# A Lightweight Fine-Grained Search Scheme over Encrypted Data in Cloud-Assisted Wireless Body Area Networks

Authors: Mingsheng Cao; Luhan Wang; Zhiguang Qin; Chunwei Lou
Journal: Wireless Communications and Mobile Computing
 (2019)

---

## Abstract

The wireless body area networks (WBANs) have emerged as a highly promising technology that allows patients’ demographics to be collected by tiny wearable and implantable sensors. These data can be used to analyze and diagnose to improve the healthcare quality of patients. However, security and privacy preserving of the collected data is a major challenge on resource-limited WBANs devices and the urgent need for fine-grained search and lightweight access. To resolve these issues, in this paper, we propose a lightweight fine-grained search over encrypted data in WBANs by employing ciphertext policy attribute based encryption and searchable encryption technologies, of which the proposed scheme can provide resource-constraint end users with fine-grained keyword search and lightweight access simultaneously. We also formally define its security and prove that it is secure against both chosen plaintext attack and chosen keyword attack. Finally, we make a performance evaluation to demonstrate that our scheme is much more efficient and practical than the other related schemes, which makes the scheme more suitable for the real-world applications.


---

## Body

## 1. Introduction

With the rapid advancement of wireless communication technology and wearable medical sensors, medical area will be largely revolutionized by the emergence of wireless body area networks (WBANs) as a highly innovative technique [1, 2]. A typical WBAN consists of a controller and a number of wearable and implantable medical sensors. These sensors are exploited to place on human body for continuously monitoring physiological symptoms or collecting related body parameters. The aggregated data via wireless networks (like Bluetooth, Zigbee, Wifi, or GPRS) are finally transferred from one mobile terminal (such as a smart phone or a PAD) to cloud servers for remotely storing and accessing. With WBANs, two great benefits can be rendered for patients and healthcare providers. One hand is that medical patient’s conditions can be remotely diagnosed instead of being measured in the traditional face-to-face way. For another one, healthcare provider can access medical records remotely to provide medical treatment in real time. Although great potential in improving healthcare quality has been shown, security and privacy protection of data collected from WBANs remains to be a major concern [3, 4], which hampers the far-ranging application of WBANs since the data stored on servers are no longer out of physical control by data owners.To protect the data privacy, a frequently adopted method is to encrypt the medical data prior to transmitting them to servers; however, data encryption makes information retrieval over the encrypted data greatly difficult. In addition, a naive solution for data users is to download-then-decipher all the ciphertexts locally since it incurs too much computational overhead and wastes considerable bandwidth resources. Accordingly, preserving the confidentiality of medical data and achieving efficient data retrieval simultaneously are of significant importance in cloud-assisted WBANs scenarios. To resolve the issue of efficient searching over the encrypted medical data, the searchable encryption (SE) technique [5, 6], which allows users to delegate their searchability to cloud server for securely and selectively retrieving the encrypted medical data of interest, has been extensively researched. At present, a lot of work focusing on SE has been explored to gain various searching functionalities like single keyword search [7, 8], multikeyword search [9, 10], fuzzy keyword search [11, 12], and so on. Although much attention in SE technology has been attracted in both academical and industrial fields, it is still unsuitable for WBANs as patients commonly desire that their medical data could be shareable and accessible by different data users (e.g., government agencies, healthcare providers, medical researchers, and insurance underwriters). To furnish access control with fine-granularity over medical data in SE solutions, ciphertext policy attribute based keyword search (CP-ABKS) is proposed [13, 14]. In a CP-ABKS scheme, data users can decipher the ciphertexts of interest on the premise that the attributes match the access policy attached to the ciphertexts and meanwhile the submitted trapdoors satisfy the keyword indexes.Despite the fact that both fine-grained access control and search functionalities can be implemented in CP-ABKS, the computational and storage costs of much of existing CP-ABKS schemes increase linearly with the complexity of access policies, which severely impedes the use of resource-limited mobile devices. Consequently, in practice, it is greatly essential to provide lightweight operations for data users.In this paper, we devise a novelly lightweight fine-grained keyword search over encrypted medical data in WBANs. With our proposed scheme, flexible and fine-grained access control in multiple data user setting and lightweight keyword search over the encrypted medical data can be achieved. Furthermore, lightweight computational and storage overhead on end users throughout our scheme can also be gained as our primary design objective. To sum up, the main contributions are provided below:(i)
Fine-grained keyword search. Our proposed scheme can achieve one-to-many encryption instead of one-to-one encryption and enforce fine-grained access control over the medical data such that the medical data can only be searched and accessed if the attributes of data user match the access policy.(ii)
Lightweight search algorithm. Our proposed scheme can support data user in retrieving the ciphertexts of interest according to the queried keyword. To be specific, after receiving the trapdoor from the data user, the cloud server performs a search algorithm to search the encrypted medical data. During the searching process, only three pairing computations are needed for the cloud server to compete a searching operation.(iii)
Lightweight decryption and verification. In our proposed scheme, the great majority of decryption operations are offloaded to the cloud server such that considerable decryption overhead of an end user is relieved and only an exponentiation is required by the end user. Further, the end user can validate that the transformed ciphertext completed by the cloud server is correct.(iv)
Security and practicability. The detailed security proof is presented to indicate that not only the chosen plaintext attack but also chosen keyword attack can be resisted in our scheme. Besides, the performance evaluation to be shown indeed depicts its practicability of our scheme for the WBANs.


## 2. Related Work

In cloud-assisted WBANs, SE [5, 6] can furnish a fundamental solution for data users to issue search queries over the encrypted medical data of a patient generated by WBANs according to his/her interested keywords. Song et al. [5] proposed the first SE scheme, which takes little communication but the computational overhead is proportional to the size of search query. To address this issue, public key encryption with keyword search was proposed [6]. Since then, many different SE schemes were proposed to enrich distinct features such as single keyword search [7, 8], multiple keyword search [9, 10] and fuzzy keyword search [11, 12]. However, the above-mentioned SE schemes with different features do not support data owner to grant the search capability to multiple data users.To enforce flexible access control over the data, attribute based encryption (ABE) [18–21], including key policy ABE and ciphertext policy ABE, was proposed. Nevertheless, the keyword search functionality is not provided in existing ABE schemes. Motivated by the idea of providing the flexible data search and data share, Zheng et al. [13] introduced two attribute based keyword search (ABKS) schemes, i.e., key policy ABKS (KP-ABKS) and ciphertext policy ABKS (CP-ABKS), by combining the conceptions of SE and ABE together. For the WBANs, CP-ABKS is more suitable than KP-ABKS since data owners are permitted to independently designate access policies themselves to determine who can flexibly search and access the encrypted medical data. Subsequently, several CP-ABKS schemes were also proposed [14–16], whereas these schemes still are inappropriate for the WBANs due to their large computation, communication, and storage costs. To be more specific, in Liang et al.’s scheme [14], the number of pairing and exponentiation operations in both search and decryption phases increases linearly with the complexity of access policy hidden in the ciphertext and the ciphertext size also follows the linear relationship with the complexity of access policy. Although the scheme [15] improves the search efficiency compared to [14], it does not solve the prohibitive computation and communication cost problem like [14, 22]. Besides, this scheme only provides data users with search function but does not support data sharing. In Li et al.’s schemes [16], the computation and storage overhead in both search and decryption phases also follows the linear relationship with the complexity of access policy.Very recently, although the CP-ABKS [17] that achieves fine-grained access control and search functionality is proposed, its computational and storage overhead is still much more larger. In addition, the reliability of the converted ciphertext returned from the cloud server is not verified. To achieve practicability, feasibility, and verifiability in WBANs, we build a lightweight fine-grained keyword search system based on the scheme [23], which supports flexible access control and single keyword with lightweight and verifiable decryption.Organization. The rest of organization is introduced as follows. Specifically, Section 3 reviews some basic knowledge including bilinear pairing, hardness assumption, linear secret sharing scheme matrices, etc. Section 4 introduces our system model involving system architecture and threat model. Our proposed system containing system overview and its concrete construction is presented in Section 5. Then, the security analysis and performance analysis are shown in Sections 6 and 7, respectively. Finally, a summary is concluded in the Section 8.


## 3. Preliminaries

The prime knowledge, including bilinear pairing, hardness assumption, linear secret sharing scheme matrices, and so on, is presented in this part.


### 3.1. Bilinear Pairing

An algorithmG based on input a security parameter λ can create a group tuple (p,G0,G1,e), where G0,G1 of same prime order p denote multiplicative cyclic groups, and a computable bilinear map is represented as e:G0×G0→G1 with the properties below: (1)Bilinearity: e(g1s,g2t)=e(g1,g2)st for all g1,g2∈G0, and s,t∈Zp. (2)Nondegeneracy: e(g1,g2)≠1.DenoteU,V∈Fp[X1,…,Xn]r as two r-tuples of n-variate polynomials over Fp, where r,n are integers. That is to say, U,V are two lists that contain s multivariate polynomials. Here, we redenote U=(u1,u2,…,ur), V=(v1,v2,…,vr) with setting u1=v1=1. For vector (ψ1,…,ψn)∈Fpn and function h:Fp→Ω, we denote h(U(ψ1,…,ψn)) as (h(p1(ψ1,…,ψn))),…,(h(pr(ψ1,…,ψn)))∈Ωs. We employ the similar notion for r-tuple V. We say that f is based on (U,V), where f∈Fp[ψ1,…,ψn]. We denote f∈U,V when there is a linear decomposition f=∑1≤i,j≤rmi,j·ui,uj+∑1≤i≤rni·vi, where mi,j,ni∈Zp. Then, the definition of (P,Q,f)-GDHE assumption is shown as follows.Definition 1 ((P,Q,f)-GDHE assumption [23]).
Given the tupleh(ψ1,…,ψn)=(gU(ψ1,…,ψn),e(g,g)V(ψ1,…,ψn)), the goal is to compute e(g,g)f(ψ1,…,ψn).Definition 2 ((P,Q,f)-GDDHE assumption [23]).
Given the tupleh(ψ1,…,ψn)=(gU(ψ1,…,ψn),e(g,g)V(ψ1,…,ψn)), the goal is to decide whether T=e(g,g)f(ψ1,…,ψn).


### 3.2. Linear Secret Sharing Scheme (LSSS) Matrices

Denotep and U as a prime order and a universe of attributes. If a collection A is an access structure on U, then an LSSS matrix M∈Zpl×n and a function ρ can be found, in which the attribute can be mapped with the function ρ to the rows of matrix M. In this way, an LSSS access policy can be expressed as (M,ρ). Consider the column vector v→=(t,s2,…,sn)∈Zp∗n, where t is the shared secret, and s2,…,sn←RZp. There exist constants {ωi}i∈I in Zp for any shares λi={M·y→}i∈I of a sharing secret s, ∑i∈Iωiλi=s, where I=i∣i∈1,l∨ρi∈S and S denotes the authorized set.


### 3.3. Conversion from a Boolean Formula to an LSSS Matrix

The elaborated working principle of the algorithm in conversion from a Boolean formula to an LSSS matrix can be found in [24]. Here, we briefly introduce its works below: the Boolean formula can be easily converted into an access tree, where AND or OR gates are interior nodes and user attributes acted as the leaf nodes. Here we specify the sharing vector of LSSS matrix as (1,0,…,0). As a starting point, the vector (1) is first availed for labelling the root node of the tree and then the levels of the tree are gone down. In this manner, a vector decided by the assigned vector from its parent node is labelled to each node. Besides, an initially global counter variable c to be maintained is set 1. If the parent node is an OR gate with its vector v, then its children are also marked by v. If the parent node is an AND gate with its vector v, 0’s at the end are appended after v to make it of length c. Then, vector v∣1 is distributed to remark one of its children and the vector (0,…,0)∣-1 is used for labelling another node. It is noteworthy that the summation of these two vectors is v∣0. The value of c is incremented with 1. Once the whole tree is finished labelling, the rows of LSSS matrix can be built by the vectors. Finally, if the vectors have various lengths, we pad with 0’s at the end on the shorter ones to achieve the same length vectors.


### 3.4. Definition and Security Model of Lightweight Fine-Grained Keyword Search over Encrypted Data

The following algorithms are involved in our lightweight fine-grained keyword search system.(i)
Setup(1λ,l). Inputting the security parameter 1λ and the attribute universe description, produce the master secret key MSK and the public parameter PP.(ii)
KeyGen(PP,S,MSK). Upon input PP, MSK, and an attribute set S of a user, create the secret key SK for users.(iii)
Encrypt(PP,ω,M,β). Upon input PP, a keyword ω, an access Boolean formula β, and the message M, generate the ciphertext CT with encrypted keyword.(iv)
Trapdoor(PP,SK,ω′,S). On input PP, SK, the picked keyword ω′, and S, produce a search token TK for keyword search and a retrieval key RK for message recovery.(v)
Search(PP,S,TK,CT). On input PP, S, TK, and CT, retrieve the intended keyword and then generate the simpler transformed ciphertext CT′.(vi)
Decrypt(PP,CT′,RK,S). On input PP, RK, CT′, and S, determine the correctness of the decrypted plaintext message M and then recover M if the determined result is true.Security Model. The security model for our scheme comprises two following probabilistic games between an adversary A and a challenger C. These two games are used to prove that not only chosen plaintext attack (CPA) but also chosen keyword attack (CKA) can be resisted by our scheme.CPA-security:(i)
Init. The challenge access policy β∗ is picked-then-committed to the challenge C by the adversary A.(ii)
Setup.Setup algorithm is done by C to gain public parameter PP and master secret key MSK. After that, PP is sent to A.(iii)
Phase 1&2. KeyGen oracle is adaptively queried by A to obtain secret key by submitting a user attribute S where S∉β∗.(iv)
Challenge. Two messages M0,M1 satisfying M0=M1 picked by A are provided to C. Then, a coin β is first randomly flipped by C and then the partially generated ciphertext CTβ by running Encrypt(PK,Mβ,β) is transmitted to A.(v)
Guess. A guess β′∈0,1 upon β is returned by A.CKA-Security:(i)
Init. The challenge access policy β∗ is picked-then-committed to the challenge C by the adversary A.(ii)
Setup.Setup algorithm is done by C to gain public parameter PP and master secret key MSK. After that, PP is sent to A.(iii)
Phase 1&2. Trapdoor oracle is adaptively queried by A to gain keyword trapdoor by submitting a user attribute S where S∉β∗.(iv)
Challenge. Two keywords ω0,ω1 meeting ω0=ω1 picked by A are provided to C. Then, a coin β is first randomly flipped by C and then the partially generated ciphertext CTβ by running Encrypt(PK,ωβ,β) is transmitted to A.(v)
Guess. A guess β′∈0,1 upon β is returned by A.


## 3.1. Bilinear Pairing

An algorithmG based on input a security parameter λ can create a group tuple (p,G0,G1,e), where G0,G1 of same prime order p denote multiplicative cyclic groups, and a computable bilinear map is represented as e:G0×G0→G1 with the properties below: (1)Bilinearity: e(g1s,g2t)=e(g1,g2)st for all g1,g2∈G0, and s,t∈Zp. (2)Nondegeneracy: e(g1,g2)≠1.DenoteU,V∈Fp[X1,…,Xn]r as two r-tuples of n-variate polynomials over Fp, where r,n are integers. That is to say, U,V are two lists that contain s multivariate polynomials. Here, we redenote U=(u1,u2,…,ur), V=(v1,v2,…,vr) with setting u1=v1=1. For vector (ψ1,…,ψn)∈Fpn and function h:Fp→Ω, we denote h(U(ψ1,…,ψn)) as (h(p1(ψ1,…,ψn))),…,(h(pr(ψ1,…,ψn)))∈Ωs. We employ the similar notion for r-tuple V. We say that f is based on (U,V), where f∈Fp[ψ1,…,ψn]. We denote f∈U,V when there is a linear decomposition f=∑1≤i,j≤rmi,j·ui,uj+∑1≤i≤rni·vi, where mi,j,ni∈Zp. Then, the definition of (P,Q,f)-GDHE assumption is shown as follows.Definition 1 ((P,Q,f)-GDHE assumption [23]).
Given the tupleh(ψ1,…,ψn)=(gU(ψ1,…,ψn),e(g,g)V(ψ1,…,ψn)), the goal is to compute e(g,g)f(ψ1,…,ψn).Definition 2 ((P,Q,f)-GDDHE assumption [23]).
Given the tupleh(ψ1,…,ψn)=(gU(ψ1,…,ψn),e(g,g)V(ψ1,…,ψn)), the goal is to decide whether T=e(g,g)f(ψ1,…,ψn).


## 3.2. Linear Secret Sharing Scheme (LSSS) Matrices

Denotep and U as a prime order and a universe of attributes. If a collection A is an access structure on U, then an LSSS matrix M∈Zpl×n and a function ρ can be found, in which the attribute can be mapped with the function ρ to the rows of matrix M. In this way, an LSSS access policy can be expressed as (M,ρ). Consider the column vector v→=(t,s2,…,sn)∈Zp∗n, where t is the shared secret, and s2,…,sn←RZp. There exist constants {ωi}i∈I in Zp for any shares λi={M·y→}i∈I of a sharing secret s, ∑i∈Iωiλi=s, where I=i∣i∈1,l∨ρi∈S and S denotes the authorized set.


## 3.3. Conversion from a Boolean Formula to an LSSS Matrix

The elaborated working principle of the algorithm in conversion from a Boolean formula to an LSSS matrix can be found in [24]. Here, we briefly introduce its works below: the Boolean formula can be easily converted into an access tree, where AND or OR gates are interior nodes and user attributes acted as the leaf nodes. Here we specify the sharing vector of LSSS matrix as (1,0,…,0). As a starting point, the vector (1) is first availed for labelling the root node of the tree and then the levels of the tree are gone down. In this manner, a vector decided by the assigned vector from its parent node is labelled to each node. Besides, an initially global counter variable c to be maintained is set 1. If the parent node is an OR gate with its vector v, then its children are also marked by v. If the parent node is an AND gate with its vector v, 0’s at the end are appended after v to make it of length c. Then, vector v∣1 is distributed to remark one of its children and the vector (0,…,0)∣-1 is used for labelling another node. It is noteworthy that the summation of these two vectors is v∣0. The value of c is incremented with 1. Once the whole tree is finished labelling, the rows of LSSS matrix can be built by the vectors. Finally, if the vectors have various lengths, we pad with 0’s at the end on the shorter ones to achieve the same length vectors.


## 3.4. Definition and Security Model of Lightweight Fine-Grained Keyword Search over Encrypted Data

The following algorithms are involved in our lightweight fine-grained keyword search system.(i)
Setup(1λ,l). Inputting the security parameter 1λ and the attribute universe description, produce the master secret key MSK and the public parameter PP.(ii)
KeyGen(PP,S,MSK). Upon input PP, MSK, and an attribute set S of a user, create the secret key SK for users.(iii)
Encrypt(PP,ω,M,β). Upon input PP, a keyword ω, an access Boolean formula β, and the message M, generate the ciphertext CT with encrypted keyword.(iv)
Trapdoor(PP,SK,ω′,S). On input PP, SK, the picked keyword ω′, and S, produce a search token TK for keyword search and a retrieval key RK for message recovery.(v)
Search(PP,S,TK,CT). On input PP, S, TK, and CT, retrieve the intended keyword and then generate the simpler transformed ciphertext CT′.(vi)
Decrypt(PP,CT′,RK,S). On input PP, RK, CT′, and S, determine the correctness of the decrypted plaintext message M and then recover M if the determined result is true.Security Model. The security model for our scheme comprises two following probabilistic games between an adversary A and a challenger C. These two games are used to prove that not only chosen plaintext attack (CPA) but also chosen keyword attack (CKA) can be resisted by our scheme.CPA-security:(i)
Init. The challenge access policy β∗ is picked-then-committed to the challenge C by the adversary A.(ii)
Setup.Setup algorithm is done by C to gain public parameter PP and master secret key MSK. After that, PP is sent to A.(iii)
Phase 1&2. KeyGen oracle is adaptively queried by A to obtain secret key by submitting a user attribute S where S∉β∗.(iv)
Challenge. Two messages M0,M1 satisfying M0=M1 picked by A are provided to C. Then, a coin β is first randomly flipped by C and then the partially generated ciphertext CTβ by running Encrypt(PK,Mβ,β) is transmitted to A.(v)
Guess. A guess β′∈0,1 upon β is returned by A.CKA-Security:(i)
Init. The challenge access policy β∗ is picked-then-committed to the challenge C by the adversary A.(ii)
Setup.Setup algorithm is done by C to gain public parameter PP and master secret key MSK. After that, PP is sent to A.(iii)
Phase 1&2. Trapdoor oracle is adaptively queried by A to gain keyword trapdoor by submitting a user attribute S where S∉β∗.(iv)
Challenge. Two keywords ω0,ω1 meeting ω0=ω1 picked by A are provided to C. Then, a coin β is first randomly flipped by C and then the partially generated ciphertext CTβ by running Encrypt(PK,ωβ,β) is transmitted to A.(v)
Guess. A guess β′∈0,1 upon β is returned by A.


## 4. System Model

The system architecture and threat model are presented in the following.


### 4.1. System Architecture

Figure1 expressively illustrates the architecture of our proposed scheme, mainly comprising three kinds of entities: the cloud server, the wireless body area networks (WBANs) and the healthcare providers, in which the last two entities are correspondingly regarded as data owners and data users. The function of each entity is described in detail below.(i)
WBANs (Data Owner). Tiny wireless sensors commonly surface-attached on patients’ body are comprised in a WBAN. These wireless sensors are employed to monitor the vital physiology parameters such as diabetes, heart rate, and asthma. The collected health data are first aggregated and then delivered to a smart device. After that, keyword to elucidate the information of health data is extracted. Subsequently, the health data with its keyword information are together encrypted into a ciphertext under a self-chosen access policy. Lastly, the encrypted health data are outsourced to the cloud server for remotely sharing data.(ii)
Healthcare provider (Data User). Healthcare providers in our architecture are viewed as data users. Every user owns a list of attributes and red should be allowed to retrieve the encrypted health data relied upon his/her possessed attributes. To search and access the encrypted health data, the data user first creates the keyword trapdoor according to his/her private key and delegates it via wireless channel (e.g., Wifi, Zigbee, and GPRS) to the cloud server for data retrieval. After receiving the returned ciphertex of health data, the data user then decrypts it and verifies the correctness of decryption.(iii)
Cloud Server. The cloud server has almost unlimited storage and computing resources to perform remote storage tasks and respond on data search requests. Besides, in our architecture, the cloud server can also help data user to transform the complex ciphertext of health data into a simple one such that the encrypted health data can be deciphered by the data user in a lightweight way.Figure 1
The architecture of our proposed system.Here, note that a fully trusted entity that is called the key generation centre takes charges of authenticating the attributes of users and distributing secret key to data users, which is not provided in our system architecture.


### 4.2. Threat Model

We suppose that key generation centre is a completely reliable entity and the server is considered as semitrusted and curious. In detail, cloud server is deemed to follow the predefined operations to implement the retrieval task over the encrypted health data but is still curious to gain some sensitive information from the trapdoor or the encrypted health data. Besides, the cloud server may give the incorrectly transformed ciphertext back to the delegated data user for saving its computation resources or bandwidth. In our threat model, all malicious hackers are supposed to own polynomial time bounded computation ability such that they cannot solve the hardness problems.


## 4.1. System Architecture

Figure1 expressively illustrates the architecture of our proposed scheme, mainly comprising three kinds of entities: the cloud server, the wireless body area networks (WBANs) and the healthcare providers, in which the last two entities are correspondingly regarded as data owners and data users. The function of each entity is described in detail below.(i)
WBANs (Data Owner). Tiny wireless sensors commonly surface-attached on patients’ body are comprised in a WBAN. These wireless sensors are employed to monitor the vital physiology parameters such as diabetes, heart rate, and asthma. The collected health data are first aggregated and then delivered to a smart device. After that, keyword to elucidate the information of health data is extracted. Subsequently, the health data with its keyword information are together encrypted into a ciphertext under a self-chosen access policy. Lastly, the encrypted health data are outsourced to the cloud server for remotely sharing data.(ii)
Healthcare provider (Data User). Healthcare providers in our architecture are viewed as data users. Every user owns a list of attributes and red should be allowed to retrieve the encrypted health data relied upon his/her possessed attributes. To search and access the encrypted health data, the data user first creates the keyword trapdoor according to his/her private key and delegates it via wireless channel (e.g., Wifi, Zigbee, and GPRS) to the cloud server for data retrieval. After receiving the returned ciphertex of health data, the data user then decrypts it and verifies the correctness of decryption.(iii)
Cloud Server. The cloud server has almost unlimited storage and computing resources to perform remote storage tasks and respond on data search requests. Besides, in our architecture, the cloud server can also help data user to transform the complex ciphertext of health data into a simple one such that the encrypted health data can be deciphered by the data user in a lightweight way.Figure 1
The architecture of our proposed system.Here, note that a fully trusted entity that is called the key generation centre takes charges of authenticating the attributes of users and distributing secret key to data users, which is not provided in our system architecture.


## 4.2. Threat Model

We suppose that key generation centre is a completely reliable entity and the server is considered as semitrusted and curious. In detail, cloud server is deemed to follow the predefined operations to implement the retrieval task over the encrypted health data but is still curious to gain some sensitive information from the trapdoor or the encrypted health data. Besides, the cloud server may give the incorrectly transformed ciphertext back to the delegated data user for saving its computation resources or bandwidth. In our threat model, all malicious hackers are supposed to own polynomial time bounded computation ability such that they cannot solve the hardness problems.


## 5. Proposed System

In this section, we first give our system overview and afterward present the detailed construction.


### 5.1. System Overview

The highlight of our proposed system is to ease the computation overburdens on the user’s smart device. The desirable way for data retrieval and data access is to migrate much of the computation-heavy tasks to the cloud server such that data users with the smart device only require to perform certain marginal operations.The system workflow is in detail described below (shown in Figure2):(1)
The patient P first asks to join the proposed system. As a response, the healthcare authority (HA) first authenticates the attributes of P and generates the key pair (private key and public key) by implementingSetup &KeyGen algorithm.(2)
The health data of P are collected and aggregated to a smart device via a WBAN. The P extracts a keyword to describe the health data. Then, both the keyword and health data are created in the form of ciphertext by performingEncrypt algorithm. Then P connects via patient’s gateway to the cloud server and transmits the encrypted health data with its keyword information. During this process, the access policy picked by the P is also attached to the encrypted health data.(3)
When an authorized health provider (HP) intends to issue data retrieval and data access request, HP first produces a keyword trapdoor by usingTrapdoor algorithm and delivers it to the cloud server via a monitoring application.(4)
Once gaining the request of search and access, the cloud server usesSearch algorithm to discover the matched health data and transform the complex ciphertext into a simpler ciphertext, which is then delivered to the HP.(5)
After downloading the simpler ciphertext about health data of the P, HP recovers the health data and checks the correctness of decryption by performingDecrypt algorithm.Figure 2
The workflow of our system architecture.


### 5.2. Concrete Construction

S e t u p ( 1 λ , l ). Master secret key MSK and public system parameter PP are produced below according to input security parameter 1λ and attribute universe description. Let l=D denote the maximal number of attributes in the system and B=(p,G0,G1,e(.,.)) express the bilinear group system. This algorithm first chooses integers α,a,b,c∈Zp and one generator g of G0 in random manners. As well, it selects l group elements h1,…,hl from G0 and two hash functions H:0,1∗→Zp, F:{0,1}∗→K. Finally, it publishes PP=(g,ga,gb,gc,e(g,g)α,h1,…,hl,H,F) and keeps MSK=(a,b,c,α) secretly.K e y G e n ( P P , S , M S K ). On input an attribute set S of a user, the public parameter PP, and the system master key MSK, this algorithm creates the secret key SK for the user as follows: This algorithm first picks s,t∈Zp and then computes the secret key for the user as SK=(d0=g(ac-α-t)/b, d1=gαgas,d2=gs,d3=gt,{fi=his}i∈D). Note that user just requires to keep d1 secret and the rest of other secret key could be published to the public domain [23].E n c r y p t ( P P , ω , M , β ). Upon input the public parameter PP, a keyword ω, an access Boolean formula β, and the message M, this algorithm performs the following procedures: The DNF access policy is described as β=(β1∨⋯∨βm), where βi is an attribute set, i=1,…,m and m denotes the size of β.(1)
For the certain keywordω, this algorithm first chooses μ,z∈Zp, this algorithm computes σ1=ga(μ+z)gbμH(ω), σ2=gbz, σ3=gcμ.(2)
For the plaintext message, it first selectsχ∈G1 and sets KSE=F(χ). After that, l∈Zp is selected and l-bit 0 string is concatenated after the plaintext message M, which will be exploited to proceed decryption verification. Besides, it computes CM=SEncKSE(M∥0l) and C=χ·e(g,g)αz, C0=gz. Then, it compares between l and m. If l≤|m|, it computes C1=(ga∏i∈βihi)z, …, Cm=(ga∏i∈βmhi)z. Else, it reverts to the encryption of the scheme [25]. This algorithm first sets up an LSSS matrix that denotes a map ρ and a Boolean formula β. Next, it picks a vector v→=(z,x2,…,xn)∈Zpn. For i=1 to l, λi=v→Mi is calculated, where the vector Mi is equivalent to i-th row of matrix M. Subsequently, it calculates Ci=gaλihρ(i)-z, where i=1,…,l.(3)
It finally outputs the ciphertextCT=(σ1,σ2,σ3,C0,C1,…,Cm) with a description of β. Or, it returns the ciphertext CT=(σ1,σ2,σ3,CM,C0,C1,…,Cl) with a description of (M,ρ).T r a p d o o r ( P P , S K , ω ′ , S ). When a user intends to access the data containing the queried keyword, the search token TK can be created as follows: it randomly selects r∈Zp and subsequently calculates the search token as TK=(t1,t2,d^0, d^1,d^2,{f^i}i∈D) and sets retrieval key RK=r, where t1=gargbrH(ω′), t2=gcr, d^0=d0r, d^1=d1r, d^2=d2r, d^3=d3r, {f^i=fir}i∈D.S e a r c h ( P P , S , T D , C T ). On input the attribute set S of the user, the search token TK, the public parameter PP, and the ciphertext CT, this algorithm first checks the number elements I of G0 in CT and whether or not the set of user attributes contents the access policy.(1)
IfI=m+4 and the set of user attributes meets the access policy, it computes (1)Θ1=eC0,d^1∏i∈βkf^ied^2,Ck=egz,gαrga∏i∈βkhisregsr,ga∏i∈βkhiz=eg,gαzr,Θ2=ed^3,C0=eg,gtzr.If the attribute set matches the access policy andI=l+4, let {ωi∈Zp} denote a collect of constants satisfying ∑i∈ρ(i)ωiλi=z if the shares {λi} of z are valid. It computes (2)Θ1=e∏i∈ρiCi-ωi,d^2eC0,d^1∏i∈ρif^ρi-ωi=e∏i∈ρigaλihρi-z-ωi,gsregz,gαrgasr∏i∈ρihρi-rsωi=eg,gαzr.Θ2=ed^3,C0=eg,gtzr.Otherwise, it aborts and returns⊥.(2)
It checks whethere(σ1,t2)=e(σ3,t1)·Θ1·Θ2·e(σ2,d^0). If it holds, it returns the outsourced ciphertext CT′=(Θ1,C). Otherwise, it also aborts and returns ⊥.D e c r y p t ( P P , R K , S ). This algorithm executes the following process to recover the encrypted value χ=C/Θ11/r. After that, it computes KSE=F(χ) and M′=SDecKSE(CM). Then, it judges whether a redundancy 0l is affixed after the decrypted message. If M∥0l=M′ holds, M could be gained in the way of truncating l-bit 0 string. Otherwise, it indicates the returned result from the cloud server is incorrect and outputs the symbol ⊥.


## 5.1. System Overview

The highlight of our proposed system is to ease the computation overburdens on the user’s smart device. The desirable way for data retrieval and data access is to migrate much of the computation-heavy tasks to the cloud server such that data users with the smart device only require to perform certain marginal operations.The system workflow is in detail described below (shown in Figure2):(1)
The patient P first asks to join the proposed system. As a response, the healthcare authority (HA) first authenticates the attributes of P and generates the key pair (private key and public key) by implementingSetup &KeyGen algorithm.(2)
The health data of P are collected and aggregated to a smart device via a WBAN. The P extracts a keyword to describe the health data. Then, both the keyword and health data are created in the form of ciphertext by performingEncrypt algorithm. Then P connects via patient’s gateway to the cloud server and transmits the encrypted health data with its keyword information. During this process, the access policy picked by the P is also attached to the encrypted health data.(3)
When an authorized health provider (HP) intends to issue data retrieval and data access request, HP first produces a keyword trapdoor by usingTrapdoor algorithm and delivers it to the cloud server via a monitoring application.(4)
Once gaining the request of search and access, the cloud server usesSearch algorithm to discover the matched health data and transform the complex ciphertext into a simpler ciphertext, which is then delivered to the HP.(5)
After downloading the simpler ciphertext about health data of the P, HP recovers the health data and checks the correctness of decryption by performingDecrypt algorithm.Figure 2
The workflow of our system architecture.


## 5.2. Concrete Construction

S e t u p ( 1 λ , l ). Master secret key MSK and public system parameter PP are produced below according to input security parameter 1λ and attribute universe description. Let l=D denote the maximal number of attributes in the system and B=(p,G0,G1,e(.,.)) express the bilinear group system. This algorithm first chooses integers α,a,b,c∈Zp and one generator g of G0 in random manners. As well, it selects l group elements h1,…,hl from G0 and two hash functions H:0,1∗→Zp, F:{0,1}∗→K. Finally, it publishes PP=(g,ga,gb,gc,e(g,g)α,h1,…,hl,H,F) and keeps MSK=(a,b,c,α) secretly.K e y G e n ( P P , S , M S K ). On input an attribute set S of a user, the public parameter PP, and the system master key MSK, this algorithm creates the secret key SK for the user as follows: This algorithm first picks s,t∈Zp and then computes the secret key for the user as SK=(d0=g(ac-α-t)/b, d1=gαgas,d2=gs,d3=gt,{fi=his}i∈D). Note that user just requires to keep d1 secret and the rest of other secret key could be published to the public domain [23].E n c r y p t ( P P , ω , M , β ). Upon input the public parameter PP, a keyword ω, an access Boolean formula β, and the message M, this algorithm performs the following procedures: The DNF access policy is described as β=(β1∨⋯∨βm), where βi is an attribute set, i=1,…,m and m denotes the size of β.(1)
For the certain keywordω, this algorithm first chooses μ,z∈Zp, this algorithm computes σ1=ga(μ+z)gbμH(ω), σ2=gbz, σ3=gcμ.(2)
For the plaintext message, it first selectsχ∈G1 and sets KSE=F(χ). After that, l∈Zp is selected and l-bit 0 string is concatenated after the plaintext message M, which will be exploited to proceed decryption verification. Besides, it computes CM=SEncKSE(M∥0l) and C=χ·e(g,g)αz, C0=gz. Then, it compares between l and m. If l≤|m|, it computes C1=(ga∏i∈βihi)z, …, Cm=(ga∏i∈βmhi)z. Else, it reverts to the encryption of the scheme [25]. This algorithm first sets up an LSSS matrix that denotes a map ρ and a Boolean formula β. Next, it picks a vector v→=(z,x2,…,xn)∈Zpn. For i=1 to l, λi=v→Mi is calculated, where the vector Mi is equivalent to i-th row of matrix M. Subsequently, it calculates Ci=gaλihρ(i)-z, where i=1,…,l.(3)
It finally outputs the ciphertextCT=(σ1,σ2,σ3,C0,C1,…,Cm) with a description of β. Or, it returns the ciphertext CT=(σ1,σ2,σ3,CM,C0,C1,…,Cl) with a description of (M,ρ).T r a p d o o r ( P P , S K , ω ′ , S ). When a user intends to access the data containing the queried keyword, the search token TK can be created as follows: it randomly selects r∈Zp and subsequently calculates the search token as TK=(t1,t2,d^0, d^1,d^2,{f^i}i∈D) and sets retrieval key RK=r, where t1=gargbrH(ω′), t2=gcr, d^0=d0r, d^1=d1r, d^2=d2r, d^3=d3r, {f^i=fir}i∈D.S e a r c h ( P P , S , T D , C T ). On input the attribute set S of the user, the search token TK, the public parameter PP, and the ciphertext CT, this algorithm first checks the number elements I of G0 in CT and whether or not the set of user attributes contents the access policy.(1)
IfI=m+4 and the set of user attributes meets the access policy, it computes (1)Θ1=eC0,d^1∏i∈βkf^ied^2,Ck=egz,gαrga∏i∈βkhisregsr,ga∏i∈βkhiz=eg,gαzr,Θ2=ed^3,C0=eg,gtzr.If the attribute set matches the access policy andI=l+4, let {ωi∈Zp} denote a collect of constants satisfying ∑i∈ρ(i)ωiλi=z if the shares {λi} of z are valid. It computes (2)Θ1=e∏i∈ρiCi-ωi,d^2eC0,d^1∏i∈ρif^ρi-ωi=e∏i∈ρigaλihρi-z-ωi,gsregz,gαrgasr∏i∈ρihρi-rsωi=eg,gαzr.Θ2=ed^3,C0=eg,gtzr.Otherwise, it aborts and returns⊥.(2)
It checks whethere(σ1,t2)=e(σ3,t1)·Θ1·Θ2·e(σ2,d^0). If it holds, it returns the outsourced ciphertext CT′=(Θ1,C). Otherwise, it also aborts and returns ⊥.D e c r y p t ( P P , R K , S ). This algorithm executes the following process to recover the encrypted value χ=C/Θ11/r. After that, it computes KSE=F(χ) and M′=SDecKSE(CM). Then, it judges whether a redundancy 0l is affixed after the decrypted message. If M∥0l=M′ holds, M could be gained in the way of truncating l-bit 0 string. Otherwise, it indicates the returned result from the cloud server is incorrect and outputs the symbol ⊥.


## 6. Security Analysis

The elaborated security analysis to be presented in this part proves that our scheme is secure. Specifically, not onlyCPA-security but alsoCKA-security can be reached. The following two theorems are utilized to prove its security of the formulated scheme.Theorem 3.
Our scheme is said to reach theCPA-security under the modified BDHE problem.Proof.
Provided that the adversaryA can breach our scheme, then there exists another algorithm C that could be built to address the modified BDHE problem by exploiting the interaction chance with A. Given the modified BDHE-assumption instance (g, gρ,gτ,…,gτq,gτq+2,…,gτ2q,gρ(τ+τη),gτη,gτ2η,…,gτqη, gτq+2η,…,gτ2qη). C avails of A and simulates the process of the game to determine if Z=e(g,g)τq+1ρ, or Z is an element randomly chosen from G1.Setup. A challenge access policy β∗=β1∗∨⋯∨βm∗ is picked by A and sent to C. Here suppose that β∗ denotes the size of the challenge access policy β∗, where βi∗ are disjoint sets. Then C creates PK by considering the cases below.(i)
Case 1. Ifm>β∗, the process of the public system parameter generation in our scheme is almost the same as that in the scheme [25]. Here we refer readers to the proof in [25]. It is worth noting that the modified BDHE assumption is an extension of the BDHE assumption.(ii)
Case 2. Ifm≤β∗, the challenger C first builds LSSS matrix (Ml∗×n∗∗,ρ∗). Next, C picks τ′∈Zp and sets e(g,g)α=e(gτ,gτq)e(g,g)τ′=e(g,g)τ′+τq+1,ga=gτ. Next, C discovers disjoint sets of rows of M∗:J1,…,Jm, where ρi,i∈Jj=βj∗. βj∗ is described as (∧ρ(i))i∈J1∨(∧ρ(i))i∈J2∨⋯∨(∧ρ(i))i∈Jm. Then, the vector y→=(τ,τη,…,τn∗-1η) is implicitly defined by C such that λ→=∑k∈[1,n∗]M∗·y→. Specifically, λj→=∑k∈[1,n∗]Mj,i∗tai-1 for j=1,…,l∗. In addition, C also discovers set {ωi}i∈[1,l∗] satisfying ∑ωiλi=τ. For each hj, if j∈[1,l], where there exists an index i∈[1,l∗], then C picks tj∈Zp and computes hj=gtigωi∑k∈[1,n∗]Mj,i∗tai=gtjgτωiλi. Otherwise, C picks tj∈Zp and computes hj=gtj. Finally, PK=(g,ga,e(g,g)α,h1,…,hl) is published by C.Phase 1&2. The challenger C generates the secret key as follows: A first issues the set of indices of attributes S∈[1,l] to C; here S⊭M∗ (this means that the set of indices of attributes does not match the matrix M∗). A vector x→=(x1,x2,…,xn∗), satisfying x1=-1 and the inner product x→,Mi∗=0, is first picked by C. Then, C picks θ∈Zp and computes (3)d1=gτ′gτθ∏i=2,…,n∗gτq+2-ixi=gτ′gτθ+τqx1+τq-1x2+⋯+τq-n∗+1xn∗-τqx1=gτ′+τq+1gτθ+τq+1x1+τq-2x2+⋯+τq-n∗xn∗=gαgas,d2=gθ∏i=1,…,n∗gτq+1-ixi=gθ+τqx1+τq-1x2+⋯+τq-n∗+1xn∗=gs,where s=θ+τqx1+τq-1x2+⋯+τq-n∗+1xn∗.Forj∈S if there exists no i∈[1,l∗] matching ρ∗(i)=j, C computes fj=(gs)tj=(gtj)s=hjs. For j∈S such that there exists an index i∈[1,l∗] matching ρ∗(i)=j; C computes fj=(gs)tjgθ+τqx1+τq-1x2+⋯+τq-n∗+1xn∗∑k∈[1,n∗]Mj,i∗tai-1=(gtj)s=hjs. Note that x→,Mi∗=0. Thus, the partial secret key can be created as (d1,d2,fj).Challenge. Two plaintext messages M0∗ and M1∗ with equal length are picked-then-delivered to C. Then, C selects β∈0,1 and subsequently computes as follows: (4)C=Mβ·Z·egρ,gτ′=Mβ·Z·egz,gτ′,C0=gρ=gz,C1=gρτ+τηg∑i∈J1ρtρi=gτ·∏i∈J1gtρigτωiλiρ,=gτ∏i∈J1hρiρ=gτ∏i∈β1hiρ=gτ∏i∈β1hiz,⋮Cm=gρτ+τηg∑i∈Jmρtρi=gτ·∏i∈Jmgtρigτωiλiρ,=gτ∏i∈Jmhρiρ=gτ∏i∈βmhiρ,=gτ∏i∈βmhiz.Note that here we use Mβ instead of the selected symmetry key to simulate the whole game.Guess. A guess with β′∈0,1 upon β is responded by A, then C gives 1 to guess Z=e(g,g)τq+1ρ=e(g,g)τq+1z if holding β=β′. Otherwise, C guesses that Z is an element randomly picked from G1.Theorem 4.
The proposed scheme is said to achieve theCKA-security in the general bilinear group model, where H is regarded as a random oracle.Proof.
In this game, the adversary will intend to distinguishga(μ+z)gbμH(ω) from ga(μ+z)gbμH(ω′). Given ϱ∈Zp, the probability of distinguishing ga(μ+z)gbμH(ω) from gϱ is the same as that of differentiating ga(μ+z)gbμH(ω′) from gϱ. If A has an advantage ϱ/2 in breaching this game, then A has the same advantage in differentiating ga(μ+z)gbμH(ω) from gϱ. In this way, we can modify the above game as that A can distinguish ga(μ+z) from gϱ. The elaborated proof of the modified game is explained below.(i)
Setup. The challenger C randomly picks a,b,c∈Zp, transmits the produced tuple (e,g,ga,gb,gc) to A. Subsequently, A chooses an access policy β∗ and sends it to C. Lastly, C proceeds the following simulation. Concretely, if A submits the attribute i that has not been issued before, C picks θi∈Zp, then added (i,θi,hi) to the list OH and returns hi=gθi. Otherwise, C directly returns hi=gθi by picking out θi from OH.(ii)
Phase 1&2. A will query OSK and OTK to gain secret key SK and search token TK below.
(a)
OSK: After receiving the attribute set S∗ from A, C first chooses α,t∗,s∗∈Zp and computes d0=g(ac-α-t∗)/b, d1=gα(ga)s∗, d2=gs∗, d3=gt∗, fi=gθis∗. Then, C returns the secret key SK=(d0,d1,d2,d3,{fi}i∈S∗).(b)
OTK: A queries the oracle OSK to get SK=(d0,d1,d2,d3,{fi}i∈S∗). Then, C chooses r∗ and produces the search token TK=(t1,t2,d^0, d^1,d^2,{f^i}i∈S∗), where t1=gar∗gbr∗H(ω′), t2=gcr∗, d^0=d0r∗, d^1=d1r∗, d^2=d2r∗, d^3=d3r∗, {f^i=fir∗}i∈S∗ and also embeds the keyword ω′ into the keyword list L.(iii)
Challenge. On giving two challenge keywords ω^,ω~ with equal length, where ω^,ω~∉L, C first chooses μ,z∈Zp. Next, C picks a random bit τ∈0,1. If τ=0, then C computes and returns σ1=gϱ, σ2=gbz, σ3=gcμ, C0=gz and Ci=ga∏i∈β∗gρiz. Otherwise, C sets and returns σ1=ga(μ+z), σ2=gbz, σ3=gcμ, C0=gz and Ci=ga∏i∈β∗gθiz. Finally, C sends the challenge ciphertext to A.
We can gain that ifA can build e(g,g)ξa(μ+z) for some gξ which is comprised by the outputs in Phase 1&2, then A can differentiate gϱ from ga(μ+z). Here, we still require to demonstrate that e(g,g)ξa(μ+z) for some gξ could be built by A with a negligible advantage. That is to say, A cannot breach the CKA game with a nonnegligible advantage.In the general group, given the two groupsG0={ψ0(ϵ)∣ϵ∈Zp} and G1={ψ1(ϵ)∣ϵ∈Zp}, where ψ0 and ψ1 are two random injective maps from Zp into a set of p3 elements, A can guess the image of ψ0 and ψ1 with a negligible advantage. So let us consider how to construct e(g,g)ξa(μ+z) for ξ∈Zp. Since only the term cμ contains the element μ, so in order to build the e(g,g)ξa(μ+z), ξ must include the factor c. In other words, ξ=cξ′ and A desires to build e(g,g)ξ′ac(μ+z). Here, A can use σ2=gbz and d0=g(ac-α-t∗)/b to get e(g,g)(ac-α-t∗)z. Although A can get e(g,g)(ac-α-t∗)z, A still needs to cancel e(g,g)(α+t∗)z by using d1=gα(ga)s∗, d2=gs∗, d3=gt∗, and fi=gθis∗. However, A cannot build these items since e(g,g)(α+t∗)z can only be built on the condition that the attributes content the access policy β∗. Therefore, we cannot derive that A can breach the CKA game.


## 7. Performance Analysis

With respect to function, storage cost, and computation overhead, this part presents comparisons among other existing attribute based keyword search schemes and our proposed scheme.


### 7.1. Qualitative Analysis

Table1 shows the function comparison with other schemes [13–17]. From the Table 1, we can learn that all schemes provide fine-grained keyword search. Data sharing is achieved in our scheme and [14, 16, 17]. Verifiable decryption among [14, 16, 17] and ours is only dealt with in our scheme. In summary, our scheme is only one that can achieve all functionalities including fine-grained keyword search and data sharing and verifiable decryption.Table 1
Function comparison with other schemes.
Scheme Fine-Grained Keyword Search Data Sharing Verifiable Decryption [13] ✓ ✓ × × [14] ✓ ✓ ✓ × [15] ✓ ✓ × × [16] ✓ ✓ ✓ × [17] ✓ ✓ ✓ × Ours ✓ ✓ ✓ ✓Table2 presents performance comparisons with other schemes with regard to the storage and computation overhead. In this table, PP, SK, CT and TK denote the sizes of public parameter, secret key, ciphertext and trapdoor. Let S and U in turn represent the sizes of attribute set and universe attribute set. Denote l as the number of rows in the matrix. In addition, an element bit length in corresponding group G0, G1, and Zp is denoted as G0, G1, and Zp. Let te1, te2 stand for the time consuming in modular exponentiations on group G0, G1, and tp be time cost in a bilinear pairing, respectively.Table 2
Storage and computation overhead comparison with other schemes.
Scheme P P S K C T T K Enc Search Dec [13] 3 G 0 2 S G 0 l + 3 G 0 2 S + 2 G 0 ( S + 4 ) t e 1 ( 2 S + 2 ) t p ⊥ [14] 2 U + 10 G 0 + 3 G 1 3 S G 0 l+3G0+2G1 3SG0 2tp+2te2+(l+5)te1 2 t p + 2 l t e 1 4tp+te2+(3l+4)te1 [15] 3U+1G0+G1 2 S + 1 G 0 + Z p l+2G0 2S+2G0 ( 2 S + 2 ) t e 1 ( S + 1 ) t p + t e 2 ⊥ [16] U + 2 G 0 2 S G 0 l+1G0+G1 2 S + 1 G 0 ( S + 1 ) t e 1 + t e 2 ( S + 2 ) t p ( 2 l + 2 ) t p [17] U + 4 G 0 S + 1 G 0 + Z p 2l+4G0+G1 2 S + 3 G 0 ( S + 1 ) t e 1 + t e 2 ( 2 S + 1 ) t p + S t e 1 ( l + 3 ) t p Ours U + 3 G 0 + G 1 G 0 l+4G0+G1 S + 6 G 0 ( 2 S + 5 ) t e 1 + t e 2 3 t p + 2 S t e 1 te1Table2 shows that our proposed scheme has optimal sizes no matter what the sizes are secret key size, ciphertext size, and even trapdoor size. Besides, it has higher computation efficiency on encryption, search, and decryption algorithm. The detailed analyzing is presented as follows: It is easy to see that our scheme consists of an element size on group G1 and U+3 element sizes on group G0. Obviously, it is much more smaller than that in [14, 15, 17]. For the secret key size, our scheme only has an element in group G0, which is the smallest compared to the other schemes. For user’s resource-limited mobile device, smaller secret key size commonly implies smaller storage cost. Our scheme also has a smaller size in both the ciphertext size and trapdoor size. For the computation overhead for encryption, search, and decryption, our scheme could use (2S+5) exponentiation operations on group G0 and an exponentiation on group G2 for encryption. which has a little higher than that in other schemes. For the computation overhead of search, our scheme has three bilinear pairing operations and 2S exponentiation operations on group G0, which reaches the best efficiency compared to other schemes, since the time consuming of other schemes follows linear relationship with the number of bilinear pairing operations whereas it in ours is growing linearly with the amount of exponentiation operations on group G0. For the computation overhead on decryption, only our scheme can achieve constant computation while other schemes cannot achieve it. This signifies that our scheme is still stable even though the number of involved attributes are too lager, which makes our scheme practical for the mobile device.


### 7.2. Experimental Result

The type A elliptic curve of 160-bit group order in pbc library [26], as the best curve to produce the fast bilinear pairing, is picked for experimental test, which is commonly deemed to have 80-bit security level. The curve expression E is denoted as y2=x3+x over Fq finite field. Both group G0 and G1 with same prime order p are subgroup of E(Fq). Then, we can get Zp=20 bytes, G0=G1=128 bytes. In our experiment test, data owners equipped with personal computers (PC) are commonly considered to have abundant resources to perform encryption to produce the data ciphertext, which will be remotely shared on the cloud server, which has powerful computing capabilities to perform the search and outsourcing decryption tasks. Due to the capacity limited mobile devices, end users (data users) require to delegate the computation-intensive operation of search and decryption to cloud server for releasing their burdens such that few lightweight operations are only done by themselves. Here, we proceed our experimental simulation according to the data from Yang et al.’s scheme [27]. More concretely, the computation times on PC for a bilinear pairing operation, an exponentiation on group G0, and an exponentiation on group G1 are 18.02ms, 9.17ms, and 2.78ms, respectively. The computation times on smart phone for those are 195.11ms, 90.12ms, and 33.40ms. Note that PC and smart phone act as cloud server and data user, respectively. Here, the schemes [14, 16, 17] achieving keyword search and data access simultaneously are compared to our scheme in terms of the storage and computation overhead in Figure 3. In detail, the secret key size comparison, ciphertext size comparison, and trapdoor size comparison are given in Figures 3(a), 3(b), and 3(c), respectively. The encryption time comparison, search time comparison, and decryption time comparison are given, respectively, in Figures 3(d), 3(e), and 3(f). It is explicit to see that our scheme has a satisfactory performance in smaller secret key size, trapdoor size, and decryption cost.Figure 3
Storage and computation overhead comparison.
(a)
Secret key size comparison (b)
Ciphertext size comparison (c)
Trapdoor size comparison (d)
The encryption time comparison (e)
The search time comparison (f)
The decryption time comparisonIn summary, our proposed scheme is almost superior to the existing related schemes since it has an extremely lightweight data access, which proves that our scheme is more feasible if being applied in IoT applications.


## 7.1. Qualitative Analysis

Table1 shows the function comparison with other schemes [13–17]. From the Table 1, we can learn that all schemes provide fine-grained keyword search. Data sharing is achieved in our scheme and [14, 16, 17]. Verifiable decryption among [14, 16, 17] and ours is only dealt with in our scheme. In summary, our scheme is only one that can achieve all functionalities including fine-grained keyword search and data sharing and verifiable decryption.Table 1
Function comparison with other schemes.
Scheme Fine-Grained Keyword Search Data Sharing Verifiable Decryption [13] ✓ ✓ × × [14] ✓ ✓ ✓ × [15] ✓ ✓ × × [16] ✓ ✓ ✓ × [17] ✓ ✓ ✓ × Ours ✓ ✓ ✓ ✓Table2 presents performance comparisons with other schemes with regard to the storage and computation overhead. In this table, PP, SK, CT and TK denote the sizes of public parameter, secret key, ciphertext and trapdoor. Let S and U in turn represent the sizes of attribute set and universe attribute set. Denote l as the number of rows in the matrix. In addition, an element bit length in corresponding group G0, G1, and Zp is denoted as G0, G1, and Zp. Let te1, te2 stand for the time consuming in modular exponentiations on group G0, G1, and tp be time cost in a bilinear pairing, respectively.Table 2
Storage and computation overhead comparison with other schemes.
Scheme P P S K C T T K Enc Search Dec [13] 3 G 0 2 S G 0 l + 3 G 0 2 S + 2 G 0 ( S + 4 ) t e 1 ( 2 S + 2 ) t p ⊥ [14] 2 U + 10 G 0 + 3 G 1 3 S G 0 l+3G0+2G1 3SG0 2tp+2te2+(l+5)te1 2 t p + 2 l t e 1 4tp+te2+(3l+4)te1 [15] 3U+1G0+G1 2 S + 1 G 0 + Z p l+2G0 2S+2G0 ( 2 S + 2 ) t e 1 ( S + 1 ) t p + t e 2 ⊥ [16] U + 2 G 0 2 S G 0 l+1G0+G1 2 S + 1 G 0 ( S + 1 ) t e 1 + t e 2 ( S + 2 ) t p ( 2 l + 2 ) t p [17] U + 4 G 0 S + 1 G 0 + Z p 2l+4G0+G1 2 S + 3 G 0 ( S + 1 ) t e 1 + t e 2 ( 2 S + 1 ) t p + S t e 1 ( l + 3 ) t p Ours U + 3 G 0 + G 1 G 0 l+4G0+G1 S + 6 G 0 ( 2 S + 5 ) t e 1 + t e 2 3 t p + 2 S t e 1 te1Table2 shows that our proposed scheme has optimal sizes no matter what the sizes are secret key size, ciphertext size, and even trapdoor size. Besides, it has higher computation efficiency on encryption, search, and decryption algorithm. The detailed analyzing is presented as follows: It is easy to see that our scheme consists of an element size on group G1 and U+3 element sizes on group G0. Obviously, it is much more smaller than that in [14, 15, 17]. For the secret key size, our scheme only has an element in group G0, which is the smallest compared to the other schemes. For user’s resource-limited mobile device, smaller secret key size commonly implies smaller storage cost. Our scheme also has a smaller size in both the ciphertext size and trapdoor size. For the computation overhead for encryption, search, and decryption, our scheme could use (2S+5) exponentiation operations on group G0 and an exponentiation on group G2 for encryption. which has a little higher than that in other schemes. For the computation overhead of search, our scheme has three bilinear pairing operations and 2S exponentiation operations on group G0, which reaches the best efficiency compared to other schemes, since the time consuming of other schemes follows linear relationship with the number of bilinear pairing operations whereas it in ours is growing linearly with the amount of exponentiation operations on group G0. For the computation overhead on decryption, only our scheme can achieve constant computation while other schemes cannot achieve it. This signifies that our scheme is still stable even though the number of involved attributes are too lager, which makes our scheme practical for the mobile device.


## 7.2. Experimental Result

The type A elliptic curve of 160-bit group order in pbc library [26], as the best curve to produce the fast bilinear pairing, is picked for experimental test, which is commonly deemed to have 80-bit security level. The curve expression E is denoted as y2=x3+x over Fq finite field. Both group G0 and G1 with same prime order p are subgroup of E(Fq). Then, we can get Zp=20 bytes, G0=G1=128 bytes. In our experiment test, data owners equipped with personal computers (PC) are commonly considered to have abundant resources to perform encryption to produce the data ciphertext, which will be remotely shared on the cloud server, which has powerful computing capabilities to perform the search and outsourcing decryption tasks. Due to the capacity limited mobile devices, end users (data users) require to delegate the computation-intensive operation of search and decryption to cloud server for releasing their burdens such that few lightweight operations are only done by themselves. Here, we proceed our experimental simulation according to the data from Yang et al.’s scheme [27]. More concretely, the computation times on PC for a bilinear pairing operation, an exponentiation on group G0, and an exponentiation on group G1 are 18.02ms, 9.17ms, and 2.78ms, respectively. The computation times on smart phone for those are 195.11ms, 90.12ms, and 33.40ms. Note that PC and smart phone act as cloud server and data user, respectively. Here, the schemes [14, 16, 17] achieving keyword search and data access simultaneously are compared to our scheme in terms of the storage and computation overhead in Figure 3. In detail, the secret key size comparison, ciphertext size comparison, and trapdoor size comparison are given in Figures 3(a), 3(b), and 3(c), respectively. The encryption time comparison, search time comparison, and decryption time comparison are given, respectively, in Figures 3(d), 3(e), and 3(f). It is explicit to see that our scheme has a satisfactory performance in smaller secret key size, trapdoor size, and decryption cost.Figure 3
Storage and computation overhead comparison.
(a)
Secret key size comparison (b)
Ciphertext size comparison (c)
Trapdoor size comparison (d)
The encryption time comparison (e)
The search time comparison (f)
The decryption time comparisonIn summary, our proposed scheme is almost superior to the existing related schemes since it has an extremely lightweight data access, which proves that our scheme is more feasible if being applied in IoT applications.


## 8. Conclusion

In this paper, a lightweight search with fine-granularity over encrypted data in WBANs is proposed. With our proposed scheme, the healthcare provider can achieve fast keyword search and lightweight verifiable decryption in the manner of fine-granularity. In addition, this paper also formally defines the security of the proposed scheme and proves its security in the random oracle. Finally, the qualitative analysis and practical simulations to be presented in this paper confirm that our proposed scheme is indeed of high efficiency and good feasibility for WBANs. Constructing a scheme that achieves conjunctive keyword search, attribute update, or the verifiability for both decryption and search would be our main future focus.



---

*Source: 9340808-2019-01-01.xml*