An Attribute-Based Encryption Scheme with Revocation for Fine-Grained Access Control in Wireless Body Area Networks

Abstract

The wireless body area networks (WBANs) have emerged as a new method for e-healthcare. Without being measured face-to-face, the medical workers can give guidance to patients in a real-time way. WBANs can greatly improve the healthcare quality. The personal information and medical data are stored and processed in sensors. The security and privacy are two vital issues. In this paper, we design an attribute-based encryption scheme for fine-grained access control in WBANs. In our scheme, a user can decrypt a ciphertext if the attributes related with a ciphertext satisfy the user's access structure. The users can be revoked if necessary. Therefore, the security and privacy of patients can be protected. Our scheme provides confidentiality, security, and resistance to collusion attack. We analyze the correctness, security, and energy consumption of the scheme.

1. Introduction

Wireless body area networks (WBANs) are gaining popularity rapidly in recent years, especially in the area of medical use, such as healthcare monitoring, medical treatment, and emergency medical response systems (EMRS) which greatly increase the efficiency of healthcare. A typical WBAN consists of a controller and a number of sensors, which are wearable or can be implanted into human body to monitor the body parameters (e.g., electrocardiogram (ECG), heart rate, blood pressure, and blood glucose), the surrounding environments parameters (e.g., temperature, humidity, and location), and the movements of body. WBANs can be used in pervasive and real-time monitoring of the status of patients in the form of text, visual, or audio, and so forth. Home monitoring is a good choice for chronic patients and old people, as it frees patients from visiting the hospital frequently. Sensor nodes and users are mobile in the sense that they can move, be relocated to another position, or be associated with other nodes or users [1]. Figure 1 shows the general healthcare system of a WBAN. The sensors are used to measure certain parameters of human body and send these signals to a controller, which may be a mobile phone or a PDA [2]. These medical data will be processed in the controller, and the controller can give guidance to other devices. For example, in the diabetes monitoring, the glucose sensors monitor and transmit blood glucose levels to the controller for insulin release. The medical data can be stored locally in WBANs or be transferred remotely to the doctors, emergency medical response, or database of patients through internet using WiFi, Bluetooth, or Zigbee, and so forth. The remoter can give guidance to the patients or healthcare staff.

Figure 1

A general healthcare system of WBAN.

Security and privacy are two major concerns in WBANs. Since the medical data stored in WBANs are sensitive, it is essential to ensure the security of these data. Obtaining inaccurate and wrong medical data will possibly make the therapy ineffective or even lead to wrong treatments [3]. We summarize two threats and possible consequences in WBANs.

• (1)

Eavesdropping Threats. The attackers may eavesdrop on the information of patients; thus, this may cause the privacy issues. For example, a patient has an embarrassing disease or a patient may want to keep medical information out from insurance. For another example, the location of patients can be found by a criminal minded person, so this threat is of vital importance. Data confidentiality is an important requirement in healthcare applications using WBANs.

(2)

Modification Threats. The data transferred is vital for patients as the modified information may lead to wrong diagnosis. The nature of wireless makes the data prone to being lost. Thus, in order to ensure that the received data has not been modified by an adversary, there should be proper data integrity mechanisms.

So, the users who want to access the patient-related data must be strictly limited; otherwise, the privilege of patients could not be protected. In order to enforce the access control, data encryption is needed to protect the patient-related data. The traditional methods are symmetric key cryptography (SKC) and public key cryptography (PKC) systems. In SKC scheme, the sender and receiver use the same key. If an attacker compromises a node, he can get all the data stored in the node. A solution to this problem is dividing the lifetime of sensors into series of periods. During different periods different keys are used, but this needs updating the keys timely and increasing the load of sensors. In PCK scheme, any patient-related data is encrypted by a public key and only the users who have the corresponding master key can decrypt the data. This general scheme is simple to implement but inefficient as the number of encryption operations and the size of ciphertexts both of which are linear with the number of users. So when the number of users increases, the cost of key distribution will be high. A better way to solve the problem is broadcast encryption. The sender specifies the receivers and broadcasts the keys to the revoked users. Although the broadcast encryption is efficient, the sender needs to store the list of receivers, and this will increase the storage space.

We design a security mechanism for access control, data encryption, and user revocation in WBANs. The major users in a typical WBAN are different doctors, nurses, healthcare staff, and medical insurance response systems. The patient may not know the exact users who are able to access the data but rather has a way to describe them in terms of descriptive attributes or credentials [4]. Attribute-based encryption (ABE) is suitable to encrypt messages without exact knowledge of the receivers.

Besides security and privacy, another issue which should be considered in WBANs is resource constraints. The sensors are limited in energy, storage space, and computational capability, and the lifetime of a battery is restricted. In order to reduce the energy consumption, it is necessary to build limited size of security mechanism. The energy consumption of sensing and computation are usually so small that they are almost negligible compared to the expensive cost of communication in WBANs; for example, according to the report of NAI Labs [5], the energy consumption of sending data is 0.0.2 mJ/bit and receiving data is 0.014 mJ/bit; however, the energy consumption used in accomplishing SHA-1 is 0.0000072 mJ/bit on the same MIPS processer. So, there should be as less transmitting as possible.

This paper makes contributions as follows. Firstly, we design the access tree structures of users. Secondly, we develop the encryption algorithms for fine-grained access control in WBANs. Thirdly, we introduce the user revocation algorithm. Fourthly, we evaluate the performance of our scheme.

2. Related Work

Security and privacy of patient-related data are two indispensable components in WBANs. Security means that data is securely stored and transferred, and privacy means that the people who have authorization can access, view, and use the data [2]. There are two main methods about the security and privacy protection in WBANs.

(1) Key Distribution in WBANs. The researches in [6–9] use the biometric signal (such as electrocardiograph) as the key to encrypt the medical data which is to be transferred, and the receiver has the same key to decrypt the data. For the advantage of biometric signal, this method ensures the security of transferred data, and testability makes the method applicable widely, but this method also has drawbacks. When the attackers get the biometric signal of patient, they can decrypt all the data which is encrypted by the signal, and this will leak the privacy of patients. In order to capture the biometric signal, there is a need to attach the biometric sensor to a body sensor node, but this will increase the cost.

(2) Data Storage and Access Control. The authors in [3] proposed the concept of secure storage and data access control in WBANs and summarized the methods of secure and privacy protection, but this paper did not analyze and compare the energy consumption. The research in [10] develops a distributed data access control scheme, in which the ciphertext is associated with attributes and the key is associated with access structure. The access structure identifies the ciphertext which can be decrypted by the key. In that paper, the users access data in a fine-grained way, but it lacks the timeliness of access control. In [11], the important multisender broadcast authentication problem is solved in WSNs. In [12], the authors proposed a fuzzy attribute-based signcryption scheme. Their scheme leverages fuzzy attribute-based encryption to enable data encryption, access control, and digital signature for a patient's medical information in a WBAN. For using the signature, it is complicated in the message transmission, and the energy consumption should be considered. In [13], the authors proposed an identity-based encryption scheme for WBANs; however, their scheme lacked the access control feature.

ABE is considered suitable for access control in WBANs, because it reduces the cost between the sensors and users. In [14] the authors first introduced the idea of ABE based on fuzzy identity-based encryption (FIBE) which was built on the idea of identity-based encryption (IBE). The identity of users can be described by strings, such as email address: [e-mail]. In FIBE, the senders can encrypt the ciphertext by a public key, ${\omega }^{\prime }$ . A user has a master key with the identity ω. When the users access the medical data, if and only if ω includes at least k parameters similar to ${\omega }^{\prime }$ , they can decrypt the ciphertext. The scheme has the tolerance ability as the ω and ${\omega }^{\prime }$ need not be the same, and there is no need to obtain the certificate of receivers, so it reduces the energy cost of authentication.

In ABE, identity consists of attributes; for example, the attributes set of a doctor is {hospital, department, on duty}. Both the ciphertext and keys are associated with attributes. The ABE has two variants, key policy ABE (KP-ABE) [15] and ciphertext policy ABE (CP-ABE) [16]. In KP-ABE, the ciphertext is associated with the attributes and the key is associated with an access structure. Decryption is enabled if and only if the attributes associated with a ciphertext satisfy the key's access structure. However, in CP-ABE, the situation is reversed: the ciphertext is associated with access structure and the key is associated with attributes.

In this paper, we consider the security and privacy of WBANs by designing a fine-grained access control scheme. The medical data is encrypted by attributes and only when these attributes satisfy the key's access structure, the users can decrypt it. The patients may not know the doctors or nurses, but they can explicit the attributes which should be satisfied for the users. A user will be able to decrypt the medical data if the attributes satisfy the access structure.

User management is an important issue since malicious users are dangerous to WBANs. If some users need to be revoked, such as changing the medical workers and finding some malicious users, they will lose their capability of decryption, while the capability of nonrevoked users remains valid. Some researches propose different methods to solve the problem. The authors in [17] proposed to renew the user's master key periodically, but the users' privilege of accessing the data would expire after a time. This method will fail when the malicious users access the data before the expired time. In [18], the sensor nodes encrypt the data using the identity attributes which are not owned by the revoked users; therefore, only the nonrevoked users can decrypt the data. However, all the revoked users in the history are recorded in the ciphertext, so the ciphertext size will be very large.

The rest of this paper is organized as follows. Section 3 introduces the preliminaries of the scheme. Section 4 presents the system model. Section 5 analyzes the scheme, including the correctness, security, and energy consumption. Section 6 overviews the conclusion and future work.

3. Preliminaries

3.1. Bilinear Maps

Let $G_1$ and $G_2$ be two groups of prime order p and g a generator of $G_1$ . A bilinear map is an injective function $e:G_1\times G_1\to G_2$ with the following properties.

• (a)

Bilinearity: $\forall u,v\in G_1$ , $a,b\in Z_p$ , there is $e(u^a,v^b)={e(u,v)}^{ab}$ .

(b)

Nondegeneracy: $e(g,g)\ne 1$ .

(c)

Computability: there is an efficient algorithm to compute $e\left(u,v\right)$ for each $u\in G_1$ and $v\in G_2$ .

3.2. Bilinear Diffie-Hellman Problem (BDHP)

Given two groups $G_1$ and $G_2$ with the same prime order p, let $e:G_1\times G_1\to G_2$ be a bilinear map and g a generator of $G_1$ . The objective of BDHP is to compute ${e(g,g)}^{abc}$ in ( $G_1,G_2,e$ ) from the given $(g,g^a,g^b,g^c)$ , where $a,b,c\in Z_p$ .

3.3. Decisional Bilinear Diffie-Hellman Problem (DBDHP)

Given $a,b,c\in Z_p$ , $g^a,g^b{,g}^c\in G_1$ , and $h\in G_2$ , the objective is to decide whether ${h=e(g,g)}^{abc}$ .

3.4. Key Policy Scheme

Usually, the key policy scheme consists of 4 steps.

• (1)

Setup. According to the random numbers produced by the system, the scheme generates the public parameters PK and a master key MK. PK is used to encrypt message by senders. MK is used to generate decryption keys.

(2)

Encryption. The plaintext M is encrypted using the attributes and PK. It outputs the ciphertext E.

(3)

Key Generation. It takes the access structure, master key MK, and the public parameters PK as input. It outputs the decryption key DK.

(4)

Decryption. The ciphertext E is decrypted by the decryption key DK for access control structure and outputs the plaintext M.

3.5. Security Game for ABE

We define the security game for our scheme. The game can be described as follows.

•  

Init: the adversary commits the attributes set γ to the challenger.

 

Setup: the challenger runs the Setup algorithm and gives the public parameters (PK) to the adversary.

 

Phase 1: the adversary submits queries for master keys for access structures $A_i$ , where, for all i, $\gamma \notin A_i$ .

 

Challenge: the adversary submits two equal length messages $M_0$ and $M_1$ to the challenger. The challenger flips a random coin b and passes the ciphertext $M_b$ encrypted with γ to the adversary.

 

Phase 2: phase 1 is repeated.

 

Guess: the adversary outputs a guess $b^{\prime }$ of b.

The advantage of an adversary A in this game is defined as $\mathrm{Pr}\left[b^{\prime }=b\right]-\mathrm{1}/\mathrm{2}$ .

This game can be extended to handle chosen-ciphertext attacks by allowing for decryption queries in phases 1 and 2.

3.6. Access Tree

Access tree expresses the structure of access control. Ciphertext is associated with attributes. Decryption key is labeled with an access tree structure, in which each nonleaf node is the threshold gate described by a threshold value and its children and each leaf node is labeled with attributes. A user can decrypt a ciphertext with a given key if and only if there is an assignment of attributes from the ciphertext to nodes of the tree such that the tree is satisfied.

Let $\mathcal{T}$ be an access tree with root r and attr(x) the attributes associated with the leaf node x. If $\text{nu}{\text{m}}_x$ is the number of children of node x and $k_x$ is its threshold value, then $0<\text{nu}{\text{m}}_x⩽k_x$ . When $k_x=1$ , the threshold gate is an OR gate; when $k_x={\text{num}}_x$ , it is an AND gate. Each leaf node x of the tree is described by an attribute. Denote the subtree of $\mathcal{T}$ rooted as the node x by ${\mathcal{T}}_{x}$ . Hence ${\mathcal{T}}_{x}$ is the same as $\mathcal{T}$ . If a set of attributes satisfy the access tree ${\mathcal{T}}_{x}$ , we denote it by ${\mathcal{T}}_{x}(\gamma )=1$ . ${\mathcal{T}}_{x}(\gamma )$ can be computed recursively as follows: if x is a nonleaf node, evaluate ${\mathcal{T}}_{x^{\prime }}(\gamma )$ for all children $x^{\prime }$ of node x. ${\mathcal{T}}_{x}(\gamma )$ returns  1 if and only if at least $k_x$ children return  1. If x is a leaf node, then ${\mathcal{T}}_{x}(\gamma )$ returns 1 if and only if $\text{attr}(x)\in \gamma$ .

When the attributes associated with the ciphertext satisfy the users' access structures, the users can get the medical data. Figure 2 shows an example of the access tree structure. Every no-leaf node is assigned with a threshold. The ciphertext which has at least k attributes can be decrypted by the users. For example, a ciphertext has the following attributes {hospital m, physician, on duty}. Hospital m refers to which hospital the doctor belonged to. On duty indicates whether the doctor is on duty that time. If the attributes related with ciphertext satisfies the access tree, the doctor can get the patient's medical data and give treatments to the patient. The same is true for a nurse, healthcare staff, and medical insurance company agents or emergency room.

Figure 2

An example of access structure.

4. System Model

4.1. Definition

We consider a typical WBAN consisting of a number of sensors denoted by $S=\{s_1,s_2,\dots ,s_m\}$ , n users denoted by $U=\{u_1,u_2,\dots ,u_n\}$ , and the number of users denoted by $N_{\text{user}}$ . Let G be a bilinear group of prime order p and g the generator of G. We define the Lagrange coefficient ${\Delta }_{i,S}$ for $i\in Z_p$ and a set, S, of elements in $Z_p:{\Delta }_{i,S}={\prod }_{j\in S,j\ne i}((x-j)/(i-j))$ .

4.2. Communication Procedure

Suppose a doctor will get the patient's medical data stored in sensors. The communication procedure can be sketched as follows.

• (1)

The sensors execute Algorithms 1 and 2 to produce the public keys and master keys.

(2)

The sensors encrypt the medical data M using public key and send the ciphertext to the doctor.

(3)

Once the doctor needs to be revoked, the controller updates the keys of all the users except the doctor. We adopt the method in [19]. The controller broadcasts any $n-r$ out of n users with ciphertext and master key. This method is suitable when the number of revoked users each time is small.

(4)

The nonrevoked users check the time, produce the decryption key, and decrypt the ciphertext when the attributes satisfy the access structure of the users.

Algorithm 1: System initialization.

(1) Choose y randomly in ${\mathrm{\hspace{0.17em}\hspace{0.17em}}\mathrm{Z}}_{\mathrm{p}}$ . Let g be the generator of ${\mathrm{\hspace{0.17em}\hspace{0.17em}}\mathrm{G}}_{\mathrm{1}}$ , choose an element ${\mathrm{g}}_{\mathrm{2}}\in {\mathrm{G}}_{\mathrm{1}}$ , ${\mathrm{g}}_{\mathrm{1}}={\mathrm{g}}^{\mathrm{y}}$ ;

(2) Define the universe of attributes set $\mathrm{A}=({\mathrm{a}}_{\mathrm{1}},{\mathrm{a}}_{\mathrm{2}},\dots ,{\mathrm{a}}_{\mathrm{n}+\mathrm{1}})$ . For each attribute ${\mathrm{a}}_{\mathrm{i}}\in \mathrm{A}$ , choose

  a number ${\mathrm{t}}_{\mathrm{i}}$ uniformly at random from ${\mathrm{\hspace{0.17em}\hspace{0.17em}}\mathrm{Z}}_{\mathrm{p}}$ , ${\mathrm{T}}_{\mathrm{1}}={\mathrm{g}}^{{\mathrm{t}}_{\mathrm{1}}},\dots ,{\mathrm{T}}_{\left|\mathrm{A}\right|}={\mathrm{g}}^{{\mathrm{t}}_{\left|\mathrm{A}\right|}},\mathrm{Y}={\mathrm{e}(\mathrm{g},\mathrm{g})}^{\mathrm{y}}$ ;

(3) Define a function $\mathrm{T}\left(\mathrm{x}\right)={{\mathrm{g}}_{\mathrm{2}}}^{{\mathrm{x}}^{\mathrm{n}}}{\prod }_{\mathrm{i}=\mathrm{1}}^{\mathrm{n}+\mathrm{1}}{\mathrm{t}}_{\mathrm{i}}^{{\mathrm{\Delta }}_{\mathrm{i},\mathrm{N}(\mathrm{x})}}$ ;

(4) The public key $\text{PK}=〈{\mathrm{T}}_{\mathrm{1}}={\mathrm{g}}^{{\mathrm{t}}_{\mathrm{1}}},\dots ,{\mathrm{T}}_{\left|\mathrm{A}\right|}={\mathrm{g}}^{{\mathrm{t}}_{\left|\mathrm{A}\right|}},\mathrm{Y}={\mathrm{e}(\mathrm{g},\mathrm{g})}^{\mathrm{y}}〉$ , the master key $\text{MK}=〈\mathrm{y},{\mathrm{t}}_{\mathrm{1}},\dots ,{\mathrm{t}}_{\left|\mathrm{A}\right|}〉$ .

(5) The maximum number of users is $\mathrm{N}$ ;

Algorithm 2: Key generation.

(1) Choose a polynomial ${\mathrm{q}}_{\mathrm{x}}$ for each non-leaf node as follows:

  Set the degree ${\mathrm{d}}_{\mathrm{x}}={\mathrm{k}}_{\mathrm{x}}-\mathrm{1}$ . For the root node r, to define it completely, set ${\mathrm{q}}_{\mathrm{r}}\left(\mathrm{0}\right)=\mathrm{y}$ , and ${\mathrm{d}}_{\mathrm{r}}$ other

  points of the polynomial ${\mathrm{q}}_{\mathrm{r}}$ randomly. For each other node x, set ${\mathrm{q}}_{\mathrm{x}}(\mathrm{0})={\mathrm{q}}_{\text{parent}(\mathrm{x})}(\text{index}\left(\mathrm{x}\right))$ and

  choose ${\mathrm{d}}_{\mathrm{x}}$ other points randomly to completely define ${\mathrm{q}}_{\mathrm{x}}$ ;

(2) For each leaf node x, give the decryption key to the users: ${\mathrm{D}}_{\mathrm{x}}={{\mathrm{g}}_{\mathrm{2}}}^{\mathrm{q}(\mathrm{x})}{\mathrm{T}(\mathrm{i})}^{-{\mathrm{r}}_{\mathrm{x}}}$ , ${\mathrm{d}}_{\mathrm{x}}={\mathrm{g}}^{{\mathrm{r}}_{\mathrm{x}}}$ .

  The decryption key $\text{DK}=\left({\mathrm{D}}_{\mathrm{x}},{\mathrm{d}}_{\mathrm{x}}\right)=\left(\left\{{{\mathrm{g}}_{\mathrm{2}}}^{{\mathrm{q}}_{\mathrm{x}}(\mathrm{0})}{\mathrm{T}\left(\mathrm{i}\right)}^{{-\mathrm{r}}_{\mathrm{x}}}\right\},\left\{{\mathrm{g}}^{{\mathrm{r}}_{\mathrm{x}}}\right\}\right)$ .

We design a scheme for fine-grained access control in WBANs. Our scheme consists of five algorithms: (1) system initialization; (2) key generation; (3) encryption; (4) user revocation; (5) decryption.

5. System Analysis

5.1. Correctness Analysis

Now that we have defined the function decryptnode, the decryption algorithm simply calls the function on the root of the tree. We observe that decryptnode $(E,\text{DK},r)={e(g,g)}^{ys}=Y^s$ if and only if the attributes associated with the ciphertext satisfy the access tree. Since $E_1=M{e(g_1,g_2)}^s$ , the decryption algorithm simply divides out ${e(g_1,g_2)}^s$ and recovers the message M:

$$\begin{array}{l}{M}^{\prime }=\frac{E_{\mathrm{1}}}{{\prod }_{i\in S}{\left(e\left(D_x,E_{\mathrm{2}}\right)/e\left(d_x,E_{\mathrm{3}}\right)\right)}^{{\Delta }_{i,S}\left(\mathrm{0}\right)}}\\ =M{e\left(g,g\right)}^t\\ \hspace{1em}\times {\left({\displaystyle \prod }_{i\in S}{\left(\frac{e\left({g_{\mathrm{2}}}^{q_x\left(\mathrm{0}\right)}{T\left(i\right)}^{{-r}_x},g^s\right)}{e\left(g^{r_x},{T\left(x\right)}^{-s}\right)}\right)}^{{\Delta }_{i,S}\left(\mathrm{0}\right)}\right)}^{-\mathrm{1}}\\ =M{e\left(g,g\right)}^t\\ \hspace{1em}\times {\left({\displaystyle \prod }_{i\in S}{\left(\frac{e\left({g_{\mathrm{2}}}^{q_x\left(\mathrm{0}\right)},g^s\right)e\left(T{\left(i\right)}^{{-r}_x},g^s\right)}{e\left(g^{r_x},{T\left(x\right)}^{-s}\right)}\right)}^{{\Delta }_{i,S}\left(\mathrm{0}\right)}\right)}^{-\mathrm{1}}\\ =\frac{M{e\left(g,g\right)}^t}{{\prod }_{i\in S}{\left(e\left({g_{\mathrm{2}}}^{q_x\left(\mathrm{0}\right)},g^s\right)\right)}^{{\Delta }_{i,S}\left(\mathrm{0}\right)}}=M.\end{array}$$

(1)

5.2. Security Analysis

(1) Collusion Attack Resistance. In this scheme, different users have different access structures. The master key is generated randomly and independently from $Z_p$ ; therefore, it is impossible for them to collude together to get the medical data. Even if they collude together, they satisfy neither of the entries to the medical data.

(2) Confidentiality

Theorem 1.

If an attacker $\mathcal{A}$ can break the scheme in the security game with probability ε, then a simulator $\mathcal{B}$ can be constructed to win the DBDH game with the probability $\epsilon /2$ .

Proof.

The security of the game is based on the hardness of the DBDH assumption. We prove it as the approach proposed in [15]. The simulation proceeds as follows.

Let $G_1$ and $G_2$ be two groups with a bilinear map e and a generator g. The challenger chooses a fair binary coin $\mu \in \{\mathrm{0,1}\}$ , $a,b,c\in Z_p$ . We construct a simulator $\mathcal{B}$ ; then $\mathcal{B}$ plays the role of challenger. If $\mu =\mathrm{0}$ , $\mathcal{B}$ is given $(A,B,C,Z)=(g^a,g^b,g^c,{e\left(g,g\right)}^{abc})$ ; otherwise, it sets z as a random number and $\mathcal{B}$ is given $(A,B,C,Z)=(g^a,g^b,g^c,{e\left(g,g\right)}^z)$ .

•  

Init: the simulator $\mathcal{B}$ runs $\mathcal{A}$ . $\mathcal{A}$ chooses the attributes set γ which it wishes to be challenged on.

 

Setup: $\mathcal{B}$ assigns the public key as follows. It sets $Y=e\left(A,B\right)={e(g,g)}^{ab}$ . For all $i\in \gamma$ , it chooses ${\beta }_i\in Z_p$ randomly and sets $T_i=C^{{\beta }_i}=g^{c{\beta }_i}$ ; otherwise, it sets $T_i=g^{{\delta }_i}$ and then gives the public key to A.

 

Phase 1: $\mathcal{A}$ makes requests for the master key of an access structure T where γ does not satisfy T. To generate the master key, $\mathcal{B}$ needs to define a polynomial $q_x$ of degree $d_x$ for every node in access tree T.

We define recursive function polynode (x) to assign the polynomial $q_x$ for node x as follows.

For each node x in T, we use $k_x$ and $\text{index}(x)$ to denote node's threshold value and the unique index of node x, respectively. The procedure takes an access tree T and attributes set γ as input.

• (i)

If x is the root node r, $q_x\left(0\right)={\lambda }_x$ and ${\lambda }_x$ is chosen from $Z_p$ randomly.

(ii)

Select the satisfied children $x^{\prime }$ of x. For each $x^{\prime }$ , choose a random number $r_{x^{\prime }}\in Z_p$ and let $q_x\left(\text{index}t\left(i\right)\right)={br}_{x^{\prime }}$ . For each unsatisfied child j, calculate $q_x\left(j\right)={\sum }_{i\in X_i}\left(\text{index}\left(i\right)\right){\Delta }_{i,S_x}(j)$ .

(iii)

For each child $x^{\prime }$ of x, $q_{x^{\prime }}\left(0\right)=q_x(\text{index}(x^{\prime }))$ .

When polynode (x) terminates, $\mathcal{B}$ constructs the polynomials for all nodes in T. Therefore, the master key corresponding to each leaf node x of T is given as follows:

$$\begin{array}{cc}& D_x=\left\{\begin{array}{cc}{g}^{Q_x\left(\mathrm{0}\right)/t_x}=g^{{bq}_x\left(\mathrm{0}\right)/r_i}=B^{q_x\left(\mathrm{0}\right)/r_i},\hfill & \text{attr}\left(x\right)\in \gamma \hfill \\ g^{Q_x\left(\mathrm{0}\right)/t_i}=g^{{bq}_x\left(\mathrm{0}\right)/{b\beta }_i}=B^{q_x\left(\mathrm{0}\right)/{\beta }_i},\hfill & \text{otherwise}.\hfill \end{array}\right.\end{array}$$

(2)

Therefore, $\mathcal{B}$ constructs a master key for the access structure T.

Challenge. $\mathcal{A}$ submits two challenge messages $M_1$ and $M_2$ to $\mathcal{B}$ . $\mathcal{B}$ flips a fair binary coin v and returns an encryption of $M_v$ . The ciphertext is output as $E=(\gamma ,M_v,Z,{\left\{E_i=C^{t_i}\right\}}_{i\in \gamma })$ . If $\mu =0$ , $Z={e(g,g)}^{abc}$ . This indicates that the ciphertext is valid for the message under the identity. If $\mu =\mathrm{1}$ , $Z={e(g,g)}^z$ . Since z is random, $M_{v}Z$ will be a random element from the adversaries view and the message contains no information about $M_v$ .

•  

Phase 2: the simulator acts exactly the same as in phase 1.

 

Guess: A will submit a guess $v^{\prime }$ of v. If $v^{\prime }=v$ , the simulator will output ${\mu }^{\prime }=\mathrm{0}$ to indicate that it is given a valid tuple; otherwise, it will output ${\mu }^{\prime }=\mathrm{1}$ to indicate it is given a random 4-tuple.

If ${\mu }^{\prime }=\mathrm{1}$ , the adversary gains no information about v, $\mathrm{Pr}[v^{\prime }=v\mid \mu =1]=\mathrm{1}/\mathrm{2}$ . If ${\mu }^{\prime }=\mathrm{0}$ , the adversary gains an encryption of $M_v$ . The adversary's advantage in this situation is ε by definition. Therefore, $\mathrm{Pr}[v^{\prime }=v\mid \mu =0]=\mathrm{1}/\mathrm{2}+\epsilon$ . The overall advantage of the simulator in the DBDH game is

$$\begin{array}{l}\frac{\mathrm{1}}{\mathrm{2}}\mathrm{Pr}\left[v^{\prime }=v\mid v=0\right]+\frac{\mathrm{1}}{\mathrm{2}}\mathrm{Pr}\left[v^{\prime }=v\mid v=1\right]-\frac{\mathrm{1}}{\mathrm{2}}\hfill \\ \hspace{1em}\hspace{1em}=\frac{\mathrm{1}}{\mathrm{2}}\left(\frac{\mathrm{1}}{\mathrm{2}}+\epsilon \right)+\frac{\mathrm{1}}{\mathrm{2}}\times \frac{\mathrm{1}}{\mathrm{2}}-\frac{\mathrm{1}}{\mathrm{2}}=\frac{\mathrm{1}}{\mathrm{2}}\epsilon .\end{array}$$

(3)

(3) Unforgeability. The adversary cannot forge the ciphertext because he cannot guess the attributes which are used to encrypt the ciphertext. Even if the adversary gets other user's ciphertext, he cannot create a new, valid ciphertext as the attributes which are used to encrypt a ciphertext are different from others, and the number y is chosen randomly. Therefore, we claim that our scheme is unforgeable under chosen-ciphertext attacks.

5.3. Performance Analysis

In this part, we present the performance analysis results about our scheme in terms of transmission and computation. We also compare the performance results with previous best known ones. In this paper, we mainly consider the energy consumption about message transmission and computation in WBANs. The energy consumption on transmission is much more than computing, so improving the performance of transmission will increase the overall performance greatly.

5.3.1. Energy Consumption on Transmission

According to Algorithms 3 and 4 (if there are some users to be revoked), the total message size is

$$\left|E_1\right|+\left|E_2\right|+\left|E_3\right|+\left|tt\right|+\left|D_x^{\prime }\right|+\left|D_x^{\prime }\right|.$$

(*)

Algorithm 3: Encryption.

To encrypt a message $\mathrm{M}\in {\mathrm{G}}_{\mathrm{2}}$ under a set of attributes, the sender chooses

a random value $\mathrm{s}\in {\mathrm{Z}}_{\mathrm{p}}$ , and compute ciphertext E with the following steps:

(1) ${\mathrm{E}}_{\mathrm{1}}=\mathrm{M}\mathrm{e}{({\mathrm{g}}_{\mathrm{1}},{\mathrm{g}}_{\mathrm{2}})}^{\mathrm{s}}$ ;

(2) ${\mathrm{E}}_{\mathrm{2}}={\mathrm{g}}^{\mathrm{s}}$ ;

(3) ${\{{\mathrm{E}}_{\mathrm{3}}={\mathrm{T}}_{\mathrm{i}}^{\mathrm{s}}\}}_{\mathrm{i}\in \mathrm{A}}$ ;

(4) Current time $tt$ ;

(5) Ciphertext $\mathrm{E}=({\mathrm{E}}_{\mathrm{1}},{\mathrm{E}}_{\mathrm{2}},{{\{\mathrm{E}}_{\mathrm{3}}\}}_{\mathrm{i}\in \mathrm{A}},tt)$ .

Algorithm 4: User revocation.

In order to revoke a user, the controller updates decryption key for the non-revoked users.

(1) Choose another random number ${\mathrm{y}}^{\prime }$ from ${\mathrm{Z}}_{\mathrm{P}}$ , $\mathrm{\Delta }\mathrm{y}={\mathrm{y}}^{\prime }-\mathrm{y}$ , ${\mathrm{Y}}^{\prime }={\mathrm{e}(\mathrm{g},\mathrm{g})}^{{\mathrm{y}}^{\prime }}$ ;

(2) Choose an exponents ${\mathrm{r}}_{\mathrm{x}}^{\prime }\in {\mathrm{Z}}_{\mathrm{p}}$ , for each user ${\mathrm{u}}_{\mathrm{j}}$ , give the decryption key to the non-revoked

  users: ${\mathrm{D}}_{\mathrm{x}}^{\prime }={{\mathrm{g}}_{\mathrm{2}}}^{\mathrm{q}(\mathrm{x})}{\mathrm{T}(\mathrm{i})}^{-{\mathrm{r}}_{\mathrm{x}}^{\prime }}$ ,   ${\mathrm{d}}_{\mathrm{x}}^{\prime }={\mathrm{g}}^{{\mathrm{r}}_{\mathrm{x}}^{\prime }}$ . The updated decryption key ${\text{DK}}^{\prime }\mathrm{\hspace{0.17em}\hspace{0.17em}}=\{{\mathrm{D}}_{\mathrm{x}}^{\prime },{\mathrm{d}}_{\mathrm{x}}^{\prime }\}$ .

We use Tate pairing [20] to evaluate the bilinear map e. The parameters in (*) are variable. Assuming $\left|tt\right|$ is 2 bytes, p is the prime order of G and $G_T$ , and n is the number of attributes, the total message size is ( $\left|p\right|+\left|p\right|+n\left|p\right|+2+\left|p\right|+\left|p\right|)=2+(n+4)|p|$ . According to [21], a chipcon CC1000 radio used in Crossbow MICA2DOT motes consumes 28.6 μJ and 59.2 μJ to receive and transmit one byte, respectively. The total energy consumption for one user is $\left(2+\left(n+4\right)\left|p\right|\right)*(\mathrm{28.6}+\mathrm{59.2})$  μJ, and W users need $W*(1.931+0.1756|p|)$  mJ. The parameters are set as follows: $n=3$ , $\left|p\right|=20$ , 42.5, 60 bytes. The first three lines in Table 1 are the results.

Table 1

The energy consumption on transmission in our scheme and other schemes.

Length of p (byte)	Energy consumption (mJ)
Our scheme ( $\left|p\right|=\mathrm{20}$ )	12.643
Our scheme ( $\left|p\right|=\mathrm{42.5}$ )	26.296
Our scheme ( $\left|p\right|=\mathrm{60}$ )	37.051
Certificate-based	146.99
Merkle hash tree	144.56
ID-based	111.02

Table 1 shows the comparison energy consumption on transmission of our scheme and other schemes. It can be seen that, even though we set $\left|p\right|=60$ bytes, the energy consumption on transmission of our scheme is much lower than others.

Figure 3 presents the relationship between the number of attributes (indicated by n) and the energy consumption on transmission. The curves in Figure 3 indicate that, with the increase of attribute numbers, the energy consumption increases.

Figure 3

Energy consumption on transmission with regard to the number of attributes.

5.3.2. Energy Consumption on Computation

In this part, we evaluate the energy consumption on computation in our scheme. n is the number of attributes. Firstly, we show the operations of initialization (Algorithm 1), key generation (Algorithm 2), encryption (Algorithm 3), user revocation (Algorithm 4), and decryption (Algorithm 5) in Table 2.

Table 2

The operations in our scheme.

Operations	Initialization	Key generation	Encryption	User revocation	Decryption
Exponent computation	$n+1$	$2n+1$	$n+3$	$2n+1$	n
e evaluation	$1$	$0$	$1$	$1$	$2n$
Multiplication	$0$	$n+1$	$n+2$	$n+2$	$1$
Addition	$0$	$0$	$0$	$0$	$1$
Comparison	$0$	$0$	$0$	$0$	n

Algorithm 5: Decryption.

If $T(\gamma )=1$ and ${\mathrm{N}}_{\text{user}}\le \mathrm{N}$ , the user can decrypt a message M which is encrypted under a set of attributes.

(1) On receiving the ciphertext E, the receiver checks the current time $\stackrel{\mathrm{~}}{\mathrm{tt}}$ ;

(2) If $\left|\mathrm{tt}-\stackrel{\mathrm{~}}{\mathrm{tt}}\right|<\epsilon$ , the receiver decrypts the ciphertext using decryption key $\text{DK}$ ;

(3) ${\mathrm{N}}_{\text{user}}+\mathrm{1}$ ;

${\mathrm{M}}^{\prime }=\frac{{\mathrm{E}}_{\mathrm{1}}}{{\prod }_{\mathrm{i}\in \mathrm{S}}{\left(\mathrm{e}\left({\mathrm{D}}_{\mathrm{x}},{\mathrm{E}}_{\mathrm{2}}\right)/\mathrm{e}\left({\mathrm{d}}_{\mathrm{x}},{\mathrm{E}}_{\mathrm{3}}\right)\right)}^{{\mathrm{\Delta }}_{\mathrm{i},\mathrm{S}}(\mathrm{0})}}$

It x is a leaf node, we can compute:

$\text{Decryptnode}(E,\text{DK},x)=\frac{\mathrm{e}({\mathrm{D}}_{\mathrm{x}},{\mathrm{E}}_{\mathrm{2}})}{\mathrm{e}({\mathrm{d}}_{\mathrm{x}},{\mathrm{E}}_{\mathrm{i}})}=\frac{\mathrm{e}({{\mathrm{g}}_{\mathrm{2}}}^{{\mathrm{q}}_{\mathrm{x}}(\mathrm{0})}·{\mathrm{T}\left(\mathrm{i}\right)}^{{\mathrm{r}}_{\mathrm{x}}},{\mathrm{g}}^{\mathrm{s}})}{\mathrm{e}({{\mathrm{g}}_{\mathrm{2}}}^{{\mathrm{r}}_{\mathrm{x}}},{\mathrm{T}}_{\mathrm{i}}^{\mathrm{s}})}={\mathrm{e}(\mathrm{g},\mathrm{g})}^{\mathrm{s}·{\mathrm{q}}_{\mathrm{x}}(\mathrm{0})}$

If x is a non-leaf node, then:

${\mathrm{F}}_{\mathrm{x}}=\prod _{\mathrm{z}\in {\mathrm{S}}_{\mathrm{x}}}{\mathrm{F}}_{\mathrm{z}}^{{\mathrm{\Delta }}_{\mathrm{i},{\mathrm{S}}_{\mathrm{x}}^{\prime }}(\mathrm{0})}$ where,  $\begin{array}{c}\mathrm{i}=\text{index}(\mathrm{z})\\ {\mathrm{S}}_{\mathrm{x}}^{\prime }=\text{index}\left(\mathrm{z}\right):\mathrm{z}\in {\mathrm{S}}_{\mathrm{x}}\end{array}$

  $=\prod _{\mathrm{z}\in {\mathrm{S}}_{\mathrm{x}}}{{\mathrm{e}(\mathrm{g},\mathrm{g})}^{\mathrm{s}·{\mathrm{q}}_{\mathrm{z}}(\mathrm{0})}}^{{\mathrm{\Delta }}_{\mathrm{i},{\mathrm{S}}_{\mathrm{x}}^{\prime }}(\mathrm{0})}$

  $=\prod _{\mathrm{z}\in {\mathrm{S}}_{\mathrm{x}}}{{\mathrm{e}(\mathrm{g},\mathrm{g})}^{\mathrm{s}·{\mathrm{q}}_{\text{parent}(\mathrm{z})}(\text{index}(\mathrm{z}))}}^{{\mathrm{\Delta }}_{\mathrm{i},{\mathrm{S}}_{\mathrm{x}}^{\prime }}(\mathrm{0})}$

  $=\prod _{\mathrm{z}\in {\mathrm{S}}_{\mathrm{x}}}{\mathrm{e}(\mathrm{g},\mathrm{g})}^{\mathrm{s}·{\mathrm{q}}_{\mathrm{x}}(\mathrm{i})·{\mathrm{\Delta }}_{\mathrm{i},{\mathrm{S}}_{\mathrm{x}}^{\prime }}(\mathrm{0})}$

  $={\mathrm{e}(\mathrm{g},\mathrm{g})}^{\mathrm{s}·{\mathrm{q}}_{\mathrm{x}}(\mathrm{0})}$

We consider the sensor CPU is a 32-bit Inter PXA-255 processor at 400 MHz. It is reported in [22] that the typical power consumption of PXA-255 in active and idle modes is 411 mW and 121 mW, respectively. We adopt Tate pairing to compute the Bilinear Maps. According to [23], it takes 752 ms to compute Tate pairing on a 32-bit ST22 smartcard microprocessor at 33 MHZ. As a result, the computation of Tate pairing on PXA-255 roughly needs 33/ $440\times 752\approx 62.04$  ms. Using the equation $E=W\times t$ , where E is the energy consumption, W is the power, and t is the execution time, the energy consumed at work is $\mathrm{411}\times \mathrm{62.04}=\mathrm{25.5}$  mJ. As mentioned in [23], the Tate pairing takes the most running time; we thus use energy consumed on pairing to approximate that of the procedure. In our scheme, we compute the Tate pairing which happened in sensors (we do not consider the Tate pairing in decryption as it takes place on the client for users). The energy consumption is 3*62.04 ms = 186.12 ms. Table 3 shows the computation cost of our scheme and other schemes when the number of users is 1. From Table 3 we can see that the computation time of our scheme is higher than the first three and lower than the fourth one.

Table 3

The energy consumption on computation of our scheme and other schemes.

Scheme	Computation cost (ms)
Certificate-based	39.96
Merkle hash tree	18.48
ID-based	124.08
FABSC	310.2
Our scheme	186.12

Figure 4 presents the energy consumption on computation with regard to the number of users. From Figure 4 we can observe that the computation cost of our scheme is lower than FABSC and higher than others. Nevertheless, when we take the transmission and computation into account, our scheme is energy-efficient when the number of users is large.

Figure 4

Computation cost with regard to the number of users.

6. Conclusion and Future Work

In this paper, we design a key policy attribute-based scheme for access control in WBANs. When the attributes related to the ciphertext satisfy the users' access structures, the ciphertext can be decrypted. User revocation is introduced to the scheme. In the future, we can classify the medical data according to the hierarchy, for example, the sensitive data and the no-sensitive data. Sensitive data includes the data which is of vital importance and embarrassed data. No-sensitive data is the ordinary medical data such as temperature, pulse, and blood pressure. Anyone who wants to get the sensitive data must have high level privilege, and the no-sensitive data can be accessed by low level privilege.