# Enabling Efficient Decentralized and Privacy Preserving Data Sharing in Mobile Cloud Computing

Authors: Jiawei Zhang; Ning Lu; Teng Li; Jianfeng Ma
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

Mobile cloud computing (MCC) is embracing rapid development these days and able to provide data outsourcing and sharing services for cloud users with pervasively smart mobile devices. Although these services bring various conveniences, many security concerns such as illegally access and user privacy leakage are inflicted. Aiming to protect the security of cloud data sharing against unauthorized accesses, many studies have been conducted for fine-grained access control using ciphertext-policy attribute-based encryption (CP-ABE). However, a practical and secure data sharing scheme that simultaneously supports fine-grained access control, large university, key escrow free, and privacy protection in MCC with expressive access policy, high efficiency, verifiability, and exculpability on resource-limited mobile devices has not been fully explored yet. Therefore, we investigate the challenge and propose an Efficient and Multiauthority Large Universe Policy-Hiding Data Sharing (EMA-LUPHDS) scheme. In this scheme, we employ fully hidden policy to preserve the user privacy in access policy. To adapt to large scale and distributed MCC environment, we optimize multiauthority CP-ABE to be compatible with large attribute universe. Meanwhile, for the efficiency purpose, online/offline and verifiable outsourced decryption techniques with exculpability are leveraged in our scheme. In the end, we demonstrate the flexibility and high efficiency of our proposal for data sharing in MCC by extensive performance evaluation.


---

## Body

## 1. Introduction

As an emerging paradigm, mobile cloud computing (MCC) is growing exponentially and facilitates the deployment of enormous mobile devices covering public and private sectors [1]. The MCC systems provide not only strong mobility but also abundant computing and storage capacity for these resource-limited devices which prefer to outsource their data to MCC for cost saving [2]. Moreover, assisted by the data sharing service of MCC, users are able to conveniently enjoy various applications, such as smart home, smart office, and intelligent transportation, with pervasive and smart mobile devices [3]. In particular, this trend is being accelerated with the implementation of 5G communication network offering massive high-speed access capacity [4]. As shown in Figure 1, users can share their data in MCC conveniently with different kinds of mobile devices, e.g., laptops, cellphones, through gNBs (i.e., next generation NodeB) of 5G network, or even satellites receiving station on various sites (e.g., home, hotel, plain, or car). Although MCC, such as iCloud and OneDrive, can provide a variety of benefits to mobile users, the data security issues, i.e., data confidentiality and fine-grained access control, have become important stumbling blocks for the usage of MCC [5]. The data outsourced to MCC may contain numerous sensitive information or significant assets relevant to mobile users and terminates [6]. Thus, the most critical data security concern is the data access control issues that allows only authorized users while prevents unauthorized ones from accessing the shared data in MCC as it will cause severe consequences if the private information is leaked.Figure 1
The architecture of mobile cloud computing.Therefore, how to protect these sensitive data outsourced in MCC remains an urgent challenge. As a promising technique, ciphertext-policy attribute-based encryption (CP-ABE) [7–9] can be adopted to provide fine-grained data access control when user data is shared with multiple users. Nevertheless, the conventional CP-ABE schemes are unsuitable to be directly utilized in secure data sharing of the MCC system as there still exist several issues. First of all, in general CP-ABE schemes, ciphertexts are stored in Cloud Service Provider (CSP) and shared with multiple users together with the access policies which are in plaintext and may cause user privacy leakage [7]. Moreover, a MCC system involves large amount of mobile devices and users, and standard CP-ABE schemes with bounded attribute universe and single attribute authority are no longer satisfactory due to their inflexibility, key escrow, and single-point failure problems [10]. Furthermore, as the CSPs are untrusted in terms of users, they may misbehave in outsourced decryption by returning previous results or even random and false results to users [2]. In addition, the low efficiency in encryption and decryption is an inferior drawback for traditional CP-ABE schemes when used in MCC with enormous resource-limited mobile devices. Thus, it is urgent to design a practical data access control scheme for data sharing in MCC that can address these issues.To find out a solution, many works have made great progresses. The scheme in [11] solves the problem of bounded attribute universe, key escrow, and single-point failure problem while it cannot support policy privacy preserving and decryption verifiability. Meanwhile, the schemes in [12, 13] support efficient encryption and exculpable decryption as well as multiauthority and policy hidden, respectively. Recently, the authors in [6, 7] proposed two CP-ABE schemes with privacy preserving and expressive policy, but both of them do not support large attribute universe and exculpability of decryption. Then, the scheme in [1] provides features of multiauthority, large attribute universe, and high efficiency to resist key escrow problem, but it cannot satisfy policy preserving and verifiability with exculpability. Besides, such schemes do not consider the issue of exculpability as in some cases, and CSP acts honestly may be framed by users. Although the scheme in [14] fixed this problem, it fails to protect the user privacy in policies. Hence, it is urgent to devise a significant data sharing scheme that is addressing all these drawbacks in traditional CP-ABE schemes at the same time when used in MCC, including key escrow resistance, large attribute universe, privacy preserving, expressive policy, and efficiency.


### 1.1. Our Contributions

Confronting the above problems, we propose an Efficient and Multiauthority Large Universe Policy-Hiding Data Sharing (EMA-LUPHDS) scheme to achieve key escrow resistance, expressive access policies, and high efficiency for data sharing of MCC with resource-limited mobile devices by extending the decentralized CP-ABE scheme [15]. In particular, our main contributions are listed as follows:
(i)
Single-Point Failure and Key Escrow Free. To adapt to decentralized environment of the MCC system, EMA-LUPHDS introduces the architecture of multiple authority for user key distribution so as to prevent single-point failure and key escrow problem in a centralized single authority.(ii)
Hidden Access Policy over Large Attribute Universe. EMA-LUPHDS leverages fully hidden access policy to solve the user privacy leakage problem in most of current CP-ABE schemes with cleartext access policy shared with the ciphertexts in CSP which may lead to private information leakage. To be flexible in the setup of large-scale MCC systems, EMA-LUPHDS supports large attribute universe with constant size of system parameter.(iii)
Cost Saving in Encryption and Decryption. To save the computation cost in both encryption and decryption, online/offline technique is introduced into EMA-LUPHDS for efficient data encryption. Moreover, EMA-LUPHDS achieves outsourced decryption in order to improve efficiency by moving a majority of computation cost of mobile devices with poor resources to CSP.(iv)
Verifiability and Exculpability. To guarantee the correctness of outsourced decryption executed by CSP, EMA-LUPHDS can check the result of partially decrypted ciphertext transformed by untrusted CSP with a data verification approach. For the exculpability of CSP, it achieves a commitment mechanism using Pedersen commitment approach.(v)
Security and Efficiency. We present security analysis and performance evaluation of the proposed scheme. The result demonstrates that our proposal is secure and efficient, which is extremely practicable and suitable for MCC systems.


### 1.2. Organization

The remainder of the article is outlined below. Some relevant studies are reviewed in Section2, and the preliminaries including related definitions and notations are introduced in Section 3. In Section 4, we give the system model, threat model, and design goals of our scheme together with the system definition. Based on this, we describe in detail the constructions of the proposal in Section 5. Section 6 follows this to discuss the security of the scheme, and its performance evaluation is conducted in Section 7. Finally, Section 8 makes a conclusion for the work in this article.


## 1.1. Our Contributions

Confronting the above problems, we propose an Efficient and Multiauthority Large Universe Policy-Hiding Data Sharing (EMA-LUPHDS) scheme to achieve key escrow resistance, expressive access policies, and high efficiency for data sharing of MCC with resource-limited mobile devices by extending the decentralized CP-ABE scheme [15]. In particular, our main contributions are listed as follows:
(i)
Single-Point Failure and Key Escrow Free. To adapt to decentralized environment of the MCC system, EMA-LUPHDS introduces the architecture of multiple authority for user key distribution so as to prevent single-point failure and key escrow problem in a centralized single authority.(ii)
Hidden Access Policy over Large Attribute Universe. EMA-LUPHDS leverages fully hidden access policy to solve the user privacy leakage problem in most of current CP-ABE schemes with cleartext access policy shared with the ciphertexts in CSP which may lead to private information leakage. To be flexible in the setup of large-scale MCC systems, EMA-LUPHDS supports large attribute universe with constant size of system parameter.(iii)
Cost Saving in Encryption and Decryption. To save the computation cost in both encryption and decryption, online/offline technique is introduced into EMA-LUPHDS for efficient data encryption. Moreover, EMA-LUPHDS achieves outsourced decryption in order to improve efficiency by moving a majority of computation cost of mobile devices with poor resources to CSP.(iv)
Verifiability and Exculpability. To guarantee the correctness of outsourced decryption executed by CSP, EMA-LUPHDS can check the result of partially decrypted ciphertext transformed by untrusted CSP with a data verification approach. For the exculpability of CSP, it achieves a commitment mechanism using Pedersen commitment approach.(v)
Security and Efficiency. We present security analysis and performance evaluation of the proposed scheme. The result demonstrates that our proposal is secure and efficient, which is extremely practicable and suitable for MCC systems.


## 1.2. Organization

The remainder of the article is outlined below. Some relevant studies are reviewed in Section2, and the preliminaries including related definitions and notations are introduced in Section 3. In Section 4, we give the system model, threat model, and design goals of our scheme together with the system definition. Based on this, we describe in detail the constructions of the proposal in Section 5. Section 6 follows this to discuss the security of the scheme, and its performance evaluation is conducted in Section 7. Finally, Section 8 makes a conclusion for the work in this article.


## 2. Related Work

Mobile cloud computing (MCC) is widely utilized in various applications in which huge number of data plays an important role. Thus, how to protect the security of such large volume data is a big challenge for MCC [3]. CP-ABE is a promising technique for data confidentiality and fine-grained access control which is first introduced in [16] based on the scheme in [17] aside from the user authentication protocols [18–21] as user-centric access control. Due to the data-centric and flexible access control, CP-ABE has been broadly studied and applied [8, 9, 22–26]. However, MCC is a large scale and distributed system involving mobile and resource-limited user devices with much privacy in their data, and the standard CP-ABE schemes cannot be directly employed in MCC applications due to their high cost in computation and dependence on centralized authority.To confront the bottleneck of single authority, the study in [15] designed a scheme based on [27, 28] with fully multiauthority, but it is inefficient and cannot resist collusion attack. As a solution, borrowing the idea of outsourced decryption proposed in [29–33] based on [34], the scheme in [29] improved the decryption efficiency and the DACC in [35] utilized Key Distribution Centres (KDC) for user key generation across multiple groups to resist collusion attack. Later, the proposals in [30, 36] enhance the DACC scheme in addressing both user collusion and revocation problems. Recently, to solve the problem of deploying CP-ABE in MCC applications for data access control, the schemes in [2] proposed a solution based on [37] and outsourced decryption with anonymous techniques to achieve high decryption efficiency in distributed MCC systems, but it only improves efficiency in decryption and cannot support large attribute universe. Thus, motivated by online/offline CP-ABE proposed in [14, 38, 39] based on [40–42], De and Ruj [1] designed a multiauthority CP-ABE with outsourced decryption to achieve high efficiency in both encryption and decryption, whereas it fails to protect user privacy in access policy which is important for MCC applications containing massive private data.To protect user privacy in plaintext access policy of standard CP-ABE schemes, the research in [43] first presents the idea of partial hidden-policy CP-ABE, but it only supports AND gate policy with weak security. Later, the study in [44] devised a fully secure and partial hidden-policy CP-ABE, but it still suffers from restricted expressiveness in access policy. Then, the scheme in [45] improves its expressiveness, and the work in [46] introduces decryption testing and large universe to improve efficiency and flexibility, but it is computation consuming with composite order groups. To solve this problem, the studies in [47, 48] design two efficient and partial hidden-policy CP-ABE schemes based on prime order groups that support expressive access policy and verifiable outsourced decryption. However, they are weak in the protection of access policy due to their partially hidden policies. As a solution, the research in [49] proposed fully hidden policy for CP-ABE, but it incurs high computation cost. Then, the work in [50] proposed an efficient fully hidden-policy CP-ABE scheme, while it only supports restricted access policy. Recently, the studies in [6, 7] devise two efficient CP-ABE schemes that support fully hidden and expressive access policy, but both schemes do not overcome the efficiency issue in encryption and small attribute universe. Moreover, these schemes fail to support exculpability which guarantees an authorized user has no way to accuse the cloud of outputting incorrect results in outsourced decryption while it was not the case. As a whole, these schemes cannot be used in MCC applications.To seek a better solution, we propose EMA-LUPHDS for data access control in MCC applications. We make a function comparison in Table1 between our scheme and several related state-of-the-art schemes in [1, 2, 6, 7, 10, 12–14] in the functionalities of access policy, large attribute universe, multiauthority, hidden access policy, efficient encryption, efficient decryption, verifiability, and exculpability. This demonstrates that our EMA-LUPHDS is more versatile and flexible than other schemes with richer advantages and satisfies the requirements of data access control in MCC applications.Table 1
Function comparison.
SchemeAccess policyLarge universeMultiple authorityPolicy hiddenEfficient encryptionOutsourced decryptionStrong verifiabilityExculpabilityScheme in [12]AND gate××××√×√Scheme in [11]LSSS√√×××××Scheme in [13]AND gate×√√××××Scheme in [7]LSSS√√√×√××Scheme in [1]LSSS√√×√√××Scheme in [14]LSSS√××√√√√Scheme in [6]LSSS×√√×√××Scheme in [2]LSSS×√×√√××EMA-LUPHDSLSSS√√√√√√√In Table1, the schemes are compared from the features of access policy, attribute universe, authority, policy hidden, encryption, and decryption efficiency as well as verifiability and exculpability. First of all, from Table 1, we note that the majority of schemes support expressive LSSS access policy which are flexible and expressive in access policy design. Only two schemes in comparison support “AND” threshold access policy which are lack in expressiveness and flexibility. Moreover, from the aspect of attribute universe, the schemes in [1, 7, 10, 14] and ours all support large universe, while only our scheme and the schemes in [6, 7, 13] provide the features of multiple authorities and hidden policy, which can prevent sensitive information leakage from access policy and resist single authority failure. Furthermore, from the aspect of efficiency, it is well accepted to adopt outsourced encryption and decryption in CP-ABE schemes. And we conclude that most of the schemes in Table 1 support outsourced decryption and verifiability simultaneously, while only our scheme and the schemes in [1, 2, 14] also improve the efficiency in encryption by introducing online/offline technique. In addition, to support a strong verifiability and exculpability for outsourced decryption, we also note that the feature of exculpability is only supported by our scheme and those in [12, 14], while the scheme in [12] does not support expressive policy and the scheme in [14] failed to protect sensitive data in policy and is lack of large attribute universe. In general, our proposal can simultaneously support all the features mentioned above.


## 3. Preliminaries

This section provides several notions and definitions in our proposal including access structure and bilinear maps.


### 3.1. Notations

In our work,l1,l2 is used to denote the set l1,l1+1,⋯,l2 and n is the set 1,2,⋯,n, where n∈Zp∗, while ∣S∣ denotes the length of a string S.


### 3.2. Access Structure

Definition 1 (Access structures [8]).
LetE=E1,⋯,En be a entity collection. Given a set C⊆2E\∅, it is monotonic if ∀D,F:D⊆F⋂D∈C⟶F∈C. Then, the set C is also a monotonic access structure, and the subsets in C are called the authorized sets, otherwise the unauthorized sets.


### 3.3. Linear Secret Sharing Schemes (LSSSs)

Definition 2 (LSSS [25]).
Given the attribute universeUa, an LSSS on it involves B,δ, where B is an l×n share-generating matrix on Zp and the function δ maps a row of B into an attribute in Ua. There are two algorithms: Share and Reconstruction in an LSSS. The former is to create the shares for a secret value s based on B with b¯=s,b2,⋯,bnT, where b2,⋯,bn∈RZp by λx=Bx·b¯ as a share of the secret s, while the latter reconstructs s with the secret shares of an authorized set E by finding I=i∣δi∈E⊆1,2,⋯l and constances ωi∈Zp to make ∑i∈IwiBi=1,0,⋯,0 hold and compute ∑i∈Iwiλi=s.


### 3.4. Cryptographic Background

Definition 3 (Bilinear maps [9]).
Givenp-ordered cyclic groups G and GT with a generator w∈G, where p is a big prime, if a map e^:G×G⟶GT is bilinear, it must satisfy the following: (1) bilinearity: e^ue,hf=e^w,hef,∀e,f∈Zp,u,h∈G, (2) nondegeneracy: e^w,w≠1, and (3) computability: e^u,h which can be efficiently computed by an algorithm ∀u,h∈G.


## 3.1. Notations

In our work,l1,l2 is used to denote the set l1,l1+1,⋯,l2 and n is the set 1,2,⋯,n, where n∈Zp∗, while ∣S∣ denotes the length of a string S.


## 3.2. Access Structure

Definition 1 (Access structures [8]).
LetE=E1,⋯,En be a entity collection. Given a set C⊆2E\∅, it is monotonic if ∀D,F:D⊆F⋂D∈C⟶F∈C. Then, the set C is also a monotonic access structure, and the subsets in C are called the authorized sets, otherwise the unauthorized sets.


## 3.3. Linear Secret Sharing Schemes (LSSSs)

Definition 2 (LSSS [25]).
Given the attribute universeUa, an LSSS on it involves B,δ, where B is an l×n share-generating matrix on Zp and the function δ maps a row of B into an attribute in Ua. There are two algorithms: Share and Reconstruction in an LSSS. The former is to create the shares for a secret value s based on B with b¯=s,b2,⋯,bnT, where b2,⋯,bn∈RZp by λx=Bx·b¯ as a share of the secret s, while the latter reconstructs s with the secret shares of an authorized set E by finding I=i∣δi∈E⊆1,2,⋯l and constances ωi∈Zp to make ∑i∈IwiBi=1,0,⋯,0 hold and compute ∑i∈Iwiλi=s.


## 3.4. Cryptographic Background

Definition 3 (Bilinear maps [9]).
Givenp-ordered cyclic groups G and GT with a generator w∈G, where p is a big prime, if a map e^:G×G⟶GT is bilinear, it must satisfy the following: (1) bilinearity: e^ue,hf=e^w,hef,∀e,f∈Zp,u,h∈G, (2) nondegeneracy: e^w,w≠1, and (3) computability: e^u,h which can be efficiently computed by an algorithm ∀u,h∈G.


## 4. System Model and Design Goals

This section presents the system model, threat model, and design goals of our proposed system before giving the formal definition and security model for EMA-LUPHDS.


### 4.1. System Model

As detailed in Figure2, our system involves Cloud Service Provider (CSP), trusted authority (TA), attribute authorities (AAs), data owner (DO), and data user (DU).
(i)
CSP provides users with data outsourcing, sharing, and outsourced decryption services as well as unlimited storage and computational resources(ii)
TA is responsible for initiating whole system by generating global public parameters for the whole system and its master keys(iii)
AA takes charges of managing a disparate set of attributes and generating and distributing secret key and transformation key of the authenticated cloud users. The attribute sets managed by any two or more AAs are different from each other(iv)
DO collects important information from mobile devices in MCC and uploads the massive data to CSP. Before outsourcing, DO converts the data with symmetric algorithm and a symmetric key encrypted by a fully hidden access policy for fine-grained access control and user privacy preserving. Besides, DO prepares ciphertext components while accessing the power source offline to save computational resource of mobile devices(v)
DU accesses the shared data in CSP on demand with his transformation key for outsourced decryption and recovers the symmetric key if authorized to further decrypt the partially decrypted ciphertext from CSP after verifying its correctnessFigure 2
The system model of our EMA-LUPHDS.Based on the above system model, we design our data sharing scheme suitable for the MCC system involving four phases as below.(i)
Initialization. TA creates the system global public parameters and master key at the first. All entities can obtain the global public parameters with which each AA can generate their public and secret key pair.(ii)
User Enrollment. Each AA issues a secret key and a pair of transformation key for DUs after receiving the joining requests from these DUs. Each AA manages the enrolled DUs as well as their attribute sets.(iii)
Encryption. DO encrypts the data (usually in form of files) collected from the smart mobile devices in MCC systems based on a designated access policy and outsources the final ciphertext with fully hidden policies to CSP for data sharing.(iv)
Decryption. DU downloads ciphertexts from CSP with his transformation public key for outsourced decryption by CSP. After receiving the partially decrypted data, the DU decrypts it based on transformation private key and checks its correctness.


### 4.2. Threat Model and Design Goals

In our EMA-LUPHDS, TA, AA, and DO are trusted entities while CSP is deemed to be a semihonest entity which is willing to act with honesty but may leak the private information in an “honest-but-curious” manner. In supplying the outsourced decryption service, CSP may misbehave in returning the result of the partially decrypted ciphertext to DU, such as returning false results or be lazy to return previous results. DUs are regarded as untrusted as they may illegally access the shared data in CSP without authorization or try to break the data security and privacy. Due to these threats on data sharing in MCC, we have the following design goals for our system:(i)
Data Confidentiality. The proposed scheme should protect sensitive information in the outsourced data from being leaked or eavesdropped during data sharing and outsourced decryption in CSP and the communication between DU and CSP.(ii)
Fine-Grained Access Control and Collusion Resistance. Malicious users who are unauthorized or intend to collude with each other in data access should have no way to recover the ciphertext by aggregating their keys while anyone of them is unauthorized to decrypt the ciphertext alone.(iii)
Access Policy Hiding. On account of the access policy shared with ciphertext, those sensitive or privacy-aware information contained and exposed in access policies should be concealed for the purpose of user privacy preserving(iv)
Verifiability and Exculpability. Due to the misbehaving CSP, the correctness of outsourced decryption by CSP should be verified. Also, any DU with authorized secret key cannot accuse the CSP of performing incorrectly in outsourced decryption while it acts honestly.(v)
Efficient Encryption and Decryption. With respect of resource-limited mobile devices in the MCC system, the computation should be as little as possible for DU by moving a majority of preparation work offline and offloading the highly operations in decryption to CSP.


### 4.3. System Definition

We present the definition of our proposed EMA-LUPHDS scheme with the following algorithms:(i)
SetupGlobalλ. The global setup algorithm is executed by TA. On inputting the security parameter λ, it outputs the global public parameters pp and master key msk(ii)
SetupAApp. The authority setup algorithm is in the charge of each AA AAi managing a disparate set of attributes. It takes as input system global public parameters and outputs their public and secret key pair pkAAi,skAAi.(iii)
KeyGenpp,skAAi,GID,Si,GID. The key generation algorithm is executed by each attribute authority AAi. It takes as input system global public parameters pp, their secret key skAAi, the global identity GID, and an attribute set Si,GID of each cloud user. Then, AAi outputs ski,GID as the secret key associated with the DU identified by GID and their attribute set Si,GID.(iv)
TKeyGenpp,ski,GID. The transformation key generation algorithm is run by each attribute authority AAi. It takes the global public parameters pp and the secret key ski,GID of DU identified by GID and outputs the transformation key pair tk of the DU identified by GID.(v)
Encryptoffpp. The offline encryption algorithm is executed by DO. On inputting the system global public parameters pp, DO generates offline ciphertext component Keyoff and VCoff.(vi)
Encryptonpp,M,A,ρ. The online encryption algorithm is run by DO. On inputting the system global public parameters pp, the specific message M, and the designated access policy A,ρ, DO generates the final ciphertext CT and outsources it to CSP(vii)
DecryptOUTpp,tpki,GID,CT. The outsourced decryption algorithm is executed by CSP. It takes as input system global public parameters pp, transformation public key tpki,GID, and ciphertext CT and then outputs the partial decrypted ciphertext CT∗.(viii)
DecryptUpp,tski,GID,CT∗. The user decryption algorithm is run by DU. It takes the system global public parameters pp, transformation private key tski,GID, and partially decrypted ciphertext CT∗ as input and outputs the recovered ciphertext components R∗ and key∗.(ix)
DecVerifypp,C¯,Vm,key∗,R∗. The user decryption verification algorithm is executed by DU. Given the recovered random element R∗ and encapsulated key key∗, the DU checks if the session key and encrypted data are valid and output the plaintext M.


## 4.1. System Model

As detailed in Figure2, our system involves Cloud Service Provider (CSP), trusted authority (TA), attribute authorities (AAs), data owner (DO), and data user (DU).
(i)
CSP provides users with data outsourcing, sharing, and outsourced decryption services as well as unlimited storage and computational resources(ii)
TA is responsible for initiating whole system by generating global public parameters for the whole system and its master keys(iii)
AA takes charges of managing a disparate set of attributes and generating and distributing secret key and transformation key of the authenticated cloud users. The attribute sets managed by any two or more AAs are different from each other(iv)
DO collects important information from mobile devices in MCC and uploads the massive data to CSP. Before outsourcing, DO converts the data with symmetric algorithm and a symmetric key encrypted by a fully hidden access policy for fine-grained access control and user privacy preserving. Besides, DO prepares ciphertext components while accessing the power source offline to save computational resource of mobile devices(v)
DU accesses the shared data in CSP on demand with his transformation key for outsourced decryption and recovers the symmetric key if authorized to further decrypt the partially decrypted ciphertext from CSP after verifying its correctnessFigure 2
The system model of our EMA-LUPHDS.Based on the above system model, we design our data sharing scheme suitable for the MCC system involving four phases as below.(i)
Initialization. TA creates the system global public parameters and master key at the first. All entities can obtain the global public parameters with which each AA can generate their public and secret key pair.(ii)
User Enrollment. Each AA issues a secret key and a pair of transformation key for DUs after receiving the joining requests from these DUs. Each AA manages the enrolled DUs as well as their attribute sets.(iii)
Encryption. DO encrypts the data (usually in form of files) collected from the smart mobile devices in MCC systems based on a designated access policy and outsources the final ciphertext with fully hidden policies to CSP for data sharing.(iv)
Decryption. DU downloads ciphertexts from CSP with his transformation public key for outsourced decryption by CSP. After receiving the partially decrypted data, the DU decrypts it based on transformation private key and checks its correctness.


## 4.2. Threat Model and Design Goals

In our EMA-LUPHDS, TA, AA, and DO are trusted entities while CSP is deemed to be a semihonest entity which is willing to act with honesty but may leak the private information in an “honest-but-curious” manner. In supplying the outsourced decryption service, CSP may misbehave in returning the result of the partially decrypted ciphertext to DU, such as returning false results or be lazy to return previous results. DUs are regarded as untrusted as they may illegally access the shared data in CSP without authorization or try to break the data security and privacy. Due to these threats on data sharing in MCC, we have the following design goals for our system:(i)
Data Confidentiality. The proposed scheme should protect sensitive information in the outsourced data from being leaked or eavesdropped during data sharing and outsourced decryption in CSP and the communication between DU and CSP.(ii)
Fine-Grained Access Control and Collusion Resistance. Malicious users who are unauthorized or intend to collude with each other in data access should have no way to recover the ciphertext by aggregating their keys while anyone of them is unauthorized to decrypt the ciphertext alone.(iii)
Access Policy Hiding. On account of the access policy shared with ciphertext, those sensitive or privacy-aware information contained and exposed in access policies should be concealed for the purpose of user privacy preserving(iv)
Verifiability and Exculpability. Due to the misbehaving CSP, the correctness of outsourced decryption by CSP should be verified. Also, any DU with authorized secret key cannot accuse the CSP of performing incorrectly in outsourced decryption while it acts honestly.(v)
Efficient Encryption and Decryption. With respect of resource-limited mobile devices in the MCC system, the computation should be as little as possible for DU by moving a majority of preparation work offline and offloading the highly operations in decryption to CSP.


## 4.3. System Definition

We present the definition of our proposed EMA-LUPHDS scheme with the following algorithms:(i)
SetupGlobalλ. The global setup algorithm is executed by TA. On inputting the security parameter λ, it outputs the global public parameters pp and master key msk(ii)
SetupAApp. The authority setup algorithm is in the charge of each AA AAi managing a disparate set of attributes. It takes as input system global public parameters and outputs their public and secret key pair pkAAi,skAAi.(iii)
KeyGenpp,skAAi,GID,Si,GID. The key generation algorithm is executed by each attribute authority AAi. It takes as input system global public parameters pp, their secret key skAAi, the global identity GID, and an attribute set Si,GID of each cloud user. Then, AAi outputs ski,GID as the secret key associated with the DU identified by GID and their attribute set Si,GID.(iv)
TKeyGenpp,ski,GID. The transformation key generation algorithm is run by each attribute authority AAi. It takes the global public parameters pp and the secret key ski,GID of DU identified by GID and outputs the transformation key pair tk of the DU identified by GID.(v)
Encryptoffpp. The offline encryption algorithm is executed by DO. On inputting the system global public parameters pp, DO generates offline ciphertext component Keyoff and VCoff.(vi)
Encryptonpp,M,A,ρ. The online encryption algorithm is run by DO. On inputting the system global public parameters pp, the specific message M, and the designated access policy A,ρ, DO generates the final ciphertext CT and outsources it to CSP(vii)
DecryptOUTpp,tpki,GID,CT. The outsourced decryption algorithm is executed by CSP. It takes as input system global public parameters pp, transformation public key tpki,GID, and ciphertext CT and then outputs the partial decrypted ciphertext CT∗.(viii)
DecryptUpp,tski,GID,CT∗. The user decryption algorithm is run by DU. It takes the system global public parameters pp, transformation private key tski,GID, and partially decrypted ciphertext CT∗ as input and outputs the recovered ciphertext components R∗ and key∗.(ix)
DecVerifypp,C¯,Vm,key∗,R∗. The user decryption verification algorithm is executed by DU. Given the recovered random element R∗ and encapsulated key key∗, the DU checks if the session key and encrypted data are valid and output the plaintext M.


## 5. The Proposed EMA-LUPHDS Scheme

In this section, we describe the overview of our EMA-LUPHDS scheme and its concrete construction.


### 5.1. Overview

To adapt to the large-scale MCC system, we first design a large universe multiauthority hidden-policy CP-ABE scheme with verifiable and exculpable outsourced decryption to realize efficient data sharing in MCC. Each user in such a distributed architecture is bound up with a global identity (GID) [51] to avoid collision. Moreover, we introduce online/offline technique to further reduce the overhead in data encryption. Before displaying the detailed construction of EMA-LUPHDS scheme, we define that in our EMA-LUPHDS, Ua is the attribute universe which contains arbitrary string, UA is the authority universe with N different AAs and a public function F:Ua⟶UA, which maps each attribute j∈Ua to a specific authority AAi∈UA, denoting that the attribute j is managed by authority AAi, and IAA is the index of relevant authorities of a user. For simplicity, here we introduce another symbol δj=Fj,j∈Ua.


### 5.2. Construction of EMA-LUPHDS

Here, the detail of each phase and corresponding algorithms in the formal definition of our proposal are given.


#### 5.2.1. Initialization Phase

In this phase, TA generates system global public parameters and master key and each AA generates their public and secret key pair by the following steps.(i)
SetupGlobalλ. Given the security parameter λ, TA generates groups G and GT of prime order p with a bilinear map e^:G×G⟶GT. Then, it chooses random generators g,g1,g2∈G and four collision-resistant hash functions H:0,1∗⟶Zp∗,H0:Ua⟶G,H1:0,1∗⟶G,H2:GT⟶0,1n1,H3:0,1∗⟶0,1n2, where M is the message universe and n1 and n2 are output sizes of H2 and H3 hash functions, respectively. Next, TA creates a L-length key derivation function (KDF) K, where L=∣key∣+∣p∣ and set the global public parameters as follows:(1)pp=G,GT,H,H0,H1,H2,H3,F,K,L,e^,g,g1,g2.Finally, TA publishes the global public parameterspp.
(ii)
SetupAApp. Each AA AAi manages a set of attributes SAAi. As to each attribute authority AAi, it chooses two random number yi,αi,βi,ti∈Zp∗ for itself. Thus, each attribute authority AAi generates its key pair as follows:(2)skAAi=yi,αi,βi,ti,pkAAi=gyi,gαi,gβi.Finally, the attribute authorityAAi outputs their public and secret key pair pkAAi,skAAi.


#### 5.2.2. User Enrollment Phase

Upon receiving the enrollment request from DU with their global identities and attribute sets, attribute authorities generate a secret key and a transformation key pair for DU based on the following algorithms.(i)
KeyGenpp,skAAi,GID,Si,GID. If a DU has a global identity GID and a set of attributes Si,GID which is related to an attribute authority AAi, the AAi chooses a random number t∈Zp∗ and computes the secret key ski,GID for the DU as follows:(3)ski,GID=K1,j,K2,j,K3j∈Si,GID=gαiH1GIDyiH0jβi,H0jti,gβij∈Si,GID.Finally, the attribute authorityAAi outputs ski,GID and sends it to the DU identified by GID through secure channel.
(ii)
TKeyGenpp,ski,GID. The authority AAi generates transformation key for DU identified by GID on giving the DU’s secret key ski,GID. We assume that as for each attribute j∈Si,GID, if Fj=i, the attribute set Si,GID of DU with GID is managed by AAi. The authority AAi chooses a random number μ∈Zp∗ and computes the transformation key tk=tpk,tsk as follows:(4)tpki,GID=TK1,j,TK2,j,TK3,TK4,TK5j∈Si,GID=K1,j1/μ,K2,j1/μ,K31/μ,g1/μ,H1GID1/μj∈Si,GID=gαi/μH1GIDyi/μH0jβi/μ,H0jti/μ,gβi/μ,g1/μ,H1GID1/μj∈Si,GIDtski,GID=μ.Finally,AAi outputs transformation key tk=tpk,tsk for DU with identity GID.


#### 5.2.3. Encryption Phase

On input globally public parameterspp and public key of AAi, the encryption process contains the following three steps:
(i)
Encryptoffpp. DO selects a random secret s∈RZp to compute the encapsulated key key. Then, the DO generates the corresponding session key ssk for data encryption/decryption and the commitment C¯ (e.g., Pedersen commitment algorithm) for key verification. The algorithm is executed as follows:(5)key=∏i∈IAAe^g,gαis=e^g,g∑i∈IAAαis,KDFkey,L=sskd,C¯=g1Hsskg2Hd.As a result, the DO setsKeyoff=s,key,ssk,C¯ and creates a pool of offline keys. Next, the DO picks a random element R∈GT and computes R′=H2R. Finally, the DO sets VCoff=R,R′ and constructs a pool of offline verification code.
(ii)
APTransform. To achieve access policy anonymity, the DO first designates an original access policy Ao,ρ, where Ao is a l×n matrix and ρ is a function that maps each row of Ao to an attribute. Then, the DO selects a random value a∈Zp∗ and computes mx=e^gtia,H0ρx, where x∈l is each row of access policy Ao,ρ and l is the number of rows in Ao. To preserve the privacy of access policy, the data owner replaces each attribute ρx in Ao with mx, and then, the original access policy Ao,ρ can be transformed to LSSS access policy matrix Al×n,ρ which can be denoted by A,ρ for simplicity.(iii)
Encryptonpp,M,A,ρ. DO chooses any one pair of offline components Keyoff=s,key,ssk,C¯ and VCoff=R,R′ to encrypt the data M gathered from smart devices to generate encryped data CTs=EsymmM,ssk with the symmetric encyption algorithm and the symmetric key ssk and compute the verification code Vm=H3R′CTs for CTs. With the specific access policy A,ρ, where A is a l×n matrix and ρ is a mapping from each row Ax to a certain attribute attx, DO picks px∈RZp∗ for each row Ax of A and computes λx=Ax·γ, where γ=s,γ2,⋯,γl∈RZpl and θx=Ax·ν, where ν=0,ν2,⋯,νl∈RZpl. Next, DO outputs ciphertext CT=A,ρ,C¯,CTs,Vm,C′,C0,C1,x,C2,x,C3,x,C4,xx∈l, where(6)C′=ga,C0=R·key,C1,x=gαδxλxgαδxpx,C2,x=gpx,C3,x=H0ρxpx,C4,x=gyδxpxgθx.Finally, the DO uploads the ciphertextCT to CSP.


#### 5.2.4. Decryption Phase

After DU requesting for specific dataCT with his transformation public key (tpk), the CSP executes outsourced access policy recovery operations and sends back the intermediate anonymous attributes to the DU. Then, the CSP executes outsourced decryption with the recovered index of access policy received from the DU. Next, with the partially decrypted ciphertext from CSP, the DU can get decrypted plaintext at the end. Finally, with verification execution, the DU can verify whether the ciphertext and session key is valid. The phase involves the following algorithms:
(i)
APRecover. First of all, the CSP computes mx′=e^C′,H0ρxti/μ, where x∈Si,GID with the DU’s tpk and sends the mx′ together with access policy of CT, i.e., A,ρ, to the DU. Then, the DU replaces the attribute x with mx′tsk, and the result attribute set Si,GID′ is constructed, and the attribute index set is Is′=x:ρx⋂SGID′x∈l. Then, the DU sends Is′ to CSP for outsourced decryption.(ii)
DecryptOUTpp,tpki,GID,CT. Let each matrix row Ax of access policy A,ρ correspond to an attribute ρx, and CSP executes as follows:(7)Cδx∗=e^TK4,C1,xe^TK5,C4,xe^TK3,C3,xe^TK1,x,C2,x=e^g1/μ,C1,xe^H1GID1/μ,C4,xe^gαδx/μH1GIDyδx/μH0ρxβδx/μ,C2,x·e^gβδx/μ,H0ρxpxe^gαδx/μH1GIDyδx/μH0ρxβδx/μ,C2,x=e∧g,gαδxλxe∧H1GID,gθx1/μ.Then, as mentioned before,λx=Ax·γ, where γ=r,γ2,⋯,γl∈Zpl and θx=Ax·ν, where ν=0,ν2,⋯,νl∈Zpl, we note that there exists coefficients ωx∈Zp where x∈Is′ such that ∑x∈Is′ωxAx=1,0,⋯,0. Thus, we have ∑x∈Is′ωxλx=s and ∑x∈Is′ωxθx=0.Subsequently, the DU can computes∏x∈Is′C∗ωx, so that,
(8)CTδx′=∏x∈Is′Cδx∗ωx=∏x∈Is′e∧g,gαδxωxλxe∧H1GID,gωxθx1/μ=e∧g,gαδx∑x∈Is′ωxλx1/μ⋅e∧H1GID,g∑x∈Is′ωxθx1/μ=e^g,gαδxs/μ.Leti=δx, and we have the following equation:
(9)CT′=∏i∈IAACTi′=∏i∈IAAe^g,gαis/μ=e^g,g∑i∈IAAαis/μ.Finally, the CSP returns partially decrypted ciphertextCT∗=C0,C¯,CT′,CTs,Vm to the DU.
(i)
DecryptUpp,tski,GID,CT∗. After receiving the partially decrypted ciphertext CT∗, the DU recovers the random element R and the encapsulated key key used for generating symmetric session key as follows:(10)key∗=CT′tsk=e∧g,g∑i∈IAAαis/μμ=e^g,g∑i∈IAAαis,R∗=C0key∗=R·e^g,g∑i∈IAAαise^g,g∑i∈IAAαis.Finally, DU outputs the recovered random elementR∗ and encapsulated key key∗.
(ii)
DecVerifypp,C¯,Vm,key∗,R∗. On input recovered encapsulated key key∗ and random element R∗, the DU computes as follows:(11)KDFkey∗,L=ssk∗d∗,C¯∗=g1Hssk∗g2Hd∗,R∗¯=H2R∗,Vm∗=H3R∗¯CTs.Then, the DU checks if the following equations(12)C¯=?C¯∗,Vm=?Vm∗.hold, and it outputs M=DsymmCTs,ssk∗, otherwise ⊥.


## 5.1. Overview

To adapt to the large-scale MCC system, we first design a large universe multiauthority hidden-policy CP-ABE scheme with verifiable and exculpable outsourced decryption to realize efficient data sharing in MCC. Each user in such a distributed architecture is bound up with a global identity (GID) [51] to avoid collision. Moreover, we introduce online/offline technique to further reduce the overhead in data encryption. Before displaying the detailed construction of EMA-LUPHDS scheme, we define that in our EMA-LUPHDS, Ua is the attribute universe which contains arbitrary string, UA is the authority universe with N different AAs and a public function F:Ua⟶UA, which maps each attribute j∈Ua to a specific authority AAi∈UA, denoting that the attribute j is managed by authority AAi, and IAA is the index of relevant authorities of a user. For simplicity, here we introduce another symbol δj=Fj,j∈Ua.


## 5.2. Construction of EMA-LUPHDS

Here, the detail of each phase and corresponding algorithms in the formal definition of our proposal are given.


### 5.2.1. Initialization Phase

In this phase, TA generates system global public parameters and master key and each AA generates their public and secret key pair by the following steps.(i)
SetupGlobalλ. Given the security parameter λ, TA generates groups G and GT of prime order p with a bilinear map e^:G×G⟶GT. Then, it chooses random generators g,g1,g2∈G and four collision-resistant hash functions H:0,1∗⟶Zp∗,H0:Ua⟶G,H1:0,1∗⟶G,H2:GT⟶0,1n1,H3:0,1∗⟶0,1n2, where M is the message universe and n1 and n2 are output sizes of H2 and H3 hash functions, respectively. Next, TA creates a L-length key derivation function (KDF) K, where L=∣key∣+∣p∣ and set the global public parameters as follows:(1)pp=G,GT,H,H0,H1,H2,H3,F,K,L,e^,g,g1,g2.Finally, TA publishes the global public parameterspp.
(ii)
SetupAApp. Each AA AAi manages a set of attributes SAAi. As to each attribute authority AAi, it chooses two random number yi,αi,βi,ti∈Zp∗ for itself. Thus, each attribute authority AAi generates its key pair as follows:(2)skAAi=yi,αi,βi,ti,pkAAi=gyi,gαi,gβi.Finally, the attribute authorityAAi outputs their public and secret key pair pkAAi,skAAi.


### 5.2.2. User Enrollment Phase

Upon receiving the enrollment request from DU with their global identities and attribute sets, attribute authorities generate a secret key and a transformation key pair for DU based on the following algorithms.(i)
KeyGenpp,skAAi,GID,Si,GID. If a DU has a global identity GID and a set of attributes Si,GID which is related to an attribute authority AAi, the AAi chooses a random number t∈Zp∗ and computes the secret key ski,GID for the DU as follows:(3)ski,GID=K1,j,K2,j,K3j∈Si,GID=gαiH1GIDyiH0jβi,H0jti,gβij∈Si,GID.Finally, the attribute authorityAAi outputs ski,GID and sends it to the DU identified by GID through secure channel.
(ii)
TKeyGenpp,ski,GID. The authority AAi generates transformation key for DU identified by GID on giving the DU’s secret key ski,GID. We assume that as for each attribute j∈Si,GID, if Fj=i, the attribute set Si,GID of DU with GID is managed by AAi. The authority AAi chooses a random number μ∈Zp∗ and computes the transformation key tk=tpk,tsk as follows:(4)tpki,GID=TK1,j,TK2,j,TK3,TK4,TK5j∈Si,GID=K1,j1/μ,K2,j1/μ,K31/μ,g1/μ,H1GID1/μj∈Si,GID=gαi/μH1GIDyi/μH0jβi/μ,H0jti/μ,gβi/μ,g1/μ,H1GID1/μj∈Si,GIDtski,GID=μ.Finally,AAi outputs transformation key tk=tpk,tsk for DU with identity GID.


### 5.2.3. Encryption Phase

On input globally public parameterspp and public key of AAi, the encryption process contains the following three steps:
(i)
Encryptoffpp. DO selects a random secret s∈RZp to compute the encapsulated key key. Then, the DO generates the corresponding session key ssk for data encryption/decryption and the commitment C¯ (e.g., Pedersen commitment algorithm) for key verification. The algorithm is executed as follows:(5)key=∏i∈IAAe^g,gαis=e^g,g∑i∈IAAαis,KDFkey,L=sskd,C¯=g1Hsskg2Hd.As a result, the DO setsKeyoff=s,key,ssk,C¯ and creates a pool of offline keys. Next, the DO picks a random element R∈GT and computes R′=H2R. Finally, the DO sets VCoff=R,R′ and constructs a pool of offline verification code.
(ii)
APTransform. To achieve access policy anonymity, the DO first designates an original access policy Ao,ρ, where Ao is a l×n matrix and ρ is a function that maps each row of Ao to an attribute. Then, the DO selects a random value a∈Zp∗ and computes mx=e^gtia,H0ρx, where x∈l is each row of access policy Ao,ρ and l is the number of rows in Ao. To preserve the privacy of access policy, the data owner replaces each attribute ρx in Ao with mx, and then, the original access policy Ao,ρ can be transformed to LSSS access policy matrix Al×n,ρ which can be denoted by A,ρ for simplicity.(iii)
Encryptonpp,M,A,ρ. DO chooses any one pair of offline components Keyoff=s,key,ssk,C¯ and VCoff=R,R′ to encrypt the data M gathered from smart devices to generate encryped data CTs=EsymmM,ssk with the symmetric encyption algorithm and the symmetric key ssk and compute the verification code Vm=H3R′CTs for CTs. With the specific access policy A,ρ, where A is a l×n matrix and ρ is a mapping from each row Ax to a certain attribute attx, DO picks px∈RZp∗ for each row Ax of A and computes λx=Ax·γ, where γ=s,γ2,⋯,γl∈RZpl and θx=Ax·ν, where ν=0,ν2,⋯,νl∈RZpl. Next, DO outputs ciphertext CT=A,ρ,C¯,CTs,Vm,C′,C0,C1,x,C2,x,C3,x,C4,xx∈l, where(6)C′=ga,C0=R·key,C1,x=gαδxλxgαδxpx,C2,x=gpx,C3,x=H0ρxpx,C4,x=gyδxpxgθx.Finally, the DO uploads the ciphertextCT to CSP.


### 5.2.4. Decryption Phase

After DU requesting for specific dataCT with his transformation public key (tpk), the CSP executes outsourced access policy recovery operations and sends back the intermediate anonymous attributes to the DU. Then, the CSP executes outsourced decryption with the recovered index of access policy received from the DU. Next, with the partially decrypted ciphertext from CSP, the DU can get decrypted plaintext at the end. Finally, with verification execution, the DU can verify whether the ciphertext and session key is valid. The phase involves the following algorithms:
(i)
APRecover. First of all, the CSP computes mx′=e^C′,H0ρxti/μ, where x∈Si,GID with the DU’s tpk and sends the mx′ together with access policy of CT, i.e., A,ρ, to the DU. Then, the DU replaces the attribute x with mx′tsk, and the result attribute set Si,GID′ is constructed, and the attribute index set is Is′=x:ρx⋂SGID′x∈l. Then, the DU sends Is′ to CSP for outsourced decryption.(ii)
DecryptOUTpp,tpki,GID,CT. Let each matrix row Ax of access policy A,ρ correspond to an attribute ρx, and CSP executes as follows:(7)Cδx∗=e^TK4,C1,xe^TK5,C4,xe^TK3,C3,xe^TK1,x,C2,x=e^g1/μ,C1,xe^H1GID1/μ,C4,xe^gαδx/μH1GIDyδx/μH0ρxβδx/μ,C2,x·e^gβδx/μ,H0ρxpxe^gαδx/μH1GIDyδx/μH0ρxβδx/μ,C2,x=e∧g,gαδxλxe∧H1GID,gθx1/μ.Then, as mentioned before,λx=Ax·γ, where γ=r,γ2,⋯,γl∈Zpl and θx=Ax·ν, where ν=0,ν2,⋯,νl∈Zpl, we note that there exists coefficients ωx∈Zp where x∈Is′ such that ∑x∈Is′ωxAx=1,0,⋯,0. Thus, we have ∑x∈Is′ωxλx=s and ∑x∈Is′ωxθx=0.Subsequently, the DU can computes∏x∈Is′C∗ωx, so that,
(8)CTδx′=∏x∈Is′Cδx∗ωx=∏x∈Is′e∧g,gαδxωxλxe∧H1GID,gωxθx1/μ=e∧g,gαδx∑x∈Is′ωxλx1/μ⋅e∧H1GID,g∑x∈Is′ωxθx1/μ=e^g,gαδxs/μ.Leti=δx, and we have the following equation:
(9)CT′=∏i∈IAACTi′=∏i∈IAAe^g,gαis/μ=e^g,g∑i∈IAAαis/μ.Finally, the CSP returns partially decrypted ciphertextCT∗=C0,C¯,CT′,CTs,Vm to the DU.
(i)
DecryptUpp,tski,GID,CT∗. After receiving the partially decrypted ciphertext CT∗, the DU recovers the random element R and the encapsulated key key used for generating symmetric session key as follows:(10)key∗=CT′tsk=e∧g,g∑i∈IAAαis/μμ=e^g,g∑i∈IAAαis,R∗=C0key∗=R·e^g,g∑i∈IAAαise^g,g∑i∈IAAαis.Finally, DU outputs the recovered random elementR∗ and encapsulated key key∗.
(ii)
DecVerifypp,C¯,Vm,key∗,R∗. On input recovered encapsulated key key∗ and random element R∗, the DU computes as follows:(11)KDFkey∗,L=ssk∗d∗,C¯∗=g1Hssk∗g2Hd∗,R∗¯=H2R∗,Vm∗=H3R∗¯CTs.Then, the DU checks if the following equations(12)C¯=?C¯∗,Vm=?Vm∗.hold, and it outputs M=DsymmCTs,ssk∗, otherwise ⊥.


## 5.2.1. Initialization Phase

In this phase, TA generates system global public parameters and master key and each AA generates their public and secret key pair by the following steps.(i)
SetupGlobalλ. Given the security parameter λ, TA generates groups G and GT of prime order p with a bilinear map e^:G×G⟶GT. Then, it chooses random generators g,g1,g2∈G and four collision-resistant hash functions H:0,1∗⟶Zp∗,H0:Ua⟶G,H1:0,1∗⟶G,H2:GT⟶0,1n1,H3:0,1∗⟶0,1n2, where M is the message universe and n1 and n2 are output sizes of H2 and H3 hash functions, respectively. Next, TA creates a L-length key derivation function (KDF) K, where L=∣key∣+∣p∣ and set the global public parameters as follows:(1)pp=G,GT,H,H0,H1,H2,H3,F,K,L,e^,g,g1,g2.Finally, TA publishes the global public parameterspp.
(ii)
SetupAApp. Each AA AAi manages a set of attributes SAAi. As to each attribute authority AAi, it chooses two random number yi,αi,βi,ti∈Zp∗ for itself. Thus, each attribute authority AAi generates its key pair as follows:(2)skAAi=yi,αi,βi,ti,pkAAi=gyi,gαi,gβi.Finally, the attribute authorityAAi outputs their public and secret key pair pkAAi,skAAi.


## 5.2.2. User Enrollment Phase

Upon receiving the enrollment request from DU with their global identities and attribute sets, attribute authorities generate a secret key and a transformation key pair for DU based on the following algorithms.(i)
KeyGenpp,skAAi,GID,Si,GID. If a DU has a global identity GID and a set of attributes Si,GID which is related to an attribute authority AAi, the AAi chooses a random number t∈Zp∗ and computes the secret key ski,GID for the DU as follows:(3)ski,GID=K1,j,K2,j,K3j∈Si,GID=gαiH1GIDyiH0jβi,H0jti,gβij∈Si,GID.Finally, the attribute authorityAAi outputs ski,GID and sends it to the DU identified by GID through secure channel.
(ii)
TKeyGenpp,ski,GID. The authority AAi generates transformation key for DU identified by GID on giving the DU’s secret key ski,GID. We assume that as for each attribute j∈Si,GID, if Fj=i, the attribute set Si,GID of DU with GID is managed by AAi. The authority AAi chooses a random number μ∈Zp∗ and computes the transformation key tk=tpk,tsk as follows:(4)tpki,GID=TK1,j,TK2,j,TK3,TK4,TK5j∈Si,GID=K1,j1/μ,K2,j1/μ,K31/μ,g1/μ,H1GID1/μj∈Si,GID=gαi/μH1GIDyi/μH0jβi/μ,H0jti/μ,gβi/μ,g1/μ,H1GID1/μj∈Si,GIDtski,GID=μ.Finally,AAi outputs transformation key tk=tpk,tsk for DU with identity GID.


## 5.2.3. Encryption Phase

On input globally public parameterspp and public key of AAi, the encryption process contains the following three steps:
(i)
Encryptoffpp. DO selects a random secret s∈RZp to compute the encapsulated key key. Then, the DO generates the corresponding session key ssk for data encryption/decryption and the commitment C¯ (e.g., Pedersen commitment algorithm) for key verification. The algorithm is executed as follows:(5)key=∏i∈IAAe^g,gαis=e^g,g∑i∈IAAαis,KDFkey,L=sskd,C¯=g1Hsskg2Hd.As a result, the DO setsKeyoff=s,key,ssk,C¯ and creates a pool of offline keys. Next, the DO picks a random element R∈GT and computes R′=H2R. Finally, the DO sets VCoff=R,R′ and constructs a pool of offline verification code.
(ii)
APTransform. To achieve access policy anonymity, the DO first designates an original access policy Ao,ρ, where Ao is a l×n matrix and ρ is a function that maps each row of Ao to an attribute. Then, the DO selects a random value a∈Zp∗ and computes mx=e^gtia,H0ρx, where x∈l is each row of access policy Ao,ρ and l is the number of rows in Ao. To preserve the privacy of access policy, the data owner replaces each attribute ρx in Ao with mx, and then, the original access policy Ao,ρ can be transformed to LSSS access policy matrix Al×n,ρ which can be denoted by A,ρ for simplicity.(iii)
Encryptonpp,M,A,ρ. DO chooses any one pair of offline components Keyoff=s,key,ssk,C¯ and VCoff=R,R′ to encrypt the data M gathered from smart devices to generate encryped data CTs=EsymmM,ssk with the symmetric encyption algorithm and the symmetric key ssk and compute the verification code Vm=H3R′CTs for CTs. With the specific access policy A,ρ, where A is a l×n matrix and ρ is a mapping from each row Ax to a certain attribute attx, DO picks px∈RZp∗ for each row Ax of A and computes λx=Ax·γ, where γ=s,γ2,⋯,γl∈RZpl and θx=Ax·ν, where ν=0,ν2,⋯,νl∈RZpl. Next, DO outputs ciphertext CT=A,ρ,C¯,CTs,Vm,C′,C0,C1,x,C2,x,C3,x,C4,xx∈l, where(6)C′=ga,C0=R·key,C1,x=gαδxλxgαδxpx,C2,x=gpx,C3,x=H0ρxpx,C4,x=gyδxpxgθx.Finally, the DO uploads the ciphertextCT to CSP.


## 5.2.4. Decryption Phase

After DU requesting for specific dataCT with his transformation public key (tpk), the CSP executes outsourced access policy recovery operations and sends back the intermediate anonymous attributes to the DU. Then, the CSP executes outsourced decryption with the recovered index of access policy received from the DU. Next, with the partially decrypted ciphertext from CSP, the DU can get decrypted plaintext at the end. Finally, with verification execution, the DU can verify whether the ciphertext and session key is valid. The phase involves the following algorithms:
(i)
APRecover. First of all, the CSP computes mx′=e^C′,H0ρxti/μ, where x∈Si,GID with the DU’s tpk and sends the mx′ together with access policy of CT, i.e., A,ρ, to the DU. Then, the DU replaces the attribute x with mx′tsk, and the result attribute set Si,GID′ is constructed, and the attribute index set is Is′=x:ρx⋂SGID′x∈l. Then, the DU sends Is′ to CSP for outsourced decryption.(ii)
DecryptOUTpp,tpki,GID,CT. Let each matrix row Ax of access policy A,ρ correspond to an attribute ρx, and CSP executes as follows:(7)Cδx∗=e^TK4,C1,xe^TK5,C4,xe^TK3,C3,xe^TK1,x,C2,x=e^g1/μ,C1,xe^H1GID1/μ,C4,xe^gαδx/μH1GIDyδx/μH0ρxβδx/μ,C2,x·e^gβδx/μ,H0ρxpxe^gαδx/μH1GIDyδx/μH0ρxβδx/μ,C2,x=e∧g,gαδxλxe∧H1GID,gθx1/μ.Then, as mentioned before,λx=Ax·γ, where γ=r,γ2,⋯,γl∈Zpl and θx=Ax·ν, where ν=0,ν2,⋯,νl∈Zpl, we note that there exists coefficients ωx∈Zp where x∈Is′ such that ∑x∈Is′ωxAx=1,0,⋯,0. Thus, we have ∑x∈Is′ωxλx=s and ∑x∈Is′ωxθx=0.Subsequently, the DU can computes∏x∈Is′C∗ωx, so that,
(8)CTδx′=∏x∈Is′Cδx∗ωx=∏x∈Is′e∧g,gαδxωxλxe∧H1GID,gωxθx1/μ=e∧g,gαδx∑x∈Is′ωxλx1/μ⋅e∧H1GID,g∑x∈Is′ωxθx1/μ=e^g,gαδxs/μ.Leti=δx, and we have the following equation:
(9)CT′=∏i∈IAACTi′=∏i∈IAAe^g,gαis/μ=e^g,g∑i∈IAAαis/μ.Finally, the CSP returns partially decrypted ciphertextCT∗=C0,C¯,CT′,CTs,Vm to the DU.
(i)
DecryptUpp,tski,GID,CT∗. After receiving the partially decrypted ciphertext CT∗, the DU recovers the random element R and the encapsulated key key used for generating symmetric session key as follows:(10)key∗=CT′tsk=e∧g,g∑i∈IAAαis/μμ=e^g,g∑i∈IAAαis,R∗=C0key∗=R·e^g,g∑i∈IAAαise^g,g∑i∈IAAαis.Finally, DU outputs the recovered random elementR∗ and encapsulated key key∗.
(ii)
DecVerifypp,C¯,Vm,key∗,R∗. On input recovered encapsulated key key∗ and random element R∗, the DU computes as follows:(11)KDFkey∗,L=ssk∗d∗,C¯∗=g1Hssk∗g2Hd∗,R∗¯=H2R∗,Vm∗=H3R∗¯CTs.Then, the DU checks if the following equations(12)C¯=?C¯∗,Vm=?Vm∗.hold, and it outputs M=DsymmCTs,ssk∗, otherwise ⊥.


## 6. Security Analysis

In this section, we present a brief security analysis of our proposed EMA-LUPHDS scheme concerning the design goals mentioned in Section4.2.Theorem 1.
The proposed scheme satisfies the properties of correctness.Proof.
We can prove the correctness of outsourced decryption in our scheme by the following equation:(13)CTδx′=∏x=1lCδx∗ωx=∏x=1le^TK4,C1,xe^TK5,C4,xe^TK3,C3,xe^TK1,x,C2,x=∏x=1le∧g1/μ,C1,xe∧H1GID1/μ,C4,xe∧gβδx/μH1GIDyδx/μH0ρxβδx/μ,C2,x⋅e∧gβδx/μ,H0ρxpxe∧gαδx/μH1GIDyδx/μH0ρxβδx/μ,C2,xωx=∏x=1le∧g1/μ,gαδxλxgαδxpxe∧gαδx/μH1GIDyδx/μH0ρxβδx/μ,gpx⋅e∧H1GID1/μ,gyδxpxgθxe∧gαδx/μH1GIDyδx/μH0ρxβδx/μ,gpx⋅e∧gβδx/μ,H0ρxpxe∧gαδx/μH1GIDyδx/μH0ρxβδx/μ,gpxωx=∏x=1le∧g,gαδxλxe∧H1GID,gθxωx/μ=∏x=1le∧g,gαδxωxλxe∧H1GID,gωxθx1/μ=e∧g,gαδx∑x=1lωxλxe∧H1GID,g∑x=1lωxθx1/μ=e^g,gαδxs/μ.☐Theorem 2.
The proposed scheme satisfies the properties of data confidentiality.Proof.
In our scheme, the data is first encrypted using a symmetric encryption algorithm, and the key is encapsulated by access policy. As for the data confidentiality, the symmetric encryption algorithm, such as AES, can guarantee the feature. With respect to the fine-grained data access control, for the transformation public keytpk of a unauthorized DU whose attribute set does not satisfy the access policy, CSP cannot get an authorized index set Is′ so as to calculate the correct constants ωx to make the equation ∑x∈Is′ωxAx=s holds. Thus, the CSP will fail to return a correct partially decrypted ciphertext, and the DU also cannot obtain the encapsulated symmetric key to further get the plaintext of data. Moreover, in outsourced decryption, the CSP also cannot get the symmetric key from partially decrypted ciphertext to recover plaintext of data because it cannot get the transformation secret key tsk of the DU to further decrypt the partially decrypted ciphertext. Furthermore, the secret key of each DU is embedded with his unique global identity, and the transformation public key of each DU is also confused with his unique transformation secret key tsk which is secret by the DU himself, and any two or more DUs have no way to collude for data access.☐Theorem 3.
The proposed scheme satisfies the properties of access policy hiding.Proof.
In our scheme, when the DO encrypts the symmetric key used in symmetric encryption based on a designated access policy, he first transforms each attribute in access policy according to the one-way anonymous key agreement protocol in [52] by computing mx=e^gtia,H0ρx for each row x of access policy, where a is a random number. Then, DO replaces each attribute in access policy by mx, which can obfuscate each attribute ρx in access policy. In decryption phase, the DU cannot compute mx only if he has the key component H0ρxti. Otherwise, DU cannot distinguish mx from x. Therefore, malicious DU cannot infer the access policy, and thus, the attribute information in access policy is protected.☐Theorem 4.
The proposed scheme satisfies the properties of collusion resistance.Proof.
The malicious users may collude to combine their secret keys and transformation keys to access the shared data which they cannot access individually. In our scheme, different attribute authority generates secret keys for different users, and the secret keys are associated with users’ GID, specific attribute set and random, which are uniquely related to each user and make the combination of attributes in different secret keys useless. As a result, collusive users cannot computekey∗=e^g,g∑i∈IAAαis cooperatively in the outsourced decryption even if the combined attributes of these users satisfy the access policy. Thus, our scheme is collision-resistant.☐Theorem 5.
The proposed scheme satisfies the properties of verifiability.Proof.
Suppose thatKDF is secure and H, H2, and H3 are three collision-resistant hash functions. Thus, the output of KDF is indistinguishable from a random string. In the encryption phase of our scheme, KDFkey,L=sskd and C¯=g1Hsskg2Hd. As it is difficult to distinguish the output of KDF from a random string and H is a deterministic collision-resisstant hash function, the untrusted CSP has no way to guess the random Hd,Hssk and thus fails to tamper the Pedersen commitment C¯ which is computationally hiding. Moreover, since H2and H3 are two collision-resistant functions, it is hard to guess a random R∗ to construct H3R∗CTs=H3RCTs, which is in negligible probability. Therefore, the validity of key and ciphertexts CTs can be guaranteed.☐Theorem 6.
The proposed scheme satisfies the properties of exculpability.Proof.
Suppose thatKDF is secure and H is a deterministic collision-resistant hash functions. Thus, the output of KDF is indistinguishable from a random string. If a malicious DU with transformation secret key tsk wants to accuse CSP of returning incorrect results, he has to have the ability of forging a fake transformation secret key tsk∗ that can generate the same commitment. Suppose that g1=gφ,g2=gψ and the malicious DU constructs KDFkey,L=sskd and KDFkey∗,L=ssk∗d∗, where key and key∗ are partially decrypted results with tsk and tsk∗, respectively. The commitment must be equal, that is, g1Hsskg2Hd=g1Hssk∗g2Hd∗. Then, the malicious DU can get φ=ψHd∗−Hd/Hssk−Hssk∗, which means that the malicious DU can solve DL problem. However, it is of negligible probability according to DL assumption. Therefore, our scheme is exculpable for decryption.☐


## 7. Performance Evaluation

This section evaluates the performance by comparing our EMA-LUPHDS scheme with several existing schemes in efficiency aspects. We give the comparison in computation and space complexity in theoretical aspects between our scheme and the schemes in [6, 7]. Furthermore, we focus on experiment implementation to precisely evaluate the efficiency of EMA-LUPHDS. By comparing with several excellent similar schemes, we demonstrate that our scheme is more efficient and practicable for data sharing in MCC.


### 7.1. Theoretical Analysis

We thoroughly analyzes the computation and space complexity by comparing our EMA-LUPHDS and other schemes [2, 6, 7] in detail from the aspects of public parameter size (pp size), user key size (UKey size), transformation key size (TKey size), ciphertext size (ciphertext size), encryption cost, user decryption cost, and outsourced decryption cost (out decryption cost), as the former four metrics measure the space complexity of each scheme and the remains are used to evaluate the computation cost in execution of each scheme. The comparison result is summarized in Table 2.Table 2
Computation complexity comparison.
Schemepp sizeTKey sizeCiphertext sizeEncryption costUser decryption costOur decryption costScheme in [6]G+1+2+GT+GA2∣GS∣G3l+1+GT+V+CTsym5EG+2MGl+EG+P+MGT+H+EncsymEGT+MGT+Decsym+2H3P+2MGT+EGT∣S∣Scheme in [2]A+G+1+GT+1G2+S3G+4l+G+GTMGT+EGT+EG+2lEGT+MGT2EG+3MGTS+P+2P+MGT+EGTSScheme in [7]∣G∣+∣GT∣+2+3+GT+GA2GS+1+1GT+V+∣G∣+3G+GTl2MGT+H+EG+5EG+2MG+EGTlEGT+MGT+H4P+3MGT+2EGT∣S∣+P+MGT+HOur scheme3∣G∣+42∣G∣∣S∣+32+12∣G∣1+2l+∣CTsym∣+∣V∣+∣GT∣EG+MGT+6EG+2MGl+Encsym+HEGT+MGT+Decsym+2H+2EG+MG4P+3MGT+EGT∣S∣Here, we first stipulate some denotions in the theoretical analysis.EG,EGT denotes the exponentiation operations in G,GT, MG,MGT denotes the multiplication operations in G,GT, P denotes the pairing operation e^, H denotes the computation cost of a hash function and Encsym,Decsym denotes the computation costs of symmetric encryption and decryption. In addition, l denotes the number of attributes in access structure, ∣S∣ denotes the number of attributes owned by DU, G,GT denotes the length of elements in group G,GT, ∣A∣ denotes the number of attributes managed by each authority, ∣V∣ denotes the length of verification code, and ∣CTsym∣ denotes the length of symmetric encrypted ciphertext.In Table2, we first analyze the space complexity comparison. First of all, the pp size of schemes in [2, 6, 7] are ∣G∣+1+2+GT+GA, ∣A∣G+1+GT+1, and G+GT+2+3+GT+GA, respectively. We note that these sizes are all growing with the increase of access policy number. However, the pp size in our scheme is 3∣G∣+4, which shows that our scheme can support large attribute universe because the public parameter size is constant and very small. Moreover, the transformation key sizes of the four schemes are G2+S, 2GS+1, 2GS+3/2+1, and 2GS+1+1, respectively. This means that the transformation key sizes in four related schemes are of the same case. Furthermore, we analyze the ciphertext size. In schemes [2, 7], the ciphertext sizes are 3G+4l+G+GT and GT+V+G+3G+GTl, while the sizes in our scheme and the scheme [6] are 2G1+2l+CTsym+V+GT and G3l+1+GT+V+CTsym. We note that the former two schemes support smaller ciphertext. However, as the latter two schemes are suitable for scalable plaintext encryption, the ciphertext size may be larger. Later, we will analyze the experiment result and use the base ciphertext size to compare the practical result.Then, we analyze the computation complexity comparison. First, as for encryption time, the complexity in scheme is [2] while in our scheme and the schemes [6, 7] are 5EG+2MGl+EG+P+MGT+H+Encsym, 2MGT+H+EG+5EG+2MG+EGTl, and EG+MGT+6EG+2MGl+Encsym+H. We can infer that the computation complexity in [2] is a little less while the other three schemes cost more. Moreover, the user decryption in schemes [2, 7] is EGT+MGT and EGT+MGT+H, while the schemes in [6] and our scheme cost EGT+MGT+Decsym+2H and EGT+MGT+Decsym+2H+2EG+MG. We note that the latter two schemes cost more than the former two schems because the latter two schemes support large plaintext encryption and decryption, which means that the user needs to decrypt the symmetric ciphertext after obtaining encapsulated symmetric key. In our scheme, we need more computation for commitment recover and add more computation overhead. Furthermore, as for out decryption, we infer from Table 2 that the four schemes outsource similar workload to third party.In conclusion, we know that although in our scheme, the transformation key is a little larger than other schemes in Table2, and it has far smaller public parameters in constant size. Also, our scheme supports scalable ciphertext though it may take up a lot of space. As our scheme supports flexible functions, to increase the efficiency, we also introduce online/offline and outsourced computing techniques. We note that from Table 2, the computation cost in encryption and user decryption of our scheme is greatly reduced and approaches other schemes in Table 2. In general, our scheme can achieve more reasonable computation complexity compared with other relevant schemes in theoretical analysis.


### 7.2. Experimental Analysis

To precisely evaluate the performance of EMA-LUPHDS, we implement our scheme and the schemes in [6, 7] and compare their actual computation and space cost with EMA-LUPHDS, and the result of which is summarized in Figures 3 and 4.Figure 3
Comparison of the computation cost.
(a)
Encryption time(b)
Out decryption time(c)
Time of user decryption with exculpability(d)
Time of user decryption without exculpabilityFigure 4
Comparison of the storage cost.
(a)
Public parameter size(b)
Public parameter size(c)
Transformation key size(d)
Ciphertext sizeWe implement and develop these schemes using Java Programming Language with the Java Pairing-Based Cryptography library (JPBC) [53] for various operations in finite field and groups. Type A pairing is adopted in our implementations which is defined over a 160-bit elliptic curve group over 512-bit finite field, that is, the supersingular elliptic curve EFp:y2=x3+x with embedding degree 2, where p is a 512-bit Solinas prime. Moreover, our simulation experiments are run on Windows10 system with Intel Core i5 CPU 2.13 GHz and 8.00 GB RAM. In addition, we use SHA256 algorithm to generate the Vm for correctness verification of ciphertext in our experiments.Figure3 shows the computation comparison from the point of the time cost in encryption, outsourced decryption, and user decryption. We note that in Figure 3(a), our scheme performs approximate to that of schemes in [6] and is superior to the scheme in [7] in encryption. From Figure 3(b), we know that the computation cost of outsourced decryption for our scheme is a little larger than that of [6] and nearly the same as that of [7]. Figures 3(c) and 3(d) present the computation cost of Pedersen commitment for supporting exculpability. We note that in Figure 3(d), the three schemes perform similarly, and in Figure 3(c), the computation cost of our scheme is larger than the other two schemes, which shows the trade-off between the function of exculpability and efficiency cost.From Figure4, we note that the storage complexity of our scheme is approximate to that in [6, 7] while takes only constant-sized public parameters that are far smaller than that in [6, 7]. We can infer from Figure 4(a) that the size of public parameters in our scheme is very small and constant. Thus, in Figure 4(b), the public parameter size of our scheme is nearly invisible. In Figure 4(c), we know that the three schemes take up similar size in transformation key. Figure 4(d) shows that our scheme takes up a little larger space for ciphertext as we support exculpability and flexible policy hiding. We also note that the ciphertext size is approximate to that of the scheme in [7] which is not flexible as our scheme. And both the scheme in and our scheme can support scalable ciphertext, which means that the user does not need to map plaintext to the bilinear group.It is obvious that the results of our experiment simulation indicate that our scheme is flexible and versatile. It is also efficient in encryption cost, user decryption cost, and out decryption cost and has far smaller and constant public parameter size. Therefore, we argue that EMA-LUPHDS proposed in our work is more suitable for resource-constraint mobile devices in MCC system.


## 7.1. Theoretical Analysis

We thoroughly analyzes the computation and space complexity by comparing our EMA-LUPHDS and other schemes [2, 6, 7] in detail from the aspects of public parameter size (pp size), user key size (UKey size), transformation key size (TKey size), ciphertext size (ciphertext size), encryption cost, user decryption cost, and outsourced decryption cost (out decryption cost), as the former four metrics measure the space complexity of each scheme and the remains are used to evaluate the computation cost in execution of each scheme. The comparison result is summarized in Table 2.Table 2
Computation complexity comparison.
Schemepp sizeTKey sizeCiphertext sizeEncryption costUser decryption costOur decryption costScheme in [6]G+1+2+GT+GA2∣GS∣G3l+1+GT+V+CTsym5EG+2MGl+EG+P+MGT+H+EncsymEGT+MGT+Decsym+2H3P+2MGT+EGT∣S∣Scheme in [2]A+G+1+GT+1G2+S3G+4l+G+GTMGT+EGT+EG+2lEGT+MGT2EG+3MGTS+P+2P+MGT+EGTSScheme in [7]∣G∣+∣GT∣+2+3+GT+GA2GS+1+1GT+V+∣G∣+3G+GTl2MGT+H+EG+5EG+2MG+EGTlEGT+MGT+H4P+3MGT+2EGT∣S∣+P+MGT+HOur scheme3∣G∣+42∣G∣∣S∣+32+12∣G∣1+2l+∣CTsym∣+∣V∣+∣GT∣EG+MGT+6EG+2MGl+Encsym+HEGT+MGT+Decsym+2H+2EG+MG4P+3MGT+EGT∣S∣Here, we first stipulate some denotions in the theoretical analysis.EG,EGT denotes the exponentiation operations in G,GT, MG,MGT denotes the multiplication operations in G,GT, P denotes the pairing operation e^, H denotes the computation cost of a hash function and Encsym,Decsym denotes the computation costs of symmetric encryption and decryption. In addition, l denotes the number of attributes in access structure, ∣S∣ denotes the number of attributes owned by DU, G,GT denotes the length of elements in group G,GT, ∣A∣ denotes the number of attributes managed by each authority, ∣V∣ denotes the length of verification code, and ∣CTsym∣ denotes the length of symmetric encrypted ciphertext.In Table2, we first analyze the space complexity comparison. First of all, the pp size of schemes in [2, 6, 7] are ∣G∣+1+2+GT+GA, ∣A∣G+1+GT+1, and G+GT+2+3+GT+GA, respectively. We note that these sizes are all growing with the increase of access policy number. However, the pp size in our scheme is 3∣G∣+4, which shows that our scheme can support large attribute universe because the public parameter size is constant and very small. Moreover, the transformation key sizes of the four schemes are G2+S, 2GS+1, 2GS+3/2+1, and 2GS+1+1, respectively. This means that the transformation key sizes in four related schemes are of the same case. Furthermore, we analyze the ciphertext size. In schemes [2, 7], the ciphertext sizes are 3G+4l+G+GT and GT+V+G+3G+GTl, while the sizes in our scheme and the scheme [6] are 2G1+2l+CTsym+V+GT and G3l+1+GT+V+CTsym. We note that the former two schemes support smaller ciphertext. However, as the latter two schemes are suitable for scalable plaintext encryption, the ciphertext size may be larger. Later, we will analyze the experiment result and use the base ciphertext size to compare the practical result.Then, we analyze the computation complexity comparison. First, as for encryption time, the complexity in scheme is [2] while in our scheme and the schemes [6, 7] are 5EG+2MGl+EG+P+MGT+H+Encsym, 2MGT+H+EG+5EG+2MG+EGTl, and EG+MGT+6EG+2MGl+Encsym+H. We can infer that the computation complexity in [2] is a little less while the other three schemes cost more. Moreover, the user decryption in schemes [2, 7] is EGT+MGT and EGT+MGT+H, while the schemes in [6] and our scheme cost EGT+MGT+Decsym+2H and EGT+MGT+Decsym+2H+2EG+MG. We note that the latter two schemes cost more than the former two schems because the latter two schemes support large plaintext encryption and decryption, which means that the user needs to decrypt the symmetric ciphertext after obtaining encapsulated symmetric key. In our scheme, we need more computation for commitment recover and add more computation overhead. Furthermore, as for out decryption, we infer from Table 2 that the four schemes outsource similar workload to third party.In conclusion, we know that although in our scheme, the transformation key is a little larger than other schemes in Table2, and it has far smaller public parameters in constant size. Also, our scheme supports scalable ciphertext though it may take up a lot of space. As our scheme supports flexible functions, to increase the efficiency, we also introduce online/offline and outsourced computing techniques. We note that from Table 2, the computation cost in encryption and user decryption of our scheme is greatly reduced and approaches other schemes in Table 2. In general, our scheme can achieve more reasonable computation complexity compared with other relevant schemes in theoretical analysis.


## 7.2. Experimental Analysis

To precisely evaluate the performance of EMA-LUPHDS, we implement our scheme and the schemes in [6, 7] and compare their actual computation and space cost with EMA-LUPHDS, and the result of which is summarized in Figures 3 and 4.Figure 3
Comparison of the computation cost.
(a)
Encryption time(b)
Out decryption time(c)
Time of user decryption with exculpability(d)
Time of user decryption without exculpabilityFigure 4
Comparison of the storage cost.
(a)
Public parameter size(b)
Public parameter size(c)
Transformation key size(d)
Ciphertext sizeWe implement and develop these schemes using Java Programming Language with the Java Pairing-Based Cryptography library (JPBC) [53] for various operations in finite field and groups. Type A pairing is adopted in our implementations which is defined over a 160-bit elliptic curve group over 512-bit finite field, that is, the supersingular elliptic curve EFp:y2=x3+x with embedding degree 2, where p is a 512-bit Solinas prime. Moreover, our simulation experiments are run on Windows10 system with Intel Core i5 CPU 2.13 GHz and 8.00 GB RAM. In addition, we use SHA256 algorithm to generate the Vm for correctness verification of ciphertext in our experiments.Figure3 shows the computation comparison from the point of the time cost in encryption, outsourced decryption, and user decryption. We note that in Figure 3(a), our scheme performs approximate to that of schemes in [6] and is superior to the scheme in [7] in encryption. From Figure 3(b), we know that the computation cost of outsourced decryption for our scheme is a little larger than that of [6] and nearly the same as that of [7]. Figures 3(c) and 3(d) present the computation cost of Pedersen commitment for supporting exculpability. We note that in Figure 3(d), the three schemes perform similarly, and in Figure 3(c), the computation cost of our scheme is larger than the other two schemes, which shows the trade-off between the function of exculpability and efficiency cost.From Figure4, we note that the storage complexity of our scheme is approximate to that in [6, 7] while takes only constant-sized public parameters that are far smaller than that in [6, 7]. We can infer from Figure 4(a) that the size of public parameters in our scheme is very small and constant. Thus, in Figure 4(b), the public parameter size of our scheme is nearly invisible. In Figure 4(c), we know that the three schemes take up similar size in transformation key. Figure 4(d) shows that our scheme takes up a little larger space for ciphertext as we support exculpability and flexible policy hiding. We also note that the ciphertext size is approximate to that of the scheme in [7] which is not flexible as our scheme. And both the scheme in and our scheme can support scalable ciphertext, which means that the user does not need to map plaintext to the bilinear group.It is obvious that the results of our experiment simulation indicate that our scheme is flexible and versatile. It is also efficient in encryption cost, user decryption cost, and out decryption cost and has far smaller and constant public parameter size. Therefore, we argue that EMA-LUPHDS proposed in our work is more suitable for resource-constraint mobile devices in MCC system.


## 8. Conclusion

In this paper, we propose an Efficient and Multiauthority Large Universe Policy-Hiding Data Sharing (EMA-LUPHDS) scheme to achieve key escrow resistance, expressive access policies without user privacy leakage, and high efficiency for data sharing of MCC with resource-limited mobile devices. In our proposal, we adopt fully hidden strategy to protect sensitive information about attributes of users and access policy. To achieve high efficiency, we introduce outsourced decryption to reduce the computational cost and the online/offline technique to trade off the overhead in encryption operation. In addition, we add into the ciphertext with verification code and Pedersen commitment to ensure the correctness of the partially decrypted result got from misbehaving CSP and the exculpability for CSP accused by DU maliciously. Moreover, the security analysis and thorough performance evaluation show that our proposal is practicable for resource-restraint mobile devices in the MCC system.In our future work, we would dedicate into the efficient attribute and user revocation in data sharing scheme for mobile cloud environment.



---

*Source: 8513869-2021-09-02.xml*