# Secure Multi-Keyword Search and Access Control over Electronic Health Records in Wireless Body Area Networks

Authors: Yong Ding; Hui Xu; Yujue Wang; Fang Yuan; Hai Liang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Wireless body area network (WBAN) consists of a number of sensors that are worn on patients to collect dynamic e-health records (EHRs) and mobile devices that aggregate EHRs. These EHRs are encrypted at mobile devices and then uploaded to the public cloud for storage and user access. To share encrypted EHRs with users effectively, help users retrieve EHRs accurately, and ensure EHRs confidentiality, a secure multi‐keyword search and access control (SMKS-AC) scheme is proposed, which implements encrypted EHRs access control under the ciphertext-policy attribute-based encryption (CP-ABE). SMKS-AC provides multi‐keyword search for accurate EHRs retrieval, supports the validation of decrypted EHRs, and traces and revokes the identity of users who leak private key. Security analysis shows that SMKS-AC is secure against chosen keyword and chosen plaintext attacks. Through theoretical analysis and experimental verification, the proposed SMKS-AC scheme requires less storage resources and computational costs on mobile devices than existing schemes.


---

## Body

## 1. Introduction

Wireless body area network (WBAN) consists of sensors and mobile devices. Sensors are used to monitor and collect patients’s medical/health data. These data are aggregated on mobile devices, then transmitted to public cloud for storage, and shared with data users. However, due to the limited storage space, computing resources, and energy on mobile devices, it is important to keep computing lightweight on mobile devices. Besides, data security and privacy [1] are another important concern in WBAN, including the security of data transmission and storage [2] and access control at the user side [3].In WBAN, electronic health records (EHRs) are outsourced to public cloud which cannot be directly controlled by the data owner. To ensure the privacy and security of data storage, data owners usually store EHRs in an encrypted form in the cloud. However, the encrypted data should be shared with data users according to some access control policy. Attribute-based encryption (ABE) is an effective mechanism for fine-grained access control of data. In addition, when data users want to access the encrypted EHRs stored in the public cloud, they can retrieve the required data according to some keywords. Then, the data can be obtained through decryption. Although the single keyword search method can retrieve encrypted data, the search results may contain a large number of irrelevant data, which affects the retrieval accuracy. Therefore, an effective multi‐keyword search on encrypted data and the validation of the correctness of decrypted data meet more practical needs.The EHRs are not only highly private but also commercially valuable. These may promote authorized users to sell their private key for huge profits, so it is necessary to track the identity of the private key owners. Moreover, when the private key of a data user is sold or compromised, the user’s access authority shall be revoked. The decrypted data are able to be forged during transmission, and data users cannot recognize the forged data. Hence, it is imperative to verify the correctness of the data.


### 1.1. Our Contributions

Inspired by the LiST scheme [4], based on the schemes of LSABE [5] and Chen et al. [6], we propose a secure multi‐keyword search and access control scheme (SMKS-AC) that supports multi‐keyword search of encrypted EHRs and verification of decrypted EHRs in WBAN. It enables data users to search for EHRs more accurately and verify the correctness of decrypted EHRs after decryption so as to ensure the reliability and security of EHRs sharing between data owners and data users. In addition, CP-ABE is employed to achieve fine-grained access control over EHRs. If a user’s private key is compromised, the system can also track and revoke the user’s real identity. Our SMKS-AC scheme is suitable to the limited resources of mobile devices since only a few exponentiation operations are performed on mobile devices, while bilinear operations are transferred to the public cloud.The rest of this paper is organized as follows. Section2 reviews related works. Section 3 provides the preliminaries for the proposed scheme. Section 4 presents system model and security requirements. Section 5 presents a concrete SMKS-AC construction. Section 6 shows the security analysis, as well as the function and performance comparison with other schemes. Finally, Section 7 concludes this paper.


## 1.1. Our Contributions

Inspired by the LiST scheme [4], based on the schemes of LSABE [5] and Chen et al. [6], we propose a secure multi‐keyword search and access control scheme (SMKS-AC) that supports multi‐keyword search of encrypted EHRs and verification of decrypted EHRs in WBAN. It enables data users to search for EHRs more accurately and verify the correctness of decrypted EHRs after decryption so as to ensure the reliability and security of EHRs sharing between data owners and data users. In addition, CP-ABE is employed to achieve fine-grained access control over EHRs. If a user’s private key is compromised, the system can also track and revoke the user’s real identity. Our SMKS-AC scheme is suitable to the limited resources of mobile devices since only a few exponentiation operations are performed on mobile devices, while bilinear operations are transferred to the public cloud.The rest of this paper is organized as follows. Section2 reviews related works. Section 3 provides the preliminaries for the proposed scheme. Section 4 presents system model and security requirements. Section 5 presents a concrete SMKS-AC construction. Section 6 shows the security analysis, as well as the function and performance comparison with other schemes. Finally, Section 7 concludes this paper.


## 2. Related Works

To achieve fine-grained access control of outsourcing data, ABE provides a good method of data encryption and sharing. ABE is an extension of the identity-based encryption algorithm, which was first proposed by Amit and Waters [7]. It can be divided into two types, namely, key policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE). The first KP-ABE, proposed by Goyal et al. [8], associates ciphertext with a set of attributes, while the private key is associated with an access policy that controls which ciphertext users can decrypt. The CP-ABE is first proposed by Bethencourt et al. [9], which can realize complex access control on encrypted data. The main idea is to embed the user’s attribute set into the private key, and the ciphertext contains the access policy that determines which user can access the ciphertext. The key can be used to decrypt the ciphertext for the user who can access the data. The advantage of the CP-ABE scheme is that encrypted data can be kept secret even if the storage server is untrusted [10], such as the public cloud.In order to save storage resources and computing costs at mobile devices, Go et al. [11] introduced an outsourcing scheme that reduces the storage space of mobile devices by outsourcing encrypted medical data to cloud serves. It is also the first outsourcing scheme that can resist the malicious cloud serve attacks. Li et al. [12] proposed an attribute-based encryption scheme for verifiable outsourcing encryption and decryption. Their scheme not only reduces the storage cost of mobile devices but also requires only a small amount of computing overhead to complete the decryption. However, Guo et al. [13] found that there was a security problem in Li et al.’s scheme [12] and put forward an improved scheme. Fan et al. [14] proposed a secure and effective outsourcing computing algorithm to solve the problem of a large amount of computing in existing schemes for data encrypting on mobile devices. This algorithm aims to outsource most of the computing involved in encryption and decryption to the cloud, thereby reducing the cost of computing on mobile devices. In order to reduce the overhead of data transmission and the storage space occupied by encrypted data, Zhang et al. [15] proposed an outsourced data access control scheme with constant size, which can keep the encrypted data and the user’s private key constant size.When some users sell private keys for profit, the outsourced data will face the risk of disclosure. Yu et al. [16] proposed a scheme that can effectively protect the outsourced data. If a malicious user shares the decryption key for profit, the user’s identity is required to be publicly verified and the request cannot be denied. Therefore, it is necessary to trace the user’s identity in ABE. Zhang et al. [17] proposed a scheme that can change user attributes and track the identity of traitors. The results show that the scheme provides feasibility and reliability for practical application. Sethi et al. [18] constructed a multiauthority CP-ABE scheme, which not only provides the function of tracking the identity of malicious users who leak decryption keys but also provides the ability to outsource decryption to reduce the computational burden on users and also supports access policy updates.Although ABE scheme can preserve the security and privacy of outsourced encrypted medical data, it still faces another problem in retrieving the required medical data in a large number of ciphertexts. The encryption algorithm directly makes the outsourced EHRs unreadable. In order to solve the problem of encrypted data search, Song et al. [19] proposed a scheme of using keywords to search encrypted data stored on untrusted servers without revealing any text information. After that many schemes have been proposed to search for encrypted data. For example, Vaanchig et al. [20] proposed a temporary and fuzzy keyword search public key encryption scheme, which can resist keyword guessing attacks and limit data retrieval time, thus enhancing the security of keyword search. Zhou et al. [21] proposed a public key encryption scheme, in which CP-ABE technology is used for fine-grained access control and keyword search of encrypted data. Their scheme is indistinguishable against adaptive selection keyword attacks.Besides, the ABE scheme for keyword search of outsourced encrypted data has also been specifically studied in [22–25]. However, these schemes only support single keyword search, which limits the flexibility and accuracy of data retrieval. Sun et al. [26] proposed a multi‐keyword search scheme based on CP-ABE, which supports auditing on search results. This scheme reduces a large number of irrelevant search results from cloud servers by narrowing the search scope. Moreover, Long et al. [27] proposed a lightweight multi‐keyword search algorithm based on attribute encryption, which not only supports multi‐keyword search but also reduces the computing cost of mobile devices.


## 3. Preliminaries

### 3.1. Linear Secret-Sharing Scheme (LSSS)

Definition 1 (see [28]).
A secret-sharing schemeΠ over a set of parties P is called linear (over ℤp) if(1)
The shares for all parties form a vector overℤp.(2)
There exists a matrixM with l rows and n columns called the share-generating matrix for Π. For all i=1,…,l, the i-th row of M is labeled by a party ρi, where ρ is a function from i to P. Set the column vector v=s,r2,…,rn, where s∈ℤp is the secret to be shared and r2,…,rn are randomly chosen. Mv is the vector of l shares of the secret s according to Π. The share Mvi belongs to party ρi.
It is shown in [28] that every LSSS defined above has the linear reconstruction property. Let Π be an LSSS for access structure A, S∈A be any authorized set, and I⊂1,2,…,l be defined as I=i:ρi∈S. Then, there exist constants ωi∈ℤpi∈I such that if λii∈I are valid shares of any secret s according to Π, then ∑i∈Iωiλi=s. Moreover, these constants ωii∈I can be found in time polynomial in the size of the share-generating matrix M.


### 3.2. Bilinear Groups

LetG1 and G2 be two multiplicative cyclic groups of prime order p and g be a generator of G1. If e:G1×G1⟶G2 satisfies the following properties:(1)
Bilinearity: for anyu,v∈G1 and a,b∈ℤp, we have eua,vb=eu,vab.(2)
Nondegeneracy: there exist two elementsu,v∈G1 such that eu,v≠1, where 1 is the identity element in G2.(3)
Computability:eu,v can be efficiently computed, for any u,v∈G1 then e is a bilinear map.


### 3.3. DBDH Assumption

The security of the proposed SMKS-AC construction is based on the following decisional bilinear Diffie–Hellman (DBDH) assumption.Assumption 1 (decisional bilinear Diffie–Hellman (DBDH) assumption).
LetG1 be a multiplicative cyclic group of prime order p with generator g. Let a,b,c∈ℤp∗ be randomly selected. If an adversary A is given g,ga,gb,gc, and eg,gabc, it is difficult for A to distinguish eg,gabc from a random element R in G2. The adversary A has advantage ϵ in solving the DBDH assumption if AdvDBDH=PrAg,ga,gb,gc,eg,gabc=0−PrAg,ga,gb,gc,R=0≥∈.


## 3.1. Linear Secret-Sharing Scheme (LSSS)

Definition 1 (see [28]).
A secret-sharing schemeΠ over a set of parties P is called linear (over ℤp) if(1)
The shares for all parties form a vector overℤp.(2)
There exists a matrixM with l rows and n columns called the share-generating matrix for Π. For all i=1,…,l, the i-th row of M is labeled by a party ρi, where ρ is a function from i to P. Set the column vector v=s,r2,…,rn, where s∈ℤp is the secret to be shared and r2,…,rn are randomly chosen. Mv is the vector of l shares of the secret s according to Π. The share Mvi belongs to party ρi.
It is shown in [28] that every LSSS defined above has the linear reconstruction property. Let Π be an LSSS for access structure A, S∈A be any authorized set, and I⊂1,2,…,l be defined as I=i:ρi∈S. Then, there exist constants ωi∈ℤpi∈I such that if λii∈I are valid shares of any secret s according to Π, then ∑i∈Iωiλi=s. Moreover, these constants ωii∈I can be found in time polynomial in the size of the share-generating matrix M.


## 3.2. Bilinear Groups

LetG1 and G2 be two multiplicative cyclic groups of prime order p and g be a generator of G1. If e:G1×G1⟶G2 satisfies the following properties:(1)
Bilinearity: for anyu,v∈G1 and a,b∈ℤp, we have eua,vb=eu,vab.(2)
Nondegeneracy: there exist two elementsu,v∈G1 such that eu,v≠1, where 1 is the identity element in G2.(3)
Computability:eu,v can be efficiently computed, for any u,v∈G1 then e is a bilinear map.


## 3.3. DBDH Assumption

The security of the proposed SMKS-AC construction is based on the following decisional bilinear Diffie–Hellman (DBDH) assumption.Assumption 1 (decisional bilinear Diffie–Hellman (DBDH) assumption).
LetG1 be a multiplicative cyclic group of prime order p with generator g. Let a,b,c∈ℤp∗ be randomly selected. If an adversary A is given g,ga,gb,gc, and eg,gabc, it is difficult for A to distinguish eg,gabc from a random element R in G2. The adversary A has advantage ϵ in solving the DBDH assumption if AdvDBDH=PrAg,ga,gb,gc,eg,gabc=0−PrAg,ga,gb,gc,R=0≥∈.


## 4. System Model and Security Requirements

In this section, we introduce the system model and security requirements of SMKS-AC.


### 4.1. System Model

As shown in Figure1, the system of SMKS-AC mainly consists of the following four types of entities: data owner, medical staff who are regarded as data users, public cloud (PC), and key generation center (KGC).(1)
WBAN (Data Owner). WBAN contains many sensors, which are embedded or worn on patients to collect medical data. The collected data are aggregated and transmitted to personal digital assistant (PDA) through wireless channel. Keywords are extracted from EHRs to describe health information, and an EHR can be described by multiple keywords. Then, these keywords form a keyword group, and the corresponding EHR is encrypted under a specific access policy. Finally, these encrypted EHRs are outsourced to the PC.(2)
Medical Staff (Data User). Medical staff, as data users, have their own specific set of attributes. Data users are authorized to search encrypted EHRs according to their set of attributes. A data user can generate keyword trapdoor and send it to the PC to realize data retrieval. As long as the search keywords are included in the keyword group describing the corresponding EHR and the user’s set of attributes satisfies the access policy, the searched encrypted EHR will be returned. Then, the user uses his/her private key to decrypt and verify the decrypted EHR to ensure the correctness of EHR.(3)
PC. PC has almost unlimited storage space and computing power, which can be used to store encrypted EHRs and respond to users’ data retrieval requests. In SMKS-AC, PC first verifies whether the keywords in the retrieval request are in the keyword group of the retrieved data. Then, the PC helps transform the retrieved ciphertext into a ciphertext that users can decrypt through lightweight computing.(4)
KGC. KGC generates public parameters for the whole system and distributes private key to each data user. The user’s attributes set is embedded in the private key to implement access control. When the user’s private key is maliciously disclosed, KGC can trace the identity of the private key holder and add it to the revocation list.Figure 1
System model.


### 4.2. Security Requirements

In WBAN, in order to ensure the availability, privacy, and security of EHRs, a secure data access control scheme supporting multi‐keyword search needs to meet the following security requirements.


#### 4.2.1. Confidentiality of EHRs

The EHRs should be encrypted before being outsourced to the PC for remote storage. Only when the user’s set of attributes meets the access policy in the ciphertext, the data can be decrypted by the user.


#### 4.2.2. Accuracy of Retrieved EHRs

When the users retrieve data, there will be a lot of redundant data in the single keyword search results. Thus, it is necessary to use multi‐keyword search to improve the accuracy of retrieval results.


#### 4.2.3. Verifiability of EHRs

Since the ciphertext is outsourced to PC, in order to prevent PC from tampering with the ciphertext, data users need to verify the accuracy of the retrieved data after decrypting with their own private key.


## 4.1. System Model

As shown in Figure1, the system of SMKS-AC mainly consists of the following four types of entities: data owner, medical staff who are regarded as data users, public cloud (PC), and key generation center (KGC).(1)
WBAN (Data Owner). WBAN contains many sensors, which are embedded or worn on patients to collect medical data. The collected data are aggregated and transmitted to personal digital assistant (PDA) through wireless channel. Keywords are extracted from EHRs to describe health information, and an EHR can be described by multiple keywords. Then, these keywords form a keyword group, and the corresponding EHR is encrypted under a specific access policy. Finally, these encrypted EHRs are outsourced to the PC.(2)
Medical Staff (Data User). Medical staff, as data users, have their own specific set of attributes. Data users are authorized to search encrypted EHRs according to their set of attributes. A data user can generate keyword trapdoor and send it to the PC to realize data retrieval. As long as the search keywords are included in the keyword group describing the corresponding EHR and the user’s set of attributes satisfies the access policy, the searched encrypted EHR will be returned. Then, the user uses his/her private key to decrypt and verify the decrypted EHR to ensure the correctness of EHR.(3)
PC. PC has almost unlimited storage space and computing power, which can be used to store encrypted EHRs and respond to users’ data retrieval requests. In SMKS-AC, PC first verifies whether the keywords in the retrieval request are in the keyword group of the retrieved data. Then, the PC helps transform the retrieved ciphertext into a ciphertext that users can decrypt through lightweight computing.(4)
KGC. KGC generates public parameters for the whole system and distributes private key to each data user. The user’s attributes set is embedded in the private key to implement access control. When the user’s private key is maliciously disclosed, KGC can trace the identity of the private key holder and add it to the revocation list.Figure 1
System model.


## 4.2. Security Requirements

In WBAN, in order to ensure the availability, privacy, and security of EHRs, a secure data access control scheme supporting multi‐keyword search needs to meet the following security requirements.


### 4.2.1. Confidentiality of EHRs

The EHRs should be encrypted before being outsourced to the PC for remote storage. Only when the user’s set of attributes meets the access policy in the ciphertext, the data can be decrypted by the user.


### 4.2.2. Accuracy of Retrieved EHRs

When the users retrieve data, there will be a lot of redundant data in the single keyword search results. Thus, it is necessary to use multi‐keyword search to improve the accuracy of retrieval results.


### 4.2.3. Verifiability of EHRs

Since the ciphertext is outsourced to PC, in order to prevent PC from tampering with the ciphertext, data users need to verify the accuracy of the retrieved data after decrypting with their own private key.


## 4.2.1. Confidentiality of EHRs

The EHRs should be encrypted before being outsourced to the PC for remote storage. Only when the user’s set of attributes meets the access policy in the ciphertext, the data can be decrypted by the user.


## 4.2.2. Accuracy of Retrieved EHRs

When the users retrieve data, there will be a lot of redundant data in the single keyword search results. Thus, it is necessary to use multi‐keyword search to improve the accuracy of retrieval results.


## 4.2.3. Verifiability of EHRs

Since the ciphertext is outsourced to PC, in order to prevent PC from tampering with the ciphertext, data users need to verify the accuracy of the retrieved data after decrypting with their own private key.


## 5. A SMKS-AC Construction

In this section, we present a SMKS-AC construction and depict the running procedure in Figure2.Figure 2
The flow of SMKS-AC construction.


### 5.1. System Setup

Letg∈G1 be a generator of group G1 of prime order p. Let e:G1×G1⟶G2 be a bilinear map, H:0,1∗⟶ℤp∗ and H1:0,1∗⟶κ be two collision-resistant hash functions, and κ be the key space of the symmetric encryption algorithm (i.e., AES, DES, and so on). KGC selects random elements α,a,λ,τ∈ℤp∗ and k1∈κ and computes(1)f=gτ,Y=eg,gα,Y0=eg,f,h=gλ.The public parameter and the master secret key of the system arePP=g,p,e,h,f,Y,Y0,ga,fa,H,H1 and MSK=α,a,λ,τ,k1, respectively.


### 5.2. Key Generation

Letid be the user’s identity and S=ξ1,ξ2,…,ξk⊆ℤp∗ be the data user’s attributes set, where k represents the number of attributes in the attribute set. KGC selects random elements r,ϱ,u′,u″∈ℤp∗ and computes(2)δ=Enck1id,D1=gα/λ+δ,D2=δ,D3,i=gr/ξi+τ,D4=gα−ar/λ+δ,D5=ϱ,Ψ1=D1u′,Ψ2=D4ϱu″,Ψ3,i=D3,iϱu″.The public keyPKid,S and secret key SKid,S of the data user are PKid,S=Ψ1,Ψ2,Ψ3,ii∈k and SKid,S=D1,D2,D3,ii∈k,D4,D5,u′,u″, respectively.


### 5.3. Encryption

Data owner chooses keywords for an EHRm to form a keyword set KW=kw1,kw2,…,kwl1 and constructs the l1 degree polynomial:(3)φx=ηl1xl1+ηl1−1xl1−1+⋯+η0modp,where Hkw1,Hkw2,…,Hkwl1 are the l1 roots of φx=1. Let M be a l×n matrix and ρ be a function that associates Mi to attributes, where l and n represent the rows and columns of M, respectively, and Mi is the i-th row of M, i=1,2,…,l. Data owner randomly selects Υ∈G2∗ and computes(4)ζ=H1Υ,Cm=Encζm,s=Hm,Υ.Then, the data owner chooses a random vectorv⟶=s,y2,y3,…,ynT∈ℤpn, where y2,y3,…,yn∈ℤp∗ are random elements. For i∈l, the data owner computes(5)si=Mi⋅v⟶modp,selects random elements s′,s″∈ℤp∗, and calculates(6)C0=Υ⋅Ys,C1=gs,C2=hs,C3,i=ρisis′,C3,i′=sis″,C4=fas″,C5=Y0s′Yss′,C6=gas′,Cj=ηjs′,j∈0,1,…,l1.Then, the ciphertextCT=C0,C1,C2,C3,i,C3,i′i∈1,…,l,C4,C5,C6,Cjj∈0,1,…,l1,Cm and the access policy M,ρ are outsourced to PC.


### 5.4. Trapdoor Generation

If a data user wants to search for EHRs containing the keyword setKW′=kw1,kw2,…,kwl2, the user needs to construct keywords trapdoor TKW′. The data user chooses random elements u,u0∈ℤp∗ and computes(7)T0=u⋅u′−1,T1=u⋅u″−1,T2=D2,T3=u⋅u0⋅l2−1,T4=Y0u,T5,j=u0−1∑i=1l2Hkwij,j∈0,1,…,l1.The keyword trapdoorTKW′=T0,T1,T2,T3,T4,T5,jj∈0,1,…,l1 is sent to PC.


### 5.5. Transform

After receiving keywords trapdoorTKW′ from a data user, the PC first verifies whether the following equation is true:(8)T4⋅eΨ1T0,C1T2C2=C5T3∑j=0l1CjT5,j.If so, the PC outputs 1 meansKW′⊂KW. Otherwise, the PC outputs 0. And then, PC checks whether the attribute set S associated with TKW′ meets the access policy M,ρ associated with ciphertext CT.(1)
If the PC outputs 0 or the attribute setS associated with TKW′ does not satisfy the access policy M,ρ, the Transform algorithm aborts.(2)
If the PC outputs 1 andS associated with TKW′ satisfies M,ρ, the Transform algorithm continues as follows. Let I⊂l be I=i:ρi∈S, and there exists a set of constants ωi∈ℤpi∈I such that(9)∑i∈IωiMi=1,0,…,0.The PC computes(10)I′=eC6,∏i∈IΨ3,iC3,i⋅ωi⋅eC4,∏i∈IΨ3,iC3,i′⋅ωi,Γ=I′T1,Γ′=eΨ2,C1T2C2T1.Therefore,C′=Γ⋅Γ′=eg,gαϱsu.Finally, the transformed ciphertextCT′=C0,C′,Cm is sent back to the data user.


### 5.6. Decryption and Verification

After receiving the transformed ciphertextCT′=CT1,CT2,Cm, the data user calculates(11)Υ′=CT1CT21/uD5,ζ′=H1Υ′,m′=Decζ′Cm,(12)s1=Hm′,Υ′.If(13)CT1=Υ′⋅Ys1,(14)CT2=Ys1uD5,both hold, then m′ is outputted.


### 5.7. User Tracing

If the private key of some authorized user is leaked, KGC is able to perform the following two algorithms to track its real identity.


#### 5.7.1. Keycheck

SupposeS=ξ1,ξ2,…,ξk. KGC checks whether the private key SKid,S is in the form of D1,D2,D3,ii∈k,D4,D5,u′,u″, where D1,D3,i,D4∈G1 and D2,D5,u′,u″∈ℤp∗. Then, the KGC verifies the following equation:(15)eD4,h⋅gD2k⋅ega,∏i∈kD3,iξi⋅efa,∏i∈kD3,i=Yk.If it is satisfied, the algorithm outputs 1 or 0 otherwise.


#### 5.7.2. Trace

If theKeyCheck algorithm outputs 0, it means that the private key SKid,S does not need to be traced; in this case, the Trace algorithm outputs ⊥. Otherwise, KGC can use the master key MSK to recover the identity of the private key holder by calculating id=Deck1D2.


### 5.8. User Revocation

After theTrace algorithm is completed, the access right of the holder who leaked the private key SKid,S needs to be revoked. Therefore, KGC stores the component D2=δ of the key containing the user’s identity information on the PC. When a user sends a data retrieval request and submits keywords trapdoor TKW′, the PC checks whether the component D2=δ in TKW′ is in the revocation list. If so, the user’s data retrieval request is rejected.


## 5.1. System Setup

Letg∈G1 be a generator of group G1 of prime order p. Let e:G1×G1⟶G2 be a bilinear map, H:0,1∗⟶ℤp∗ and H1:0,1∗⟶κ be two collision-resistant hash functions, and κ be the key space of the symmetric encryption algorithm (i.e., AES, DES, and so on). KGC selects random elements α,a,λ,τ∈ℤp∗ and k1∈κ and computes(1)f=gτ,Y=eg,gα,Y0=eg,f,h=gλ.The public parameter and the master secret key of the system arePP=g,p,e,h,f,Y,Y0,ga,fa,H,H1 and MSK=α,a,λ,τ,k1, respectively.


## 5.2. Key Generation

Letid be the user’s identity and S=ξ1,ξ2,…,ξk⊆ℤp∗ be the data user’s attributes set, where k represents the number of attributes in the attribute set. KGC selects random elements r,ϱ,u′,u″∈ℤp∗ and computes(2)δ=Enck1id,D1=gα/λ+δ,D2=δ,D3,i=gr/ξi+τ,D4=gα−ar/λ+δ,D5=ϱ,Ψ1=D1u′,Ψ2=D4ϱu″,Ψ3,i=D3,iϱu″.The public keyPKid,S and secret key SKid,S of the data user are PKid,S=Ψ1,Ψ2,Ψ3,ii∈k and SKid,S=D1,D2,D3,ii∈k,D4,D5,u′,u″, respectively.


## 5.3. Encryption

Data owner chooses keywords for an EHRm to form a keyword set KW=kw1,kw2,…,kwl1 and constructs the l1 degree polynomial:(3)φx=ηl1xl1+ηl1−1xl1−1+⋯+η0modp,where Hkw1,Hkw2,…,Hkwl1 are the l1 roots of φx=1. Let M be a l×n matrix and ρ be a function that associates Mi to attributes, where l and n represent the rows and columns of M, respectively, and Mi is the i-th row of M, i=1,2,…,l. Data owner randomly selects Υ∈G2∗ and computes(4)ζ=H1Υ,Cm=Encζm,s=Hm,Υ.Then, the data owner chooses a random vectorv⟶=s,y2,y3,…,ynT∈ℤpn, where y2,y3,…,yn∈ℤp∗ are random elements. For i∈l, the data owner computes(5)si=Mi⋅v⟶modp,selects random elements s′,s″∈ℤp∗, and calculates(6)C0=Υ⋅Ys,C1=gs,C2=hs,C3,i=ρisis′,C3,i′=sis″,C4=fas″,C5=Y0s′Yss′,C6=gas′,Cj=ηjs′,j∈0,1,…,l1.Then, the ciphertextCT=C0,C1,C2,C3,i,C3,i′i∈1,…,l,C4,C5,C6,Cjj∈0,1,…,l1,Cm and the access policy M,ρ are outsourced to PC.


## 5.4. Trapdoor Generation

If a data user wants to search for EHRs containing the keyword setKW′=kw1,kw2,…,kwl2, the user needs to construct keywords trapdoor TKW′. The data user chooses random elements u,u0∈ℤp∗ and computes(7)T0=u⋅u′−1,T1=u⋅u″−1,T2=D2,T3=u⋅u0⋅l2−1,T4=Y0u,T5,j=u0−1∑i=1l2Hkwij,j∈0,1,…,l1.The keyword trapdoorTKW′=T0,T1,T2,T3,T4,T5,jj∈0,1,…,l1 is sent to PC.


## 5.5. Transform

After receiving keywords trapdoorTKW′ from a data user, the PC first verifies whether the following equation is true:(8)T4⋅eΨ1T0,C1T2C2=C5T3∑j=0l1CjT5,j.If so, the PC outputs 1 meansKW′⊂KW. Otherwise, the PC outputs 0. And then, PC checks whether the attribute set S associated with TKW′ meets the access policy M,ρ associated with ciphertext CT.(1)
If the PC outputs 0 or the attribute setS associated with TKW′ does not satisfy the access policy M,ρ, the Transform algorithm aborts.(2)
If the PC outputs 1 andS associated with TKW′ satisfies M,ρ, the Transform algorithm continues as follows. Let I⊂l be I=i:ρi∈S, and there exists a set of constants ωi∈ℤpi∈I such that(9)∑i∈IωiMi=1,0,…,0.The PC computes(10)I′=eC6,∏i∈IΨ3,iC3,i⋅ωi⋅eC4,∏i∈IΨ3,iC3,i′⋅ωi,Γ=I′T1,Γ′=eΨ2,C1T2C2T1.Therefore,C′=Γ⋅Γ′=eg,gαϱsu.Finally, the transformed ciphertextCT′=C0,C′,Cm is sent back to the data user.


## 5.6. Decryption and Verification

After receiving the transformed ciphertextCT′=CT1,CT2,Cm, the data user calculates(11)Υ′=CT1CT21/uD5,ζ′=H1Υ′,m′=Decζ′Cm,(12)s1=Hm′,Υ′.If(13)CT1=Υ′⋅Ys1,(14)CT2=Ys1uD5,both hold, then m′ is outputted.


## 5.7. User Tracing

If the private key of some authorized user is leaked, KGC is able to perform the following two algorithms to track its real identity.


### 5.7.1. Keycheck

SupposeS=ξ1,ξ2,…,ξk. KGC checks whether the private key SKid,S is in the form of D1,D2,D3,ii∈k,D4,D5,u′,u″, where D1,D3,i,D4∈G1 and D2,D5,u′,u″∈ℤp∗. Then, the KGC verifies the following equation:(15)eD4,h⋅gD2k⋅ega,∏i∈kD3,iξi⋅efa,∏i∈kD3,i=Yk.If it is satisfied, the algorithm outputs 1 or 0 otherwise.


### 5.7.2. Trace

If theKeyCheck algorithm outputs 0, it means that the private key SKid,S does not need to be traced; in this case, the Trace algorithm outputs ⊥. Otherwise, KGC can use the master key MSK to recover the identity of the private key holder by calculating id=Deck1D2.


## 5.7.1. Keycheck

SupposeS=ξ1,ξ2,…,ξk. KGC checks whether the private key SKid,S is in the form of D1,D2,D3,ii∈k,D4,D5,u′,u″, where D1,D3,i,D4∈G1 and D2,D5,u′,u″∈ℤp∗. Then, the KGC verifies the following equation:(15)eD4,h⋅gD2k⋅ega,∏i∈kD3,iξi⋅efa,∏i∈kD3,i=Yk.If it is satisfied, the algorithm outputs 1 or 0 otherwise.


## 5.7.2. Trace

If theKeyCheck algorithm outputs 0, it means that the private key SKid,S does not need to be traced; in this case, the Trace algorithm outputs ⊥. Otherwise, KGC can use the master key MSK to recover the identity of the private key holder by calculating id=Deck1D2.


## 5.8. User Revocation

After theTrace algorithm is completed, the access right of the holder who leaked the private key SKid,S needs to be revoked. Therefore, KGC stores the component D2=δ of the key containing the user’s identity information on the PC. When a user sends a data retrieval request and submits keywords trapdoor TKW′, the PC checks whether the component D2=δ in TKW′ is in the revocation list. If so, the user’s data retrieval request is rejected.


## 6. Scheme Analysis

### 6.1. Correctness and Security Analysis

This section analyzes and proves the correctness and security of SMKS-AC construction.Theorem 1.
The proposed SMKS-AC construction is correct.Proof.
In order to prove the correctness of the SMKS-AC construction, we only need to show that equations (8), (11), and (15) hold.
First, PC can determine whether the keyword setΚW′ searched by the data user satisfies ΚW′⊂ΚW by verifying equation (8), where ΚW is keyword set in CT. Since(16)T4⋅eΨ1T0,C1T2C2=Y0u⋅eD1u′⋅u⋅u′−1,gsδgλs=eg,fu⋅egαu/λ+δ,gλ+δs=eg,fu⋅eg,gαus,C5T3∑j=0l1CjT5,j=Y0s′Yss′u⋅u0⋅l2−1∑j=0l1ηj/s′⋅u0−1∑ℓ=1l2Hkwij=eg,f⋅eg,gαsu⋅l2−1∑j=0l1ηj⋅∑ℓ=1l2Hkwij=eg,f⋅eg,gαsu,we have ΚW′⊂ΚW.
Second, after receiving the PC’s transformed ciphertext, the data user can recover the random elementΥ by calculating equation (11), so as to decrypt and verify the message. Since C′=Γ⋅Γ′=I′T1⋅Γ′, we have(17)C0C′1/uD5=Υ⋅eg,gαseg,gαϱsu1/uϱ=Υ,where(18)I′=eC6,∏i∈IΨ3,iC3,i⋅ωi⋅eC4,∏i∈IΨ3,iC3,i′⋅ωi=ega,grϱu″∑i∈Iρisiωi/ξi+τ⋅egτa,grϱu″∑i∈Isiωi/ξi+τ=eg,garϱu″∑i∈Iρisiωi/ξi+τ+∑i∈Iτsiωi/ξi+τ=eg,garϱu″s,Γ′=eΨ2,C1T2C2T1=egα−ar/λ+δϱu″,gsλ+δuu″−1=eg,gα−arϱsu,C′=eg,garϱu′′sT1eg,gα−arϱsu=eg,garϱu″s⋅uu″−1eg,gα−arϱsu=eg,gαϱsu.
Third, if the data user sells the private key for profit, KGC can verify the authenticity of the sold key by verifying equation (15) to determine whether the identity of the user holding the private key is worth tracking due to(19)eD4,h⋅gD2k⋅ega,∏i∈kD3,iξi⋅efa,∏i∈kD3,i=egα−ar/λ+δ,gλgδk⋅ega,g∑i∈krξi/ξi+τ⋅egτa,g∑i∈kr/ξi+τ=eg,gα−ark⋅eg,gar⋅∑i∈kξi/ξi+τ⋅eg,gar⋅∑i∈kτ/ξi+τ=eg,gαk=Yk.
Therefore, the proposed SMKS-AC construction is correct.Theorem 2.
The proposed SMKS-AC construction can ensure the EHRs confidentiality. Under the DBDH assumption, the SMKS-AC construction is indistinguishable against chosen keyword and chosen plaintext attack (IND-CKCPA).Proof.
The form of ciphertextCT in the SMKS-AC construction is similar to that in [4]. Compared with the SMKS-AC construction, the data owners of [4] only extract one keyword in processing an EHR. In our construction, in order to improve the accuracy of the data retrieval by data users, the data owners of SMKS-AC construction are able to extract multiple keywords from an EHR. The specific proof of Theorem 2 is similar to Theorem 1 in [4]. Therefore, the SMKS-AC construction is IND-CKCPA secure.Theorem 3.
The proposed SMKS-AC construction can resist collusion attacks against multiple users.Proof.
In a multi-user system, collusion attack is an important attack type. Authorized users can collude with each other to generate a new key and gain extra privileges. Whereas in our solution, for each user, KGC selects a set of random numbers based on the user’s attributes to generate the user’s private key. Users who intend to collude with each other cannot combine their private keys to generate a new valid key. Since each user’s private key is generated by different random numbers, they are not compatible with each other. Therefore, the proposed SMKS-AC construction is secure against collusion attacks.


### 6.2. Comparison

This section compares SMKS-AC construction with existing schemes in terms of function, storage, and computation overheads. The comparison is shown in Tables1–3 , respectively.Table 1
Function comparison.
Access controlMulti-keyword searchVerify decryptionUser traceUser revocationYang et al.’s scheme [4]✓×✓✓✓Zhang et al.’s scheme [5]✓✓×××Wang et al.’s scheme [22]✓××××Wang et al.’s scheme [29]✓✓×××SMKS-AC scheme✓✓✓✓✓“✓” represents supported; “×” represents not supported.Table 2
Storage cost comparison.
PPSKCTTKW′Yang et al.’s scheme [4]5G1 + 2 G2S+1G1+5ℤp4G1+2G2+2lℤp7ℤpZhang et al.’s scheme [5]4G1+G2S+3G1+ℤpl+4G1+2G2+l1+4ℤpG1+G2+l1+2ℤpWang et al.’s scheme [22]5G12SG1+ℤpl+2G1+3G2+ℤp2G1+ℤpWang et al.’s scheme [29]4+UG1+3G23G1+ℤp2l+l1+4G1+G23+l1G1SMKS-AC scheme5G1+2G2S+2G1+4ℤp4G1+2G2+2l+l1ℤpG2+l1+4ℤpTable 3
Computation cost comparison.
Key generationEncryptionTrapdoorDecryptionYang et al.’s scheme [4]S+1E14E1+3E20E2Zhang et al.’s scheme [5]S+4E12l+4E1+3E2+3PE1+E2+PE2Wang et al.’s scheme [22]3E15E1+3E22E1E1+PWang et al.’s scheme [29]S+6E14+l+l1E1+E2+P3+l1E1E1+E2+PSMKS-AC schemeS+2E14E1+3E2E2E2As shown in Table1, in addition to the proposed SMKS-AC construction, both schemes [5, 29] provide multi‐keyword search function. Data users are allowed to verify the message after decryption in [4] and SMKS-AC construction. Since the user’s private key may be used maliciously, both [4] and the SMKS-AC construction provide user trace and user revocation functions, which are not considered in [5, 22, 29].The storage and computing resources of mobile devices in WBAN are limited. In practical applications, storage and computation costs on mobile devices need to be considered. LetPP, SK, CT, and TKW′ represent the sizes of the public parameter, private key of data user, ciphertext, and the keywords trapdoor, respectively. G1, G2, and ℤp denote the length of an element in groups G1, G2, and ℤp, respectively. Let S be the size of attribute set S, l be the number of rows in M, U be the size of the universe attribute set U, and l1 be the size of the keyword set KW. Besides, E1 and E2 represent exponentiation operations on groups G1 and G2, respectively. P is the symbol of bilinear pairing operation.Table2 shows the storage cost comparison. It can be seen that only the size of public parameter in Wang et al.’s scheme [29] is related to U, which is the number of all the attributes in the whole system. As the number of system attributes increases, the size of public parameter also increases, which do not meet the actual needs. Although the length of public parameters of schemes [5, 22] is smaller than that of SMKS-AC construction, the sizes of user’s private key, ciphertext, and the keywords trapdoor are, respectively, larger than those of SMKS-AC construction, which will increase the storage burden and data transmission time of mobile devices. Although private key size of scheme [29] is smaller than that of SMKS-AC construction, the sizes of ciphertext and the keywords trapdoor in SMKS-AC construction are, respectively, smaller than those of [29]. Note that the length of the elements in group ℤp is much smaller than that in group G. In addition, the sizes of private key, ciphertext and keywords trapdoor in SMKS-AC scheme are, respectively, larger than those in scheme [4]. The main reason is that the SMKS-AC construction realizes multi‐keyword search, which can ensure the accuracy of data retrieval, while scheme [4] can only support single keyword search.Table3 shows the computation cost comparison, where only the cost of exponentiation and bilinear pairing operations are considered. In the Key Generation algorithm, the KGC can use S+2 exponentiation operations on group G1 to get the user’s private key in SMKS-AC construction. Except for [4], other schemes require more computation than ours. The Encryption algorithm is executed on mobile devices with limited resources. In order to save storage space on mobile devices, the EHRs should be encrypted immediately and then transferred to the PC, which require high encryption efficiency. In our scheme and the scheme [4], only four exponentiation operations on group G1 and three exponentiation operations on group G2 are required to generate a ciphertext. However, the other schemes require other redundant operations overhead. Since the Trapdoor Generation and Decryption algorithms are executed on the user’s mobile device, a small amount of computations is required to get the keywords trapdoor and decryption data to meet the system needs. In addition, compared with the scheme [4] and our construction, the other schemes need to carry out bilinear pairing operations and exponentiation operations.


### 6.3. Experimental Analysis

In this section, we implement the code based on the Pairing-Based Cryptography Library (PBC-0.5.14,https://crypto.stanford.edu/pbc/). The experimental simulation is run on a virtual machine with 4-core 8 GB memory, 64 bit Linux Ubuntu 18.04.5 operating system, and Intel (R) Core (TM) i5-8265U CPU @ 1.60 GHz 1.80 GHz. The element of cyclic group is 512 bits, and the length of p is 160 bits.Figure3 compares the running time of each phase in SMKS-AC construction with that in other schemes. Since other schemes had no trace and revocation phases, we only compared the time of Key Generation algorithm, Encryption algorithm, Trapdoor Generation algorithm, Transform algorithm, and Decryption algorithm. Due to the limited resources of mobile devices, it is particularly necessary to consider the complexity of algorithms executed by data owners and users.Figure 3
Computation overhead. (a) Key Generation time. (b) Encryption time. (c) Trapdoor Generation time. (d) Transform time. (e) Decryption time.
(a)(b)(c)(d)(e)Figure3(a) shows the time required for the Key Generation algorithm, which is executed by the KGC. It can be seen that the scheme in [22] takes the least time to generate the key. With the increase in the number of attributes, the time required remains unchanged. However, our SMKS-AC construction generates different keys for different attributes in the attribute set of data users; thus, the time user key generation will increase as the number of attributes in the attribute set increases.Figure3(b) indicates the time required for the data owner to execute the Encryption algorithm. The computational cost of SMKS-AC construction and the scheme in [22] roughly keeps constant, while the computational cost of [5] is increasing dynamically. The main reason is that the generation time of ciphertext in scheme [5] is related to the number of rows in matrix M. As the number of rows increases, the time to run the Encryption algorithm also increases.It can be seen from Figure3(c) that the time cost of the Trapdoor Generation algorithm has nothing to do with the number of attributes, and the generation time of trapdoor by SMKS-AC construction is shorter than that of the existing schemes. Note that the SMKS-AC construction and scheme [5] support multi‐keyword search to improve the search accuracy, while scheme [22] only supports single keyword search.As indicated in Figure3(d), the SMKS-AC construction takes more time than the existing schemes. It is worth noting that the Transform algorithm is implemented by the PC, which has almost unlimited computing power and resources.Figure3(e) shows the decryption time of encrypted data by data users. The SMKS-AC construction takes almost the same decryption time as the scheme [5], and scheme [22] takes relatively much time. Also, the SMKS-AC construction satisfies the verification on the message after decryption.


## 6.1. Correctness and Security Analysis

This section analyzes and proves the correctness and security of SMKS-AC construction.Theorem 1.
The proposed SMKS-AC construction is correct.Proof.
In order to prove the correctness of the SMKS-AC construction, we only need to show that equations (8), (11), and (15) hold.
First, PC can determine whether the keyword setΚW′ searched by the data user satisfies ΚW′⊂ΚW by verifying equation (8), where ΚW is keyword set in CT. Since(16)T4⋅eΨ1T0,C1T2C2=Y0u⋅eD1u′⋅u⋅u′−1,gsδgλs=eg,fu⋅egαu/λ+δ,gλ+δs=eg,fu⋅eg,gαus,C5T3∑j=0l1CjT5,j=Y0s′Yss′u⋅u0⋅l2−1∑j=0l1ηj/s′⋅u0−1∑ℓ=1l2Hkwij=eg,f⋅eg,gαsu⋅l2−1∑j=0l1ηj⋅∑ℓ=1l2Hkwij=eg,f⋅eg,gαsu,we have ΚW′⊂ΚW.
Second, after receiving the PC’s transformed ciphertext, the data user can recover the random elementΥ by calculating equation (11), so as to decrypt and verify the message. Since C′=Γ⋅Γ′=I′T1⋅Γ′, we have(17)C0C′1/uD5=Υ⋅eg,gαseg,gαϱsu1/uϱ=Υ,where(18)I′=eC6,∏i∈IΨ3,iC3,i⋅ωi⋅eC4,∏i∈IΨ3,iC3,i′⋅ωi=ega,grϱu″∑i∈Iρisiωi/ξi+τ⋅egτa,grϱu″∑i∈Isiωi/ξi+τ=eg,garϱu″∑i∈Iρisiωi/ξi+τ+∑i∈Iτsiωi/ξi+τ=eg,garϱu″s,Γ′=eΨ2,C1T2C2T1=egα−ar/λ+δϱu″,gsλ+δuu″−1=eg,gα−arϱsu,C′=eg,garϱu′′sT1eg,gα−arϱsu=eg,garϱu″s⋅uu″−1eg,gα−arϱsu=eg,gαϱsu.
Third, if the data user sells the private key for profit, KGC can verify the authenticity of the sold key by verifying equation (15) to determine whether the identity of the user holding the private key is worth tracking due to(19)eD4,h⋅gD2k⋅ega,∏i∈kD3,iξi⋅efa,∏i∈kD3,i=egα−ar/λ+δ,gλgδk⋅ega,g∑i∈krξi/ξi+τ⋅egτa,g∑i∈kr/ξi+τ=eg,gα−ark⋅eg,gar⋅∑i∈kξi/ξi+τ⋅eg,gar⋅∑i∈kτ/ξi+τ=eg,gαk=Yk.
Therefore, the proposed SMKS-AC construction is correct.Theorem 2.
The proposed SMKS-AC construction can ensure the EHRs confidentiality. Under the DBDH assumption, the SMKS-AC construction is indistinguishable against chosen keyword and chosen plaintext attack (IND-CKCPA).Proof.
The form of ciphertextCT in the SMKS-AC construction is similar to that in [4]. Compared with the SMKS-AC construction, the data owners of [4] only extract one keyword in processing an EHR. In our construction, in order to improve the accuracy of the data retrieval by data users, the data owners of SMKS-AC construction are able to extract multiple keywords from an EHR. The specific proof of Theorem 2 is similar to Theorem 1 in [4]. Therefore, the SMKS-AC construction is IND-CKCPA secure.Theorem 3.
The proposed SMKS-AC construction can resist collusion attacks against multiple users.Proof.
In a multi-user system, collusion attack is an important attack type. Authorized users can collude with each other to generate a new key and gain extra privileges. Whereas in our solution, for each user, KGC selects a set of random numbers based on the user’s attributes to generate the user’s private key. Users who intend to collude with each other cannot combine their private keys to generate a new valid key. Since each user’s private key is generated by different random numbers, they are not compatible with each other. Therefore, the proposed SMKS-AC construction is secure against collusion attacks.


## 6.2. Comparison

This section compares SMKS-AC construction with existing schemes in terms of function, storage, and computation overheads. The comparison is shown in Tables1–3 , respectively.Table 1
Function comparison.
Access controlMulti-keyword searchVerify decryptionUser traceUser revocationYang et al.’s scheme [4]✓×✓✓✓Zhang et al.’s scheme [5]✓✓×××Wang et al.’s scheme [22]✓××××Wang et al.’s scheme [29]✓✓×××SMKS-AC scheme✓✓✓✓✓“✓” represents supported; “×” represents not supported.Table 2
Storage cost comparison.
PPSKCTTKW′Yang et al.’s scheme [4]5G1 + 2 G2S+1G1+5ℤp4G1+2G2+2lℤp7ℤpZhang et al.’s scheme [5]4G1+G2S+3G1+ℤpl+4G1+2G2+l1+4ℤpG1+G2+l1+2ℤpWang et al.’s scheme [22]5G12SG1+ℤpl+2G1+3G2+ℤp2G1+ℤpWang et al.’s scheme [29]4+UG1+3G23G1+ℤp2l+l1+4G1+G23+l1G1SMKS-AC scheme5G1+2G2S+2G1+4ℤp4G1+2G2+2l+l1ℤpG2+l1+4ℤpTable 3
Computation cost comparison.
Key generationEncryptionTrapdoorDecryptionYang et al.’s scheme [4]S+1E14E1+3E20E2Zhang et al.’s scheme [5]S+4E12l+4E1+3E2+3PE1+E2+PE2Wang et al.’s scheme [22]3E15E1+3E22E1E1+PWang et al.’s scheme [29]S+6E14+l+l1E1+E2+P3+l1E1E1+E2+PSMKS-AC schemeS+2E14E1+3E2E2E2As shown in Table1, in addition to the proposed SMKS-AC construction, both schemes [5, 29] provide multi‐keyword search function. Data users are allowed to verify the message after decryption in [4] and SMKS-AC construction. Since the user’s private key may be used maliciously, both [4] and the SMKS-AC construction provide user trace and user revocation functions, which are not considered in [5, 22, 29].The storage and computing resources of mobile devices in WBAN are limited. In practical applications, storage and computation costs on mobile devices need to be considered. LetPP, SK, CT, and TKW′ represent the sizes of the public parameter, private key of data user, ciphertext, and the keywords trapdoor, respectively. G1, G2, and ℤp denote the length of an element in groups G1, G2, and ℤp, respectively. Let S be the size of attribute set S, l be the number of rows in M, U be the size of the universe attribute set U, and l1 be the size of the keyword set KW. Besides, E1 and E2 represent exponentiation operations on groups G1 and G2, respectively. P is the symbol of bilinear pairing operation.Table2 shows the storage cost comparison. It can be seen that only the size of public parameter in Wang et al.’s scheme [29] is related to U, which is the number of all the attributes in the whole system. As the number of system attributes increases, the size of public parameter also increases, which do not meet the actual needs. Although the length of public parameters of schemes [5, 22] is smaller than that of SMKS-AC construction, the sizes of user’s private key, ciphertext, and the keywords trapdoor are, respectively, larger than those of SMKS-AC construction, which will increase the storage burden and data transmission time of mobile devices. Although private key size of scheme [29] is smaller than that of SMKS-AC construction, the sizes of ciphertext and the keywords trapdoor in SMKS-AC construction are, respectively, smaller than those of [29]. Note that the length of the elements in group ℤp is much smaller than that in group G. In addition, the sizes of private key, ciphertext and keywords trapdoor in SMKS-AC scheme are, respectively, larger than those in scheme [4]. The main reason is that the SMKS-AC construction realizes multi‐keyword search, which can ensure the accuracy of data retrieval, while scheme [4] can only support single keyword search.Table3 shows the computation cost comparison, where only the cost of exponentiation and bilinear pairing operations are considered. In the Key Generation algorithm, the KGC can use S+2 exponentiation operations on group G1 to get the user’s private key in SMKS-AC construction. Except for [4], other schemes require more computation than ours. The Encryption algorithm is executed on mobile devices with limited resources. In order to save storage space on mobile devices, the EHRs should be encrypted immediately and then transferred to the PC, which require high encryption efficiency. In our scheme and the scheme [4], only four exponentiation operations on group G1 and three exponentiation operations on group G2 are required to generate a ciphertext. However, the other schemes require other redundant operations overhead. Since the Trapdoor Generation and Decryption algorithms are executed on the user’s mobile device, a small amount of computations is required to get the keywords trapdoor and decryption data to meet the system needs. In addition, compared with the scheme [4] and our construction, the other schemes need to carry out bilinear pairing operations and exponentiation operations.


## 6.3. Experimental Analysis

In this section, we implement the code based on the Pairing-Based Cryptography Library (PBC-0.5.14,https://crypto.stanford.edu/pbc/). The experimental simulation is run on a virtual machine with 4-core 8 GB memory, 64 bit Linux Ubuntu 18.04.5 operating system, and Intel (R) Core (TM) i5-8265U CPU @ 1.60 GHz 1.80 GHz. The element of cyclic group is 512 bits, and the length of p is 160 bits.Figure3 compares the running time of each phase in SMKS-AC construction with that in other schemes. Since other schemes had no trace and revocation phases, we only compared the time of Key Generation algorithm, Encryption algorithm, Trapdoor Generation algorithm, Transform algorithm, and Decryption algorithm. Due to the limited resources of mobile devices, it is particularly necessary to consider the complexity of algorithms executed by data owners and users.Figure 3
Computation overhead. (a) Key Generation time. (b) Encryption time. (c) Trapdoor Generation time. (d) Transform time. (e) Decryption time.
(a)(b)(c)(d)(e)Figure3(a) shows the time required for the Key Generation algorithm, which is executed by the KGC. It can be seen that the scheme in [22] takes the least time to generate the key. With the increase in the number of attributes, the time required remains unchanged. However, our SMKS-AC construction generates different keys for different attributes in the attribute set of data users; thus, the time user key generation will increase as the number of attributes in the attribute set increases.Figure3(b) indicates the time required for the data owner to execute the Encryption algorithm. The computational cost of SMKS-AC construction and the scheme in [22] roughly keeps constant, while the computational cost of [5] is increasing dynamically. The main reason is that the generation time of ciphertext in scheme [5] is related to the number of rows in matrix M. As the number of rows increases, the time to run the Encryption algorithm also increases.It can be seen from Figure3(c) that the time cost of the Trapdoor Generation algorithm has nothing to do with the number of attributes, and the generation time of trapdoor by SMKS-AC construction is shorter than that of the existing schemes. Note that the SMKS-AC construction and scheme [5] support multi‐keyword search to improve the search accuracy, while scheme [22] only supports single keyword search.As indicated in Figure3(d), the SMKS-AC construction takes more time than the existing schemes. It is worth noting that the Transform algorithm is implemented by the PC, which has almost unlimited computing power and resources.Figure3(e) shows the decryption time of encrypted data by data users. The SMKS-AC construction takes almost the same decryption time as the scheme [5], and scheme [22] takes relatively much time. Also, the SMKS-AC construction satisfies the verification on the message after decryption.


## 7. Conclusion

In WBAN, in order to achieve secure sharing of outsourced EHRs with a large number of users, we proposed a SMKS-AC construction supporting secure multi‐keyword search and access control. SMKS-AC provides fine-grained access control and verifiability of decrypted EHRs, multi‐keyword search over encrypted EHRs, user’s identity tracking, and revocation. Security analysis showed that the SMKS-AC construction can resist chosen keyword and chosen plaintext attacks and collusion attacks. Theoretical analysis and experiments demonstrate that our SMKS-AC construction is more effective and takes lower computational cost than existing related solutions.



---

*Source: 9520941-2021-09-29.xml*