# An Efficient Blockchain Based Data Access with Modified Hierarchical Attribute Access Structure with CP-ABE Using ECC Scheme for Patient Health Record

Authors: F. Sammy; S. Maria Celestin Vigila
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Secure patient health record (PHR) information exchange via cloud computing is a considerable security risk to user privacy. The fundamental reason of this issue is cloud computing’s reliance on trustworthy third parties to share data across it. To exchange data securely, many conventional cryptographic algorithms employ various keying approaches. However, relying on a trusted third party compromises the privacy of consumers’ data. To offer secure communication without the involvement of a third party, a distributed blockchain based (DBC) ciphertext–policy attribute-based encryption (CP-ABE) approach is employed in this study. Because of bilinear paring and simple scalar multiplication factors, the proposed CP-ABE system is entirely dependent on elliptic curve cryptography to reduce complexity. Furthermore, the data requester provides dynamic attributes, and a user-centric access policy is created, allowing multiple authorities to manage the attributes and provide data access. Data confidentiality, data authentication, user authentication, and tamper-proof data are all guaranteed by the suggested method. The DBC-CP-ABE method is used to provide user-centric access policies and effective key management.


---

## Body

## 1. Introduction

The Internet of Things (IoT) is a new technology that allows items to communicate with one another across wireless networks. IoT devices are resource-constrained and have challenges with data processing, data storage, and energy consumption. Cloud computing provides a centralized solution to these resource restricted procedures to overcome these limits. The collected data is stored and processed in the cloud, but the cloud can be a trustless environment with major security issues such as single point failure, data tampering, lack of user privacy due to a lack of data access control, Denial of Service (DoS), Man-in-the-Middle attack (MiTM), and password phishing. As a result of permitted data/device access, the cloud environment is prone to security breaches, compromising users' privacy. Many public key secret writing techniques provide a fine-grained access control strategy while also protecting the privacy of users. Among other public key encryption methods, CP-ABE scheme offers one-to-many access control which allows data to be shared across multiple users. But the implementation overhead incurs due to operations with bilinear pairing. It consumes more resources with high computational cost. To overcome this issue, less complex and less resource consumption scalar computation with elliptic curve cryptography (ECC) is used in this work. This reduces the computational requirement by two-three times that of bilinear pairing. This work focuses on building a security system with blockchain where hierarchical access control policy is achieved by combining CP-ABE and ECC. The experiment analysis shows that our scheme outperforms the compared work in cryptographic operations. The major focus of this work is concentrated to achieve the following criteria:(1)
Adoption of straightforward scalar multiplication with ECC and CP-ABE approach reduces procedure overhead caused by bilinear pairing methodology(2)
The proposed method ensures use of multiple authorities to manage attributes and shares multiple data attributes of single data user(3)
To specify the access policy scheme with increased security, the Linear Secret Sharing Scheme (LSSS) is used(4)
Attribute revocation for a data user is achieved with the help of RSA key pair in communication between the data user and Attribute Authority (AA)The following are the last sections: Section2 contains material from the research study that is relevant to the current effort, and Section 3 contains information on the proposed study's contribution. The preliminaries utilized on this project are explained in Section 4. The architecture of the blockchain based hierarchical access control scheme with CP-ABE using ECC is briefly described in Section 5. The modified hierarchical attribute access structure (MHAAS) with CP-ABE employing ECC is explained in Section 6. The integration of HACS-CP-ABE-ECC with blockchain is explained in Section 7. Section 8 summarizes the HACS-CP-ABE-ECC with blockchain security analysis, whereas Section 9 describes the performance evaluation conducted in this study.


## 2. Related Works

Cloud computing offers computation of massive data and data sharing in a promising way [1]. Data are encrypted and shared in cloud computing environment either with symmetric key encryption or public key standards [2–4]. This method has drawback in achieving security [2] and drawback in flexible access control [3] and shows poor performance [4]. To deal with these drawbacks, attribute-based encryption (ABE) is proposed. There are two types of attribute-based encryption: KP-ABE and CP-ABE. Bethencourt et al. [5] were the first to suggest CP-ABE. ABE scheme with bilinear pairing showing less efficiency was proposed [6]. ABE is further refined with CP-ABE involving hierarchical attributes as proposed by [7] to address key management problem [8]. A multiauthority-ABE with dynamic policy attributes is proposed, although the CP-ABE method demonstrates little improvement [9]. An access policy based on the DBDH scheme is proposed. All the CP-ABE methods described above use bilinear mapping using large sized keys. To lessen the complexity of CP-ABE, the decryption method is split into degrees: predecryption and final decryption degrees in [10]. But this method does not ensure forward security. This has been improved in other work [11] where encryption and decryption are outsourced and validated but lack improvement in encryption and decryption process. The work is also extended in [12] by redistributing the encoding and decoding system to fog nodes; however, they are easily attacked. Another decryption outsourcing work proposed in [13] resists against selective ciphertext. Although the work in [14] provides outsourcing of encryption and decryption process, it uses bilinear pairing that remains as hurdle to performance improvement to CP-ABE.CP-ABE does not ensure less storage overhead and good cost-effective solution as it depends on the use of bilinear maps. A bilinear map produces secret keys of larger values and ciphertext with linear associated attribute. And also it uses exponentiation factors for doing encryption and decryption process which relies on linear attributes defined in the access policy [15–17]. The problem of requiring a large key size necessitates the usage of elliptic curve cryptography (ECC) with a smaller key size. This paves the path for CP-ABE to define an access structure utilizing ECC [18–20]. Lightweight devices such as the CP-ABE with constant key size using ECC have been developed, but they are not appropriate for complex access structures [21, 22]. Another lightweight work using KP-ABE without bilinear pairing is proposed but suffers from poor scalability and lack of decryption outsourcing [23]. The overall computation overhead due to bilinear pairing is overcome with ECC [24]. Constant key size with CP-ABE using ABE addressing collision attack problem is proposed in [25]. Alternative to bilinear pairing with ECC to address secured data share is proposed in [26]. All the abovementioned work defines the access policy based on the set of attributes.Betherncourt created the first tree-based access control structure in order to implement AND, OR, and OF strategies [27]; however, it is insecure. Many studies focus on improving access control strategies; however, the time it takes to encrypt and decrypt data grows as the number of attributes increases. The research was furthered by Lewko and Waters, who proposed a technique to convert tree access control to an LSSS and Waters enhanced CP-ABE with a matrix format [28]. With d-parallel BDHE assumption, this gives security. Many studies have refined the use of CP-ABE with flat access control [29–33], constant ciphertext [34], accountability and authorities with attribute revocation [35–38], and improvement in security through accountability and authorities. However, none of these structures support hierarchical file relationships.Hierarchical CP-ABE based on LSSS matrix structure was also studied. By considering hierarchical heads sharing secret keys with users, these approaches lessen the burden of a single head [39, 40]. In this paper, we design a hierarchical based access relation for sharing multiple files [41] in a distributed blockchain context using LSSS. To address the privacy and security concerns, [45] present a unique pairing-free certificateless method that builds a novel reliable and efficient lightweight certificateless signature (CLS) scheme using a state-of-the-art blockchain technique and smart contract. Paper [46] addresses a lightweight and reliable authentication protocol for wireless medical sensor networks (WMSN), which is composed of cutting-edge blockchain technology and physically unclonable functions (PUF), to address physical layer security and the overcentralized server problem in WMSN. The elliptic curve digital signature algorithm (ECDSA), which is one of the essential building blocks of blockchain, is proposed in [47] as an efficient and large-scale batch verification technique with group testing technology. Using edge computing and blockchain approaches, [48] introduces search efficiency, reliability requirements, and a resource allocation scheme to properly handle IoT devices. The study [49] demonstrates how to use erasure coding to overcome data integrity issues in IoT devices.


## 3. Our Contribution

We suggested a blockchain based hierarchical access scheme that uses CP-ABE with ECC in this paper. A hierarchical access hierarchy is defined here, with the user attribute satisfying partially or entirely alone allowing partial or complete access to the data. A root authority (RA) checks and joins all of the domain attribute authorities (AA) in the blockchain. For each AA, RA produces a public key and a master key. It also sends hierarchical access scheme to all AA. RA sends the public key to AA while keeping the master key hidden. AA takes an attribute from the users and generates an address, an RSA key pair, and a private key for that attribute. Based on this, AA distributes the attribute's address, RSA key pair, and private key to the user who satisfies the access structure to decrypt the data. The AA keeps track of the RSA key pair in order to revoke the user's attribute. To reduce computing complexity, the predecryption is outsourced to AA, and AA's trust is kept thanks to the presence of blockchain. The suggested method ensures that data is shared with several authorities and that different attributes of the user's identification are shared.


## 4. Preliminaries

### 4.1. Elliptic Curve Cryptography

ECC is a discrete logarithm problem-based public key cryptography (ECDLP). The elliptic curveE is defined by FG (P), a finite field, and is written as y2 = x3+ax + b (mod p) and 4a3 + 27 b2≠0. Calculate a point on the curve Q = KG, where G is the prime order r generator group over the polynomial time k. The plain texts are transferred to the elliptic curve's point Q. The ECC procedure is broken down into three phases.(a)
Key generation:(1)
Both the data server and the data client have agreed to use the same elliptic curvey2 = x3+ax + b (mod p) and G(2)
The data server generates a random number, Sa ∈ Zp, as the private key, and Pa  =  SaG, as the public key(3)
Data clients generate a private key using a random number Sb ∈ Zp and a public key using Pb  =  SbG(b)
Encryption:The data server encrypts the message withQ by selecting a random number K ∈ Zp, then computes the cypher text C1 = KG and C2 = Q + K Pb, and sends both C1 and C2 to the data clients(c)
Decryption:Data clients use C2–SbC1 = Q + kPb − SbkG = Q to decrypt the message. The message is obtained by mapping to the curve's point Q.


### 4.2. Hierarchical Access Control Strategies

As demonstrated in Figures1 and 2, a hierarchical access control technique allows numerous access structures to be combined into a single structure T.Figure 1
Part of integrated hierarchical access control structure.Figure 2
Part of integrated hierarchical access control process.


### 4.3. Linear Secret Sharing Scheme

Beimel proposed the Linear Secret Sharing Scheme [33]. When all parties make up a share on vector Zp, a Secret Sharing Scheme is defined across linear Zp for various parties. Matrix M was created to generate shares for all parties. Consider the M matrix, which has p rows and q columns. Consider a row of a matrix Mi where i= (1, 2, ......, p) meets the criterion 1, 2, ....., p) ⟶ d, and given a column vector Ō = (s, u2...un) with the secret key s∈ Zp and u2….un ∈ Zp picked at random. M is made up of m shares of s, each of which is dependent. The share mi = (M Ō)i belongs to a specific political party.Consider an LSSSΠ with T as the access tree structure and S ∈T. This denotes an arbitrary permitted set, L⊂ {1 ...p}, and L = {i: mi ∈S.s =  ∑i∈Lωimi and mi are arbitrary secret s specified by ωi which is discovered in the matrix M in polynomial time. There is a vector ω.1,0,…..0=−1 and. ω.Mi  = 0 for the unlawful set of rows i∈L.When a jth secret of a nonleaf node is recovered from a set ofn secrets, the set of attributes { ωi∈Zp} can be discovered in polynomial time by satisfying ∑i∈Lωi,jMiT  =  εj, where j denotes a row vector of length n with the jth element equal to 1 and all other elements equal to 0. As a result, secret share sj  =  ∑i∈Lωi,jmi. The marking method defined by [34] is used to create the LSSS matrix. It translates a Boolean formula-defined access tree to the LSSS matrix technique. In hierarchical access control, this LSSS marking mechanism is employed. According to Figure 3, if the user characteristics only partially satisfy the access structure policy, just a portion of the information is decrypted.Figure 3
Architecture of proposed blockchain based patient centric data access with CP-ABE using ECC.


## 4.1. Elliptic Curve Cryptography

ECC is a discrete logarithm problem-based public key cryptography (ECDLP). The elliptic curveE is defined by FG (P), a finite field, and is written as y2 = x3+ax + b (mod p) and 4a3 + 27 b2≠0. Calculate a point on the curve Q = KG, where G is the prime order r generator group over the polynomial time k. The plain texts are transferred to the elliptic curve's point Q. The ECC procedure is broken down into three phases.(a)
Key generation:(1)
Both the data server and the data client have agreed to use the same elliptic curvey2 = x3+ax + b (mod p) and G(2)
The data server generates a random number, Sa ∈ Zp, as the private key, and Pa  =  SaG, as the public key(3)
Data clients generate a private key using a random number Sb ∈ Zp and a public key using Pb  =  SbG(b)
Encryption:The data server encrypts the message withQ by selecting a random number K ∈ Zp, then computes the cypher text C1 = KG and C2 = Q + K Pb, and sends both C1 and C2 to the data clients(c)
Decryption:Data clients use C2–SbC1 = Q + kPb − SbkG = Q to decrypt the message. The message is obtained by mapping to the curve's point Q.


## 4.2. Hierarchical Access Control Strategies

As demonstrated in Figures1 and 2, a hierarchical access control technique allows numerous access structures to be combined into a single structure T.Figure 1
Part of integrated hierarchical access control structure.Figure 2
Part of integrated hierarchical access control process.


## 4.3. Linear Secret Sharing Scheme

Beimel proposed the Linear Secret Sharing Scheme [33]. When all parties make up a share on vector Zp, a Secret Sharing Scheme is defined across linear Zp for various parties. Matrix M was created to generate shares for all parties. Consider the M matrix, which has p rows and q columns. Consider a row of a matrix Mi where i= (1, 2, ......, p) meets the criterion 1, 2, ....., p) ⟶ d, and given a column vector Ō = (s, u2...un) with the secret key s∈ Zp and u2….un ∈ Zp picked at random. M is made up of m shares of s, each of which is dependent. The share mi = (M Ō)i belongs to a specific political party.Consider an LSSSΠ with T as the access tree structure and S ∈T. This denotes an arbitrary permitted set, L⊂ {1 ...p}, and L = {i: mi ∈S.s =  ∑i∈Lωimi and mi are arbitrary secret s specified by ωi which is discovered in the matrix M in polynomial time. There is a vector ω.1,0,…..0=−1 and. ω.Mi  = 0 for the unlawful set of rows i∈L.When a jth secret of a nonleaf node is recovered from a set ofn secrets, the set of attributes { ωi∈Zp} can be discovered in polynomial time by satisfying ∑i∈Lωi,jMiT  =  εj, where j denotes a row vector of length n with the jth element equal to 1 and all other elements equal to 0. As a result, secret share sj  =  ∑i∈Lωi,jmi. The marking method defined by [34] is used to create the LSSS matrix. It translates a Boolean formula-defined access tree to the LSSS matrix technique. In hierarchical access control, this LSSS marking mechanism is employed. According to Figure 3, if the user characteristics only partially satisfy the access structure policy, just a portion of the information is decrypted.Figure 3
Architecture of proposed blockchain based patient centric data access with CP-ABE using ECC.


## 5. Architecture of Blockchain Based Hierarchical Access Control Scheme with CP-ABE Using ECC (BHACS-CP-ABE-ECC)

Certificate authority (CA), attribute authority for personal, health, and insurance domain, cloud service provider, data owner (DO), data clients (DC), and edge nodes for predecryption process are all part of the proposed blockchain linked architecture. Figure3 depicts the proposed scheme framework. The following is a description of each participant’s functionality:(1)
Root authority (RA): the main role RA is to provide identity of the communicating nodes by considering the security parameter (K) of the node and generates public parameter (PP). To generate a public key and master key for an attribute, this public parameter is submitted to the appropriate attribute authority.(2)
Attribute authority (AA): attribute authority of the domain extracts the attributes of their respective data clients. Attribute authority further generates public key and master key for that attribute.(3)
Cloud storage: cloud storage serves to store encrypted data (CT) sent by the data owners.(4)
Data owners (DO): the data is encrypted before being uploaded to the cloud server by the data owners. It creates ciphertext CT using plaintext B, the matching public key PK, and the access policy given by the LSSS matrix structure (M,m).(5)
Data clients (DC): data clients are responsible for performing decryption on CT. Deciphering is done in two stages. First the local server near the DC serves as edge nodes and does partial encryption by inputting CT and SK. Finally the DC decrypt the partial decrypted CT to plaintext by considering CT′ and DSK.


## 6. Modified Hierarchical Attribute Access Structure (MHAAS) with CP-ABE Using ECC

The following section explains the process carried out using hierarchical access policy structure (Schemes1–5).Scheme 1
System initialization at root authority.Scheme 2
Generation of public and master key by attribute authority.Scheme 3
Encryption by data owners.Scheme 4
Key generation for data decryption by attribute authority.Scheme 5
Decryption by data clients.


## 7. Integration of HACS-CP-ABE-ECC with Blockchain

The hierarchical access control scheme employing with ciphertext ABE using ECC is integrated with blockchain and its operation is explained below.The operation of this method is explained as six principal components as initialization phase, authority creation, user creation, ciphertext data upload, creation and issuance of attributes, and revoke attribute. This process includes the reception of only the secret key of the attribute for a particular address in its wallet alone is specified in the process. The encryption, decryption, and retrieval of public key of the attribute are omitted here.(a)
Initialization phase: this phase includes initialization of blockchain and setting of hierarchical access based policy scheme to all attribute authorities in different domains and provides permission chain through RA. The RA performs mining of the genesis block. For all attribute authority domains, RA is in charge of producing pubic key PK and master key MSK. Everyone has access to the public key, while the master key is kept hidden in order to generate the private key for data decryption.(b)
Authority creation: RA uses MSK of theAttribute Authority Domains and generates private key SKAU for each AA domain. For this, RA generates new address {p, RSASK,RSAPK} for each AA domain and transmits public key and RSA key pair to all AA domains. RSA key pair is used to transmit the symmetric encryption key securely to all the requester. RA provides “transmit”, “receive,” and permission rights to all AA domain and joins the blockchain system.(c)
User creation: now the respective AA adds the individual users and obtains the attributes from the users in the domain. AA generates the addressu, RSA key pair, and private key of the individual users SKUSER. AA transmits the address u and RSA key pair to the individual users and keeps the SKUSER with AA.(d)
Ciphertext data upload: data owners create ciphertext of the data and uploads the hashed ciphertext to the cloud storage.(e)
Attribute creation and distribution: data owners specify the LSSS policy for all data requesters via AA. AA holds the LSSS policy attributes and generates the data decryption private key for the each data requester. Data clients who satisfy the partial or full policy structure are granted access to the data; otherwise, access is refused.(f)
Revoke attribute: since AA holds the attributes of the data clients, it can also withdraw the attributes as it holds the RSA key pair of the attribute for the particular data client. It revokes all the attributes of the data client.


### 7.1. Functions of the Blockchain Components

#### 7.1.1. Root Authority

BHACS-CP-ABE-ECC:(1)
Initialization phase-(PP⟶PK,MSK)(2)
Authority Creation(PK,MSK,P)⟶SK_AA1,SK_AA2…SK_AAnFunctions of RA:(1)
Blockchain creation(2)
Permits all AA to join the blockchain(3)
Grants connect, send, and receive permission to all AAs


#### 7.1.2. Attribute Authority

(1)
User creation(2)
Obtains attributes from the data requester(3)
Creates address and RSA key pair and private key for a particular attribute of the data requester(4)
Sends LSSS access policy to all the data requester(5)
Pre-Decryption of CT(6)
Revoke attributes for a particular data requester


#### 7.1.3. Data Owner

(1)
Define and send LSSS access policy to all AA(2)
Data is encrypted and sent to cloud storage using the symmetric encryption technique(3)
Shares the symmetric key securely using RSA key pair to the entire AA


#### 7.1.4. Data Clients

(1)
Sends the attribute list to the AA of that domain(2)
Performs final decryption of the data requested


## 7.1. Functions of the Blockchain Components

### 7.1.1. Root Authority

BHACS-CP-ABE-ECC:(1)
Initialization phase-(PP⟶PK,MSK)(2)
Authority Creation(PK,MSK,P)⟶SK_AA1,SK_AA2…SK_AAnFunctions of RA:(1)
Blockchain creation(2)
Permits all AA to join the blockchain(3)
Grants connect, send, and receive permission to all AAs


### 7.1.2. Attribute Authority

(1)
User creation(2)
Obtains attributes from the data requester(3)
Creates address and RSA key pair and private key for a particular attribute of the data requester(4)
Sends LSSS access policy to all the data requester(5)
Pre-Decryption of CT(6)
Revoke attributes for a particular data requester


### 7.1.3. Data Owner

(1)
Define and send LSSS access policy to all AA(2)
Data is encrypted and sent to cloud storage using the symmetric encryption technique(3)
Shares the symmetric key securely using RSA key pair to the entire AA


### 7.1.4. Data Clients

(1)
Sends the attribute list to the AA of that domain(2)
Performs final decryption of the data requested


## 7.1.1. Root Authority

BHACS-CP-ABE-ECC:(1)
Initialization phase-(PP⟶PK,MSK)(2)
Authority Creation(PK,MSK,P)⟶SK_AA1,SK_AA2…SK_AAnFunctions of RA:(1)
Blockchain creation(2)
Permits all AA to join the blockchain(3)
Grants connect, send, and receive permission to all AAs


## 7.1.2. Attribute Authority

(1)
User creation(2)
Obtains attributes from the data requester(3)
Creates address and RSA key pair and private key for a particular attribute of the data requester(4)
Sends LSSS access policy to all the data requester(5)
Pre-Decryption of CT(6)
Revoke attributes for a particular data requester


## 7.1.3. Data Owner

(1)
Define and send LSSS access policy to all AA(2)
Data is encrypted and sent to cloud storage using the symmetric encryption technique(3)
Shares the symmetric key securely using RSA key pair to the entire AA


## 7.1.4. Data Clients

(1)
Sends the attribute list to the AA of that domain(2)
Performs final decryption of the data requested


## 8. Security Analysis of BHACS-CP-ABE-ECC

The following section examines the proposed scheme's security. Under the assumption of DDH, the security model is considered as being secure.The proposed method supports multiauthority and multiattribute from single data user. For each attribute, attribute authority generates a set of {address, RSA key pair, and private key). The address, master key, and RSA key pair are preserved by the AA to secure the system against adversary attacks and to perform attribute revocation. Instead of bilinear pairing, the computing phase uses basic scalar multiplication, which makes the procedure more efficient with the compared models. Also, the decryption process is done at two stages: one at the AA end and the other at the data requester which makes the decryption process lighter at the data requester end.


### 8.1. Security Assumption under Decisional Diffie–Hellman

The proposed model considers Decisional Diffie–Hellman (d-DDH) Assumption and described as follows: the challenger chooses F, a cyclic group with prime orders, and G, a cyclic group F generator, while y and k are chosen at random from Zs. Despite being given a tuple of (G, yG, kG), the adversary finds it difficult to validate y, k, G in polynomial time from random element X ∈ F. The algorithm A overcomes the DDH problem with a constant factor ρ which is obtained from |Fs[A(G, yG, kG, Z = ykG) = 0] − Fs[A(G, yG, kG, Z = X) = 0]| ≥ ρ.


### 8.2. Security under Chosen Ciphertext Attack

The communication between adversaryδ and the challenger ∁ is given below. The summons is given an access structure (T, m) by the opponent. The initialization algorithm is run by challenger. The system's public parameter is used to compute the public and secret keys, with the public key being sent to the opponent. Stage 1: the adversary queries the secret keys of the attribute from the challenger. The challenger records the attributes provided by the adversary in the list and stores it with the corresponding adversary address in the attribute list.Challenge phase: here the challenger picks out two identical-length messages (B0, B1) ∈ Zp. Then the challenger selectsβ ∈ {0, 1} and forwards B β under matrix (T∗, m) to challenger δ.Stage 2: the adversary inquires about the secret key with same input queries in Stage 1. Guess: the guess that the adversary creates is equal to ½, the probability of guessingβ0 of β. The game is defined as [Fs [β0 = β] − 1/2. Thus our model is secure against selective ciphertext attack.


### 8.3. Data Security

The adversary is unable to obtain to decrypt the ciphertext as its attribute must satisfy the access policy defined in the matrix structure corresponding to a row of Tm. For unauthorized set of rowsL, there exists a vector ω.1,0,…..0=−1 and ω.Mi  = 0 for i∈L, where L = {i: mi∈S.s and ω is the polynomial time in matrix M. The adversary cannot calculate the first element of vector ω. Thus, the proposed scheme ensures the data security.


### 8.4. Forward Security

The attribute authority revokes the attribute of the user with the users address and RSA key pair. The user/address of the revoked attribute cannot decrypt the data again as AA has deleted/blocked the address of the corresponding attribute from the attribute list. Hence the proposed method ensures forward security.


### 8.5. Collision Resistance

The proposed method ensures resistance to collision attack. The hierarchical access structure policy has been defined in the system. There is a chance of colliding with same access policy generated by multiple users. In this system, a unique address is generated for each set of attributes defined by different users. Hence address of UserA≠ address of UserB. This uniqueness provides collision-free system.


### 8.6. Data Integrity

The owner of the data computes ciphertext with symmetric encryption key algorithmE to encode the plaintext message B using symmetric key cr and calculates the ciphertext data CTd  =  Ecr (B). Then the hash value on the ciphertext data HCT  =  HCTdG is calculated. This ensures data integrity. The final cryptic message uploaded to the cloud is CT=M,m,C0, {C1,x,C2,x,,C3,x,,CTd,, HCT. During decryption, the hash value is used to ensure data integrity at the data requester end.


### 8.7. Unauthorized Communication

In each level, the data is decrypted using the user address and an RSA key pair. For each set of attributes defined by distinct users, a unique address is generated in this system. As a result, user A’s address is different from user B's address and the unauthorized users cannot be entirely in the system. This prevents unauthorized hierarchical communication between nodes.


## 8.1. Security Assumption under Decisional Diffie–Hellman

The proposed model considers Decisional Diffie–Hellman (d-DDH) Assumption and described as follows: the challenger chooses F, a cyclic group with prime orders, and G, a cyclic group F generator, while y and k are chosen at random from Zs. Despite being given a tuple of (G, yG, kG), the adversary finds it difficult to validate y, k, G in polynomial time from random element X ∈ F. The algorithm A overcomes the DDH problem with a constant factor ρ which is obtained from |Fs[A(G, yG, kG, Z = ykG) = 0] − Fs[A(G, yG, kG, Z = X) = 0]| ≥ ρ.


## 8.2. Security under Chosen Ciphertext Attack

The communication between adversaryδ and the challenger ∁ is given below. The summons is given an access structure (T, m) by the opponent. The initialization algorithm is run by challenger. The system's public parameter is used to compute the public and secret keys, with the public key being sent to the opponent. Stage 1: the adversary queries the secret keys of the attribute from the challenger. The challenger records the attributes provided by the adversary in the list and stores it with the corresponding adversary address in the attribute list.Challenge phase: here the challenger picks out two identical-length messages (B0, B1) ∈ Zp. Then the challenger selectsβ ∈ {0, 1} and forwards B β under matrix (T∗, m) to challenger δ.Stage 2: the adversary inquires about the secret key with same input queries in Stage 1. Guess: the guess that the adversary creates is equal to ½, the probability of guessingβ0 of β. The game is defined as [Fs [β0 = β] − 1/2. Thus our model is secure against selective ciphertext attack.


## 8.3. Data Security

The adversary is unable to obtain to decrypt the ciphertext as its attribute must satisfy the access policy defined in the matrix structure corresponding to a row of Tm. For unauthorized set of rowsL, there exists a vector ω.1,0,…..0=−1 and ω.Mi  = 0 for i∈L, where L = {i: mi∈S.s and ω is the polynomial time in matrix M. The adversary cannot calculate the first element of vector ω. Thus, the proposed scheme ensures the data security.


## 8.4. Forward Security

The attribute authority revokes the attribute of the user with the users address and RSA key pair. The user/address of the revoked attribute cannot decrypt the data again as AA has deleted/blocked the address of the corresponding attribute from the attribute list. Hence the proposed method ensures forward security.


## 8.5. Collision Resistance

The proposed method ensures resistance to collision attack. The hierarchical access structure policy has been defined in the system. There is a chance of colliding with same access policy generated by multiple users. In this system, a unique address is generated for each set of attributes defined by different users. Hence address of UserA≠ address of UserB. This uniqueness provides collision-free system.


## 8.6. Data Integrity

The owner of the data computes ciphertext with symmetric encryption key algorithmE to encode the plaintext message B using symmetric key cr and calculates the ciphertext data CTd  =  Ecr (B). Then the hash value on the ciphertext data HCT  =  HCTdG is calculated. This ensures data integrity. The final cryptic message uploaded to the cloud is CT=M,m,C0, {C1,x,C2,x,,C3,x,,CTd,, HCT. During decryption, the hash value is used to ensure data integrity at the data requester end.


## 8.7. Unauthorized Communication

In each level, the data is decrypted using the user address and an RSA key pair. For each set of attributes defined by distinct users, a unique address is generated in this system. As a result, user A’s address is different from user B's address and the unauthorized users cannot be entirely in the system. This prevents unauthorized hierarchical communication between nodes.


## 9. Performance Evaluations

This section briefs the performance evaluation in terms of used system properties, communication overhead, and computation overhead with the previous works and the proposed work.The subsequent section describes Table1 that provides the comparative study of the proposed approach with other research works carried out.Table 1
Performance comparison of the proposed study with other research studies.
Research studyPairing freeAccess structureMultiauthorityDecryption outsourcing[21]YesAND gateNoNo[24]YesLSSSNoNo[42]YesAND gateNoNo[43]YesAND gateNoYes[44]YesLSSSYesYesProposed workYesHierarchical LSSSYesYesFrom Table1, it is found that all the works carried out rely on ECC scheme rather than bilinear pairing and [24, 44] use LSSS based access structure where [21, 42, 43] use AND gate access structure whose performance is lesser than the previous LSSS approach. The proposed work differs from all the above by adopting hierarchical access structure with LSSS. Each attribute set corresponds to a row of a matrix in LSSS structure. Thus, our scheme supports multiauthority and multiple data access method.Table2 describes the computation cost encountered in current research study and compared study. The entire scheme employs common ECC with 160 bit by G. It seems that our scheme considers a single row in matrix structure for performing cryptographic operation which is more efficient than the compared schemes.Table 2
Computation cost of the compared algorithms.
SchemeEncryptionPredecryptionLocal decryption[21](Nt − |Λ| + 2)g—(Nt − |Λ| + 3)g[24](3 Ns + 1)g—(Dt + 1)g[42](Ns + 1)g—(Dt + 1)g[43](Nt − |Λ| + 1)g—(Nt − |Λ| + 2)g[44](4 Ns + 1)g(Dt + 1)g(1)gProposed work(Ns + 1)g(Dt + 1)g(1)gNs: total number of rows in the matrix Λ, Nt: system attributes, Dt: number of rows in access matrix Λ, Nt: total number of attributes in the system, Dt: number of attributes fulfilling the access policy, |Λ|: access policy attributes, and g: ECC scalar factor for multiplication.It is observed that, from [21, 43], the computation overhead depends on the difference between the number of attributes defined in the access policy and the total attributes in the system. Schemes in [24, 44] depend on different attribute set to perform cryptographic process. The scheme in [42] uses KP-ABE and our scheme uses CP-ABE and has efficient encryption process as the encryption process depends on set of attributes alone. But there is an overhead in decryption process in the scheme in [42] as the end node has to do total decryption process. But our scheme offloads the predecryption process to AA and final decryption at the end nodes. The proposed work excels other compared works in computation and communication cost.Table3 discusses the communication cost observed in our work and other compared works. Compared with other works, our scheme and the scheme in [44] have increased communication overhead as predecryption process is carried at the AA in our scheme and at edge nodes in the scheme in [44]. Also revocation process is carried at AA in our scheme without affecting other components in the system. Hence the communication overhead at the end data requester is minimum compared with others.Table 3
Communication overhead of the compared algorithms.
SchemePrivate key (bits)Public key (bits)Ciphertext (bits)[21]2∗ |g|(3Nt + 1)|g|(Nt − |Λ| + 3)|g|[24](|Λ|)|g|(2Nt + 2)|g|(2 Ns + 1)|g|[42](Ns + 1)|g|(2Nt + 2)|g|(2 Ns + 2)|g|[43]1∗ |g|(Nt + 1)|g|(Nt − |Λ| + 2)|g|[44](|Λ|)|g|(2Nt + 2)|g|(3 Ns + 1)|g|Proposed work(|Λ|)|g|(Nt+ 2)|g|(Ns + 1)|g|Ns: total number of rows in the matrix Λ, Nt: system attributes, Dt: number of rows in access matrix Λ, Nt: total number of attributes in the system, Dt: number of attributes fulfilling the access policy, |Λ|: access policy attributes, and g: ECC scalar factor for multiplication.To excel our scheme, we implemented our proposed work in Ubuntu platform. It is deployed with Python and charm library to implement the ECC using simple scalar multiplication. The scheme is implemented with 512-bit ECC where 160 bits serves as ECC group order. In Figures4 and 5, we show that our scheme excels the work done in [24, 44] in executing cryptographic operations. Our scheme excels [24, 44] in executing encryption method and decryption outsourcing is performed in the proposed work and [44]; hence it has same decryption time.Figure 4
Comparison of encryption time (ms).Figure 5
Comparison of decryption time (ms).


## 10. Conclusion

The proposed work uses CP-ABE using ECC in blockchain network with hierarchical access structure. The scheme considers multiple authorities and multiple data access by defining the attribute set. The attribute set is represented as row in LSSS matrix structure. For each attribute set, a unique address is generated along with RSA key pair. This pair is helpful in revoking the attribute, thereby providing security from unauthorized users. Further, the security mechanism of the proposed work is defined under d-DDH assumption. From the experimental analysis, it is found that our scheme shows better outcome than the compared work. The constraint of the current work affects the ciphertext length with increase in number of attributes. Hence, in future work an efficient CP-ABE will focus on alleviating this problem.



---

*Source: 8685273-2022-03-08.xml*