# Adaptive Secure Cross-Cloud Data Collaboration with Identity-Based Cryptography and Conditional Proxy Re-Encryption

Authors: Qinlong Huang; Yue He; Wei Yue; Yixian Yang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Data collaboration in cloud computing is more and more popular nowadays, and proxy deployment schemes are employed to realize cross-cloud data collaboration. However, data security and privacy are the most serious issues that would raise great concerns from users when they adopt cloud systems to handle data collaboration. Different cryptographic techniques are deployed in different cloud service providers, which makes cross-cloud data collaboration to be a deeper challenge. In this paper, we propose an adaptive secure cross-cloud data collaboration scheme with identity-based cryptography (IBC) and proxy re-encryption (PRE) techniques. We first present a secure cross-cloud data collaboration framework, which protects data confidentiality with IBC technique and transfers the collaborated data in an encrypted form by deploying a proxy close to the clouds. We then provide an adaptive conditional PRE protocol with the designed full identity-based broadcast conditional PRE algorithm, which can achieve flexible and conditional data re-encryption among ciphertexts encrypted in identity-based encryption manner and ciphertexts encrypted in identity-based broadcast encryption manner. The extensive analysis and experimental evaluations demonstrate the well security and performance of our scheme, which meets the secure data collaboration requirements in cross-cloud scenarios.


---

## Body

## 1. Introduction

Cloud computing which benefits individual and enterprise users in the aspect of convenient access, rich computation, and storage resources is becoming more and more popular. Nowadays, many enterprises have built their own cloud platform on one or multiple public cloud systems (e.g., Dropbox, Google Drive, and Baidu PCS) for data storage and sharing [1]. More recently, they have been widely used for more advanced, user-desired functionalities, in particular data collaboration among multiple users, such as collaborative document or paper editing.However, the desirable functionality is yet restricted to the “walled-garden” of each cloud storage service, since data collaboration happens inside each cloud service, but not cross the cloud when these cloud services are unavailable in certain regions. For example, a transnational corporation has its headquarter in United States that uses Google Drive to backup data, as well as branch office in China that uses Baidu PCS (Google Drive have been banned in China). Employees in headquarter or branch office can enjoy the data collaboration service by uploading and downloading the data in Google Drive or Baidu PCS, respectively. But data collaboration between these two cloud services is inconvenient and inefficient. Researchers have proposed proxy deployment schemes to realize the cross-cloud data collaboration and designed inter-proxy transfer protocols to improve efficiency.As promising as it is, cloud service is also facing many challenges and may impede its fast growth if not well resolved. Data security and privacy are the most serious issues in cloud computing when handling sensitive information (e.g., project schedule and commercial data). Since the cloud servers are honest but curious, the collected private information may be directly revealed. A common belief on the security and privacy of cloud system is that the data should be encrypted. There are many proposals on how to use modern cryptographic techniques such as identity-based cryptography (IBC), or attribute-based encryption (ABE) to achieve secure data collaboration inside the cloud service [2]. Identity-based encryption (IBE) is the most commonly used encryption technique, through which data owner could encrypt data with authorized user’s identity. Then identity-based broadcast encryption (IBBE) is proposed by allowing data owner to grant access permission to a group of users at one time. Recent works also utilize ABE to achieve fine-grained access control over encrypted data using access policies and ascribed attributes among private keys and ciphertexts. However, ABE brings heavy overhead of data encryption, data decryption, and key management. It may be not suitable for data collaboration directly, since the data collaboration service involves multiple parties and results in a large number of encryption and decryption operations. Thus, IBC is a prevalent technique to enable users to protect data confidentiality in cloud computing. Hence, by using an identity, the user can share data with collaborative users in a secure manner, which motivates more users to enjoy the benefits of cloud collaboration.In fact, different cryptographic techniques may be deployed in cloud services to protect data confidentiality. It makes cross-cloud data collaboration to be a deeper challenge. A simple solution is to re-encrypt the data and upload the ciphertext, while another appropriate approach is to introduce a semitrusted proxy to transform a ciphertext into another ciphertext which can be decrypted by other users. To solve this problem, some schemes based on proxy re-encryption (PRE) are proposed. Corresponding to above data collaboration scenario, existing PRE based schemes only can achieve coarse-grained control over ciphertexts, since it only allows the re-encryption procedure to be executed in an all-or-nothing manner. If a project leader in department A wonders to discuss detailed project schedule with collaborative users in department B, so he only asks the proxy to re-encrypt the ciphertext of project schedule to collaborative users, not other ciphertexts that he has encrypted. A recent concept referred to as conditional PRE (CPRE) could address this issue, in which data owner can enforce re-encryption control over the initial ciphertexts and only the ciphertexts meeting the specified condition can be re-encrypted by the proxy [3]. However, how to achieve conditional and cross-cloud ciphertext collaboration between different cloud services is still a challenging problem.In this paper, we propose an adaptive secure cross-cloud data collaboration scheme with IBC and PRE technique. The main contribution of this paper can be summarized as follows:(1) We propose a secure cross-cloud data collaboration framework, which protects data confidentiality with IBC technique and transfers the collaborated data in an encrypted form by deploying a proxy close to the clouds.(2) We provide an adaptive CPRE (ACPRE) protocol with four types of ciphertext collaboration, which can achieve flexible and conditional data re-encryption among ciphertexts in IBE and IBBE manners.(3) We conduct extensive security and performance analysis and also experimental evaluations, which demonstrate that our scheme is secure and efficient for data collaboration.The rest of this paper is organized as follows. Sections2 and 3 discuss the related work and preliminaries, respectively. Section 4 provides the system framework, security model, and system definition. In Section 5, we present our detailed construction. Then, we give the security and performance analysis of our scheme in Sections 6 and 7, respectively. We discuss the experimental results in Section 8 and conclude this paper in Section 9.


## 2. Related Work

### 2.1. Data Collaboration

The demand for cloud-based data collaboration is rising along with the tremendously increased popularity in cloud computing. At present, many researchers have been devoted to achieve flexible and scalable data collaboration in cloud environment. The common approach is the data owners use the encryption key to encrypt the whole document into the ciphertext before uploading it to the cloud for storage. While the collaborative users download the document and recover the text with the decryption key [4, 5]. However, distributing the decryption key to the collaborative users can be challenging. These schemes cannot support cross-cloud data collaboration where data are shared and collaboratively used among different parties who adopt different cryptographic techniques involved in the multiple clouds.Nepal et al. [9] provided a data collaboration solution in the hybrid cloud by fragmenting, encrypting and signing the data before uploading it to the cloud storage. Unfortunately, this method does not give the detailed construction of designed algorithms. Ahmadian et al. [10] discussed a hybrid clouds based architecture to provide an ideal environment for cooperation of multiple organizations. In this scheme, trusted private cloud processes sensitive data and public cloud adopts order preserving encryption to process data. However, the security of this scheme relies on trusted private cloud and it only considers the case that all the organizations adopt the same public cloud.Bessani et al. [11] designed a DepSky system, which can provide dependable and secure storage service on diverse public clouds for users through the encryption, encoding, and replication techniques. However, this scheme assumes all clouds adopt the same symmetric encryption. Based on it, Fabian et al. [12] presented an improved architecture for medical data sharing between different cooperating organizations in multiple clouds, which uses different cryptographic techniques. But it focuses on splitting and reconstructing the encrypted data based on secret sharing. E et al. [13] implemented an efficient cross-cloud file collaboration system, called CoCloud, which includes an inter-proxy transfer protocol and a cross-cloud data transfer optimization algorithm. Although CoCloud supports file collaborations among four popular cloud storage services in the United States and China, it ignores the security and privacy concerns of users that cannot support data collaboration on ciphertexts.


### 2.2. Identity-Based Proxy Re-Encryption

IBE and IBBE techniques are both widely adapted to share data and guarantee data confidentiality in cloud [14]. In their approaches, data owner publishes encrypted data to the service provider with one or multiple recipients, while only the intended users who can derive the decryption key would be able to decrypt and access the data owner’s private data.Combined with IBBE and IBE, PRE is another technique which is commonly adopted to achieve data sharing and disseminating. The first PRE scheme was proposed by Blaze [15]. It can transform the ciphertext under Alice to be another ciphertext under Bob by using semitrusted proxy. Following this seminal work, identity-based PRE [16] was proposed, which allows any recognizable string to serve as a public key. Since then, PRE became a hot research topic in cryptography field. Liang et al. [17] proposed a cloud-based revocable identity-based PRE scheme, which supports user revocation by making a proxy to re-encrypt all ciphertexts every once in a while. Li et al. [18] designed a secure identity-based PRE scheme with multi-hop construction. Wang et al. [19] designed a health cloud system framework based on IBE, called IBPRE, in which doctor can access health data with authorization from patient based on PRE. Zhou et al. [6] proposed an identity-based PRE construct named IBBPRE to convert the user’s IBBE-encrypted data into IBE-encrypted data without leaking any sensitive information. Combining the broadcast encryption system and PRE, Sun et al. [20] constructed chosen-ciphertext secure PRE scheme IBPBRE, which enables the proxy to transfer IBE-encrypted data into IBBE-encrypted data.


### 2.3. Conditional Proxy Re-Encryption

The above PRE schemes only allow data sharing in a coarse-grained manner. If the user delegates a re-encryption key to the proxy, either all ciphertexts can be re-encrypted and then be accessible to the intended users, or none of the ciphertexts can be re-encrypted or accessed by others. This issue is addressed in the CPRE schemes[21, 22], which is first proposed by Weng et al. [23]. In this scheme, proxy can successfully re-encrypt data only if the prescribed conditions are met. Shao et al. [7] proposed an identity-based CPRE (IBCPRE), in which a proxy is allowed to transform a subset of ciphertexts under an identity to other ciphertexts under another identity. However, it cannot authorize decryption right to a group of users. Chu et al. [24] introduced a more generalized notion of conditional proxy broadcast re-encryption (IBCPBRE), which allows a user to delegate the decryption rights of ciphertexts to a group of users, restricted to a certain condition. Xu et al. [8] proposed an efficient conditional identity-based broadcast PRE scheme for cloud email, which is referred to as IBBCPBRE, and transformed an IBBE ciphertext into another IBBE ciphertext if the conditions are satisfied.


## 2.1. Data Collaboration

The demand for cloud-based data collaboration is rising along with the tremendously increased popularity in cloud computing. At present, many researchers have been devoted to achieve flexible and scalable data collaboration in cloud environment. The common approach is the data owners use the encryption key to encrypt the whole document into the ciphertext before uploading it to the cloud for storage. While the collaborative users download the document and recover the text with the decryption key [4, 5]. However, distributing the decryption key to the collaborative users can be challenging. These schemes cannot support cross-cloud data collaboration where data are shared and collaboratively used among different parties who adopt different cryptographic techniques involved in the multiple clouds.Nepal et al. [9] provided a data collaboration solution in the hybrid cloud by fragmenting, encrypting and signing the data before uploading it to the cloud storage. Unfortunately, this method does not give the detailed construction of designed algorithms. Ahmadian et al. [10] discussed a hybrid clouds based architecture to provide an ideal environment for cooperation of multiple organizations. In this scheme, trusted private cloud processes sensitive data and public cloud adopts order preserving encryption to process data. However, the security of this scheme relies on trusted private cloud and it only considers the case that all the organizations adopt the same public cloud.Bessani et al. [11] designed a DepSky system, which can provide dependable and secure storage service on diverse public clouds for users through the encryption, encoding, and replication techniques. However, this scheme assumes all clouds adopt the same symmetric encryption. Based on it, Fabian et al. [12] presented an improved architecture for medical data sharing between different cooperating organizations in multiple clouds, which uses different cryptographic techniques. But it focuses on splitting and reconstructing the encrypted data based on secret sharing. E et al. [13] implemented an efficient cross-cloud file collaboration system, called CoCloud, which includes an inter-proxy transfer protocol and a cross-cloud data transfer optimization algorithm. Although CoCloud supports file collaborations among four popular cloud storage services in the United States and China, it ignores the security and privacy concerns of users that cannot support data collaboration on ciphertexts.


## 2.2. Identity-Based Proxy Re-Encryption

IBE and IBBE techniques are both widely adapted to share data and guarantee data confidentiality in cloud [14]. In their approaches, data owner publishes encrypted data to the service provider with one or multiple recipients, while only the intended users who can derive the decryption key would be able to decrypt and access the data owner’s private data.Combined with IBBE and IBE, PRE is another technique which is commonly adopted to achieve data sharing and disseminating. The first PRE scheme was proposed by Blaze [15]. It can transform the ciphertext under Alice to be another ciphertext under Bob by using semitrusted proxy. Following this seminal work, identity-based PRE [16] was proposed, which allows any recognizable string to serve as a public key. Since then, PRE became a hot research topic in cryptography field. Liang et al. [17] proposed a cloud-based revocable identity-based PRE scheme, which supports user revocation by making a proxy to re-encrypt all ciphertexts every once in a while. Li et al. [18] designed a secure identity-based PRE scheme with multi-hop construction. Wang et al. [19] designed a health cloud system framework based on IBE, called IBPRE, in which doctor can access health data with authorization from patient based on PRE. Zhou et al. [6] proposed an identity-based PRE construct named IBBPRE to convert the user’s IBBE-encrypted data into IBE-encrypted data without leaking any sensitive information. Combining the broadcast encryption system and PRE, Sun et al. [20] constructed chosen-ciphertext secure PRE scheme IBPBRE, which enables the proxy to transfer IBE-encrypted data into IBBE-encrypted data.


## 2.3. Conditional Proxy Re-Encryption

The above PRE schemes only allow data sharing in a coarse-grained manner. If the user delegates a re-encryption key to the proxy, either all ciphertexts can be re-encrypted and then be accessible to the intended users, or none of the ciphertexts can be re-encrypted or accessed by others. This issue is addressed in the CPRE schemes[21, 22], which is first proposed by Weng et al. [23]. In this scheme, proxy can successfully re-encrypt data only if the prescribed conditions are met. Shao et al. [7] proposed an identity-based CPRE (IBCPRE), in which a proxy is allowed to transform a subset of ciphertexts under an identity to other ciphertexts under another identity. However, it cannot authorize decryption right to a group of users. Chu et al. [24] introduced a more generalized notion of conditional proxy broadcast re-encryption (IBCPBRE), which allows a user to delegate the decryption rights of ciphertexts to a group of users, restricted to a certain condition. Xu et al. [8] proposed an efficient conditional identity-based broadcast PRE scheme for cloud email, which is referred to as IBBCPBRE, and transformed an IBBE ciphertext into another IBBE ciphertext if the conditions are satisfied.


## 3. Preliminaries

### 3.1. Bilinear Map

LetG
0 and G
T be two multiplicative groups with the same prime orderp. A map e
:
G
0
×
G
0
→
G
T with the following properties is said to be bilinear:(1)
Computability. There is a polynomial time algorithm to computee
(
g
,
h
)
∈
G
T for any g
,
h
∈
G
0.
(2)
Bilinearity. For allg
,
h
∈
G
0 and a
,
b
∈
Z
p, we have e
(
g
a
,
h
b
)
=
e
(
g
,
h
)
a
b.
(3)
Nondegeneracy. There existsg
,
h
∈
G
0 such that e
(
g
,
h
)
≠
1.


### 3.2. Identity-Based Encryption

The IBE scheme consists of the following algorithms.(1) (PK, MK) ← Setup(1
λ). It takes a security parameter λ as input and outputs public parametersPK which are distributed to users, and the master secret keyMK which is kept private.(2)SK← KeyGen(MK, PK, ID). It takes the master secret keyMK and an identityID as input, and outputs a secret keySK corresponding toID.(3)CT← Enc(ID, PK, M). It takes an identityID, the public parametersPK and a plaintextM as input, and outputs a ciphertextCT.(4)M/⊥ ← Dec(SK, PK, CT). It decrypts the ciphertextCT using the secret keySK, and outputsM or ⊥.


### 3.3. Conditional Proxy Re-Encryption

The CPRE scheme which allows encrypting and re-encrypting with a condition is comprised of the following algorithms.(1)GK← Setup(1
λ). It takes a security parameter λ as input and generates the global public parameterGK.(2) (PK, SK) ← KeyGen(GK, u). It generates the public keyPK and secret keySK for a useru.(3)RK← ReKeyGen(SK
A
, PK
B
, c). It takes as input a secret keySK
A of the delegator, a public keyPK
B of the delegatee, a conditional setc, and outputs a re-encryption keyRK.(4)CT← Enc-1(PK,M). It takes as input a public keyPK, a messageM, and outputs a first-level ciphertextCT under public keyPK.(5)C
T
′
← Enc-2(PK, M, c). It takes as input a public keyPK, a messageM and a conditional setc, and outputs a second-level ciphertext C
T
′.(6)CT← ReEnc(C
T
′
, RK). It takes as input a second-level ciphertext C
T
′associated withc, a re-encryption key R
K, and outputs a first-level ciphertextCT if the conditional set is matched.(7)M← Dec-1(CT, SK). It takes as input a first-level ciphertextCT and a secret keySK, and outputs a messageM or an error symbol.(8)M← Dec-2(C
T
′
, SK). It takes as input a second-level ciphertext C
T
′ and a secret keySK, and outputs a messageM or an error symbol.


## 3.1. Bilinear Map

LetG
0 and G
T be two multiplicative groups with the same prime orderp. A map e
:
G
0
×
G
0
→
G
T with the following properties is said to be bilinear:(1)
Computability. There is a polynomial time algorithm to computee
(
g
,
h
)
∈
G
T for any g
,
h
∈
G
0.
(2)
Bilinearity. For allg
,
h
∈
G
0 and a
,
b
∈
Z
p, we have e
(
g
a
,
h
b
)
=
e
(
g
,
h
)
a
b.
(3)
Nondegeneracy. There existsg
,
h
∈
G
0 such that e
(
g
,
h
)
≠
1.


## 3.2. Identity-Based Encryption

The IBE scheme consists of the following algorithms.(1) (PK, MK) ← Setup(1
λ). It takes a security parameter λ as input and outputs public parametersPK which are distributed to users, and the master secret keyMK which is kept private.(2)SK← KeyGen(MK, PK, ID). It takes the master secret keyMK and an identityID as input, and outputs a secret keySK corresponding toID.(3)CT← Enc(ID, PK, M). It takes an identityID, the public parametersPK and a plaintextM as input, and outputs a ciphertextCT.(4)M/⊥ ← Dec(SK, PK, CT). It decrypts the ciphertextCT using the secret keySK, and outputsM or ⊥.


## 3.3. Conditional Proxy Re-Encryption

The CPRE scheme which allows encrypting and re-encrypting with a condition is comprised of the following algorithms.(1)GK← Setup(1
λ). It takes a security parameter λ as input and generates the global public parameterGK.(2) (PK, SK) ← KeyGen(GK, u). It generates the public keyPK and secret keySK for a useru.(3)RK← ReKeyGen(SK
A
, PK
B
, c). It takes as input a secret keySK
A of the delegator, a public keyPK
B of the delegatee, a conditional setc, and outputs a re-encryption keyRK.(4)CT← Enc-1(PK,M). It takes as input a public keyPK, a messageM, and outputs a first-level ciphertextCT under public keyPK.(5)C
T
′
← Enc-2(PK, M, c). It takes as input a public keyPK, a messageM and a conditional setc, and outputs a second-level ciphertext C
T
′.(6)CT← ReEnc(C
T
′
, RK). It takes as input a second-level ciphertext C
T
′associated withc, a re-encryption key R
K, and outputs a first-level ciphertextCT if the conditional set is matched.(7)M← Dec-1(CT, SK). It takes as input a first-level ciphertextCT and a secret keySK, and outputs a messageM or an error symbol.(8)M← Dec-2(C
T
′
, SK). It takes as input a second-level ciphertext C
T
′ and a secret keySK, and outputs a messageM or an error symbol.


## 4. Scheme Overview

### 4.1. System Model

Our scheme applies IBC and PRE techniques to accomplish secure cross-cloud data collaboration. As shown in Figure1, the system model of our scheme consists of trust authority, cloud service provider (CSP), proxy server, data owner, and user.Figure 1
System model of our scheme.(1) Trust authority. The trust authority is a fully trusted party that generates system parameters to initialize the system. It also generates secret keys with users’ identity.(2) CSP. The CSP is a semitrusted party which offers data storage service and enables the authorized users to access ciphertexts stored on it.(3) Proxy server. The proxy server provides data transfer service based on web APIs between CSPs. Moreover, it is in charge of generating re-encrypted ciphertext to achieve cross-cloud data collaboration among multiple users.(4) Data owner. The data owners encrypt data with IBE or IBBE algorithm and then upload ciphertext to the CSP. When sharing data stored in one CSP with the user who cannot access directly, the data owners send the re-encryption key to the proxy server which transforms the ciphertext into a re-encrypted ciphertext that can be accessed by user.(5) User. The user can decrypt the ciphertext stored in the cloud with his or her secret key. Simultaneously, the users can also decrypt the data owners’ re-encrypted ciphertext with their secret keys, which achieves data collaboration between two CSPs.


### 4.2. Security Requirements

We assume the trust authority to be a trusted party which will not collude with unauthorized users. However, we assume the CSP and proxy server are honest but curious, which means they may collude to get unauthorized data. Specifically, the security requirements cover the following aspects.(1) Data confidentiality. The unauthorized users who are not the intended receivers defined by data owner should be prevented from accessing the data; unauthorized access from the semitrusted CSP should also be prevented.(2) Re-encryption secrecy. The re-encryption keys with unauthorized data users should be prevented from transforming the ciphertexts successfully.


### 4.3. System Definitions

Our ACPRE protocol includes the following four types of ciphertext collaboration.Type I Individual-to-Individual Re-Encryption.The initial ciphertext associated with one authorized user is transformed to a re-encrypted ciphertext of one user by proxy server.Type II Individual-to-Group Re-Encryption.The initial ciphertext associated with one authorized user is transformed to a re-encrypted ciphertext of a set of users by proxy server.Type III Group-to-Individual Re-Encryption.The initial ciphertext associated with a set of authorized users is transformed to a re-encrypted ciphertext of one user by proxy server.Type IV Group-to-Group Re-Encryption.The initial ciphertext associated with a set of authorized users is transformed to a re-encrypted ciphertext of a set of users by proxy server.To implement the above protocol, we define our scheme with the following algorithms.(1)Setup(1
λ,N). The trust authority takes as input a security parameter λ and the maximal size of receiver setN and outputs a system public keyPK and a master secret keyMK.(2)KeyGen(PK,MK,ID). The trust authority takes as inputPK andMK and an identityID, and outputs the secret keySK.(3)IBE.Enc(PK,M,ID,C). The CSP takes as inputPK, dataM, an identityID, and a conditionC and then outputs an initial ciphertext C
T
I
B
E.(4)IBBE.Enc(PK,M,U,C). The CSP takes as inputPK, dataM, a setU of identities, and a conditionC and then outputs an initial ciphertext C
T
I
B
B
E.Type I Re-Encryption(5)IBE.ReKeyGen1(PK,ID,SK,ID′,C). The user takes as inputPK, his or her identityID and secret keySK, a user’s identityID′ and a conditionC, then outputs a re-encryption keyRK.(6)IBE.ReEnc1(PK,RK, C
T
I
B
E). The proxy server takes as inputPK, a re-encryption keyRK, and an initial ciphertext C
T
I
B
E and then outputs a re-encrypted ciphertext C
T
I
B
E
′.Type II Re-Encryption(7)IBE.ReKeyGen2(PK,ID,SK,U′,C). The user takes as inputPK, his or her identityID and secret keySK, a setU′ of users’ identities, and a conditionC and then outputs a re-encryption keyRK.(8)IBE.ReEnc2(PK,RK, C
T
I
B
E). The proxy server takes as inputPK, a re-encryption keyRK and an initial ciphertext C
T
I
B
E and then outputs a re-encrypted ciphertext C
T
I
B
B
E
′.Type III Re-Encryption(9)IBBE.ReKeyGen1(PK,ID,SK,U,ID′,C). The user takes as inputPK, his or her identityID and secret keySK, a setU of authorized users’ identities, an identityID′ of user and a conditionC, then outputs a re-encryption keyRK.(10)IBBE.ReEnc1(PK,ID,RK,U, C
T
I
B
B
E). The proxy server takes as inputPK, a user’s identityID and re-encryption keyRK, a setU of authorized users’ identities, and an initial ciphertext C
T
I
B
B
E and then outputs a re-encrypted ciphertext C
T
I
B
E
′.Type IV Re-Encryption(11)IBBE.ReKeyGen2(PK,ID,SK,U′,C). The user takes as inputPK, his or her identityIDand secret keySK, a setU′ of users’ identities, and a conditionC and then outputs a re-encryption keyRK.(12)IBBE.ReEnc2(PK,ID,RK,U, C
T
I
B
B
E). The proxy server takes as inputPK, a user’s identityID and re-encryption keyRK, a setU of authorized users’ identities, and an initial ciphertext C
T
I
B
B
E and then outputs a re-encrypted ciphertext C
T
I
B
B
E
′.(13)IBE.Dec1(PK,SK, C
T
I
B
E). The user takes as inputPK, a secret keySK, and initial ciphertext C
T
I
B
E and then outputs dataM.(14)IBE.Dec2(PK,SK, C
T
I
B
E
′). The user takes as inputPK, a secret keySK, and re-encrypted ciphertext C
T
I
B
E
′ and then outputs dataM.(15)IBBE.Dec1(PK,ID,SK,U, C
T
I
B
B
E).The user takes as inputPK, his or her identityID and secret keySK, a setU of authorized users’ identities, and initial ciphertext C
T
I
B
B
E and then outputs dataM.(16)IBBE.Dec2(PK,ID′,SK,U′, C
T
I
B
B
E
′). The user takes as inputPK, his or her identityID′ and secret keySK, a setU′ of authorized users’ identities, and re-encrypted ciphertext C
T
I
B
B
E
′ and then outputs dataM.


### 4.4. System Workflow

The system workflow is described as Figure2. In the system initialization phase, trust authority runsSetup algorithm to generate system public key and master secret key. Concurrently, it also usesKeyGen algorithm to generate secret keys for the users in the system. At first, data owner runsIBE.Enc orIBBE.Encalgorithm to encrypt data with its identity and a keyword as condition. Then data owner outsources the encrypted data to the CSP. The user, which can access the same CSP with the data owner, would send a request of accessing the ciphertext to the CSP. After receiving the request, the CSP will send the ciphertext to the user. If it is the intended user, it could runIBE.Dec1 orIBBE.Dec1 algorithm to decrypt the ciphertext with his or her secret key. Furthermore, an authorized user could run re-encryption key generation algorithm to generate the re-encryption key containing new identities and keyword condition and then upload it into the proxy server. The re-encryption key decides which users can have the ability to access the data by enforcing the new identities on it. With the re-encryption key, the proxy server would run re-encryption algorithm to transform the initial ciphertexts to the re-encrypted ciphertexts. When the user sends an access request to the CSP, the CSP would return the re-encrypted ciphertexts. The user can run theIBE.Dec2 orIBBE.Dec2 algorithm to decrypt the re-encrypted ciphertexts.Figure 2
System workflow of our scheme.


## 4.1. System Model

Our scheme applies IBC and PRE techniques to accomplish secure cross-cloud data collaboration. As shown in Figure1, the system model of our scheme consists of trust authority, cloud service provider (CSP), proxy server, data owner, and user.Figure 1
System model of our scheme.(1) Trust authority. The trust authority is a fully trusted party that generates system parameters to initialize the system. It also generates secret keys with users’ identity.(2) CSP. The CSP is a semitrusted party which offers data storage service and enables the authorized users to access ciphertexts stored on it.(3) Proxy server. The proxy server provides data transfer service based on web APIs between CSPs. Moreover, it is in charge of generating re-encrypted ciphertext to achieve cross-cloud data collaboration among multiple users.(4) Data owner. The data owners encrypt data with IBE or IBBE algorithm and then upload ciphertext to the CSP. When sharing data stored in one CSP with the user who cannot access directly, the data owners send the re-encryption key to the proxy server which transforms the ciphertext into a re-encrypted ciphertext that can be accessed by user.(5) User. The user can decrypt the ciphertext stored in the cloud with his or her secret key. Simultaneously, the users can also decrypt the data owners’ re-encrypted ciphertext with their secret keys, which achieves data collaboration between two CSPs.


## 4.2. Security Requirements

We assume the trust authority to be a trusted party which will not collude with unauthorized users. However, we assume the CSP and proxy server are honest but curious, which means they may collude to get unauthorized data. Specifically, the security requirements cover the following aspects.(1) Data confidentiality. The unauthorized users who are not the intended receivers defined by data owner should be prevented from accessing the data; unauthorized access from the semitrusted CSP should also be prevented.(2) Re-encryption secrecy. The re-encryption keys with unauthorized data users should be prevented from transforming the ciphertexts successfully.


## 4.3. System Definitions

Our ACPRE protocol includes the following four types of ciphertext collaboration.Type I Individual-to-Individual Re-Encryption.The initial ciphertext associated with one authorized user is transformed to a re-encrypted ciphertext of one user by proxy server.Type II Individual-to-Group Re-Encryption.The initial ciphertext associated with one authorized user is transformed to a re-encrypted ciphertext of a set of users by proxy server.Type III Group-to-Individual Re-Encryption.The initial ciphertext associated with a set of authorized users is transformed to a re-encrypted ciphertext of one user by proxy server.Type IV Group-to-Group Re-Encryption.The initial ciphertext associated with a set of authorized users is transformed to a re-encrypted ciphertext of a set of users by proxy server.To implement the above protocol, we define our scheme with the following algorithms.(1)Setup(1
λ,N). The trust authority takes as input a security parameter λ and the maximal size of receiver setN and outputs a system public keyPK and a master secret keyMK.(2)KeyGen(PK,MK,ID). The trust authority takes as inputPK andMK and an identityID, and outputs the secret keySK.(3)IBE.Enc(PK,M,ID,C). The CSP takes as inputPK, dataM, an identityID, and a conditionC and then outputs an initial ciphertext C
T
I
B
E.(4)IBBE.Enc(PK,M,U,C). The CSP takes as inputPK, dataM, a setU of identities, and a conditionC and then outputs an initial ciphertext C
T
I
B
B
E.Type I Re-Encryption(5)IBE.ReKeyGen1(PK,ID,SK,ID′,C). The user takes as inputPK, his or her identityID and secret keySK, a user’s identityID′ and a conditionC, then outputs a re-encryption keyRK.(6)IBE.ReEnc1(PK,RK, C
T
I
B
E). The proxy server takes as inputPK, a re-encryption keyRK, and an initial ciphertext C
T
I
B
E and then outputs a re-encrypted ciphertext C
T
I
B
E
′.Type II Re-Encryption(7)IBE.ReKeyGen2(PK,ID,SK,U′,C). The user takes as inputPK, his or her identityID and secret keySK, a setU′ of users’ identities, and a conditionC and then outputs a re-encryption keyRK.(8)IBE.ReEnc2(PK,RK, C
T
I
B
E). The proxy server takes as inputPK, a re-encryption keyRK and an initial ciphertext C
T
I
B
E and then outputs a re-encrypted ciphertext C
T
I
B
B
E
′.Type III Re-Encryption(9)IBBE.ReKeyGen1(PK,ID,SK,U,ID′,C). The user takes as inputPK, his or her identityID and secret keySK, a setU of authorized users’ identities, an identityID′ of user and a conditionC, then outputs a re-encryption keyRK.(10)IBBE.ReEnc1(PK,ID,RK,U, C
T
I
B
B
E). The proxy server takes as inputPK, a user’s identityID and re-encryption keyRK, a setU of authorized users’ identities, and an initial ciphertext C
T
I
B
B
E and then outputs a re-encrypted ciphertext C
T
I
B
E
′.Type IV Re-Encryption(11)IBBE.ReKeyGen2(PK,ID,SK,U′,C). The user takes as inputPK, his or her identityIDand secret keySK, a setU′ of users’ identities, and a conditionC and then outputs a re-encryption keyRK.(12)IBBE.ReEnc2(PK,ID,RK,U, C
T
I
B
B
E). The proxy server takes as inputPK, a user’s identityID and re-encryption keyRK, a setU of authorized users’ identities, and an initial ciphertext C
T
I
B
B
E and then outputs a re-encrypted ciphertext C
T
I
B
B
E
′.(13)IBE.Dec1(PK,SK, C
T
I
B
E). The user takes as inputPK, a secret keySK, and initial ciphertext C
T
I
B
E and then outputs dataM.(14)IBE.Dec2(PK,SK, C
T
I
B
E
′). The user takes as inputPK, a secret keySK, and re-encrypted ciphertext C
T
I
B
E
′ and then outputs dataM.(15)IBBE.Dec1(PK,ID,SK,U, C
T
I
B
B
E).The user takes as inputPK, his or her identityID and secret keySK, a setU of authorized users’ identities, and initial ciphertext C
T
I
B
B
E and then outputs dataM.(16)IBBE.Dec2(PK,ID′,SK,U′, C
T
I
B
B
E
′). The user takes as inputPK, his or her identityID′ and secret keySK, a setU′ of authorized users’ identities, and re-encrypted ciphertext C
T
I
B
B
E
′ and then outputs dataM.


## 4.4. System Workflow

The system workflow is described as Figure2. In the system initialization phase, trust authority runsSetup algorithm to generate system public key and master secret key. Concurrently, it also usesKeyGen algorithm to generate secret keys for the users in the system. At first, data owner runsIBE.Enc orIBBE.Encalgorithm to encrypt data with its identity and a keyword as condition. Then data owner outsources the encrypted data to the CSP. The user, which can access the same CSP with the data owner, would send a request of accessing the ciphertext to the CSP. After receiving the request, the CSP will send the ciphertext to the user. If it is the intended user, it could runIBE.Dec1 orIBBE.Dec1 algorithm to decrypt the ciphertext with his or her secret key. Furthermore, an authorized user could run re-encryption key generation algorithm to generate the re-encryption key containing new identities and keyword condition and then upload it into the proxy server. The re-encryption key decides which users can have the ability to access the data by enforcing the new identities on it. With the re-encryption key, the proxy server would run re-encryption algorithm to transform the initial ciphertexts to the re-encrypted ciphertexts. When the user sends an access request to the CSP, the CSP would return the re-encrypted ciphertexts. The user can run theIBE.Dec2 orIBBE.Dec2 algorithm to decrypt the re-encrypted ciphertexts.Figure 2
System workflow of our scheme.


## 5. Construction

### 5.1. System Setup

The trust authority first runsSetup algorithm to select a bilinear map e
:
G
0
×
G
0
→
G
T, where G
0 and G
T are two multiplicative groups with prime orderp. Then the trust authority chooses a maximum number of receiversN, chooses g
,
h
,
u
∈
G
0, γ
∈
Z
p randomly, cryptographic hash functions H
1
:
{
0,1
}
∗
→
Z
p
∗, H
2
:
{
0,1
}
∗
→
G
0 and H
3
:
G
T
→
G
0, and finally outputs a system public key P
K
=
(
g
γ
,
e
(
g
,
h
), e
(
g
,
h
)
γ
,
h
,
h
γ
,
.
.
.
,
h
γ
N
,
u
,
u
γ
,
.
.
.
,
u
γ
N
,
t
,
t
γ
,
.
.
.
,
t
γ
N
) and a master secret key M
K
=
(
g
,
γ
).


### 5.2. Key Generation

For each user with identityID, the trust authority runsKeyGen algorithm to generate the secret keySK =
g
1
/
(
γ
+
H
1
(
I
D
)
).


### 5.3. Data Encryption

The data owner encrypts dataM with a set of identities, and then outsources the result to the CSP. First, the data owner chooses a randomDK and encryptsM based on symmetric encryption algorithmSE, that isC
0 = S
E
D
K
(
M
).(1) If the data owner chooses to share data with a single user, then he runsIBE.Enc algorithm to pick k
∈
Z
p, and compute the following with a condition α
∈
Z
p.(1)
C
T
I
B
E
=
C
0
,
C
1
=
D
K
·
e
g
,
h
k
,
C
2
=
h
k
·
γ
+
H
1
I
D
,
C
3
=
u
t
α
k
·
γ
+
H
1
I
D
/
H
1
I
D
,
C
4
=
u
t
α
-
k(2) If the data owner chooses to share data with a group of users, then he runsIBBE.Enc algorithm to pick k
∈
Z
p, and choose a setU of users’ identities, and compute the following with a condition α
∈
Z
p.(2)
C
T
I
B
B
E
=
C
0
,
C
1
=
D
K
·
e
g
,
h
k
,
C
2
=
h
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
,
C
3
=
u
t
α
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
4
=
g
-
γ
k
,
C
5
=
u
t
α
-
k


### 5.4. Data Re-Encryption

Suppose a user with identityID needs to collaborate with other users, he can generate a re-encryption key and send it to the CSP for ciphertext re-encryption according to the chosen collaboration type.Type I Re-EncryptionIBE.ReKeyGen1: The user chooses a single user with identity I
D
′ and picks a random s
∈
Z
p and computes the following re-encryption keyRK with a condition α
∈
Z
p.(3)
R
1
=
S
K
·
u
t
α
k
′
·
u
s
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
k
′
·
u
s
,
R
2
=
h
k
′
·
γ
+
H
1
I
D
,
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sIBE.ReEnc1: The CSP takesRK as input and first computes(4)
C
1
′
=
C
1
e
C
4
,
R
2
·
e
R
1
,
C
2
=
D
K
·
e
u
s
,
h
-
k
γ
+
H
1
I
DThen the CSP generates the re-encrypted ciphertext.(5)
C
T
I
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
s
,
h
-
k
γ
+
H
1
I
D
,
C
2
′
=
C
2
=
h
k
·
γ
+
H
1
I
D
,
C
3
′
=
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sType II Re-EncryptionIBE.ReKeyGen2: The user chooses a set U
′ of users’ identities and picks a random s
∈
Z
p and then computes the following re-encryption keyRK with a condition α
∈
Z
p.(6)
R
1
=
S
K
·
u
t
α
s
/
H
1
I
D
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
s
/
H
1
I
D
,
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
R
3
=
H
3
e
g
,
h
k
′
·
h
s
,
R
4
=
g
-
γ
k
′IBE.ReEnc2: The CSP takesRK as input and first computes(7)
C
1
′
=
C
1
e
R
1
,
C
2
=
D
K
·
e
u
t
α
-
s
,
h
k
γ
+
H
1
I
D
/
H
1
I
DThen the CSP generates the re-encrypted ciphertext.(8)
C
T
I
B
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
t
α
-
s
,
h
k
γ
+
H
1
I
D
/
H
1
I
D
,
C
2
′
=
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
C
3
′
=
C
3
=
u
t
α
k
·
γ
+
H
1
I
D
/
H
1
I
D
,
C
4
′
=
R
4
=
g
-
γ
k
′
,
C
5
′
=
R
3
=
H
3
e
g
,
h
k
′
·
h
sType III Re-EncryptionIBBE.ReKeyGen1: The user chooses a single user with identity I
D
′ and picks a random s
∈
Z
p and then computes the following re-encryption keyRK with a condition α
∈
Z
p.(9)
R
1
=
S
K
·
u
t
α
k
′
·
u
s
/
H
1
I
D
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
k
′
·
u
s
/
H
1
I
D
,
R
2
=
h
k
′
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
,
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sIBBE.ReEnc1: The CSP takesRK as input and first computes(10)
C
1
′
=
C
1
·
e
C
4
,
h
Δ
γ
I
D
,
U
·
e
R
1
,
C
2
·
e
C
5
,
R
2
-
1
/
∏
I
I
D
i
∈
U
∧
I
D
i
≠
I
D
H
1
I
D
i
=
D
K
·
e
u
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
iThen the CSP generates the re-encrypted ciphertext.(11)
C
T
I
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
2
′
=
C
2
1
/
∏
I
D
i
∈
U
H
1
I
D
i
=
h
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
3
′
=
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sType IV Re-EncryptionIBBE.ReKeyGen2: The user chooses a set U
′ of users’ identities and picks a random s
∈
Z
p and then computes the following re-encryption keyRK with a condition α
∈
Z
p.(12)
R
1
=
S
K
·
u
t
α
s
/
H
1
I
D
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
s
/
H
1
I
D
,
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
R
3
=
H
3
e
g
,
h
k
′
·
h
s
,
R
4
=
g
-
γ
k
′IBBE.ReEnc2: The CSP takesRK as input and first computes(13)
C
1
′
=
C
1
·
e
C
4
,
h
Δ
γ
I
D
,
U
·
e
R
1
,
C
2
-
1
/
∏
I
D
i
∈
U
∧
I
D
i
≠
I
D
H
1
I
D
i
=
D
K
·
e
u
t
α
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
iThen the CSP generates the re-encrypted ciphertext.(14)
C
T
I
B
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
t
α
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
2
′
=
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
C
3
′
=
C
3
=
u
t
α
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
4
′
=
R
4
=
g
-
γ
k
′
,
C
5
′
=
R
3
=
H
3
e
g
,
h
k
′
·
h
s


### 5.5. Data Decryption

(1) If the ciphertext is an initial ciphertextC
T
I
B
E generated byIBE.Enc algorithm, the user with identity I
D
′ runsIBE.Dec1 algorithm to compute the following and generates D
K
=
C
1
/
K.(15)
K
=
e
S
K
,
C
2
=
e
g
1
/
γ
+
H
1
I
D
,
h
k
·
γ
+
H
1
I
D
=
e
g
,
h
k(2) If the ciphertext is a Type I or Type III re-encrypted ciphertextC
T
I
B
E
′, the user with identity I
D
′ runsIBE.Dec2 algorithm to compute the following.(16)
s
=
I
B
E
.
D
e
c
S
K
I
D
′
,
C
3
′Then the user generates D
K
=
C
1
′
·
e
(
u
s
,
C
2
′
).(3) If the ciphertext is an initial ciphertextC
T
I
B
B
E generated byIBBE.Enc algorithm, the user with identity I
D
′ runsIBBE.Dec1 algorithm to compute the following if I
D
′
∈
U.(17)
K
=
e
C
4
,
h
Δ
γ
I
D
,
U
·
e
S
K
,
C
2
1
/
∏
I
D
i
∈
U
∧
I
D
i
≠
I
D
H
1
I
D
i
=
e
g
,
h
kThen the user generatesD
K
=
C
1
/
K.(4) If the ciphertext is a Type II or Type IV re-encrypted ciphertextC
T
I
B
B
E
′, the user with identity I
D
′ runsIBBE.Dec2 algorithm to compute the following if I
D
′
∈
U.(18)
K
′
=
e
C
4
′
,
h
Δ
γ
I
D
′
,
U
′
·
e
S
K
′
,
C
2
′
1
/
∏
I
D
i
∈
U
′
∧
I
D
i
≠
I
D
′
H
1
I
D
i
=
e
g
,
h
k
′Then the user computesh
s.(19)
Z
=
C
5
′
H
3
K
′
=
H
3
e
g
,
h
k
′
·
h
s
H
3
e
g
,
h
k
′
=
h
sFinally, the user generatesD
K
=
C
1
′
·
e
(
Z
,
C
3
′
).


## 5.1. System Setup

The trust authority first runsSetup algorithm to select a bilinear map e
:
G
0
×
G
0
→
G
T, where G
0 and G
T are two multiplicative groups with prime orderp. Then the trust authority chooses a maximum number of receiversN, chooses g
,
h
,
u
∈
G
0, γ
∈
Z
p randomly, cryptographic hash functions H
1
:
{
0,1
}
∗
→
Z
p
∗, H
2
:
{
0,1
}
∗
→
G
0 and H
3
:
G
T
→
G
0, and finally outputs a system public key P
K
=
(
g
γ
,
e
(
g
,
h
), e
(
g
,
h
)
γ
,
h
,
h
γ
,
.
.
.
,
h
γ
N
,
u
,
u
γ
,
.
.
.
,
u
γ
N
,
t
,
t
γ
,
.
.
.
,
t
γ
N
) and a master secret key M
K
=
(
g
,
γ
).


## 5.2. Key Generation

For each user with identityID, the trust authority runsKeyGen algorithm to generate the secret keySK =
g
1
/
(
γ
+
H
1
(
I
D
)
).


## 5.3. Data Encryption

The data owner encrypts dataM with a set of identities, and then outsources the result to the CSP. First, the data owner chooses a randomDK and encryptsM based on symmetric encryption algorithmSE, that isC
0 = S
E
D
K
(
M
).(1) If the data owner chooses to share data with a single user, then he runsIBE.Enc algorithm to pick k
∈
Z
p, and compute the following with a condition α
∈
Z
p.(1)
C
T
I
B
E
=
C
0
,
C
1
=
D
K
·
e
g
,
h
k
,
C
2
=
h
k
·
γ
+
H
1
I
D
,
C
3
=
u
t
α
k
·
γ
+
H
1
I
D
/
H
1
I
D
,
C
4
=
u
t
α
-
k(2) If the data owner chooses to share data with a group of users, then he runsIBBE.Enc algorithm to pick k
∈
Z
p, and choose a setU of users’ identities, and compute the following with a condition α
∈
Z
p.(2)
C
T
I
B
B
E
=
C
0
,
C
1
=
D
K
·
e
g
,
h
k
,
C
2
=
h
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
,
C
3
=
u
t
α
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
4
=
g
-
γ
k
,
C
5
=
u
t
α
-
k


## 5.4. Data Re-Encryption

Suppose a user with identityID needs to collaborate with other users, he can generate a re-encryption key and send it to the CSP for ciphertext re-encryption according to the chosen collaboration type.Type I Re-EncryptionIBE.ReKeyGen1: The user chooses a single user with identity I
D
′ and picks a random s
∈
Z
p and computes the following re-encryption keyRK with a condition α
∈
Z
p.(3)
R
1
=
S
K
·
u
t
α
k
′
·
u
s
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
k
′
·
u
s
,
R
2
=
h
k
′
·
γ
+
H
1
I
D
,
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sIBE.ReEnc1: The CSP takesRK as input and first computes(4)
C
1
′
=
C
1
e
C
4
,
R
2
·
e
R
1
,
C
2
=
D
K
·
e
u
s
,
h
-
k
γ
+
H
1
I
DThen the CSP generates the re-encrypted ciphertext.(5)
C
T
I
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
s
,
h
-
k
γ
+
H
1
I
D
,
C
2
′
=
C
2
=
h
k
·
γ
+
H
1
I
D
,
C
3
′
=
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sType II Re-EncryptionIBE.ReKeyGen2: The user chooses a set U
′ of users’ identities and picks a random s
∈
Z
p and then computes the following re-encryption keyRK with a condition α
∈
Z
p.(6)
R
1
=
S
K
·
u
t
α
s
/
H
1
I
D
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
s
/
H
1
I
D
,
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
R
3
=
H
3
e
g
,
h
k
′
·
h
s
,
R
4
=
g
-
γ
k
′IBE.ReEnc2: The CSP takesRK as input and first computes(7)
C
1
′
=
C
1
e
R
1
,
C
2
=
D
K
·
e
u
t
α
-
s
,
h
k
γ
+
H
1
I
D
/
H
1
I
DThen the CSP generates the re-encrypted ciphertext.(8)
C
T
I
B
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
t
α
-
s
,
h
k
γ
+
H
1
I
D
/
H
1
I
D
,
C
2
′
=
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
C
3
′
=
C
3
=
u
t
α
k
·
γ
+
H
1
I
D
/
H
1
I
D
,
C
4
′
=
R
4
=
g
-
γ
k
′
,
C
5
′
=
R
3
=
H
3
e
g
,
h
k
′
·
h
sType III Re-EncryptionIBBE.ReKeyGen1: The user chooses a single user with identity I
D
′ and picks a random s
∈
Z
p and then computes the following re-encryption keyRK with a condition α
∈
Z
p.(9)
R
1
=
S
K
·
u
t
α
k
′
·
u
s
/
H
1
I
D
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
k
′
·
u
s
/
H
1
I
D
,
R
2
=
h
k
′
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
,
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sIBBE.ReEnc1: The CSP takesRK as input and first computes(10)
C
1
′
=
C
1
·
e
C
4
,
h
Δ
γ
I
D
,
U
·
e
R
1
,
C
2
·
e
C
5
,
R
2
-
1
/
∏
I
I
D
i
∈
U
∧
I
D
i
≠
I
D
H
1
I
D
i
=
D
K
·
e
u
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
iThen the CSP generates the re-encrypted ciphertext.(11)
C
T
I
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
2
′
=
C
2
1
/
∏
I
D
i
∈
U
H
1
I
D
i
=
h
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
3
′
=
R
3
=
I
B
E
.
E
n
c
I
D
′
,
sType IV Re-EncryptionIBBE.ReKeyGen2: The user chooses a set U
′ of users’ identities and picks a random s
∈
Z
p and then computes the following re-encryption keyRK with a condition α
∈
Z
p.(12)
R
1
=
S
K
·
u
t
α
s
/
H
1
I
D
=
g
1
/
γ
+
H
1
I
D
·
u
t
α
s
/
H
1
I
D
,
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
R
3
=
H
3
e
g
,
h
k
′
·
h
s
,
R
4
=
g
-
γ
k
′IBBE.ReEnc2: The CSP takesRK as input and first computes(13)
C
1
′
=
C
1
·
e
C
4
,
h
Δ
γ
I
D
,
U
·
e
R
1
,
C
2
-
1
/
∏
I
D
i
∈
U
∧
I
D
i
≠
I
D
H
1
I
D
i
=
D
K
·
e
u
t
α
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
iThen the CSP generates the re-encrypted ciphertext.(14)
C
T
I
B
B
E
′
=
C
0
′
=
C
0
,
C
1
′
=
D
K
·
e
u
t
α
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
2
′
=
R
2
=
h
k
′
·
∏
I
D
i
∈
U
′
γ
+
H
1
I
D
i
,
C
3
′
=
C
3
=
u
t
α
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
,
C
4
′
=
R
4
=
g
-
γ
k
′
,
C
5
′
=
R
3
=
H
3
e
g
,
h
k
′
·
h
s


## 5.5. Data Decryption

(1) If the ciphertext is an initial ciphertextC
T
I
B
E generated byIBE.Enc algorithm, the user with identity I
D
′ runsIBE.Dec1 algorithm to compute the following and generates D
K
=
C
1
/
K.(15)
K
=
e
S
K
,
C
2
=
e
g
1
/
γ
+
H
1
I
D
,
h
k
·
γ
+
H
1
I
D
=
e
g
,
h
k(2) If the ciphertext is a Type I or Type III re-encrypted ciphertextC
T
I
B
E
′, the user with identity I
D
′ runsIBE.Dec2 algorithm to compute the following.(16)
s
=
I
B
E
.
D
e
c
S
K
I
D
′
,
C
3
′Then the user generates D
K
=
C
1
′
·
e
(
u
s
,
C
2
′
).(3) If the ciphertext is an initial ciphertextC
T
I
B
B
E generated byIBBE.Enc algorithm, the user with identity I
D
′ runsIBBE.Dec1 algorithm to compute the following if I
D
′
∈
U.(17)
K
=
e
C
4
,
h
Δ
γ
I
D
,
U
·
e
S
K
,
C
2
1
/
∏
I
D
i
∈
U
∧
I
D
i
≠
I
D
H
1
I
D
i
=
e
g
,
h
kThen the user generatesD
K
=
C
1
/
K.(4) If the ciphertext is a Type II or Type IV re-encrypted ciphertextC
T
I
B
B
E
′, the user with identity I
D
′ runsIBBE.Dec2 algorithm to compute the following if I
D
′
∈
U.(18)
K
′
=
e
C
4
′
,
h
Δ
γ
I
D
′
,
U
′
·
e
S
K
′
,
C
2
′
1
/
∏
I
D
i
∈
U
′
∧
I
D
i
≠
I
D
′
H
1
I
D
i
=
e
g
,
h
k
′Then the user computesh
s.(19)
Z
=
C
5
′
H
3
K
′
=
H
3
e
g
,
h
k
′
·
h
s
H
3
e
g
,
h
k
′
=
h
sFinally, the user generatesD
K
=
C
1
′
·
e
(
Z
,
C
3
′
).


## 6. Security Analysis

### 6.1. Correctness

The authorized user can generateDK from the re-encrypted ciphertext C
T
′ according to the collaboration type.(1) IfC
T
′ is a Type I re-encrypted ciphertext C
T
I
B
E, it computes(20)
D
K
=
C
1
′
·
e
u
s
,
C
2
′
=
D
K
·
e
u
s
,
h
-
k
γ
+
H
1
I
D
·
e
u
s
,
h
k
·
γ
+
H
1
I
D(2) IfC
T
′ is a Type III re-encrypted ciphertext C
T
I
B
E
′, it computes(21)
D
K
=
C
1
′
·
e
u
s
,
C
2
′
=
D
K
·
e
u
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
·
e
u
s
,
h
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i(3) IfC
T
′ is a Type II re-encrypted ciphertext C
T
I
B
B
E, it computes(22)
D
K
=
C
1
′
·
e
Z
,
C
3
′
=
D
K
·
e
u
t
α
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
·
e
h
s
,
u
t
α
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i(4) IfC
T
′ is a Type IV re-encrypted ciphertext C
T
I
B
B
E
′, it computes(23)
D
K
=
C
1
′
·
e
Z
,
C
3
′
=
D
K
·
e
u
t
α
-
s
,
h
k
γ
+
H
1
I
D
/
H
1
I
D
·
e
h
s
,
u
t
α
k
·
γ
+
H
1
I
D
/
H
1
I
D


### 6.2. Scheme Security

The shared data in our scheme is encrypted with IBE and IBBE techniques, which are secure against chosen plaintext attack (CPA) since the decisional bilinear Diffie–Hellman (DBDH) assumption holds [25]. Our scheme is CPA secure in the random oracle model with the game among adversary A and challenger C.Proof.
The adversaryA chooses a set U
∗ of challenge identities. The challenger C randomly runs theSetup algorithm to generate a system public keyPK and a master secret keyMK, and models the hash functionsH
1,H
2 andH
3 as three random oracles. The adversary A can issue hash query, key generation query, and re-encryption key generation query to challenger C. In the challenge phase, the adversary sends two challenge messagesm
0 andm
1 to challenger C, then the challenger C runs encryption algorithm to generate the challenge ciphertext C
T
∗, whereb is chosen randomly in {
0,1
}. Finally, the challenger C sends the challenge ciphertext C
T
∗ to adversary A. In the guess phase, the adversary A outputs a guess b
′
∈
{
0,1
}. As proved in [8], we can find that if the adversary A successfully breaks our scheme, except it can break the CPA security of the IBE and IBBE scheme, or can solve the DBDH problem in re-encryption key generation query.
Specially, the data is encrypted with a random symmetric keyDK, and thenDK is protected by IBE or IBBE technique. Since the symmetric encryption and IBC scheme are secure, the confidentiality of outsourced data can be guaranteed against unauthorized users whose identities are not in the set of receivers’ identities. Moreover, the re-encryption requests from unauthorized users who are not included in the identity set or do not own the same condition will not be executed successfully, and the CSP cannot get any useful information about theDK from the ciphertext and re-encryption key.


## 6.1. Correctness

The authorized user can generateDK from the re-encrypted ciphertext C
T
′ according to the collaboration type.(1) IfC
T
′ is a Type I re-encrypted ciphertext C
T
I
B
E, it computes(20)
D
K
=
C
1
′
·
e
u
s
,
C
2
′
=
D
K
·
e
u
s
,
h
-
k
γ
+
H
1
I
D
·
e
u
s
,
h
k
·
γ
+
H
1
I
D(2) IfC
T
′ is a Type III re-encrypted ciphertext C
T
I
B
E
′, it computes(21)
D
K
=
C
1
′
·
e
u
s
,
C
2
′
=
D
K
·
e
u
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
·
e
u
s
,
h
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i(3) IfC
T
′ is a Type II re-encrypted ciphertext C
T
I
B
B
E, it computes(22)
D
K
=
C
1
′
·
e
Z
,
C
3
′
=
D
K
·
e
u
t
α
s
,
h
-
k
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i
·
e
h
s
,
u
t
α
k
·
∏
I
D
i
∈
U
γ
+
H
1
I
D
i
/
H
1
I
D
i(4) IfC
T
′ is a Type IV re-encrypted ciphertext C
T
I
B
B
E
′, it computes(23)
D
K
=
C
1
′
·
e
Z
,
C
3
′
=
D
K
·
e
u
t
α
-
s
,
h
k
γ
+
H
1
I
D
/
H
1
I
D
·
e
h
s
,
u
t
α
k
·
γ
+
H
1
I
D
/
H
1
I
D


## 6.2. Scheme Security

The shared data in our scheme is encrypted with IBE and IBBE techniques, which are secure against chosen plaintext attack (CPA) since the decisional bilinear Diffie–Hellman (DBDH) assumption holds [25]. Our scheme is CPA secure in the random oracle model with the game among adversary A and challenger C.Proof.
The adversaryA chooses a set U
∗ of challenge identities. The challenger C randomly runs theSetup algorithm to generate a system public keyPK and a master secret keyMK, and models the hash functionsH
1,H
2 andH
3 as three random oracles. The adversary A can issue hash query, key generation query, and re-encryption key generation query to challenger C. In the challenge phase, the adversary sends two challenge messagesm
0 andm
1 to challenger C, then the challenger C runs encryption algorithm to generate the challenge ciphertext C
T
∗, whereb is chosen randomly in {
0,1
}. Finally, the challenger C sends the challenge ciphertext C
T
∗ to adversary A. In the guess phase, the adversary A outputs a guess b
′
∈
{
0,1
}. As proved in [8], we can find that if the adversary A successfully breaks our scheme, except it can break the CPA security of the IBE and IBBE scheme, or can solve the DBDH problem in re-encryption key generation query.
Specially, the data is encrypted with a random symmetric keyDK, and thenDK is protected by IBE or IBBE technique. Since the symmetric encryption and IBC scheme are secure, the confidentiality of outsourced data can be guaranteed against unauthorized users whose identities are not in the set of receivers’ identities. Moreover, the re-encryption requests from unauthorized users who are not included in the identity set or do not own the same condition will not be executed successfully, and the CSP cannot get any useful information about theDK from the ciphertext and re-encryption key.


## 7. Performance Analysis

We analyze the performance efficiency of data encryption, re-encryption and decryption by comparing our scheme with several secure data collaboration schemes. The result is shown in Table1. LetT
pair be the computation cost of a single pairing,T
exp be the computation cost of an exponent operation, andN
u be the total number of users. We ignore simple multiplication, hash, and symmetric encryption and decryption operations.Table 1
Comparison of computation in secure data collaboration.
Schemes
Enc
ReEnc
Dec-1
Dec-2
IBBPRE [6]
T
pair+(N
u+5)T
exp
(3N
u+3)T
exp
2T
pair
+N
u
T
exp
3T
pair+T
exp
IBCPRE [7]
T
pair+4T
exp
2T
pair
T
pair
2T
pair
IBBCPBRE [8]
(3N
u+8)T
exp
2T
pair
+N
u
T
exp
2T
pair+N
u
T
exp
3T
pair+N
u
T
exp
Our scheme
IBE
9T
exp
Type-I
2T
pair
T
pair
2T
pair
Type-II
T
pair
IBBE
(3N
u+10)T
exp
Type-III
3T
pair+(N
u+1)T
exp
2T
pair+N
u
T
exp
3T
pair+N
u
T
exp
Type-IV
2T
pair+N
u
T
expFirst, we discuss the computation cost of data encryption. The encryption process can be divided into two types: IBBE encryption and IBE encryption. IBBPRE [6], IBBCPBRE [8] andIBBE.Enc algorithm in our scheme belong to the former, and their computation costs areT
pair+(N
u+5)T
exp, (3N
u+8)T
exp, (3N
u+10)T
exp, respectively, which grow linearly with the number of users. In addition, theIBE.Enc algorithm in our scheme cost 9T
expto encrypt the data, which is constant and the same as IBCPRE [7], and also less than these compared schemes. However, compared with other three schemes, we can see that encryption algorithms of our scheme cost a little more time since initial ciphertext will be transformed into two types of re-encrypted ciphertext in subsequent operation, while other schemes will be converted into only one type of re-encrypted ciphertext.In the re-encryption phase, IBBPRE [6], IBCPRE [7], and IBBCPBRE [8] correspond to Type III, Type I, and Type IV of our scheme. The computation cost of IBBPRE [6] is more than Type III in our scheme and the other two schemes are the same as Type I and Type IV in our scheme. It should be noted that these re-encryption computations are performed by cloud server or proxy server.Further, in the initial ciphertext decryption phase, IBBPRE [6], IBBCPBRE [8] andIBBE.Dec1 algorithm in our scheme all decrypt ciphertext for sharing data with a group, so their decryption computation costs are the same as 2T
pair+N
u
T
exp, which are related to the number of users. IBCPRE [7] andIBE.Dec1 algorithm in our scheme decrypt the ciphertext which is encrypted to an individual, and they only need to perform one pairing operation to decrypt. In the re-encrypted ciphertext decryption phase, IBBCPBRE [8] andIBBE.Dec2 algorithm in our scheme both cost 3T
pair+N
u
T
exp to decrypt the ciphertext, which also increase linearly with the number of users.


## 8. Experimental Evaluations

We conduct experiments on a Windows system with an Intel Core i7-6700 CPU with 3.4 GHz processor and 8 GB memory. The experimental prototype is written in Java language with Java pairing-based cryptography (jpbc) library [26]. We accomplish several relative schemes including IBBPRE [6], IBCPRE [7] and IBBCPBRE [8] in the same experimental environment, and use a pairing type A 160-bit elliptic curve group based on the super-singular curve over a 512-bit finite field.We analyze the computation cost of the data encryption by comparing our scheme with IBBPRE [6], IBCPRE [7] and IBBCPBRE [8]. In the data encryption phase, the data owner in these schemes encrypts a file with IBE algorithm or IBBE algorithm and then posts the encrypted file to the CSP. Figure 3 shows the computation cost on data owners during this phase. In the re-encryption key generation phase, we give the computation cost of IBE re-encryption key generation and IBBE re-encryption key generation respectively, and the results are shown in Figures 4 and 5. Figure 4 shows the computation cost on users for IBE re-encryption key generation versus the number of users in the ciphertext. The computation cost in IBCPRE [7], IBBPRE [6] and Type I re-encryption in our scheme is almost constant, while the result in Type III re-encryption in our scheme grows linearly with the number of users. The reason is that the former executes re-encryption algorithm for individual and the latter executes for group. Figure 5 focuses on the computation cost of IBBE re-encrypted key generation. We can see that the re-encryption key generation time of IBBCPBRE [8], Type II and Type IV of our scheme is almost the same, which increase mainly with the number of users. The experimental result of re-encryption phase is depicted in Figure 6, which shows the computational time of re-encryption on the proxy server versus the number of receivers associated with initial ciphertext in the CSP. Obviously, IBBCPBRE [8], Type III and Type IV re-encryption in our scheme vary linearly with the number of receivers, and IBCPRE [7], Type I and Type II re-encryption in our scheme remain constant. Moreover, the computation cost of IBBPRE [6] in this phase is much more than other schemes.Figure 3
Computation cost of data encryption.Figure 4
Computation cost of IBE re-encryption key generation.Figure 5
Computation cost of IBBE re-encryption key generation.Figure 6
Computation cost of data re-encryption.Furthermore, we evaluate the computation cost from three aspects in data decryption phase, and the results are shown in Figures7, 8, and 9, respectively. Figure 7 reveals the computation cost on user side when decrypting IBBE initial ciphertext and re-encrypted ciphertext of IBE. Compared with IBBPRE [6], it is obviously that the computation cost of decrypting the initial ciphertext of IBBPRE [6] grows at faster pace than our scheme, while the time of decrypting re-encrypted ciphertext of IBBPRE [6] and our scheme is almost constant. The fact is that IBBPRE [6] takes about 49 ms that is higher than 20 ms in our scheme. The computation cost on IBPRE [19] and our scheme are shown in Figure 8. The computation time of decrypting initial ciphertext and re-encrypted ciphertext in IBPRE [19] is 30 ms and 27 ms, and the result in our scheme is 20 ms and 5 ms. The computation cost of IBPRE [19] is evidently more than that of our scheme since decryption algorithm in the former needs more pairing operation. Figure 9 indicates the computation cost ofIBBE.Dec2 algorithm in our scheme and re-encrypted ciphertext decryption in IBBCPBRE [8]. The experimental results show that our scheme is almost identical with IBBCPBRE [8].Figure 7
Computation cost of decryption in Type III.Figure 8
Computation cost of decryption in Type I.Figure 9
Computation cost of decrypting IBBE re-encrypted ciphertext.


## 9. Conclusion

Recent years, data collaboration between different clouds becomes increasingly popular. In this paper, we propose an adaptive secure cross-cloud data collaboration scheme with IBC and CPRE techniques. Firstly, we present a cross-cloud data collaboration framework which protects the confidentiality of data in the semitrusted CSPs with IBE or IBBE technique. The framework deploys a proxy server close to the clouds to transfer and re-encrypt the collaborated data. Secondly, we provide an ACPRE protocol, which not only addresses the issue of flexible ciphertext collaboration between CSPs, but also supports conditional data re-encryption. We further make comparisons with current schemes and conduct experiments with jpbc library. The results indicate that our cross-cloud data collaboration scheme is secure, efficient, and practical.



---

*Source: 8932325-2018-10-01.xml*