A lightweight verifiable outsourced decryption of attribute-based encryption scheme for blockchain-enabled wireless body area network in fog computing

Abstract

Wireless body area network includes some tiny wearable sensors for monitoring the physiological data of user, which has been a promising method of promoting the quality and efficiency greatly in healthcare. The collected physical signs are aggregated into the medical documents and uploaded to cloud server for utilizing by the remote user. As these files are highly sensitive privacy data, there is a vital challenge that constructs a secure and efficient communication architecture in this application scenario. Based on this standpoint, we present a lightweight verifiability ciphertext-policy attribute-based encryption protocol with outsourced decryption in this article. Specifically, our construction enjoys the following six features: (1) Although the outsourced decryption enables to save the computation overhead of the data user sharply in an attribute-based encryption scheme, the ciphertext is out of control and the correctness cannot be guaranteed by the data owner. The proposal provides the verifiability of ciphertext that ensures the user to check the correctness efficiently. (2) The size of the ciphertext is constant that is not increased with the complexity of attribute and access structure. (3) For Internet of Things devices, it introduces the fog computing into our protocol for the purpose of low latency and relation interactions, which has virtually saved the bandwidth. (4) With the help of blockchain technique, we encapsulate the hash value of public parameter, original and transformed ciphertext and transformed key into a block, so that the tamper-resistance is facilitated against an adversary from inside and outside the system. (5) In the standard model, we prove that it is selectively chosen-plaintext attack-secure and verifiable provided that the computational bilinear Diffie–Hellman assumption holds. (6) It implements this protocol and shows the result of performance measurement, which indicates a significant reduction on communication and computation costs burden on every entity in wireless body area network.

Introduction

Internet of Things (IoTs) connect physical devices on Internet, including sensor nodes, smart terminals, and other wireless communication equipments.^1–3 As a main application of IoTs, the wireless body area network (WBAN) has attracted a tremendous attention recently.^4–6 WBAN consists of various wearable intelligent sensors on the body, which are connected in the form of wireless communication link. The sensors in WBAN provide the constant health monitoring (for example, the heart beat, the body temperature, the blood pressure, and electrocardiogram), and real-time feedback to the data user (DU) or medical staff. Taking advantages of WBAN, the patient enjoys a promising physical mobility and experiences a high-quality healthcare service at home. In addition, these collected physiological data are uploaded to the cloud platform for being utilized by the DU.

As a distributed computation model over a shared pool, cloud computing provides infrastructure as a service like physical computing resources, data partitioning, storage, and so on.^7–9 In the cloud paradigm, the user just pays for enjoying the corresponding cloud services supported by the cloud service provider (CSP) instead of managing and maintaining the infrastructure, which reduces the local storage overhead and provides the convenient data access service. Uploading the physiological data in WBAN to cloud platform, it realizes the real-time data sharing, the elastic computation resource distribution and the accurate response in time. However, the data owner (DO) loses the capacity of controlling over it physically after being stored on the cloud platform, and the physiological data contains some sensitive privacy. Therefore, it is essential to implement the confidentiality protection with access control against the unauthorized user and curious CSP.

For enjoying the confidentiality and access control in cloud, the attribute-based encryption (ABE) scheme was proposed as a preeminent cryptographic primitive. ¹⁰ ABE is an one-to-many encryption mode that the authorized entity is able to decrypt the protected data only if the access structure and attribute attached with private key and ciphertext. Moreover, this scheme is divided into two types, key-policy ABE (KP-ABE) schemes^11–13 and ciphertext-policy ABE (CP-ABE) schemes.^14–17 In the former, the private key is related to designated policies, while the ciphertext is labeled by some attributes. The user decrypts this ciphertext successfully unless these access policies are met by some attributes of such ciphertext, which reflects the permission of this user. On the contrary, in the latter, the ciphertext is associated with access policy, while some attribute sets are embedded into private key. CP-ABE scheme shows some requirements for the decryptor. In the cloud-assisted WBAN, the physiological data are stored on the cloud storage server (CSS), and shared among the authorized DUs. Consequently, it is more practical to adopt CP-ABE scheme to support confidentiality and access control in the cloud-assisted WBAN. Unfortunately, in the CP-ABE scheme, there is a shortcoming that the overhead is expensive due to the complexity of access structure in the phase of decryption, which impedes the application of ABE in IoTs device with limited resource.

For decreasing the computation overhead of decryption burdened on the DU, the concept of outsourced decryption was presented. ¹⁸ Concretely, a ciphertext and a transformation key are given to CSS, and it transforms this ciphertext into a partial one, rather that is directly decrypted by the DU. The user only spends a little cost in accessing the plaintext from this partial ciphertext. Nevertheless, the validity of this transformed ciphertext cannot be ensured for an untrusted CSS. Some curious CSS may distort and tamper the transformed ciphertext. Therefore, the verifiability of the transformed ciphertext is necessary for the outsourced decryption ABE. ¹⁹

Moreover, the blockchain technique is a desirable method of resisting the data tampering as well.^20,21 Blockchain technology is a backbone of the Bitcoin cryptocurrency, ²² which is considered as a peer-to-peer distributed ledger technology to record data. The distinguishing features of this technology are decentralized maintenance, secure transporting and accessing the data as well as anti-tamper and undeniability. Taking blockchain into outsourced decryption ABE protocol, the ciphertext, the partial ciphertext, the transformation key, and other important parameters are encapsulated into a block chronologically, which avoids to be tampered from any entity, including the inside and outside adversary.

At the same time of enjoying the convenience, the cloud-assisted IoTs also suffers from the huge network latency, the massive data, and other various drawbacks. ²³ To avoid these drawbacks, one of the preeminent technique measure is fog computing. As shown in Figure 1, fog computing is presented for extending the cloud service to the edge of the IoTs,^24–26 which promotes the resources and services to be closer to the IoTs devices. In the face of the explosion of data in IoTs, fog computing enables to provide small latency and real-time application.

Figure 1.

The underlying structure of fog computing.

Related works

ABE is a popular topic that enjoys the confidentiality and fine-grained access control. However, the weakness of original ABE scheme is that it needs some expensive operations in decryption, and the overhead is related to the complexity of access structure. Green et al. ¹⁸ introduced the model of ABE with outsourced computing to reduce the computational cost in decryption, which transformed the decryption operation to CSS and reduced the overhead of the DU significantly. Unfortunately, the correctness of transformed ciphertext in Green et al. ¹⁸ cannot be checked. Lai et al. ¹⁹ presented a verifiability ABE protocol with outsourced decryption to verify the validity of the transformed ciphertext. To improve the efficiency, Lin et al. ²⁷ combined an attribute-based key encapsulation mechanism (KEM), a commitment protocol, and a symmetric key encryption scheme to achieve efficient verifiability. Moreover, they also put forward a unified model for outsourced decryption ABE with verifiability. Qin et al. ²⁸ encrypted the data in symmetric encryption, and this symmetric key is encrypted under ABE scheme. By comparing the hash values, this protocol realized the verification of the outsourced ciphertext in correctness. Mao et al. ²⁹ designed an improved verifiability ABE protocol with outsourced decryption to cut down the size of ciphertext and computational cost obviously, which committed to such plaintext by means of a random parameter. The scheme in Li et al. ³⁰ gave a novel verifiable outsourced decryption of ABE scheme that the size of ciphertext is constant, which not only verified the validity of transformed ciphertext, but also made the overhead be irrelevant to the complexity of access structure. Li et al. ³¹ introduced an ABE protocol with fully verifiable oursourced decryption as well, and all the users (including authorized and unauthorized) enabled to check the correctness of transformed ciphertext. Recently, the scheme in Li et al. ³² demonstrated an verifiability ABE with outsourced computing in both the encryption and decryption phases. This protocol caused the cost of transformed key generation to be constant and shifted the burden on both the DO and user.

Furthermore, the blockchain technology is also employed to guarantee the validity of the outsourced data. If only encapsulated the vital parameters into a block, any entity (including the authorized user and trusted or curious authority from inside, and the unauthorized user and adversary from outside) could not tamper these data. Guo et al. ³³ encapsulated the electronic health records (EHRs) in blockchain to guarantee the validity in the attribute-based cryptography primitive, every patient endorsed a message according to his attribute for avoiding to reveal his or her privacy. For applying in distribution system, the protocol in Guo et al. ³⁴ demonstrated a multi-authority ABE for medical data. Taking advantage of the blockchain technique, the integrity of these private data in cloud is protected. Liu et al. ³⁵ adopted the CP-ABE to provide strong privacy preservation in data sharing. Moreover, the index of physiological data is stored in the blockchain, which ensured that such sensitive data could not be modified arbitrarily. The schemes^36–39 are all focused on the integrity and correctness of the outsourced data in cloud depending on the blockchain technology.

Although ABE scheme with outsourced decryption reduces the cost significantly, the mass data processing from sensor nodes is still greatly hindering the application of resource-limited IoT devices. Taking cloud-fog architecture into consideration, fog node (FN) is likely to be a proxy that executes partial computation. With the assistance of FN, it will need less calculation cost on the resource-limited IoT device. In the environment of fog computing, Zuo et al. ⁴⁰ first presented the chosen-ciphertext attack (CCA)-secure model in ABE with outsourced decryption. Integrating CP-ABE and searchable encryption, Miao et al. ⁴¹ proposed an efficient fine-grained ciphertext searching system, which shifted partial computation overhead from the DU to the selected FN. Fan et al. ⁴² introduced an access control scheme with multiple authorities for privacy preservation in the fog-assisted IoT architecture, which operated the verifiable outsourced decryption by FN and ensured a real-time application. Considering the computing capacity of the sensor node, Wang et al. ⁴³ presented a fine-grained access control with distributed outsourced computing, in which the receiver and sender just executed little calculation with the help of the FN.

Contributions

To this article, for preserving the privacy in WBAN, a lightweight verifiability CP-ABE protocol with outsourced decryption is presented. The contributions of our protocol are listed as following.

1. By adding verification algorithm in decryption, this scheme enjoys the verifiability of ciphertext to check the correctness by the DU. Moreover, depending on the blockchain technology, it encapsulates the important data into a block chronologically and protects these data from being tampered by inside and outside adversary.

2. The size of ciphertext is constant that is independent with the complexity of attributed set and access policy. Moreover, FN affords partial computation and storage task that cuts the cost of IoT device equipped by the DO.

3. Provided that the assumption of computational bilinear Diffie–Hellman (CBDH) holds, we formally prove this proposal is verifiable in the standard model, and selectively chosen-plaintext attack (CPA)-secure.

4. As for simulation and comparison, we implement our constrution and demonstrate the result of performance measurement, which indicates a significant reduction on the bandwidth of communication and computation for every entity in this protocol.

Organization

The remaining paper is organized as follows. Section “Preliminaries” introduces some basic knowledges and concepts, such as the notions of bilinear map, security assumption and access structure, the definition and security model of verifiability CP-ABE scheme with outsourced decryption in this article. Section “The architecture of system model” describes the detailed characters in our system model. Section “Our construction” presents our concrete CP-ABE scheme with verifiable oursourced decryption for WBAN. Section “Security analysis” proves the security and verifiability of this proposal. Section “Performance evaluation” demonstrates the experimental results on the performance comparison with the related schemes. Finally, Section “Conclusion” states our conclusions of such article.

Preliminaries

In this part, some preliminary knowledges regarding the cryptographic primitives that our scheme depends on are introduced.

Bilinear map

Suppose that $(G,+)$ and $(G_T,\times )$ are bilinear cyclic groups with the prime order $p$ . A bilinear map $\hat{e}:G\times G\to G_T$ possesses the following three properties:

1. Bilinearity: ∀ $P,Q\in G$ , $a,b\in Z_p^{*}$ , $\hat{e}(\mathrm{aP},\mathrm{bQ})=\hat{e}(P,Q{)}^{\mathrm{ab}}$ holds.

2. Non-degeneracy: It exists $P,Q\in G$ such that $\hat{e}(P,Q)\ne 1\in G_T$ .

3. Computability: ∀ $P,Q\in G$ , it exists an efficient algorithm to calculate $\hat{e}(P,Q)$ .

Complexity assumption

Let $G$ be a finite cyclic group with prime order $p$ , and $a,b,c\in Z_p^{*}$ be selected uniformly at random. The difficult problem underlying the security of our protocol are shown as below.

Definition 1

CBDH problem

Given a tuple of elements $\{A=\mathrm{aP},B=\mathrm{bP},C=\mathrm{cP}\}\in G^3$ , the CBDH problem in $(p,G,G_T,\hat{e})$ is to calculate the bilinear pairing $\hat{e}(P,P{)}^{\mathrm{abc}}$ .

The CBDH assumption in $(p,G,G_T,\hat{e})$ is that there is no probabilistic polynomial-time (PPT) algorithm $\mathcal{A}$ to solve CBDH problem successfully with non-negligible advantage. The advantage of $\mathcal{A}$ is defined as

$$\mathrm{Pr}[\mathcal{A}(p,G,G_T,\hat{e},A,B,C)=\hat{e}(g,g{)}^{\mathrm{abc}}]$$

where this probability is over the randomly chosen tuple of $(p,a,b,c)$ .

Access structure

Definition 2

Access structure

Suppose that $\{P_1,P_2,\dots ,P_n\}$ is a set of parties. There is a monotone collection $\mathbb{A}\subseteq 2^{\{P_1,P_2,\dots ,P_n\}}$ , where if $B\in \mathbb{A},B\subseteq C$ , $C\in \mathbb{A}$ for any $B$ and $C$ . Moreover, the access structure $\mathbb{A}$ (respectively, monotone access structure) is called a collection (respectively, monotone access structure) of non-empty subsets of $\{P_1,P_2,\dots ,P_n\}$ , that is, $\mathbb{A}\subseteq 2^{\{P_1,P_2,\dots ,P_n\}}\backslash \{\varnothing \}$ . Hence, the set belonging to $\mathbb{A}$ is an authorized set. Otherwise, it is unauthorized.

Formal definition of CP-ABE with outsourced decryption

The CP-ABE scheme with outsourced decryption consists of seven algorithms as follows.

• $\mathrm{Setup}(1^{\lambda })\to (\mathrm{PK},\mathrm{MSK})$ : This algorithm inputs security parameter $1^{\lambda }$ , and then it outputs the public parameters $\mathrm{PK}$ and master secret key $\mathrm{MSK}$ of this system.

• $\mathrm{KeyGen}(\mathrm{PK},\mathrm{MSK},\mathrm{Att})\to S{K}_{\mathrm{Att}}$ : This algorithm inputs the public parameters $\mathrm{PK}$ , master secret key $\mathrm{MSK}$ , and an attribute set $\mathrm{Att}$ . Then, returns $S{K}_{\mathrm{Att}}$ as a private key for $\mathrm{Att}$ .

• $\mathrm{Encrypt}(\mathrm{PK},M,\mathbb{A})\to \mathrm{CT}$ : This algorithm inputs public parameters $\mathrm{PK}$ , a message $M$ and an access policy $\mathbb{A}$ , and then it returns the ciphertext $\mathrm{CT}$ of $M$ as an answer.

• $\mathrm{Decrypt}(\mathrm{PK},S{K}_{\mathrm{Att}},\mathrm{CT})\to M$ : This algorithm inputs the public parameters $\mathrm{PK}$ , the private key $S{K}_{\mathrm{Att}}$ for $\mathrm{Att}$ and the ciphertext $\mathrm{CT}$ , and then it returns $M$ as an answer if $S{K}_{\mathrm{Att}}$ satisfies the access structure $\mathbb{A}$ .

• $\mathrm{GenT}{K}_{\mathrm{out}}(\mathrm{PK},S{K}_{\mathrm{Att}})\to (T{K}_{\mathrm{Att}},R{K}_{\mathrm{Att}})$ : This algorithm inputs the public parameters $\mathrm{PK}$ and the private key $S{K}_{\mathrm{Att}}$ for attribute set $\mathrm{Att}$ , and then it returns a transformation key $T{K}_{\mathrm{Att}}$ and a retrieving key $R{K}_{\mathrm{Att}}$ correspondingly as an answer.

• $\mathrm{Transfor}{m}_{\mathrm{out}}(\mathrm{PK},\mathrm{CT},T{K}_{\mathrm{Att}})\to \mathrm{CT}\prime$ : This algorithm inputs the public parameters $\mathrm{PK}$ , the ciphertext $\mathrm{CT}$ , and the transformation key $T{K}_{\mathrm{Att}}$ for $\mathrm{Att}$ , and then it returns a partial ciphertext $\mathrm{CT}\prime$ as an answer.

• $\mathrm{Decryp}{t}_{\mathrm{out}}(\mathrm{PK},\mathrm{CT},\mathrm{CT}\prime ,R{K}_{\mathrm{Att}})\to M$ : This algorithm inputs the public parameters $\mathrm{PK}$ , the ciphertext $\mathrm{CT}$ , the partial ciphertext $\mathrm{CT}\prime$ , and the retrieving key $R{K}_{\mathrm{Att}}$ , and then returns message $M$ as an answer.

Security model for CP-ABE with outsourced decryption

Confidentiality

As the traditional CCA-secure does not permit any changes on bits of ciphertext, which is not suitable for the above model of CP-ABE with outsourced decryption. Thus, it proposes the selectively CPA-secure model in the following game between a challenge $\mathcal{C}$ and an adversary $\mathcal{A}$ .

Init: The adversary $\mathcal{A}$ submits ${\mathbb{A}}^{*}$ as a challenge access policy.

Setup: The challenger $\mathcal{C}$ selects a security parameter $1^{\lambda }$ for executing Setup, and then it returns the public parameters $\mathrm{PK}$ to $\mathcal{A}$ and keeps master secret key $\mathrm{MSK}$ secretly.

Query Phase 1: Challenger $\mathcal{C}$ maintains an empty list $L$ and a set E. Adversary $\mathcal{A}$ issues two queries as below.

1. Private-Key-Extraction: Adversary $\mathcal{A}$ queries this oracle on the attribute set $\mathrm{Att}$ , and the challenger $\mathcal{C}$ executes KeyGen and sets E=E $\cup \{\mathrm{Att}\}$ . It outputs the private key $S{K}_{\mathrm{Att}}$ to $\mathcal{A}$ , and it cannot make this query for the private key $S{K}_{\mathrm{Att}}$ that satisfies the challenge access structure ${\mathbb{A}}^{*}$ .

2. Transformation-Key-Extraction: Adversary $\mathcal{A}$ launches this query on attribute set $\mathrm{Att}$ . The challenger searches $〈\mathrm{Att},S{K}_{\mathrm{Att}},T{K}_{\mathrm{Att}},R{K}_{\mathrm{Att}}〉$ from the list $L$ . If such tuple exists, $\mathcal{C}$ outputs $T{K}_{\mathrm{Att}}$ to $\mathcal{A}$ . Otherwise, the challenger executes KeyGen and GenTK_out, and stores the generated tuple $〈\mathrm{Att},S{K}_{\mathrm{Att}},T{K}_{\mathrm{Att}},R{K}_{\mathrm{Att}}〉$ in the list $L$ . At last, it returns transformation key $T{K}_{\mathrm{Att}}$ to $\mathcal{A}$ . In addition, if it has queried Private-Key-Extraction based on $\mathrm{Att}$ , $\mathcal{A}$ is forbidden to make queries on Transformation-Key-Extraction for the same set $\mathrm{Att}$ .

Challenge: Adversary $\mathcal{A}$ submits two messages $M_0$ and $M_1$ with the same length, and a challenge access policy ${\mathbb{A}}^{*}$ that cannot be satisfied by $\mathrm{Att}$ . $\mathcal{C}$ randomly selects $b\in \{0,1\}$ and calculates $C{T}^{*}=\mathrm{Encrypt}(\mathrm{PK},M_b,{\mathbb{A}}^{*})$ . After that, $\mathcal{C}$ returns the challenge ciphertext $C{T}^{*}$ to $\mathcal{A}$ .

Query Phase 2: The adversary continues to make the same queries on Private-Key-Extraction and Transformation-Key-Extraction as in Query Phase 1. However, the private key should not meet the challenge access policy ${\mathbb{A}}^{*}$ .

Guess: Adversary $\mathcal{A}$ returns its guess $b\prime \in \{0,1\}$ on $b$ . If $b\prime =b$ , $\mathcal{A}$ wins the game.

The advantage of $\mathcal{A}$ in this game is defined as

$${\mathrm{Adv}}_{\mathrm{AB}{E}_{\mathrm{out}},\mathcal{A}}^{\mathrm{Con}}(1^{\lambda })=|\mathrm{Pr}[b\prime =b]-\frac{1}{2}|$$

Definition 3

This verifiability CP-ABE protocol with outsourced decryption is selectively CPA-secure if the advantage of all the PPT adversaries is negligible in the above security model.

Verifiability

The verifiability for CP-ABE protocol with outsourced decryption is proposed by the interaction between adversary and challenger in the following.

• Init: Adversary $\mathcal{A}$ submits ${\mathbb{A}}^{*}$ as a challenge access policy.

• Setup: Challenger $\mathcal{C}$ operates Setup to generate the public parameters $\mathrm{PK}$ and the master secret key $\mathrm{MSK}$ . After that, it returns $\mathrm{PK}$ to adversary.

• Query Phase 1: Adversary queries on Private-Key-Extraction and Transformation-Key-Extraction as in Query Phase 1 of the above security game.

• Challenge: Adversary $\mathcal{A}$ submits a message $M^{*}$ and a challenge access structure ${\mathbb{A}}^{*}$ to $\mathcal{C}$ , it calculates $C{T}^{*}=\mathrm{Encrypt}(\mathrm{PK},M^{*},{\mathbb{A}}^{*})$ and reponses it to $\mathcal{A}$ as a challenge ciphertext.

• Query Phase 2: The adversary adaptively launches the query in Query Phase 1.

• Output: Adversary $\mathcal{A}$ returns attribute set $\mathrm{At}{\mathrm{t}}^{*}$ and transformed ciphertext $C{T}^{*\prime }$ . We suppose that the tuple $(\mathrm{At}{\mathrm{t}}^{*},S{K}_{\mathrm{At}{\mathrm{t}}^{*}},T{K}_{\mathrm{At}{\mathrm{t}}^{*}},R{K}_{\mathrm{At}{\mathrm{t}}^{*}})$ is included in the list $L$ . Otherwise, $\mathcal{C}$ generates this tuple by querying on Private-Key-Extraction and Transformation-Key-Extraction. $\mathcal{A}$ wins this game if $\mathrm{Decryp}{t}_{\mathrm{out}}(\mathrm{PK},C{T}^{*},C{T}^{*\prime },R{K}_{\mathrm{At}{\mathrm{t}}^{*}})\in \{M^{*},\perp \}$ . Moreover, the advantage of $\mathcal{A}$ in above model is defined as

$$\begin{array}{c}{\mathrm{Adv}}_{\mathrm{AB}{E}_{\mathrm{out}},\mathcal{A}}^{\mathrm{Ver}}(1^{\lambda })\hfill \\ =\mathrm{Pr}[\mathrm{Decryp}{t}_{\mathrm{out}}(\mathrm{PK},C{T}^{*},C{T}^{*\prime },R{K}_{\mathrm{At}{\mathrm{t}}^{*}})\in \{M^{*},\perp \}]\hfill \end{array}$$

Definition 4

Verifiability

This CP-ABE scheme with outsourced decryption is verifiable, if the advantage ${\mathrm{Adv}}_{\mathrm{AB}{E}_{\mathrm{out}},\mathcal{A}}^{\mathrm{Ver}}(1^{\lambda })$ for all PPT adversaries $\mathcal{A}$ is negligible.

The architecture of system model

The architecture of this system consists of the DO (such as patient), the FNs, the CSS, the trusted authority (TA) and the DU (such as doctor and researcher). The relationship between them is described in Figure 2 and elaborated as follows.

Figure 2.

The system model of blockchain-enabled WBAN in fog computing.

DO in this system is considered as a patient, who enjoys the medical monitoring service from CSP. The wearable IoT devices collect the physiological data and medical images of the patient in WBAN, such as electrocardiograph (ECG), physical status video (PSV), blood pressure (BP), and so on. And then, these data are delivered to a collection device by the wireless network. Since the physical data are sensitive privacy information, for the sake of protecting the medical data and realizing fine-grained access control, DO designs an access policy that is used to encrypt the data under the verifiable outsourced decryption CP-ABE scheme with public system parameter $\mathrm{PK}$ acquired from TA. After that, the encrypted data is uploaded to the FN via Internet.

FN are located on the edge of network, which has the ability of computing, transmitting, and temporarily storing the medical data. There are three primary missions in our proposal. First, FN is in charge of retransmitting the ciphertext from DO to CSS. Second, after receiving the transformation key $\mathrm{TK}$ from DU, FN computes the transformed ciphertext $\mathrm{CT}$ and returns it back to DU. Third, FN manages and maintains a blockchain that stores the hash value of a public parameter $\mathrm{PK}$ , a transformation key $\mathrm{TK}$ , a ciphertext $\mathrm{CT}$ , and a transformed ciphertext $\mathrm{CT}\prime$ in every encrypting into a block chronologically. Depending on the purpose of anti-tamper, all the data stored in the blockchain will never be distorted by anyone. Specifically, according to this mode, any variations on this key or ciphertext would change the corresponding hash value in the blockchain, and all the entities in this system will perceive these variations. Consequently, blockchain is beneficial for protecting integrity in a verifiable and permanent method from inside and outside adversary.

CSS owns considerable storage space and calculation capability, which supplies outsourced storage and computation service to the customers. In this system, CSS is responsible for storing the outsourced data from DO in the form of ciphertext, which could be accessed by DU.

TA is a system parameter generator center, whose responsibility is generating the public parameters $\mathrm{PK}$ and master secret key, and distributing secret key to the registered DO and DU. Furthermore, it executes Setup and KeyGen algorithms as well.

DU represents the medical staff for diagnosis, the researcher for medical science and the relatives for solicitude, and so on. Each of registered user accepts the attribute secret key relying on its characteristics. If their attributes meet the access policy of DO, DU enables to access his or her medical data. In detail, after receiving the partial encrypted medical file (i.e. the transformed ciphertext $\mathrm{CT}\prime$ ) from FN, DU downloads the ciphertext $\mathrm{CT}$ from CSS for verification and decryption by taking advantage of attribute secret key and transformation key pair to achieve the accurate plaintext medical data.

Our construction

In this section, it lists some employed notations in Table 1. Furthermore, it designs seven concrete algorithms that are demonstrated in the following.

• $\mathrm{Setup}(1^{\lambda })\to (\mathrm{PK},\mathrm{MSK})$ : TA takes $1^{\lambda }$ as input, it selects a bilinear map $\hat{e}:G\times G\to G_T$ , where $G$ and $G_T$ are additional and multiplicative cyclic groups with prime order $p$ . Let $P$ be a generator of $G$ , TA chooses $\alpha ,\beta \in Z_p^{*}$ randomly and calculates $A=\hat{e}(P,P{)}^{\alpha },B=\beta P,B\prime =(1/\beta )P$ . Then, it picks two collision resistance hash functions $H_1:\{0,1{\}}^{*}\to Z_p^{*}$ and $H_2:G_T\to \{0,1{\}}^{*}$ . At last, TA returns the public parameters $\mathrm{params}=〈\hat{e},G,G_T,p,P,A,B,B\prime ,B,H_1,H_2〉$ and master secret key $\mathrm{MSK}=〈\alpha ,\beta 〉$ .

• $\mathrm{KeyGen}(\mathrm{PK},\mathrm{MK},\mathrm{Att})\to S{K}_{\mathrm{Att}}$ : Considering that $\Pi$ is linear secret sharing scheme (LSSS) for an access policy $\mathbb{A}$ , ³⁰ Att is an authorized attribute set and $I=|\mathrm{Att}|$ . Then, it obtains shares $\{a_i{\}}_{i\in I}$ of the secret $\gamma \in Z_p^{*}$ , and $\gamma =\sum _{i\in I}{a}_i{t}_i$ denotes the party corresponding to shares $\{a_i{\}}_{i\in I}$ as $\mathrm{at}{t}_i\in \mathrm{Att}$ , where $\{t_i\in Z_p{\}}_{i\in I}$ is the attribute underlying $\mathrm{at}{t}_i$ . For the different Att and Att′, $(\gamma =\sum _{i\in I}{a}_i{t}_i{)}_{\mathrm{at}{t}_i\in \mathrm{Att}}\ne (\gamma \prime =\sum _{i\in I\prime }{a_i}^{\prime }{t_i}^{\prime }{)}_{\mathrm{at}t{\prime }_i\in \mathrm{Att}\prime }$ holds. TA computes $K_1=((\alpha +\gamma )/\beta )P$ , $K_2=\gamma P$ , and sends $S{K}_{\mathrm{Att}}=〈K_1,K_2〉$ to DU with attribute Att.

• $\mathrm{Encrypt}(\mathrm{PK},M,\mathbb{A})\to \mathrm{CT}$ : To encrypt $M\in \{0,1{\}}^{*}$ , it first selects $\tilde{M}\in \{0,1{\}}^{*}$ and $s,s\prime \in Z_p^{*}$ . Next, DO computes

$$\begin{array}{c}\hat{C}=H_1(M)H_1(\tilde{M})P,C_1=M\oplus H_2(A^s),C_2=\mathrm{sB},C_3=\mathrm{sP}\hfill \\ C{\prime }_1=\tilde{M}\oplus H_2(A^{s\prime }),C{\prime }_2=s\prime B,C{\prime }_3=s\prime P\hfill \end{array}$$

Table 1.

Notions and meanings.

Notions	Meanings
$G$	The additional cyclic group with prime order $p$ .
$G_T$	The multiplicative cyclic group with prime order $p$ .
$P$	The generator of $G$ .
$H_i$	The collision resistance hash function $i=1,2$ .
$\mathrm{PK}$	The public parameters of this system.
$\mathrm{MSK}$	The master secret key of this system.
Att	The authorized attribute set.
$I$	The number of attribute in Att.
$S{K}_{\mathrm{Att}}$	The private key of user with attribute Att.
$T{K}_{\mathrm{Att}}$	The transformation key of user with attribute Att.
$R{K}_{\mathrm{Att}}$	The retrieving key of user with attribute Att.

After that, it returns the ciphertext

$$\mathrm{CT}=〈\mathbb{A},\hat{C},C_1,C_2,C_3,C{\prime }_1,C{\prime }_2,C{\prime }_3〉$$

• $\mathrm{Decrypt}(\mathrm{PK},S{K}_{\mathrm{Att}},\mathrm{CT})\to M$ : Input the private key $S{K}_{\mathrm{Att}}$ and ciphertext $\mathrm{CT}$ , DU calculates $〈D,D\prime 〉$ as follows

$$\begin{array}{c}\multicolumn{1}{c}{D=\frac{\hat{e}(C_2,K_1)}{\hat{e}(C_3,K_2)}=\frac{\hat{e}(s\beta P,((\alpha +\gamma )/\beta )P)}{\hat{e}(\mathrm{sP},\gamma P)}}\\ =\frac{\hat{e}{(P,P)}^{s(\alpha +\gamma )}}{\hat{e}{(P,P)}^{s\gamma }}=\hat{e}(P,P{)}^{s\alpha }\hfill \end{array}$$

$$\begin{array}{c}\multicolumn{1}{c}{D\prime =\frac{\hat{e}(C{\prime }_2,K_1)}{\hat{e}(C{\prime }_3,K_2)}=\frac{\hat{e}(s\prime \beta P,((\alpha +\gamma )/\beta )P)}{\hat{e}(s\prime P,\gamma P)}}\\ =\frac{\hat{e}{(P,P)}^{s\prime (\alpha +\gamma )}}{\hat{e}{(P,P)}^{s\prime \gamma }}=\hat{e}(P,P{)}^{s\prime \alpha }\hfill \end{array}$$

Then, it computes $M=C_1\oplus H_2(D)$ and $\tilde{M}=C{\prime }_1\oplus H_2(D\prime )$ . At last, if $\hat{e}(\hat{C},P)=\hat{e}(H_1(M)B,H_1(\tilde{M})B\prime )$ holds, it outputs the message $M$ . Otherwise, outputs ⊥ and aborts.

• $\mathrm{GenT}{K}_{\mathrm{out}}(\mathrm{PK},S{K}_{\mathrm{Att}})\to (T{K}_{\mathrm{Att}},R{K}_{\mathrm{Att}})$ : This algorithms takes the private key $S{K}_{\mathrm{Att}}$ as input, DU generates its transformation key pair by choosing $t\in Z_p^{*}$ randomly and computing $T{K}_{\mathrm{Att}}=〈K{\prime }_1=(1/t)K_1,K{\prime }_2=(1/t)K_2〉$ as a pair of transformation key, and $R{K}_{\mathrm{Att}}=t$ as a retrieving key.

• $\mathrm{Transfor}{m}_{\mathrm{out}}(\mathrm{PK},\mathrm{CT},T{K}_{\mathrm{Att}})\to \mathrm{CT}\prime$ : Given ciphertext $\mathrm{CT}$ and transformation key $T{K}_{\mathrm{Att}}$ , FN computes as belows

$$\begin{array}{c}\multicolumn{1}{c}{\frac{\hat{e}(C_2,K{\prime }_1)}{\hat{e}(C_3,K{\prime }_2)}=\frac{\hat{e}(s\beta P,((\alpha +\gamma )/t\beta )P)}{\hat{e}(\mathrm{sP},(\gamma /t)P)}}\\ =\frac{\hat{e}{(P,P)}^{(s(\alpha +\gamma ))/t}}{\hat{e}{(P,P)}^{s\gamma /t}}=\hat{e}(P,P{)}^{s\alpha /t}=T\hfill \end{array}$$

$$\begin{array}{c}\multicolumn{1}{c}{\frac{\hat{e}(C{\prime }_2,K{\prime }_1)}{\hat{e}(C{\prime }_3,K{\prime }_2)}=\frac{\hat{e}(s\prime \beta P,((\alpha +\gamma )/t\beta )P)}{\hat{e}(s\prime P,(\gamma /t)P)}}\\ =\frac{\hat{e}{(P,P)}^{((s\prime (\alpha +\gamma ))/t)}}{\hat{e}{(P,P)}^{s\prime \gamma /t}}=\hat{e}(P,P{)}^{s\prime \alpha /t}=T\prime \hfill \end{array}$$

Outputting the transformed ciphertext as

$$\mathrm{CT}\prime =〈\hat{T}=\hat{C},T,T\prime 〉.$$

• $\mathrm{Decryp}{t}_{\mathrm{out}}(\mathrm{PK},\mathrm{CT},\mathrm{CT}\prime ,R{K}_{\mathrm{Att}})\to M$ : DU downloads the ciphertext $\mathrm{CT}$ from CCS and checks whether $\hat{T}=\hat{C}$ . If not, it outputs ⊥ and aborts. Otherwise, computes $M=C_1\oplus H_2(T^t)$ and $\tilde{M}=C{\prime }_1\oplus H_2(T{\prime }^t)$ . Then, it verifies $\hat{e}(\hat{T},P)=\hat{e}(H_1(M)B,H_1(\tilde{M})B\prime )$ holds or not. If it is, returns the message $M$ . Otherwise, outputs ⊥ and aborts.

Security analysis

In this part, it proves that this protocol is selectively CPA-secure and verifiable in the standard model.

Theorem 1

Provided that the protocol in Waters ¹⁷ is selectively CPA-secure, our proposal is selectively CPA-secure as well.

Proof

This protocol is selectively CPA-secure under the following two games.

• $\mathrm{Gam}{e}_0$ : It is the original selectively CPA-secure game in CP-ABE protocol.

• $\mathrm{Gam}{e}_1$ : Challenger picks $\hat{C}\in G$ at random, and keeps the rest of challenge ciphertext to generate $\mathrm{CT}=〈\mathbb{A},\hat{C},C_1,C_2,C_3,C{\prime }_1,C{\prime }_2,C{\prime }_3〉$ as in $\mathrm{Gam}{e}_0$ .

The proof of this theorem consists of the following two lemmas. Lemma 1 proves the indistinguishability between $\mathrm{Gam}{e}_0$ and $\mathrm{Gam}{e}_1$ , while Lemma 2 demonstrates that the advantage of adversary in $\mathrm{Gam}{e}_1$ is negligible. Consequently, it concludes that the advantage in $\mathrm{Gam}{e}_0$ is also negligible.

Lemma 1

Assume that the scheme in Waters ¹⁷ is selectively CPA-secure, $\mathrm{Gam}{e}_0$ and $\mathrm{Gam}{e}_1$ are computationally indistinguishable.

Proof

Suppose that an adversary $\mathcal{A}$ distinguishes $\mathrm{Gam}{e}_0$ and $\mathrm{Gam}{e}_1$ with non-negligible probability, and an simulator $\mathcal{B}$ attacks the scheme ¹⁷ under the selective CPA security model with non-negligible advantage.

• $\mathcal{C}$ is a challenger in the selective CPA security model in Waters. ¹⁷ A simulator interacts with $\mathcal{A}$ by executing the following algorithms.

• Init: The adversary $\mathcal{A}$ delivers ${\mathbb{A}}^{*}$ to $\mathcal{B}$ as a challenge access structure. Then, the simulator gives this policy to $\mathcal{C}$ . The challenger feeds back the public parameters in additional group $\mathrm{PK}\prime =〈p,G,G_T,\hat{e},P,\mathrm{aP},\hat{e}(P,P{)}^{\alpha },\{T_i=s_{i}P{\}}_{\forall i}〉$ of Waters. ¹⁷

• Setup: $\mathcal{B}$ chooses $x,y\in Z_p^{*}$ at random and gets $B=\mathrm{xP},B\prime =\mathrm{yP}$ . Moreover, it chooses $H_1:\{0,1{\}}^{*}\to Z_p^{*}$ and $H_2:G_T\to \{0,1{\}}^{*}$ as two collision-resistant hash functions. $\mathcal{B}$ transmits $\mathrm{PK}=〈\hat{e},G,G_T,p,P,A,B,B\prime ,H_1,H_2〉$ to $\mathcal{A}$ .

• Query Phase 1: The adversary $\mathcal{A}$ makes a private key query on attribute set $\mathrm{At}{\mathrm{t}}_i$ . Simulator queries Private-Key-Extraction with $\mathcal{C}$ on $\mathrm{At}{\mathrm{t}}_i$ , and then accesses the private key $S{K}_{\mathrm{At}{\mathrm{t}}_i}$ . At last, $\mathcal{B}$ returns the private keys $S{K}_{\mathrm{At}{\mathrm{t}}_i}$ to adversary.

• Challenge: $\mathcal{A}$ submits two challenge plaintexts $M_0$ and $M_1$ with equal size to the simulator. It picks a value $\eta \in \{0,1\}$ and two message ${\tilde{M}}_0,{\tilde{M}}_1\in \{0,1{\}}^{*}$ randomly. Then, it sends $〈{\tilde{M}}_0,{\tilde{M}}_1,{\mathbb{A}}^{*}〉$ to the challenger. $\mathcal{C}$ selects random $\theta \in \{0,1\}$ , encrypts the message ${\tilde{M}}_{\theta }$ under $\mathrm{PK}\prime$ and ${\mathbb{A}}^{*}$ according to the encryption in Waters. ¹⁷ After that, the ciphertext $C{T}^{*\prime }=〈{\mathbb{A}}^{*},C{\prime }_1,C{\prime }_2,C{\prime }_3〉$ is sent to $\mathcal{B}$ . The simulator chooses $s\in Z_p^{*}$ randomly and computes $\hat{C}=H_1(M_{\eta })H_1({\tilde{M}}_{\eta })P,C_1=M_{\eta }\oplus H_2(A^s),C_2=\mathrm{sB}$ and $C_3=\mathrm{sP}$ . At last, $\mathcal{B}$ transmits the challenge ciphertext $C{T}^{*}=〈{\mathbb{A}}^{*},\hat{C},C_1,C_2,C_3,C{\prime }_1,C{\prime }_2,C{\prime }_3〉$ to $\mathcal{A}$ .

• Query Phase 2: $\mathcal{A}$ queries on Private-Key-Extraction adaptively as in Query Phase 1, and $\mathcal{B}$ responds it as before.

• Guess: $\mathcal{A}$ returns its guess $\eta \prime \in \{0,1\}$ for $\mathcal{B}$ , and it outputs $\eta \prime$ as its guess for $\theta$ .

Provided that $\eta =\theta$ , $\mathcal{B}$ has simulated $\mathrm{Gam}{e}_0$ appropriately. Otherwise, $\mathcal{B}$ has appropriately simulated $\mathrm{Gam}{e}_1$ with non-negligible advantage, we design an algorithm $\mathcal{B}$ as a simulator who attacks the selectively CPA-secure protocol with non-negligible advantage.

Lemma 2

Provided that the scheme in Waters ¹⁷ is selectively CPA-secure, the adversary’s advantage in $\mathrm{Gam}{e}_1$ is negligible.

Proof

Suppose that the advantage of $\mathcal{A}$ in $\mathrm{Gam}{e}_1$ is non-negligible. Besides, there is an algorithm $\mathcal{B}$ as a simulator who attacks the protocol ¹⁷ in the selectively CPA-secure model with a non-negligible advantage.

Assume that $\mathcal{C}$ is a challenger in selective CPA-security model, $\mathcal{B}$ interacts with $\mathcal{A}$ by running the algorithms as below.

• Init: $\mathcal{A}$ transmits a challenge access structure ${\mathbb{A}}^{*}$ to $\mathcal{B}$ . Simulator also gives ${\mathbb{A}}^{*}$ to $\mathcal{C}$ . The challenger $\mathcal{C}$ delivers the public parameters in the additional group $\mathrm{PK}\prime =〈p,G,G_T,\hat{e},P,\mathrm{aP},\hat{e}(P,P{)}^{\alpha },\{T_i=s_{i}P{\}}_{\forall i}〉$ of Waters ¹⁷ back to simulator.

• Setup: Simulator picks random $x,y\in Z_p^{*}$ , computes $B=\mathrm{xP},B\prime =\mathrm{yP}$ , and there are two hash functions $H_1:\{0,1{\}}^{*}\to Z_p^{*}$ and $H_2:G_T\to \{0,1{\}}^{*}$ with collision-resistant. After that, $\mathcal{B}$ transmits $\mathrm{PK}=〈\hat{e},G,G_T,p,P,A,B,B\prime ,H_1,H_2〉$ to adversary.

• Query Phase 1: $\mathcal{A}$ adaptively issues the private key query on $\mathrm{At}{\mathrm{t}}_i$ . Simulator receives a private key $S{K}_{\mathrm{At}{\mathrm{t}}_i}$ by querying Private-Key-Extraction with $\mathcal{C}$ on $\mathrm{At}{\mathrm{t}}_i$ . Then, the simulator returns the private key $S{K}_{\mathrm{At}{\mathrm{t}}_i}$ to adversary.

• Challenge: The adversary $\mathcal{A}$ submits two equal size messages $M_0$ and $M_1$ . Simulator sends $〈M_0,M_1,{\mathbb{A}}^{*}〉$ to $\mathcal{C}$ . After that, $\mathcal{C}$ picks $\theta \in \{0,1\}$ at random, encrypts $M_{\theta }$ under $\mathrm{PK}\prime$ and ${\mathbb{A}}^{*}$ as the encryption in Waters. ¹⁷ Then, it gives the result ciphertext $C{T}^{*\prime }=〈{\mathbb{A}}^{*},C_1,C_2,C_3〉$ back to $\mathcal{B}$ . The simulator $\mathcal{B}$ chooses $s\prime \in Z_p^{*}$ , $\tilde{M}\in \{0,1{\}}^{*}$ and $\hat{C}\in G_T$ randomly, and calculates $C{\prime }_1=\tilde{M}\oplus H_2(A^{s\prime }),C{\prime }_2=s\prime B,C{\prime }_3=s\prime P$ . At last, $\mathcal{B}$ transmits $C{T}^{*}=〈{\mathbb{A}}^{*},\hat{C},C_1,C_2,C_3,C{\prime }_1,C{\prime }_2,C{\prime }_3〉$ to $\mathcal{A}$ as a challenge ciphertext.

• Query Phase 2: Adversary queries on Private-Key-Extraction adaptively as in Query Phase 1. Simulator responses this query correspondingly.

• Guess: Finally, adversary returns a guess $\eta \prime \in \{0,1\}$ to simulator, it also takes $\eta \prime$ as its guess for $\theta$ .

Obviously, $\mathcal{B}$ has simulated $\mathrm{Gam}{e}_1$ appropriately. Provided that the advantage of adversary in $\mathrm{Gam}{e}_1$ is non-negligible, $\mathcal{B}$ attacks selectively CPA-secure protocol ¹⁷ with non-negligible advantage.

In conclusion, these two lemmas show that the first four algorithms in our protocol as basic CP-ABE protocol is selectively CPA-secure. After that, in the following theorem, we will prove that if basic CP-ABE protocol is selectively CPA-secure, the whole protocol is selectively CPA-secure as well.

Theorem 2

Provided that basic CP-ABE protocol is selectively CPA-secure, this protocol with outsourced decryption is selectively CPA-secure as well.

Proof

Suppose that, in the selectively CPA-secure model, the advantage of $\mathcal{A}$ is non-negligible. $\mathcal{B}$ acts as a simulator to attack the basic CP-ABE scheme with non-negligible advantage.

$\mathcal{C}$ is a challenger in the selectively CPA-secure model of basic CP-ABE protocol. Simulator interacts with $\mathcal{A}$ according to the algorithms as below.

• Init: The adversary $\mathcal{A}$ gives ${\mathbb{A}}^{*}$ to $\mathcal{B}$ as a challenge access structure. Then, simulator transmits this structure to $\mathcal{C}$ . Challenger outputs the public parameters $\mathrm{PK}=〈\hat{e},G,G_T,p,P,A,B,B\prime ,H_1,H_2〉$ of basic CP-ABE scheme to $\mathcal{B}$ .

• Setup: Simulator gives the above parameters $\mathrm{PK}$ to $\mathcal{A}$ .

• Query Phase 1: $\mathcal{B}$ maintains an empty list $L$ as well as a set E. $\mathcal{A}$ launches the following queries adaptively.

• Private-Key-Extraction: Based on the attribute set $\mathrm{Att}$ , $\mathcal{B}$ queries the key generation oracle to receive the private key $S{K}_{\mathrm{Att}}$ . After that, $\mathcal{B}$ sets E=E $\cup \{\mathrm{Att}\}$ and responses a private key $S{K}_{\mathrm{Att}}$ to $\mathcal{A}$ .

• Transformation-Key-Extraction: Based on the attribute set $\mathrm{Att}$ , $\mathcal{B}$ searches $〈\mathrm{Att},S{K}_{\mathrm{Att}},T{K}_{\mathrm{Att}},R{K}_{\mathrm{Att}}〉$ from the list $L$ . And outputting the transformation key $T{K}_{\mathrm{Att}}$ to the adversary $\mathcal{A}$ if it exists. Otherwise, $\mathcal{B}$ picks $u,v\in Z_p^{*}$ , computes $K{\prime }_1=((u+v)/\beta )P,K{\prime }_2=\mathrm{vP}$ , and $\mathcal{B}$ stores this tuple $〈\mathrm{Att},*,T{K}_{\mathrm{Att}}=(\mathrm{Att},K{\prime }_1,K{\prime }_2),u〉$ into $L$ and transmits it to $\mathcal{A}$ .

Note that, the simulator $\mathcal{B}$ is unable to access the actual retrieving key $R{K}_{\mathrm{Att}}=\alpha /u$ . It computes the following:

$$\begin{array}{c}\multicolumn{1}{c}{\frac{\hat{e}(C_2,K{\prime }_1)}{\hat{e}(C_3,K{\prime }_2)}=\frac{\hat{e}(s\beta P,\left(\frac{u+v}{\beta }\right)P)}{\hat{e}(\mathrm{sP},\mathrm{vP})}}\\ =\frac{\hat{e}{(P,P)}^{s(u+v)}}{\hat{e}{(P,P)}^{\mathrm{sv}}}=\hat{e}(P,P{)}^{\mathrm{su}}=T\hfill \end{array}$$

$$\begin{array}{c}{C}_1\oplus H_2(T^{R{K}_{\mathrm{Att}}})\hfill \\ =M\oplus H_2(\hat{e}(P,P{)}^{s\alpha })\oplus H_2(\hat{e}(P,P{)}^{\mathrm{su}\frac{\alpha }{u}})=M\hfill \end{array}$$

• Challenge: Adversary submits two equal size messages $〈M_0,M_1〉$ and ${\mathbb{A}}^{*}$ as a challenge access policy. $\mathcal{B}$ transmits the tuple $〈M_0,M_1,{\mathbb{A}}^{*}〉$ to challenger to compute $C{T}^{*}$ on $M_{\eta }$ as a challenge ciphertext, where $\eta \in \{0,1\}$ . After that, $\mathcal{B}$ returns $C{T}^{*}$ to $\mathcal{A}$ .

• Query Phase 2: $\mathcal{A}$ makes a private key query adaptively as in Query Phase 1. $\mathcal{B}$ returns the answer correspondingly.

• Guess: $\mathcal{A}$ returns a value $\eta \prime$ as its guess on $\eta$ , and $\mathcal{B}$ responses $\eta \prime$ as well.

Provided that the guess $\eta \prime$ of $\mathcal{A}$ in this protocol is correct, the guess in basic CP-ABE scheme is also correct. Therefore, it concludes that if $\mathcal{A}$ enables to attack the proposal with non-negligible advantage, in the selectively CPA-secure model, there is a simulator $\mathcal{B}$ that attacks basic CP-ABE protocol with non-negligible advantage.

Theorem 3

Provided that CBDH assumption defined in Definition 1 holds, this CP-ABE protocol with outsourced decryption is verifiable.

Proof

Assume that $\mathcal{A}$ attacks verifiability of this scheme with non-negligible advantage. In addition, $\mathcal{B}$ acts as a simulator that enables to solve CBDH problem with non-negligible advantage.

• Setup: Simulator $\mathcal{B}$ randomly picks $\alpha ,x,y\in Z_p^{*}$ , let $H_1:\{0,1{\}}^{*}\to Z_p^{*}$ and $H_2:G_T\to \{0,1{\}}^{*}$ be collision-resistant hash functions. After that, simulator defines the public parameters $\mathrm{PK}=〈\hat{e},G,G_T,p,P,A=\hat{e}(P,P{)}^{\alpha },B=\mathrm{xP},B\prime =\mathrm{yP},H_1,H_2〉$ , and master secret key $\mathrm{MSK}=\alpha$ . It returns $\mathrm{PK}$ to adversary.

• Query Phase 1: $\mathcal{A}$ makes some queries on $\mathrm{KeyGen}(\mathrm{PK},\mathrm{MK},\mathrm{Att})$ , $\mathrm{Transfor}{m}_{\mathrm{out}}(\mathrm{PK},\mathrm{CT},T{K}_{\mathrm{Att}})$ , $\mathrm{Decrypt}(\mathrm{PK},S{K}_{\mathrm{Att}},\mathrm{CT})$ and $\mathrm{Decryp}{t}_{\mathrm{out}}(\mathrm{PK},\mathrm{CT},\mathrm{CT}\prime ,R{K}_{\mathrm{Att}})$ algorithms. As simulator possesses master secret key $\mathrm{MSK}$ , it is able to response these queries properly.

• Challenge: $\mathcal{A}$ submits a message $M^{*}$ and a challenge access policy ${\mathbb{A}}^{*}$ to $\mathcal{B}$ . The simulator calculates the ciphertext $C{T}^{*}$ of $M^{*}$ and returns $C{T}^{*}=〈{\mathbb{A}}^{*},\hat{C},C_1,C_2,C_3,C{\prime }_1,C{\prime }_2,C{\prime }_3〉$ to $\mathcal{A}$ , where $\hat{C}=H_1(M^{*})H_1({\tilde{M}}^{*})P$ and ${\tilde{M}}^{*}\in \{0,1{\}}^{*}$ is selected by the simulator at random. Note that, $\mathcal{B}$ is forbidden to access the random parameter $s$ .

• Query Phase 2: Adversary launches the same query on private key as in Query Phase 1, and simulator responses as before.

• Output: $\mathcal{A}$ returns an attribute set $\mathrm{At}{\mathrm{t}}^{*}$ and the transformed ciphertext $C{T}^{*\prime }=〈\hat{T}=\hat{C},T,T\prime 〉$ . Simulator $\mathcal{B}$ computes $C_1\oplus H_2(T^{t_{\mathrm{At}{\mathrm{t}}^{*}}})=M$ and $C{\prime }_1\oplus H_2(T{\prime }^{t_{\mathrm{At}{\mathrm{t}}^{*}}})=\tilde{M}$ , where $t_{\mathrm{At}{\mathrm{t}}^{*}}$ is a retrieving key for the attribute set $\mathrm{At}{\mathrm{t}}^{*}$ controlled by simulator $\mathcal{B}$ .

Furthermore, if $\mathcal{A}$ wins the above game, $\mathcal{B}$ has ability of computing

$$\begin{array}{c}\multicolumn{1}{c}{{\left[\frac{\hat{e}(C_2,K_1)}{\hat{e}(C_2,\gamma B\prime )}\right]}^{\frac{1}{\alpha }}={\left[\frac{\hat{e}(\mathrm{sxP},(\alpha +\gamma )\mathrm{yP})}{\hat{e}(\mathrm{sxP},\gamma \mathrm{yP})}\right]}^{\frac{1}{\alpha }}}\\ ={\left[\frac{\hat{e}{(P,P)}^{\mathrm{xys}(\alpha +\gamma )}}{\hat{e}{(P,P)}^{\mathrm{xys}\gamma }}\right]}^{\frac{1}{\alpha }}=\hat{e}(P,P{)}^{\mathrm{xys}}\hfill \end{array}$$

where $\alpha$ and $\gamma$ are controlled by the simulator $\mathcal{B}$ . Thus, $\mathcal{B}$ solves the CDBH problem, which is paradoxical. Therefore, this CP-ABE protocol with outsourced decryption is verifiable.

Performance evaluation

In this section, it demonstrates the cost evaluation between this protocol and other related schemes^{19,28–31,40} from the aspects of communication and computation overhead.

Communication overhead

Let $|G|$ and $|G_T|$ be the element length in the additional cyclic group $G$ and the multiplicative cyclic group $G_T$ , respectively. $N$ denotes the number of attribute, and $L_M$ denotes the length of message. For scheme in Qin et al., ²⁸ $L_{\mathrm{SE}}$ is denoted to the length of a symmetric encryption ciphertext, and $L_{\mathrm{VK}}$ is the length of a verification key. Moreover, for protocol in Mao et al., ²⁹ $L_{\mathrm{CM}}$ is represented to the length of commit on a message. As shown in Table 2, it compares the communication cost in the phase of KeyGen, Encrypt, GenTK_out, and Transform_out. In the algorithm of KeyGen, the communication overhead between TA and DU is $2|G|$ . In the algorithm of Encrypt, the communication overhead between DO and CSS in our scheme is $(5|G|+2L_M)$ . In the phase of transformation key generation, the overhead in communication is also $2|G|$ . Meanwhile, in the algorithm of Transform_out, the communication overhead between FN and DU is $(|G|+2|G_T|)$ . To sum up, from this table, we can conclude that the size of the transmitted data with constant length in every phase is the smallest, which indicates a significant advantage of our protocol in communication.

Table 2.

Comparison of communication overhead.

Schemes	KeyGen	Encrypt	GenTKout	Transformout
Lai et al. 19	$N+(N+2)|G_T|$	$(4N+3)|G|+2|G_T|$	$N+(N+2)|G_T|$	$|G|+4|G_T|$
Qin et al. 28	$(N+2)|G_T|$	$(2N+1)|G|+|G_T|+L_{\mathrm{SE}}+L_{\mathrm{VK}}$	$(N+2)|G_T|$	$2|G_T|+L_{\mathrm{SE}}+L_{\mathrm{VK}}$
Mao et al. 29	$N+(N+2)|G_T|$	$(2N+2)|G|+L_M+L_{\mathrm{CM}}$	$N+(N+2)|G_T|$	$|G|+|G_T|+L_M+L_{\mathrm{CM}}$
Li et al. 30	$2|G_T|$	$5|G|+2|G_T|$	$2|G_T|$	$|G|+4|G_T|$
Li et al. 31	$N+(N+2)|G_T|$	$(2N+3)|G|+L_M$	$N+(N+2)|G_T|$	$2|G|+|G_T|+L_M$
Zuo et al. 40	$(2N+1)|G_T|$	$(N+2)|G_T|+2L_M$	$(2N+1)|G_T|$	$|G_T|+2L_M$
Ours	$2|G|$	$5|G|+2L_M$	$2|G|$	$|G|+2|G_T|$

Computation overhead

We implement our scheme with previous works^30,31,40 depending on pairing-based cryptography (PBC) library, ⁴⁴ the operations are executed on the 64-bit Windows 10 operation system, 2.20-GHz Intel Core i5-5200u CPU with 8-GB RAM. Concretely, we select the Type A elliptic curve parameter with the 160-bit order. Figures 3–7 demonstrate the experimental results in the average time of 100 operations. Specifically, in Figure 3, because of integrating the attribute into $\gamma$ , it is obvious that the overhead of key generation in this protocol is constant and more efficient than others. We compare the time of encryption spent among these four schemes in Figure 4, which shows that our cost is much less than others for the reason that the overhead in this protocol is not increased with the quantity of attribute embedded in the access policy. Figures 5 and 7 show that the cost of decryption and outsourced decryption, respectively. However, the overhead of our proposal is a little more than Li et al.’s protocol ³⁰ for the reason that it needs one more bilinear pairing operations in our verification algorithm. Finally, in Figure 6, it demonstrates that the operation cost of this proposal is equal to the scheme in Li et al. ³⁰ in the phase of transformation. Conclusions as a result, this protocol shows a better performance in the phases of KeyGen, Encrypt, Decrypt, Transform_out, and Decrypt _out , respectively.

Figure 3.

The cost of KeyGen algorithm.

Figure 4.

The cost of Encrypt algorithm.

Figure 5.

The cost of Decrypt algorithm.

Figure 6.

The cost of Transform_out algorithm.

Figure 7.

The cost of Decrypt_out algorithm.

Conclusion

In this article, it presents a lightweight verifiable outsourced CP-ABE protocol for the typical WBAN in IoT, which enables a user to verify the correctness of the transformed ciphertext. The security is proven to be selectively CPA-secure, and the verifiability is reduced to CBDH assumption in the standard model. In addition, the complicated decryption operation is outsourced to the FN instead of being laid on the device of DU. As for the communication and computation overhead, they do not depend on the amount of attributes, which reduces the cost of the whole system greatly. Therefore, this scheme has some applications in the limited power devices, such as IoTs. Moreover, our scheme takes advantage of fog computing to provide low latency and real-time interactions, while the blockchain protects the public parameter and ciphertext from being tampered by the inside and outside adversary.