# Multiauthority Attribute-Based Access Control for Supply Chain Information Sharing in Blockchain

Authors: Chenlei Liu; Feng Xiang; Zhixin Sun
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Information sharing has become an important application in modern supply chain management systems with business technology development. Because traditional supply chain information systems have problems such as easy data tampering, low information transparency, and interaction delays, blockchain has been taken consideration into supply chain information sharing research. Furthermore, blockchain technology is expected to provide decentralized supply chain information sharing solutions to enhance security, availability, and transparency. However, with the in-depth study of the application of blockchain technology in supply chain information sharing, people have found that the data stored publicly in the blockchain are still threatened by privacy leakage. In addition, due to the openness and accessibility of the blockchain, the lack of fine-grained access control is also apparent. In order to improve the security of data, we propose a novel privacy-preserving multiauthority attribute-based access control scheme for secure blockchain-based information sharing in a supply chain. In this scheme, blockchain stores encrypted supply chain information on distributed nodes. Multiple attribute authorities manage different attributes of users to achieve fine-grained access control and flexible authorization. Even if some attribute authorities fail, the user’s private key will not be leaked. In user secret key generation, we adopt an anonymous key generation protocol to realize the secure distribution of user keys by the attribute authorities. Furthermore, in order to meet the protection of communication privacy between blockchain nodes, properties of policy hiding and identity hiding are considered. Finally, we design experiments to analyze the performance of our scheme, including secret key sizes and running time of encryption and decryption.


---

## Body

## 1. Introduction

A supply chain is a huge and complex network that tightly integrates suppliers, carriers, manufacturers, and consumers. In the supply chain, information sharing has played an important role in resource utilization, demand analysis, and production management for upstream suppliers and downstream manufacturers in each industry. In addition, as consumers pay more attention to raw materials, product processing, and logistics, the research on the transparency and traceability of supply chain information has become a research hotspot in the field of the supply chain. However, a supply chain is often characterized by high levels of globalization, a large number of participating corporations, and complex product processing links, which contain the confidential and critical private information of corporations and consumers. Therefore, a traditional centralized supply chain system is vulnerable to facing a single point of failure, which makes the entire network and organizations involved in potential danger (e.g., hacking or corruption) [1]. In addition, since centralized organizations introduce third parties for management, there is also a problem of inefficient access and limited control of information. Therefore, finding decentralized solutions to improve the security, availability, and transparency of information sharing in the supply chain is very crucial.Blockchain is a novel deneutralized computing model, which is expected to provide decentralized solutions for information sharing in a supply chain system. It was firstly described in the context of Bitcoin [2], which Satoshi Nakamoto designed. Blockchain integrates distributed data storage, independent peering transactions, consensus mechanisms, programmable smart contracts, dynamic encryption algorithms, etc. It enables multiparty transactions in a distributed environment. It also has the characteristics of traceable information sources and is difficult to tamper with transaction data [3]. With the development of blockchain technology, it is increasingly applied in many fields such as medical care [4], banking system [5], and Internet of Things (IoT) applications [6]. In recent years, scholars have paid more attention to the application of blockchain in supply chain information sharing. Abidi et al. [7] constructed a new privacy preservation model in supply chain networks based on blockchain technology, where blockchain plays a promising role for secure information sharing. Venkatesh et al. [8] developed a system architecture that integrates the use of blockchain, IoT, and big data analytics to allow suppliers to efficiently and effectively monitor supply chain social sustainability.However, with the application of technologies such as deep learning and data mining, the blockchain is still facing the threat of network attacks such as DDoS attacks [9], DNS attacks [10], and deanonymity analysis [11], which hinders the availability of services to users and threatens blockchain node security. Therefore, the data in the blockchain system are not completely secure because it transfers data through address identification similar to e-mail addresses, which may cause user privacy issues. Furthermore, although the address identification is not directly related to the real-world user identity, the blockchain data are completely open and transparent, leading to privacy leaks. So, it is indispensable to optimize the access control scheme for the traditional blockchain-based supply chain information sharing systems.Attribute-based encryption (ABE) [12] is proposed as an encryption system that inherits the advantages of identity encryption, in which the secret key of a user and the ciphertext are dependent on attributes (e.g., phone number or e-mail address). It can provide fine-grained access control for an information sharing system. Due to the excellent performance of ABE in controlling and managing access to data, it has been considered to be one of the key technologies that can continuously improve the security and privacy performance of a blockchain system in recent years [13]. In this paper, we propose a blockchain-based supply chain information sharing access control scheme based on the privacy-preserving multiauthority ciphertext-policy ABE. This scheme also introduces the user attribute revocation mechanism to enhance flexibility and security.In our scheme, the main contributions are summarized as follows:(1)
A novel multiauthorities attribute-based encryption scheme has been proposed to solve the problems of privacy leakage and incomplete anonymity in blockchain-based information sharing systems of the supply chain.(2)
We take properties of attribute revocable, policy hiding, identity hiding, and secret key anonymous generation into account to improve the security and flexibility of our scheme.(3)
An anonymous key generation protocol is proposed to solve the problem of secure key issuance between users and attribute authorities.The rest of the article is structured as follows: Section2 reviews the relevant issues of the research topic. Section 3 introduces the mathematical preliminaries involved in the paper. Section 4 explains the access control system model and security model. Section 5 describes our work in detail. Section 6 analyzes the correctness and security of the scheme we proposed. Section 7 analyzes the security of the anonymous key generation protocol. The results of the comparison and experiments will be shown in Section 8. Finally, Section 9 summarizes the work of this article and looks forward to future work.


## 2. Related Works

In this section, we review some existing works associated with the blockchain-based access control scheme and the applications of ABE and MA-ABE on it.


### 2.1. Blockchain-Based Access Control

The leakage of sensitive data in the block can pose a great threat to the security of the blockchain and its applications. Therefore, the research on the data access control scheme of the blockchain has become a hot topic in blockchain security. Huang et al. [14] created a new type of blockchain system with a credit-based workload consensus mechanism (Proof of Work), and researchers also designed a method for regulating sensor data access. The data authentication management method realized the data privacy protection of the Industrial Internet of Things and the efficiency improvement of the blockchain under the Internet of Things. Khan et al. [15] proposed a role-based fine-grained access control model for blockchain resource management. This model can monitor a resource continuously during the operation and update the attributes accordingly. Tan et al. [16] presented a general access control framework, which provided a unified and feasible way for users to achieve decentralized, lightweight, and fine-grained access control of the blockchain-based green Internet of Things. However, these studies mainly focused on optimizing the blockchain consensus mechanism and smart contracts, that is, more improvements to the blockchain security technology itself, without taking into account the encryption algorithm cracking, key leakage, and privacy leaks in the blockchain.


### 2.2. ABE for Blockchain-Based Access Control

Due to its wide application scenarios, attribute-based encryption has become a very popular research direction in cryptography. The emergence of ABE provides another solution to meet the needs of secure access control in blockchain applications. Xu et al. [17] created a distributed attribute-based keyword search (ABKS) scheme, where ABKS is a keyword search mechanism that introduces public key encryption using keyword search into the context of the attribute cryptosystem. The scheme allowed data owners have the flexibility to share data content with groups of users that meet access control conditions. Yu et al. [18] provided an update-oriented access control scheme for blockchain-based IoT systems, which is compatible with the ABE technique. In the scheme, historical on-chain data can only be accessible to new members and inaccessible to the revoked members. Qin et al. [19] proposed an access control scheme with lightweight decryption based on ABE and blockchain technologies, where a user credibility incentive mechanism is designed to calculate the user’s credibility according to the user’s access behavior and gives a reputation score to adjust the endorsement protocol dynamically. These studies enhance the blockchain’s ability to protect data and user privacy in its applications and enrich the research on the ABE-based blockchain information sharing access control scheme. However, in traditional attribute-based cryptography, a trusted entity known as a Key Generation Center (KGC) is responsible for generating users’ private keys, which contradicts the decentralized blockchain.


### 2.3. MA-ABE for Blockchain-Based Access Control

The multiauthority ABE was first proposed in [20]. This solution is based on the fact that different types of transactions are handled exclusively by different organizations in reality, and it is improved on the standard ABE scheme. MA-ABE and its variants have been applied in researching and applying blockchain access control security. Guo et al. [21] constructed a multiauthority attribute-based encryption and signature scheme and introduced pseudorandom functions to achieve data sharing and collision avoidance. Qin et al. [22] proposed a blockchain-based multiauthority access control called BMAC for secure data sharing in the cloud, where the Shamir secret-sharing scheme and a permission blockchain were introduced. In this scheme, multiple authorities jointly managed each attribute to avoid a single point of failure. Banerjee et al. [23] offered a new blockchain-envisioned fine-grained user access control scheme for data security and scalability in IIoT environment, which supported multiple attribute authorities and constant size key and ciphertext. Hei et al. [24] designed a novel MA-ABE scheme based on blockchain, which ensured that a relevant user could obtain the final decryption attribute key only after all attribute authorities had publicly issued their keys to the blockchain. Sethi et al. [25] presented a practical decentralized multiauthority traceable and efficiently revocable attribute-based cryptosystem with outsourcing decryption advantage. Rouhani et al. [26] proposed a distributed attribute-based access control (ABAC) system based on blockchain to provide trusted auditing of access attempts and presented a level of transparency that both access requesters and resource owners can benefit from this system. In this paper, we have considered four cryptographic properties to improve the security of MA-ABE for the blockchain-based access control scheme. Furthermore, the current multiauthority attribute-based encryption schemes are mainly based on prime order and composite-order bilinear groups. Prime order bilinear groups are better than composite-order bilinear groups in terms of computational efficiency. However, the number of bilinear groups satisfying prime order is relatively small, and the structure of bilinear groups is single, which cannot meet the practical application needs. Therefore, we constructed a multiauthority attribute-based encryption scheme based on composite-order bilinear groups.


## 2.1. Blockchain-Based Access Control

The leakage of sensitive data in the block can pose a great threat to the security of the blockchain and its applications. Therefore, the research on the data access control scheme of the blockchain has become a hot topic in blockchain security. Huang et al. [14] created a new type of blockchain system with a credit-based workload consensus mechanism (Proof of Work), and researchers also designed a method for regulating sensor data access. The data authentication management method realized the data privacy protection of the Industrial Internet of Things and the efficiency improvement of the blockchain under the Internet of Things. Khan et al. [15] proposed a role-based fine-grained access control model for blockchain resource management. This model can monitor a resource continuously during the operation and update the attributes accordingly. Tan et al. [16] presented a general access control framework, which provided a unified and feasible way for users to achieve decentralized, lightweight, and fine-grained access control of the blockchain-based green Internet of Things. However, these studies mainly focused on optimizing the blockchain consensus mechanism and smart contracts, that is, more improvements to the blockchain security technology itself, without taking into account the encryption algorithm cracking, key leakage, and privacy leaks in the blockchain.


## 2.2. ABE for Blockchain-Based Access Control

Due to its wide application scenarios, attribute-based encryption has become a very popular research direction in cryptography. The emergence of ABE provides another solution to meet the needs of secure access control in blockchain applications. Xu et al. [17] created a distributed attribute-based keyword search (ABKS) scheme, where ABKS is a keyword search mechanism that introduces public key encryption using keyword search into the context of the attribute cryptosystem. The scheme allowed data owners have the flexibility to share data content with groups of users that meet access control conditions. Yu et al. [18] provided an update-oriented access control scheme for blockchain-based IoT systems, which is compatible with the ABE technique. In the scheme, historical on-chain data can only be accessible to new members and inaccessible to the revoked members. Qin et al. [19] proposed an access control scheme with lightweight decryption based on ABE and blockchain technologies, where a user credibility incentive mechanism is designed to calculate the user’s credibility according to the user’s access behavior and gives a reputation score to adjust the endorsement protocol dynamically. These studies enhance the blockchain’s ability to protect data and user privacy in its applications and enrich the research on the ABE-based blockchain information sharing access control scheme. However, in traditional attribute-based cryptography, a trusted entity known as a Key Generation Center (KGC) is responsible for generating users’ private keys, which contradicts the decentralized blockchain.


## 2.3. MA-ABE for Blockchain-Based Access Control

The multiauthority ABE was first proposed in [20]. This solution is based on the fact that different types of transactions are handled exclusively by different organizations in reality, and it is improved on the standard ABE scheme. MA-ABE and its variants have been applied in researching and applying blockchain access control security. Guo et al. [21] constructed a multiauthority attribute-based encryption and signature scheme and introduced pseudorandom functions to achieve data sharing and collision avoidance. Qin et al. [22] proposed a blockchain-based multiauthority access control called BMAC for secure data sharing in the cloud, where the Shamir secret-sharing scheme and a permission blockchain were introduced. In this scheme, multiple authorities jointly managed each attribute to avoid a single point of failure. Banerjee et al. [23] offered a new blockchain-envisioned fine-grained user access control scheme for data security and scalability in IIoT environment, which supported multiple attribute authorities and constant size key and ciphertext. Hei et al. [24] designed a novel MA-ABE scheme based on blockchain, which ensured that a relevant user could obtain the final decryption attribute key only after all attribute authorities had publicly issued their keys to the blockchain. Sethi et al. [25] presented a practical decentralized multiauthority traceable and efficiently revocable attribute-based cryptosystem with outsourcing decryption advantage. Rouhani et al. [26] proposed a distributed attribute-based access control (ABAC) system based on blockchain to provide trusted auditing of access attempts and presented a level of transparency that both access requesters and resource owners can benefit from this system. In this paper, we have considered four cryptographic properties to improve the security of MA-ABE for the blockchain-based access control scheme. Furthermore, the current multiauthority attribute-based encryption schemes are mainly based on prime order and composite-order bilinear groups. Prime order bilinear groups are better than composite-order bilinear groups in terms of computational efficiency. However, the number of bilinear groups satisfying prime order is relatively small, and the structure of bilinear groups is single, which cannot meet the practical application needs. Therefore, we constructed a multiauthority attribute-based encryption scheme based on composite-order bilinear groups.


## 3. Preliminaries

### 3.1. Composite-Order Bilinear Group

The concept of the composite-order bilinear group was firstly proposed by Boneh et al. in [27].Letp1,p2,p3 be distinct primes and G and GT be cyclic groups of order N=p1p2p3. The map e:G×G⟶GT is a bilinear map if it meets the following three properties:(1)
Bilinearity: for∀a,b∈ZN and u,v∈G, we have eua,vb=eu,vab.(2)
Nondegeneracy:∀g∈G such that eg,g≠1 hold.(3)
Computability:∀u,v∈G, eu,v is efficiently computable.LetG be a composite-order bilinear group and Gpi be the subgroups of order pi in G, we can get that ∀gi∈Gpi and ∀gj∈Gpj, then egi,gj is an identity element in GT, which has been explained in [28]. The orthogonal property of subgroups will be used in dual-system encryption to achieve semifunctionality.


### 3.2. Assumption

There will be four assumptions illustrated in the proof of the security of our scheme. For assumptions 1–4, we refer to the assumptions 1–4 from Lewko and Waters’s scheme [29], where g←RG means randomly selecting g in G.


#### 3.2.1. Assumption 1

For a given group generatorG, we define the following distribution:(1)N=p1p2p3,G,GT,e←RGg1←RGp1,T1←RG,T2←RGp1,D=G,g1.We defineAdv1A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 1. The assumption is true if no algorithm exists that can respectively distinguish T1 and T2 in G and Gp1 in polynomial time.


#### 3.2.2. Assumption 2

For a given group generatorG, we define the following distribution:(2)N=p1p2p3,G,GT,e←RGg1,X1←RGp1,X2←RGp2,g3←RGp3,D=G,g1,g3,X1X2,T1←RGp1,T2←RGp1p2.We defineAdv2A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 2. The assumption is true if no algorithm exists that can, respectively, distinguish T1 and T2 in Gp1 and Gp2 in polynomial time.


#### 3.2.3. Assumption 3

For a given group generatorG, we define the following distribution:(3)N=p1p2p3,G,GT,e←RGg1,X1←RGp1,Y2←RGp2,X3,Y3←RGp3,D=G,g1,X1X3,Y2Y3,T1←RGp1p2,T2←RGp1p3.We defineAdv3A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 3. The assumption is true if no algorithm exists that can, respectively, distinguish T1 and T2 in Gp1p2 and Gp1p3 in polynomial time.


#### 3.2.4. Assumption 4

For a given group generatorG, we define the following distribution:(4)N=p1p2p3,G,GT,e←RGg1←RGp1,g2←RGp2,g3←RGp3,a,b,c,d←RZN,D=G,g1,g2,g3,g1a,g1bg3b,g1c,g1acg3d,T1=eg1,g1abc,T2←RGT.We defineAdv4A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 4. The assumption is true if no algorithm exists that can respectively distinguish T1 and T2 in polynomial time.


### 3.3. Access Structure

LetP=p1,p2,…,pn be the collection of participants. A collection A⊆2P is monotone, if any arbitrary B and C can get that B∈A and B⊆C, and then C∈A holds. An access structure (monotone access structure) is a collection (monotone access structure) A∈2P/∅. The sets in A are authorized sets, besides the sets not in A are unauthorized sets.


#### 3.3.1. Linear Secret-Sharing Scheme (LSSS) [30]

Linear secret-sharing scheme is an effective method to build an access structure. LetP be the collection of participants; A be a matrix with m rows and r columns. The map ρ:1,2,…,m⟶P pairs each row with each participant by labeling. A linear secret-sharing scheme Π:A,ρ over the set P and ZP∗ for access structure A, if π satisfies the following two polynomial-time algorithms:(1)
ShareA,ρ: the algorithm takes the shared secret s∈Zp∗ as input and randomly chooses a group of elements v2,v3,…,vn∈Zp∗ to generate a column vector v=s,v2,v3,…,vnT. Then, it outputs λ=Av. We define that Ai is the i-th row of matrix A so that λρi=Aiv is the element belonging to participant ρi.(2)
RecoverS: the algorithm sets a set S of participants as input. Then, we define another set I=i|ρi∈S. If S∈A, there will exist a group of constants ωi|i∈I, which can satisfy that ∑i∈Iωi⋅λρi=s. So, we can recover the secret. However, if S∉A, we cannot recover the right secret.


### 3.4. Commitment Scheme

The commitment scheme we used is based on Pedersen [31], which uses the discrete logarithm assumption. A commitment scheme is composed of three following algorithms:(1)
Setup1λ⟶params: this algorithm takes a security parameter 1λ as input and outputs the set of public parameters.(2)
Commitparams,M⟶com,decom: this algorithm takes the public parameter set params and a message M as input and outputs a commitment com and a decommitment decom, where decom can decommit com to M.(3)
Decommitparams,M,com,decom⟶0,1: this algorithm takes the public parameter set params, a message M, a commitment com, and a decommitment decom as input and outputs 1 if decom can decommit com to M; otherwise, the algorithm outputs 0.A commitment scheme must provide two properties of hiding and binding. The hiding property needs the messageM to keep unreleased until the user releases it. Other property only needs the decom to decommit the commitment com to M.


### 3.5. Zero-Knowledge Proof

The zero-knowledge proof scheme we used is based on [32]. By PoKa,b,c:y=gahb∧y˜=g˜ah˜c, we define a zero-knowledge proof of knowledge of a,b, and c, where y=gahb and y˜=g˜ah˜c respectively hold by the group G=<g>=<h> and G˜=<g˜>=<h˜>. Commonly, the values in the parenthesis represent the knowledge that needs to be proven, while the rest of the values are known by the verifier. There is an extractor that can be used to rewind the knowledge from the successful prover.


## 3.1. Composite-Order Bilinear Group

The concept of the composite-order bilinear group was firstly proposed by Boneh et al. in [27].Letp1,p2,p3 be distinct primes and G and GT be cyclic groups of order N=p1p2p3. The map e:G×G⟶GT is a bilinear map if it meets the following three properties:(1)
Bilinearity: for∀a,b∈ZN and u,v∈G, we have eua,vb=eu,vab.(2)
Nondegeneracy:∀g∈G such that eg,g≠1 hold.(3)
Computability:∀u,v∈G, eu,v is efficiently computable.LetG be a composite-order bilinear group and Gpi be the subgroups of order pi in G, we can get that ∀gi∈Gpi and ∀gj∈Gpj, then egi,gj is an identity element in GT, which has been explained in [28]. The orthogonal property of subgroups will be used in dual-system encryption to achieve semifunctionality.


## 3.2. Assumption

There will be four assumptions illustrated in the proof of the security of our scheme. For assumptions 1–4, we refer to the assumptions 1–4 from Lewko and Waters’s scheme [29], where g←RG means randomly selecting g in G.


### 3.2.1. Assumption 1

For a given group generatorG, we define the following distribution:(1)N=p1p2p3,G,GT,e←RGg1←RGp1,T1←RG,T2←RGp1,D=G,g1.We defineAdv1A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 1. The assumption is true if no algorithm exists that can respectively distinguish T1 and T2 in G and Gp1 in polynomial time.


### 3.2.2. Assumption 2

For a given group generatorG, we define the following distribution:(2)N=p1p2p3,G,GT,e←RGg1,X1←RGp1,X2←RGp2,g3←RGp3,D=G,g1,g3,X1X2,T1←RGp1,T2←RGp1p2.We defineAdv2A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 2. The assumption is true if no algorithm exists that can, respectively, distinguish T1 and T2 in Gp1 and Gp2 in polynomial time.


### 3.2.3. Assumption 3

For a given group generatorG, we define the following distribution:(3)N=p1p2p3,G,GT,e←RGg1,X1←RGp1,Y2←RGp2,X3,Y3←RGp3,D=G,g1,X1X3,Y2Y3,T1←RGp1p2,T2←RGp1p3.We defineAdv3A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 3. The assumption is true if no algorithm exists that can, respectively, distinguish T1 and T2 in Gp1p2 and Gp1p3 in polynomial time.


### 3.2.4. Assumption 4

For a given group generatorG, we define the following distribution:(4)N=p1p2p3,G,GT,e←RGg1←RGp1,g2←RGp2,g3←RGp3,a,b,c,d←RZN,D=G,g1,g2,g3,g1a,g1bg3b,g1c,g1acg3d,T1=eg1,g1abc,T2←RGT.We defineAdv4A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 4. The assumption is true if no algorithm exists that can respectively distinguish T1 and T2 in polynomial time.


## 3.2.1. Assumption 1

For a given group generatorG, we define the following distribution:(1)N=p1p2p3,G,GT,e←RGg1←RGp1,T1←RG,T2←RGp1,D=G,g1.We defineAdv1A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 1. The assumption is true if no algorithm exists that can respectively distinguish T1 and T2 in G and Gp1 in polynomial time.


## 3.2.2. Assumption 2

For a given group generatorG, we define the following distribution:(2)N=p1p2p3,G,GT,e←RGg1,X1←RGp1,X2←RGp2,g3←RGp3,D=G,g1,g3,X1X2,T1←RGp1,T2←RGp1p2.We defineAdv2A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 2. The assumption is true if no algorithm exists that can, respectively, distinguish T1 and T2 in Gp1 and Gp2 in polynomial time.


## 3.2.3. Assumption 3

For a given group generatorG, we define the following distribution:(3)N=p1p2p3,G,GT,e←RGg1,X1←RGp1,Y2←RGp2,X3,Y3←RGp3,D=G,g1,X1X3,Y2Y3,T1←RGp1p2,T2←RGp1p3.We defineAdv3A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 3. The assumption is true if no algorithm exists that can, respectively, distinguish T1 and T2 in Gp1p2 and Gp1p3 in polynomial time.


## 3.2.4. Assumption 4

For a given group generatorG, we define the following distribution:(4)N=p1p2p3,G,GT,e←RGg1←RGp1,g2←RGp2,g3←RGp3,a,b,c,d←RZN,D=G,g1,g2,g3,g1a,g1bg3b,g1c,g1acg3d,T1=eg1,g1abc,T2←RGT.We defineAdv4A,G=PrAD,T1−PrAD,T2 is the advantage of algorithm A in breaking Assumption 4. The assumption is true if no algorithm exists that can respectively distinguish T1 and T2 in polynomial time.


## 3.3. Access Structure

LetP=p1,p2,…,pn be the collection of participants. A collection A⊆2P is monotone, if any arbitrary B and C can get that B∈A and B⊆C, and then C∈A holds. An access structure (monotone access structure) is a collection (monotone access structure) A∈2P/∅. The sets in A are authorized sets, besides the sets not in A are unauthorized sets.


### 3.3.1. Linear Secret-Sharing Scheme (LSSS) [30]

Linear secret-sharing scheme is an effective method to build an access structure. LetP be the collection of participants; A be a matrix with m rows and r columns. The map ρ:1,2,…,m⟶P pairs each row with each participant by labeling. A linear secret-sharing scheme Π:A,ρ over the set P and ZP∗ for access structure A, if π satisfies the following two polynomial-time algorithms:(1)
ShareA,ρ: the algorithm takes the shared secret s∈Zp∗ as input and randomly chooses a group of elements v2,v3,…,vn∈Zp∗ to generate a column vector v=s,v2,v3,…,vnT. Then, it outputs λ=Av. We define that Ai is the i-th row of matrix A so that λρi=Aiv is the element belonging to participant ρi.(2)
RecoverS: the algorithm sets a set S of participants as input. Then, we define another set I=i|ρi∈S. If S∈A, there will exist a group of constants ωi|i∈I, which can satisfy that ∑i∈Iωi⋅λρi=s. So, we can recover the secret. However, if S∉A, we cannot recover the right secret.


## 3.3.1. Linear Secret-Sharing Scheme (LSSS) [30]

Linear secret-sharing scheme is an effective method to build an access structure. LetP be the collection of participants; A be a matrix with m rows and r columns. The map ρ:1,2,…,m⟶P pairs each row with each participant by labeling. A linear secret-sharing scheme Π:A,ρ over the set P and ZP∗ for access structure A, if π satisfies the following two polynomial-time algorithms:(1)
ShareA,ρ: the algorithm takes the shared secret s∈Zp∗ as input and randomly chooses a group of elements v2,v3,…,vn∈Zp∗ to generate a column vector v=s,v2,v3,…,vnT. Then, it outputs λ=Av. We define that Ai is the i-th row of matrix A so that λρi=Aiv is the element belonging to participant ρi.(2)
RecoverS: the algorithm sets a set S of participants as input. Then, we define another set I=i|ρi∈S. If S∈A, there will exist a group of constants ωi|i∈I, which can satisfy that ∑i∈Iωi⋅λρi=s. So, we can recover the secret. However, if S∉A, we cannot recover the right secret.


## 3.4. Commitment Scheme

The commitment scheme we used is based on Pedersen [31], which uses the discrete logarithm assumption. A commitment scheme is composed of three following algorithms:(1)
Setup1λ⟶params: this algorithm takes a security parameter 1λ as input and outputs the set of public parameters.(2)
Commitparams,M⟶com,decom: this algorithm takes the public parameter set params and a message M as input and outputs a commitment com and a decommitment decom, where decom can decommit com to M.(3)
Decommitparams,M,com,decom⟶0,1: this algorithm takes the public parameter set params, a message M, a commitment com, and a decommitment decom as input and outputs 1 if decom can decommit com to M; otherwise, the algorithm outputs 0.A commitment scheme must provide two properties of hiding and binding. The hiding property needs the messageM to keep unreleased until the user releases it. Other property only needs the decom to decommit the commitment com to M.


## 3.5. Zero-Knowledge Proof

The zero-knowledge proof scheme we used is based on [32]. By PoKa,b,c:y=gahb∧y˜=g˜ah˜c, we define a zero-knowledge proof of knowledge of a,b, and c, where y=gahb and y˜=g˜ah˜c respectively hold by the group G=<g>=<h> and G˜=<g˜>=<h˜>. Commonly, the values in the parenthesis represent the knowledge that needs to be proven, while the rest of the values are known by the verifier. There is an extractor that can be used to rewind the knowledge from the successful prover.


## 4. System and Security Model

### 4.1. System Model

In this paper, we propose a MA-ABE access control scheme for a blockchain-based supply chain information sharing system. The system model is shown in Figure1. Our system model considers five main participants: supply chain, data owner, blockchain, data users, and attribute authorities. The definition and functions of each participant are as follows:Supply chain: the supply chain is the source of all data. We assume the source data in a supply chain is correctly uploaded by suppliers, who record the data in materials production, product processing, logistics transportation, warehouse storage, goods purchasing, etc. Furthermore, because of the limited size of blockchain blocks, the supply chain data involved in this article only contains small-capacity data such as transaction records, cargo numbers, and logistics processes. For large-capacity data such as videos and images, we will not discuss in this paper, but we will do more researches on it in the future.Data Owner: the owner encrypts his/her goods’ supply chain information and sends encrypted data to the blockchain with the access policy. An access policy can be defined as follows: (Attribute 1: (Researcher identified by Authority 1)) OR (Attribute 2: (Analyst identified by Authority 2)) AND (Attribute 3: (User identified by Authority 3)), so only the users with Attributes 1 and 2 or the users with Attributes 1 and 2 can correctly decrypt owner’s ciphertext. Furthermore, the owner can update the encrypted data in a new block.Attribute Authorities: each attribute authority can generate and distribute attribute public keys based on data users’ attributes within the scope of the attributes it manages, such as phone numbers, identities, and affiliation. When data users’ attributes changed, the attribute authority has to change user attribute secret keys. In addition, attribute authority can create a block. It has to package the data owner’s encrypted data in the block and add it to the blockchain.Blockchain: blockchain is the distributed environment for storing data owner’s encrypted data in storage nodes and making it public to users who can connect to the blockchain system.Data Users: data users get their attribute secret keys from the attribute authorities and decrypt data owner’s encrypted data. However, only the users with the correct attribute secret keys can decrypt the ciphertext properly.Figure 1
MA-ABE access control system model.


### 4.2. Security Model

We letA be an adversary and C be a challenger, then the game between A and C will carry out as follows:GlobalSetup: C executes this algorithm and sends global parameter set gp to A. Then, A returns a group of corrupted authorities AA′⊆AA and gives the challenge access structure A∗=A∗,ρ∗, where AA is the set of all authorities.AuthoritySetup: challenger C obtains attribute authorities’ public and private keys and then sends the public keys to the adversary.Key Query Phase 1: adversary A queries the secret key by submitting a pair attri,GID to challenger C, where attri belongs to good authorities. Then, C responds by providing the relative secret keys. However, A cannot make queries on any attribute set which satisfies the access structure A. Besides, the request of GID cannot belong to the corrupted authorities.Challenge: adversary A transmits two messages with the same length, M0 and M1, and the access structure A∗=A∗,ρ∗ to challenger C. It is worth noting that every attributes of the corrupted authority set AU′ cannot satisfy A∗. C randomly selects a bit b∈0,1 and returns the encrypted data CTb of message Mb under the access structure A∗ to A.Key Query Phase 2: adversary A makes more key queries as long as the attribute sets do not satisfy the challenge access structure A∗.Guess: adversary A tries to guess whether the message Mb′ meets the encrypted data CTb. If b′=b, the advantage of adversary A to win this game is calculated as follows:(5)AdvA=Prb′=b−12.


## 4.1. System Model

In this paper, we propose a MA-ABE access control scheme for a blockchain-based supply chain information sharing system. The system model is shown in Figure1. Our system model considers five main participants: supply chain, data owner, blockchain, data users, and attribute authorities. The definition and functions of each participant are as follows:Supply chain: the supply chain is the source of all data. We assume the source data in a supply chain is correctly uploaded by suppliers, who record the data in materials production, product processing, logistics transportation, warehouse storage, goods purchasing, etc. Furthermore, because of the limited size of blockchain blocks, the supply chain data involved in this article only contains small-capacity data such as transaction records, cargo numbers, and logistics processes. For large-capacity data such as videos and images, we will not discuss in this paper, but we will do more researches on it in the future.Data Owner: the owner encrypts his/her goods’ supply chain information and sends encrypted data to the blockchain with the access policy. An access policy can be defined as follows: (Attribute 1: (Researcher identified by Authority 1)) OR (Attribute 2: (Analyst identified by Authority 2)) AND (Attribute 3: (User identified by Authority 3)), so only the users with Attributes 1 and 2 or the users with Attributes 1 and 2 can correctly decrypt owner’s ciphertext. Furthermore, the owner can update the encrypted data in a new block.Attribute Authorities: each attribute authority can generate and distribute attribute public keys based on data users’ attributes within the scope of the attributes it manages, such as phone numbers, identities, and affiliation. When data users’ attributes changed, the attribute authority has to change user attribute secret keys. In addition, attribute authority can create a block. It has to package the data owner’s encrypted data in the block and add it to the blockchain.Blockchain: blockchain is the distributed environment for storing data owner’s encrypted data in storage nodes and making it public to users who can connect to the blockchain system.Data Users: data users get their attribute secret keys from the attribute authorities and decrypt data owner’s encrypted data. However, only the users with the correct attribute secret keys can decrypt the ciphertext properly.Figure 1
MA-ABE access control system model.


## 4.2. Security Model

We letA be an adversary and C be a challenger, then the game between A and C will carry out as follows:GlobalSetup: C executes this algorithm and sends global parameter set gp to A. Then, A returns a group of corrupted authorities AA′⊆AA and gives the challenge access structure A∗=A∗,ρ∗, where AA is the set of all authorities.AuthoritySetup: challenger C obtains attribute authorities’ public and private keys and then sends the public keys to the adversary.Key Query Phase 1: adversary A queries the secret key by submitting a pair attri,GID to challenger C, where attri belongs to good authorities. Then, C responds by providing the relative secret keys. However, A cannot make queries on any attribute set which satisfies the access structure A. Besides, the request of GID cannot belong to the corrupted authorities.Challenge: adversary A transmits two messages with the same length, M0 and M1, and the access structure A∗=A∗,ρ∗ to challenger C. It is worth noting that every attributes of the corrupted authority set AU′ cannot satisfy A∗. C randomly selects a bit b∈0,1 and returns the encrypted data CTb of message Mb under the access structure A∗ to A.Key Query Phase 2: adversary A makes more key queries as long as the attribute sets do not satisfy the challenge access structure A∗.Guess: adversary A tries to guess whether the message Mb′ meets the encrypted data CTb. If b′=b, the advantage of adversary A to win this game is calculated as follows:(5)AdvA=Prb′=b−12.


## 5. Our Works

### 5.1. System Scheme

Our system scheme’s workflow is shown in Figure2. We divide the system workflow into five stages: Setup, Key Generation, Encrypt, Decrypt, and Revoke and Update. The details are as follows.(1)
Setup: multiple attribute authorities generate the system’s public parameters through theGlobalSetup algorithm and use the consensus algorithm to negotiate and reach an agreement. After that, each attribute authority executes the AuthoritySetup algorithm to create its public key and private key. At the same time, attribute tags are assigned to users according to their attributes, such as phone number, identification, and affiliation.(2)
Key generation: the attribute authority uses theKeyGen algorithm to generate the user’s public and private key according to the user’s attributes.(3)
Encrypt: the data owner uses the Encrypt algorithm to encrypt the access structure and data.(4)
Block generation: when the encrypted data need to be uploaded to the blockchain, the data owner broadcasts ciphertext to the blockchain network. When attribute authorities have collected enough ciphertexts, use a hash function to calculate the hash value of each ciphertext and construct a Merkle tree structure. Then, the attribute authority puts all ciphertexts into the block body and adds them into the blockchain along with the block. The structure of the block is shown as Figure3. Finally, storage nodes store the blockchain data. It is noted that the size of the block is related to the number and size of the ciphertext stored in the block body.(5)
Decrypt: the data user requests the data owner’s encrypted data from the blockchain node and decrypts it through theDecrypt algorithm.(6)
Revoke and update: the attribute authority center can use theKeyUpdate algorithm to update the user key flexibly according to the user’s attribute change. In addition, users can also update the encrypted data using the CTUpdate algorithm and pack it in a new block.Figure 2
System scheme workflow.Figure 3
Block structure.


### 5.2. Algorithm Construction

Like other schemes [33, 34], although our scheme is based on the composite-order bilinear group construction, the whole system is limited to subgroups Gp1. Subgroups Gp2 and Gp3 are only used in the security proof process to construct the semifunctional key and the semifunctional ciphertexts. Here, the specific seven main algorithms of the cryptography involved in our scheme are as follows:GlobalSetup1λ⟶gp.(1)
Letφ be an algorithm to generate composite-order bilinear groups. φ takes the security parameter 1λ as input and randomly selects number N=p1p2p3 as the order of the group G, where g1 is a generator of Gp1. Then, set h=g1μ, where μ∈ZN∗ is randomly chosen. We set H:0,1∗⟶ZN∗ and H′:0,1∗⟶G as two strong collision resistance hash functions for mapping random numbers to values in ZN∗ and G. Let e:G×G⟶GT be a bilinear map.(2)
The algorithm generates a user’s unique global indicatorGID in the system and uses the hash function H to get u=HGID∈ZN∗. Then, user public key will be represented as PKu=g1u.(3)
We define the set ofN attribute authorities as AA=AA1,AA2,…,AAN, where each attribute authority AAi manages its attribute set AA˜i.(4)
We setgp=e,g1,N,G,Gp1,H,H′,AA,AA˜,PKu.AuthoritySetupgp⟶PKi,SKi.Each attribute authorityAAi runs this algorithm. For attribute aj belonging to AAi, AAi chooses two random exponents αj,βj∈ZN∗. Then, AAi randomly selects a exponent γi for itself and gets its public key PKi and secret key SKi as follows:(6)SKi=αj,βjaj∈AA˜i,γi,PKi=eg1,g1αj,g1βjaj∈AA˜i,g1γi.Encryptgp,M,PKi,A⟶ct.(1)
Data owner executes theEncrypt algorithm and selects a LSSS-based access policy A=A,ρ, in which for each attribute aj involved, the owner sets a random number t∈ZN∗ and replaces aj as θj=eH′aj,g1γit in the LSSS matrix A,ρ.(2)
The algorithm firstly chooses a secrets∈ZN as the sharing secret. Then, it generates a random column vector v=s,v2,v3,…,vmT∈ZNm with s as the first element, where ∀i∈2,m,vi∈ZN.(3)
We setλx=Axv, where Ax is the x-th row of matrix A. Then, the algorithm generates another random column vector ω=0,ω2,ω3,…,ωmT∈ZNm with 0 as the first element, where ωx=Axω. For each row of the matrix A, the algorithm randomly selects rx∈ZN. At least, the encrypted data of the message M∈ZN can be defined as follows:(7)C0=Meg1,g1s,C1=g1tC1,x=eg1,g1λxeg1,g1αρxrx,C2,x=g1rx,C3,x=g1ωxg1βρxrx.Here,ct=C0,C1,C1,x,C2,x,C3,x.KeyGengp,PKi,SPi,A˜u,u,PKu⟶Ku,j.Attribute authorities use the anonymous key distribution protocol to generate the attribute secret keys to users. For each attributeai∈A˜ui=A˜u∩AA˜i, where A˜u is user u′s attributes set which is verified by authorities. Then, the user attribute secret keys Ku,j can be computed as follows:(8)K1=g1αjhβj/u+γi,K2=h1/u+γi,K3=H′ajγi.Here,K3 is used to hide the attribute aj, and Ku,j=K1,K2,K3.Decryptgp,ct,Ku,j⟶M.Each data user has to query the owner’s encrypted data (ciphertext) from blockchain and uses theDecrypt algorithm to get the original message M. Furthermore, data user can replace his/her attribute aj∈A˜ui by calculating θj=eK3,C1 in the access policy A. Then, the user gains a set X=x:ρx from A. Finally, the user chooses a constant cx∈ZN, which meets ∑x∈XcxAx=1,0,…,0. The Decrypt algorithm is run to decrypt the ciphertext ct. If the data user has the secret keys of each Ax, he/she will decrypt the ciphertext ct as follows:(9)M=C0ΠxC1,xeK2,C3,x/eK1,C2,xcx.KeyUpdatepg,aj,PKi,SKi,PKu⟶Ku,j′.Assume thataj is an attribute revoked and updated by the authority AAi. Then, AAi must regenerate a corresponding new user attribute secret key for aj through the following steps:(1)
AuthorityAAi regenerates two new attribute random exponents αj′,βj′∈ZN.(2)
For users who have the attributeaj, AAi calculates UKαj=αj−αj′,UKβj=βj−βj′.(3)
In the end, useru computes(10)K1′=K1g1UKαjK2UKβj,K2′=K2.CTUpdatect,A,UKαj,UKβj⟶ct′.If the access policyA,ρ involves the revoked and updated attribute aj, i.e., ρx=j, the data owner will update his/her ciphertext stored in a new block in blockchain. The ciphertext can be updated as follows:(11)C1,x′=C1,xeg1,g1UKαρxrx,C3,x′=C3,xC2,xUKβρx,C2,x′=C2,x.


### 5.3. Anonymous Key Generation Protocol

Algorithm 1 shows the anonymous key generation protocol built in this paper. The details of this algorithm are shown as follows:(1)
The data useru selects ρ,a1,a2∈ZN∗ randomly and calculates P=g11/ρ,Q=hu,P′=g1a1,Q′=ha2. Then, u sends P,Q,P′,Q′ to authority AAi.(2)
AAi chooses c∈ZN∗ randomly and returns it to u.(3)
u computes a1′=a1−c/ρ,a2′=a2−cu, and sends a1′ and a2′ to AAi.(4)
AAi verifies P′=Pcg1a1′ and Q′=Qcha2′. If they are verified rightly, AAi will continue. If not, AAi will abort.(5)
AAi computes η=γi+uρ by two-party secure computation (2PC Protocol).(6)
AAi generates b1,b2,b3∈ZN∗ randomly. Then, it calculates K1′=Pαjhβj/η,K2′=Q1/η,K1″=Pb1hb2,K2″=Qb3 and sends K1′,K2′,K1″,K2″ to u.(7)
u returns a random number t∈ZN∗ to AAi.(8)
AAi computes b1′=b1−tαj,b2′=b2−tβj/η,b3′=b3−t/η and returns b1′,b2′,b3′.(9)
u checks K1″=K1′g1b1′hb2′ and K2″=K2′hb3′. If verifications are correct, u will get his/her user attribute secret keys by calculating K1=K1′ and K2=K2′. Otherwise, u aborts.Algorithm 1: Anonymous key generation protocol.
(1) Useru has his/her global ID u=HGID.(2) AuthorityAAi has this identity γi∈ZN∗ and u’s attribute aj’s parameters αj,βj∈ZN∗.(3)u randomly chooses ρ∈ZN∗.(4)u computes P=g11/ρ,Q=hu,Poku,ρ:P∧Q and sends them to AAi.(5)u should proof he/she knows u,ρ in zero-knowledge(6)if the proof is successful then(7)AAi continues.(8)else(9)AAi aborts.(10)end if(11)u↔2PCprotocolAi : η=γi+uρ.(12)AAi computes K1′=Pαjhβj/η,K2′=h1/η,Pokαj,βj,η:K1′∧K2′ and sends them to u.(13)AAi proofs it knows αj,βj,η in zero-knowledge to Users(14)if the proof is successful then(15)u computes K1=K1′ and K2=K2′ as his/her user attribute secret keys.(16)else(17)u aborts.(18)end if


## 5.1. System Scheme

Our system scheme’s workflow is shown in Figure2. We divide the system workflow into five stages: Setup, Key Generation, Encrypt, Decrypt, and Revoke and Update. The details are as follows.(1)
Setup: multiple attribute authorities generate the system’s public parameters through theGlobalSetup algorithm and use the consensus algorithm to negotiate and reach an agreement. After that, each attribute authority executes the AuthoritySetup algorithm to create its public key and private key. At the same time, attribute tags are assigned to users according to their attributes, such as phone number, identification, and affiliation.(2)
Key generation: the attribute authority uses theKeyGen algorithm to generate the user’s public and private key according to the user’s attributes.(3)
Encrypt: the data owner uses the Encrypt algorithm to encrypt the access structure and data.(4)
Block generation: when the encrypted data need to be uploaded to the blockchain, the data owner broadcasts ciphertext to the blockchain network. When attribute authorities have collected enough ciphertexts, use a hash function to calculate the hash value of each ciphertext and construct a Merkle tree structure. Then, the attribute authority puts all ciphertexts into the block body and adds them into the blockchain along with the block. The structure of the block is shown as Figure3. Finally, storage nodes store the blockchain data. It is noted that the size of the block is related to the number and size of the ciphertext stored in the block body.(5)
Decrypt: the data user requests the data owner’s encrypted data from the blockchain node and decrypts it through theDecrypt algorithm.(6)
Revoke and update: the attribute authority center can use theKeyUpdate algorithm to update the user key flexibly according to the user’s attribute change. In addition, users can also update the encrypted data using the CTUpdate algorithm and pack it in a new block.Figure 2
System scheme workflow.Figure 3
Block structure.


## 5.2. Algorithm Construction

Like other schemes [33, 34], although our scheme is based on the composite-order bilinear group construction, the whole system is limited to subgroups Gp1. Subgroups Gp2 and Gp3 are only used in the security proof process to construct the semifunctional key and the semifunctional ciphertexts. Here, the specific seven main algorithms of the cryptography involved in our scheme are as follows:GlobalSetup1λ⟶gp.(1)
Letφ be an algorithm to generate composite-order bilinear groups. φ takes the security parameter 1λ as input and randomly selects number N=p1p2p3 as the order of the group G, where g1 is a generator of Gp1. Then, set h=g1μ, where μ∈ZN∗ is randomly chosen. We set H:0,1∗⟶ZN∗ and H′:0,1∗⟶G as two strong collision resistance hash functions for mapping random numbers to values in ZN∗ and G. Let e:G×G⟶GT be a bilinear map.(2)
The algorithm generates a user’s unique global indicatorGID in the system and uses the hash function H to get u=HGID∈ZN∗. Then, user public key will be represented as PKu=g1u.(3)
We define the set ofN attribute authorities as AA=AA1,AA2,…,AAN, where each attribute authority AAi manages its attribute set AA˜i.(4)
We setgp=e,g1,N,G,Gp1,H,H′,AA,AA˜,PKu.AuthoritySetupgp⟶PKi,SKi.Each attribute authorityAAi runs this algorithm. For attribute aj belonging to AAi, AAi chooses two random exponents αj,βj∈ZN∗. Then, AAi randomly selects a exponent γi for itself and gets its public key PKi and secret key SKi as follows:(6)SKi=αj,βjaj∈AA˜i,γi,PKi=eg1,g1αj,g1βjaj∈AA˜i,g1γi.Encryptgp,M,PKi,A⟶ct.(1)
Data owner executes theEncrypt algorithm and selects a LSSS-based access policy A=A,ρ, in which for each attribute aj involved, the owner sets a random number t∈ZN∗ and replaces aj as θj=eH′aj,g1γit in the LSSS matrix A,ρ.(2)
The algorithm firstly chooses a secrets∈ZN as the sharing secret. Then, it generates a random column vector v=s,v2,v3,…,vmT∈ZNm with s as the first element, where ∀i∈2,m,vi∈ZN.(3)
We setλx=Axv, where Ax is the x-th row of matrix A. Then, the algorithm generates another random column vector ω=0,ω2,ω3,…,ωmT∈ZNm with 0 as the first element, where ωx=Axω. For each row of the matrix A, the algorithm randomly selects rx∈ZN. At least, the encrypted data of the message M∈ZN can be defined as follows:(7)C0=Meg1,g1s,C1=g1tC1,x=eg1,g1λxeg1,g1αρxrx,C2,x=g1rx,C3,x=g1ωxg1βρxrx.Here,ct=C0,C1,C1,x,C2,x,C3,x.KeyGengp,PKi,SPi,A˜u,u,PKu⟶Ku,j.Attribute authorities use the anonymous key distribution protocol to generate the attribute secret keys to users. For each attributeai∈A˜ui=A˜u∩AA˜i, where A˜u is user u′s attributes set which is verified by authorities. Then, the user attribute secret keys Ku,j can be computed as follows:(8)K1=g1αjhβj/u+γi,K2=h1/u+γi,K3=H′ajγi.Here,K3 is used to hide the attribute aj, and Ku,j=K1,K2,K3.Decryptgp,ct,Ku,j⟶M.Each data user has to query the owner’s encrypted data (ciphertext) from blockchain and uses theDecrypt algorithm to get the original message M. Furthermore, data user can replace his/her attribute aj∈A˜ui by calculating θj=eK3,C1 in the access policy A. Then, the user gains a set X=x:ρx from A. Finally, the user chooses a constant cx∈ZN, which meets ∑x∈XcxAx=1,0,…,0. The Decrypt algorithm is run to decrypt the ciphertext ct. If the data user has the secret keys of each Ax, he/she will decrypt the ciphertext ct as follows:(9)M=C0ΠxC1,xeK2,C3,x/eK1,C2,xcx.KeyUpdatepg,aj,PKi,SKi,PKu⟶Ku,j′.Assume thataj is an attribute revoked and updated by the authority AAi. Then, AAi must regenerate a corresponding new user attribute secret key for aj through the following steps:(1)
AuthorityAAi regenerates two new attribute random exponents αj′,βj′∈ZN.(2)
For users who have the attributeaj, AAi calculates UKαj=αj−αj′,UKβj=βj−βj′.(3)
In the end, useru computes(10)K1′=K1g1UKαjK2UKβj,K2′=K2.CTUpdatect,A,UKαj,UKβj⟶ct′.If the access policyA,ρ involves the revoked and updated attribute aj, i.e., ρx=j, the data owner will update his/her ciphertext stored in a new block in blockchain. The ciphertext can be updated as follows:(11)C1,x′=C1,xeg1,g1UKαρxrx,C3,x′=C3,xC2,xUKβρx,C2,x′=C2,x.


## 5.3. Anonymous Key Generation Protocol

Algorithm 1 shows the anonymous key generation protocol built in this paper. The details of this algorithm are shown as follows:(1)
The data useru selects ρ,a1,a2∈ZN∗ randomly and calculates P=g11/ρ,Q=hu,P′=g1a1,Q′=ha2. Then, u sends P,Q,P′,Q′ to authority AAi.(2)
AAi chooses c∈ZN∗ randomly and returns it to u.(3)
u computes a1′=a1−c/ρ,a2′=a2−cu, and sends a1′ and a2′ to AAi.(4)
AAi verifies P′=Pcg1a1′ and Q′=Qcha2′. If they are verified rightly, AAi will continue. If not, AAi will abort.(5)
AAi computes η=γi+uρ by two-party secure computation (2PC Protocol).(6)
AAi generates b1,b2,b3∈ZN∗ randomly. Then, it calculates K1′=Pαjhβj/η,K2′=Q1/η,K1″=Pb1hb2,K2″=Qb3 and sends K1′,K2′,K1″,K2″ to u.(7)
u returns a random number t∈ZN∗ to AAi.(8)
AAi computes b1′=b1−tαj,b2′=b2−tβj/η,b3′=b3−t/η and returns b1′,b2′,b3′.(9)
u checks K1″=K1′g1b1′hb2′ and K2″=K2′hb3′. If verifications are correct, u will get his/her user attribute secret keys by calculating K1=K1′ and K2=K2′. Otherwise, u aborts.Algorithm 1: Anonymous key generation protocol.
(1) Useru has his/her global ID u=HGID.(2) AuthorityAAi has this identity γi∈ZN∗ and u’s attribute aj’s parameters αj,βj∈ZN∗.(3)u randomly chooses ρ∈ZN∗.(4)u computes P=g11/ρ,Q=hu,Poku,ρ:P∧Q and sends them to AAi.(5)u should proof he/she knows u,ρ in zero-knowledge(6)if the proof is successful then(7)AAi continues.(8)else(9)AAi aborts.(10)end if(11)u↔2PCprotocolAi : η=γi+uρ.(12)AAi computes K1′=Pαjhβj/η,K2′=h1/η,Pokαj,βj,η:K1′∧K2′ and sends them to u.(13)AAi proofs it knows αj,βj,η in zero-knowledge to Users(14)if the proof is successful then(15)u computes K1=K1′ and K2=K2′ as his/her user attribute secret keys.(16)else(17)u aborts.(18)end if


## 6. Security Analysis

### 6.1. Correction

#### 6.1.1. Correction of Decryption

We assume that(12)X=C1,xeK2,C3,x=eg1,g1λxeg1,g1αρxrxeg1,g1ωx+βρxrx/γi+u,Y=eK1,C2,x=eg1,g1αρxrxeg1,g1βρxrx/γi+u.So, we can compute(13)ΠxXYcx=Πxeg1,g1λxeg1,g1ωx/γi+ucx=eg1,g1veg1,g1ω/γi+uΣxcxAx=eg1,g1av+aω/γi+u=eg1,g1s.Also, we can getC0/ΠxX/Ycx=M, in which a=1,0,…,0T.


### 6.2. Correction of Update

(1)
K1/g1UKαjK2UKβj=g1αjhβj/γi+u/g1αj−αj′hβj−βj′/γi+u=g1αj′hβj′/γj+u=K1′.(2)
C1,x/eg1,g1UKαρxrx=eg1,g1λxeg1,g1αρxrx/eg1,g1rxαρx−αρx′=eg1,g1λxeg1,g1αρx′rx=C1,x′.(3)
C3,x/C2,xUKβρx=g1ωxg1βρxrx/g1rxβρx−βρx′=g1ωxg1βρxrx′=C3,x′.


### 6.3. Security of Our Scheme

In this paper, the dual-system encryption [35] is applied to prove the security of our scheme. We refer to the proof method in [29, 36, 37]. In the dual-system encryption technology, secret keys and ciphertexts are divided into two forms: normal and semifunctional. It is noteworthy that a normal key can decrypt normal ciphertexts and semifunctional ciphertexts, while a semifunctional key can only decrypt normal ciphertexts, but it cannot decrypt semifunctional ciphertexts. In addition, the semifunctional key and ciphertext only exist in the security certification, and they will not appear in the actual system application. To more accurately describe the semifunctional ciphertext and the semifunctional key, we select two fixed random values zj,tj∈ZN for each attribute aj, and these two random numbers are the same for the semifunctional ciphertexts and the semifunctional keys, and they will not be changed by different users.


#### 6.3.1. Semifunctional Ciphertext

To generate the semifunctional ciphertext, we randomly chooseg2∈G2,g3∈G3,u2∈ZNm,u3∈ZNm. Then, we set δx=Axu2,σx=Axu3 for each row Ax in the access policy matrix A. In addition, we set B as the subset of related rows, which is marked by corrupted attribute authorities in A, and we set B¯ as the subset of rows marked by good attribute authorities in A. Three exponents ax,bx,cx∈ZN are chosen randomly.At first, we set the original ciphertext as follows:(14)C0′=Meg1,g1s,C1′=g1tC1,x′=eg1,g1λxeg1,g1αρxrxC2,x′=g1rx,C3,x′=g1ωxg1βρxrx.For eachx, if Ax∈B, the semifunctional ciphertext will be computed as follows:(15)C0=C0′,C1=C1′,C1,x=C1,x′,C2,x=C2,x′,C3,x=C3,x′g2δxg3σx.For eachx, if Ax∈B¯, the semifunctional ciphertext will be computed as follows:(16)C0=C0′,C1=C1′,C1,x=C1,x′,C2,x=C2,x′g2axg3bx,C3,x=C3,x′g2δx+axzρxg3σx+bxtρx.


#### 6.3.2. Semifunctional Key

There are two kinds of semifunctional keys, namely, type-1 and type-2. We setHu=h1/u+γi as the value in the subgroup Gp1 of G and select an exponent c∈ZN at random.The type-1 semifunctional key is calculated as follows:(17)K2=Hug2c,K1=K1′g2czj.The type-2 semifunctional key is calculated as follows:(18)K2=Hug3c,K1=K1′g3ctj.Here,K1′=g1αjhβj/u+γi is the normal key.When we apply a type-1 semifunctional key to decrypt a semifunctional ciphertext, the extra parteg2,g2cδx will prevent the ciphertext from being directly decrypted unless δx=0. Similarly, when we apply a type-2 semifunctional key to decrypt a semifunctional ciphertext, the extra part eg3,g3cσx will prevent the ciphertext from being directly decrypted unless σx=0.


#### 6.3.3. Attack Games

The games we used in this paper are defined as follows:Gamereal: this game is a real game, where the ciphertext and user secret key are normal.Game0: comparing with Gamereal, the challenging ciphertext is a semifunctional.Gamej,1: comparing with Game0, the first j−1 keys obtained are type-2 semifunctional keys, while the j-th key is the type-1 semifunctional key, and other keys are normal keys. In addition, the challenging ciphertext is the semifunctional ciphertext. If q is the number of times that the adversary A queries for the key, the range of j will be 1 to q.Gamej,2: comparing with Game0, the first j keys obtained are type-2 semifunctional keys, while other keys are normal. Moreover, the challenging ciphertext is the semifunctional ciphertext, and all keys in Gameq,2 are type-2 semifunctional keys.Game final: in this game, all keys are type-2 semifunctional keys, and the ciphertext is a semifunctional ciphertext of a random message. We can get that the adversary A has no advantage in winning the game.


### 6.4. Lemma1 and Its Proof

Lemma 1.
If there is a polynomial-time algorithmA that can distinguish Gamereal and Game0 at the nonnegligible advantage ε, another polynomial-time algorithm ℬ will be constructed to break Assumption 1 with the advantage ε.


#### 6.4.1. Proof

GlobalSetup: challenger C runs the GlobalSetup algorithm. Simulator ℬ receives the global parameter gp=e,g1,h,p1,p2,p3,G,GT,H,H′ from the challenger C and simulates Gamereal or Game0 between the adversary A and ℬ. A specifies a set of corrupted attribute authorities AA˜∈AA, where AA represents the set of all attribute authorities in the system. Then, A develops an access structure A=A,ρ that he/she needs to challenge.AuthoritySetup: ℬ executes the AuthoritySetup algorithm. For the corrupted attribute authorities, ℬ sends their public and private keys to A, and for good attribute authorities, ℬ only sends its public key to A.Key Query Phase 1: when A queries the key of aj,GID, ℬ runs the KeyGen algorithm to generate the related keys.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=Meg1,g1s. ℬ also selects two random column vectors v=s,v2,v3,…,vm∈ZNm and φ=0,φ2,φ3,…,φm∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ, where Ax is the x-th row in the matrix A.A provides ℬ with the random parameters g1αj,g1βj for the attribute aj contained in the access structure A,ρ, which belongs to the corrupted attribute authorities. Here, B represents a subset of the relevant rows of attributes with good attribute authorities in A, while B¯ represents a subset of the relevant rows with corrupted attribute authorities in A. For each Ax in B, ℬ randomly selects rx∈ZN and relatively selects rx′∈ZN for each Ax in B¯, where rx=rrx′. We set the Gp1 part of T as g1r, the Gp2 part as g2c, and the Gp3 part as g3d, where r,c,d∈ZN are selected randomly.ForAx∈B, the ciphertexts are computed as follows:(19)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=g1rx,C3,x=Tωxg1βρxrx.ForAx∈B¯, the ciphertexts are computed as follows:(20)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=Trx′,C3,x=TωxTβρxrx′.A ciphertext is generated in two cases:Ax∈B and Ax∈B¯. If T∈Gp1, it will be a normal ciphertext. When T∈G, it is a semifunctional ciphertext. Due to T∈Gp1 and T∈G are indistinguishable, the game Gamereal and Game0 cannot be distinguished. The proof is shown as follows:(1)
WhenT∈Gp1, the Gp1 part of T is g1r. For each Ax∈B, Tωx=g1rωx=g1Axrφ, because the first random value of the vector φ is 0, we make the ciphertext C3,x a normal ciphertext. For each Ax∈B¯, C2,x and C3,x are normal ciphertexts, because of Trx′=g1rrx′=g1rx and rx=rrx′. Finally, we can get that when T∈Gp1, all ciphertexts are normal.WhenT∈G, we can know that T=g1rg2cg3d. If Ax∈B, Tωx=g1Axrφg2Axcφg3Axdφ in the ciphertext C3,x. In the semifunctional ciphertext, δx=Ax⋅cφmodp2 and σx=Ax⋅dφmodp3, so C3,x can be seen as a semifunctional ciphertext.According to the remainder theorem, ifAx∈B¯, amodp1,amodp2, and amodp3 will be uncorrelated for a random value a. We can set exponents ax=crx′modp2,bx=drx′modp3,zρx=βρxmodp2, and tρx=βρxmodp3. Because ax,bx,zρx and tρx of g2 and g3 are all distributed randomly, C2,x and C3,x are semifunctional ciphertexts.(2)
In a semifunctional ciphertext, we can getδx=Axu2 and σx=Axu3, where u2 and u3 are random vectors. In this game, the first element of φ is 0, and adversary A cannot distinguish whether the value is random or not.WhenAx∈B, according to the monotone span program [36], we can know that φ=0,φ2,…,φm and φ′=φ1,φ2,…,φm can generate the same secret-sharing value, which means adversary A cannot figure out whether the first element is 0 or another φ1.WhenAx∈B¯, zρx is random in δx+axzρx. If axmodp2≠0, the exponent δx of g2 will be represented by zρx. So, the secret-sharing value can be hidden, and the shared value δx is appropriately distributed from the perspective of adversary A. The exponent σx of g3 is still appropriately distributed for the same reason.Therefore, whenT∈Gp1, ciphertexts are normal and simulator ℬ can simulate the Gamereal. When T∈G, ciphertexts are semifunctional and simulator ℬ can simulate the Game0. ℬ can use A to break Assumption 1 with advantage ε.


### 6.5. Lemma2 and Its Proof

Lemma 2.
If there is a polynomial-time algorithmA that can distinguish Gamej−1,2 and Gamej,1 at the nonnegligible advantage ε, then another polynomial-time algorithm B can be constructed to break Assumption 2 with the advantage ε.


#### 6.5.1. Proof

The proof of Lemma2 is similar to that of Lemma 1, but challenger C needs to send the public parameter g1,g3,X1X2,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 1. According to the difference of T, A and ℬ will simulate Gamej−1,2 and Gamej,1. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi,βi∈ZN and sends the public key to A.Key Query Phase 1: assume that GIDk indicates the identity of the k-th user queried by adversary A, which means A performs a key query ai,GIDk. Then, ℬ needs to perform the following feedback:Whenk>j, K2′=Hu=g11/γh+u,K1′=K1=g1αig1βi/γh+u, where K1′ is normal.Whenk<j, K2′=Hu=g1g31/γh+u,K1′=K1g3ctj=g1αig1g3βi/γh+u, where K1′ is semifunctional of type-2, and c=1/γh+u,ti=βi.Whenk=j, if T∈Gp1, let T=g1θ1, then K2′=Hu=T1/γh+u and K1′=Tβi/γh+ug1αi, where K1′ is normal; if T∈Gp1p2, let T=g1θ2g2θ3, then K2′=T1/γh+u=H′ug2c=g1θ2/γh+ug2θ3/γh+u and K1′=Tβi/γh+ug1αi=K1g2czi, where K1′ is semifunctional of type-1, and c=θ3/γh+u,zi=βi.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=Meg1,g1s; ℬ selects three random column vectors v=s,v2,v3,…,vm∈ZNm,φ=0,φ2,φ3,…,φm∈ZNm and u=u1,u2,…,um∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ, where Ax is the x-th row in the matrix A. The definitions of B and B¯ are the same as in the proof of Lemma 1.IfAx∈B, ℬ randomly selects rx∈ZN for each Ax in B. Then, ciphertexts can be computed as follows:(21)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=C2,x′=g1rx,C3,x=X1X2ωxg1βρxrxg3ηx=C3,x′g2cωxg3ηx.IfAx∈B¯, ℬ randomly selects rx,φx,φx′∈ZN for each Ax in B¯, where rx=rrx′,ωx=rωx′, then ciphertexts are as follows:(22)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=X1X2rx′g3φx=g1rxX2r′xg3φx,C3,x=X1X2ωx′X1X2βρxrx′g3βρxφxg3ηx=C3,x′g2cωx′+cβρxrx′g3βρxφx+ηx.(1)
The proof method of the first aspect is the same as Lemma1.IfAx∈B, C3,x=X1X2ωxg1βρxrxg3ηx, where X1ωx and X2ωx are g1Axrφ and g2Axcφ, so we can set the exponent δx=Ax⋅cφmodp2 and σx=Ax⋅umodp3 of g2 and g3, so C3,x is semifunctional.IfAx∈B¯, C2,x=X1X2rx′g3φx=g1rrx′g2crx′g3φx, the exponents of g1,g2, and g3 will be random, because rx′modp2 and rx′modp3 are uncorrelated. Therefore, we can set ax=crx′modp2,bx=φxmodp3. C3,x=C3,x′g2cωx′+crx′βρxg3αρxφx+σx, where we can set zρx=βρxmodp2,tρx=βρxmodp3,δx=cωx′modp2. So, ciphertexts are semifunctional.(2)
The proof method of the second aspect is the same as Lemma1 too.In dual-system encryption, both the simulatorℬ and the adversary A are required to be unable to determine whether the key is a semifunctional key. Even though the secret-sharing value of δx is hidden from A, the secret-sharing value needs to be set to 0. By setting the secret-sharing value of δx to 0, the ciphertext generated by ℬ is a nominal semifunctional ciphertext. In this way, if ℬ wants to test whether the j-th key is a semifunctional key or a normal key, it will generate challenge ciphertexts that this key can decrypt. However, the ciphertexts are all nominal semifunctional ciphertexts, and users can successfully decrypt them. In other words, ℬ cannot tell whether the j-th key is a semifunctional key of type-1 or a normal key.Therefore, whenT∈Gp1, the keys are normal and simulator ℬ can simulate the Gamej−1,2. When T∈Gp1p2, keys are semifunctional keys of type-1 and simulator ℬ can simulate the Gamej,1. ℬ can use A to break Assumption 2 with advantage ε.


### 6.6. Lemma3 and Its Proof

Lemma 3.
If there is a polynomial-time algorithmA that can distinguish Gamej,1 and Gamej,2 at the nonnegligible advantage ε, another polynomial-time algorithm ℬ will be constructed to break Assumption 3 with the advantage ε.


#### 6.6.1. Proof

The proof of Lemma3 is similar to that of Lemma 3, but challenger C needs to send the public parameter N,g1,X1X3,Y2Y3,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 2. According to the difference of T, A and ℬ will simulate Gamej,1 and Gamej,2. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi,βi∈ZN and sends the public key to A.Key Query Phase 1: assume that GIDk indicates the identity of the k-th user queried by adversary A, which means A performs a key query ai,GIDk. Then, ℬ needs to perform the following feedback:Whenk>j, K2′=Hu=g11/γh+u,K1′=K1=g1αig1βi/γh+u, where K1′ is normal.Whenk<j, K2′=Hu=X1X31/γh+u=g1r/γh+ug3d/γh+u,K1′=K1g3ctj=g1αiX1X3βi/γh+u=g1αig1rβi/γh+ug3dβi/γh+u, where K1′ is semifunctional of type-2, and c=1/γh+u,ti=βi.Whenk=j, if T∈Gp1p2, let T=g1θ1g2θ2, then K2′=Hu=T1/γh+u=g1θ1/γh+ug2θ2/γh+u and K1′=Tβi/γh+ug1αi=g1αig1θ1βi/γh+ug2θ2βi/γh+u, where K1′ is the semifunctional key of type-1, where c=θ2/γh+u,zi=βi; if T∈Gp1p3, let T=g1θ3g3θ4, then K2′=T1/γh+u=H′ug2c=g1θ2/γh+ug3θ4/γh+u and K1′=Tβi/γh+ug1αi=g1αig1θ3βi/γh+ug3θθ4βiγh+u=K1g2cti, where K1′ is semifunctional of type-2, and c=θ4/γh+u,ti=βi.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN, sets C0=Meg1,g1s, and chooses three random column vectors v=s,v2,v3,…,vm∈ZNm,φ=0,φ2,φ3,…,φm∈ZNm and u=u1,u2,…,um∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ. The definition of B and B¯ is the same as in the proof of Lemma 2.IfAx∈B, ℬ will randomly choose ηx,rx∈ZN. Then, the ciphertexts can be calculated as follows:(23)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=C2,x′,C3,x=g1ωxg1βρxrxY2Y3ηx.IfAx∈B¯, ℬ will randomly choose rx′,ωx′,φx∈ZN, where rx=rrx′,ωx=rωx′. Then, the ciphertexts can be calculated as follows:(24)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=Y2Y3rxg1rx,C3,x=Y2Y3σxY2Y3βρxrxg1βρxrxg1ωx.Similar to the proof of Lemma2, we can set Y2=g2t,Y3=g3p.(1)
IfAx∈B, C3,x=g1ωxg1βρxrxY2Y3ωx=C3,x′g2tσxg3pσx, the exponents of g2 and g3 will be random, because ηxmodp2 and ηxmodp3 are uncorrelated, where δx=tηxmodp2,σx=pηxmodp3. So, ciphertexts are semifunctional.IfAx∈B¯, C2,x=Y2Y3rxg1rx=g1rxg2trxg3prx, the exponents of g2 and g3 will be computed as ax=trxmodp2,bx=prxmodp3. C3,x=Y2Y3σxY2Y3βρxrxg1βρxrxg1ωx=C3,x′g2tσx+tβρxrxg3pσx+tβρxrx, and the exponents of g2 and g3 will be computed as zρx=βρxmodp2,tρx=βρxmodp3. So, ciphertexts are semifunctional.(2)
Whenk=j, the key is a semifunctional key. So, whether it is a type-1 semifunctional key or a type-2 one, the ciphertexts cannot be decrypted, which means that the key is indistinguishable.Therefore, whenGp1p2, the keys are normal and simulator ℬ can simulate the Gamej,1. When T∈Gp1p3, keys are semifunctional keys of type-1 and simulator ℬ can simulate the Gamej,2. ℬ can use A to break Assumption 3 with advantage ε.


### 6.7. Lemma4 and Its Proof

Lemma 4.
If there is a polynomial-time algorithmA that can distinguish Gameq,2 and Gamefinal at the nonnegligible advantage ε, another polynomial-time algorithm ℬ will be constructed to break Assumption 4 with the advantage ε.


#### 6.7.1. Proof

The proof of Lemma4 is similar to that of Lemma 3, but challenger C needs to send the public parameter N,g1,g2,g3,g1a,g1bg3b,g1c,g1acg3d,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 2. According to the difference of T, A and ℬ will simulate Gameq,2 and Gamefinal. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi′,βi′∈ZN and sends the public key to A. We set eg1,g1αi=eg1,g1bg3beg1,g1αi′ and g1βi=g1βi′, where βi=b+βi′.Key Query Phase 1: when A performs a key query ai,GID, ℬ needs to generate the following keys:(25)K2′=Hu=g1bg3b1/γh+u=g1b/γh+ug3b/γh+u,K1′=g1bg3bβi/γh+ug1αi=g1bβi/γh+ug1αig3bβi/γh+u.We can setc=b/γh+u and ti=βi, so keys are type-2 semifunctional keys.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=MbT, where s=abc. If T=eg1,g1abc, it will be the encryption of message Mb. Otherwise, it will be the encryption of a random message. The definition of B and B¯ is the same as them in the proof of Lemma 3.IfAx∈B¯, ℬ will randomly choose two random vectors v1 and v2, where 1 and 0 are the first elements of them, respectively. According to the nature of the complexity assumption [34], we can find a vector with 1 as the first element, which can be orthogonal to all the rows in B.We setv=abcv1+v2 and λx=Axv=abcAxv1+Axv2. For each row Ax∈B¯, ℬ randomly selects rx′∈ZN and lets rx=−acAxv1+rx′.So, we can getλx+αρxrx=abcAxv1+Axv2+b+αρx′−acAxv1+rx′=Axv2+brx′−acαρx′Axv1+rx′αρx′. We define C1,x as follows:(26)C1,x=eg1,g1bg3brx′eg1a,g1c−αρx′Axv1eg1,g1Axv2+rx′αρx′ℬ randomly generates two vectors φ=0,φ2,…,φm∈ZNm,u=u1,u2,…,um∈ZNm and a number φx∈ZN, where ωx=Axφ,σx=Axu. We define C2,x as follows:(27)C2,x=g1acg3d−Axv1g1rx′g2φx=g1−acAxv1+rx′g2φxg3−dAxv1,where rx=−acAxv1+rx′,ax=φx and bx=−dAxv1 are the exponents of g1,g2, and g3. ℬ randomly chooses ηx∈ZN. Then, C3,x can be computed as follows:(28)C3,x=g1acg3d−Axv1βρx′g1rx′βρx′g1ωxg2ηx+βρx′φxg3ηx=g1−acAxv1βρx′+rx′βρx′g1ωxg2ηx+βρx′φxg3ηx−dAxv1βρx′,where ηx and γρx′ are uncorrelated under modp2 and modp3. So, we can get that δx=ηxmodp2,zρx=βρx′modp2,σx=ηxmodp3, and tρx=βρx′modp3 are random. Therefore, ciphertexts are semifunctional.IfAx∈B, ℬ will randomly choose rx∈ZN, and ciphertexts can be computed as follows:(29)C1,x=eg1,g1λxeg1,g1αρxrxC2,x=g1rx,C3,x=g1ωxg1βρxg2ηxg3ηx.Becauseηxmodp2 and ηxmodp3 are uncorrelated, these ciphertexts are normal.Ifs=abc, ciphertexts will be semifunctional ciphertexts, which are properly distributed. If T=eg1,g1abc is the semifunctional encryption of the message Mb, the game ℬ will simulate Gameq,2. In addition, if T is random, ℬ will simulate Gamefinal. Therefore, ℬ can use A to break Assumption 4 with advantage ε.So, in the final attack game of Lemma4, when the challenger C encrypts a random message, the adversary’s attack advantage is negligible. As a result, according to the defined Assumptions 1–4, we can prove that real attack games and the above attack games are indistinguishable. Thus, it proves that the adversary’s advantage in winning the real attack game is negligible.


## 6.1. Correction

### 6.1.1. Correction of Decryption

We assume that(12)X=C1,xeK2,C3,x=eg1,g1λxeg1,g1αρxrxeg1,g1ωx+βρxrx/γi+u,Y=eK1,C2,x=eg1,g1αρxrxeg1,g1βρxrx/γi+u.So, we can compute(13)ΠxXYcx=Πxeg1,g1λxeg1,g1ωx/γi+ucx=eg1,g1veg1,g1ω/γi+uΣxcxAx=eg1,g1av+aω/γi+u=eg1,g1s.Also, we can getC0/ΠxX/Ycx=M, in which a=1,0,…,0T.


## 6.1.1. Correction of Decryption

We assume that(12)X=C1,xeK2,C3,x=eg1,g1λxeg1,g1αρxrxeg1,g1ωx+βρxrx/γi+u,Y=eK1,C2,x=eg1,g1αρxrxeg1,g1βρxrx/γi+u.So, we can compute(13)ΠxXYcx=Πxeg1,g1λxeg1,g1ωx/γi+ucx=eg1,g1veg1,g1ω/γi+uΣxcxAx=eg1,g1av+aω/γi+u=eg1,g1s.Also, we can getC0/ΠxX/Ycx=M, in which a=1,0,…,0T.


## 6.2. Correction of Update

(1)
K1/g1UKαjK2UKβj=g1αjhβj/γi+u/g1αj−αj′hβj−βj′/γi+u=g1αj′hβj′/γj+u=K1′.(2)
C1,x/eg1,g1UKαρxrx=eg1,g1λxeg1,g1αρxrx/eg1,g1rxαρx−αρx′=eg1,g1λxeg1,g1αρx′rx=C1,x′.(3)
C3,x/C2,xUKβρx=g1ωxg1βρxrx/g1rxβρx−βρx′=g1ωxg1βρxrx′=C3,x′.


## 6.3. Security of Our Scheme

In this paper, the dual-system encryption [35] is applied to prove the security of our scheme. We refer to the proof method in [29, 36, 37]. In the dual-system encryption technology, secret keys and ciphertexts are divided into two forms: normal and semifunctional. It is noteworthy that a normal key can decrypt normal ciphertexts and semifunctional ciphertexts, while a semifunctional key can only decrypt normal ciphertexts, but it cannot decrypt semifunctional ciphertexts. In addition, the semifunctional key and ciphertext only exist in the security certification, and they will not appear in the actual system application. To more accurately describe the semifunctional ciphertext and the semifunctional key, we select two fixed random values zj,tj∈ZN for each attribute aj, and these two random numbers are the same for the semifunctional ciphertexts and the semifunctional keys, and they will not be changed by different users.


### 6.3.1. Semifunctional Ciphertext

To generate the semifunctional ciphertext, we randomly chooseg2∈G2,g3∈G3,u2∈ZNm,u3∈ZNm. Then, we set δx=Axu2,σx=Axu3 for each row Ax in the access policy matrix A. In addition, we set B as the subset of related rows, which is marked by corrupted attribute authorities in A, and we set B¯ as the subset of rows marked by good attribute authorities in A. Three exponents ax,bx,cx∈ZN are chosen randomly.At first, we set the original ciphertext as follows:(14)C0′=Meg1,g1s,C1′=g1tC1,x′=eg1,g1λxeg1,g1αρxrxC2,x′=g1rx,C3,x′=g1ωxg1βρxrx.For eachx, if Ax∈B, the semifunctional ciphertext will be computed as follows:(15)C0=C0′,C1=C1′,C1,x=C1,x′,C2,x=C2,x′,C3,x=C3,x′g2δxg3σx.For eachx, if Ax∈B¯, the semifunctional ciphertext will be computed as follows:(16)C0=C0′,C1=C1′,C1,x=C1,x′,C2,x=C2,x′g2axg3bx,C3,x=C3,x′g2δx+axzρxg3σx+bxtρx.


### 6.3.2. Semifunctional Key

There are two kinds of semifunctional keys, namely, type-1 and type-2. We setHu=h1/u+γi as the value in the subgroup Gp1 of G and select an exponent c∈ZN at random.The type-1 semifunctional key is calculated as follows:(17)K2=Hug2c,K1=K1′g2czj.The type-2 semifunctional key is calculated as follows:(18)K2=Hug3c,K1=K1′g3ctj.Here,K1′=g1αjhβj/u+γi is the normal key.When we apply a type-1 semifunctional key to decrypt a semifunctional ciphertext, the extra parteg2,g2cδx will prevent the ciphertext from being directly decrypted unless δx=0. Similarly, when we apply a type-2 semifunctional key to decrypt a semifunctional ciphertext, the extra part eg3,g3cσx will prevent the ciphertext from being directly decrypted unless σx=0.


### 6.3.3. Attack Games

The games we used in this paper are defined as follows:Gamereal: this game is a real game, where the ciphertext and user secret key are normal.Game0: comparing with Gamereal, the challenging ciphertext is a semifunctional.Gamej,1: comparing with Game0, the first j−1 keys obtained are type-2 semifunctional keys, while the j-th key is the type-1 semifunctional key, and other keys are normal keys. In addition, the challenging ciphertext is the semifunctional ciphertext. If q is the number of times that the adversary A queries for the key, the range of j will be 1 to q.Gamej,2: comparing with Game0, the first j keys obtained are type-2 semifunctional keys, while other keys are normal. Moreover, the challenging ciphertext is the semifunctional ciphertext, and all keys in Gameq,2 are type-2 semifunctional keys.Game final: in this game, all keys are type-2 semifunctional keys, and the ciphertext is a semifunctional ciphertext of a random message. We can get that the adversary A has no advantage in winning the game.


## 6.3.1. Semifunctional Ciphertext

To generate the semifunctional ciphertext, we randomly chooseg2∈G2,g3∈G3,u2∈ZNm,u3∈ZNm. Then, we set δx=Axu2,σx=Axu3 for each row Ax in the access policy matrix A. In addition, we set B as the subset of related rows, which is marked by corrupted attribute authorities in A, and we set B¯ as the subset of rows marked by good attribute authorities in A. Three exponents ax,bx,cx∈ZN are chosen randomly.At first, we set the original ciphertext as follows:(14)C0′=Meg1,g1s,C1′=g1tC1,x′=eg1,g1λxeg1,g1αρxrxC2,x′=g1rx,C3,x′=g1ωxg1βρxrx.For eachx, if Ax∈B, the semifunctional ciphertext will be computed as follows:(15)C0=C0′,C1=C1′,C1,x=C1,x′,C2,x=C2,x′,C3,x=C3,x′g2δxg3σx.For eachx, if Ax∈B¯, the semifunctional ciphertext will be computed as follows:(16)C0=C0′,C1=C1′,C1,x=C1,x′,C2,x=C2,x′g2axg3bx,C3,x=C3,x′g2δx+axzρxg3σx+bxtρx.


## 6.3.2. Semifunctional Key

There are two kinds of semifunctional keys, namely, type-1 and type-2. We setHu=h1/u+γi as the value in the subgroup Gp1 of G and select an exponent c∈ZN at random.The type-1 semifunctional key is calculated as follows:(17)K2=Hug2c,K1=K1′g2czj.The type-2 semifunctional key is calculated as follows:(18)K2=Hug3c,K1=K1′g3ctj.Here,K1′=g1αjhβj/u+γi is the normal key.When we apply a type-1 semifunctional key to decrypt a semifunctional ciphertext, the extra parteg2,g2cδx will prevent the ciphertext from being directly decrypted unless δx=0. Similarly, when we apply a type-2 semifunctional key to decrypt a semifunctional ciphertext, the extra part eg3,g3cσx will prevent the ciphertext from being directly decrypted unless σx=0.


## 6.3.3. Attack Games

The games we used in this paper are defined as follows:Gamereal: this game is a real game, where the ciphertext and user secret key are normal.Game0: comparing with Gamereal, the challenging ciphertext is a semifunctional.Gamej,1: comparing with Game0, the first j−1 keys obtained are type-2 semifunctional keys, while the j-th key is the type-1 semifunctional key, and other keys are normal keys. In addition, the challenging ciphertext is the semifunctional ciphertext. If q is the number of times that the adversary A queries for the key, the range of j will be 1 to q.Gamej,2: comparing with Game0, the first j keys obtained are type-2 semifunctional keys, while other keys are normal. Moreover, the challenging ciphertext is the semifunctional ciphertext, and all keys in Gameq,2 are type-2 semifunctional keys.Game final: in this game, all keys are type-2 semifunctional keys, and the ciphertext is a semifunctional ciphertext of a random message. We can get that the adversary A has no advantage in winning the game.


## 6.4. Lemma1 and Its Proof

Lemma 1.
If there is a polynomial-time algorithmA that can distinguish Gamereal and Game0 at the nonnegligible advantage ε, another polynomial-time algorithm ℬ will be constructed to break Assumption 1 with the advantage ε.


### 6.4.1. Proof

GlobalSetup: challenger C runs the GlobalSetup algorithm. Simulator ℬ receives the global parameter gp=e,g1,h,p1,p2,p3,G,GT,H,H′ from the challenger C and simulates Gamereal or Game0 between the adversary A and ℬ. A specifies a set of corrupted attribute authorities AA˜∈AA, where AA represents the set of all attribute authorities in the system. Then, A develops an access structure A=A,ρ that he/she needs to challenge.AuthoritySetup: ℬ executes the AuthoritySetup algorithm. For the corrupted attribute authorities, ℬ sends their public and private keys to A, and for good attribute authorities, ℬ only sends its public key to A.Key Query Phase 1: when A queries the key of aj,GID, ℬ runs the KeyGen algorithm to generate the related keys.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=Meg1,g1s. ℬ also selects two random column vectors v=s,v2,v3,…,vm∈ZNm and φ=0,φ2,φ3,…,φm∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ, where Ax is the x-th row in the matrix A.A provides ℬ with the random parameters g1αj,g1βj for the attribute aj contained in the access structure A,ρ, which belongs to the corrupted attribute authorities. Here, B represents a subset of the relevant rows of attributes with good attribute authorities in A, while B¯ represents a subset of the relevant rows with corrupted attribute authorities in A. For each Ax in B, ℬ randomly selects rx∈ZN and relatively selects rx′∈ZN for each Ax in B¯, where rx=rrx′. We set the Gp1 part of T as g1r, the Gp2 part as g2c, and the Gp3 part as g3d, where r,c,d∈ZN are selected randomly.ForAx∈B, the ciphertexts are computed as follows:(19)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=g1rx,C3,x=Tωxg1βρxrx.ForAx∈B¯, the ciphertexts are computed as follows:(20)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=Trx′,C3,x=TωxTβρxrx′.A ciphertext is generated in two cases:Ax∈B and Ax∈B¯. If T∈Gp1, it will be a normal ciphertext. When T∈G, it is a semifunctional ciphertext. Due to T∈Gp1 and T∈G are indistinguishable, the game Gamereal and Game0 cannot be distinguished. The proof is shown as follows:(1)
WhenT∈Gp1, the Gp1 part of T is g1r. For each Ax∈B, Tωx=g1rωx=g1Axrφ, because the first random value of the vector φ is 0, we make the ciphertext C3,x a normal ciphertext. For each Ax∈B¯, C2,x and C3,x are normal ciphertexts, because of Trx′=g1rrx′=g1rx and rx=rrx′. Finally, we can get that when T∈Gp1, all ciphertexts are normal.WhenT∈G, we can know that T=g1rg2cg3d. If Ax∈B, Tωx=g1Axrφg2Axcφg3Axdφ in the ciphertext C3,x. In the semifunctional ciphertext, δx=Ax⋅cφmodp2 and σx=Ax⋅dφmodp3, so C3,x can be seen as a semifunctional ciphertext.According to the remainder theorem, ifAx∈B¯, amodp1,amodp2, and amodp3 will be uncorrelated for a random value a. We can set exponents ax=crx′modp2,bx=drx′modp3,zρx=βρxmodp2, and tρx=βρxmodp3. Because ax,bx,zρx and tρx of g2 and g3 are all distributed randomly, C2,x and C3,x are semifunctional ciphertexts.(2)
In a semifunctional ciphertext, we can getδx=Axu2 and σx=Axu3, where u2 and u3 are random vectors. In this game, the first element of φ is 0, and adversary A cannot distinguish whether the value is random or not.WhenAx∈B, according to the monotone span program [36], we can know that φ=0,φ2,…,φm and φ′=φ1,φ2,…,φm can generate the same secret-sharing value, which means adversary A cannot figure out whether the first element is 0 or another φ1.WhenAx∈B¯, zρx is random in δx+axzρx. If axmodp2≠0, the exponent δx of g2 will be represented by zρx. So, the secret-sharing value can be hidden, and the shared value δx is appropriately distributed from the perspective of adversary A. The exponent σx of g3 is still appropriately distributed for the same reason.Therefore, whenT∈Gp1, ciphertexts are normal and simulator ℬ can simulate the Gamereal. When T∈G, ciphertexts are semifunctional and simulator ℬ can simulate the Game0. ℬ can use A to break Assumption 1 with advantage ε.


## 6.4.1. Proof

GlobalSetup: challenger C runs the GlobalSetup algorithm. Simulator ℬ receives the global parameter gp=e,g1,h,p1,p2,p3,G,GT,H,H′ from the challenger C and simulates Gamereal or Game0 between the adversary A and ℬ. A specifies a set of corrupted attribute authorities AA˜∈AA, where AA represents the set of all attribute authorities in the system. Then, A develops an access structure A=A,ρ that he/she needs to challenge.AuthoritySetup: ℬ executes the AuthoritySetup algorithm. For the corrupted attribute authorities, ℬ sends their public and private keys to A, and for good attribute authorities, ℬ only sends its public key to A.Key Query Phase 1: when A queries the key of aj,GID, ℬ runs the KeyGen algorithm to generate the related keys.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=Meg1,g1s. ℬ also selects two random column vectors v=s,v2,v3,…,vm∈ZNm and φ=0,φ2,φ3,…,φm∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ, where Ax is the x-th row in the matrix A.A provides ℬ with the random parameters g1αj,g1βj for the attribute aj contained in the access structure A,ρ, which belongs to the corrupted attribute authorities. Here, B represents a subset of the relevant rows of attributes with good attribute authorities in A, while B¯ represents a subset of the relevant rows with corrupted attribute authorities in A. For each Ax in B, ℬ randomly selects rx∈ZN and relatively selects rx′∈ZN for each Ax in B¯, where rx=rrx′. We set the Gp1 part of T as g1r, the Gp2 part as g2c, and the Gp3 part as g3d, where r,c,d∈ZN are selected randomly.ForAx∈B, the ciphertexts are computed as follows:(19)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=g1rx,C3,x=Tωxg1βρxrx.ForAx∈B¯, the ciphertexts are computed as follows:(20)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=Trx′,C3,x=TωxTβρxrx′.A ciphertext is generated in two cases:Ax∈B and Ax∈B¯. If T∈Gp1, it will be a normal ciphertext. When T∈G, it is a semifunctional ciphertext. Due to T∈Gp1 and T∈G are indistinguishable, the game Gamereal and Game0 cannot be distinguished. The proof is shown as follows:(1)
WhenT∈Gp1, the Gp1 part of T is g1r. For each Ax∈B, Tωx=g1rωx=g1Axrφ, because the first random value of the vector φ is 0, we make the ciphertext C3,x a normal ciphertext. For each Ax∈B¯, C2,x and C3,x are normal ciphertexts, because of Trx′=g1rrx′=g1rx and rx=rrx′. Finally, we can get that when T∈Gp1, all ciphertexts are normal.WhenT∈G, we can know that T=g1rg2cg3d. If Ax∈B, Tωx=g1Axrφg2Axcφg3Axdφ in the ciphertext C3,x. In the semifunctional ciphertext, δx=Ax⋅cφmodp2 and σx=Ax⋅dφmodp3, so C3,x can be seen as a semifunctional ciphertext.According to the remainder theorem, ifAx∈B¯, amodp1,amodp2, and amodp3 will be uncorrelated for a random value a. We can set exponents ax=crx′modp2,bx=drx′modp3,zρx=βρxmodp2, and tρx=βρxmodp3. Because ax,bx,zρx and tρx of g2 and g3 are all distributed randomly, C2,x and C3,x are semifunctional ciphertexts.(2)
In a semifunctional ciphertext, we can getδx=Axu2 and σx=Axu3, where u2 and u3 are random vectors. In this game, the first element of φ is 0, and adversary A cannot distinguish whether the value is random or not.WhenAx∈B, according to the monotone span program [36], we can know that φ=0,φ2,…,φm and φ′=φ1,φ2,…,φm can generate the same secret-sharing value, which means adversary A cannot figure out whether the first element is 0 or another φ1.WhenAx∈B¯, zρx is random in δx+axzρx. If axmodp2≠0, the exponent δx of g2 will be represented by zρx. So, the secret-sharing value can be hidden, and the shared value δx is appropriately distributed from the perspective of adversary A. The exponent σx of g3 is still appropriately distributed for the same reason.Therefore, whenT∈Gp1, ciphertexts are normal and simulator ℬ can simulate the Gamereal. When T∈G, ciphertexts are semifunctional and simulator ℬ can simulate the Game0. ℬ can use A to break Assumption 1 with advantage ε.


## 6.5. Lemma2 and Its Proof

Lemma 2.
If there is a polynomial-time algorithmA that can distinguish Gamej−1,2 and Gamej,1 at the nonnegligible advantage ε, then another polynomial-time algorithm B can be constructed to break Assumption 2 with the advantage ε.


### 6.5.1. Proof

The proof of Lemma2 is similar to that of Lemma 1, but challenger C needs to send the public parameter g1,g3,X1X2,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 1. According to the difference of T, A and ℬ will simulate Gamej−1,2 and Gamej,1. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi,βi∈ZN and sends the public key to A.Key Query Phase 1: assume that GIDk indicates the identity of the k-th user queried by adversary A, which means A performs a key query ai,GIDk. Then, ℬ needs to perform the following feedback:Whenk>j, K2′=Hu=g11/γh+u,K1′=K1=g1αig1βi/γh+u, where K1′ is normal.Whenk<j, K2′=Hu=g1g31/γh+u,K1′=K1g3ctj=g1αig1g3βi/γh+u, where K1′ is semifunctional of type-2, and c=1/γh+u,ti=βi.Whenk=j, if T∈Gp1, let T=g1θ1, then K2′=Hu=T1/γh+u and K1′=Tβi/γh+ug1αi, where K1′ is normal; if T∈Gp1p2, let T=g1θ2g2θ3, then K2′=T1/γh+u=H′ug2c=g1θ2/γh+ug2θ3/γh+u and K1′=Tβi/γh+ug1αi=K1g2czi, where K1′ is semifunctional of type-1, and c=θ3/γh+u,zi=βi.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=Meg1,g1s; ℬ selects three random column vectors v=s,v2,v3,…,vm∈ZNm,φ=0,φ2,φ3,…,φm∈ZNm and u=u1,u2,…,um∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ, where Ax is the x-th row in the matrix A. The definitions of B and B¯ are the same as in the proof of Lemma 1.IfAx∈B, ℬ randomly selects rx∈ZN for each Ax in B. Then, ciphertexts can be computed as follows:(21)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=C2,x′=g1rx,C3,x=X1X2ωxg1βρxrxg3ηx=C3,x′g2cωxg3ηx.IfAx∈B¯, ℬ randomly selects rx,φx,φx′∈ZN for each Ax in B¯, where rx=rrx′,ωx=rωx′, then ciphertexts are as follows:(22)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=X1X2rx′g3φx=g1rxX2r′xg3φx,C3,x=X1X2ωx′X1X2βρxrx′g3βρxφxg3ηx=C3,x′g2cωx′+cβρxrx′g3βρxφx+ηx.(1)
The proof method of the first aspect is the same as Lemma1.IfAx∈B, C3,x=X1X2ωxg1βρxrxg3ηx, where X1ωx and X2ωx are g1Axrφ and g2Axcφ, so we can set the exponent δx=Ax⋅cφmodp2 and σx=Ax⋅umodp3 of g2 and g3, so C3,x is semifunctional.IfAx∈B¯, C2,x=X1X2rx′g3φx=g1rrx′g2crx′g3φx, the exponents of g1,g2, and g3 will be random, because rx′modp2 and rx′modp3 are uncorrelated. Therefore, we can set ax=crx′modp2,bx=φxmodp3. C3,x=C3,x′g2cωx′+crx′βρxg3αρxφx+σx, where we can set zρx=βρxmodp2,tρx=βρxmodp3,δx=cωx′modp2. So, ciphertexts are semifunctional.(2)
The proof method of the second aspect is the same as Lemma1 too.In dual-system encryption, both the simulatorℬ and the adversary A are required to be unable to determine whether the key is a semifunctional key. Even though the secret-sharing value of δx is hidden from A, the secret-sharing value needs to be set to 0. By setting the secret-sharing value of δx to 0, the ciphertext generated by ℬ is a nominal semifunctional ciphertext. In this way, if ℬ wants to test whether the j-th key is a semifunctional key or a normal key, it will generate challenge ciphertexts that this key can decrypt. However, the ciphertexts are all nominal semifunctional ciphertexts, and users can successfully decrypt them. In other words, ℬ cannot tell whether the j-th key is a semifunctional key of type-1 or a normal key.Therefore, whenT∈Gp1, the keys are normal and simulator ℬ can simulate the Gamej−1,2. When T∈Gp1p2, keys are semifunctional keys of type-1 and simulator ℬ can simulate the Gamej,1. ℬ can use A to break Assumption 2 with advantage ε.


## 6.5.1. Proof

The proof of Lemma2 is similar to that of Lemma 1, but challenger C needs to send the public parameter g1,g3,X1X2,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 1. According to the difference of T, A and ℬ will simulate Gamej−1,2 and Gamej,1. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi,βi∈ZN and sends the public key to A.Key Query Phase 1: assume that GIDk indicates the identity of the k-th user queried by adversary A, which means A performs a key query ai,GIDk. Then, ℬ needs to perform the following feedback:Whenk>j, K2′=Hu=g11/γh+u,K1′=K1=g1αig1βi/γh+u, where K1′ is normal.Whenk<j, K2′=Hu=g1g31/γh+u,K1′=K1g3ctj=g1αig1g3βi/γh+u, where K1′ is semifunctional of type-2, and c=1/γh+u,ti=βi.Whenk=j, if T∈Gp1, let T=g1θ1, then K2′=Hu=T1/γh+u and K1′=Tβi/γh+ug1αi, where K1′ is normal; if T∈Gp1p2, let T=g1θ2g2θ3, then K2′=T1/γh+u=H′ug2c=g1θ2/γh+ug2θ3/γh+u and K1′=Tβi/γh+ug1αi=K1g2czi, where K1′ is semifunctional of type-1, and c=θ3/γh+u,zi=βi.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=Meg1,g1s; ℬ selects three random column vectors v=s,v2,v3,…,vm∈ZNm,φ=0,φ2,φ3,…,φm∈ZNm and u=u1,u2,…,um∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ, where Ax is the x-th row in the matrix A. The definitions of B and B¯ are the same as in the proof of Lemma 1.IfAx∈B, ℬ randomly selects rx∈ZN for each Ax in B. Then, ciphertexts can be computed as follows:(21)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=C2,x′=g1rx,C3,x=X1X2ωxg1βρxrxg3ηx=C3,x′g2cωxg3ηx.IfAx∈B¯, ℬ randomly selects rx,φx,φx′∈ZN for each Ax in B¯, where rx=rrx′,ωx=rωx′, then ciphertexts are as follows:(22)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=X1X2rx′g3φx=g1rxX2r′xg3φx,C3,x=X1X2ωx′X1X2βρxrx′g3βρxφxg3ηx=C3,x′g2cωx′+cβρxrx′g3βρxφx+ηx.(1)
The proof method of the first aspect is the same as Lemma1.IfAx∈B, C3,x=X1X2ωxg1βρxrxg3ηx, where X1ωx and X2ωx are g1Axrφ and g2Axcφ, so we can set the exponent δx=Ax⋅cφmodp2 and σx=Ax⋅umodp3 of g2 and g3, so C3,x is semifunctional.IfAx∈B¯, C2,x=X1X2rx′g3φx=g1rrx′g2crx′g3φx, the exponents of g1,g2, and g3 will be random, because rx′modp2 and rx′modp3 are uncorrelated. Therefore, we can set ax=crx′modp2,bx=φxmodp3. C3,x=C3,x′g2cωx′+crx′βρxg3αρxφx+σx, where we can set zρx=βρxmodp2,tρx=βρxmodp3,δx=cωx′modp2. So, ciphertexts are semifunctional.(2)
The proof method of the second aspect is the same as Lemma1 too.In dual-system encryption, both the simulatorℬ and the adversary A are required to be unable to determine whether the key is a semifunctional key. Even though the secret-sharing value of δx is hidden from A, the secret-sharing value needs to be set to 0. By setting the secret-sharing value of δx to 0, the ciphertext generated by ℬ is a nominal semifunctional ciphertext. In this way, if ℬ wants to test whether the j-th key is a semifunctional key or a normal key, it will generate challenge ciphertexts that this key can decrypt. However, the ciphertexts are all nominal semifunctional ciphertexts, and users can successfully decrypt them. In other words, ℬ cannot tell whether the j-th key is a semifunctional key of type-1 or a normal key.Therefore, whenT∈Gp1, the keys are normal and simulator ℬ can simulate the Gamej−1,2. When T∈Gp1p2, keys are semifunctional keys of type-1 and simulator ℬ can simulate the Gamej,1. ℬ can use A to break Assumption 2 with advantage ε.


## 6.6. Lemma3 and Its Proof

Lemma 3.
If there is a polynomial-time algorithmA that can distinguish Gamej,1 and Gamej,2 at the nonnegligible advantage ε, another polynomial-time algorithm ℬ will be constructed to break Assumption 3 with the advantage ε.


### 6.6.1. Proof

The proof of Lemma3 is similar to that of Lemma 3, but challenger C needs to send the public parameter N,g1,X1X3,Y2Y3,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 2. According to the difference of T, A and ℬ will simulate Gamej,1 and Gamej,2. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi,βi∈ZN and sends the public key to A.Key Query Phase 1: assume that GIDk indicates the identity of the k-th user queried by adversary A, which means A performs a key query ai,GIDk. Then, ℬ needs to perform the following feedback:Whenk>j, K2′=Hu=g11/γh+u,K1′=K1=g1αig1βi/γh+u, where K1′ is normal.Whenk<j, K2′=Hu=X1X31/γh+u=g1r/γh+ug3d/γh+u,K1′=K1g3ctj=g1αiX1X3βi/γh+u=g1αig1rβi/γh+ug3dβi/γh+u, where K1′ is semifunctional of type-2, and c=1/γh+u,ti=βi.Whenk=j, if T∈Gp1p2, let T=g1θ1g2θ2, then K2′=Hu=T1/γh+u=g1θ1/γh+ug2θ2/γh+u and K1′=Tβi/γh+ug1αi=g1αig1θ1βi/γh+ug2θ2βi/γh+u, where K1′ is the semifunctional key of type-1, where c=θ2/γh+u,zi=βi; if T∈Gp1p3, let T=g1θ3g3θ4, then K2′=T1/γh+u=H′ug2c=g1θ2/γh+ug3θ4/γh+u and K1′=Tβi/γh+ug1αi=g1αig1θ3βi/γh+ug3θθ4βiγh+u=K1g2cti, where K1′ is semifunctional of type-2, and c=θ4/γh+u,ti=βi.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN, sets C0=Meg1,g1s, and chooses three random column vectors v=s,v2,v3,…,vm∈ZNm,φ=0,φ2,φ3,…,φm∈ZNm and u=u1,u2,…,um∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ. The definition of B and B¯ is the same as in the proof of Lemma 2.IfAx∈B, ℬ will randomly choose ηx,rx∈ZN. Then, the ciphertexts can be calculated as follows:(23)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=C2,x′,C3,x=g1ωxg1βρxrxY2Y3ηx.IfAx∈B¯, ℬ will randomly choose rx′,ωx′,φx∈ZN, where rx=rrx′,ωx=rωx′. Then, the ciphertexts can be calculated as follows:(24)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=Y2Y3rxg1rx,C3,x=Y2Y3σxY2Y3βρxrxg1βρxrxg1ωx.Similar to the proof of Lemma2, we can set Y2=g2t,Y3=g3p.(1)
IfAx∈B, C3,x=g1ωxg1βρxrxY2Y3ωx=C3,x′g2tσxg3pσx, the exponents of g2 and g3 will be random, because ηxmodp2 and ηxmodp3 are uncorrelated, where δx=tηxmodp2,σx=pηxmodp3. So, ciphertexts are semifunctional.IfAx∈B¯, C2,x=Y2Y3rxg1rx=g1rxg2trxg3prx, the exponents of g2 and g3 will be computed as ax=trxmodp2,bx=prxmodp3. C3,x=Y2Y3σxY2Y3βρxrxg1βρxrxg1ωx=C3,x′g2tσx+tβρxrxg3pσx+tβρxrx, and the exponents of g2 and g3 will be computed as zρx=βρxmodp2,tρx=βρxmodp3. So, ciphertexts are semifunctional.(2)
Whenk=j, the key is a semifunctional key. So, whether it is a type-1 semifunctional key or a type-2 one, the ciphertexts cannot be decrypted, which means that the key is indistinguishable.Therefore, whenGp1p2, the keys are normal and simulator ℬ can simulate the Gamej,1. When T∈Gp1p3, keys are semifunctional keys of type-1 and simulator ℬ can simulate the Gamej,2. ℬ can use A to break Assumption 3 with advantage ε.


## 6.6.1. Proof

The proof of Lemma3 is similar to that of Lemma 3, but challenger C needs to send the public parameter N,g1,X1X3,Y2Y3,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 2. According to the difference of T, A and ℬ will simulate Gamej,1 and Gamej,2. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi,βi∈ZN and sends the public key to A.Key Query Phase 1: assume that GIDk indicates the identity of the k-th user queried by adversary A, which means A performs a key query ai,GIDk. Then, ℬ needs to perform the following feedback:Whenk>j, K2′=Hu=g11/γh+u,K1′=K1=g1αig1βi/γh+u, where K1′ is normal.Whenk<j, K2′=Hu=X1X31/γh+u=g1r/γh+ug3d/γh+u,K1′=K1g3ctj=g1αiX1X3βi/γh+u=g1αig1rβi/γh+ug3dβi/γh+u, where K1′ is semifunctional of type-2, and c=1/γh+u,ti=βi.Whenk=j, if T∈Gp1p2, let T=g1θ1g2θ2, then K2′=Hu=T1/γh+u=g1θ1/γh+ug2θ2/γh+u and K1′=Tβi/γh+ug1αi=g1αig1θ1βi/γh+ug2θ2βi/γh+u, where K1′ is the semifunctional key of type-1, where c=θ2/γh+u,zi=βi; if T∈Gp1p3, let T=g1θ3g3θ4, then K2′=T1/γh+u=H′ug2c=g1θ2/γh+ug3θ4/γh+u and K1′=Tβi/γh+ug1αi=g1αig1θ3βi/γh+ug3θθ4βiγh+u=K1g2cti, where K1′ is semifunctional of type-2, and c=θ4/γh+u,ti=βi.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN, sets C0=Meg1,g1s, and chooses three random column vectors v=s,v2,v3,…,vm∈ZNm,φ=0,φ2,φ3,…,φm∈ZNm and u=u1,u2,…,um∈ZNm. Then, ℬ sets λx=Axv,ωx=Axφ. The definition of B and B¯ is the same as in the proof of Lemma 2.IfAx∈B, ℬ will randomly choose ηx,rx∈ZN. Then, the ciphertexts can be calculated as follows:(23)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=C2,x′,C3,x=g1ωxg1βρxrxY2Y3ηx.IfAx∈B¯, ℬ will randomly choose rx′,ωx′,φx∈ZN, where rx=rrx′,ωx=rωx′. Then, the ciphertexts can be calculated as follows:(24)C1,x=eg1,g1λxeg1,g1αρxrx,C2,x=Y2Y3rxg1rx,C3,x=Y2Y3σxY2Y3βρxrxg1βρxrxg1ωx.Similar to the proof of Lemma2, we can set Y2=g2t,Y3=g3p.(1)
IfAx∈B, C3,x=g1ωxg1βρxrxY2Y3ωx=C3,x′g2tσxg3pσx, the exponents of g2 and g3 will be random, because ηxmodp2 and ηxmodp3 are uncorrelated, where δx=tηxmodp2,σx=pηxmodp3. So, ciphertexts are semifunctional.IfAx∈B¯, C2,x=Y2Y3rxg1rx=g1rxg2trxg3prx, the exponents of g2 and g3 will be computed as ax=trxmodp2,bx=prxmodp3. C3,x=Y2Y3σxY2Y3βρxrxg1βρxrxg1ωx=C3,x′g2tσx+tβρxrxg3pσx+tβρxrx, and the exponents of g2 and g3 will be computed as zρx=βρxmodp2,tρx=βρxmodp3. So, ciphertexts are semifunctional.(2)
Whenk=j, the key is a semifunctional key. So, whether it is a type-1 semifunctional key or a type-2 one, the ciphertexts cannot be decrypted, which means that the key is indistinguishable.Therefore, whenGp1p2, the keys are normal and simulator ℬ can simulate the Gamej,1. When T∈Gp1p3, keys are semifunctional keys of type-1 and simulator ℬ can simulate the Gamej,2. ℬ can use A to break Assumption 3 with advantage ε.


## 6.7. Lemma4 and Its Proof

Lemma 4.
If there is a polynomial-time algorithmA that can distinguish Gameq,2 and Gamefinal at the nonnegligible advantage ε, another polynomial-time algorithm ℬ will be constructed to break Assumption 4 with the advantage ε.


### 6.7.1. Proof

The proof of Lemma4 is similar to that of Lemma 3, but challenger C needs to send the public parameter N,g1,g2,g3,g1a,g1bg3b,g1c,g1acg3d,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 2. According to the difference of T, A and ℬ will simulate Gameq,2 and Gamefinal. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi′,βi′∈ZN and sends the public key to A. We set eg1,g1αi=eg1,g1bg3beg1,g1αi′ and g1βi=g1βi′, where βi=b+βi′.Key Query Phase 1: when A performs a key query ai,GID, ℬ needs to generate the following keys:(25)K2′=Hu=g1bg3b1/γh+u=g1b/γh+ug3b/γh+u,K1′=g1bg3bβi/γh+ug1αi=g1bβi/γh+ug1αig3bβi/γh+u.We can setc=b/γh+u and ti=βi, so keys are type-2 semifunctional keys.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=MbT, where s=abc. If T=eg1,g1abc, it will be the encryption of message Mb. Otherwise, it will be the encryption of a random message. The definition of B and B¯ is the same as them in the proof of Lemma 3.IfAx∈B¯, ℬ will randomly choose two random vectors v1 and v2, where 1 and 0 are the first elements of them, respectively. According to the nature of the complexity assumption [34], we can find a vector with 1 as the first element, which can be orthogonal to all the rows in B.We setv=abcv1+v2 and λx=Axv=abcAxv1+Axv2. For each row Ax∈B¯, ℬ randomly selects rx′∈ZN and lets rx=−acAxv1+rx′.So, we can getλx+αρxrx=abcAxv1+Axv2+b+αρx′−acAxv1+rx′=Axv2+brx′−acαρx′Axv1+rx′αρx′. We define C1,x as follows:(26)C1,x=eg1,g1bg3brx′eg1a,g1c−αρx′Axv1eg1,g1Axv2+rx′αρx′ℬ randomly generates two vectors φ=0,φ2,…,φm∈ZNm,u=u1,u2,…,um∈ZNm and a number φx∈ZN, where ωx=Axφ,σx=Axu. We define C2,x as follows:(27)C2,x=g1acg3d−Axv1g1rx′g2φx=g1−acAxv1+rx′g2φxg3−dAxv1,where rx=−acAxv1+rx′,ax=φx and bx=−dAxv1 are the exponents of g1,g2, and g3. ℬ randomly chooses ηx∈ZN. Then, C3,x can be computed as follows:(28)C3,x=g1acg3d−Axv1βρx′g1rx′βρx′g1ωxg2ηx+βρx′φxg3ηx=g1−acAxv1βρx′+rx′βρx′g1ωxg2ηx+βρx′φxg3ηx−dAxv1βρx′,where ηx and γρx′ are uncorrelated under modp2 and modp3. So, we can get that δx=ηxmodp2,zρx=βρx′modp2,σx=ηxmodp3, and tρx=βρx′modp3 are random. Therefore, ciphertexts are semifunctional.IfAx∈B, ℬ will randomly choose rx∈ZN, and ciphertexts can be computed as follows:(29)C1,x=eg1,g1λxeg1,g1αρxrxC2,x=g1rx,C3,x=g1ωxg1βρxg2ηxg3ηx.Becauseηxmodp2 and ηxmodp3 are uncorrelated, these ciphertexts are normal.Ifs=abc, ciphertexts will be semifunctional ciphertexts, which are properly distributed. If T=eg1,g1abc is the semifunctional encryption of the message Mb, the game ℬ will simulate Gameq,2. In addition, if T is random, ℬ will simulate Gamefinal. Therefore, ℬ can use A to break Assumption 4 with advantage ε.So, in the final attack game of Lemma4, when the challenger C encrypts a random message, the adversary’s attack advantage is negligible. As a result, according to the defined Assumptions 1–4, we can prove that real attack games and the above attack games are indistinguishable. Thus, it proves that the adversary’s advantage in winning the real attack game is negligible.


## 6.7.1. Proof

The proof of Lemma4 is similar to that of Lemma 3, but challenger C needs to send the public parameter N,g1,g2,g3,g1a,g1bg3b,g1c,g1acg3d,T to simulator ℬ.GlobalSetup and AuthoritySetup: the same as in Lemma 2. According to the difference of T, A and ℬ will simulate Gameq,2 and Gamefinal. For each attribute ai belonging to a good attribute authority AAh, ℬ generates its random parameters αi′,βi′∈ZN and sends the public key to A. We set eg1,g1αi=eg1,g1bg3beg1,g1αi′ and g1βi=g1βi′, where βi=b+βi′.Key Query Phase 1: when A performs a key query ai,GID, ℬ needs to generate the following keys:(25)K2′=Hu=g1bg3b1/γh+u=g1b/γh+ug3b/γh+u,K1′=g1bg3bβi/γh+ug1αi=g1bβi/γh+ug1αig3bβi/γh+u.We can setc=b/γh+u and ti=βi, so keys are type-2 semifunctional keys.Challenge: A submits two messages M0 and M1 with the same length to ℬ. ℬ randomly chooses a bit b∈0,1 and sends the confidential message Mb under the access structure A to A.ℬ selects a random shared number s∈ZN and sets C0=MbT, where s=abc. If T=eg1,g1abc, it will be the encryption of message Mb. Otherwise, it will be the encryption of a random message. The definition of B and B¯ is the same as them in the proof of Lemma 3.IfAx∈B¯, ℬ will randomly choose two random vectors v1 and v2, where 1 and 0 are the first elements of them, respectively. According to the nature of the complexity assumption [34], we can find a vector with 1 as the first element, which can be orthogonal to all the rows in B.We setv=abcv1+v2 and λx=Axv=abcAxv1+Axv2. For each row Ax∈B¯, ℬ randomly selects rx′∈ZN and lets rx=−acAxv1+rx′.So, we can getλx+αρxrx=abcAxv1+Axv2+b+αρx′−acAxv1+rx′=Axv2+brx′−acαρx′Axv1+rx′αρx′. We define C1,x as follows:(26)C1,x=eg1,g1bg3brx′eg1a,g1c−αρx′Axv1eg1,g1Axv2+rx′αρx′ℬ randomly generates two vectors φ=0,φ2,…,φm∈ZNm,u=u1,u2,…,um∈ZNm and a number φx∈ZN, where ωx=Axφ,σx=Axu. We define C2,x as follows:(27)C2,x=g1acg3d−Axv1g1rx′g2φx=g1−acAxv1+rx′g2φxg3−dAxv1,where rx=−acAxv1+rx′,ax=φx and bx=−dAxv1 are the exponents of g1,g2, and g3. ℬ randomly chooses ηx∈ZN. Then, C3,x can be computed as follows:(28)C3,x=g1acg3d−Axv1βρx′g1rx′βρx′g1ωxg2ηx+βρx′φxg3ηx=g1−acAxv1βρx′+rx′βρx′g1ωxg2ηx+βρx′φxg3ηx−dAxv1βρx′,where ηx and γρx′ are uncorrelated under modp2 and modp3. So, we can get that δx=ηxmodp2,zρx=βρx′modp2,σx=ηxmodp3, and tρx=βρx′modp3 are random. Therefore, ciphertexts are semifunctional.IfAx∈B, ℬ will randomly choose rx∈ZN, and ciphertexts can be computed as follows:(29)C1,x=eg1,g1λxeg1,g1αρxrxC2,x=g1rx,C3,x=g1ωxg1βρxg2ηxg3ηx.Becauseηxmodp2 and ηxmodp3 are uncorrelated, these ciphertexts are normal.Ifs=abc, ciphertexts will be semifunctional ciphertexts, which are properly distributed. If T=eg1,g1abc is the semifunctional encryption of the message Mb, the game ℬ will simulate Gameq,2. In addition, if T is random, ℬ will simulate Gamefinal. Therefore, ℬ can use A to break Assumption 4 with advantage ε.So, in the final attack game of Lemma4, when the challenger C encrypts a random message, the adversary’s attack advantage is negligible. As a result, according to the defined Assumptions 1–4, we can prove that real attack games and the above attack games are indistinguishable. Thus, it proves that the adversary’s advantage in winning the real attack game is negligible.


## 7. Security of the Anonymous Key Generation Protocol

The security proof of the anonymous key generation protocol is divided into two parts, namely, leak-freeness and selective-failure blindness, which are used for legitimate and malicious attribute authorities.


### 7.1. Leak-freeness

We assume that a malicious userU interacts with a legitimate attribute authority AAi and runs this anonymous key generation protocol in a real security game. In an ideal security game, there is a simulator S that can execute the KeyGen algorithm with a trusted party. Nevertheless, there is no distinguisher D that can distinguish an ideal game from a real one. The interaction between U and D can be simulated by the simulator S, and S can perform the following steps.(1)
S sends the public keys of AAi to U.(2)
U sends P,Q to S, then uses zero-knowledge proof to prove he/she does own u,ρ.(3)
S sends the element u to the trusted attribute authority AAi, then AAi generates user attribute secret keys K1 and K2 to S.(4)
S computes K1′=K11/ρ and K2′=K2u/ρ. Then, S returns K1′ and K2′ to U.IfK1 and K2 are correct keys generated from a trusted attribute authority AAi in the ideal game, K1′ and K2′ will be considered to be the right keys of AAi in the real game. Hence, D cannot distinguish whether the game is real or ideal.


### 7.2. Selective-Failure Blindness

We assume that a malicious attribute authorityAAi generates its public key PKi and two global user identifiers u0 and u1. AAi produces a random bit b∈0,1 and then it accesses two oracles in a black-box manner, namely, Ogp,ub,A˜ub,PKi and Ogp,u1−b,A˜u1−b,PKi, which are adopted to play the role of legitimate users. O and AAi execute the anonymous key generation protocol and then O can get two kinds of keys SKub and SKu1−b. If there are some errors during the execution of the anonymous key generation protocol, the returned key will be considered meaningless and return SKu=⊥.IfSKub≠⊥ and SKu1−b≠⊥, AAi outputs SKub,SKu1−b;SKub=⊥ and SKu1−b≠⊥, AAi outputs ⊥,SKu1−b; SKub≠⊥ and SKu1−b=⊥, AAi outputs SKub,⊥; SKub=⊥ and SKu1−b=⊥, AAi outputs ⊥,⊥.In the anonymous key generation protocol,O provides P,Q to AAi and computes PoKub,ρ:P=g11/ρ∧Q=hub. Then, AAi performs two oracles, which are regarded incalculable distinguished. Otherwise, the indistinguishability of the zero-knowledge proof and the hidden policy of the commitment scheme will be broken. If AAi can use any of the calculation strategies to output the key of the first oracle K1′,K2′,K1″,K2″, it will predict the key SKub without interacting with the two oracles.(1)
AAi verifies PoKαj,βj,η:K1′=Pαjhβj/η∧K2′=Q1/η. If the proof is a fault, AAi will output SKub=⊥.(2)
AAi generates a pair of different keys K1,K2 for the second oracle and verifies PoKαj,βj,η:K1′=Pαjhβj/η∧K2′=Q1/η. If the proof is a fault, AAi will output SKu1−b=⊥.(3)
If the verification fails, that is, ifSKub=⊥ and SKu1−b≠⊥, AAi will output ⊥,SKu1−b. If SKub≠⊥ and SKu1−b=⊥, AAi will output SKub,⊥, and if SKub=⊥ and SKu1−b=⊥, AAi will output ⊥,⊥.(4)
If the verification is successful,AAi will execute the anonymous key generation protocol by itself using the inputs ub,A˜ub,u1−b,A˜u1−b and the output SKub,SKu1−b.WhenAAi is verified like a trusted O, the two predictions will have the same distribution. So, AAi can predict the output of the two predictions and has the same advantages in distinguishing Ogp,ub,A˜ub,PKi and Ogp,u1−b,A?˜u1−b,PKi as the same final output. Therefore, the advantage of AAi in distinguishing two predictions comes from the received K1′,K2′,K1″,K2″ and authentication PoKαj,βj,η:K1′=Pαjhβj/η∧K2′=Q1/η. However, because of the witness indistinguishability of zero-knowledge proof and the strategic hiddenness of the commitment mechanism, we can infer that the advantage of AAi in distinguishing between the two predictions is negligible.


## 7.1. Leak-freeness

We assume that a malicious userU interacts with a legitimate attribute authority AAi and runs this anonymous key generation protocol in a real security game. In an ideal security game, there is a simulator S that can execute the KeyGen algorithm with a trusted party. Nevertheless, there is no distinguisher D that can distinguish an ideal game from a real one. The interaction between U and D can be simulated by the simulator S, and S can perform the following steps.(1)
S sends the public keys of AAi to U.(2)
U sends P,Q to S, then uses zero-knowledge proof to prove he/she does own u,ρ.(3)
S sends the element u to the trusted attribute authority AAi, then AAi generates user attribute secret keys K1 and K2 to S.(4)
S computes K1′=K11/ρ and K2′=K2u/ρ. Then, S returns K1′ and K2′ to U.IfK1 and K2 are correct keys generated from a trusted attribute authority AAi in the ideal game, K1′ and K2′ will be considered to be the right keys of AAi in the real game. Hence, D cannot distinguish whether the game is real or ideal.


## 7.2. Selective-Failure Blindness

We assume that a malicious attribute authorityAAi generates its public key PKi and two global user identifiers u0 and u1. AAi produces a random bit b∈0,1 and then it accesses two oracles in a black-box manner, namely, Ogp,ub,A˜ub,PKi and Ogp,u1−b,A˜u1−b,PKi, which are adopted to play the role of legitimate users. O and AAi execute the anonymous key generation protocol and then O can get two kinds of keys SKub and SKu1−b. If there are some errors during the execution of the anonymous key generation protocol, the returned key will be considered meaningless and return SKu=⊥.IfSKub≠⊥ and SKu1−b≠⊥, AAi outputs SKub,SKu1−b;SKub=⊥ and SKu1−b≠⊥, AAi outputs ⊥,SKu1−b; SKub≠⊥ and SKu1−b=⊥, AAi outputs SKub,⊥; SKub=⊥ and SKu1−b=⊥, AAi outputs ⊥,⊥.In the anonymous key generation protocol,O provides P,Q to AAi and computes PoKub,ρ:P=g11/ρ∧Q=hub. Then, AAi performs two oracles, which are regarded incalculable distinguished. Otherwise, the indistinguishability of the zero-knowledge proof and the hidden policy of the commitment scheme will be broken. If AAi can use any of the calculation strategies to output the key of the first oracle K1′,K2′,K1″,K2″, it will predict the key SKub without interacting with the two oracles.(1)
AAi verifies PoKαj,βj,η:K1′=Pαjhβj/η∧K2′=Q1/η. If the proof is a fault, AAi will output SKub=⊥.(2)
AAi generates a pair of different keys K1,K2 for the second oracle and verifies PoKαj,βj,η:K1′=Pαjhβj/η∧K2′=Q1/η. If the proof is a fault, AAi will output SKu1−b=⊥.(3)
If the verification fails, that is, ifSKub=⊥ and SKu1−b≠⊥, AAi will output ⊥,SKu1−b. If SKub≠⊥ and SKu1−b=⊥, AAi will output SKub,⊥, and if SKub=⊥ and SKu1−b=⊥, AAi will output ⊥,⊥.(4)
If the verification is successful,AAi will execute the anonymous key generation protocol by itself using the inputs ub,A˜ub,u1−b,A˜u1−b and the output SKub,SKu1−b.WhenAAi is verified like a trusted O, the two predictions will have the same distribution. So, AAi can predict the output of the two predictions and has the same advantages in distinguishing Ogp,ub,A˜ub,PKi and Ogp,u1−b,A?˜u1−b,PKi as the same final output. Therefore, the advantage of AAi in distinguishing two predictions comes from the received K1′,K2′,K1″,K2″ and authentication PoKαj,βj,η:K1′=Pαjhβj/η∧K2′=Q1/η. However, because of the witness indistinguishability of zero-knowledge proof and the strategic hiddenness of the commitment mechanism, we can infer that the advantage of AAi in distinguishing between the two predictions is negligible.


## 8. Performance Analysis

In this section, we have the comparisons between our scheme with other schemes in Qin et al. [22], Liang et al. [37], and Malluhi et al. [38] from the view of property and efficiency to reflect the feasibility as well as the practicality of our work.


### 8.1. Property Analysis

In Table1, we can find comparisons in scheme properties, such as attribute revocable, policy hiding, user identity hiding, and anonymous key generation, which reflects the comprehensiveness of our scheme in those compared schemes. Considering the actual application scenarios, more comprehensive features are of greater significance for protecting system data security and user privacy.Table 1
Scheme property comparison.
SchemeAttribute updatable/revocablePolicy hidingUser identityAnonymous key generationOurs✓✓✓✓Qin et al. [22]××✓×Liang et al. [37]×✓✓✓Malluhi et al. [38]✓✓✓×


### 8.2. Theoretical Analysis

We compare our scheme with other schemes for blockchain-based access control in terms of attribute authorityAA’s secret key size, user secret key size, ciphertext size, and decryption overhead. We define that N is the total number of attributes. K is the number of attribute authorities. A is the access structure. Zp∗=60byte, G=124byte, and GT=124byte are the lengths of the group Zp∗, G, and GT in the paring group. A˜u and AA˜i are the attribute number of user u and authority i. P is the cost of performing a bilinear operation. E is the cost of performing an exponential operation. It is worth noting that there is not the concept of attribute authority in [38], but a special key user can realize the function of generating secret keys for other users in the whole system. When comparing the schemes in this paper, we considered the special key users as attribute authorities.As shown in Table2, the size of the attribute authority secret key of our work is smaller than the other works. For the size of user secret, our work is the same as [37] and [38]. When 2 K is smaller than A˜u, it will also be smaller than [22]. In terms of ciphertext, our work is slightly higher than [22, 38]. Because the exponential operation cost is much higher than the bilinear operation cost in the paired group, our work is most efficient when decrypting. In conclusion, our work has advantages in storage, communication, and computing.Table 2
Scheme performance comparison.
SchemeAttribute authority secret key sizeUser secret sizeCiphertext sizeDecryption overheadOurs2AA˜i+1Zp∗|A˜u+2KGN+1GT+2N+1G3NP+NEQin et al. [22]2AA˜i+2Zp∗2A˜uGN+1GT+2NG2NP+3NELiang et al.[37]3AA˜i+1Zp∗A˜u+2KGN+1GT+3N+1G4NP+NEMalluhi et al. [38]AA˜i+2GA˜u+2KGGT+GA+12N+4P+2NE


### 8.3. Experiment Analysis

We use a 64 bit Windows 10 laptop with an eight-core 2.40 GHz Intel Core(TM) i5-1135G7 processor and 16 GB memory for experiments. Moreover, we implemented the above scheme in Java by using IntelliJ IDEA 2019.3. The JPBC (Java Pairing-Based Cryptography) Library [39] and a Type-A1 curve y2=x3+x with 160 bits are respectively used to deal with the pairing computations and provide test parameters.In order to compare the actual running time cost of the Encryption and Decryption phase under different access control structures, we designed two kinds of experiments. InExperiment 1, the number of total attributes increases while the number of access attributes is fixed. It simulates the impact on the running cost of data owners and data users when attribute authorities continuously add new attributes. In Experiment 2, the number of access attributes increases while the number of total attributes is fixed. It simulates the impact on the running cost of data owners and data users when the data owner changes the access structure. In each experiment, we simulate five attribute authorities that manage the same number of different attributes. An access structure specifies that each data user needs a given number of attributes to decrypt the ciphertext properly. We repeated each group of experiments 5 times and computed the average running time of the encryption and decryption phase. Note that each message consists of 124 random integers in these experiments. The running time is shown in Table 3. It should be noted that, according to the actual model of each scheme, we used all attribute keys to encrypt the ciphertext in the process of encryption and stored the access structure in the ciphertext. Moreover, we simulated a legal user only with access attributes to decrypt the ciphertext. Therefore, the encryption algorithm generally needs more attributes, which makes the running time cost of the encryption algorithm much higher.Table 3
Experiment running time comparison.
Access structureSizeOursLiang et al. [37]Malluhi et al. [38]Qin et al. [22]EncryptDecryptEncryptDecryptEncryptDecryptEncryptDecryptComparison based on access structure with a fixed number of access attributes (ms)Access = 10Total = 15937.62771311.4487.2846.64781022369.4Total = 191159.6305.61529.8488964.2480.81195.6411Total = 231434.8315.22110.2517.41256.2475.61692.4421.6Total = 271726.23282315507.81361.4460.21893.2394.2Total = 311934332.62755518.61662.4477.82107.6393.8Total = 352098.431229934831649.6445.22356.8386Total = 3922993003173.6458.41769.2432.42435.2371.6Total = 432535.4314.63420.647318574322673370.8Total = 472773.8312.83932.8482.62227.24583372396.8Total = 512788.9307.64015.4460.62340.44253342.8371.8Total = 552924.43084350.64542470.8431.23390.8361.4Comparison based on access structure with a fixed number of total attributes (ms)Total = 30Access = 51840.21592793.2330.41887.43352021230.2Access = 71874.6226.42820425.21846.2412.82112.2347.2Access = 91864.4276.42787403.41729.8446.62143.2341.2Access = 112000351.42647.25221676.6409.42062.8409.4Access = 131963.2441.22575.2604.81699556.22087.8487.8Access = 151835.8455.82691.4705.61644.8667.82120.4576.8Access = 171909.6494.62666.8809.81636.2761.41988.4621.6Access = 191844576.82558.29771657.4830.21992702.8Access = 211904.8656.62600.4980.61682.68962060.8764.8Access = 231883.4720.226081088.41672.4996.42024.6870Access = 251834.2753.42552.41093.21681.81027.81972.6905For a more intuitive comparison, the comparison charts in running time of encryption, decryption, and total are shown in Figures4 and 5. For the running time cost in encryption, our scheme is more efficient than the other scheme in [22, 38] but slightly higher than [37]. Meanwhile, the running time cost of our work has obvious advantages compared with other schemes in the decryption phase. Our scheme has obvious advantages compared with the schemes in [22, 38] for the total running time comparison. It shows that our scheme is more suitable for application in the supply chain information sharing system where many data users need to access user data frequently.Figure 4
Comparison of the running time in experiment 1. (a) Encryption. (b) Decryption. (c) Total.
(a)(b)(c)Figure 5
Comparison of the running time in experiment 2. (a) Encryption. (b) Decryption. (c) Total.
(a)(b)(c)In summary, our scheme has its advantages in the aspects of security, storage, and efficiency compared with the schemes in [22, 37] and [38].


## 8.1. Property Analysis

In Table1, we can find comparisons in scheme properties, such as attribute revocable, policy hiding, user identity hiding, and anonymous key generation, which reflects the comprehensiveness of our scheme in those compared schemes. Considering the actual application scenarios, more comprehensive features are of greater significance for protecting system data security and user privacy.Table 1
Scheme property comparison.
SchemeAttribute updatable/revocablePolicy hidingUser identityAnonymous key generationOurs✓✓✓✓Qin et al. [22]××✓×Liang et al. [37]×✓✓✓Malluhi et al. [38]✓✓✓×


## 8.2. Theoretical Analysis

We compare our scheme with other schemes for blockchain-based access control in terms of attribute authorityAA’s secret key size, user secret key size, ciphertext size, and decryption overhead. We define that N is the total number of attributes. K is the number of attribute authorities. A is the access structure. Zp∗=60byte, G=124byte, and GT=124byte are the lengths of the group Zp∗, G, and GT in the paring group. A˜u and AA˜i are the attribute number of user u and authority i. P is the cost of performing a bilinear operation. E is the cost of performing an exponential operation. It is worth noting that there is not the concept of attribute authority in [38], but a special key user can realize the function of generating secret keys for other users in the whole system. When comparing the schemes in this paper, we considered the special key users as attribute authorities.As shown in Table2, the size of the attribute authority secret key of our work is smaller than the other works. For the size of user secret, our work is the same as [37] and [38]. When 2 K is smaller than A˜u, it will also be smaller than [22]. In terms of ciphertext, our work is slightly higher than [22, 38]. Because the exponential operation cost is much higher than the bilinear operation cost in the paired group, our work is most efficient when decrypting. In conclusion, our work has advantages in storage, communication, and computing.Table 2
Scheme performance comparison.
SchemeAttribute authority secret key sizeUser secret sizeCiphertext sizeDecryption overheadOurs2AA˜i+1Zp∗|A˜u+2KGN+1GT+2N+1G3NP+NEQin et al. [22]2AA˜i+2Zp∗2A˜uGN+1GT+2NG2NP+3NELiang et al.[37]3AA˜i+1Zp∗A˜u+2KGN+1GT+3N+1G4NP+NEMalluhi et al. [38]AA˜i+2GA˜u+2KGGT+GA+12N+4P+2NE


## 8.3. Experiment Analysis

We use a 64 bit Windows 10 laptop with an eight-core 2.40 GHz Intel Core(TM) i5-1135G7 processor and 16 GB memory for experiments. Moreover, we implemented the above scheme in Java by using IntelliJ IDEA 2019.3. The JPBC (Java Pairing-Based Cryptography) Library [39] and a Type-A1 curve y2=x3+x with 160 bits are respectively used to deal with the pairing computations and provide test parameters.In order to compare the actual running time cost of the Encryption and Decryption phase under different access control structures, we designed two kinds of experiments. InExperiment 1, the number of total attributes increases while the number of access attributes is fixed. It simulates the impact on the running cost of data owners and data users when attribute authorities continuously add new attributes. In Experiment 2, the number of access attributes increases while the number of total attributes is fixed. It simulates the impact on the running cost of data owners and data users when the data owner changes the access structure. In each experiment, we simulate five attribute authorities that manage the same number of different attributes. An access structure specifies that each data user needs a given number of attributes to decrypt the ciphertext properly. We repeated each group of experiments 5 times and computed the average running time of the encryption and decryption phase. Note that each message consists of 124 random integers in these experiments. The running time is shown in Table 3. It should be noted that, according to the actual model of each scheme, we used all attribute keys to encrypt the ciphertext in the process of encryption and stored the access structure in the ciphertext. Moreover, we simulated a legal user only with access attributes to decrypt the ciphertext. Therefore, the encryption algorithm generally needs more attributes, which makes the running time cost of the encryption algorithm much higher.Table 3
Experiment running time comparison.
Access structureSizeOursLiang et al. [37]Malluhi et al. [38]Qin et al. [22]EncryptDecryptEncryptDecryptEncryptDecryptEncryptDecryptComparison based on access structure with a fixed number of access attributes (ms)Access = 10Total = 15937.62771311.4487.2846.64781022369.4Total = 191159.6305.61529.8488964.2480.81195.6411Total = 231434.8315.22110.2517.41256.2475.61692.4421.6Total = 271726.23282315507.81361.4460.21893.2394.2Total = 311934332.62755518.61662.4477.82107.6393.8Total = 352098.431229934831649.6445.22356.8386Total = 3922993003173.6458.41769.2432.42435.2371.6Total = 432535.4314.63420.647318574322673370.8Total = 472773.8312.83932.8482.62227.24583372396.8Total = 512788.9307.64015.4460.62340.44253342.8371.8Total = 552924.43084350.64542470.8431.23390.8361.4Comparison based on access structure with a fixed number of total attributes (ms)Total = 30Access = 51840.21592793.2330.41887.43352021230.2Access = 71874.6226.42820425.21846.2412.82112.2347.2Access = 91864.4276.42787403.41729.8446.62143.2341.2Access = 112000351.42647.25221676.6409.42062.8409.4Access = 131963.2441.22575.2604.81699556.22087.8487.8Access = 151835.8455.82691.4705.61644.8667.82120.4576.8Access = 171909.6494.62666.8809.81636.2761.41988.4621.6Access = 191844576.82558.29771657.4830.21992702.8Access = 211904.8656.62600.4980.61682.68962060.8764.8Access = 231883.4720.226081088.41672.4996.42024.6870Access = 251834.2753.42552.41093.21681.81027.81972.6905For a more intuitive comparison, the comparison charts in running time of encryption, decryption, and total are shown in Figures4 and 5. For the running time cost in encryption, our scheme is more efficient than the other scheme in [22, 38] but slightly higher than [37]. Meanwhile, the running time cost of our work has obvious advantages compared with other schemes in the decryption phase. Our scheme has obvious advantages compared with the schemes in [22, 38] for the total running time comparison. It shows that our scheme is more suitable for application in the supply chain information sharing system where many data users need to access user data frequently.Figure 4
Comparison of the running time in experiment 1. (a) Encryption. (b) Decryption. (c) Total.
(a)(b)(c)Figure 5
Comparison of the running time in experiment 2. (a) Encryption. (b) Decryption. (c) Total.
(a)(b)(c)In summary, our scheme has its advantages in the aspects of security, storage, and efficiency compared with the schemes in [22, 37] and [38].


## 9. Conclusion and Future Works

This paper aims to provide an effective access control scheme for a blockchain-based supply chain information sharing system to protect data privacy. Therefore, we propose a new privacy-preserving multiauthority attribute-based access control scheme. Our scheme ensures the confidentiality of blockchain data and provides fine-grained access control for data sharing. Taking into account the actual needs of the system, the scheme also supports user attribute key updates and ciphertext updates to cope with the dynamic change of user attribute authority. Furthermore, the scheme adopts LSSS as the access structure, which improves computational efficiency. In addition, the scheme is proven to be fully secure under the assumption of dual-system encryption. Finally, we prove that our work is feasible and effective through analysis and experimental comparison.In order to test the safety and efficiency of our plan, we are working on implementing our scheme under a real blockchain-based supply chain information sharing system. In addition, our future research focuses on antiquantum attacks and lightweight encryption algorithms.



---

*Source: 8497628-2022-04-12.xml*