Efficient and accountable anti-leakage attribute-based encryption scheme for cloud storage

Abstract

To ensure secure and flexible data sharing in cloud storage, attribute-based encryption (ABE) is introduced to meet the requirements of fine-grained access control and secure one-to-many data sharing. However, the computational burden imposed by attribute encryption renders it unsuitable for resource-constrained environments such as the Internet of Things (IoT) and edge computing. Furthermore, the issue of accountability for illegal keys is crucial, as authorized users may actively disclose or sell authorization keys for personal gain, and keys may also passively leak due to management negligence or hacking incidents. Additionally, since all authorization keys are generated by the attribute authorization center, there is a potential risk of unauthorized key forgery. In response to these challenges, this paper proposes an efficient and accountable leakage-resistant scheme based on attribute encryption. The scheme adopts more secure online/offline encryption mechanisms and cloud server-assisted decryption to alleviate the computational burden on resource-constrained devices. For illegal keys, the scheme supports accountability for both users and the authorization center, allowing the revocation of decryption privileges for malicious users. In the case of passively leaked keys, timely key updates and revocation of decryption capabilities for leaked keys are implemented. Finally, the paper provides selective security and accountability proofs for the scheme under standard models. Efficiency analysis and experimental results demonstrate that the proposed scheme enhances encryption/decryption efficiency, and the storage overhead for accountability is also extremely low.

1. Introduction

As the increasing popularity of IoT applications and the rapid maturation of cloud computing, cloud storage outsourcing services [1], [2], [3], [4] have become increasingly prevalent. This practice reduces the need for local storage and facilitates efficient data sharing. While cloud service providers offer substantial computing and storage benefits, complete trust in them is not assured, as they possess access to the stored data. As a precaution, encryption mechanisms are typically employed before outsourcing to ensure data security in a semi-trusted or compromised cloud environment. Additionally, given that data on the cloud is accessed by numerous users, the establishment of appropriate access control schemes becomes imperative to restrict data access.

Although public key encryption provides powerful encryption functions, it requires the public keys of all users to encrypt data, leading to the generation of multiple copies of encrypted data. Meanwhile, when numerous participants engage in data sharing, symmetric encryption may encounter maintenance costs and key distribution problems. For the aforementioned issues, Attribute-Based Encryption (ABE) [5], proposed by Sahai and Waters, is considered a promising encryption method. It associates access control with users' attributes, allowing only users who satisfy specific attribute requirements to access data. This feature makes it particularly useful for securely sharing data in outsourcing scenarios. Subsequently, scholars have proposed more ABE schemes specifically for use on public cloud platforms such as AWS and Azure [6], [7], with ongoing efforts focused on enhancing their functionality, efficiency, and resilience against attacks [8], [9], [10], [11].

In the past, traditional attribute-based encryption methods [12] were limited in their application in IoT and edge computing due to their relatively complex computation process. Particularly in these environments, devices like smart sensors and edge devices often possess limited computational resources. Traditional attribute-based encryption methods cannot meet the requirements of these resource-limited devices for efficient encryption and decryption functions. Employing online/offline encryption mechanisms [13] and outsourcing decryption processes [14] can effectively alleviate the computational burden overhead associated with encryption and decryption tasks. However, ensuring the security of offline ciphertext and the correctness of outsourced decryption poses a significant challenge, especially in the face of potential malicious attacks or system failures.

In attribute-based encryption systems, malicious users can sell their authorized attribute keys to unauthorized users for profit. Due to the fact that in most schemes, authorized keys are independently generated by the authority center, this would result in the authority center being able to forge keys with decryption capabilities. Based on this, malicious users can claim that the illegal key was leaked by the authorization center rather than themselves when they are traced [15]. Therefore, supporting the accountability of both the user and the authorization center for illegal keys is an important design consideration [16]. However, there are certain limitations when it comes to addressing passively leaked user keys. Considering that passive leakage may result from external attacks, hacking incidents, or management oversights, merely revoking a user's decryption privileges might not be the most appropriate response. Therefore, to ensure data is protected against unauthorized access via leaked keys, a more intelligent key update method is needed, one that can effectively revoke the decryption ability of leaked keys.

1.1. Related work

In 2005, Sahai and Waters first proposed a fuzzy identity-based encryption scheme [5], which was the first attribute-based encryption algorithm. In 2007, Bethencourt et al. [17] extended this concept to introduce ciphertext-policy attribute-based encryption (CP-ABE). In CP-ABE, a user's key embeds a set of attributes related to their identity, while data owners define access policies to determine which individuals with specific attributes can access ciphertext. This imbues CP-ABE with high flexibility and wide applicability in cloud services. However, as the access control capabilities have improved, attribute-based encryption systems face the challenge of high computational overhead, which inconveniences resource-limited users. To address the issue of inefficient user decryption, Green et al. [18] proposed a ciphertext outsourcing decryption scheme based on attribute based encryption in 2011, which utilizes blind techniques to handle attribute keys. This scheme is widely used in outsourcing decryption. Subsequently, based on the outsourcing decryption scheme [18], subsequent scholars proposed various outsourcing decryption schemes with richer functions [19], [20], [21], [22]. Li et al. [23] developed an ABE scheme that facilitates efficient verification of outsourced decryption results. Varri et al. [24] leveraged edge computing to alleviate the burden of resource consumption caused by encryption and decryption on users. Apart from the decryption overhead, attribute-based encryption processes remain challenging for resource-constrained devices. To alleviate the computational load during encryption, Even et al. [25] introduced the concept of online/offline encryption algorithms in 1996, allowing pre-computation of intensive tasks in an offline phase. Building on this concept, Hohenberger and Waters [26] incorporated the online/offline encryption method into ABE, proposing the first online/offline ABE scheme. In 2017, Zhang et al. [27] proposed an unbounded online/offline CP-ABE scheme based on non-monotonic access structures.

On the other hand, user accountability in CP-ABE continues to be a major concern. Malicious users may intentionally share their keys with unauthorized individuals, granting these individuals access to encrypted data. Additionally, since users' attribute keys are solely generated by the authority center, this could lead to instances of authority center key abuse. Specifically, the authority center is capable of generating and distributing authorized decryption keys according to a user's attribute list without the risk of being detected for key abuse. Auditors face difficulties in determining the culpability of key owners since it is possible that the authority center may have leaked legitimate keys to unauthorized users. A common approach to address this issue is to embed some user private information in their keys that the authority center is unaware of. Li et al. [28] were the first to propose a scheme addressing illegal key sharing and implementing access policy hiding to protect user privacy. Liu et al. [29], [30] introduced two schemes that support black-box tracing and white-box tracing for illegal keys. But both schemes are constructed using composite order bilinear group, impacting algorithm efficiency. To enhance efficiency, Ning et al. [31], [32] developed two CP-ABE schemes supporting white-box tracking using prime order bilinear group construction. Zhang et al. [33] proposed a traceable scheme featuring online/offline encryption. Additionally, Zhang et al. [34] proposed a CP-ABE scheme supporting authority center accountability through techniques such as discrete logarithm zero-knowledge proofs. In 2016, Yu et al. [35] proposed an authority-traceable ABE scheme with public verifiability, allowing auditors to verify publicly whether leaked keys originated from malicious users or authority entities. In 2017, in the scheme designed by Zhang et al. [36], decryption keys are generated through interaction between users and the authority center, and auditors can identify the identity of forgers. In 2020, Li et al. [37] built an authority center accountable scheme supporting access policy hiding based on prime-order bilinear groups. In 2021, Hei et al. [38] proposed a solution assisted by blockchain to address illegal authorization and key leakage issues.

1.2. Motivation and our contributions

1.2.1. Motivation

We have analyzed certain limitations present in existing solutions. Our work aims to design an efficient and flexible ABE scheme for secure cloud storage, addressing these constraints.

(1) High Computational Costs: The high computational costs associated with encryption and decryption pose critical barriers to deploying traditional attribute-based encryption schemes on resource-constrained devices. While some schemes adopt online/offline encryption mechanisms and outsourced decryption to alleviate computational pressure, they still face challenges related to the secure storage of offline ciphertexts [18], [33], [39] and the correctness of outsourced decryption [19], [27], [28].

(2) Key Escrow Problem: In schemes [19], [34], [35], the majority involve the attribute authorization center generating outsourced keys and final decryption keys for users, leading to a key custody problem. During the process of tracking malicious users, those accused may argue that the keys were not leaked by them but rather by the attribute authorization center. To eliminate disputes, the issue of key custody must be addressed.

(3) Abuse of Attribute Keys: Malicious users may exploit attribute keys for personal gain by selling their authorized attribute keys to unauthorized users, thereby enabling unauthorized users to gain access to encrypted data. Additionally, the attribute authorization center could also fabricate a decryption key with the ability to decrypt, without the risk of being discovered [36], [37]. Therefore, tracking and assigning accountability for illegal keys is an urgent issue in need of resolution.

(4) Inappropriate User Revocation: Considering that users may involuntarily leak their keys due to improper personal storage practices or external attacks, directly revoking decryption privileges might not be an appropriate solution.

1.2.2. Our contributions

In response to the aforementioned issues, this paper proposes an efficient and accountable anti-leakage attribute encryption scheme, which offers the following contributions:

(1) Secure Online/Offline Encryption: To mitigate the substantial computational burden imposed by attribute encryption on devices with limited computing resources, we have adopted a more secure online/offline encryption technique. Recognizing the potential vulnerability of offline ciphertexts to attacks, which could allow unauthorized decryption of attribute ciphertexts, this paper introduces an additional layer of encryption for offline ciphertexts, decrypted and utilized upon going online.

(2) Key Escrow Free: To diminish dependence on the attribute authorization center, the complete attribute key is generated by the cooperation between the attribute authorization center and the user. The user selects and keeps the final decryption key private. Without it, the attribute authorization center cannot generate a valid decryption key for a legitimate user.

(3) Verifiable Outsourced Decryption: In order to release the user's decryption pressure, cloud servers use outsourced decryption keys for semi decryption. Based on the discrete logarithm problem, cloud servers cannot obtain plaintext without the final decryption key. To avoid cloud servers returning incorrect semi decryption results due to system errors or external attacks, users can verify the correctness of cloud server semi decryption through verification key.

(4) Illegal Key Accountability: For captured illegal keys, we establish white-box traceability. Any user's voluntary disclosure of keys or the attribute authorization center's forging of keys can be traced back. Users are mandated to digitally sign their final decryption keys for identity verification in cases of illegal key accountability.

(5) Passive Leakage Updateable: In instances of users voluntarily disclosing keys, they are removed from the authorized user list, thereby revoking their decryption privileges. In cases of passive key leakage due to attacks or intrusion, users can promptly update their decryption keys to annul the decryption capabilities of the original keys.

Our scheme innovatively proposes an efficient and accountable anti-leakage attribute-based encryption scheme. The scheme cleverly combines online/offline encryption and outsourced decryption, alleviating the computational burden of encryption and decryption. Furthermore, the scheme also addresses the issues of key escrow and key misuse by users and the authorization center. It specifically designs key update algorithm in the event of key leakage. Finally, we provide proof against selective plaintext attack and accountability of the scheme.

2. Preliminaries

In this section, we introduce several preliminary knowledge related to the proposed scheme.

2.1. Bilinear maps

Definition 3

(Bilinear Maps) Let $G_0$ and $G_T$ be two groups with the prime order p. A bilinear pairing satisfies the following properties.

(1) bilinearity: ∀$u,v\in G_0$, $a,b\in Z_p$, $e(u^a,v^b)=e{(u,v)}^{ab}$.

(2) non-degeneracy: $e(u,v)\ne 1$.

(3) Computability: There is a polynomial time algorithm to compute $e(u,v)\in G_T$ for any $u,v\in G_0$.

2.2. Assumptions

Definition 4

($q-SDH$ Assumption [40]) Let G be a bilinear group of prime order p and g be a generator of G, the q-Strong Diffie-Hellman ($q-SDH$) problem in G is defined as follows: given $(g,g^a,g^{a^2},...,g^{a^q})$ as inputs, output a pair $(\beta ,g^{1/(\beta +a)})\in Z_p\times G$. An algorithm $\mathcal{A}$ has advantage ε in solving $q-SDH$ in G if

$$\mathrm{Pr}[\mathcal{A}(g,g^a,g^{a^2},...,g^{a^q})=(\beta ,g^{1/(\beta +a)})]\ge \epsilon$$

Definition 5

($q-BDHE$ Assumption [41]) Let G be a bilinear group of prime order p and g be a generator of G. Let $\lambda ,s,a_1,...,a_q\in Z_p$ be chosen at random. If an adversary $\mathcal{A}$ is given

$$\begin{array}{c}\overline{y}=\{g,g^s,\hfill \\ g^{{\lambda }^i},\forall i\in [2q],i\ne q+1\hfill \\ g^{s{a}_j},\forall j\in [q]\hfill \\ g^{{\lambda }^i/a_j},\forall (i,j)\in [2q,q],i\ne q+1\hfill \\ g^{s{\lambda }^i{a}_j/a_{j^{\prime }}},\forall (i,j,j^{\prime })\in [q,q,q],j\ne j^{\prime }\}\hfill \end{array}$$

it is hard for the attacker $\mathcal{A}$ to distinguish $e{(g,g)}^{s{\lambda }^{q+1}}\in G_T$ from an element T that is randomly chosen from $G_T$.

2.3. Notations

The main notations presented in this paper are summarized in Table 1.

Table 1.

Summary of Notations.

Notation	Description
$\mathcal{K}$	key space
x∈RB	randomly select an element from set B
h	hash function $h:{\{0,1\}}^{⁎}\to \mathcal{K}$
H	hash function H:{0,1}⁎ → Zp
PP/MSK	public parameters/master secret key
S/(M,ρ)	attribute set/access structure
SKid,S	attribute key of user (with identity id and attribute set S)
UL	authorized user list
CT/FT/TCT	ciphertext/Offline ciphertext/Semi decrypted ciphertext
Kpub,id/Kpri,id	digital signature public/private key pair of user id
VKM	verification key
SEnc/SDec	cryptographic secure symmetric encryption/decryption pair
SigM/Sigid	digital signature of verification key/user id
sign/ver	digital signature/verify signature

3. Problem formulation

In this section, we will introduce the system model, the definition of the scheme algorithm, and the security model for the proposed scheme in this paper.

3.1. System model

The system model proposed in this paper is illustrated in Fig. 1. It consists of six types of entities: Certificate Authority (CA), Attribute Authority (AA), Third Party Auditor (TPA), Cloud Server (CS), Data Owner (DO), and Data User (DU).

Figure 1.

System model.

Certificate Authority (CA): CA performs system parameter configuration and distributes digital signature keys to users.

Attribute Authority (AA): AA is responsible for user registration and generating attribute keys for users. It also generates an authorized user list and uploads it to the cloud server.

Third Party Auditor (TPA): The TPA validates the validity of the keys in the system and holds entities accountable for any illegal activities. If the AA forges the keys, further actions are taken against the involved parties. If a malicious user actively leaks the keys, their decryption privileges are revoked.

Cloud Server (CS): The CS has powerful computing capabilities and immense storage capacity. It stores encrypted files of the data owners and, upon receiving decryption requests from data users, partially decrypts the ciphertext, sending the partially decrypted results and relevant verification information to the users.

Data Owner (DO): The DO utilizes cloud storage services to store files. Before storage, the DO encrypts the plaintext. Specifically, the DO specifies an access policy, embedding it into the ciphertext during encryption to achieve fine-grained access control.

Data User (DU): DU can request access to data from the cloud server. If the user's attributes satisfy the access policy defined by the DO, the cloud server will respond to the decryption request. The DU can perform the final decryption on the partially decrypted ciphertext. Additionally, DU can update the leaked key and revoke the decryption ability of the leaked key.

3.2. Definition of our scheme

The efficient and accountable anti-leakage encryption scheme consists of 10 algorithms:

• •$Setup(\kappa )$. CA takes a security parameter as input and generates two outputs: public parameters $(PP)$ and master secret key $(MSK)$.
• •$KeyGen(MSK,PP,id,S)$. AA interacts with the user to output attribute keys. AA takes inputs such as the public parameters PP, the system master key MSK, the user id, and the attribute set S, and outputs the user's attribute key SK and the authorized user list UL. The attribute key SK embeds the information of the AA and the user.
• •$Offline.Encrypt(PP,U)$. The input consists of public parameters PP and attribute universe U, and the output is the offline ciphertext $C_{FT}$ obtained through symmetric encryption.
• •$Online.Encrypt(PP,C_{FT},(\mathbf{\text{M}},\rho ))$. The input consists of public parameters PP, encrypted offline ciphertext $C_{FT}$, and an access policy $(\mathbf{\text{M}},\rho )$. The output includes attribute ciphertext CT, verification keys $V{K}_M$, and the signature of the verification keys $Si{g}_M$.
• •$Cloud.Decrypt(CT,UL,S{K}_{id,S})$. The input includes attribute ciphertext CT, authorized user list UL, and user attribute key $S{K}_{id,S}$. If the user is part of the authorized user list and their attribute set satisfies the access policy, the output is the partially decrypted ciphertext TCT. Otherwise, the output indicates a failure in partial decryption.
• •$User.Decrypt(TCT,C^{⁎},C_M,K_{fin})$. The input consists of the partially decrypted ciphertext TCT, the ciphertext $C^{⁎}$ and $C_M$, and the user's final decryption key $K_{fin}$. The output is the plaintext M.
• •$Verify(\zeta ,C_M,V{K}_M,Si{g}_M)$. The input includes the decryption result ζ, the symmetric ciphertext $C_M$, the verification key $V{K}_M$, and the signature of the verification key $Si{g}_M$. If the verification is successful, the output is 1. Otherwise, the output is 0.
• •$Accountability(S{K}_{id,S},PP,UL)$. The input includes the captured illegal key $S{K}_{id,S}$, public parameters PP, and the authorized user list UL. If the illegal key fails the validity check, the output ⊥ indicates that it is not a valid key. Otherwise, the output indicates either a user or AA.
• •$UserRevocation(id,UL)$. The input consists of the malicious user id and the authorized user list UL. The output is the updated authorized user list $U{L}^{\prime }$ after revocation.
• •$KeyUpdate(S{K}_{id,S})$. The input is the leaked key $S{K}_{id,S}$, and the output the updated key $S{K}_{id,S,new}$.

3.3. Security model

3.3.1. IND-CPA security model

In this section, we will describe the security model of our scheme through a game between an adversary and a challenger. The specific game is shown in Fig. 2.

Figure 2.

IND-CPA security game.

Definition 6

If for any PPT adversary, the advantage of winning in the above game is negligible, then the scheme is considered $IND-CPA$ secure.

3.3.2. Accountability security model

As shown in Figure 3, Figure 4, we will define two games for accountability targeting dishonest AA and dishonest users, respectively.

Figure 3.

The DishonestAA Game.

Figure 4.

The DishonestUser Game.

In the dishonest AA game, malicious AA will attempt to calculate the key family number b in the user's decryption key. We define the DishonestAA Game of our scheme through an interactive game between an adversary and a challenger.

In the dishonest user game, if the adversary generates a new secret key $S{K}_{id}^{\prime }$ associated with the queried identity id, it means that the information related to the identity id in the key has been successfully modified.

Definition 7

If the advantage of winning in the above two games is negligible for any PPT adversary, then the scheme is considered accountable.

4. Construction of our scheme

In this section, we have described the specific construction of the scheme proposed in this paper.

(1) $Setup(\kappa )$. Let G be a bilinear group of prime order p and g be a generator of G. Let $e:G\times G\to G_T$ be the bilinear map. Define attribute universe U and hash functions $h:{\{0,1\}}^{⁎}\to \mathcal{K}$ and $H:{\{0,1\}}^{⁎}\to Z_p$. Generate digital signature key pairs $\{K_{pub,id},K_{pri,id}\}$ for user id in the system. Given a security parameter κ as input, CA randomly selects $\alpha ,a,\delta {\in }_R{Z}_p$. The public parameters of the system $PP=(g,A=g^a,g^{\delta },e{(g,g)}^{\alpha },h,H)$ and the master key $MSK=(\alpha ,a,\delta )$. The CA distributes MSK to the registered attribute authority.

(2) $KeyGen(MSK,PP,id,S)$. When a user applies to join the system, it first chooses a random number $b{\in }_R{Z}_p$ and compute $\theta =g^b$. Set its personal final decryption key $K_{fin}=b$ and keep it secret. Additionally, it calculates the signature $Si{g}_{id}=sig{n}_{K_{pri,id}}(H(id||b))$. The user sends both θ and $Si{g}_{id}$ to the AA. Based on the user id and attribute set S, AA generates attribute key for the user.

AA randomly selects $\gamma ,t{\in }_R{Z}_p$ and computes $K_{id}={\theta }^{\frac{\alpha }{\delta +\gamma }}{\theta }^{at}=g^{\frac{\alpha b}{\delta +\gamma }}{g}^{bat}$, $K_1=\gamma$, $K_2={\theta }^t=g^{bt}$, $K_3={\theta }^{\delta t}=g^{\delta bt}$, $K_x={\theta }^{H(x)(\delta +\gamma )t}=g^{H(x)(\delta +\gamma )bt}(\forall x\in S)$. Output the attribute key for the user as $S{K}_{id,S}^{\prime }=(K_{id},K_1,K_2,K_3,{\{K_x\}}_{x\in S})$. The user adds $K_{fin}=b$ to obtain its complete attribute key $S{K}_{id,S}=(K_{id},K_1,K_2,K_3,K_{fin},{\{K_x\}}_{x\in S})$.

AA adds $(id,\gamma ,Si{g}_{id},K_{id})$ to the authorized user list UL and uploads UL to the cloud server for storage.

(3) $Offline.Encrypt(PP,U)$. Input the public parameters PP. Randomly choose $s{\in }_R{Z}_p$ and compute $D_1=g^s,D_2=g^{\delta s},D_3=e{(g,g)}^{\alpha s}$. For each $i\in [U]$, randomly select ${{\lambda }_i}^{\prime },r_i{\in }_R{Z}_p$ and calculate $C_{i,1}=g^{a{{\lambda }_i}^{\prime }},C_{i,2}=g^{-H_{\rho (i)}{r}_i},C_{i,3}=g^{r_i}$. Output the offline ciphertext $FT=(D_1,D_2,D_3,{\{C_{i,1},C_{i,2}{C}_{i,3}\}}_{i\in [U]})$.

To prevent potential security risks from offline ciphertext leakage, the offline ciphertext is symmetrically encrypted and stored locally. It can be decrypted when needed. The encrypted offline ciphertext $C_{FT}=SEn{c}_{k_{FT}}(FT)$, where $k_{FT}$ represents the symmetric encryption key, which is kept secret by the data owner.

(4) $Online.Encrypt(PP,M,C_{FT},(\mathbf{\text{M}},\rho ))$. Input the public parameters PP, plaintext set M, encrypted offline ciphertext $C_{FT}$, and the access policy $(\mathbf{\text{M}},\rho )$. Let M be an $l\times n$ matrix and ρ be the function that associates rows of M to attributes.

Randomly select $\zeta {\in }_R{G}_T$ and compute the symmetric key $k_M=h\left(\zeta \right)$. Then, use this symmetric key to encrypt the plaintext set $M=\{M_1,M_2,...,M_m\}$, resulting in a ciphertext set $C_M={\{C_{M_j}\}}_{1\le j\le m}$, $C_{M_j}=SEn{c}_{k_M}(M_j)$. Compute the verification key $V{K}_{M_j}=H(\zeta ||C_{M_j})$ to validate the correctness of the partially decrypted result from the cloud server. Using the signature private key of the data owner $K_{Pri,o}$ to calculate digital signature $Si{g}_{M_j}=sig{n}_{K_{pri,o}}(V{K}_{M_j})$ for the verification key. Decrypt the offline ciphertext $FT=SDe{c}_{k_{FT}}(C_{FT})$ using the key $k_{FT}$. Randomly choose $y_2,y_3,...,y_n{\in }_R{Z}_p$ and let $\upsilon =(s,y_2,...,y_n)$. Compute ${\lambda }_i={\mathbf{\text{M}}}_i\cdot \overline{\upsilon },i=1,...,l$, where ${\mathbf{\text{M}}}_i$ is the i-th row vector of M. Randomly select $r_1,...,r_l{\in }_R{Z}_p$ and compute the ciphertext $C^{⁎}=\zeta \cdot D_3$, $C_{i,4}={\lambda }_i-{\lambda }_i^{\prime }$. Output the ciphertext $CT=((\mathbf{\text{M}},\rho ),C_M,C^{⁎},D_1,D_2,{\{C_{i,1},C_{i,2},C_{i,3},C_{i,4}\}}_{i=[l]})$.

The data owner uploads the ciphertext CT, verification key $\{V{K}_{M_j}\}$, and the signature $\{Si{g}_{M_j}\}$ to the cloud server.

(5) $Cloud.Decrypt(CT,UL,S{K}_{id,S})$. Input the ciphertext CT, authorized user list UL, and user attribute key $S{K}_{id,S}$. The parameters $K_{id}$ and $K_{fin}$ do not need to be uploaded. If the user belongs to the UL and its attribute set satisfies the access policy, there exists a set of constants ${\{{\omega }_i\in Z_p\}}_{i\in I}$ so that ${\sum }_{i\in I}{\omega }_i{\lambda }_i=s$. Let $I\subset \{1,2,...,l\}$ be defined as $I=\{i:\rho \left(i\right)\in S\}$. The cloud server retrieves the corresponding $K_{id}$ for the user from the UL and calculates the partially decrypted result using the following method:

$$TCT=\frac{e({D_1}^{K_1}{D}_2,K_{id})}{\prod _{i\in S}{[e(C_{i,1}{A}^{C_{i,4}}{C}_{i,2},{K_2}^{K_1}{K}_3)e(C_{i,3},K_{\rho (i)})]}^{{\omega }_i}}$$

The cloud server returns the partially decrypted result TCT, verification key $\{V{K}_{M_j}\}$, signature $\{Si{g}_{M_j}\}$, $C^{⁎}$ and $C_M$ to the user.

(6) $User.Decrypt(TCT,C^{⁎},C_M,K_{fin})$. Upon receiving the partially decrypted result TCT, the user calculates $\zeta =\frac{C^{⁎}}{TC{T}^{{K_{fin}}^{-1}}}$. Then, compute $k_M=h\left(\zeta \right)$ and restore plaintext through $M=SDe{c}_{k_M}\left(C_M\right)$.

(7) $Verify(\zeta ,C_M,V{K}_M,Si{g}_M)$. Verify whether the equation $H(\zeta ||C_{M_j})=V{K}_{M_j}$ holds. If it holds true, use $V{K}_{M_j}=ve{r}_{K_{pub,o}}(Si{g}_{M_j})$ to verify the validity of its signature. If successful, it confirms that the cloud server's partial decryption is correct.

(8) $Accountability(S{K}_{id,S},PP,UL)$. If an illegal key is detected in the system, first check the validity of the illegal key. If it passes the following checks, it indicates that the key is valid. Otherwise, output ⊥.

• •The illegal key is in the form of $(K_{id},K_1,K_2,K_3,K_{fin},\{K_x\})$, $K_1,K_{fin}\in Z_p$,

  $K_{id},K_2,K_3,\{K_x\}\in G$.

• •$e(g,K_3)=e(g^{\delta },K_2)$
• •$e(g^{\delta }{g}^{K_1},K_{id})={(e{(g,g)}^{\alpha })}^{K_{fin}}e({K_2}^{K_1}{K}_3,g^a)$
• •$e({\prod }_{i\in I}{g}^{H(\rho (i))},{K_2}^{K_1}{K}_3)=e(g,{\prod }_{i\in I}{K}_x)$

If the illegal key is valid, extract $K_1=\gamma$ from the key and search for tuples in the UL that contain $K_1$. If there are no tuples in the UL with the mentioned condition, it implies that the illegal key has been forged by the AA. If such tuples exist, extract the user id from the tuple and compare $K_{fin}=b$ of the illegal key with $K_{fin,id}=b_{id}$ of the user id. If $b=b_{id}$, it indicates that the invalid key has been maliciously leaked by the mentioned user. If $b\ne b_{id}$ and $b_{id}=ve{r}_{K_{pub,id}}(Si{g}_{id})$, it indicates that the invalid key has been forged by the AA.

(9) $UserRevocation(id,UL)$. Input the user id to be revoked and the authorized user list UL, then remove the corresponding tuple $(id,\gamma ,Si{g}_{id},K_{id})$ from the UL.

(10) $KeyUpdate(S{K}_{id,S})$. Input the user key $S{K}_{id,S}=(K_{id},K_1,K_2,K_3,K_{fin},{\{K_x\}}_{x\in S})$ and randomly select $b^{\prime }{\in }_R{Z}_p$ to compute $K_{id,new}={K_{id}}^{b^{\prime }}$, $K_{2,new}={K_2}^{b^{\prime }}$, $K_{3,new}={K_3}^{b^{\prime }}$, $K_{fin,new}=K_{fin}\cdot b^{\prime }$, $K_{x,new}={K_x}^{b^{\prime }}$, $Si{g}_{id,new}=sig{n}_{K_{pri,id}}(H(id||b\cdot b^{\prime }))$. Output the new attribute key $S{K}_{id,S,new}=(K_{id,new},K_1,K_{2,new},K_{3,new},K_{fin,new},{\{K_{x,new}\}}_{x\in S})$. The user sends $K_{id,new}$ and $Si{g}_{id,new}$ to the cloud server, which updates them in the authorized user list.

Discussion: Detecting illegal secret keys is paramount. We need to clarify in this paper that if an authorized user privately provides his authorization key to an unauthorized user, the key cannot be found, as an unauthorized user with a real key and an authentic user cannot be differentiated. In addition, assuming that authorized users publicly sell or publish keys on any Web-based business platform, such improper behavior will be discovered and considered as “abuse of secret key”. On the other hand, we hope to incorporate more refined monitoring mechanisms, such as identifying potential illegal key usage through behavior analysis or anomaly detection.

5. Security analysis

5.1. IND-CPA security analysis

We reduce the IND-CPA security of our scheme to scheme [41]. Under the $q-BDHE$ assumption, scheme [41] has been proven to be IND-CPA secure.

Theorem 1

If there is an adversary $\mathcal{A}$ that can break our scheme with a non-negligible advantage ε, we can construct an algorithm $\mathcal{B}$ that breaks the scheme [41] at the advantage ε.

Proof

We assume there exists an adversary $\mathcal{A}$ that can break our scheme with a non-negligible advantage ε. We construct an algorithm $\mathcal{B}$ that breaks the scheme [41] with the same advantage ε. Define $\mathcal{C}$ as the challenger that interacts with $\mathcal{B}$ in the scheme [41].

Setup: The adversary $\mathcal{A}$ first sends the access policy $({\mathbf{\text{M}}}^{⁎},{\rho }^{⁎})$ it wants to attack to $\mathcal{B}$. $\mathcal{B}$ will send it to the challenger $\mathcal{C}$. $\mathcal{C}$ returns the public parameters to $\mathcal{B}$. $\mathcal{B}$ randomly selects δ and h and returns the public parameters $PP=(g,e{(g,g)}^{\alpha },g^a,g^{\delta },h,H)$ to $\mathcal{A}$, where for each attribute $x_i$ in the attribute universe U, $h_i=g^{H(x_i)}$.

Phase 1: The adversary $\mathcal{A}$ queries $\mathcal{B}$ for the attribute key corresponding to the attribute set $(i{d}_1,S_1)$, $(i{d}_2,S_2),\dots ,(i{d}_{q_1},S_{q_1})$. Here it requires that for any $i\in [q_1]$, $S_i$ cannot satisfy the access policy $({\mathbf{\text{M}}}^{⁎},{\rho }^{⁎})$. $\mathcal{B}$ sends $S_i$ to $\mathcal{C}$ to obtain the key $K^{\prime }=g^{\alpha }{g}^{a{t}^{\prime }},L^{\prime }=g^{t^{\prime }},K_x^{\prime }=h_x^{t^{\prime }}$ of Scheme [41]. $\mathcal{B}$ randomly selects γ and sets $t=t^{\prime }/(\delta +\gamma )$, calculates $K_{fin}=b$, $K_1=\gamma$, $K_2=L^{\prime b/(\delta +\gamma )}=g^{bt}$, $K_3=K_2^{\delta }=g^{\delta bt}$, $K_x={K_x^{\prime }}^b=g^{H(x)(\delta +\gamma )bt}$. $\mathcal{B}$ sends $S{K}_{id,S}^{\prime }=(K_{id},K_1,K_2,K_3,{\{K_x\}}_{x\in S})$ to $\mathcal{A}$. $K_{fin}=b$ is only known to $\mathcal{A}$.

Challenge:$\mathcal{A}$ submits two equal-length messages $M_0,M_1$ to $\mathcal{B}$. $\mathcal{B}$ sends them to the challenger $\mathcal{C}$. $\mathcal{C}$ runs the encryption algorithm to obtain ciphertext $C,C^{\prime }=g^s,C_i=g^{a{\lambda }_i}{h}_{\rho (i)}^{-r_i}$ and returns them to $\mathcal{B}$. For C, $\mathcal{C}$ randomly selects $b\in \{0,1\}$, and C may be $M_b\cdot e{(g,g)}^{\alpha s}$ or a random value in $G_T$. $\mathcal{B}$ returns the challenge ciphertext $CT=$ $(D_1=g^s$, $D_2=g^{\delta s}$, $C_{i,1}=g^{a{{\lambda }_i}^{\prime }}$, $C_{i,2}=g^{-H_{\rho (i)}{r}_i}$, $C_{i,3}=g^{r_i}$, $C_{i,4}={\lambda }_i-{\lambda }_i^{\prime })$ to $\mathcal{A}$.

Phase 2:$\mathcal{A}$ repeats the queries from Phase 1, similarly all the queried attribute sets do not satisfy the access policy $({\mathbf{\text{M}}}^{⁎},{\rho }^{⁎})$ mentioned earlier.

Guess:$\mathcal{A}$ outputs a guessed result $b^{\prime }\in \{0,1\}$ to $\mathcal{B}$. $\mathcal{B}$ sends $b^{\prime }$ to $\mathcal{C}$.

If $\mathcal{A}$ can break our scheme with advantage ε, then the simulator can break the [41] scheme with the same advantage ε. □

5.2. Accountability security analysis

a) Analysis of the DishonestAA Game

Theorem 2

If computing discrete logarithm in group G is difficult, then for our scheme, the advantage of any PPT adversary in the DishonestAA Game can be negligible.

Proof

To prove this theorem, we assume that there is a adversary $\mathcal{A}$ which has a non-negligible advantage $Ad{v}_{\mathcal{A}}$ in the DishonestAA Game in our scheme. Then we can use this adversary to build a PPT simulator $\mathcal{B}$ to solve the discrete logarithm problem in the group G with a non-negligible advantage.

Setup: The adversary $\mathcal{A}$ (acting as a malicious AA) runs the $Setup$ algorithm and sends the public parameters $PP=(g,e{(g,g)}^{\alpha },g^a,g^{\delta },h,H)$ and a user's identity id to the simulator $\mathcal{B}$. $\mathcal{B}$ checks whether the formats of PP and id are correct. If the check fails, the game aborts

Key Generation:$\mathcal{B}$ calls the challenger $\mathcal{C}$, passing g to $\mathcal{C}$. $\mathcal{C}$ randomly selects $b\in Z_p$ and returns the challenge $\theta =g^b$ to $\mathcal{B}$. $\mathcal{B}$ sends θ and a zero-knowledge proof of θ to $\mathcal{A}$. Then $\mathcal{A}$ calls $KeyGen(MSK$, $PP,id,S)\to SK$ and sends SK to $\mathcal{B}$.

Key Forgery:$\mathcal{A}$ will output a decryption key $S{K}^{\prime }=(K_{id},K_1,K_2,K_3,K_{fin}=b^{\prime },{\{K_x\}}_{x\in S})$ related with id. $\mathcal{B}$ checks whether the format of $S{K}^{\prime }$ is correct. If the check fails, the game aborts. If the format of $S{K}^{\prime }$ is correct, $\mathcal{B}$ sends $b^{\prime }$ to $\mathcal{C}$.

If the advantage $Ad{v}_{\mathcal{A}}$ in the DishonestAA Game in our scheme is non-negligible, we can construct a PPT simulator $\mathcal{B}$ that can solve the discrete logarithm problem with a non-negligible advantage. However, since the computation of the discrete logarithm problem is considered difficult, there is no PPT adversary $\mathcal{A}$ in our scheme that can win the DishonestAA Game with a non-negligible advantage $Ad{v}_{\mathcal{A}}$. □

b) Analysis of the DishonestUser Game

Theorem 3

Under the $q-SDH$ assumption, an adversary's advantage in winning DishonestUser Game is negligible.

Proof

Assume there is a PPT adversary $\mathcal{A}$ can win the DishonestUser Game by a non-negligible advantage $Ad{v}_{\mathcal{A}}$. Then, we can construct a PPT algorithm $\mathcal{C}$ to break the $q-SDH$ assumption. $\mathcal{C}$ is given a problem instance of $q-SDH:(\hat{g},{\hat{g}}^{\delta },{\hat{g}}^{{\delta }^2},...,{\hat{g}}^{{\delta }^q})$. Set $A_i={\hat{g}}^{{\delta }^i}$ for $i\in \{0,1,...,q\}$.

Setup:$\mathcal{C}$ chooses $c_1,...,c_q\in Z_p^{⁎}$ randomly and sets $f(x)={\prod }_{i=1}^q(x+c_i)={\sum }_{i=0}^q{\alpha }_i{x}_i$, where ${\alpha }_0,...,{\alpha }_q\in Z_p$ are the coefficients of $f(x)$. Then, $\mathcal{C}$ sets $g={\prod }_{i=0}^q{(A_i)}^{{\alpha }_i}={\hat{g}}^{f(\delta )},g^{\delta }={\prod }_{i=1}^q{(A_i)}^{{\alpha }_{i-1}}={\hat{g}}^{f(\delta )\cdot \delta }$. Then $\mathcal{C}$ selects $\alpha ,a\in Z_p^{⁎}$ and outputs the public key $PP=(g,e{(g,g)}^{\alpha },g^a,g^{\delta },h,H)$.

Key Query:$\mathcal{A}$ submits $(i{d}_i,S_i)$ to $\mathcal{C}$ as the ith secret key query $(i\le q)$. Set $f_i(x)={\prod }_{i=0}^{q-1}{\beta }_i{x}_i$, where ${\beta }_0,...,{\beta }_{q-1}\in Z_p$ are the coefficients of $f_i(x)$. Compute ${\sigma }_i={\prod }_{j=0}^{q-1}{(A_j)}^{{\beta }_j}={\hat{g}}^{f_i(\delta )}={\hat{g}}^{f(\delta )/(\delta +{\gamma }_i)}=g^{1/(\delta +{\gamma }_i)}$.

$\mathcal{C}$ selects $t\in Z_p$ and computers $K_{i}d=g^{\frac{\alpha b}{\delta +{\gamma }_i}}{g^b}^{at}$, $K_1={\gamma }_i$, $K_2=g^{bt}$, $K_3=g^{\delta bt}$, $K_x=g^{H(x)(\delta +\gamma )bt}(\forall x\in S)$. Finally, $\mathcal{C}$ outputs the queried secret key $S{K}_{i{d}_i,S_i}=(K_{id},K_1,K_2,K_3,{\{K_x\}}_{x\in S_i})$.

Key Forgery:$\mathcal{A}$ outputs a challenge secret key $S{K}^{⁎}$. Let ${\xi }_{\mathcal{A}}$ denote the event that $\mathcal{A}$ wins the game, i.e., $S{K}^{⁎}$ passes the key sanity check and ${K_1}^{⁎}\notin \{{\gamma }_1,...,{\gamma }_q\}$.

- If ${\xi }_{\mathcal{A}}$ does not happen, $\mathcal{C}$ selects a random tuple $(c^{⁎},w^{⁎})\in Z_p\times G$ as the solution for q-SDH problem.

- If ${\xi }_{\mathcal{A}}$ happens, $\mathcal{C}$ makes use of $S{K}^{⁎}$ to break $q-SDH$ problem.

$\mathcal{C}$ utilizes long division to represent $f(x)$ as $f(x)=\phi (x)(x+K_1^{⁎})+{\phi }_{-1}$ for some ${\phi }_{-1}\in Z_p$. Since $f(x)={\prod }_{i=1}^q(x+{\gamma }_i)$ and ${K_1}^{⁎}\notin \{{\gamma }_1,...,{\gamma }_q\}$, $(x+K_1^{⁎})$ does not divide $f(x)$. Then ${\phi }_{-1}\ne 0(modp)$ and $gcd({\phi }_{-1},p)=1$. Expend $\phi (x)$ to be $\phi (x)={\sum }_{i=0}^{q-1}{\phi }_i{x}^i$, where ${\phi }_0,...,{\phi }_{q-1}\in Z_p$ are the coefficient of $\phi (x)$.

$\mathcal{C}$ computes $\mathrm{\Psi }={[K_{id}/{(K_2)}^a]}^{{(\alpha b)}^{-1}}=g^{\frac{1}{(\delta +K_1^{⁎})}}={({\hat{g}}^{f(\delta )})}^{\frac{1}{(\delta +K_1^{⁎})}}={\hat{g}}^{\phi (\delta )}\cdot {\hat{g}}^{\frac{{\phi }_{-1}}{(\delta +K_1^{⁎})}}$.

$\mathcal{C}$ sets $c^{⁎}=K_1^{⁎}$ and computes $w^{⁎}={(\mathrm{\Psi }\cdot {\prod }_{i=1}^{q-1}{A_i}^{-{\phi }_i})}^{\frac{1}{{\phi }_{-1}}}={\hat{g}}^{\frac{1}{(\delta +K_1^{⁎})}}$. Then, $(c^{⁎},w^{⁎})$ is a well constructed solution for the $q-SDH$ problem.

Let ${\xi }_{SDH}$ denote the event that is $(c^{⁎},w^{⁎})$ a solution for $q-SDH$ problem. Suppose $\mathcal{A}$ has advantage ξ in attacking $q-SDH$ assumption and $\mathcal{C}$ has advantage ${\xi }^{\prime }$ in winning this game. Then,

$\begin{array}{c}{\xi }^{\prime }=\mathrm{Pr}[{\xi }_{SDH}]=\mathrm{Pr}[{\xi }_{SDH}|\overline{\mathcal{A}win}]\cdot \mathrm{Pr}[\overline{\mathcal{A}win}]+\mathrm{Pr}[{\xi }_{SDH}|\mathcal{A}win]\cdot \mathrm{Pr}[\mathcal{A}win]\hfill \\ =\mathrm{Pr}[{\xi }_{SDH}|\overline{\mathcal{A}win}]\cdot \mathrm{Pr}[\overline{\mathcal{A}win}]+\mathrm{Pr}[{\xi }_{SDH}|\mathcal{A}win\wedge gcd({\phi }_{-1},p)\ne 1]\hfill \\ \cdot \mathrm{Pr}[\mathcal{A}win\wedge gcd({\phi }_{-1},p)\ne 1]+\mathrm{Pr}[{\xi }_{SDH}|\mathcal{A}win\wedge gcd({\phi }_{-1},p)=1]\hfill \\ \cdot \mathrm{Pr}[\mathcal{A}win\wedge gcd({\phi }_{-1},p)=1]\hfill \\ =0+0+1\cdot \mathrm{Pr}[\mathcal{A}win\wedge gcd({\phi }_{-1},p)=1]\hfill \\ =\mathrm{Pr}[\mathcal{A}win]\cdot \mathrm{Pr}[gcd({\phi }_{-1},p)=1]\hfill \\ =\mathrm{Pr}[\mathcal{A}win]\cdot 1=\xi \hfill \end{array}$.

If $\mathcal{C}$ wins the game with non-negligible probability, then $\mathcal{A}$ can solve the $q-SDH$ problem with non-negligible probability using $\mathcal{C}$'s forged key. However, since solving the $q-SDH$ problem is difficult for polynomial-time algorithm, there is no PPT adversary $\mathcal{C}$ in our scheme that has non-negligible advantage in the DishonestUser Game. □

6. Performance evaluation

In this section, we performed theoretical analysis and experimental analysis.

6.1. Theoretical analysis

In this section, we compared our scheme with other related CP-ABE schemes in terms of functionality and performance to highlight the advantages of our scheme. We use P to represent the time for a pairing operation and E to represent the time for an exponential operation. This analysis omits the computational costs of hash operations and multiplications because their costs are far less than P and E. The results are shown in Table 2 and Table 3.

Table 2.

Functional comparison.

Scheme	A1	A2	A3	A4	A5	A6	A7
[22]	LSSS	No	Yes	Yes	No	selectively secure	No
[24]	LSSS	No	Yes	Yes	No	selectively secure	No
[29]	LSSS	No	No	Yes	No	selectively secure	No
[33]	LSSS	Yes	No	Yes	No	Selectively secure	No
[34]	LSSS	No	No	Yes	Yes	selectively secure	No
Ours	LSSS	Yes	Yes	Yes	Yes	Selectively secure	Yes

A1: Access structure A2: Sonline/offline encryption A3: Outsourced decryption A4: User accountability A5: Authority accountability A6: Security model A7: Updatable key.

Table 3.

Storage and computation overhead comparison.

Scheme	B1	B2	B3	B4	B5	B6
[22]	4G + 2GT	(|S| + 3)G + |Zp|	(l + 3)G + 2GT + |Zp|	0	(2l + 6)E + 3P	E
[24]	(|U| + 3)G + GT	(|S| + 1)G + 3|Zp|	(2l + 1)G + GT	0	(3l + 2)E + P	E + P
[29]	(|U| + 4)G	(|S| + 3)G + |Zp|	(2l + 2)G + GT	0	(3l + 3)E + P	(2|S| + 1)(E + P)
[33]	6G + GT	(2|S| + 4)G	(5l + 2)G	(5l + 3)E + P	0	(2|S| + 2)P + (3|S| + 3)E
[34]	7G + GT	(2|S| + 7)G	(3l + 3)G + GT	0	(5l + 4)E + P	(3|S| + 3)E + (3|S| + 1)P
Ours	3G + GT	(|S| + 3)G + 2|Zp|	(3l + 2)G + GT + l|Zp|	(3l + 3)E + P	0	E

B1: Public parameter B2: Secret key size B3: Ciphertext size B4: Offline encryption B5: Online encryption B6: Decryption

$|S|$: size of attribute set S$|U|$: size of the universe attribute set U l: matrix M has l rows.

From Table 2 and Table 3, it can be clearly seen that the scheme proposed in literature [22] introduced outsourced decryption and user accountability without incorporating authority accountability. Moreover, its encryption overhead involves more bilinear pairings compared to other schemes. The approach outlined in literature [24] lacks support for an online/offline encryption mechanism. Despite this, it reduces encryption and decryption computation costs by leveraging edge fog nodes, effectively mitigating the storage overhead of user keys. Nonetheless, similar to the scheme in literature [29], the size of public parameters in this scheme increases as the attribute domain expands. Additionally, while it integrates user accountability, it overlooks accountability for authority organizations or edge nodes. In the scheme proposed by [29], although its key size and ciphertext size are marginally smaller than our scheme, the encryption and decryption costs exhibit a significantly larger gap compared to ours. The scheme described in [33] adopts the same online/offline encryption mechanism as our scheme. However, its decryption computation burden rests solely on the user. Regarding the scheme introduced in literature [34], it offers both user and authority accountability. Nevertheless, its key size and ciphertext size surpass ours, resulting in significantly higher encryption and decryption computation costs compared to other schemes. Importantly, while these schemes incorporate user accountability mechanisms, none address passive key leakage of user keys. In contrast, our scheme includes a key update algorithm designed specifically to counter passive key leakage of user keys.

6.2. Experimental analysis

To evaluate performance, the schemes in literatures [22], [29], [34] and our scheme were simulated and compared using the PBC library. The experimental configuration was Ubuntu 18.04.1, Intel Core i5-8300H CPU 2.30 GHz. The curve is determined as $y^2=x^3+x$ over the field $F_p$ for some prime $p=3\left(mod4\right)$. The parameter p=8780710799663312522437781984754049815806883199414208211028653399266475630880222957078625179422662221423155858769582317459277713367317481324925129998224791, which was provided by the PBC library.

In Figure 5, Figure 6, we conducted simulated efficiency experiments on various schemes outlined in literature [22], [29], [34], including our own, and compared their performance. The horizontal axis represents the number of attributes, ranging from 10 to 100 with increments of 10, while the vertical axis indicates the time required to execute the corresponding operation in milliseconds. Specifically, Fig. 5(a) illustrates a comparison of key generation times among the mentioned schemes. The scheme proposed in reference [34], due to its complex key structure, has a significantly higher key size with an increasing number of user attributes than other schemes, leading to significantly longer processing time. The key generation scheme in reference [22] requires two rounds of symmetric encryption to embed the user ID into the key, making it slightly faster than our scheme. The scheme in reference [29] is constructed from composite order groups, while our scheme is constructed from prime order groups, which is more efficient. In Fig. 5(b), we compared encryption times. Our scheme adopts an online/offline encryption mechanism, predominantly completing computations offline. Consequently, the online encryption overhead for the data owner involves minimal operations—primarily a single multiplication and multiple subtractions—making it negligible. Fig. 5(c) showcases decryption computations. Observably, the user overhead for the schemes in literature [22] and our scheme remains constant, around 0.07 ms. This is because both literature [22] and our scheme adopt cloud server assisted decryption, greatly reducing the computational pressure on users. However, the schemes in literature [29] and [34] will bring great computational burden to users in environments with more complex access structures and more user attributes. In Fig. 5(d), we analyzed the efficiency of key updating in our scheme. As the number of user attributes increases, the updating time gradually rises. However, even with 100 attributes, the update time remains under 100 ms, and the algorithm can execute during user idle periods, which does not bring too much computational pressure to the user. Moving to Fig. 6(a) and Fig. 6(b), we conducted comparative analyses on the encryption and decryption efficiency of our scheme, both with and without online/offline encryption and outsourced decryption. Notably, the computational overhead of online encryption and user decryption is negligible, as most of the encryption and decryption workload is completed during the offline and outsourced phases. In conclusion, the experimental results confirm that our scheme is more efficient and practical than existing relevant CP-ABE schemes.

Figure 5.

Computation overheads.

Figure 6.

Computation savings.

7. Conclusion

In the realm of secure cloud storage systems, the issue of access control based on attribute encryption has garnered significant attention. In this study, we propose a novel, efficient, and flexible scheme for attribute-based encryption access control. This approach adopts a more secure online/offline encryption mechanism and verifiable outsourced decryption, aiming to address scenarios with constrained computing resources. We have successfully tackled both key Escrow and key misuse concerns. Malicious users actively disclosing keys for personal gain or attribute authorization centers forging keys can be traced. For users affected by passive key leakage, timely key updates allow for the revocation of the original key's decryption capabilities. Theoretical analysis clearly demonstrates the algorithm's efficiency in terms of computational complexity and storage overhead. Experimental results show a substantial reduction in the computational costs for users during online encryption and decryption, leading to significant savings in computing resources. This study demonstrates practical applicability across diverse fields, presenting an innovative solution to tackle data security challenges in resource-constrained environments. It is especially relevant in domains, including IoT, smart meter data collection, healthcare data management, and finance. We hope that this research can provide some insights for the future development of secure cloud storage systems.

Funding

This research was funded by State Grid Shandong Electric Power Company Technology Project (No. 520627230004).

CRediT authorship contribution statement

Li Yan: Investigation, Data curation. Gaozhou Wang: Investigation. Hongxin Feng: Writing – original draft, Formal analysis. Peishun Liu: Writing – review & editing, Supervision. Haojie Gao: Writing – review & editing, Resources. Wenbin Zhang: Supervision. Hailin Hu: Data curation. Fading Pan: Supervision.

Declaration of Competing Interest

The authors declare the following financial interests/personal relationships which may be considered as potential competing interests: Peishun Liu and Hongxin Feng report financial support was provided by National Key Research and Development Program of China. Peishun Liu and Hongxin Feng report financial support was provided by State Grid Shandong Electric Power Company. If there are other authors, they declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Data availability statement

The data used in this study is currently not publicly available. If necessary, please contact the corresponding author.