqAdvAλ−Gamefinal′AdvAλ=ε4. Then we can build a polynomial-time algorithm ℬ with advantage ϵ4 in breaking Assumption 4.Proof of Lemma 5.
The input of algorithmℬ is the challenge tuple g2,g3,g4,W14,E12,T of Assumption 4. Algorithm ℬ has to answer whether T is in Gp2p4 or in Gp1p2p4.Setup:ℬ first receives g2,g3,g4,W14,E12,T. It then picks random exponents aii∈1,n,b from ZN, and sets U1i,4⟵RW14ai, X14⟵RW14b. It sends these public parameters N,U1i,4,X14,W14,g4i∈1,n to A.Query Phase 1: WhenA requests the secret credential for the medical staff with role R⟶=R1,…,Rd, ℬ lets zk=∑i∈IaiRi+b, randomly chooses exponents t,y,y′,r3,r3′, rjj∈1,n/I,yjj∈1,n/I⟵RZN where I=i:Ri∈SR⟶, and sets(27)K1=E12g2yg3r3,K2=E12t⋅zkg2y′g3r3′,Ej=E12t⋅ajg3rjg2yjj∈1,n/I.ConsiderE12=g1e1g2e2 for random e1,e2⟵RZN, and get(28)K1=g1te1g2te2+yg3r3,K2=∏i∈IU1iRi⋅X1te1⋅g2zkte2+y′⋅g3r3′,Ej=U1,jte1⋅g2te2⋅aj+yj⋅g3rjj∈1,n/I.This implicitly setsr=te1, t2=te2+y, t2′=zkte2+y′, U1i=g1ai, X1=g1b, and tj=te2⋅aj+yj. The simulated key is distributed as the semifunctional credential.Challenge:A outputs two EMR files EMR0 and EMR1, and a challenge access policy P∗. This policy must satisfy that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks a random coin β⟵R0,1 and gives the challenge EMR encapsulation as follows. We denote that II∗=i:Ri∗∈SP∗.
(i)
EMR
β
=
0.
ℬ randomly chooses s,x2′⟵RZN and sets(29)En1⟵R∏i∈II∗U1i,4Ri⋅X14sTx2′,En2⟵RW14sT.(a)
Ifℬ’s challenge bit is β=1, then T⟵RGp1p2p4. Hence, the challenge ciphertexts En1 and En2 are random in Gp1p2p4 as in Gamefinal′.(b)
Ifℬ’s challenge bit is β=0, then T⟵RGp2p4. We write T=g4t4′g2x2 for random t4′,x2⟵RZN and get(30)En1=∏i∈I∗U1i,4Ri⋅X14s⋅g4t4′x2′g2x2x2′,En2=W14sg4t4′g2x2.(c)
This implicitly setst4=t4′x2′ mod p4. The challenge encapsulation is formed as the semifunctional form in Gameq.
(ii)
EMR
β
=
1. ℬ sets En1,En2⟵RG.
Query Phase 2: Query Phase 1 is repeated adaptively exceptR⟶∉PrefP∗.
Guess: the adversaryA outputs a guess that it is in Gameq or Gamefinal′.
The simulatorℬ guesses T⟵RGp2p4 if A decides it is in Gameq β=0. Otherwise, ℬ outputs T⟵RGp1p2p4 β=1. If A has an advantage ε4 to distinguish Gameq and Gamefinal′, ℬ breaks Assumption 4 with advantage ε4. Since all the credentials and EMR encapsulations are semifunctional in Gameq, A cannot get any information about the challenge EMR encapsulation due to none of the given credentials are useful to decapsulate it. Hence, A cannot find that the challenge EMR encapsulation has been replaced by a random component. This implies the indistinguishability between Gameq and Gamefinal′.Lemma 6.
Suppose there exists a PPT algorithmA such that Gamefinal′AdvAλ−GamefinalAdvAλ=ε5. Then we construct a PPT algorithm ℬ with advantage ϵ5 in breaking Assumption 5.Proof of Lemma 6.
The input ofℬ is the challenge tuple g1,g4,D23,T of Assumption 5. ℬ has to answer T is in Gp1p2p4 or in G.Setup:ℬ first receives g1,g4,D23,T. It then picks up random exponents aii∈1,n,b from ZN, and sets U1i⟵Rg1ai, X1⟵Rg1b,X4⟵Rg4x,U4⟵Rg4y,W4⟵Rg4ω,U1i,4⟵RU1iU4,X14⟵RX1X4,W14⟵Rg1W4. It sends the public parameters N,U1i,4,X14,W14,g4i∈1,n to A.Query Phase 1: whenA requests a secret credential for a medical staff with role R⟶=R1,…,Rd, ℬ lets zk=∑i∈IaiRi+b, chooses exponents r,d,d′,djj∈1,n/I⟵RZN where I=i:Ri∈SR⟶, and sets(31)K1=g1rD23d,K2=∏i∈IU1iRi⋅X1rD23d′,Ej=U1jrD23djj∈1,n/I.We writeD23=g2e2g3e3 for random e2,e3⟵RZN and get(32)K1=g1rg2e2dg3e3d,K2=∏i∈IU1iRi⋅X1rg2ed′⋅g3e3d′,Ej=U1jrg3e3dj⋅g2e2djj∈i∈1,n/I.This implicitly setsr3=e3d, t2=e2d, r3′=e3d′, t2′=e2d′, rj=e3dj, and tj=e2dj. The simulated credential is distributed as the semifunctional credential.Challenge:A outputs two EMR files EMR0 and EMR1, and a challenge access policy P∗. This policy must satisfy that no revealed role in Query Phase 1 was a prefix of its components. ℬ picks up a random exponent z and a random coin β⟵R0,1. It gives the challenge encapsulation: En1⟵RT,En2⟵RTz. If ℬ’s challenge bit is β=0 then T⟵RG. Hence, the challenge ciphertexts En1 and En2 are random components in G as in Gamefinal.
Ifℬ’s challenge bit is β=1, then T⟵RGp1p2p4. Hence, the challenge ciphertexts En1 and En2 are random components in Gp1p2p4 as in Gamefinal′.Query Phase 2: repeat Query phase 1 exceptR⟶∉PrefP∗.Guess: the adversaryA outputs a guess whether it is in Gamefinal′ or in Gamefinal. The simulator ℬ guesses T⟵RGp1p2p4 if A decides it is in Gamefinal′ β=1. Otherwise, ℬ outputs T⟵RG β=0. If A has the advantage ε5 to distinguish Gamefinal′ and Gamefinal, ℬ can break Assumption 5 with advantage ε5. Gamefinal replaces the challenge encapsulation of 0 by a pair of random points in the full group. From the view of adversary, it cannot find that the challenge EMR encapsulation has been replaced by a random component in the full group or in the subgroup. Hence, it implies the indistinguishability between Gamefinal′ and Gamefinal.Proof of Theorem 1.
If a group generator algorithmG satisfies Assumption i with advantage εi′1≤i≤5, then Lemmas 0–5 show that there is no polynomial time adversary to distinguish Gamereal and Gamefinal with advantage GamerealAdvAλ−GamefinalAdvAλ, which can be expanded as follows:(33)GamerealAdvAλ−GamefinalAdvAλ≤GamerealAdvAλ−Gamereal′AdvAλ+Gamereal′AdvAλ−GameresAdvAλ+GameresAdvAλ−Game0AdvAλ+Game0AdvAλ−Game1AdvAλ+Game1AdvAλ−Game2AdvAλ+⋯+Gameq−1AdvAλ−GameqAdvAλGameqAdvAλ−Gamefinal′AdvAλ+Gamefinal′AdvAλ−GamefinalAdvAλ=3ε1′+ε2′+ε3′+ε4′+ε5′.
All the components inGamefinal are random elements in G, and the messages are hidden from the adversary. Therefore, if the group G with composite order N=p1p2p3p4 satisfies Assumption 1–5 with advantage ε1′,ε2′,ε3′,ε4′,ε5′ respectively, then our one-bit RBAC is secure with advantage 3ε1′+ε2′+ε3′+ε4′+ε5′.


## 6.4. From One-Bit RBAC with 1SPL to Multibit RBAC-UL

We provide security analysis for the RBAC-UL model. The key point is to reduce RBAC-UL security from a secured one-bit RBAC with 1SPL functionality. We use a specific 1SPL algorithm “LeakToOne” which exposes the randomness as if it is randomly chosen for bit 1, and fails with probability δ when it cannot find out the randomness to 1. In the security analysis, we assume that all the roles in the access policy set or its subset are ordered from high-level staff to the lower level one.Theorem 2.
LetΓ be a one-bit RBAC scheme, and Γℓ be the ℓ-bit RBAC scheme built from it. Let k be the number of leaked EMRs and δ be the failing probability of LeakToOne. Suppose there exists an RBAC-UL adversary A, RBAC-UL simulator S, and RBAC adversary ℬ. If Γ is secure with AdvΓ,ℬRBAC−INDλ, then Γℓ is secure with AdvΓℓ,S,ARBAC−ULλ≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ.We prove it by a series of game transitions.(i)
GamerealA: this is the real game.(ii)
Gamereal1A: this game reselects the randomness for the “0” bit encapsulation at Corrupt phase.(iii)
Gamereal2A: this game runs LeakToOne algorithm for the “0” bit encapsulation at Corrupt phase. If LeakToOne fails, it reselects the randomness as Gamereal1A does.(iv)
Gamereal3A: compared with Gamereal2A, it does nothing if LeakToOne algorithm fails.(v)
GamevA: the first v bits from the challenge EMRs are replaced by bit “0” and then encapsulated. The remaining bits are encapsulated normally. At Corrupt phase, if it needs to open an encapsulation component to a “0” bit, it directly gives A the randomness it used when creating the encapsulation. If it needs to open an encapsulation to a “1” bit, it runs LeakToOne to find the randomness.(vi)
GamekℓA: all the bits from challenge EMRs are replaced by “0” and all the “0” bits are encapsulated.(vii)
GamesimS: this game is run by the simulator S.In the next subsection, we show that no PPT algorithm can distinguish betweenGamerealA and Gamereal1A and between Gamereal1A and Gamereal2A. Then we demonstrate that, if any execution of LeakToOne fails at most δ, no PPT algorithm has advantage kℓδ to distinguish between Gamereal2A and Gamereal3A. Following that, if no adversary ℬ has the advantage AdvΓ,ℬRBAC−INDλ to break one-bit RBAC scheme, then no algorithm has the advantage AdvΓ,ℬRBAC−INDλ to distinguish between GamevA and Gamev+1A, so that no algorithm has the advantage kℓ⋅AdvΓ,ℬRBAC−INDλ to distinguish between Gamereal3A and GamekℓA. From the above deductions, we get PrGamerealAλ=1−PrGamekℓAλ=1≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ. We also show that the simulator S runs identically to the GamekℓA, which means the GamekℓA is distinguishable from the GamesimS. Finally, we get AdvΓ,S,ARBAC−ULλ=PrGamerealAλ=1−PrGamesimSλ=1 which is defined in Definition 6.


## 6.5. Proof of Theorem 2

LetA be a RBAC-UL adversary against Γℓ. We can construct a simulator S that runs Setup to generate PK and MSK. It runs A to answer the following queries. (1) When A outputs the set of EMRs on which it wishes to challenge, S then generates a set of EMR encapsulations where each encryption is an encryption of the all-zero message 0ℓ and returns them to A. (2) When A decides to corrupt some of these EMR encapsulations, the simulator S queries its own Corrupt procedure, learns the EMRs it needs to corrupt, and opens them bit-by-bit. If it needs to open an encapsulation component to a 0, it directly gives A the randomness it used when creating the encapsulation. Otherwise, S needs to open an encapsulation to a 1, it runs LeakToOne algorithm to find the randomness. (3) When A issues a secret credential query, S simply uses MSK to answer correctly. Through the above ways, the simulator S can generate the same output as A. We use Gamereal and Gamesim to describe the games that A and S runs, respectively. Based on Definition 6, the target of Theorem 2 is to prove(34)PrGamerealAλ=1−PrGamesimSλ=1≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ.Lemma 7.
For any PPT algorithmA, GamerealAAdvAλ=Gamereal1AAdvAλ.Proof of Lemma 7.
Since the randomness inGamerealA and Gamereal1A are uniformly and independently chosen from Zp, they are identically distributed from the view of A.Lemma 8.
For any PPT algorithmA, Gamereal1AAdvAλ=Gamereal2AAdvAλ.Proof of Lemma 8.
IfLeakToOne does not fail, its output is identically distributed as that in Gamereal1A from the view of A’s. If LeakToOne does fail, Gamereal2A does the same operations as that in Gamereal1A.Lemma 9.
Suppose that any execution ofLeakToOne fails at most δ. For any PPT algorithm A, the following holds:(35)Gamereal2AAdvAλ−Gamereal3AAdvAλ≤kℓ⋅δ.Proof of Lemma 9.
Since there are at mostkℓ bits that have to be opened by LeakToOne algorithm in phase Corrupt, the worst event is that all the kℓ bits are failed to be opened and Gamereal3A does not make any response to the failure. The probability for the worst event is kℓ⋅δ.Lemma 10.
If a PPT adversaryℬ can break the one-bit RBAC-IND scheme with AdvΓ,ℬRBAC−INDλ, then there exists a PPT algorithm A so that(36)GamevAAdvAλ−Gamev+1AAdvAλ=AdvΓ,ℬRBAC−INDλ.Proof of Lemma 10.
SupposeEvv+11GamevA is the event that in the execution of GamevA, the v+1st bits sampled from the set of EMR are 1.
LetGamevAEvv+11GamevA denote that GamevA is run in the condition that the event Evv+11GamevA happens. Ev0 is the complementary event for Ev1. Notice that in the event that the v+1st bit sampled in GamevA is 0, the game Gamev+1A and GamevA are identical, because Gamev+1A ignores the actual bit and encapsulates it as a bit 0 based on its definition, and GamevA encapsulates the actual v+1st bit which is 0. Thus, Evv+10Gamev+1=Evv+10Gamev. Next, we compute GamevAAdvAλ−Gamev+1AAdvAλ as follows (we use G to represent Game):(37)GamevAAdvA−Gamev+1AAdvA=PrGvA&Evv+10GvA+PrGvA&Evv+11GvA−PrGv+1A&Evv+10Gv+1A+PrGv+1A&Evv+11Gv+1A=PrEvv+10GvA⋅PrGvAEvv+10GvA−PrEvv+10Gv+1A⋅PrGvAEvv+10Gv+1A+PrEvv+11GvA⋅PrGvAEvv+11GvA−PrEvv+11Gv+1A⋅PrGv+1AEvv+11Gv+1A=PrEvv+10GvA⋅PrGvAEvv+10GvA−PrGv+1AEvv+10Gv+1A+PrEvv+11GvA⋅PrGvAEvv+11GvA−PrEvv+11Gv+1A⋅PrGv+1AEvv+11Gv+1A.
Since in the eventEvv+10 both Gamev+1A and GamevA are identical, the first item in the above formula is 0. It means that(38)GamevAAdvA−Gamev+1AAdvA=PrEvv+11GamevA⋅PrGamevAEvv+11GamevA−PrEvv+11Gamev+1A⋅PrGamev+1AEvv+11Gamev+1A.
Next, we consider the adversaryℬ against the one-bit RBAC scheme with 1SPL. ℬ runs A while simulating its RBAC-IND environment as in either GamevAEvv+11GamevA or Gamev+1AEvv+11Gamev+1A. Note that ChallengeB is used to denote that the adversary ℬ runs the Challenge phase in the RBAC-IND experiment.Setup:ℬ generates a public key PK by running the system setup algorithm, and it sends PK to A.Query Phase 1:A issues a secret credential query for the medical staff associated with role R⟶. ℬ creates the secret credential by running the credential generation algorithm and return the secret credential to A.Challenge: the adversaryA outputs a set of EMR files EMR⟶=M1,M2,…,Mk and a challenge access policy set P∗=P1∗,P2∗,…,Pk∗ to ℬ. Each challenge access policy Pi∗ in the set should satisfy that for all the secret credential queries for R⟶ issued in Query Phase 1, R⟶∉PrefPi∗. We note that each EMR file EMRi for i∈1,k constitutes of ℓ bits since we let the Γℓ be a ℓ-bit RBAC scheme. ℬ randomly chooses i⟵R1,ℓ and j⟵R1,k. For each i∈1,ℓ and j∈1,k, we consider three cases:(i)
Wheni−1⋅ℓ+j≤v, EMRij is ignored and replaced by 0. ℬ randomly chooses rij⟵RZp, computes Enij⟵REMREncPK,Pi∗,0,rij, and returns it to A.(ii)
Wheni−1⋅ℓ+j=v+1, ℬ encrypts the v+1st bit in two different conditions. If EMRij=1, ℬ runs the Challengeℬ algorithm against the RBAC-IND scheme. Specifically speaking, ℬ flips a random coin to decide whether it encapsulates 0 or 1 under the challenge access policy Pi∗. Then ℬ returns the cihpertext to A. If EMRij=0, EMRij is encapsulated normally. ℬ randomly chooses rij⟵RZp, executes Enij⟵REMREncPK,Pi∗,EMRij,rij and returns it to A.(iii)
Wheni−1⋅ℓ+j>v+1, EMRij is encapsulated normally. ℬ randomly chooses rij⟵RZp, computes Enij⟵REMREncPK,Pi∗,EMRij,rij, and returns it to A.Corrupt:A outputs a set I⊆1,n and then ℬ learns EMR⟶I. For each index i∈I and each j∈1,ℓ, ℬ generates the randomness as follows:(i)
IfEMRij=0, ℬ returns the actual randomness it used to generated Eni.(ii)
IfEMRij=1, ℬ runs LeakToOne algorithm to get randomness under which the EMREnc algorithm applied to 1 would produce Enij, namely,(39)rij⟵RLeak to onePK,Pi∗,Enij.
Finally,ℬ returns Mij,riji∈1,kj∈1,ℓ to A.Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefPi∗.Output: whenA halts with out, ℬ halts and outputs EMR⟶,P∗,I,out.
The adversaryℬ only runs Challengeℬ in the event Evv+11 EMRij=1 in the Challenge phase, such that all of its advantage comes from this case. It means that PrEvv+11Gamev=1 and PrEvv+11Gamev+1=1. It is important to notice that in the event Evv+11, if ℬ decides to encapsulate 1, it simulates its environment as in playing GamevA with A. If ℬ decides to encapsulate 0, it simulates the environment as in Gamev+1A. Therefore, the advantage of A to distinguish GamevAEvv+11GamevA and Gamev+1AEvv+11Gamev+1A depends on the advantage of ℬ to distinguish that the challenge EMR-encapsulation is for 1 or 0. It is easy to see that(40)AdvΓ,ℬRBAC−INDλ=PrGamevAEvv+11GamevA−PrGamev+1AEvv+11Gamev+1A.
Combined with equation (38), we get(41)GamevAAdvAλ−Gamev+1AAdvAλ=AdvΓ,ℬRBAC−INDλ.
Furthermore, since(42)Game0AAdvAλ−GamekℓAAdvAλ=∑v=0kℓ−1GamevAAdvAλ−Gamev+1AAdvAλ,we conclude(43)Game0AAdvAλ−GamekℓAAdvAλ=kℓ⋅AdvΓ,ℬRBAC−INDλ.Lemma 11.
For any PPT algorithmA,(44)GamekℓAAdvAλ=GamesimSAdvSλ.Proof of Lemma 11.
First, we compare two gamesGamekℓA and GamesimS.
Game
k
ℓ
A works as follows:Setup:A receives a public key from the challenger C.Query Phase 1:A issues a secret credential query for the medical staff associated with role R⟶. The challenger C creates the secret credential by running the credential generation algorithm and returns the secret credential to A.Challenge: the adversaryA outputs a set of EMR files EMR⟶=EMR1EMR2,…,EMRk and the challenge access policy set P∗=P1∗,P2∗,…,Pk∗ to the challenger C. Each challenge access policy Pi∗ in the set should satisfy that for all the access credential queries for R⟶ issued in Query Phase 1, R⟶∉PrefPi∗. C randomly chooses elements r1,r2,…,rk⟵RZp where p=G. We denote r⟶=r1,r2,…,rk. C ignores the input EMRs and regards the components as all-0 messages. Then it encrypts each 0ℓ message as follows:(45)Eni⟵REncPK,Pi∗,0ℓ,ri,C returns the set of EMR encapsulation En⟶=En1,En2,…,Enk to A.Corrupt:A outputs a set I⊆1,n and then C opens the corresponding ciphertext to get EMR⟶I. For each index i∈I and each j∈1,ℓ, C makes the randomness as follows:(i)
IfEMRij=0, C returns the actual randomness it used to generated Eni.(ii)
IfEMRij=1, C runs LeakToOne to get the randomness used by EMREnc to compute Enij when encrypting 1, namely, rij⟵RLeak to onePK,Pi∗,Enij.Finally,C returns EMRij,riji∈,k,j∈1,ℓ to A.Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefPi∗.Output: When the adversaryA halts with out, C halts and outputs EMR⟶,P∗,I,out.
Game
sim
S works as follows:Setup:S generates the public key PK by running the system setup algorithm and then sends the public key to A.Query Phase 1:A requests the secret credential for the medical staff associated with role R⟶. S creates the secret credential by running the credential generation algorithm and return the secret credential to A.Challenge:A outputs a set of EMR EMR⟶=M1,M2,…,Mk and the challenge access policy set P∗=P1∗,P2∗,…,Pk∗ to ℬ. Each challenge access policy Pi∗ in the set should satisfy that for all the access credential queries for R⟶ issued in Query Phase 1, R⟶∉PrefPi∗. Note that each EMRi for i∈1,k consists of ℓ bits since we let Γℓ be a ℓ-bit RBAC scheme. S randomly chooses elements r1,r2,…,rk⟵RZp where p=G. We denote r⟶=r1,r2,…,rk. S ignores the input EMRs and regards the components as all-0 messages. Then it encapsulates each 0ℓ message as Eni⟵REncPK,Pi∗,0ℓ,ri. Finally, S returns the EMR encapsulations En⟶=En1,En2,…,Enk to A.Corrupt:A outputs a set I⊆1,n and then S learns EMR⟶I. For each index i∈I and each j∈1,ℓ, S makes the randomness as follows:(i)
IfEMRij=0, S returns the actual randomness used to generate Eni.(ii)
IfEMRij=1, S runs LeakToOne to get randomness used by EMREnc to compute Enij for encapsulation of 1, namely, rij⟵RLeak to onePK,Pi∗,0ℓ,Enij.Finally,S returns EMRij,riji∈1,k,j∈1,ℓ to A.Query Phase 2: Query Phase 1 is repeated adaptively except thatR⟶∉PrefPi∗.Output: whenA halts with output out, S halts and outputs EMR⟶,P∗,I,out.
S queries its own Corrupt procedure on I and learns EMR⟶I instead of getting them directly as in GamekℓA. From the view of the adversary A, there is no difference of the corrupted EMRs and the sampled randomness. Therefore, S runs identically with GamekℓA.Proof of Theorem 2.
From the above analysis, the simulatorS described in GamesimS runs identically to GamekℓA. So we have GamekℓAAdvAλ=GamesimSAdvSλ. Combining all the above lemmas, we get(46)GamerealAAdvAλ−GamesimSAdvSλ≤GamerealAAdvAλ−Gamereal1AAdvAλ+Gamereal1AAdvAλ−Gamereal2AAdvAλ+Gamereal2AAdvAλ−Gamereal3AAdvAλ+∑v=0kℓ−1GamevAAdvAλ−Gamev+1AAdvAλ+GamekℓAAdvAλ−GamesimSAdvSλ≤kℓ⋅δ+kℓ⋅AdvΓ,ℬRBAC−INDλ.
According to Definition6, we get AdvΓℓ,S,ARBAC−ULλ≤kℓ⋅AdvΓ,ℬRBAC−INDλ+kℓ⋅δ, which proves Theorem 2.


## 7. Performance Analyses

### 7.1. Improve User Experience

To achieve better user experience, we speed up credential generation and EMR encapsulation by applying online/offine cryptography [38]. The offline phase executes most of heavy computations by assuming a set of random roles, while the online phase only performs light computations to produce the EMR encapsulation and the secret credential once the true roles are available. “Ours&RBAC” is denoted as the scheme with improved efficiency.


### 7.2. Theoretical Analysis

Table4 shows the efficiency of the proposed one-bit RBAC scheme. We denote te as one exponent operation time, tm as one multiplication time, and tp as one pairing operation time. The maximal depth of the hierarchy for a access policy is P. R⟶ is the number of atom roles in a secret credential. In the procedure of SCGen, SCDeleg, EMREnc, and EMRDec, exponentiations can be precomputed by choosing the random exponents.Table 4
The efficiency of the proposed scheme.
The atom roles isn
MSK size
n
+
3
SC
R
⟶ size
n
+
2
−
R
⟶
SCGen time
2
n
−
R
⟶
+
4
t
e
+
n
+
2
t
m
SCDeleg time
2
n
−
R
⟶
+
5
t
e
+
n
+
5
t
m
EMREnc time
P
+
3
t
e
+
P
+
2
t
m
EMRDec time
2
t
pTable5 compares several schemes in different perspectives. The properties of scalable sharing, flexible access, and leakage controllability support further rendering our scheme with improved efficiency to practice.Table 5
Comparison with related work.
SCGen time
EMREnc time
Parings in EMRDec
Leakage controllability
Scalable sharing
Flexibility
[12]
1
+
4
R
⟶
t
e
1
+
4
R
⟶
t
m
6
t
e
+
t
m
+
t
p
+
t
p
3
R
⟶
×
√
√
[16]
3
n
+
4
t
e
+
3
R
⟶
+
4
t
m
P
+
4
t
e
+
P
+
4
t
m
3
×
√
√
[29]
5
t
e
+
3
t
m
5
t
e
+
3
t
m
2
√
×
×
[39]
2
R
⟶
+
1
t
e
+
R
⟶
t
m
5
t
e
+
P
t
m
+
t
p
2
×
√
√
[40]
2
R
⟶
+
1
t
e
+
R
⟶
t
m
4
t
e
+
t
m
+
t
p
2
R
⟶
×
×
√
Ours
2
n
−
R
⟶
+
4
t
e
+
n
+
2
t
m
P
+
3
t
e
+
P
+
2
t
m
2
√
√
√
Ours & RBAC
R
⟶
⋅
t
m
P
⋅
t
m
2
√
√
√


### 7.3. Performance Analysis

We conduct experiment on Intel Core i7 processor with 8 GB RAM and 2.6 GHZ CPU. We use elliptic curve type A1 for the Tate symmetric pairing. Both group order ofℤN and element size in G are configured as 512 bits. The experiment is executed with jPBC library. We test the single computation execution times te, tm, and tp for the prime order bilinear group and the composite order bilinear group, which are used in the related work and our work separately. Table 6 shows the compared running time.Table 6
A single computation execution time.
t
e
t
m
t
p
Prime order bilinear group
4.62 ms
0.04 ms
38.56 ms
Composite order bilinear group
130 ms
0.16 ms
148.52 msWe also test the operational time for system setup, credential generation, delegation, EMR encapsulation, and decapsulation for our system, as Figure2 illustrates. Figure 2(f) and 2(g) show the operational time when user experience is improved.Figure 2
Experimental results for our proposed system. (a) System setup time (ms). (b) SC generation time (ms). (c) SC delegation time (ms). (d) Encapsulation time (ms). (e) Decapsulation time (ms). (f) Improved SC generation time (ms). (g) Improved encapsulation time (ms).
(a)
(b)
(c)
(d)
(e)
(f)
(g)Figures3(a) and 3(b) show the operational time for the compared related work, where prime order bilinear groups are used. The computation of SC generation time and EHR encapsulation time shows superior efficiency when compared with our work without performance improved. That is why we apply the performance improvement algorithm in our system, so as to ensure both efficiency and security. The Y-axis represents the operational time in milliseconds. The X-axis in Figures 2(b), 2(c), 2(f), and 3(a) means the number of related atom roles included in a role of medical staff. The X-axis in Figures 2(a), 2(d), 2(e), 2(g), and 3(b) means the number of atom roles in an access policy.Figure 3
Experimental result for the compared related work. (a) SC Generation time for the related work (ms). (b) EHR Encapsulation time for the related work (ms).
(a)
(b)


## 7.1. Improve User Experience

To achieve better user experience, we speed up credential generation and EMR encapsulation by applying online/offine cryptography [38]. The offline phase executes most of heavy computations by assuming a set of random roles, while the online phase only performs light computations to produce the EMR encapsulation and the secret credential once the true roles are available. “Ours&RBAC” is denoted as the scheme with improved efficiency.


## 7.2. Theoretical Analysis

Table4 shows the efficiency of the proposed one-bit RBAC scheme. We denote te as one exponent operation time, tm as one multiplication time, and tp as one pairing operation time. The maximal depth of the hierarchy for a access policy is P. R⟶ is the number of atom roles in a secret credential. In the procedure of SCGen, SCDeleg, EMREnc, and EMRDec, exponentiations can be precomputed by choosing the random exponents.Table 4
The efficiency of the proposed scheme.
The atom roles isn
MSK size
n
+
3
SC
R
⟶ size
n
+
2
−
R
⟶
SCGen time
2
n
−
R
⟶
+
4
t
e
+
n
+
2
t
m
SCDeleg time
2
n
−
R
⟶
+
5
t
e
+
n
+
5
t
m
EMREnc time
P
+
3
t
e
+
P
+
2
t
m
EMRDec time
2
t
pTable5 compares several schemes in different perspectives. The properties of scalable sharing, flexible access, and leakage controllability support further rendering our scheme with improved efficiency to practice.Table 5
Comparison with related work.
SCGen time
EMREnc time
Parings in EMRDec
Leakage controllability
Scalable sharing
Flexibility
[12]
1
+
4
R
⟶
t
e
1
+
4
R
⟶
t
m
6
t
e
+
t
m
+
t
p
+
t
p
3
R
⟶
×
√
√
[16]
3
n
+
4
t
e
+
3
R
⟶
+
4
t
m
P
+
4
t
e
+
P
+
4
t
m
3
×
√
√
[29]
5
t
e
+
3
t
m
5
t
e
+
3
t
m
2
√
×
×
[39]
2
R
⟶
+
1
t
e
+
R
⟶
t
m
5
t
e
+
P
t
m
+
t
p
2
×
√
√
[40]
2
R
⟶
+
1
t
e
+
R
⟶
t
m
4
t
e
+
t
m
+
t
p
2
R
⟶
×
×
√
Ours
2
n
−
R
⟶
+
4
t
e
+
n
+
2
t
m
P
+
3
t
e
+
P
+
2
t
m
2
√
√
√
Ours & RBAC
R
⟶
⋅
t
m
P
⋅
t
m
2
√
√
√


## 7.3. Performance Analysis

We conduct experiment on Intel Core i7 processor with 8 GB RAM and 2.6 GHZ CPU. We use elliptic curve type A1 for the Tate symmetric pairing. Both group order ofℤN and element size in G are configured as 512 bits. The experiment is executed with jPBC library. We test the single computation execution times te, tm, and tp for the prime order bilinear group and the composite order bilinear group, which are used in the related work and our work separately. Table 6 shows the compared running time.Table 6
A single computation execution time.
t
e
t
m
t
p
Prime order bilinear group
4.62 ms
0.04 ms
38.56 ms
Composite order bilinear group
130 ms
0.16 ms
148.52 msWe also test the operational time for system setup, credential generation, delegation, EMR encapsulation, and decapsulation for our system, as Figure2 illustrates. Figure 2(f) and 2(g) show the operational time when user experience is improved.Figure 2
Experimental results for our proposed system. (a) System setup time (ms). (b) SC generation time (ms). (c) SC delegation time (ms). (d) Encapsulation time (ms). (e) Decapsulation time (ms). (f) Improved SC generation time (ms). (g) Improved encapsulation time (ms).
(a)
(b)
(c)
(d)
(e)
(f)
(g)Figures3(a) and 3(b) show the operational time for the compared related work, where prime order bilinear groups are used. The computation of SC generation time and EHR encapsulation time shows superior efficiency when compared with our work without performance improved. That is why we apply the performance improvement algorithm in our system, so as to ensure both efficiency and security. The Y-axis represents the operational time in milliseconds. The X-axis in Figures 2(b), 2(c), 2(f), and 3(a) means the number of related atom roles included in a role of medical staff. The X-axis in Figures 2(a), 2(d), 2(e), 2(g), and 3(b) means the number of atom roles in an access policy.Figure 3
Experimental result for the compared related work. (a) SC Generation time for the related work (ms). (b) EHR Encapsulation time for the related work (ms).
(a)
(b)


## 8. Conclusion

We consider a multiparty communication scenario in a medical cloud storage system. A lot of medical records are outsourced on the cloud and accessed by medical staff with hierarchical privileges. We summarize different adversarial behaviours and construct a RBAC-UL scheme against many kinds of leakages. Performance analyses show that our scheme has advantages in scalability, flexibility, and the controllability of privacy leakage.



---

*Source: 8347213-2020-02-10.xml*