1.1 Related work

In this section, we discuss the related work of this article.

1.2 Our contribution

In this article, we propose a searchable personal health records framework with fine-grained access control in cloud-fog computing. Roughly, the key points of our work are described below:

1. We designed a hybrid searchable encryption scheme based on cloud-fog computing. The fog node bridges between the intelligent terminal and the cloud, the data owner and data user can be directly connected to fog nodes, and each fog node is connected to the cloud, reducing unnecessary data transmission.
2. In order to meet the resource-constrained terminal equipment, the novel multi-authority CP-ABE was proposed to support both outsourced encryption and outsourced decryption scheme. Without divulging data privacy, most local calculations are outsourced to fog nodes, enabling data users to enjoy high-rate, low-latency, high-quality services.
3. This article proposes an attribute-based searchable encryption scheme, which realizes one-to-many communication. Data users can query relevant ciphertexts according to the keywords they specify, narrowing the scope of retrieval in massive document.
4. Formal security and performance analysis proves that our scheme is safe and feasible under cloud-fog computing. In addition, it achieve secure data sharing and effectively protect the confidentiality of data.

1.3 Organization

The remaining structure of this paper is organized as follows: In Section 2, we review the relevant background knowledge of this scheme. Section 3 presents system model and security model throughout the paper. In Section 4, we give a detailed description of the specific algorithm and the correctness analysis of the scheme. We analyzed the security and discuss the performance of our schemes with comparison to several related works in Section 5 and Section 6. Finally, we conclude this scheme in Section 7.

2.1 Access structure

In order to achieve fine-grained access control in an ABE scheme, the following access control structure is defined.

Definition 1 (Access structure [21]). Let P = {P₁, P₂, ⋯, P_n} be a set of n participants. For ∀B,C, if and B ⊆ C, then , we call is monotonous. An access structure is a collection of non-empty subsets of P = {P₁, P₂, ⋯, P_n}, namely . The sets in are called the authorized sets, and the sets not in are called the unauthorized sets.

2.2 Bilinear maps

Definition 2 (Bilinear Maps [21]). Let and are two groups of prime order p. Let g be a generator of . The map is called a bilinear pairing operation. The mapping e satisfies the following properties:

1. Bilinearity: For all and , we have e(u^a, v^b) = e(u, v)^ab.
2. Non-degenerate: , where is the unit of .
3. Computability: For all , there is a valid algorithm to calculate e(u, v).

2.3 Linear secret sharing scheme

Definition 3 (Linear Secret Sharing scheme (LSSS) [6]). Let P = {P₁, P₂, ⋯, P_n} be a set of participants. (M, ρ) represents an access structure , where M is the shared generator matrix of l × n and ρ is a mapping. For all i = 1, 2, ⋯, l, function ρ maps the i row of M to the corresponding attribute. A linear secret sharing scheme consists of the following two effective algorithms:

1. Secret sharing algorithm: To share a secret . The algorithm randomly chooses and the column vector v = (s, v₂, ⋯, v_n). Then calculate λ_i = (M · v)_i, where λ_i belongs to the secret share value obtained by the entity ρ(i).
2. Secret reconstruction algorithm: Let be any set of authorized users, we define I ⊂ {1, 2, ⋯, l} as I = {i: ρ(i) ∈ S}. There is a constant coefficient that satisfies ∑_i∈I ω_iM_i = (1, 0, ⋯, 0). The recovered secret will be ∑_i∈I ω_iλ_i = s. The set of constants can be found in polynomial time.

2.4 Hardness assumptions

Decisional q-Parallel Bilinear Diffie-Hellman Exponent (q-parallel DBDHE)Assumption [27] A group with prime order p is selected through security parameters, and g is a generator of . Randomly choose , and given

It’s hard to distinguish a valid tuple from a random element R in . An algorithm outputs υ ∈ {0,1} has advantage ε in solving q-parallel DBDHE in if

Definition 4. we say that the q-parallel DBDHE assumption holds if no polynomial time algorithm to solve the q-parallel DBDHE problem with non-negligible advantage.

Decisional Bilinear Diffie-Hellman (DBDH) Assumption [28,29]. Let g be a generator of and be selected at random. If the challenger gives adversary (g, g^β, g^γ, g^z), it must be difficult for the adversary to distinguish a valid tuple from a random element .

An algorithm outputs υ ∈ {0,1} has advantage ε in solving DBDH in if

Definition 5. we say that the DBDH assumption holds if all polynomial time algorithm have at most a negligible advantage in solving the DBDH problem.

3.1 Definition of system model

The system model of this system is shown in Fig 2. The labels (1)-(6) in the figure correspond to the 6 algorithms in our scheme, namely system establishment, key generation, file encryption, trapdoor generation, ciphertext retrieval and file decryption algorithms. It contains the following 6 entities:

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. System model.

https://doi.org/10.1371/journal.pone.0207543.g002

Central Authorities (CA): We assumes that there are K central authority CA, for example, the health department, education department, state government, etc. The CA generates global public parameters for the PHR system and distribute secret keys based on the user’s globally unique identifier id. Each CA works independently and does not need to communicate with each other, and at least one of the CAs is honest and not curious. Note that CA does not participate in any attribute-related operations.

Attribute Authorities (AA): Here are D attribute authority AA. Each AA manages different attribute domains S_d, represents the set of all attributes in the entire system. For ∀i ≠ j ∈ {1, 2, ⋯, D}, where S_i ∩ S_j = ∅. AA generates related secret keys based on the user’s attributes. For example, a hospital can assign the Hospital A attribute to all employees. Health associations can assign different doctors or nurses attributes related to medical professional licenses, such as dermatologists and psychologists. Each AA is independent of each other, one attribute is managed by only one AA, but one AA can manage multiple attributes.

Cloud Server Provider (CSP): The Cloud Server Provider (CSP) is a semi-trusted entity that is mainly responsible for storing encrypted PHR files and keyword indexes, and providing access services for authorized users.

Fog Nodes (FN): A fog node is a trusted entity that is at the edge of the network and has the ability to computing, storage and network services. It is responsible for partial encryption and decryption operations. The fog node helps the DO to generate partial ciphertext and upload all ciphertext to the CSP. It can also decrypt some ciphertext downloaded from the CSP.

Data Owner (DO): The data owner specifies an access policy, encrypts PHR files and keyword sets, and uploads ciphertext and indexes to the CSP.

Data User (DU): The data user downloads the encrypted PHR file from the CSP. The DU can decrypt successfully only if the attributes of the DU satisfy the access policy. For example, doctors and nurses must visit the patient’s PHR file in order to properly diagnose the condition and care.

For a more intuitive description of the scheme, we use personal health records to illustrate. Consider the following scenario: Alice who has a skin disease wants to find an expert to check through an online medical facility. Alice’s needs is (hospital A ∧ dermatologist). In order to protect the confidentiality of personal health records, Alice needs to encrypt medical health records under hospital A ∧ dermatologist condition before uploading data to the CSP. The CSP then searches for a doctor who satisfies hospital A ∧ dermatologist in its own database and sends Alice’s personal health record to the qualified doctor Bob. Bob can decrypt the record for Alice to continue treatment.

3.2 Algorithm definition

This scheme consists of 6 algorithms: system setup, key generation, file encryption, trapdoor generation, search over ciphertext, and file decryption. Each algorithm is described as follows:

1. System Setup: The algorithm is executed by authority. It contains 3 sub-algorithms:
   1. Global—Setup(1^λ): The global-setup algorithm is run by a trusted third party. It takes as no input other than the security parameters λ and outputs the global public parameter GPK.
   2. CA—Setup(GPK, k): The CA-setup algorithm is run by each CA_k. It input the GPK and the tag k of the CA, and then output the public parameter (CPK_k, CAPK_k) and the master key CASK_k, and the CAPK_k is used only by the CA_k.
   3. AA—Setup(GPK, d, S_d): The AA-setup algorithm is performed by each AA_d. It takes as inputs the GPK, the tag d of the AA_d, and attributes set S_d managed by the AA_d. It outputs the public parameter (APK_d, AAPK_d) and the master key AASK_d, AAPK_d is used only by the AA_d.
2. Key Generation: This algorithm is performed by the CA_k and the AA_d. It contains 2 sub-algorithms:
   1. CA—KeyGen(GPK, CMSK_k, AAPK_d, id): The CA-key generation algorithm is performed by the CA_k. It takes as inputs the global public parameter GPK, the master key CMSK_k of the CA_k, part of the public parameters AAPK_d of the AA_d, and the unique identifier id of the data user. It outputs the user-center-key (ucsk_id,k, ucpk_id,k), where ucpk_id,k is called user-center-public-key.
   2. : The AA-key generation algorithm is executed by the AA_d. It intakes an attributes att, user-center-public-key ucpk_id,k, verification key VerifyKey_k, master key AMSK_d, and global public parameters GPK. It outputs the secret key SK_DU of the DU and the public/secret key pair (pk_O, sk_O) of the DO.
3. File Encryption: This algorithm is executed by the FN and the DO. It contains 2 sub-algorithms:
   1. Fog—Encrypt(GPK, {APK_d}, (M, ρ)): The outsourced encryption algorithm is performed by the FN. The algorithm intakes the global public parameter GPK, the public parameter APK_d of the AA_d, and an access structure (M, ρ). It outputs the intermediate ciphertext CT_Fog.
   2. Do—Encrypt(m, GPK, CT_Fog, sk_O, pk_U): The local encryption algorithm is usually performed by the DO. It intakes the plaintext message m, the global public parameter GPK, DO’s secret key sk_O, DU’s public key pk_U and the ciphertext CT_Fog. It outputs all ciphertext CT₁, CT₂ and delivers it to the FN. Finally, the FN uploads the ciphertext CT = (CT₁, CT₂) to the CSP.
4. : The trapdoor generation algorithm is performed by the DU. It intakes a desired keyword , the secret key SK_DU and the public key pk_O. Finally, it outputs the trapdoor and the pre-decryption key .
5. Search over Ciphertext: This algorithm is executed by the CSP to determine whether the keywords in the ciphertext match the keywords of the trapdoor.
   1. : The search algorithm is performed by the CSP. It intakes the index CT₂, trapdoor and the public key pk_O, pk_U. If the trapdoor and index match successfully, returns the search result to the FN.
6. File Decryption: This algorithm is executed by the FN and the DU. Including 2 sub-algorithms:
   1. : The outsourced decryption algorithm is performed by the FN. It intakes the ciphertext CT and the pre-decryption key . It outputs the partially decrypted ciphertext (C, Ω) to the DU.
   2. Do—Decrypt(C, Ω, RK): The final decryption algorithm is performed by the DU. It intakes the partially decrypted ciphertext (C, Ω) and the retrieval key RK. It outputs the plaintext message m.

3.3 Definition of security model

In the fog-cloud storage system, the CSP is also curious about the contents of the encrypted data. We assume that the CSP will correctly perform the tasks assigned by the central authority and attribute authority. The AA and CA can be corrupted or attacked. To demonstrate the security of our scheme, we design two security games: indistinguishability against selective ciphertext-policy and chosen ciphertext attack (IND-sCP-CCA) game and trapdoor privacy game.

4.1 Detailed description of our scheme

B. Key generation.

We assume that there are two central authorities: the health department, the education department, and two attribute authorities: hospitals, health associations. Because the keys and attribute sets are related in the CP-ABE scheme, the attribute authority AA_d will generate a corresponding attribute key according to the user’s attribute set. Consider the following scenario: Generate a key for a dermatologist working in Hospital A. The key generation phase contains 2 sub-algorithms: CA—KeyGen and AA—KeyGen. The key generation process is shown in Fig 3.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. CA_S and AA_S send key for user id.

https://doi.org/10.1371/journal.pone.0207543.g003

CA—KeyGen(GPK, CMSK_k, AAPK_d, id): A data user sends its globally unique identifier id to the CA_k to request the user-central-key. The CA_k randomly picks element and sets the user-center-key: , . For d ∈ [1, D], CA_k calculates and generates the signature sign_id,k = Sign(SignKey_k, id‖k‖Γ_id,k‖{L_id,k,d}_d∈[1,D]). Simultaneously, the user-central-public-key is output.

: For attribute att ∈ S_d. The data user id sends its user-center-public-key to the AA_d to request the user-attribute-key.

① For any k ∈ [1, K], the AA_d verifies the following equation:

If the above equation holds, then ② is performed. Otherwise, the AA_d outputs ⊥. It indicates that the user-central-public-key ucpk_id,k submitted by user is invalid.

② For any k ∈ [1, K], the AA_d generates the user-attribute-key uask_att,id for the user

After that, algorithm randomly picks and computes g^β, g^γ. It returns the public/secret key pair of DO’s and DU’s as (pk_O, sk_O) = (g^γ, γ) and (pk_U = g^β, sk_U = β), respectively. So DU’s secret key SK_DU = ({ucsk_id,k, Γ_id,k | k ∈ K}, {uask_att,id | att ∈ S_d}, β).

C. File encryption.

Before uploading the PHR file to the CSP, the patient needs to encrypt the file based on the access policy (hospital A ∧ dermatologist) and sends an access policy to FN. The encryption algorithm contains two sub-algorithms: Fog—Encrypt and Do—Encrypt.

Fog—Encrypt(GPK, {APK_d}, (M, ρ)): Here (M, ρ) is an LSSS access structure. Assuming that M is an l × n matrix. Function ρ(.), which is an injective function, maps each rows of M to different attributes. For ∀i ∈ {1, 2, ⋯, l}, fog nodes are randomly selects and sets the ciphertext CT_Fog as follows:

Output part of the ciphertext .

Do—Encrypt(m, GPK, CT_Fog, sk_O, pk_U): m is the PHR file to be shared by patient. The DO first creates vectors , where s is the random secret to be shared. From i = 1 to l, it gets the sub-secret λ_i = V · M_i by computing, where M_i is the i − th row of matrix M. The intact data ciphertext CT₁ can be created by the following calculation:

All data ciphertext is published as CT₁ = {(M, ρ), C, C′, {C_i,1, C_i,2, C_i,3}_i∈[1,l]}.

Then, the DO extracts keywords from the PHR file to form a set of keywords W_m. For each keyword w_i ∈ W_m, the algorithm randomly selects to generate a keyword index and send it to the FN.

Subsequently, the FN uploads the ciphertext CT = (CT₁, CT₂) to the CSP.

E. Search over ciphertext.

When the CSP receives the user’s search request, the CSP performs the following algorithm to search the matched health records:

: When gained the DU’s search query, the CSP first checks whether the DU’s attribute set satisfies with access structure (M, ρ). If it is true, the CSP uses the following equation to checks if the trapdoor and index CT₂ match.

If the equation does not hold, ⊥ is returned. Otherwise, it indicates that the matching is successful and then the CSP returns the corresponding search results CT to the FN.

F. File decryption.

If the doctor’s attribute satisfies the access policy, the doctor uses retrieval key to successfully decrypt the partially encrypted ciphertext and obtain the patient’s PHR file. The decryption algorithm includes 2 aspects: Fog—Decrypt and Do—Decrypt.

: The FN downloads the ciphertext CT from the CSP and the pre-decryption key from the DU. Once that attribute set of the DU does not satisfy the access policy, the FN outputs ⊥. If not, there must be a constant set that satisfies ∑_i∈Ic_iM_i = (1, 0, ⋯, 0). If {λ_i} is a valid share of secret s, there is ∑_i∈Ic_iλ_i = s. The FN uses the pre-decryption key to calculate the intermediate ciphertext Ω as follows:

Finally, the FN sends the partially decryption result (C, Ω) to the DU.

Du—Decrypt(C, Ω, RK): After receiving the partially decrypted ciphertext (C, Ω) by the DU, the DU decrypts it with retrieval key RK = δ. The plaintext m can be recovered by the following equation.

4.2 Correctness analysis

In this part, we will prove the correctness of our scheme by the following equations:

1. (1). In order to verify whether the user-central-public-key ucpk_id,k is valid, the calculation process is as follows:
2. (3). The index and trapdoor matching process is verified as follows:
3. (4). The Fog-Decryption process calculates:

6.1 Theoretical analysis

(1) Capability.

Here, we give the comparison between our scheme and several related works in terms of features (i.e. Keyword search, Fog computing, Multi-authority, etc.) in Table 1. Observe that, we can see that the schemes [10,22,29] do not have the function of keyword search. Only our scheme and scheme [29] are based on fog computing. With the exception of scheme [10] and our scheme, all users’ attributes in the other schemes are not distributed by multiple authorities. That is to say, multiple authorities design improve the security of the key and reduce the computational pressure of a single authority. Moreover, our scheme and scheme [22] can provide outsourced encryption algorithm. But scheme [22] outsources their computational tasks to the corresponding service providers and does not address the latency response problem. The schemes [16,29] adopts AND-gate access policy and the schemes [18,24] uses a less computationally efficient tree access structure. Our scheme adopts efficient linear secret sharing (LSSS). Fortunately, only our scheme satisfies all properties which makes our scheme more suitable for cloud-fog computing system.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Features comparison with the main schemes.

https://doi.org/10.1371/journal.pone.0207543.t001

(2) Efficiency.

In Table 2, we compare the computation cost of our scheme with the schemes [10,16,18,22,24,29] on the key generation, index encryption, trapdoor generation, search over ciphertext, DU-decryption. We mainly consider the time-consuming exponential operation e and the bilinear pairing operation p. In contrast, the time consumption of the remaining operations is negligible. It can be seen from Table 2 that the literature [10,22,29] does not support keyword search, so there is no computational cost in the index generation, trapdoor generation and search phases. Since our scheme is a multi-authority encryption scheme, the proposed scheme has lower efficiency in the key generation phase than other schemes, but our scheme protects the privacy of the user key and prevents the key from leaking. In the index generation phase, it is obvious that the schemes in [16] is less efficient than our scheme. In addition, the computational complexity of the trapdoor generation and search algorithm are linear with the number of attributes. Our scheme is more efficient than other schemes. It only requires 3 exponential operations and 3 pairs of operations are independent of the number of attributes. In the decryption phase, the efficiency of scheme [10] and our scheme are much higher than that of scheme [18,22,24,29] and the decryption algorithm only needs 1 exponential operation. In general, our proposed scheme has higher search efficiency and lower cost of decryption.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Comparisons of communication cost.

https://doi.org/10.1371/journal.pone.0207543.t002

6.2 Experimental analysis

In order to evaluate the practical performance of our scheme, our experiments use the Pairing-Based Cryptography (PBC) library [30]. The environment of the hardware runtime is Intel Core i5-3470 CPU @ 3.20GHz and RAM is 4.00GB. The software runtime environment is JDK 1.7.5, JPBC 2.0.0 and MyEclipse 10. In this section, we describe the efficiency comparison between our scheme and several related literatures [10,16,18,22,24,29]. For the sake of description, we assume the number of user attributes |S| ∈ [10, 50] for the keygen, index, trapdoor and search algorithms, which the unified factor is described by the number of attributes. The time is given in milliseconds. From these sub-figures Fig 4(A)~4(D), we show that the number of attributes has an influence on the efficiency of the above four algorithms, respectively.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 4. Performance comparison.

(A) key generation time (B) index generation time (C) trapdoor generation time (D) search time.

https://doi.org/10.1371/journal.pone.0207543.g004

In Fig 4(A), we show the runtime of the key generation algorithm under different schemes. It can be seen that our solutions are better than all other solutions, and the running time of the schemes [16,18,24] is slightly higher. This is because the theoretical costs of KeyGen algorithm in aforementioned three schemes are (2|S| + 3)e, (2|S| + 4)e, (2|S| + 4)e, respectively. The scheme [29] requires the longest run time and the fastest growth rate. For example, when setting |S| = n = 30, the time required for these seven programs is 138.934ms, 118.566ms, 120.448ms, 151.836, 120.448ms, 185.444ms and 63.988ms, respectively. The growth of scheme [22] is relatively flat, and at |S| = 10, the time of key generation is the longest in all relevant literature.

Schemes in [10,22,29] do not have the function of keyword search, there are no index generation, trapdoor generation and ciphertext retrieval curve for the scheme of [10,22,29] in Fig 4(B)~4(D). In Fig 4(B) we show the time of index generation in the encryption algorithm. By changing the value of n from 10 to 50, we notice that the computational burden of our scheme is slightly higher than that of schemes [16] and [18]. However, since the encryption algorithm is a one-time cost, it does not affect the user’s search experience. Therefore, its communication cost is acceptable in practical applications.

In Fig 4(C), we present the time cost of the trapdoor generation algorithm in all schemes. Schemes [10], [18] and [24] have only subtle differences in the trapdoor generation phase and the time spent is linearly increasing with the number of attributes. However, our scheme is a tiny constant that only needs 3e + p operations, regardless of the number of attributes.

Focusing on the search algorithm, we also tested the time spent in the ciphertext retrieval phase. In this experiment, the calculation cost of the scheme [18] and [24] were the highest, and the scheme [18] (or the scheme [24]) needs |S|e + (2|S| + 1)p (or (2|S| + 1)p) operations. The computational cost of these three schemes [16,18,24] grows linearly with the number of attributes. While our scheme is optimal in all schemes. This is because the time of ciphertext search is independent of variable n, our scheme just needs 2p operations.

From Fig 4 we can see that the actual experimental simulation is completely consistent with the theoretical analysis. Therefore, our scheme is feasible and efficient in practical environment.