Our contributions

In this paper, we propose a keyword searchable attribute-based encryption scheme with attribute update for cloud storage. The main contributions of our scheme are summarized as follows:

1. The new scheme is a combination of ABE scheme and keyword searchable encryption scheme. So our scheme not only solves the problem of confidentiality of the data with fine -grained access control but also solves the problem of keyword search. Moreover, the scheme is proven to be semantic security against chosen ciphertext-policy and chosen plaintext attack in the general bilinear group model.
2. The new scheme supports the user's attribute update, and when a user’s attribute need to be updated, only the user's secret key related with this attribute need to be updated, while other users’ secret key and the ciphertexts related with the attribute need not to be updated. This is a more efficient attribute update method than that in existing attribute update schemes.
3. In addition, the operation with high computation cost is outsourced to CS to reduce the user's computational burden.
4. Our keyword search algorithm supports multi-user keywords searchable, as long as user's trapdoor could match keywords index stored in the cloud storage. Moreover, our keyword search scheme is proved to be semantic security against chosen keyword attack (IND-CKA) under bilinear Diffie-Hellman (BDH) assumption.

Functional comparisons

We compare the function of our scheme with some exiting schemes [13,19,21,29,31] in Table 1.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. The comparisons of our scheme with some exiting schemes.

https://doi.org/10.1371/journal.pone.0197318.t001

Bilinear map [33]

Let and be two multiplicative cyclic bilinear groups of prime order p. Let g be a generator of . A bilinear map is a map with the following properties:

1. Bilinearity: for all and , we have e(g^a,g^b) = e(g,g)^ab.
2. Non-degeneracy: e(g,g) ≠ 1.
3. Computability: There is an efficient algorithm to compute e(u,v) for .

Bilinear Diffie-Hellman assumption [34]

The BDH problem in is defined as follows: taken as input, compute . We say that the adversary has ε advantage in solving BDH problems in if

We say that the BDH assumption holds in if no probability polynomial adversary has non-negligible advantage in solving the BDH problem in .

Generic bilinear group model [2]

We suppose there are two random encodings , where is an additive group and m > 3logp. For i = 0,1, we set . We are given oracles to compute the induced group action on and an oracle to compute a non-degenerate bilinear map . And we are also given a random oracle to represent the hash function H.

Linear secret sharing schemes [33]

A linear secret sharing scheme ∏ over a set of parties P is called linear (over ) if

1. The shares for each party form a vector over .
2. There exists a matrix M with l rows and n columns called the share-generating matrix for ∏. For all i = 1,2,⋯,l, the function ρ defines the party labeling ith row of M as ρ(i). When we consider the column vector , where is the secret to be shared, and are randomly chosen. Then Mv is the vector of 1shares of the secret s according to ∏. The share (Mv)_i belongs to party ρ(i).

Suppose ∏ that is an LSSS for the access structure . Let be any authorized set, and I ⊂ {1,⋯,l}. Then, there exist constants such that, if {λ_i} are valid shares of any secret s according to ∏, then ∑_i∈I ω_i λ_i = s. Furthermore,there these constants {ω_i} can be found in time polynomial in the size of the share -generating matrix M.

System model

A system framework of our scheme includes the main four entities is presented in Fig 1.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. System model of the proposed scheme.

https://doi.org/10.1371/journal.pone.0197318.g001

Attribute authority (AA). The AA is a perfectly trusted entity. It takes charge of the system establishment, user registration, attributes management and secret key generation. And when an attribute of a user needs to be updated, the AA generates an updated key for the user.

Cloud server (CS). The CS is responsible for storing the data and providing data access for legitimate users. It is also responsible for keyword search when a search trapdoor is received from a user. And it also takes charge of updating the user's partial secret key which related to the updated attribute and helps legitimate users to partially decrypt the ciphertext by using partial secret key of the user.

Data owner (DO). The data owner encrypts its owner data and builds keyword indexes, and then outsources them to the CS.

User (U). Each legitimate user can search their interesting the files from system. The user generates a search trapdoor to protect the privacy of the search keyword. Then the user sends his identity and search trapdoor to CS. Without revealing any information about keyword search, the CS will find the encrypted file includes the keywords and do a lot of partial decryption work to reduce the decryption load of the user. Finally, the user gets the partial decrypted files, and then decrypts the partial decrypted files by using his owner partial secret key.

Algorithm description

We proposed a keyword searchable attribute-based encryption scheme with attribute update for cloud storage includes the following eight phases.

Security model

Phase 1: System initialization

The AA first defines an attribute universe as L = {1,2,⋯,m} and chooses three hash functions and , which can be modeled as random oracles. Then the CS creates a user identity list and a file list FL = (F^*,CT,I_W,E_k(F)), which are initially empty. Finally, the AA executes the setup algorithm.

AA.Setup (λ,L) → (PP,MSK,PK_s,SK_s). The setup algorithm first chooses two multiplicative cyclic groups and of prime order p, a generator and a bilinear map . It then chooses and lets SK_s = x_s as the CS's secret key. And it computes as the CS's public key and publishes it. And it also randomly chooses three elements . In addition, it chooses a random number for each attribute j ∈ L. Finally, it outputs the public parameters PP and the master secret key MSK as follows:

Phase 2: Key generation

The AA first distributes an attribute set associates with user's identity id, when a user with identity id requests a registration in the system. Secondly, the AA randomly chooses a number for the user and calculates . Then, the AA executes key generation algorithm.

AA.KeyGen . The key generation algorithm first randomly chooses , which t_id is a unique assigned to the user with identity id. For each attribute , it randomly chooses . Finally, it outputs the user's secret key:

Lets A_priv = μ as the user's search secret key and B_pub = g^μ as the user's search public key.

Finally, the AA sends to the user and publishes the user's searches public key B_pub. And, the AA sends to the CS, the CS stores in the SL-list.

Phase 3: File encryption and keyword index generation

Step 1: The DO encrypts the files.

To get ciphertext E_k(F), the DO encrypts file F with a symmetric key k by the symmetric encryption algorithm. Then DO encrypts the symmetric key k by the following encryption algorithm.

DO.Encrypt (PP,k,(M,ρ)) → CT. Let M be an l × n matrix, and M_i be the vector corresponding to the i th row of matrix M. The function ρ associates rows of matrix M to attributes. The encryption algorithm first chooses a random vector . These elements of vector v will be used to share the random encryption exponent s. For i = 1 to l, it calculates λ_i = M_iv^T. It then randomly chooses numbers and outputs the ciphertext CT: Where v_ρ(i) refers to the master key is associated with attribute ρ(i) ∈ L.

Step2: Index generation.

The DO extracts a keywords set from the file F. Then DO executes the following index generation algorithm.

DO.Index (W,B_pub) → I_W. The index generation algorithm randomly chooses for each keyword w_i ∈ W and calculates . It then lets . Finally, It outputs the keywords index set .

Finally, the DO sends the file (CT,I_W,E_k(F)) to the CS. When the CS receives the uploaded file (CT,I_W,E_k(F)), it picks a unique identifier F^* for the file (CT,I_W,E_k(F)). The CS stores (F^*,CT,I_W,E_k(F)) in the FL-list.

Phase 4: Trapdoor generation

Step 1: Authentication information generation.

U.AuthorizationKey . To generate the authentication information, the authentication information generation algorithm chooses a random number and calculates . It outputs the authentication information :

Step 2: Trapdoor generation.

U.Trapdoor (w,PK_s,A_priv) → T_w. The trapdoor generation algorithm randomly chooses a number and calculates T₁ = g^η, . It outputs the trapdoor T_w:

Finally, the user sends his id, the authentication information and the trapdoor T_w to CS.

Phase 5:Verification

CS.Verifing . The validation algorithm inputs user's identity id and the authentication information . The cloud server uses its own secret key SK_s = x_s to calculate and judges the equation holds or not. If the equation holds, which means the user is a legitimate user, it outputs 1. Otherwise, it outputs 0 and the algorithm is terminated.

Phase 6: File retrieval

CS.Test (I_W,T_w) → (0,1). The test algorithm inputs the keywords index set I_W and the user's search trapdoor T_w. The cloud server uses its own secret key SK_s = x_s and user's trapdoor T_w = {T₁,T₂} to calculate

It then accords to keywords index to calculate and judges the equation H₂(φ₁) = I₂ holds or not. If the equation holds, which means the test is successful it outputs 1. Otherwise, it outputs 0 and the algorithm is terminated.

Phase 7: Data decryption

Step 1: Partial decryption by CS.

The CS first obtains ciphertext CT corresponding to keywords index I_W in the FL-list and finds user's secret key in the SL-list. If user's secret key is not the SL-list, the algorithm ends. Otherwise, it executes pre-decryption algorithm.

CS.PreDecrypt . The pre-decryption algorithm inputs user's secret key for an attribute set and a ciphertexts CT for access structure (M,ρ). At present, we assume that the attribute set satisfies the access structure (M,ρ) and let I be defined as . Then, let be as set of constants such that, if {λ_i}_i∈I are valid shares of the secret s according to M, then ∑_i∈I ω_iλ_i = s. The pre-decryption algorithm calculates

Finally, The CS sends part-ciphertext and the encrypted file E_k(F) to the user.

Step2: User decryption

U.PostDecrypt . The post-decryption algorithm inputs the partial decrypted ciphertext CT′ and the user's secret key . The user executes post-decryption algorithm to calculate symmetric k as follows:

Finally, the user gets the plaintext F = D_k(E_k(F)) by the symmetric key k.

Phase 8: Attribute update

Step1: Update key generation.

AA.UKeyGen . The update key generation algorithm inputs the public parameter PP, the master secret key MSK, the attribute j and j′. For attribute j′, the AA finds the random number in the master secret key MSK, and then the AA outputs the update key :

Finally, it sends user's identity id and update key to CS.

Step2:The CS executes a secret key update.

CS.KeyUpdate . The secret key update algorithm inputs user's secret key and the update key . The CS executes the secret key update algorithm, and outputs a new secret key .

Selective security proof for our scheme

Theorem 1. Let and be defined as in the generic bilinear group model. For any adversary that makes a total of at most q queries to the oracles for computing the group operations in and , the bilinear map e and the interaction with the IND-sCP-CPA security game, then the advantage of the adversary in the IND-sCP-CPA security game is .

Proof. In the IND-sCP-CPA security game, the challenge ciphertext has part-ciphertext may be k₀e(g,g)^αs or k₁e(g,g)^αs. As in the [2], we modify ciphertext in the IND-sCP-CPA security game, now assuming the challenge ciphertext which may be e(g,g)^αs or e(g,g)^θ, where is randomly selected and the adversary needs to determine which is the case. Obviously, any adversary has advantage ε in the IND-sCP-CPA security game may be converted into has at least advantage in the modified IND-sCP-CPA security game (there are two situations can be considered: one in which the adversary must distinguish between k₀e(g,g)^αs and e(g,g)^θ; another in which the adversary must distinguish between k₁e(g,g)^αs and e(g,g)^θ. Obviously, both of these are equivalent to the above modified IND-sCP-CPA security game).

Initialization. The adversary first submits an access structure (M^*,ρ^*) to the simulator S. In order to simulate the modified IND-sCP-CPA game, and then we introduce some mathematical symbols in the general bilinear group model, and let ψ₀(0) = g,ψ₁(1) = e(g,g) (we will write ψ₀(x) = g^x,ψ₁(y) = e(g,g)^y).

Setup. The simulator S randomly chooses , and calculates g^μ,g^γ,e(g,g)^α. When the adversary queries hash value of H on any attribute j, if it did not be queried, the simulator S randomly chooses , and then calculates , and writes the results into the Hash list. Otherwise, it looks for the Hash list. For any attribute j ∈ L, the simulator S randomly chooses a number . It sets the public parameter PP and the master secret key MSK as:

The simulator S sends public parameter PP to the adversary .

Phase 1. The simulator S answers secret key queries as following:

Secret key query. When makes its m'th key generation query for the attribute set S_m, with a constraint that attribute set S_m does not satisfy access structure (M^*,ρ^*). The simulator S randomly chooses , and then calculates . For any attribute j ∈ S_m, the simulator S randomly chooses and calculates . It outputs secret key:

Then, the simulator S sends SK to adversary .

Challenge. The adversary submits two equal messages k₀ and k₁ to the simulator S. First, the simulator S executes encryption algorithm according to the access structure (M^*,ρ^*). Where M^* is an l × n matrix. The is ith row of matrix M^*. The function ρ^* which associates rows of matrix M^* to attributes. Secondly, the simulator S chooses a random vector . These elements of vector v will be used to share the encryption exponent s. Where is constrained by the LSSS scheme. Then, the simulator S chooses a random variable b ∈ {0,1} and l random variable values to get the encryption of as: and .

The ciphertext is

Finally, the simulator S sends the ciphertext CT^* to adversary .

Phase 2. Phase1 is repeated.

The adversary terminates and returns a guess b′ of b after many queries. At this point, the simulator S randomly chooses a value to get the simulated challenge ciphertext via substituting for . After the simulation, the simulator S returns the simulated challenge ciphertext to adversary .

Next, we analyze the simulator S simulation. We think that the simulator S simulation is flawless with a constraint “unexpected collision” does not occur in the querying of ψ₀(x) = g^x, ψ₁(y) = e(g,g)^y for group operation and . Thus, an “unexpected collision” occurs when two queries corresponding to two different rational functions v and v′, it causes that v′ − v = 0 for some variables. (Where an oracle query is regard as a rational function [2]). Then, we make the following analysis of "unexpected collision":

Before substitution. By the Schwartz-Zipple lemma[35,36], the probability of the “unexpected collision” occurs in and at most is .

After substitution. We consider what the adversary’s view would have been if we set θ = αs. We will show that subject to the conditioning above, the the adversary’s view would have been identically distributed. Since we are in the generic group model where each group element’s representation is uniformly and independently chosen[2], the only way that the adversary’s view can differ in the case of θ = αs is if there are two queries v and v′ into is v ≠ v′ but v|_{θ = αs} = v′|_{θ = αs}. We prove show that this does never happens.

Case. To structure γ′αs, we know that θ only exists as e(g,g)^θ in this form. According to the simulation, the simulator S wants v and v′ is related to the θ is by having some additive terms of the form γ′θ.Therefore, we must have v − v′ = γ′αs − γ′θ for some constant γ′ ≠ 0. Then, we artificially add the query v − v′ + γ′θ = γ′αs to the adversary's queries. According to the conditions which we have set, we prove that adversary cannot construct the query for . Otherwise, a collision occurs and the theorem proves.

In order to gain a better understand of the above situation. We analyze based on the information given to the adversary by the simulation. In Table 2, we enumerate the possibility queries of all rational function in by the adversary . Except those in which every monomial involves the variable μ, since the variable μ is not relevant to constructing term αs. Where the variables j and j′ represents the attribute string, and m indicates secret key queries made by the adversary .

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Possible query types from the adversary.

https://doi.org/10.1371/journal.pone.0197318.t002

According to Table 2, the adversary can construct a polynomial αs + t_ms is by pairing s with α + t_m. In this way, the adversary also constructs a query term containing for some collections T and constant . But the goal of the adversary is to obtain a query polynomial γ′αs, so the adversary must add the negative terms to cancel the terms . To construct the negative terms , the adversary first constructs a query polynomial of the from t_ms by pairing with with a constraint ρ^*(i) = j, as we know s is linear combinations of λ_i. For the other collections and constant , the adversary can also construct a query polynomial as:

Therefore, we do some analysis to give the conclusion of this proof:

1. The set of secret shares do not reconstruct secret s for some m ∈ T. Then term t_ms will still be retained, and cannot construct γ′αs.
2. If for all m ∈ T the set of secret shares allow reconstruction the secret s. In order to get γ′αs, the adversary may cancel the term by the combination of the terms t_mλ_i, but dose not get the term by examining the Table 2, there is no term such that can cancel this term . Therefore, the adversary cannot construct γ′αs.

IND-CKA security proof

Theorem 2. Supposing that BDH assumption holds, our scheme is semantically secure against a chosen keyword attack in the random oracle model.

Proof. Suppose the adversary is a malicious cloud server that has non-negligible advantage ε in breaking our constructed searchable encryption scheme. Suppose that the adversary makes at most hash function queries to H₂ and at most q_T trapdoor queries(we assume and q_T are positive).We will construct a simulator to solve BDH problem with advantage , where e is the base of the natural.

Initialization. The simulator receives a BDH challenge and chooses two multiplicative cyclic groups and of prime order p, a generator and a bilinear map . Then simulator randomly chooses , lets , its aim is to compute .

Setup. The simulator randomly chooses a number , lets public key and secret key SK_s = x_s for the adversary . To simulate the user's search public keys B_pub and secret keys A_priv, the simulator chooses a random parameter and sets , so A_priv = μ = at₁.

Phase1.The adversary adaptively issues following queries:

H₁-Query: The adversary can query the random oracle H₁ at any time. To answer to H₁ queries, the simulator maintains a list of tuples (w_i,h_i,e_i,c_i) called the H₁-list. The list is initially empty. When queries the random oracle H₁ of any keywords w_i ∈ {0,1}^*, the simulator answers as follows:

1. If the query w_i has already appeared on the H₁-list in a tuple (w_i,h_i,e_i,c_i), the simulator responds with .
2. Otherwise, generates a random coin c_i ∈ {0,1} so that , where q_T is a trapdoor query.

If c_i = 0, the simulator calculates ;

If c_i = 1, the simulator calculates , where the value randomly is selected. Then adds the tuple (w_i,h_i,e_i,c_i) to the H₁-list, and returns H₁(w_i) = h_i to the adversary .

H₂-Query: can query the random oracle H₂ at any time. To answer to H₂ queries, the simulator maintains a list of tuples (t_i,V_i) called the H₂-list. The list is initially empty. When queries the random oracle H₂ of any , the simulator answers as follows:

1. If the query t_i has already appeared on the H₂-list in a tuple (t_i,V_i), the simulator responds with H₂(t_i) = V_i ∈ {0,1}^logp.
2. Otherwise, the simulator randomly chooses a value V_i ∈ {0,1}^logp, and the simulator adds the tuple (t_i,V_i) to the H₂-list, and returns H₂(t_i) = V_i to .

Trapdoor queries: When queries the trapdoor of any keywords w_i ∈ {0,1}^*, the simulator first executes the H₁ queries to obtain such that H₁(w_i) = h_i and (w_i,h_i,e_i,c_i) corresponding to the tuple on the H₁-list. the simulator answers as follows:

1. If c_i = 0, the simulator declares the failure and aborts.
2. If c_i = 1, . the simulator randomly chooses a value , and calculates

The simulator sends trapdoor to .

Challenge: The adversary submits a pair of keywords w₀ and w₁, where keywords w₀ and w₁ trapdoor had not been queried by . the simulator generates keyword index as follows:

1. the simulator first executes H₁ queries twice to obtain such that H₁(w₀) = h₀, H₁(w₁) = h₁. For i = 0,1, we set (w_i,h_i,e_i,c_i) corresponding to the tuple on the H₁-list. If both c₀ = 0 and c₁ = 1, then declares the failure and aborts.
2. we known that at least one of c₀ and c₁ is equal to 0. The simulator chooses a bit b ∈ {0,1} such that c_b = 0.
3. The simulator answers the keyword index . The simulator then randomly chooses a parameter and sets with the implied setting (), where c is unknown, and we know u₃ = g^c is a part of BDH.
4. the simulator randomly chooses a Z ∈ {0,1}^logp, and sets .

With the definition, is an effective keyword index for keyword w_b as queried.

Phase 2. Phase1 is repeated.

Output. The adversary outputs its guess b′ of bit b.

Note the values be set with probability in the setting of the H₁ queries. Since queries the value of the form to H₂ oracle with the same probability in the setting of the H₂-list, therefore

Then, the simulator randomly chooses a pair (t_i,V_i) ∈ H₂-list and outputs as its guess for e(g,g)^abc. Where t₁,t₂ and e_b are set according to the parameters of the challenge phase.

Probability Analyses. We can prove that can win the game with a non negligible probability, then can solve the BDH problem with the probability at least . The specific probability analysis is similar to the scheme[34].

Because of the BDH assumption that the BDH problem is tough, so the probability . is negligible. So that our scheme is secure under the BDH assumption.

Computational complexity comparison

In Table 3,we give the comparison of the computational complexity of our scheme with the schemes [13,19, 21,31]. As shown in Table 3, our scheme has a less amount of computation in the key generation and encryption generation compared with the schemes in [13,19,31]. Actually, our scheme needs the minimum amount of computation when the users decrypt the ciphertext. And most important is that our scheme need not update ciphertext when an attribute update occurs, which also help us greatly reduce the amount of computation. In addition, our scheme have the function of the keyword search, which can make the search more efficiently and more accurately. The schemes of [13],[19] and [21] don’t achieve the function of keyword search.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Comparison of computational complexity.

https://doi.org/10.1371/journal.pone.0197318.t003

Performance evaluation

To evaluate the performance of our scheme and the scheme [19], we simulate the computational time of the setup generation, key generation, encryption and decryption by user with different number of attributes. As shown in Fig 2. The implementation is executed by using of the Pairing Cryptography (PBC) library[37]. We can clearly see from Fig 2(A) that the setup generation times scales linearly in the number of attribute in attribute universe in both scheme. Fig 2(B) shows secret key times scales linearly in the number of attribute in secret key in both scheme. Fig 2(C) shows the encryption times scales linearly in the number of attribute in ciphertexts in both scheme. The setup generation time is shown in Fig 2(A). We find also that the setup generation takes higher computational time in our scheme than the scheme [19]. The key generation time is shown in Fig 2(B) and the encryption time is shown in Fig 2(C). Obviously, the encryption time and key generation time of the scheme[19] takes higher computational time than our scheme.Fig 2(D) shows that the user- decryption time of our scheme takes lesser computational time than the scheme [19].

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. Performance evaluation.

(a) Setup generation time (b) Key generation time (c) Encryption time (d) Decryption time of the user.

https://doi.org/10.1371/journal.pone.0197318.g002