# Practical Multiauthority Attribute-Based Access Control for Edge-Cloud-Aided Internet of Things

Authors: Kaiqing Huang; Xueli Wang; Zhiqiang Lin
Journal: Security and Communication Networks
 (2021)

---

## Abstract

With the assistance of edge computing which reduces the heavy burden of the cloud center server by using the network edge servers, the Internet of Things (IoTs) architectures enable low latency for real-time devices and applications. However, there still exist security challenges on data access control for the IoT. Multiauthority attribute-based encryption (MA-ABE) is a promising technique to achieve access control over encrypted data in cross-domain applications. Based on the characteristics and technical requirements of the IoT, we propose an efficient fine-grained revocable large universe multiauthority access control scheme. In the proposed scheme, the most expensive encryption operations have been executed in the user’s initialization phase by adding a reusable ciphertext pool besides splitting the encryption algorithm to online encryption and offline encryption. Massive decryption operations are outsourced to the near-edge servers for reducing the computation overhead of decryption. An efficient revocation mechanism is designed to change users’ access privileges dynamically. Moreover, the scheme supports ciphertext verification. Only valid ciphertext can be stored and transmitted, which saves system resources. With the help of the chameleon hash function, the proposed scheme is proven CCA2-secure under the q-DPBDHE2 assumption. The performance analysis results indicate that the proposed scheme is efficient and suitable in edge computing for the IoT.


---

## Body

## 1. Introduction

With the development of the 5G network and the Internet of Things (IoTs) technology, more and more objects are connected to the network via information sensing devices which generate a huge amount of data [1, 2]. Cisco predicted that the total amount of data created (and not necessarily stored) by any device will reach 847 ZB per year by 2021 [3].In traditional cloud computing modes, these massive data are all sent to the cloud for storing and processing, which consumes a large amount of network bandwidth and computing resources. Moreover, massive access requests from users may lead to service interruption and generate traffic overload or even network delay, etc. As a result, the edge computing model is proposed to offload computing tasks to edge servers [4–9].In an edge computing model, the network edge servers near the data source will preliminarily handle the data and tasks and serves the adjacent devices in time. Then, it selectively sends the important data to the core network (cloud). Consequently, the edge servers reduce the load of cloud centers and ensure efficient network operation for improved services.However, edge computing is facing some new challenging issues [4–9]. On the one hand, the users’ data are mostly privacy-sensitive. A good way to ensure data security and privacy protection is that the data are encrypted before being outsourced and only allow authorized users to access it. On the other hand, users frequently enter and leave the network, and their access privileges change dynamically, which makes the access control of users’ data complex and dynamic. Unfortunately, it is difficult for traditional access control technology to deal with the above problems in such a complex edge computing environment. Therefore, an efficient lightweight data encryption mechanism with fine-grained access control is indispensable for the IoT.Attribute-based encryption (ABE) is a promising technique (cryptosystem) for protecting data confidentiality and dynamic fine-grained authorized access control through the attribute management, with which the data owners can encrypt data files according to the attribute of the target recipients without knowing their exact identities.In 2005, Sahai and Waters introduced fuzzy identity-based encryption (FIBE) which can be applied to enable encryption using error-tolerance biometric inputs as identities. Moreover, FIBE is extended into attribute-based encryption (ABE) by defining the biometric identity as a set of attributes [10]. In 2006, Goyal et al. distinguished ABE into key-policy attribute-based encryption (KP-ABE) and ciphertext-policy attribute-based encryption (CP-ABE) [11]. In KP-ABE, secret keys are associated with access policies, and ciphertexts are associated with attributes, while in CP-ABE, the ciphertexts are associated with access policies, and secret keys are associated with attributes. Decryption is enabled if and only if the user’s attribute set satisfies the ciphertext access structure. Goyal et al. gave a secure construction of KP-ABE [11], and Bethencourt et al. presented a secure CP-ABE construction against collusion attacks in the generic group model [12]. In 2008, Goyal et al. presented the first construction of a ciphertext-policy attribute-based encryption scheme with a security proof based on a number-theoretic assumption [13]. In 2011, Waters presented the first CP-ABE construction which is proven selectively secure under the decisional parallel bilinear Diffie-Hellman exponent (PBDHE) assumption in the standard model. In 2013, Rouselakis and Waters proposed two large universe attribute-based encryption constructions (CP-ABE and KP-ABE) on prime-order bilinear groups. Both schemes are selectively secure in the standard model under two “q-type” assumptions [14]. However, all these schemes are single-authority ABE.


### 1.1. Issues and Related Work

Attribute-based access control in the IoT should efficiently address some practical issues in the following details.Firstly, the massive data produced in the IoT are used in large-scale cross-domain applications. Multipart collaborative (MPC) is one of the motivating scenarios, where data owners want to share their data across different domains and organizations. To illustrate, in a multiexpert cooperative diagnosis system, a patient Alice may need to share her medical data generated by medical wearing equipment with different experts in different affiliations. She defines the access policy as “surgeon@hospital A” or “surgeon@hospital B and medical researcher@research center C,” where the attributes “surgeon@hospital A,” “surgeon@hospital B,” and “medical researcher@research center C” are issued by “hospital A,” “hospital B,” and “research center C,” respectively. In this scenario, three authorities, “hospital A,” “hospital B,” and “research center C,” are needed. Meanwhile, in ABE schemes, if the system attribute universe is “small,” the attributes are fixed and enumerated at system setup, which is not practical in the IoT. Conversely, in “large universe” construction, any string can be used as an attribute, and the attributes are not necessarily enumerated at system setup, which is more flexible and practical for the IoT.To deal with the scenario that the users’ attributes are issued by different authorities in the same system, Chase proposed multiauthority attribute-based encryption, which is the first construction to support multiple attribute authorities in 2007 [15]. In 2009, Chase and Chow proposed a solution that removes the trusted central authority and protects the users’ privacy by preventing the authorities from pooling their information on particular users [16]. In 2011, Lewko and Waters proposed the first fully secure multiauthority ciphertext-policy attribute-based encryption system which does not require any central authority and collision resistance. They proved their system secure using the dual system encryption methodology in the random oracle model [17]. In 2011, Liu et al. proposed a new multiauthority CP-ABE system which is adaptively secure in the standard model with adaptive authority corruption and can support the large attribute universe [18]. In 2015, Rouselakis and Waters proposed an efficient large-universe multiauthority ciphertext-policy attribute-based encryption system, which uses the significantly faster prime-order bilinear groups rather than composite order groups [19].Secondly, in the IoT, data users may change their subscription or leave the system, which results in losing part of the access privileges or all the access privileges. To protect the interests of the data owners, an efficient and secure revocation mechanism must be designed. In the above example, an expert Bower with the attribute set “surgeon@hospital B, medical researcher@research center C” departures from research center C, then he loses the privilege to access Alice’s encrypted data. To avoid Alice’s privacy disclosure, the authority “research center C” should revoke Bower’s attribute “medical researcher@research center C.” Similarly, when Bower departures from the multiexpert cooperative diagnosis system, Bower should be revoked from the system. When the attribute “medical researcher@research center C” is dropped by the authority “research center C,” it also should be revoked.To solve the security problems brought by the dynamic change in users’ access privilege, researchers have come up with revocable ABE. In 2008, Boldyreva et al. firstly proposed an ABE scheme with indirect user revocation. The sender encrypts with the present time slot regarded as an attribute. The authority who possesses the current revocation list, periodically announces the key update material so that only unrevoked users can update their key and decrypt ciphertexts [20]. In 2009, Attrapadung and Imai proposed an ABE system with direct user revocation. It allows senders to specify the revocation list directly when encrypting [21]. The authority does not need to update the secret key concerning the revoked attribute for each nonrevoked user. But it should publish a revocation list and the data users are required to synchronize this revocation list all the time, which makes it not suitable for large-scale systems. It still faces a backward security problem that the revoked users can access the old data they were authorized to access before being revoked. In 2009, Attrapadung and Imai presented the first hybrid revocable ABE scheme that allows senders to select on-the-fly whether to use either direct or indirect revocation mode when encrypting [22]. In 2011, based on the subset-cover revocation framework [23], Hur et al. proposed an access control mechanism using CP-ABE to enforce access control policies with efficient attribute and user revocation capability [24]. In 2012, Sahai et al. introduced the concept of revocable storage and proposed the revocable ABE by updating keys and CSP by updating ciphertext without accessing any secret information, and the updated ciphertexts are no longer decryptable by revoked users, but the schemes are inefficient [25]. In 2013, Yang et al. constructed a new multiauthority CP-ABE scheme and designed an attribute revocation method that can achieve both forward security and backward security, which is secure under weaker security assumptions [26]. However, the scheme only supports the small attribute universe. In 2017, Li et al. provided a CP-ABE scheme with efficient user revocation by introducing the concept of user group [27].Thirdly, in ABE, bilinear pairing operation is an expensive computation cost, and its number increases along with the number of attributes involved in the access structure. The drawback of high computation overhead in the ABE schemes with multifunction becomes more serious for resource-constrained users such as mobile devices, sensors, and medical wearing equipment [28]. To save energy for the resource-constrained users and ensure the rapid generation and acquisition of the data, some technologies should be used to reduce the computational overhead both in the encryption phase and the decryption phase.For eliminating the overhead of decryption for users, Matthew Green et al. [29] gave the methods for efficiently and securely outsourcing decryption which offloads most decryption operations to a third-part server provider and returns a partial decryption ciphertext. The user performs only a little time of exponential operation to recover the plaintext. In 2013, Lai et al. firstly constructed a concrete ABE scheme with verifiable outsourced decryption which allows for verifiability of the partial decryption ciphertext [30]. Li et al. proposed a new secure outsourced ABE system, which supports both secure outsourced key-issuing and decryption with checkability of the outsourced computation results in an efficient way [31]. There are also some works to make verifiable outsourced decryption more efficiently and securely in ABE [32–34].Meanwhile, for saving online computation, Hohenberger and Waters proposed the first online/offline ABE [35] which splits the encryption into two phases: the data owner does as much precomputation as possible to encrypt a message or create a secret key in the offline phase and rapidly assembles a ciphertext or key in the online phase. It is a promising technique for resource-limited devices. In 2018, Li et al. proposed a new scheme that eliminates a majority of the encryption computation task by adding system public parameters [36].Last but not the least, it may be that the data owner device makes an error to generate the wrong ciphertext, or the malicious user generates many wrong ciphertexts to attack the system. These wrong ciphertext not only waste system resources but also waste user resources. For example, it wastes data user resources to decrypt the error ciphertext which returns an error result even though his attributes satisfy the access structure. A ciphertext verification algorithm should be used to eliminate invalid ciphertexts as much as possible. In 2014, Liu et al. proposed a KP-ABE scheme with the public ciphertext test, but the verify equations grow linearly with the number of the attributes involved in the access structure, which requires high computation overhead [37].


### 1.2. Motivation and Contributions

Recently, there have been many researchers who proposed the multifunctional MA-ABE system trying to meet the above needs, but no one solving all the issues simultaneously. In 2017, De and Ruj proposed a decentralized attribute-based encryption scheme with online/offline encryption, outsourced decryption, and user revocation, but their scheme only supports the small universe [38]. In 2018, Liu et al. designed an MA-ABE scheme that simultaneously supports the large attribute universe, outsourcing decryption, and attribute revocation, but their scheme is statically secure, without online/offline encryption and ciphertext publicly verifiable [39]. In 2019, Li et al. constructed a CCA2-secure publicly verifiable revocable large-universe multiauthority attribute-based encryption, but their scheme does not support online/offline encryption and outsourcing decryption [40]. In their scheme, the verify equations grow linearly with the number of the attributes involved in the access structure, which require high computation overhead. Moreover, if the user’s some attributes involved in the ciphertext are revoked, she/he will fail to verify the validity of the ciphertext even though her/his rest attributes still have the access privilege to the ciphertext.As we revisited the existing ABE schemes, no one simultaneously solves all the practical issues. Most of them only concentrate on solving one specific issue. A few schemes try to solve some issues but cause new problems. Therefore, we designed an efficient, CCA2-secure, flexible, fine-grained access control scheme for the IoT using edge computing, which can solve the above issues efficiently. The proposed scheme meets the need of the large-scale multidomain collaboration in the IoT by using multiauthority attribute-based encryption with the large attribute universe. More contributions are as follows:(1)
By adding a reusable ciphertext pool, the most expensive encryption operations have been executed in the user’s initialization phase, which minimizes the offline/online encryption computation. At the same time, the near-edge servers can perform the major decryption with the help of transformed keys given by the data user. As a result, the computation overhead of encryption and decryption is substantially reduced both on the data owner and user sides, so the scheme is suitable for the resource-constrained users in the IoT.(2)
The proposed scheme designs a fine-grained revocation mechanism to revoke an attribute from the user, by which the user or the attribute can be revoked from the system. So, it can change the user’s access privilege timely and is fit for the dynamic IoT.(3)
The scheme supports efficient ciphertext verification, and only valid ciphertext can be stored and transmitted, which saves the system resources. For reducing the computation overhead, we combine all the verify equations into one equation like a “hash function” which reduces expensive pairing operation. Moreover, the user can verify the validity of the ciphertext even though some attributes involved in the ciphertext are revoked, only if the rest of her/his attributes still have the access privilege to the ciphertext.(4)
With the help of the chameleon hash function, the simulator successfully prepares the challenge ciphertext with the dummy attribute in the security proof. Consequently, the proposed scheme is proven CCA2-secure under the q-DPBDHE2 assumption, which is more secure than the previous scheme. The performance analysis results indicate that the proposed scheme is efficient and suitable in edge computing for the IoT.


## 1.1. Issues and Related Work

Attribute-based access control in the IoT should efficiently address some practical issues in the following details.Firstly, the massive data produced in the IoT are used in large-scale cross-domain applications. Multipart collaborative (MPC) is one of the motivating scenarios, where data owners want to share their data across different domains and organizations. To illustrate, in a multiexpert cooperative diagnosis system, a patient Alice may need to share her medical data generated by medical wearing equipment with different experts in different affiliations. She defines the access policy as “surgeon@hospital A” or “surgeon@hospital B and medical researcher@research center C,” where the attributes “surgeon@hospital A,” “surgeon@hospital B,” and “medical researcher@research center C” are issued by “hospital A,” “hospital B,” and “research center C,” respectively. In this scenario, three authorities, “hospital A,” “hospital B,” and “research center C,” are needed. Meanwhile, in ABE schemes, if the system attribute universe is “small,” the attributes are fixed and enumerated at system setup, which is not practical in the IoT. Conversely, in “large universe” construction, any string can be used as an attribute, and the attributes are not necessarily enumerated at system setup, which is more flexible and practical for the IoT.To deal with the scenario that the users’ attributes are issued by different authorities in the same system, Chase proposed multiauthority attribute-based encryption, which is the first construction to support multiple attribute authorities in 2007 [15]. In 2009, Chase and Chow proposed a solution that removes the trusted central authority and protects the users’ privacy by preventing the authorities from pooling their information on particular users [16]. In 2011, Lewko and Waters proposed the first fully secure multiauthority ciphertext-policy attribute-based encryption system which does not require any central authority and collision resistance. They proved their system secure using the dual system encryption methodology in the random oracle model [17]. In 2011, Liu et al. proposed a new multiauthority CP-ABE system which is adaptively secure in the standard model with adaptive authority corruption and can support the large attribute universe [18]. In 2015, Rouselakis and Waters proposed an efficient large-universe multiauthority ciphertext-policy attribute-based encryption system, which uses the significantly faster prime-order bilinear groups rather than composite order groups [19].Secondly, in the IoT, data users may change their subscription or leave the system, which results in losing part of the access privileges or all the access privileges. To protect the interests of the data owners, an efficient and secure revocation mechanism must be designed. In the above example, an expert Bower with the attribute set “surgeon@hospital B, medical researcher@research center C” departures from research center C, then he loses the privilege to access Alice’s encrypted data. To avoid Alice’s privacy disclosure, the authority “research center C” should revoke Bower’s attribute “medical researcher@research center C.” Similarly, when Bower departures from the multiexpert cooperative diagnosis system, Bower should be revoked from the system. When the attribute “medical researcher@research center C” is dropped by the authority “research center C,” it also should be revoked.To solve the security problems brought by the dynamic change in users’ access privilege, researchers have come up with revocable ABE. In 2008, Boldyreva et al. firstly proposed an ABE scheme with indirect user revocation. The sender encrypts with the present time slot regarded as an attribute. The authority who possesses the current revocation list, periodically announces the key update material so that only unrevoked users can update their key and decrypt ciphertexts [20]. In 2009, Attrapadung and Imai proposed an ABE system with direct user revocation. It allows senders to specify the revocation list directly when encrypting [21]. The authority does not need to update the secret key concerning the revoked attribute for each nonrevoked user. But it should publish a revocation list and the data users are required to synchronize this revocation list all the time, which makes it not suitable for large-scale systems. It still faces a backward security problem that the revoked users can access the old data they were authorized to access before being revoked. In 2009, Attrapadung and Imai presented the first hybrid revocable ABE scheme that allows senders to select on-the-fly whether to use either direct or indirect revocation mode when encrypting [22]. In 2011, based on the subset-cover revocation framework [23], Hur et al. proposed an access control mechanism using CP-ABE to enforce access control policies with efficient attribute and user revocation capability [24]. In 2012, Sahai et al. introduced the concept of revocable storage and proposed the revocable ABE by updating keys and CSP by updating ciphertext without accessing any secret information, and the updated ciphertexts are no longer decryptable by revoked users, but the schemes are inefficient [25]. In 2013, Yang et al. constructed a new multiauthority CP-ABE scheme and designed an attribute revocation method that can achieve both forward security and backward security, which is secure under weaker security assumptions [26]. However, the scheme only supports the small attribute universe. In 2017, Li et al. provided a CP-ABE scheme with efficient user revocation by introducing the concept of user group [27].Thirdly, in ABE, bilinear pairing operation is an expensive computation cost, and its number increases along with the number of attributes involved in the access structure. The drawback of high computation overhead in the ABE schemes with multifunction becomes more serious for resource-constrained users such as mobile devices, sensors, and medical wearing equipment [28]. To save energy for the resource-constrained users and ensure the rapid generation and acquisition of the data, some technologies should be used to reduce the computational overhead both in the encryption phase and the decryption phase.For eliminating the overhead of decryption for users, Matthew Green et al. [29] gave the methods for efficiently and securely outsourcing decryption which offloads most decryption operations to a third-part server provider and returns a partial decryption ciphertext. The user performs only a little time of exponential operation to recover the plaintext. In 2013, Lai et al. firstly constructed a concrete ABE scheme with verifiable outsourced decryption which allows for verifiability of the partial decryption ciphertext [30]. Li et al. proposed a new secure outsourced ABE system, which supports both secure outsourced key-issuing and decryption with checkability of the outsourced computation results in an efficient way [31]. There are also some works to make verifiable outsourced decryption more efficiently and securely in ABE [32–34].Meanwhile, for saving online computation, Hohenberger and Waters proposed the first online/offline ABE [35] which splits the encryption into two phases: the data owner does as much precomputation as possible to encrypt a message or create a secret key in the offline phase and rapidly assembles a ciphertext or key in the online phase. It is a promising technique for resource-limited devices. In 2018, Li et al. proposed a new scheme that eliminates a majority of the encryption computation task by adding system public parameters [36].Last but not the least, it may be that the data owner device makes an error to generate the wrong ciphertext, or the malicious user generates many wrong ciphertexts to attack the system. These wrong ciphertext not only waste system resources but also waste user resources. For example, it wastes data user resources to decrypt the error ciphertext which returns an error result even though his attributes satisfy the access structure. A ciphertext verification algorithm should be used to eliminate invalid ciphertexts as much as possible. In 2014, Liu et al. proposed a KP-ABE scheme with the public ciphertext test, but the verify equations grow linearly with the number of the attributes involved in the access structure, which requires high computation overhead [37].


## 1.2. Motivation and Contributions

Recently, there have been many researchers who proposed the multifunctional MA-ABE system trying to meet the above needs, but no one solving all the issues simultaneously. In 2017, De and Ruj proposed a decentralized attribute-based encryption scheme with online/offline encryption, outsourced decryption, and user revocation, but their scheme only supports the small universe [38]. In 2018, Liu et al. designed an MA-ABE scheme that simultaneously supports the large attribute universe, outsourcing decryption, and attribute revocation, but their scheme is statically secure, without online/offline encryption and ciphertext publicly verifiable [39]. In 2019, Li et al. constructed a CCA2-secure publicly verifiable revocable large-universe multiauthority attribute-based encryption, but their scheme does not support online/offline encryption and outsourcing decryption [40]. In their scheme, the verify equations grow linearly with the number of the attributes involved in the access structure, which require high computation overhead. Moreover, if the user’s some attributes involved in the ciphertext are revoked, she/he will fail to verify the validity of the ciphertext even though her/his rest attributes still have the access privilege to the ciphertext.As we revisited the existing ABE schemes, no one simultaneously solves all the practical issues. Most of them only concentrate on solving one specific issue. A few schemes try to solve some issues but cause new problems. Therefore, we designed an efficient, CCA2-secure, flexible, fine-grained access control scheme for the IoT using edge computing, which can solve the above issues efficiently. The proposed scheme meets the need of the large-scale multidomain collaboration in the IoT by using multiauthority attribute-based encryption with the large attribute universe. More contributions are as follows:(1)
By adding a reusable ciphertext pool, the most expensive encryption operations have been executed in the user’s initialization phase, which minimizes the offline/online encryption computation. At the same time, the near-edge servers can perform the major decryption with the help of transformed keys given by the data user. As a result, the computation overhead of encryption and decryption is substantially reduced both on the data owner and user sides, so the scheme is suitable for the resource-constrained users in the IoT.(2)
The proposed scheme designs a fine-grained revocation mechanism to revoke an attribute from the user, by which the user or the attribute can be revoked from the system. So, it can change the user’s access privilege timely and is fit for the dynamic IoT.(3)
The scheme supports efficient ciphertext verification, and only valid ciphertext can be stored and transmitted, which saves the system resources. For reducing the computation overhead, we combine all the verify equations into one equation like a “hash function” which reduces expensive pairing operation. Moreover, the user can verify the validity of the ciphertext even though some attributes involved in the ciphertext are revoked, only if the rest of her/his attributes still have the access privilege to the ciphertext.(4)
With the help of the chameleon hash function, the simulator successfully prepares the challenge ciphertext with the dummy attribute in the security proof. Consequently, the proposed scheme is proven CCA2-secure under the q-DPBDHE2 assumption, which is more secure than the previous scheme. The performance analysis results indicate that the proposed scheme is efficient and suitable in edge computing for the IoT.


## 2. Preliminaries

### 2.1. Notations

In order to facilitate the understanding, we explain some notations used throughout this article in Table1.Table 1
Entities.
SymbolDescriptionnInteger set1,2,…,ni,jSeti,i+1,i+2,…,j containing consecutive integerss←RSVariables is chosen uniformly at random from the set SneglnNegligible function innPPTProbabilistic polynomial timeℤp∗Setℤp−0ℤpm×nSet of matrices of sizem×n with elements in ℤpAID/UIDAttribute authority global identity/User global identityU/UAASystem attribute/authority universeMKSystem master keyGPGlobal public parameterH/FFunction maps eachUID/attribute to an element of GTFunction maps each attribute to the unique attribute authority who controls itSKAID/PKAIDSecret key/public key for authorityAIDSKUID,a/PUID,aPrivate key/path key of attributea for user UIDCPoolUIDImmediate ciphertext pool of userUIDCToff/CTonOffline/online ciphertextCTOriginal ciphertext generated by the data ownerCTCSPCiphertext generated after ESP re-encryptsCT by using the latest attribute keySUIDAttribute set of userUIDATaBinary state tree of attributeaAKaAttribute key of attributeaRLaRevocation list of attributeaUpAKaUpdate key of attributeaTKUIDTransformation key for userUIDRKUID,aRetrieving key of attributea for user UIDCToutPartial decrypted ciphertext generated by ESP


### 2.2. Bilinear Pairings and Complexity Assumption

Definition 1.
(bilinear pairings). LetG and GT be the cyclic multiplicative groups with prime order p. The identities of G and GT are denoted as 1G and 1GT, respectively. We say a map e:G×G⟶GT is a bilinear pairing if it satisfies the following properties:(1)
Bilinear.∀g1,g2∈G,∀a,b∈ℤp∗,eg1a,g2b=eg1,g2ab.(2)
Nondegenerate.∃g1,g2∈G,s.t.eg1,g2≠1GT.(3)
Computable. There is an efficient algorithm to computeeg1,g2,∀g1,g2∈G.Definition 2.
(q-DPBDHE2 problem [41]). Let G and GT be the bilinear groups with prime order p and g be a generator of G. e:G×G⟶GT is a bilinear map defined on G. Pick s,a,b1,b2,…,bq←Rℤp and R←RGT. Given(1)D=G,p,e,g,gs,gai,gaibj,gs/bj,i∈2q,j∈q,i≠q+1,gsaibj/bj′,i∈q+1,j∈q,j′∈q,j≠j′,and the algorithm is asked to distinguish D,eg,gsaq+1 from D,R.Definition 3.
(q-DPBDHE2 assumption [41]). The q-DPBDHE2 assumption holds in G if no probabilistic polynomial time algorithm has probability at least 1/2+ε in solving the q-DPBDHE2 problem in G for nonnegligible ε.


### 2.3. Access Structures and Linear Secret-Sharing Schemes

Definition 4.
(access structure [42]). Let P=P1,P2,…,Pn be a set of parties. A collection A⊆2P is monotone if ∀B,C:ifB∈A and B⊆C then C∈A. An access structure (respectively, monotone access structure) is a collection (respectively, monotone collection) A of nonempty subsets of P, i.e., A∈2P\∅. The sets in A are called the authorized sets, and the sets not in A are called the unauthorized sets.
In the attribute-based encryption scheme, the parties are replaced by the attributes. An access structureA will contain some authorized sets of attributes. Similarly, we restrict our attention to monotone access structures. From now on, by an access structure, we mean a monotone access structure.Definition 5.
(linear secret-sharing schemes (LSSS)) [42]). Let p be a prime and U the attribute universe. A secret-sharing scheme π with domain of secrets ℤp realizing access structures on U is linear over ℤp if the following holds:(1)
The shares of a secrets∈ℤp for each attribute form a vector over ℤp.(2)
For each access structureA on U, there exists a matrix M∈ℤpl×n, called the share-generating matrix, and a function ρ that labels the rows of M with attributes from U, i.e., ρ:l⟶U, which satisfies the following: during the generation of the shares, we consider the column vector v⟶=s,r2,…,rn⊤, where r2,…,rn←$ℤp. Then, the vector of l shares of the secret s according to π is equal to Mv⟶∈ℤpl×1. The share Mv⟶j where j∈l “belongs” to attribute ρj. We will be referring to the pair M,ρ as the policy of the access structure A.


### 2.4. Chameleon Hash Functions

A chameleon hash function consists of three polynomial time algorithms as follows [43]:KeyGen1λ⟶SKch,PKch: it takes the security parameter λ as input and outputs a secret key SKch and the corresponding public key PKch.HchPKch,m,rch⟶v: it takes in the public key PKch, a message m, and an auxiliary parameter rch and then outputs the hashed value v.TCollisionSKch,m,rch,m′ch⟶rch′: it takes as inputs the secret key SKch, a message m with its auxiliary parameter rch, and another m′=m and outputs another auxiliary parameter rch′ such that v′=HchPKch,m′,rch′=HchPKch,m,rch=v.A secure chameleon hash function satisfies the requirements of collision resistance and uniformity. All messagesm induce the same probability distribution on HchPKch,m,rch for rch chosen uniformly at random. There is no efficient algorithm that takes as input the Chameleon hash public key PKch to find two pairs m,rch, m′,rch′ where m≠m′ such that HchPKch,m′,rch′=HchPKch,m,rch except with negligible probability. Only the one who knows the chameleon hash secret key can find collision for every given input efficiently.


### 2.5. Subset-Cover Revocation Framework

Naor et al. proposed the subset-cover revocation framework [23] and described two algorithms: the complete subtree method and the subset difference method. We can realize the revocation in ABE based on the complete subtree method.As shown in Figure1, firstly, it establishes a binary state tree BT. Each user is assigned as a leaf node u. Let vi denote a node and vilvir denote the left (right) child of vi. Pvi records all the nodes which are on the path from vi to the root. If a user vi is revoked, vi will be added into the revocation list RL. MinSubCoverBT,RL is an algorithm to generate the minimum subset cover whose descendant nodes cover all the unrevoked users (Algorithm 1).Figure 1
Binary state treeBT.Algorithm 1:MinSubCover BT,RL.
(1)
X=∅,Y=∅(2)
for∀vi∈RLdo(3)
addPvi to X(4)
end for(5)
for∀x∈Xdo(6)
ifxl∉Xthen(7)
addxl to Y(8)
end if(9)
ifxr∉Xthen(10)
addxr to Y(11)
end if(12)
end for(13)
ifY=∅then(14)
add root toY(15)
end if(16)
returnYAs shown in Figure1, there are eight users u1,u2,u3,u4,u5,u6,u7,u8. If the user u2 is revoked, N9 would be added into RL=N9, and the MinSubCover BT,RL outputs N3,N5,N8.


## 2.1. Notations

In order to facilitate the understanding, we explain some notations used throughout this article in Table1.Table 1
Entities.
SymbolDescriptionnInteger set1,2,…,ni,jSeti,i+1,i+2,…,j containing consecutive integerss←RSVariables is chosen uniformly at random from the set SneglnNegligible function innPPTProbabilistic polynomial timeℤp∗Setℤp−0ℤpm×nSet of matrices of sizem×n with elements in ℤpAID/UIDAttribute authority global identity/User global identityU/UAASystem attribute/authority universeMKSystem master keyGPGlobal public parameterH/FFunction maps eachUID/attribute to an element of GTFunction maps each attribute to the unique attribute authority who controls itSKAID/PKAIDSecret key/public key for authorityAIDSKUID,a/PUID,aPrivate key/path key of attributea for user UIDCPoolUIDImmediate ciphertext pool of userUIDCToff/CTonOffline/online ciphertextCTOriginal ciphertext generated by the data ownerCTCSPCiphertext generated after ESP re-encryptsCT by using the latest attribute keySUIDAttribute set of userUIDATaBinary state tree of attributeaAKaAttribute key of attributeaRLaRevocation list of attributeaUpAKaUpdate key of attributeaTKUIDTransformation key for userUIDRKUID,aRetrieving key of attributea for user UIDCToutPartial decrypted ciphertext generated by ESP


## 2.2. Bilinear Pairings and Complexity Assumption

Definition 1.
(bilinear pairings). LetG and GT be the cyclic multiplicative groups with prime order p. The identities of G and GT are denoted as 1G and 1GT, respectively. We say a map e:G×G⟶GT is a bilinear pairing if it satisfies the following properties:(1)
Bilinear.∀g1,g2∈G,∀a,b∈ℤp∗,eg1a,g2b=eg1,g2ab.(2)
Nondegenerate.∃g1,g2∈G,s.t.eg1,g2≠1GT.(3)
Computable. There is an efficient algorithm to computeeg1,g2,∀g1,g2∈G.Definition 2.
(q-DPBDHE2 problem [41]). Let G and GT be the bilinear groups with prime order p and g be a generator of G. e:G×G⟶GT is a bilinear map defined on G. Pick s,a,b1,b2,…,bq←Rℤp and R←RGT. Given(1)D=G,p,e,g,gs,gai,gaibj,gs/bj,i∈2q,j∈q,i≠q+1,gsaibj/bj′,i∈q+1,j∈q,j′∈q,j≠j′,and the algorithm is asked to distinguish D,eg,gsaq+1 from D,R.Definition 3.
(q-DPBDHE2 assumption [41]). The q-DPBDHE2 assumption holds in G if no probabilistic polynomial time algorithm has probability at least 1/2+ε in solving the q-DPBDHE2 problem in G for nonnegligible ε.


## 2.3. Access Structures and Linear Secret-Sharing Schemes

Definition 4.
(access structure [42]). Let P=P1,P2,…,Pn be a set of parties. A collection A⊆2P is monotone if ∀B,C:ifB∈A and B⊆C then C∈A. An access structure (respectively, monotone access structure) is a collection (respectively, monotone collection) A of nonempty subsets of P, i.e., A∈2P\∅. The sets in A are called the authorized sets, and the sets not in A are called the unauthorized sets.
In the attribute-based encryption scheme, the parties are replaced by the attributes. An access structureA will contain some authorized sets of attributes. Similarly, we restrict our attention to monotone access structures. From now on, by an access structure, we mean a monotone access structure.Definition 5.
(linear secret-sharing schemes (LSSS)) [42]). Let p be a prime and U the attribute universe. A secret-sharing scheme π with domain of secrets ℤp realizing access structures on U is linear over ℤp if the following holds:(1)
The shares of a secrets∈ℤp for each attribute form a vector over ℤp.(2)
For each access structureA on U, there exists a matrix M∈ℤpl×n, called the share-generating matrix, and a function ρ that labels the rows of M with attributes from U, i.e., ρ:l⟶U, which satisfies the following: during the generation of the shares, we consider the column vector v⟶=s,r2,…,rn⊤, where r2,…,rn←$ℤp. Then, the vector of l shares of the secret s according to π is equal to Mv⟶∈ℤpl×1. The share Mv⟶j where j∈l “belongs” to attribute ρj. We will be referring to the pair M,ρ as the policy of the access structure A.


## 2.4. Chameleon Hash Functions

A chameleon hash function consists of three polynomial time algorithms as follows [43]:KeyGen1λ⟶SKch,PKch: it takes the security parameter λ as input and outputs a secret key SKch and the corresponding public key PKch.HchPKch,m,rch⟶v: it takes in the public key PKch, a message m, and an auxiliary parameter rch and then outputs the hashed value v.TCollisionSKch,m,rch,m′ch⟶rch′: it takes as inputs the secret key SKch, a message m with its auxiliary parameter rch, and another m′=m and outputs another auxiliary parameter rch′ such that v′=HchPKch,m′,rch′=HchPKch,m,rch=v.A secure chameleon hash function satisfies the requirements of collision resistance and uniformity. All messagesm induce the same probability distribution on HchPKch,m,rch for rch chosen uniformly at random. There is no efficient algorithm that takes as input the Chameleon hash public key PKch to find two pairs m,rch, m′,rch′ where m≠m′ such that HchPKch,m′,rch′=HchPKch,m,rch except with negligible probability. Only the one who knows the chameleon hash secret key can find collision for every given input efficiently.


## 2.5. Subset-Cover Revocation Framework

Naor et al. proposed the subset-cover revocation framework [23] and described two algorithms: the complete subtree method and the subset difference method. We can realize the revocation in ABE based on the complete subtree method.As shown in Figure1, firstly, it establishes a binary state tree BT. Each user is assigned as a leaf node u. Let vi denote a node and vilvir denote the left (right) child of vi. Pvi records all the nodes which are on the path from vi to the root. If a user vi is revoked, vi will be added into the revocation list RL. MinSubCoverBT,RL is an algorithm to generate the minimum subset cover whose descendant nodes cover all the unrevoked users (Algorithm 1).Figure 1
Binary state treeBT.Algorithm 1:MinSubCover BT,RL.
(1)
X=∅,Y=∅(2)
for∀vi∈RLdo(3)
addPvi to X(4)
end for(5)
for∀x∈Xdo(6)
ifxl∉Xthen(7)
addxl to Y(8)
end if(9)
ifxr∉Xthen(10)
addxr to Y(11)
end if(12)
end for(13)
ifY=∅then(14)
add root toY(15)
end if(16)
returnYAs shown in Figure1, there are eight users u1,u2,u3,u4,u5,u6,u7,u8. If the user u2 is revoked, N9 would be added into RL=N9, and the MinSubCover BT,RL outputs N3,N5,N8.


## 3. System Model and Security Model

### 3.1. System Model

As shown in Figure2, our efficient CCA2-secure flexible fine-grained access control for the IoT by using edge computing consists of the following entities:Figure 2
System model.Central authority (CA): CA is a trusted entity that initializes the system by setting up the global public parameters. Moreover, it is responsible for the registration of users and authorized attribute authorities. CA assigns each user a unique identityUID, and each attribute authority is a unique identity AID.Attribute authority (AA): AA is a trusted entity that manages the users’ attributes. Each AA is an independent attribute authority and manages a disjoint attribute set, respectively, which means that each attribute is associated with a single AA. Each AA issues its public key, authenticates users’ attribute sets, and generates the corresponding private keys for them. It also can revoke and update users’ attributes by using attribute keys.Cloud service provider (CSP): CSP is semitrusted (honest-but-curious). It will honestly and correctly execute the tasks but be curious about the data messages which it receives. CSP will not conclude with the malicious users. It stores the valid ciphertexts which are sent from ESP.Edge service provider (ESP): ESP is semitrusted (honest-but-curious) and will not conclude with the malicious users. It has both computing capability and large storage. It is geographically close to the users (data owners and data users). ESP receives the ciphertext from users and re-encrypts the valid ciphertext by using attribute keys after verifying the validity of ciphertext and then sends the legal data to CSP for permanent storage. It is also in charge of re-encrypting and updating the ciphertext when a revocation happens. Furthermore, it provides partial decryption of ciphertext for some resource-limited users if they require it.Data owner (DO): to ensure data confidentiality and achieve flexible access to data, DO has two methods to encrypt data before uploading data to ESP. One is DO directly encrypting the data file under an access policy about who can get access to the data. The other is DO firstly encrypting the data file using a symmetric encryption algorithm which is a lightweight encryption method and then encrypting the symmetric key under the access policy.Data user (DU): each DU is assigned a global user identityUID by CA. DU obtains a set of attributes privileges and corresponding decryption private keys from authorities. DU can freely get any encrypted data from ESP and decrypt the ciphertext if and only if his/her attribute set satisfies the access policy. Moreover, some resource-limited users can outsource decryption to ESP.


### 3.2. Framework

This system mainly contains the following polynomial time algorithms:GlobalSetup1λ⟶MK,GP: the global set up algorithm is run by CA to set up the system. It takes the system security parameter λ as input and outputs the system master key MK and the global public parameters GP.AASetupGP,AID⟶PKAID,SKAID: the attribute authority set up algorithm is run by attribute authorities. It takes the authority’s identity AID as input and sets up the authority’s public key and secret key. The authority keeps the secret key SKAID and publishes the public key PKAID.UKeyGenUID,AID,a∈U⟶SKUID,a: the user key generation algorithm is run by the authority AID. It takes the data user’s identity UID, his attribute a, and the authority’s secret key as input and outputs the private key SKUID,a=<KTa,a,1,KTa,a,2,PUID,a> for the user UID, where the path key PUID,a is generated by the attribute key generation algorithm.AttrKeyGenUID,AID,a∈U⟶PUID,a: the attribute key generation algorithm is run by the authority AID. Firstly, if the binary state tree ATa has not been set up, it establishes an ATa and initializes a revocation list RLa=∅, then chooses a random number AKa∈Zp∗ as the attribute key. Each user with the attribute a is assigned as a leaf node, and it increases the height with users increasing. For each node Ni in the tree, it randomly picks NKa,i∈Zp∗. PathUID,a denotes the path of the user UID from its leaf node to the root node, then PUID,a=NKa,ii∈PathUID,a is the path key for the user UID which is the key used to recover AKa. Finally, it sends PUID,a to the user and then publishes AKa·NKa,ii∈MinSubCoverATa,RLa and shares ATa,AKa with ESP and CSP.CPoolGenUID,GP,PKAIDAID∈UAA⟶CPoolUID: the ciphertext pool generation algorithm is run by data owners. It takes the data owner’s identity UID, the global public parameters GP, the authorities’ public keys PKAIDAID∈UAA as input and chooses an integer N to determine the size of the attributes will be associated with any ciphertext and then outputs the immediate ciphertext pool CPoolUID. CPoolUID is saved in the encryption algorithm and can be reused. Moreover, it can be updated by the user UID whenever a new attribute authority joins the system or the data owner increases the size of attributes for improving the expressiveness.EnoffGP⟶CToff: the offline encryption algorithm is run by data owners. It takes the global public parameters GP as input and outputs the offline ciphertext CToff.Enonm,M,ρ,GP,CPoolUID,CToff⟶CT: the online encryption algorithm is run by data owners. It takes a plaintext message m, an access structure M,ρ, the global public parameters GP, the immediate ciphertext pool CPoolUID, and an offline ciphertext CToff as input and outputs the ciphertext CT.PublicTestGP,PKAIDAID∈δI,CT,I⟶True/False: the public test algorithm can be run by any role in the system if she/he feels she/he needs it. It takes the global public parameters GP, part of ciphertext which is to be tested, the authorities’ public keys PKAIDAID∈δI as input, and outputs True if the ciphertext is valid.CReEncCT,AKρi⟶CTCSP: the algorithm is run by ESP. It firstly verifies the validity of the ciphertext by the algorithm PublicTest GP,PKAID,CT,I, where I=l. If the public test algorithm outputs True, it re-encrypts the ciphertext CT by using the latest attribute keys AKρi and outputs the new ciphertext CTCSP. At last, ESP sends the ciphertext CTCSP to CSP and drops the original ciphertext CT.DecryptCTCSP,UID,GP,AKρi,SKUID,aa∈SUID⟶m: the decryption algorithm is run by the data user UID with a set of attributes SUID which wants to decrypt the ciphertext CTCSP. If SUID⊭M,ρ, the algorithm outputs ⊥. Otherwise, it outputs the message m.The data user can choose to outsource decryption if he owns limited resource or for saving resource. This feature is implemented in the following three algorithms:TKGenCTCSP,UID,GP,AKρi,SKUID,a⟶TKUID,a,CT: this algorithm is run by data users. It chooses a random numbers as the retrieving key RKUID, takes the unrevoked attributes private key AKρi, SKUID,a, and CTCSP as input, then outputs the transformation key TKUID,a and the primitive ciphertext CT.PartialDecTKUID,a∀a∈J,CT,GP,AKρi⟶CTout: this algorithm is run by ESP. It takes TKUID,a and CT as input and then outputs the partial decrypted ciphertext CTout to the user.FullDecCTout,RKUID⟶m: this algorithm is run by data users. It works out the massage m by using CTout and RKUID.RevokeUID,a,RLa⟶UpAKa: this algorithm is run by attribute authorities. It takes the attribute a and the user UID as input then publishes AKa′·NKa,ii∈MinSubCoverATa,RLa and outputs the update key UpAKa for ESP and CSP to update the ciphertext and the attribute key, where AKa′ is the new attribute key.IfTa wants to revoke the attribute a from the system, it only sets all the users who own a into RLa and run the above operation.If the system wants to revoke the userUID from the system, it asks all the involved attribute authorities to revoke all the involved attributes from the user UID, by running the above operation.


### 3.3. Security Model

In this section, our security model is similar to that in [40] which is named indistinguishability against selective authority and access policy and statically chosen-ciphertext attacks (IND-sAA-sCCA2). At the beginning of the security game, the adversary should claim the access policy which it will challenge, and it should also claim the corrupt authorities. The challenge message can be encrypted by some attributes from some of these corrupt authorities but should at least one attribute from an honest authority, which means that the ciphertext still cannot be attacked successfully if only part of the encrypted attributes is from corrupted authorities.The security game played between adversaryA and challenger C is as follows:Init: adversaryA selects a challenge access policy A∗,δ∗ and a set of corrupt authorities CAA and sends it to the challenger C.Global setup: the challengerC runs the GlobalSetup (1λ) algorithm to get a system master key MK and the global public parameters GP. It keeps MK and sends GP to A.Phase 1: the adversaryA issues a polynomially bounded number of queries statically:Authority’s public key queries:A submits a set of the noncorrupt authorities, and C replies to A with the corresponding public keys. A can create the public keys of the corrupt authorities by itself.User’s secret key queries:A submits some users identity and a set of his all attributes S∗, C gives A the secret keys. If S∗ satisfies A∗,δ∗, C revokes one of these attributes from all users.TransformKey queries:A submits some users with a set of his all attributes S∗, where there is no sense querying the transformation key for the same user who has been queried the secret key. Then, C gives A the transformation keys.CReEncryption queries:A submits some ciphertext, then C re-encrypts the ciphertext with the latest attribute keys and return them to A.Decryption queries:A submits a ciphertext and C returns the message if the ciphertext is legitimate.Revocation queries:A queries to revoke some users with a set of attributes. C runs the algorithm Revoke UIDi,u,RLu⟶UpAKu to get the update keys and then re-encryptes the ciphertext with the latest update keys.Challenge:A submits to C two equal-length messages m0 and m1. C firstly randomly flips coin b∈0,1 and encrypts mb with A∗,δ∗. Then, it re-encryptes the ciphertext by the latest attribute keys and sends to A.Phase 2: the same as Phase 1, except thatA cannot make the secret key query for the selected access policy or make decryption query for the challenge ciphertext.Guess:A outputs a guess bit b′∈0,1 and wins the game if b′=b.Definition 6.
The proposed scheme is indistinguishable against selective authority and access policy and statically chosen-ciphertext attacks if no probabilistic polynomial time adversary can break the above security game with a nonnegligible advantage.


## 3.1. System Model

As shown in Figure2, our efficient CCA2-secure flexible fine-grained access control for the IoT by using edge computing consists of the following entities:Figure 2
System model.Central authority (CA): CA is a trusted entity that initializes the system by setting up the global public parameters. Moreover, it is responsible for the registration of users and authorized attribute authorities. CA assigns each user a unique identityUID, and each attribute authority is a unique identity AID.Attribute authority (AA): AA is a trusted entity that manages the users’ attributes. Each AA is an independent attribute authority and manages a disjoint attribute set, respectively, which means that each attribute is associated with a single AA. Each AA issues its public key, authenticates users’ attribute sets, and generates the corresponding private keys for them. It also can revoke and update users’ attributes by using attribute keys.Cloud service provider (CSP): CSP is semitrusted (honest-but-curious). It will honestly and correctly execute the tasks but be curious about the data messages which it receives. CSP will not conclude with the malicious users. It stores the valid ciphertexts which are sent from ESP.Edge service provider (ESP): ESP is semitrusted (honest-but-curious) and will not conclude with the malicious users. It has both computing capability and large storage. It is geographically close to the users (data owners and data users). ESP receives the ciphertext from users and re-encrypts the valid ciphertext by using attribute keys after verifying the validity of ciphertext and then sends the legal data to CSP for permanent storage. It is also in charge of re-encrypting and updating the ciphertext when a revocation happens. Furthermore, it provides partial decryption of ciphertext for some resource-limited users if they require it.Data owner (DO): to ensure data confidentiality and achieve flexible access to data, DO has two methods to encrypt data before uploading data to ESP. One is DO directly encrypting the data file under an access policy about who can get access to the data. The other is DO firstly encrypting the data file using a symmetric encryption algorithm which is a lightweight encryption method and then encrypting the symmetric key under the access policy.Data user (DU): each DU is assigned a global user identityUID by CA. DU obtains a set of attributes privileges and corresponding decryption private keys from authorities. DU can freely get any encrypted data from ESP and decrypt the ciphertext if and only if his/her attribute set satisfies the access policy. Moreover, some resource-limited users can outsource decryption to ESP.


## 3.2. Framework

This system mainly contains the following polynomial time algorithms:GlobalSetup1λ⟶MK,GP: the global set up algorithm is run by CA to set up the system. It takes the system security parameter λ as input and outputs the system master key MK and the global public parameters GP.AASetupGP,AID⟶PKAID,SKAID: the attribute authority set up algorithm is run by attribute authorities. It takes the authority’s identity AID as input and sets up the authority’s public key and secret key. The authority keeps the secret key SKAID and publishes the public key PKAID.UKeyGenUID,AID,a∈U⟶SKUID,a: the user key generation algorithm is run by the authority AID. It takes the data user’s identity UID, his attribute a, and the authority’s secret key as input and outputs the private key SKUID,a=<KTa,a,1,KTa,a,2,PUID,a> for the user UID, where the path key PUID,a is generated by the attribute key generation algorithm.AttrKeyGenUID,AID,a∈U⟶PUID,a: the attribute key generation algorithm is run by the authority AID. Firstly, if the binary state tree ATa has not been set up, it establishes an ATa and initializes a revocation list RLa=∅, then chooses a random number AKa∈Zp∗ as the attribute key. Each user with the attribute a is assigned as a leaf node, and it increases the height with users increasing. For each node Ni in the tree, it randomly picks NKa,i∈Zp∗. PathUID,a denotes the path of the user UID from its leaf node to the root node, then PUID,a=NKa,ii∈PathUID,a is the path key for the user UID which is the key used to recover AKa. Finally, it sends PUID,a to the user and then publishes AKa·NKa,ii∈MinSubCoverATa,RLa and shares ATa,AKa with ESP and CSP.CPoolGenUID,GP,PKAIDAID∈UAA⟶CPoolUID: the ciphertext pool generation algorithm is run by data owners. It takes the data owner’s identity UID, the global public parameters GP, the authorities’ public keys PKAIDAID∈UAA as input and chooses an integer N to determine the size of the attributes will be associated with any ciphertext and then outputs the immediate ciphertext pool CPoolUID. CPoolUID is saved in the encryption algorithm and can be reused. Moreover, it can be updated by the user UID whenever a new attribute authority joins the system or the data owner increases the size of attributes for improving the expressiveness.EnoffGP⟶CToff: the offline encryption algorithm is run by data owners. It takes the global public parameters GP as input and outputs the offline ciphertext CToff.Enonm,M,ρ,GP,CPoolUID,CToff⟶CT: the online encryption algorithm is run by data owners. It takes a plaintext message m, an access structure M,ρ, the global public parameters GP, the immediate ciphertext pool CPoolUID, and an offline ciphertext CToff as input and outputs the ciphertext CT.PublicTestGP,PKAIDAID∈δI,CT,I⟶True/False: the public test algorithm can be run by any role in the system if she/he feels she/he needs it. It takes the global public parameters GP, part of ciphertext which is to be tested, the authorities’ public keys PKAIDAID∈δI as input, and outputs True if the ciphertext is valid.CReEncCT,AKρi⟶CTCSP: the algorithm is run by ESP. It firstly verifies the validity of the ciphertext by the algorithm PublicTest GP,PKAID,CT,I, where I=l. If the public test algorithm outputs True, it re-encrypts the ciphertext CT by using the latest attribute keys AKρi and outputs the new ciphertext CTCSP. At last, ESP sends the ciphertext CTCSP to CSP and drops the original ciphertext CT.DecryptCTCSP,UID,GP,AKρi,SKUID,aa∈SUID⟶m: the decryption algorithm is run by the data user UID with a set of attributes SUID which wants to decrypt the ciphertext CTCSP. If SUID⊭M,ρ, the algorithm outputs ⊥. Otherwise, it outputs the message m.The data user can choose to outsource decryption if he owns limited resource or for saving resource. This feature is implemented in the following three algorithms:TKGenCTCSP,UID,GP,AKρi,SKUID,a⟶TKUID,a,CT: this algorithm is run by data users. It chooses a random numbers as the retrieving key RKUID, takes the unrevoked attributes private key AKρi, SKUID,a, and CTCSP as input, then outputs the transformation key TKUID,a and the primitive ciphertext CT.PartialDecTKUID,a∀a∈J,CT,GP,AKρi⟶CTout: this algorithm is run by ESP. It takes TKUID,a and CT as input and then outputs the partial decrypted ciphertext CTout to the user.FullDecCTout,RKUID⟶m: this algorithm is run by data users. It works out the massage m by using CTout and RKUID.RevokeUID,a,RLa⟶UpAKa: this algorithm is run by attribute authorities. It takes the attribute a and the user UID as input then publishes AKa′·NKa,ii∈MinSubCoverATa,RLa and outputs the update key UpAKa for ESP and CSP to update the ciphertext and the attribute key, where AKa′ is the new attribute key.IfTa wants to revoke the attribute a from the system, it only sets all the users who own a into RLa and run the above operation.If the system wants to revoke the userUID from the system, it asks all the involved attribute authorities to revoke all the involved attributes from the user UID, by running the above operation.


## 3.3. Security Model

In this section, our security model is similar to that in [40] which is named indistinguishability against selective authority and access policy and statically chosen-ciphertext attacks (IND-sAA-sCCA2). At the beginning of the security game, the adversary should claim the access policy which it will challenge, and it should also claim the corrupt authorities. The challenge message can be encrypted by some attributes from some of these corrupt authorities but should at least one attribute from an honest authority, which means that the ciphertext still cannot be attacked successfully if only part of the encrypted attributes is from corrupted authorities.The security game played between adversaryA and challenger C is as follows:Init: adversaryA selects a challenge access policy A∗,δ∗ and a set of corrupt authorities CAA and sends it to the challenger C.Global setup: the challengerC runs the GlobalSetup (1λ) algorithm to get a system master key MK and the global public parameters GP. It keeps MK and sends GP to A.Phase 1: the adversaryA issues a polynomially bounded number of queries statically:Authority’s public key queries:A submits a set of the noncorrupt authorities, and C replies to A with the corresponding public keys. A can create the public keys of the corrupt authorities by itself.User’s secret key queries:A submits some users identity and a set of his all attributes S∗, C gives A the secret keys. If S∗ satisfies A∗,δ∗, C revokes one of these attributes from all users.TransformKey queries:A submits some users with a set of his all attributes S∗, where there is no sense querying the transformation key for the same user who has been queried the secret key. Then, C gives A the transformation keys.CReEncryption queries:A submits some ciphertext, then C re-encrypts the ciphertext with the latest attribute keys and return them to A.Decryption queries:A submits a ciphertext and C returns the message if the ciphertext is legitimate.Revocation queries:A queries to revoke some users with a set of attributes. C runs the algorithm Revoke UIDi,u,RLu⟶UpAKu to get the update keys and then re-encryptes the ciphertext with the latest update keys.Challenge:A submits to C two equal-length messages m0 and m1. C firstly randomly flips coin b∈0,1 and encrypts mb with A∗,δ∗. Then, it re-encryptes the ciphertext by the latest attribute keys and sends to A.Phase 2: the same as Phase 1, except thatA cannot make the secret key query for the selected access policy or make decryption query for the challenge ciphertext.Guess:A outputs a guess bit b′∈0,1 and wins the game if b′=b.Definition 6.
The proposed scheme is indistinguishable against selective authority and access policy and statically chosen-ciphertext attacks if no probabilistic polynomial time adversary can break the above security game with a nonnegligible advantage.


## 4. Concrete Scheme

In this section, we present the concrete construction of our efficient CCA2-secure flexible fine-grained access control scheme for the IoT using edge computing based on prime-order bilinear groups which perform more efficiently than composite-order bilinear groups as follows:GlobalSetup1λ⟶MK,GP: this algorithm is run by CA. It takes the system security parameter λ as input. It chooses two suitable multiplicative cyclic groups G and GT with large prime-order p∈Θ2λ. Let g be a generator of G and defines a bilinear map e:G×G⟶GT on G. The attribute universe is U=ℤp. UAA denotes the set of all attribute authorities. Additionally, it chooses three functions H, F, and T. H maps user identities to elements of G. F maps attributes to elements of G. T maps each attribute to the unique attribute authority who controls it. It picks a secure chameleon hash function Hch:0,1∗⟶U and runs the KeyGench1λ algorithm to obtain a chameleon hash key pair SKch,PKch. Finally, it picks two random numbers α0,β0∈ℤp∗ and computes eg,gα0 and gβ0. This algorithm outputs the system master key MK=<α0,β0,SKch> and the global public parameters GP=<p,g,G,GT,e,eg,gα0,gβ0,U,UAA,PKch,H,F,T,Hch>.AASetupGP,AID⟶PKAID,SKAID: this algorithm is run by attribute authorities. For each authority AID∈UAA, it chooses two αAID,βAID∈ℤp∗ as its secret key SKAID and publishes the public key:(2)PKAID=<eg,gαAID,gβAID>.UKeyGenUID,AID,a∈U⟶SKUID,a: since the attribute a is managed by the authority Ta, then this algorithm is run by the authority Ta. Firstly, it chooses a random number ta∈ℤp∗. Then, it computes(3)KTa,a,1=gαTaHUIDβTaFata,KTa,a,2=gta.The path keyPUID,a is generated by the attribute key generation algorithm.AttrKeyGenUID,AID,a∈U⟶PUID,a: since the attribute a is managed by the authority Ta, this algorithm is run by the authority Ta. Firstly, if the binary state tree ATa has not been set up, it establishes an ATa, initializes a revocation list RLa=∅, and then chooses a random number AKa∈ℤp∗ as the attribute key. Each user with the attribute a is assigned as a leaf node, and it increases the height with users increasing. For each node Ni in the tree, it randomly picks NKa,i∈ℤp∗. PathUID,a denotes the path of the user UID from its leaf node to the root node, and then, PUID,a=NKa,ii∈PathUID,a is the path key for the user UID which is used to recover AKa. Finally, it sends PUID,a to the user, publishes AKa·NKa,ii∈MinSubCoverATa,RLa, and then shares ATa,AKa with CSP and ESP.Finally, the private key of the attributea for the data user UID is(4)SKUID,a=<KTa,a,1,KTa,a,2,PUID,a>.CPoolGenUID,GP,PKAIDAID∈UAA⟶CPoolUID: this algorithm is run by data owners. The data owner UID chooses an integer N to determine the size of the attributes will be associated with any ciphertext. ∀j∈UAA, ∀i∈N, the algorithm picks randomly numbers ri,xi,yi,∈Zp∗, and computes(5)C1,i′=eg,gxieg,gαjri,C2,i′=g−ri,C3,i′=gβjrigyi.Set(6)ITji=ri,xi,yi,C1,i′,C2,i′,C3,i′,ITj=ITjii∈N,then the immediate ciphertext pool for the data ownerUID is(7)CPoolUID=ITjj∈UAA.Remark 1.
CPoolUID is generated when the data owner initializes her/his client. It is saved on the data owner’s side and can be reused. Moreover, it can be updated by the data owner UID whenever a new attribute authority joins the system or the data owner increases the size of attributes for improving the expressiveness.EnoffGP⟶CToff: this algorithm is run by data owners. It picks randomly numbers r0,s,∈Zp∗, and computes(8)K=eg,gs,C1,0′=eg,gseg,gα0r0,C2,0′=g−r0,C3,0′=gβ0r0.Then, the offline ciphertext is(9)CToff=r0,s,K,C1,0′,C2,0′,C3,0′.Remark 2.
The offline ciphertext is used only one time. After it is used, the algorithm EnoffGP⟶CToff in the client generates a new offline ciphertext for the next plaintext message.Enonm,M,ρ,GP,CPoolUID,CToff,PKAID⟶CT: this algorithm is run by data owners. It takes a plaintext message m, an access structure M,ρ, and a set of authority public keys PKAID as input, where M∈ℤpl×n and ρ is a map from each row M⟶i of M to an attribute ρi∈U. Let δ be a function maps each row M⟶i to the authority who manages attribute ρi, i.e., δi=Tρi. For encryption, the algorithm randomly picks numbers v2,…,vn,w2,…,wn∈Zp∗. Let v⟶=s,v2,…,vn⊤ and w⟶=0,w2,…,wn⊤. For i=1,…,l, it computes λi=M⟶iv⟶, wi=M⟶iw⟶, and w0=−∑i=0nwi. Then, the ciphertext is computed as follows:(10)C0=mK,C1,0=C1,0′=eg,gseg,gα0r0,C2,0=C2,0′=g−r0,C3,0=C3,0′gw0=gβ0r0gw0.Fori=1,…,l, it randomly chooses immediate ciphertexts without repetition in ITδi and an auxiliary parameter rch⟵Rℤp, then computes(11)C1,i=C1,i′=eg,gxieg,gαδiri,C2,i=C2,i′=g−ri,C3,i=C3,i′=gβδirigyi,C4,i=Fρiri,C5,i=λi−xi,C6,i=wi−yi,V=HchPKch,PKchC0C1,0C1,1C5,1⋯C1,lC5,l,rch,C4,0=FVr0.At last, the ciphertext is(12)CT=M,ρ,C0,C1,0,C2,0,C3,0,C4,0,C1,i,C2,i,C3,i,C4,i,C5,i,C6,ii=1l,rch.PublicTestGP,PKAID,CT,I⟶True/False: the public test algorithm can be run by any role in the system, if she/he feels she/he needs it. Suppose the components which to be tested is(13)C1,i,C2,i,C3,i,C4,i,C5,i,C6,ii∈I,whereI⊂l.It firstly computes(14)V′=HchPKch,PKchC0C1,0C1,1C5,1⋯C1,lC5,l,rch,and then(15)eg,C3,0C4,0∏i∈IC4,i∏i∈lC3,igC6,ieC2,0,FV′gβ0∏i∈IeC2,i,Fρigβδi∏i∈l\IeC2,i,gβδi=1.If the above equation holds, it means that the ciphertext is legitimate. To be specific, it is encrypted exactly by the attribute setρii∈I, and the legitimate private key set with respect to the attribute set ρii∈I can decrypt out the correct plaintext message when ρii∈I is an authorized set of M,ρ.CReEncCT,AKρi⟶CTCSP: this algorithm is run by ESP. After receiving the data owner’s encrypted data, it first verifies the validity of the ciphertext by using the algorithm PublicTest GP,PKAID,CT,I, where I=l. If the public-test algorithm outputs True, it re-encrypts the ciphertext by using the latest attribute keys as follows:(16)CTCSP=M,ρ,C0,C1,0,C2,0,C3,0,C4,0,C1,i,C2,i,C3,i,C4,iAKρi,C5,i,C6,ii=1l,rch.Finally, ESP sends the ciphertextCTCSP to CSP.DecryptCTCSP,UID,GP,AKρi,SKUID,a⟶m: this algorithm is run by data users. Suppose a user UID with a set of attributes SUID wants to decrypt the ciphertext CTCSP. If SUID⊭M,ρ, this algorithm outputs ⊥. Otherwise, it exist a subset ρi:i∈I⊂l of SUID satisfy the access policy M,ρ. Then, it calculates constants ci:i∈I such that ∑i∈IciM⟶i=1,0,…,0. For each attribute ρi∈ρi:i∈I, it recovers AKδi by using the path keys and computes the original ciphertext CT=CTCSP except that C4,i=C4,iAKρiAKρi−1 for all i∈I. Then, it can verify the validity of the ciphertext by the algorithm PublicTestGP,PKAID,CT,I. If the public-test algorithm outputs True, it computes(17)∀i∈I,C1,ieg,gC5,ieKδi,ρi,1,C2,i·eHUID,C3,igC6,ieKδi,ρi,2,C4,i=eg,gxieg,gαδirieg,gλi−xi·egαδiHUIDβδiFρitρi,g−ri·eHUID,gβδirigyigwi−yiegtρi,Fρiri=eg,gλieHUID,gwi,∏i∈Ieg,gλieHUID,gwici=eg,gs,C0eg,gs=meg,gseg,gs=m.Outsourcing decryption: the data user can choose to outsource decryption if he owns limited resource or for saving resource. This feature is implemented in three algorithms:TKGenCTCSP,UID,GP,AKρi,SKUID,a⟶TKUID,a,CT: this algorithm is run by data users. Assuming that the subset J=ρi:i∈l of SUID is unrevoked. Firstly, it chooses random numbers z∈Zp∗ as the retrieving key, i.e., RKUID=z. Then, set the transformation key TKUID,a=<KTa,a,11/z,KTa,a,21/z>, for every a∈J. Secondly, it computes the ciphertext CT=CTCSP except that C4,i=C4,iAKρiAKρi−1 for all i∈J. At last, it keeps the retrieving key RKUID=z and then sends CT and TKUID,aa∈J to ESP.PartialDecTKUID,a∀a∈J,CT,GP,AKρi⟶CTout: this algorithm is run by ESP. Assuming that the subset ρi:i∈I⊂l of SUID satisfies the access policy M,ρ. It calculates constants ci:i∈I such that ∑i∈IciM⟶i=1,0,…,0, and then, it computes(18)CT1=∏i∈IC1,ieg,gC5,ieHUID,C3,igC6,i−ci=∏i∈Ieg,gxieg,gαδirieg,gλi−xieHUID,gβδirigyigwi−yi−ci=∏i∈Ieg,gλieg,gαδirieHUID,gβδirigwi−ci,CT2=∏i∈IeKδi,ρi,11/z,C2,ieKδi,ρi,21/z,C4,i−ci=∏i∈Iegαδi/zHUIDβδi/zFρitρi/z,g−riegtρi/z,Fρiri−ci=∏i∈IegαδiHUIDβδi,g−ri−ci/z.Finally, it setsCTout=CT1,CT2 and sends it to the data user.FullDecCTout,RKUID⟶m: this algorithm is run by data users. It computes(19)C0CT1CT2z=meg,gseg,g−s=m.RevokeUID,a,RLa⟶UpAKa: if the authority Ta wants to revoke the attribute a from the data user UID, it adds UID into the revocation list RLa of the attribute a and chooses a new attribute key AKa′←RZp∗. Then, it sends the update keys(20)UpAKa=AKa′AKa−1,to ESP and CSP and publishes(21)AKa′·NKa,ii∈MinSubCoverATa,RLa.
ESP or CSP updates the ciphertext related toa using UpAKa by calculating(22)C4,iAKρiUpAKρi=C4,iAKρi′,and updates the attribute key by calculating(23)AKa′=UpAKa·AKa.
If the authorityTa wants to revoke the attribute a from the system, it only sets all the data users UID who own a into RLa and runs the above operation.
If the system wants to revoke the data userUID from the system, it asks all the involved attribute authorities to revoke all the involved attributes from the user UID, by running the above operation.


## 5. Security Analysis

In this section, we prove the proposed scheme is IND-sAA-sCCA2 secure.Lemma 1 (“zero-out” Lemma [19]).
LetM∗∈ℤpl×n∗,ρ be a linear secret sharing schemes of an access policy and C∈l be a nonauthorized set of rows. Let c∈ℕ be the dimension of the subspace spanned by the rows of ℂ. Then, the distribution of the shares λx∗x∈l sharing the secret s∈ℤp generated with the matrix M∗ is the same as the distribution of the share λxx∈l sharing the same secret s generated with some matrix M, where Mx,j=0 for all x,j∈C×n∗−c.The main security theorem is shown as follows.Theorem 1.
The proposed concrete scheme is IND-sAA-sCCA2 secure in the random oracle model if theq+1−DPBDHE2 assumption holds, the chameleon hash function is secure, and the size of challenge matrix is at most q×q.Proof.
Suppose that there exists a PPT adversaryA who can break the proposed scheme with nonnegligible advantage ε, then we can build a simulator ℬ which can break the q+1−DPBDHE2 assumption with the tuple D,Y as input and interact with A as follows:Init: initially,A gives ℬ a set of corrupt authorities Cθ and a challenge access policy M∗,ρ, where M∗ is a matrix whose size l×n is at most q×q and ρ:l⟶ℤp which implies that its attribute set is S∗=ρii∈l≜ρl. Let δ be a function map in each row M⟶i to the authority who manages attribute ρi, i.e., δi=Tρi, and denote δii∈l by δl.Global setup:ℬ gets D,Y from q+1−DPBDHE2 challenger and substitutes M∗ with the matrix M according to “zero-out” lemma where denotes n−c by n′ and restricts that, for each row Mx∈C, there is only one “1” in one of the last c positions and “0” in others. It picks randomly a challenge message m∗←RGT and sets C0=m∗·Y. It selects a secure chameleon hash function Hch:0,1∗⟶U and then runs the algorithm KeyGench1λ to get the key pair SKch,PKch. It randomly chooses an auxiliary parameter rch∗←Rℤp and computes V∗=HchPKch,C0∗,rch∗. Then, V∗ is regarded as a challenge on-the-fly dummy attribute authorized by θ0 controlled by ℬ. It calculates a matrix Ml+1⟵Rℤp1×n representing the access policy of V∗; Ml+1 is regarded as the l+1 row of M, and then, M becomes a l+1×n matrix.ℬ randomly selects α0′,β0′←Rℤp and sets(24)α0=α0′+bl+1aq+2Ml+1,1,β0=β0′+∑j=2n′bl+1aq+3−jMl+1,j.Then, it calculates(25)eg,gα0=eg,gα0′egbl+1a,gaq+1Ml+1,j,gβ0=gβ0′∏j=2n′gbl+1aq+3−jMl+1,j.At last,ℬ sends(26)GP=<p,g,G,e,eg,gα0,gβ0,U,Uθ,PKch,T>,toA, where the random oracles H and F are programmed by the simulator.Phase 1: the adversaryA issues a polynomially bounded number of queries statically:(i)
Authority’s public key queries:A submits a set of the noncorrupt authorities Nθ⊆Uθ and Nθ∩Cθ=∅ since A can create the public keys of the corrupt authorities by himself. For each θ∈Nθ, A considers two cases:(a)
θ∉δl: ℬ randomly selects αθ,βθ⟵Rℤp and outputs the public key eg,gαθ,gβθ.(b)
θ∈δl\Cθ: let X=x|δx=θ, ℬ randomly selects αθ′,βθ′⟵Rℤp and sets(27)αθ=αθ′+∑x∈X∪l+1bxaq+2Mx,1,βθ=βθ′+∑x∈X∪l+1∑j=2n′bxaq+3−jMx,j.Then, it calculates(28)eg,gαθ=eg,gαθ′∏x∈X∪l+1egbxa,gaq+1Mx,1,gβθ=gβθ′∏x∈X∪l+1∏j=2n′gbxaq+3−jMx,j.(ii)
H-oracle queries:A queries to oracle H for identity UIDi with attribute set Si. There are two cases:(a)
ρl∩Si=∅: ℬ randomly selects hi′←Rℤp and computes(29)HUIDi=ghi′ga,…,gan′−1=ghi′∏k=2n′gak−1.(b)
ρl∩Si≠∅: for some rows X′=x|ρx∈ρl∩Si and XC=x|δx∈δl∩Cθ, ℬ can find a vector d⟶i∈ℤpn×1 with di,1=1 such that M⟶x∗d⟶i=0 and M⟶xd⟶i=0 for all x∈X′∪XC and then ℬ randomly selects hi′←Rℤp and computes(30)HUIDi=ghi′gadi,2,…,gan′−1di,n′=ghi′∏k=2n′gak−1di,k.(iii)
F-oracle queries:A queries to oracle F for the attribute u whose authority is Tu. There are two cases:(a)
Tu∉δl or Tu∈Cθ: ℬ randomly selects Fu←RG if it has not been stored.(b)
Tu∈δl: let X″=x|δx=Tu−x|ρx=u and ℬ randomly selects fu←Rℤp and outputs(31)Fu=gfu∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,j.(iv)
User’s secret keys queries:A submits the user identity UIDi and a set of his all attributes Si, and ℬ gives A the secret keys for every u∈Si. Firstly, for each u∈Si, ℬ runs the algorithm AttrKeyGenUID,Tu,u⟶PUID,u to generate a binary tree ATu with an attribute key AKu and the path key PUID,u. Then, it considers the following three cases:(a)
Tu∉δl: ℬ randomly selects r,αTu,βTu←RG if it has not been stored. Then, it outputs(32)KTu,u,1=gαTuHUIDiβTuFur,KTu,u,2=gr,PUID,u.(b)
Tu∈δl and Si∩ρl=∅: according to the authority public key queries and H-oracle and F-oracle phases,(33)αTu=αTu′+∑x∈X∪l+1bxaq+2Mx,1,βTu=βTu′+∑x∈X∪l+1∑j=2n′bxaq+3−jMx,j,HUIDi=ghi′∏k=2n′gak−1,Fu=gfu∏x∈X∪l+1∏j∈n′gbxaq+2−jMx,j,whereX=x|δx=Tu.ℬ randomly selects t←Rℤp sets r=t−∑k∈n′ak and computes(34)KTu,u,1=gαTuHUIDiβTuFur=gαTu′g∑x∈X∪l+1bxaq+2Mx,1ghi′∏k=2n′gak−1βTu−βTu′HUIDiβTu′gfur∏x∈X∪l+1∏j∈n′gbxaq+2−jMx,jr=gαTu′g∑x∈X∪l+1bxaq+2Mx,1HUIDiβTu′gβTu−βTu′hi′g∑k=2n′ak−1∑x∈X∪l+1∏j=2n′bxaq+3−jMx,jgfur∏x∈X∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X∪l+1Σj∈n′bxaq+2−jMx,j−Σk∈n′ak=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X∪l+1bxaq+2Mx,1gΣx∈X∪l+1∏j=2n′∏k=2n′bxaq+2−j+kMx,jg−Σx∈X∪l+1Σj∈n′Σk∈n′bxaq+2−j+kMx,j=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X∪l+1∏j∈n′gbxaq+2−jMx,jtg−Σx∈X∪l+1∏j=2n′bxaq+3−jMx,jg−Σx∈X∪l+1∏j=2n′bxaq+1+jMx,1=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X∪l+1∏j∈ngbxaq+2−jMx,jt∏x∈X∪l+1∏j=2n′gbxaq+3−j−Mx,j∏x∈X∪l+1∏j=2n′gbxaq+1+j−Mx,1KTu,u,2=gr=gt∏j∈n′gaj−1.(c)
Tu∈δl and Si∩ρl≠∅: according to the authority public key queries and H-oracle and F-oracle phases,(35)αTu=αTu′+∑x∈X∪l+1bxaq+2Mx,1,βTu=βTu′+∑x∈X∪l+1∑j=2n′bxaq+3−jMx,j,HUIDi=ghi′∏k=2n′gak−1di,k,Fu=gfu∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,j,whereX=x|δx=Tu and X″=X\x|ρx=u.Hence,∀x∈X\X″=x|ρx=u, di,1=0, and M⟶xd⟶i=0. ℬ randomly selects t←Rℤp, sets r=t−∑k∈n′akdi,k, and computes(36)KTu,u,1=gαTuHUIDiβTuFur=gαTu′gΣx∈X∪l+1bxaq+2Mx,1ghi′∏k=2n′gak−1di,kβTu−βTu′HUIDiβTu′gfur∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,jr=gαTu′gΣx∈X∪l+1bxaq+2Mx,1HUIDiβTu′gβTu−βTu′hi′gΣk=2n′ak−1di,kΣx∈X∪l+1Σj=2n′bxaq+3−jMx,jgfur∏x∈X′′∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X″∪l+1Σj∈n′bxaq+2−jMx,j−Σk∈n′akdi,k=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X∪l+1bxaq+2Mx,1gΣx∈X∪l+1Σj=2nΣk=2nbxaq+2−j+kMx,jdi,kg−Σx∈X″∪l+1Σj∈n′Σk∈n′bxaq+2−j+kMx,jdi,k=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X\X″∪l+1bxaq+2Mx,1gΣx∈X\X″∪l+1Σj=2n′Σk=2n′bxaq+2−j+kMx,jdi,kgΣx∈X″∪l+1bxaq+2Mx,1gΣx∈X″∪l+1Σj=2n′Σk=2n′bxaq+2−j+kMx,jdi,kg−Σx∈X″∪l+1Σj∈n′Σk∈n′bxaq+2−j+kMx,jdi,k=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X\X″∪l+1bxaq+2Mx,1gΣx∈X\X″∪l+1Σj=2nΣk=2n′bxaq+2−j+kMx,jdi,kgΣx∈X″∪l+1bxaq+2Mx,1g−Σx∈X″∪l+1Σk=2n′bxaq+1+kMx,1di,kg−Σx∈X″∪l+1Σj∈n′bxaq+2−jMx,jdi,1=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X\X″∪l+1bxaq+2Mx,1gΣx∈X\X″∪l+1Σj=2n′Σk=2n′bxaq+2−j+kMx,jdi,kg−Σx∈X″∪l+1Σk=2n′bxaq+1+kMx,1di,kg−Σx∈X″∪l+1Σj=2n′bxaq+3−jMx,jdi,1=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X′′∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X\X″∪l+1bxaq+2Mx,1di,1gΣx∈X\X″∪l+1Σj=2n′bxaq+2Mx,jdi,jgΣx∈X\X″∪l+1Σj,k=2,j≠kn′,n′bxaq+2−j+kMx,jdi,kg−Σx∈X″∪l+1Σk=2n′bxaq+1+kMx,1di,kg−Σx∈X″∪l+1Σj=2n′bxaq+3−jMx,jdi,1=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X′′∪l+1∏j∈n′gbxaq+2−jMx,jtgΣx∈X\X″∪l+1Σj,k=2,j≠kn′,n′bxaq+2−j+kMx,jdi,kg−Σx∈X″∪l+1Σk=2n′bxaq+1+kMx,1di,kg−Σx∈X″∪l+1Σj=2n′bxaq+3−jMx,jdi,1=gαTu′HUIDiβTu′gβTu−βTu′hi′gfur∏x∈X″∪l+1∏j∈n′gbxaq+2−jMx,jt∏x∈X\X″∪l+1∏j,k=2,j≠kn′,n′gbxaq+2−j+kMx,jdi,k∏x∈X″∪l+1∏k=2n′gbxaq+1+k−Mx,1di,k∏x∈X″∪l+1∏j=2n′gbxaq+3−j−Mx,jdi,1KTu,u,2=gr=gt∏k∈n′gak−1.At last, the secret key foru is(37)SKUIDi,u=<KTu,u,1,KTu,u,2,PUIDi,u>.IfSi satisfies M∗,ρ, ℬ revokes one of these attributes from all users.(d)
TransformKey queries:A submits a user identity UIDi and a set of his all attributes Si. For every u∈Si, ℬ generates the secret keys KTu,u,1 and KTu,u,2 for u as shown in the phase of user’s secret key queries. Next, ℬ chooses a random number ℬ and then computes the transformation keys TKUID,u=<KTu,u,11/z,KTu,u,21/z>. At last, ℬ gives A the transformation keys TKUID,u for every u∈Si.(e)
CReEncryption queries:A submits some ciphertext and then ℬ re-encrypts the ciphertext with the latest attribute keys and returns them to A.(v)
Decryption queries:A submits a ciphertext CTCSP, and ℬ firstly transforms CTCSP to the original ciphertext CT by the latest {AKAID}. Then, it judges the ciphertext is valid or not by the algorithm PublicTestGP,PKAID,CT. At last, ℬ decrypts the ciphertext with the corresponding secret keys and returns the message if the ciphertext is legitimate.(vi)
Revocation queries:A queries to revoke a user UIDi with a set of attribute Si. For every u∈Si, ℬ runs the algorithm RevokeUIDi,u,RLu⟶UpAKu to get the update keys UpAKu, re-encrypts the ciphertext with the latest update keys, and then publishes AKu′·NKu,ii∈MinSubCoverATu,RLu to A.Challenge:A submits to ℬ two equal-length messages m0 and m1. C firstly randomly flips coin b∈0,1 and computes C0=mbY, where Y may be eg,gsaq+2 or R←RGT. ℬ sets v⟶=saq+2,0,…,0∈ℤp1×n and w⟶=0,saq+1,…,saq+n′−1,0,…,0∈ℤp1×n. Then, it produces the cipertexts by considering the following two cases:x∗∈l and δx∗∈Cθ: ∀i∈n′,Mx∗,i=0 implies that λx∗=M⟶x∗v⟶=0 and wx∗=M⟶x∗w⟶=0. ℬ randomly selects zx∗,yx∗,tx∗←Rℤp and calculates(38)C1,x∗=eg,gλx∗eg,gαδx∗tx∗eg,gzx∗=eg,gαδx∗tx∗eg,gzx∗+λx∗,C2,x∗=g−tx∗,C3,x∗=gβδx∗tx∗gwx∗gyx∗,C4,x∗=Fρx∗tx∗,C5,x∗=−zx∗,C6,x∗=−yx∗.x∗∈l and δx∗∉Cθ: λx∗=saq+2Mx∗,1 and wx∗=∑j=2n′saq+3−jMx∗,j. ℬ sets tx∗=−s/bx∗ and t0=−s/bl+1. Then, it randomly selects zx∗,yx∗←Rℤp and computes(39)C1,x∗=eg,gλx∗eg,gαδx∗tx∗eg,gzx∗=eg,gsaq+2Mx∗,1eg,g−∑x∈X∪l+1sbxaq+2Mx∗,1/bxeg,gzx∗=eg,g−Σx∈X∪l+1\x∗sbxaq+2Mx∗,1/bxeg,gzx∗,C2,x∗=g−tx∗=gs/bx∗,C3,x∗=gβδx∗tx∗gwx∗gyx∗=g−Σx∈X∪l+1Σj=2n′sbxaq+3−jMx∗,j/bx∗gΣj=2n′saq+3−jMx∗,jgyx∗=g−Σx∈X∪l+1\x∗Σj=2n′sbxaq+3−jMx∗,j/bx∗gyx∗=∏x∈X∪l+1\x∗∏j=2n′gsbxaq+3−j/bx∗−Mx∗,jgyx∗,C4,x∗=Fρx∗tx∗=∏x∈X″∪l+1∏j∈n′gsbxaq+2−j/bx∗−Mx∗,j,C5,x∗=−zx∗,C6,x∗=−yx∗,C1,0=Yeg,gα0t0,C2,0=g−t0=gs/bl+1,C3,0=gβ0t0gw0=gβ0t0g−Σx∗∈lwx∗,C4,0=FV∗t0,CT=M∗,ρ,C0,C1,0,C2,0,C3,0,C4,0,C1,x∗,C2,x∗,C3,x∗,C4,x∗,C5,x∗,C6,x∗x∗∈l.Sincetx∗x∗=0l are not properly distributed, ℬ randomly selects s′,tx∗′,t0′←Rℤp and random vectors v⟶′=s′,v2,…,vn, w⟶′=0,w2,…,wn∈ℤp1×n. Then, it computes the re-randomized ciphertext CT∗, ∀x∗∈l:(40)C0∗=C0eg,gs′,C1,0∗=C1,0eg,gs′+α0t0′,C2,0∗=C2,0g−t0′,C3,0∗=C3,0gβ0t0′gβ0t0g−Σx∗∈lwx∗′,C4,0∗=C4,0FV∗t0′,C1,x∗∗=C1,x∗eg,gM⟶x∗v⟶′+αρx∗tx∗,C2,x∗∗=C2,x∗g−tx∗′,C3,x∗∗=C3,x∗gβρx∗tx∗′+M⟶x∗wx∗′,C4,x∗∗=C4,x∗Fρx∗tx∗′,C5,x∗∗=C5,x∗=−zx∗,C6,x∗∗=C6,x∗=−yx∗.ℬ runs TCollisionchSKch,C0∗,rch∗,PKchC0∗C1,0∗C1,1∗C5,1∗⋯C1,l∗C5,l∗ to get the rb∗ such that V∗=HchPKch,PKchC0∗C1,0∗C1,1∗C5,1∗⋯C1,l∗C5,l∗,rb∗. At last, it re-encryptes the ciphertext CT∗ by the latest attribute keys and sends to A.Phase 2: the same as Phase 1, except thatA cannot make the secret key query for the selected access policy or make decryption query for the challenge ciphertext.Guess:A outputs a guess bit b′∈0,1. If b′=b, then ℬ outputs that Y=eg,gsaq+2. Otherwise, ℬ outputs that Y=R.
IfY=eg,gsaq+2, then ℬ plays the proper security game with A, since CT∗ is a valid ciphertext for the message mb. Denote the advantage of A wins in this case by ε. Otherwise, Y=R, CT∗ is a ciphertext of a random message, so the advantage of A is 0. Therefore, A has advantage AdvAλ=ε in breaking the concrete scheme, and then, ℬ can break the q+1-DPBDHE2 assumption with advantage AdvAλ=ε.


## 6. Performance Analysis

In this section, we analyze and compare the proposed scheme with others in terms of characteristics and efficiency both in the theoretical method and in the experimental method.


### 6.1. Theoretical Analysis

We compare the proposed scheme with several related MA-CP-ABE schemes in the terms of the feature, the computation, and the storage, respectively, in Tables2–4. Table 5 summarizes notations.Table 2
Comparison of properties with previous works.
SchemesMultiauthorityPublic testRevocationOnline/offline encryptionOutsource decryptionSecurityRW15 [19]√××××Statically secureLJWY18 [39]√×√×√Statically secureLLWG19 [40]√√√××IND-sAA-sCCA2 secureOurs√√√√√IND-sAA-sCCA2 secureTable 3
Comparison of computation cost.
SchemesOffline encryptionOnline encryptionPublic ciphertext testUser decryptionUser decryption (outsource decryption model)RW15 [19]×lF+2l+1ET+4lE+l+1MT+lM×3IP+IET+4IMT+H×LJWY18 [39]×lF+2l+1ET+4lE+l+1MT+lM×3IP+IET+IE+4IMT+HI+1ET+3IE+MTLLWG19 [40]×l+1F+2l+2ET+4l+4E+l+2MT+l+1M4l+1P+2l+3MT+Hch3IP+IET+IE+4IMT+H×Ours2ET+2E+MTlF+lE+MT+M+Hchl+2P+lE+l+2MT+2I+l+4M+Hch3IP+2IET+2IE+5IMT+HET+2IE+2MTTable 4
Comparison of storage overhead.
SchemesAA’s MKAA’s PKUser’s private keyCTpoolOffline ciphertextOnline ciphertextRW15 [19]2lZplGT+lG2SlG××l+1lGT+3llGLJWY18 [39]2lZplGT+lG2SlG+SPalZp××l+1lGT+3llGLLWG19 [40]2lZplGT+lG2SlG+SPalZp××l+2lGT+3l+3lG+lZpOurs2lZplGT+lG2SlG+SPalZpNlGT+2NlG+3NlZp2lGT+2lG+2lZpl+2lGT+3l+3lG+3lZpTable 5
Notations in performance analysis.
NotationDescriptionM/MTOne multiplication operation in the groupG/GTE/ETOne exponentiation operation onG/GTPOne pairing operationHOne hash operationHchOne chameleon hash operationINumber of attributes required for the decryptionNANumber of attributes authoritieslComplexity of the access structureSSet of the attributes in user’s private keyNSize of ciphertext poolPaSize of the path key for attributealZpSize of an element inℤplGSize of an element inGlGTSize of an element inGTIn Table2, we compare the properties of our scheme with other previous schemes. All these MA-CP-ABE access control schemes are constructed on the prime-order bilinear group and support the large universe. We can observe that our scheme is superior to other existing previous relevant schemes. The schemes in [19, 39] cannot filter illegal or invalid ciphertext because they do not support the ciphertext public test. The schemes in [19, 40] deal with the scenario that dynamically change the users’ access privilege since they support users’ attribute revocation. They also cannot support outsourcing decryption to reduce the computation overhead on the users’ side. In the other schemes, the data owners will face a heavy computation load when encrypting the data. Only our scheme provides the online/offline encryption algorithm. Moreover, ours is CCA2-secure which is more secure than the other statically secure schemes.In Table3, we compare the computational complexity of our scheme with the previous schemes. As for the computation efficiency of the encryption, the proposed scheme is much more efficient than the other schemes since the expensive encryption operations have been executed in the user’s initialization phase by adding the reusable ciphertext pool and split to online encryption and offline encryption. In comparison with the scheme in [39], the computation complexity of final decryption (the last step to recover plaintext for the user) is substantially reduced in our scheme. Moreover, our scheme is more efficient than the scheme in [40] when publicly verifying the ciphertext.In Table4, we compare the storage overhead of these above schemes on every entity. The main storage overhead of each AA comes from the master secret key is the same constant in every scheme. The data owner’s storage overhead comes from the global public parameters and authority public keys. In our scheme, the data owner needs to shore the reusable ciphertext pool additionally. The data user’s storage overhead mainly comes from the attribute-related secret keys. In these schemes [39, 40], and our scheme, the data user needs to store the path key since they using the same revocation method.


### 6.2. Experimental Analysis

To evaluate the performance of our proposed scheme, we implemented and compared the computation cost of the RW15 scheme [19], the LLWG19 scheme [40], and ours in Charm [44] from the Stanford Pairing-Based Crypto library [45]. The program was running on a supersingular symmetric elliptic curve group (“SS512”), over 512-bit base field size. The curve group has a 160-bit order. All the experiments were conducted on a virtual machine platform: Vmware@Workstation 15 Pro 15.5.2 build-15785246, equipped with a 2.30 GHz Intel Cored CPU with 2 GB RAM running 64-bit Linux Ubuntu 18.04.4. We run the schemes for 100 rounds and calculate the average execution time they took, where the number of attributes is ranging from 1 to 50. Finally, the graphs are shown in Figure 3.Figure 3
Experimental performance comparisons: (a) encryption cost; (b) decryption cost; (c) public-test cost.
(a)(b)(c)As shown in Figure3, the encryption cost, the decryption cost, and the public ciphertext test cost grow linearly with the number of attributes in the access structure. From Figure 3(a), in the proposed scheme, the encryption is split into online encryption and offline encryption. The online encryption time grows with the number of attributes since the online encryption has to compute the hash operation and exponentiation operation related to attributes. However, the online encryption time can be nearly haft reduced. In Figure 3(b), the predecryption denotes the data user recovers the original ciphertext by the attribute keys when she/he chooses outsourcing decryption, so its time grows with the number of attributes. Moreover, the final decryption only requires a constant amount of computation, so its time is nearly constant. Taken together, the total decryption time in our proposed scheme is nearly a quarter of it in the RW15 scheme. Focusing on the public ciphertext test cost, Figure 3(c) shows that the public ciphertext test time in the proposed scheme is less than that in the LLWG19 scheme. Therefore, the proposed scheme is very efficient in terms of the encryption cost, the decryption cost, and the public ciphertext test cost.In conclusion, our proposal is more flexible and supports more functions than other previous schemes, which is more suitable for the IoT.


## 6.1. Theoretical Analysis

We compare the proposed scheme with several related MA-CP-ABE schemes in the terms of the feature, the computation, and the storage, respectively, in Tables2–4. Table 5 summarizes notations.Table 2
Comparison of properties with previous works.
SchemesMultiauthorityPublic testRevocationOnline/offline encryptionOutsource decryptionSecurityRW15 [19]√××××Statically secureLJWY18 [39]√×√×√Statically secureLLWG19 [40]√√√××IND-sAA-sCCA2 secureOurs√√√√√IND-sAA-sCCA2 secureTable 3
Comparison of computation cost.
SchemesOffline encryptionOnline encryptionPublic ciphertext testUser decryptionUser decryption (outsource decryption model)RW15 [19]×lF+2l+1ET+4lE+l+1MT+lM×3IP+IET+4IMT+H×LJWY18 [39]×lF+2l+1ET+4lE+l+1MT+lM×3IP+IET+IE+4IMT+HI+1ET+3IE+MTLLWG19 [40]×l+1F+2l+2ET+4l+4E+l+2MT+l+1M4l+1P+2l+3MT+Hch3IP+IET+IE+4IMT+H×Ours2ET+2E+MTlF+lE+MT+M+Hchl+2P+lE+l+2MT+2I+l+4M+Hch3IP+2IET+2IE+5IMT+HET+2IE+2MTTable 4
Comparison of storage overhead.
SchemesAA’s MKAA’s PKUser’s private keyCTpoolOffline ciphertextOnline ciphertextRW15 [19]2lZplGT+lG2SlG××l+1lGT+3llGLJWY18 [39]2lZplGT+lG2SlG+SPalZp××l+1lGT+3llGLLWG19 [40]2lZplGT+lG2SlG+SPalZp××l+2lGT+3l+3lG+lZpOurs2lZplGT+lG2SlG+SPalZpNlGT+2NlG+3NlZp2lGT+2lG+2lZpl+2lGT+3l+3lG+3lZpTable 5
Notations in performance analysis.
NotationDescriptionM/MTOne multiplication operation in the groupG/GTE/ETOne exponentiation operation onG/GTPOne pairing operationHOne hash operationHchOne chameleon hash operationINumber of attributes required for the decryptionNANumber of attributes authoritieslComplexity of the access structureSSet of the attributes in user’s private keyNSize of ciphertext poolPaSize of the path key for attributealZpSize of an element inℤplGSize of an element inGlGTSize of an element inGTIn Table2, we compare the properties of our scheme with other previous schemes. All these MA-CP-ABE access control schemes are constructed on the prime-order bilinear group and support the large universe. We can observe that our scheme is superior to other existing previous relevant schemes. The schemes in [19, 39] cannot filter illegal or invalid ciphertext because they do not support the ciphertext public test. The schemes in [19, 40] deal with the scenario that dynamically change the users’ access privilege since they support users’ attribute revocation. They also cannot support outsourcing decryption to reduce the computation overhead on the users’ side. In the other schemes, the data owners will face a heavy computation load when encrypting the data. Only our scheme provides the online/offline encryption algorithm. Moreover, ours is CCA2-secure which is more secure than the other statically secure schemes.In Table3, we compare the computational complexity of our scheme with the previous schemes. As for the computation efficiency of the encryption, the proposed scheme is much more efficient than the other schemes since the expensive encryption operations have been executed in the user’s initialization phase by adding the reusable ciphertext pool and split to online encryption and offline encryption. In comparison with the scheme in [39], the computation complexity of final decryption (the last step to recover plaintext for the user) is substantially reduced in our scheme. Moreover, our scheme is more efficient than the scheme in [40] when publicly verifying the ciphertext.In Table4, we compare the storage overhead of these above schemes on every entity. The main storage overhead of each AA comes from the master secret key is the same constant in every scheme. The data owner’s storage overhead comes from the global public parameters and authority public keys. In our scheme, the data owner needs to shore the reusable ciphertext pool additionally. The data user’s storage overhead mainly comes from the attribute-related secret keys. In these schemes [39, 40], and our scheme, the data user needs to store the path key since they using the same revocation method.


## 6.2. Experimental Analysis

To evaluate the performance of our proposed scheme, we implemented and compared the computation cost of the RW15 scheme [19], the LLWG19 scheme [40], and ours in Charm [44] from the Stanford Pairing-Based Crypto library [45]. The program was running on a supersingular symmetric elliptic curve group (“SS512”), over 512-bit base field size. The curve group has a 160-bit order. All the experiments were conducted on a virtual machine platform: Vmware@Workstation 15 Pro 15.5.2 build-15785246, equipped with a 2.30 GHz Intel Cored CPU with 2 GB RAM running 64-bit Linux Ubuntu 18.04.4. We run the schemes for 100 rounds and calculate the average execution time they took, where the number of attributes is ranging from 1 to 50. Finally, the graphs are shown in Figure 3.Figure 3
Experimental performance comparisons: (a) encryption cost; (b) decryption cost; (c) public-test cost.
(a)(b)(c)As shown in Figure3, the encryption cost, the decryption cost, and the public ciphertext test cost grow linearly with the number of attributes in the access structure. From Figure 3(a), in the proposed scheme, the encryption is split into online encryption and offline encryption. The online encryption time grows with the number of attributes since the online encryption has to compute the hash operation and exponentiation operation related to attributes. However, the online encryption time can be nearly haft reduced. In Figure 3(b), the predecryption denotes the data user recovers the original ciphertext by the attribute keys when she/he chooses outsourcing decryption, so its time grows with the number of attributes. Moreover, the final decryption only requires a constant amount of computation, so its time is nearly constant. Taken together, the total decryption time in our proposed scheme is nearly a quarter of it in the RW15 scheme. Focusing on the public ciphertext test cost, Figure 3(c) shows that the public ciphertext test time in the proposed scheme is less than that in the LLWG19 scheme. Therefore, the proposed scheme is very efficient in terms of the encryption cost, the decryption cost, and the public ciphertext test cost.In conclusion, our proposal is more flexible and supports more functions than other previous schemes, which is more suitable for the IoT.


## 7. Conclusion

In this paper, we design an efficient, CCA2-secure, flexible fine-grained access control scheme to solve the practical issues efficiently for the IoT using edge computing. The proposed scheme meets the need of the large-scale multidomain collaboration in the IoT by using multiauthority attribute-based encryption with the large attribute universe. By adding a reusable ciphertext pool, the most expensive encryption operations have been executed in the user’s initialization phase which minimizes the online encryption computation. At the same time, the near-edge servers can perform the major decryption for the data user. As a result, the computation overhead of encryption and decryption is substantially reduced both on the data owner and user sides. A fine-grained revocation mechanism is designed to revoke an attribute from the user, by which the user or the attribute can be revoked from the system. So it can change user’s access privileges timely and be suitable for the dynamic IoT. The scheme supports efficient ciphertext verification. Only valid ciphertext can be stored and transmitted, which saves the system resources. Moreover, the user can verify the validity of the ciphertext even though some attributes involved in the ciphertext are revoked, only if the rest of his attributes still has the access privilege to decrypt the ciphertext. The proposed scheme is proven CCA2-secure under the q-DPBDHE2 assumption, which is more secure than the previous scheme. The performance analysis results show that the proposed scheme is highly efficient and suitable in edge computing for the IoT.



---

*Source: 8872699-2021-02-02.xml*