Privacy-Preserving and Efficient Public Key Encryption with Keyword Search Based on CP-ABE in Cloud

Zhou, Yunhong; Zheng, Shihui; Wang, Licheng

doi:10.3390/cryptography4040028

Open AccessArticle

Privacy-Preserving and Efficient Public Key Encryption with Keyword Search Based on CP-ABE in Cloud

by

Yunhong Zhou

,

Shihui Zheng

and

Licheng Wang

^*

State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China

^*

Author to whom correspondence should be addressed.

Cryptography 2020, 4(4), 28; https://0-doi-org.brum.beds.ac.uk/10.3390/cryptography4040028

Received: 16 August 2020 / Revised: 2 October 2020 / Accepted: 8 October 2020 / Published: 13 October 2020

Download PDF

Browse Figures

Citation Export

Abstract

In the area of searchable encryption, public key encryption with keyword search (PEKS) has been a critically important and promising technique which provides secure search over encrypted data in cloud computing. PEKS can protect user data privacy without affecting the usage of the data stored in the untrusted cloud server environment. However, most of the existing PEKS schemes concentrate on data users’ rich search functionalities, regardless of their search permission. Attribute-based encryption technology is a good method to solve the security issues, which provides fine-grained access control to the encrypted data. In this paper, we propose a privacy-preserving and efficient public key encryption with keyword search scheme by using the ciphertext-policy attribute-based encryption (CP-ABE) technique to support both fine-grained access control and keyword search over encrypted data simultaneously. We formalize the security definition, and prove that our scheme achieves selective indistinguishability security against an adaptive chosen keyword attack. Finally, we present the performance analysis in terms of theoretical analysis and experimental analysis, and demonstrate the efficiency of our scheme.

Keywords: cloud computing; public key encryption with keyword search; data privacy; access control; ciphertext-policy attribute-based encryption

1. Introduction

With the rise and popularity of cloud computing technology, more and more data users are motivated to outsource their data to cloud for storage, and start to enjoy the various advantages brought by cloud computing, such as large storage capacity, flexible accessibility and vast computationality. By outsourcing data to the cloud, data users are relieved from the heavy burden of local storage and management costs. However, as the cloud server is not fully trusted and the outsourced data may contain sensitive information, sensitive data privacy and security in the cloud naturally become a primary concern for users. In order to address this issue, sensitive data should be encrypted before outsourcing to the cloud. Typical practical applications include cloud-based storage systems, such as electronic medical record systems where electronic health record data-sharing can help doctors to effectively assess patients’ conditions and make correct treatments. To prevent the leakage of patient information, we store the encrypted medical data on the cloud. Although encryption can ensure the confidentiality of data, it brings the inconvenience of data access and processing. For example, when doctors want to query the required medical data, the cloud server needs to perform search functions without knowing the content of the data. However, the conventional information retrieval methods based on plaintext can not directly be used on ciphertext. Therefore, how to search over encrypted data is of importance and becomes a new challenge.

Homomorphic encryption [1,2] can operate on encrypted data, it can be used to search the keyword over encrypted data theoretically. However, constructions based on homomorphic encryption needs large key sizes and brings huge communication costs. To better solve the keyword search problem over encrypted data, searchable encryption (SE) was proposed as an efficient solution. SE not only enables users to search queries over encrypted data stored on an untrusted server but also protects data privacy and search privacy. Compared with homomorphic encryption, SE is designed for keyword search, which is more efficient.

Song et al. [3] seminally proposed the notion of searchable encryption, which was the first concrete symmetric searchable encryption (SSE) construction. Subsequently, a number of efficient SSE schemes [4,5,6,7,8,9,10] have been proposed. However, data users have to securely share key for encryption in SSE schemes due to the property of symmetric cryptography. Therefore, most SSE schemes inevitably suffer from secret key distribution and management problems. Later, at Eurocrypt’04, Boneh et al. [11] first introduced the concept of public key searchable encryption based on the public key encryption algorithm, namely public key encryption with keyword search (PEKS). PEKS solved the secret key management and distribution yield by SSE, so PEKS has aroused great attention in research and has a broader application prospect.

PEKS is a critically important and promising technique, and this paper concentrates on PEKS. At present, various PEKS schemes have been proposed in the literature [12,13,14,15,16,17,18,19,20], and PEKS has been rapidly developed [21]. Most existing PEKS schemes focus on data users’ rich search functionalities, such as conjunctive keyword search [14] and multi-keyword search [20]. In the above schemes, all search users can be regarded as authorized users, who can have unrestricted access to the system. However, it is not suitable for practical requirements. For example, only the mail receiver is allowed to search on the encrypted emails in the cloud-based email system, while other users have no such permissions. To solve this problem, CP-ABE technology is widely adopted as a viable tool to achieve flexible data access control over encrypted data, which can gain one-to-many encryption instead of one-to-one.

Zheng et al. [22] constructed an attribute-based keyword search scheme on the basis of CP-ABE, however, computation and storage costs grow linearly with the number of system attributes. Yin et al. [23] improved the work of Zheng, but encryption and key generation operations also lead to much higher computational overheads. Thus, in this paper, we propose a new privacy-preserving and efficient public key encryption with keyword search scheme based on ciphertext-policy attribute-based encryption (PEKS-CPABE) to support both fine-grained access control and keyword search over encrypted data simultaneously. Specifically, the main contributions of this paper can be summarized as follows.

We propose an efficient and privacy-preserving PEKS-CPABE scheme, which enables the data owner to control the search and use of its outsourced encrypted data in the cloud according to its access control policy. Our scheme can achieve keyword search queries over encrypted data with fine-grained access control;
We formalize the security definition, and prove that our scheme achieves selective indistinguishability security against an adaptive chosen keyword attack and can also ensure keyword privacy;
We present the performance analysis in terms of theoretical analysis and experimental analysis, and demonstrate the efficiency of our scheme. Finally, the experimental results show that our PEKS-CPABE scheme performs better than the CP-ABKS scheme proposed in [22] and CP-ABSE scheme proposed in [23].

The remainder of this paper is organized as follows: Section 2 presents an overview of related work. Section 3 reviews some necessary and basic preliminary notions used in this paper. Section 4 defines the system model, algorithm description and security model of our proposed scheme. Section 5 introduces the concrete construction of our proposed scheme. Section 6 provides detailed security proof of our proposed scheme. Section 7 shows the performance analysis of our proposed scheme in terms of theoretical analysis and experimental analysis. Finally, Section 8 summarizes this paper.

2. Related Work

In 2004, Boneh et al. [11] devised the first public key searchable encryption scheme based on a standard public key encryption algorithm. In this scheme, multiple users are allowed to encrypt data using the public key, but only the private key holder can search the keyword over encrypted data. Inspired by Boneh et al. pioneering work, more and more researchers have been working on the public key searchable encryption to achieve various functionalities. Park et al. [13] first proposed a PEKS scheme to support conjunctive keyword search on encrypted data. Subsequently, Boneh and Waters [14] extended PEKS to support conjunctive, subset, and range queries on encrypted data. Later on, Lv et al. [18] proposed an expressive and secure PEKS scheme based on composite-order groups to support conjunctive, disjunctive and negation search operations that can be extended to support a range search. Huang and Li [19] proposed a public key authenticated encryption with keyword search scheme that can resist the inside keyword guessing attack, in which the data user can use the secret key to authenticate the data. Recently, Zhang et al. [20] constructed a novel PEKS scheme supporting semantic multi-keyword search by leveraging an efficient inner product encryption technology. These schemes guarantee that data users are able to efficiently perform search queries and prevent the untrusted cloud server from infringing data confidentiality and search privacy.

Attribute-based encryption (ABE), as a useful data encryption tool to address the problem of fine-grained data sharing and decentralized access control, was first proposed by Sahai and Waters [24]. This kind of new cryptographic technology enables users to achieve access control over encrypted data by using an access control policy associated with the private key or ciphertext. There are two types of attribute-based encryption, depending on whether the private key or ciphertext is associated with the access control policy, namely key-policy attribute-based encryption (KP-ABE) and ciphertext-policy attribute-based encryption (CP-ABE). Goyal et al. [25] proposed the first KP-ABE scheme, where the private key is associated with an access control policy and the ciphertext is associated with attributes. A user can decrypt a ciphertext only if the attributes that are used for encryption satisfy the access policy on the user private key. Bethencourt et al. [26] proposed the first CP-ABE scheme, where the ciphertext is associated with an access control policy and the key is associated with attributes. A user can decrypt a ciphertext only if the attributes on the user private key satisfy the access policy associated with the ciphertext. Compared with KP-ABE, CP-ABE is a preferred choice for designing an access control mechanism, because it is conceptually closer to traditional role-based access control.

Based on the special features of ABE, Zheng et al. [22] proposed a ciphertext-policy attribute-based keyword search (CP-ABKS) scheme, in which keywords are encrypted with an access control policy so that only data users with a legitimate credential can generate the trapdoor used to search over encrypted data. Dong et al. [27] introduced an enhanced attribute-based keyword search scheme via an online/offline approach. Their schemes mainly consider resource-constrained mobile devices, and allow data owners and data users to perform related operations online and offline. However, two encryption and decryption operations incur huge computational costs. Li et al. [28] proposed an attribute-based keyword search scheme with outsourcing key-issuing and outsourcing decryption, which is shown to be secure against chosen-plaintext attack, but it introduces three cloud storage providers and needs a number of expenses. Sun et al. [29] designed an authorized keyword search scheme with user revocation by utilizing CP-ABE technology, however, the computational costs in the trapdoor generation grow linearly with the number of system attributes. Qiu et al. [30] proposed a hidden policy attribute-based keyword search scheme to protect the privacy of the access control policy, which incurs abundant computational costs at the same time. Recently, Yin et al. [23] proposed a ciphertext-policy attribute-based searchable encryption scheme, and improved the scheme of Zheng et al. Inspired by both the work of Zheng and Yin, in this paper, we propose a new privacy-preserving and efficient public key encryption with a keyword search scheme based on ciphertext-policy attribute-based encryption (PEKS-CPABE) to support both fine-grained access control and keyword search over encrypted data simultaneously.

3. Preliminaries

In this section, we review some necessary and basic preliminary notions used in this paper.

3.1. Bilinear Map

Let

G

and

G_{T}

be two multiplicative cyclic groups with the same prime order, p. g is a generator of

G

. Let

\hat{e} : G \times G \to G_{T}

be a computable bilinear map. The map

\hat{e}

has the following properties:

Bilinearity: Given $a, b \in Z_{p}^{*}$ and for all $g \in G$ , there exists $\hat{e} (g^{a}, g^{b}) = \hat{e} {(g, g)}^{a b}$ ;
Non-degeneracy: $\hat{e} (g, g) \neq 1$ ;
Computability: Given $a, b \in Z_{p}^{*}$ and for all $g \in G$ , there is an efficient algorithm to compute $\hat{e} (g^{a}, g^{b}) \in G_{T}$ .

3.2. Decisional Bilinear Diffie-Hellman Assumption

Decisional Bilinear Diffie–Hellman (DBDH) Assumption is given as follows: Let

G

be a cyclic group with prime order p. g is a generator of

G

.

\hat{e} : G \times G \to G_{T}

is a bilinear map. We define the advantage as

ϵ

of a PPT adversary

A

to solve the DBDH problem as

A d v_{A}^{D B D H} (λ) = | P r [A (g, g^{a}, g^{b}, g^{c}, \hat{e} {(g, g)}^{a b c}) = 1] - P r [A (g, g^{a}, g^{b}, g^{c}, e {(g, g)}^{z}) = 1] | < ϵ

, where

a, b, c, z \in Z_{p}^{*}

. We say that the DBDH assumption holds if the PPT adversary has a negligible advantage

ϵ

in solving the DBDH problem.

3.3. Access Structure

Access structure is defined by the concepts of an authorized access subset and unauthorized access subset. Let

P = {P_{1}, P_{2}, \dots, P_{n}}

be a set of parties. A collection

A \subseteq 2^{P}

is monotone if

\forall B, C

: if

B \in A

and

B \subseteq C

, then

C \in A

. A monotone access structure is a monotone collection

A

which is a non-empty subset for

{P_{1}, P_{2}, \dots, P_{n}}

, i.e.,

A \subseteq 2^{P} ∖ {⌀}

. The set in

A

is called an authorized set, and the set not in

A

is called an unauthorized set.

3.4. Access Tree

An access tree is usually used to represent an access control policy. Let T be an access tree, and each non-leaf represents a threshold gate described by a threshold value and the number of its children nodes. Let

n u m_{x}

represent the number of children of node x, and the children be labeled from the left to the right as

{1, \dots, n u m_{x}}

. Let

k_{x}

represent the threshold value of x with

1 \leq k_{x} \leq n u m_{x}

. If

k_{x} = 1

, the logic gate of node x is an “OR” gate. If

k_{x} = n u m_{x}

, the logic gate of node x is an “AND” gate. In an access tree T, a leaf is associated with an attribute, so each leaf node of T is described by an attribute and a threshold value

k_{x} = 1

.

Let

p a r e n t (x)

denote the parent of node x,

a t t (x)

denote the attribute associated with leaf node x, and

l v s (T)

denote the set of leaves of the access tree T. Let

i n d e x (x)

denote the label of the node x, and

T_{x}

represent the subtree of T rooted at node x (thus,

T_{r o o t} = T

). If an attribute set

γ

meets the access tree

T_{x}

, we denotes it as

T_{x} (γ) = 1

. Otherwise,

T_{x} (γ) = 0

. When x is a leaf node, if and only if

a t t (x) \in γ

, then

T_{x} (γ) = 1

. When x is a non-leaf node, we can compute

T_{x^{'}} (γ)

for each child node

x^{'}

of node x. If at least

k_{x}

children of the node x return 1, then

T_{x} (γ) = 1

.

4. System Model

In this section, we present the system model, the algorithm description of our proposed scheme and the security model.

4.1. System Model

The system model for our proposed scheme is shown as Figure 1, which involves four types of entities, namely Trusted Authority (TA), Data Owner (DO), Data User (DU) and Cloud Service Provider (CSP). First, the DO extracts the keywords from each data file and builds a secure-searchable keyword index with an attribute-based access policy before outsourcing them into the CSP. The CSP is responsible for many services, such as data storage, computation and search. When a DU wants to issue a search query over encrypted data, he will generate a search trapdoor according to his interested keyword by using his private key and submit it to the CSP. Having received the trapdoor, the CSP attempts to check whether the specified search keyword matches with the index, without knowing the content of the encrypted data and the search keyword. Finally, the CSP returns the corresponding search results to the DU if and only if the attributes of the data user on the trapdoor satisfy the access policies of secure-searchable indexes, and the search trapdoor matches the keyword index. In addition, a TA is in charge of generating and distributing public keys and master keys.

4.2. Algorithm Description of PEKS-CPABE Scheme

In this section, we present an overview of our proposed scheme, which is a tuple of five algorithms.

Setup $(1^{λ})$ : The setup algorithm is invoked by the TA, which takes as input the security parameter $λ$ , and outputs the public parameter $p p$ and the master private key $m s k$ ;
KeyGen $(p p, m s k, S_{U})$ : The key generation algorithm is invoked by the TA, which takes as input the public parameter $p p$ , the master private key $m s k$ and the data user’s attribute set $S_{U}$ , and outputs the private key of the data user $S K_{U}$ ;
Encryption $(p p, T, w)$ : The encryption algorithm is invoked by the DO, which takes as input the public parameter $p p$ , the access tree T and the index keyword w, and outputs the encrypted index $I_{w}$ ;
TrapGen $(p p, S K_{U}, w^{'})$ : The trapdoor generation algorithm is called the DU, which takes as input the public parameter $p p$ , the private key of the data user $S K_{U}$ and the search query for keyword $w^{'}$ , and outputs the trapdoor for query keyword $T_{w^{'}}$ ;
Search $(p p, I_{w}, T_{w^{'}}, S_{U})$ : The search query algorithm is called the CSP, which takes as input the public parameter $p p$ , the encrypted index $I_{w}$ , the trapdoor for query keyword $T_{w^{'}}$ and the data user’s attribute set $S_{U}$ . If the attributes of the data user on the trapdoor satisfy the access policies of secure searchable indexes, and the search trapdoor matches the keyword index, the algorithm returns 1. Otherwise, it returns 0.

4.3. Security Model

To demonstrate the security of our scheme, we design a security game: indistinguishability security against an adaptive chosen keyword attack (IND-CKA) game.

The IND-CKA security game between an adversary

A

and a challenger

C

is defined as follows.

Init: The adversary $A$ chooses a challenging access tree $T^{*}$ , which is sent to the challenger $C$ ;
Setup: The challenger $C$ runs the Setup $(1^{λ})$ algorithms to generate public parameters $p p$ and master key $m s k$ . It gives $p p$ to adversary $A$ and keeps master key $m s k$ ;
Phase 1: $A$ can adaptively ask the simulator $B$ for the trapdoors $T_{w_{i}}$ of a series of keywords $w_{i}$ , and issue private key query and trapdoor query as follows:
Private key query: The adversary $A$ can adaptively ask the challenger $C$ for a group of private keys $S K_{U}$ of some attributes. The challenger $C$ runs the KeyGen $(p p, m s k, S_{U})$ to generate a set of private keys $S K_{U}$ , and sends to the adversary $A$ . The only restriction is that the responding private key does not satisfy $T^{*}$ , and the $C$ maintains a list $L_{S K_{U}}$ of private keys;
Trapdoor query: The adversary $A$ can adaptively ask the challenger $C$ for the trapdoors $T_{w^{'}}$ of a series of keywords $w^{'}$ . The challenger $C$ runs the Trapdoor $(p p, S K_{U}, w^{'})$ to generate the trapdoor, and sends to the adversary $A$ ;
Challenge: The adversary $A$ sends the challenger $C$ two keywords $w_{0}$ , $w_{1}$ on which it wishes to be challenged. The challenger $C$ randomly selects a bit $b \in {0, 1}$ to encrypt and sends the encrypted keyword to the adversary $A$ ;
Phase 2: The adversary $A$ can repeat the query in Phase 1 and continue to ask for any keyword of his choice, except for the $w_{0}$ , $w_{1}$ ;
Guess: The adversary $A$ outputs its guess of $b^{'}$ and wins the game if $b = b^{'}$ .

The advantage of an adversary

A

in winning the IND-CKA game is

A d v_{A}^{I N D - C K A} (λ) = | P r [b = b^{'}] - \frac{1}{2} |

Definition 1.

Our scheme is said to be IND-CKA secure if a probabilistic polynomial-time adversary wins the IND-CKA game with negligible advantage.

5. PEKS-CPABE Construction

In this section, we give a concrete construction of the proposed PEKS-CPABE scheme.

Setup $(1^{λ})$ : The setup algorithm is called by the TA, which takes as input the security parameter $λ$ , and outputs the public parameter $p p$ and the master private key $m s k$ , which is processed as follows:
—
The TA first chooses two cyclic groups $G$ and $G_{T}$ of order p, which is a $λ$ bit prime, g is the generator of $G$ , and selects a bilinear map $\hat{e} : G \times G \to G_{T}$ ;
—
Let $H_{1} : {0, 1}^{*} \to Z_{p}^{*}$ and $H_{2} : {0, 1}^{*} \to G$ be two secure hash functions;
—
Then, the TA selects a random element $α, β \in Z_{p}^{*}$ and sets

$p p = (G, G_{T}, p, \hat{e}, g, g^{α}, g^{β}, H_{1}, H_{2}), m s k = (α, β);$
KeyGen $(p p, m s k, S_{U})$ : The key generation algorithm is invoked by the TA, which takes as input the public parameter $p p$ , the master private key $m s k$ and the data user’s attribute set $S_{U}$ , and outputs the private key of the data user $S K_{U}$ , which is processed as follows:
—
The TA randomly selects $r \in Z_{p}^{*}$ and computes $K = g^{\frac{α + r}{β}}, K^{'} = g^{r}$ ;
—
For each attribute $a t_{j} \in S_{U}$ , compute $K_{a t_{j}} = K^{'} g^{H_{1} (a t_{j})}$ ;
—
Set the private key of the data user as

$S K_{U} = (K, {(K_{a t_{j}}) | \forall a t_{j} \in S_{U}})$
Encryption $(p p, T, w)$ : The encryption algorithm is invoked by the DO, which takes as input the public parameter $p p$ , the access tree T and the index keyword w, and outputs the encrypted index $I_{w}$ , which is processed as follows:
—
The DO first computes $I_{1} = \hat{e} {(g, g)}^{α s} \hat{e} (g^{s β}, H_{2} (w))$ , $I_{2} = g^{s β}$ ;
—
For each node x in the access tree T, the DO chooses a $d_{x}$ degree polynomial $q_{x}$ in a top-down manner, where $d_{x} = k_{x} - 1$ , where $k_{x}$ is the threshold value of node x;
—
For the root node $r o o t$ of access tree T, the DO randomly picks up a secret key $s \in Z_{p}^{*}$ and sets $q_{r o o t} (0) = s$ . Then, the DO randomly chooses $d_{r o o t}$ other points of to define the polynomial $q_{r o o t}$ completely;
—
For other non-root node x, the DO sets $q_{x} (0) = q_{p a r e n t (x)} (i n d e x (x))$ , and randomly chooses $d_{x}$ other points to define the polynomial $q_{x}$ completely;
—
Finally, for each node $x \in l v s (T)$ , compute $A_{x} = g^{q_{x} (0)}$ and $B_{x} = g^{H_{1} (a t t (x)) q_{x} (0)}$ . The encrypted index is given as

$I_{w} = (T, I_{1}, I_{2}, {(A_{x}, B_{x}) | \forall x \in l v s (T)})$
TrapGen $(p p, S K_{U}, w^{'})$ : The trapdoor generation algorithm is called the DU, which takes as input the public parameter $p p$ , the private key of the data user $S K_{U}$ and the search query for keyword $w^{'}$ , and outputs the trapdoor $T_{w^{'}}$ , which is processed as follows:
—
The DU computes $T_{0} = K_{1} H_{2} (w^{'}) = g^{\frac{α + r}{β}} H_{2} (w^{'})$ ;
—
For each $a t_{j} \in S_{U}$ , compute $T_{a t_{j}} = K_{a t_{j}}$ . The trapdoor is given as

$T_{w^{'}} = (T_{0}, {(T_{a t_{j}}) | \forall a t_{j} \in S_{U}})$
Search $(p p, I_{w}, T_{w^{'}}, S_{U})$ : The search query algorithm is called by the CSP, which takes as input the public parameter $p p$ , the encrypted index $I_{w}$ , the trapdoor for query keyword $T_{w^{'}}$ and the data user’s attribute set $S_{U}$ . The CSP selects a data user’s attribute set $S_{U}$ that satisfies the access tree T contained the encrypted index. If $S_{U}$ does not exist, the algorithm returns 0. Otherwise, it computes as follows:
—
If the node x is a leaf node in the T, for each attribute $a t_{j} \in S_{U}$ , then

$E_{x} = \frac{\hat{e} (T_{a t_{j}}, A_{x})}{\hat{e} (g, B_{x})} = \frac{\hat{e} (g^{r} g^{H_{1} (a t_{j})}, g^{q_{x} (0)})}{\hat{e} (g, g^{H_{1} (a t t (x)) q_{x} (0)})} = \hat{e} {(g, g)}^{r q_{x} (0)}, a t t (x) = a t_{j}, x \in l v s (T) .$

—
If the node x is a non-leaf node in the T, we get the $E_{x}$ by computing $E_{x^{'}}$ in a recursive manner, where $x^{'}$ is the children nodes of x. Let $S_{x}$ represent an arbitrary $k_{x}$ set of children nodes x, if no such set exists, $E_{x^{'}} = ⊥$ ; otherwise, compute as follows

$\begin{matrix} E_{x} & = \prod_{x^{'} \in S_{x}} E_{x^{'}}^{Δ_{i, S_{x}^{'} (0)}} \\ = \prod_{x^{'} \in S_{x}} {(\hat{e} {(g, g)}^{r q_{x^{'}} (0)})}^{Δ_{i, S_{x}^{'} (0)}} \\ = \prod_{x^{'} \in S_{x}} {(\hat{e} {(g, g)}^{r q_{p a r e n t (x^{'})} (i n d e x (x^{'}))})}^{Δ_{i, S_{x}^{'} (0)}} \\ = \prod_{x^{'} \in S_{x}} {(\hat{e} {(g, g)}^{r q_{x} (i)})}^{Δ_{i, S_{x}^{'} (0)}} \\ = \hat{e} {(g, g)}^{r q_{x} (0)} \end{matrix}$

(1)

where $i = i n d e x (x^{'}), S_{x}^{'} = {i n d e x (x^{'}) : x^{'} \in S_{x}}$ ;
—
If x is a root node in T, $E_{r o o t} = \hat{e} {(g, g)}^{r q_{r o o t} (0)} = \hat{e} {(g, g)}^{r s} .$ Finally, if $\hat{e} (I_{2}, T_{0}) = E_{r o o t} I_{1}$ , the search algorithm returns 1; otherwise, it returns 0.
Correctness. $I_{1}$ and $I_{2}$ are generated by the encryption algorithm, and $T_{0}$ is generated in the trapdoor generation algorithm. The proposed PEKS-CPABE scheme is correct when the following equation holds.

$\begin{matrix} I_{1} & = \frac{\hat{e} (I_{2}, T_{0})}{E_{r o o t}} \\ = \frac{\hat{e} (g^{s β}, g^{\frac{α + r}{β}} H_{2} (w^{'}))}{\hat{e} {(g, g)}^{r s}} \\ = \frac{\hat{e} {(g, g)}^{s (α + r)} \hat{e} (g^{s β}, H_{2} (w^{'}))}{\hat{e} {(g, g)}^{r s}} \\ = \hat{e} {(g, g)}^{α s} \hat{e} (g^{s β}, H_{2} (w^{'})) . \end{matrix}$

(2)

If the query keyword $w^{'}$ matches the encrypted keyword index, namely $w = w^{'}$ , then we have the equation $\frac{\hat{e} (I_{2}, T_{0})}{E_{r o o t}} = I_{1}$ hold.

6. Security Proof

In this section, we give the security proof of the proposed PEKS-CPABE scheme. Based on the aforementioned security model, we provide a detailed security proof that our scheme achieves selective indistinguishability security against an adaptive chosen keyword attack.

Theorem 1.

PEKS-CPABE scheme achieves IND-CKA security on the condition that DBDH problem is intractable.

Proof.

Assume that

A

is an adversary that can break our proposed scheme, then we can construct a simulator

B

, and the goal is to distinguish between the DBDH tuple

(g^{a}, g^{b}, g^{c}, Z = \hat{e} {(g, g)}^{a b c})

and a random tuple

(g^{a}, g^{b}, g^{c}, Z = \hat{e} {(g, g)}^{z})

where

a, b, c, z \in Z_{p}^{*}

. The IND-CKA security game between the adversary

A

and the simulator

B

is conducted as follows.

Init: The adversary $A$ first chooses an access tree $T^{*}$ to be challenged, which is sent to the simulator $B$ ;
Setup: The simulator $B$ randomly chooses $α, β \in Z_{p}^{*}$ , and computes $g^{α}$ , $g^{β}$ , $\hat{e} {(g, g)}^{α}$ . Then, $B$ returns the public parameter $p p = (G, G_{T}, p, \hat{e}, g, g^{α}, g^{β}, H_{1}, H_{2})$ which is sent to adversary $A$ . $H_{2} (w_{i})$ is simulated as follows. If the $w_{i}$ has not been queried before, the simulator $B$ randomly chooses $ρ_{i} \in Z_{p}^{*}$ , adds $(w_{i}, ρ_{i})$ to the list $O_{H_{2}}$ and outputs $g^{ρ_{i}}$ ; otherwise, the simulator $B$ returns $g^{ρ_{i}}$ by searching $ρ_{i}$ from $O_{H_{2}}$ ;
Phase 1: $A$ can adaptively ask the simulator $B$ for the trapdoors $T_{w_{i}}$ of a series of keywords $w_{i}$ , and issue the $O_{K e y G e n}$ and $O_{T r a p d o o r}$ oracles as follows.
$O_{K e y G e n}$ : The adversary $A$ can adaptively ask the simulator $B$ for a group of private keys $S K_{U_{1}}, \dots, S K_{U_{n}}$ of some attributes $S_{U_{1}}, \dots, S_{U_{n}}$ . The attribute sets embedded into corresponding private keys do not satisfy $T^{*}$ . The simulator $B$ randomly selects $r \in Z_{p}^{*}$ and computes $K = g^{\frac{α + r}{β}}$ . For each attribute $a t_{j} \in S_{U}$ , compute $K_{a t_{j}} = g^{r} g^{H_{1} (a t_{j})}$ . The simulator $B$ sends the private key $S K_{U} = (K, K_{a t_{j}})$ to $A$ , and maintains a list $L_{S K_{U}}$ of private keys.
$O_{T r a p d o o r}$ : The simulator $B$ first searches the $O_{K e y G e n}$ oracle to obtain the secret key as
$(K, {(K_{a t_{j}}, K_{a t_{j}}^{'}) | \forall a t_{j} \in S_{U}})$ . Then, $B$ computes $T_{0} = K H_{2} (w_{i}) = g^{\frac{α + r^{*}}{β}} g^{ρ_{i}}$ . For each $a t_{j} \in S_{U}$ , compute $T_{a t_{j}} = K_{a t_{j}}$ . Finally, $B$ generates the trapdoor as $T_{w_{i}} = (T_{0}, {(T_{a t_{j}}) | \forall a t_{j} \in S_{U}})$ , and $B$ sends $T_{w_{i}}$ to the adversary $A$ ;
Challenge: The adversary $A$ sends the simulator $B$ two keywords $w_{0}$ , $w_{1}$ on which it wishes to be challenged. The simulator $B$ randomly selects a bit $b \in {0, 1}$ to encrypt and generates the encrypted keyword index as follows: $I_{1}^{*} = Z \hat{e} (g^{a β}, H_{2} (w_{b}))$ , $I_{2}^{*} = g^{a β}$ , $A_{x}^{*} = g^{q_{x} (0)}$ , $B_{x}^{*} = g^{H_{1} (a t t (x)) q_{x} (0)}, \forall x \in l v s (T^{*})$ . Namely, $I_{w_{b}} = (T^{*}, I_{1}^{*}, I_{2}^{*}, {(A_{x}^{*}, B_{x}^{*}) | \forall x \in l v s (T^{*})})$ where $a \in Z_{p}^{*}$ . Then, $B$ sends $I_{w_{b}}$ to the adversary $A$ ;
Phase 2: The adversary $A$ can repeat query in Phase 1 and continue to ask for any keyword of his choice, except for the $w_{0}$ , $w_{1}$ ;
Guess: The adversary $A$ outputs its guess $b^{'}$ of b. If $b^{'} = b$ , $B$ outputs 1; otherwise $B$ randomly outputs 0 or 1.

There are two conditions, as follows:

If $Z = \hat{e} {(g, g)}^{a b c}$ , a valid ciphertext $I_{w_{b}}$ is given to the adversary $A$ , and the adversary $A$ has an advantage $ϵ$ to win this game.
The ciphertexts $I_{w_{b}}$ is valid. $I_{1}^{*} = Z \hat{e} (g^{a β}, H_{2} (w_{b})) = \hat{e} {(g, g)}^{a b c} \hat{e} (g^{a β}, H_{2} (w_{b}))$ , $I_{2}^{*} = g^{a β}$ . Since $α, s$ are randomly selected, $a, b, c, \in Z_{p}^{*}$ , let $a = s, b c = α$ , $I_{1}^{*}, I_{2}^{*}$ can be denoted as $I_{1}^{*} = \hat{e} {(g, g)}^{s α} \hat{e} (g^{s β}, H_{2} (w_{b}))$ , $I_{2}^{*} = g^{s β}$ . This means $I_{w_{b}}$ is the valid ciphertext. Through $ϵ$ is the advantage that the adversary $A$ outputs a correct guess, therefore we have that $P r [B (g, g^{a}, g^{b}, g^{c}, Z = \hat{e} {(g, g)}^{a b c}) = 1] = \frac{1}{2} + ϵ$ ;
If $Z \neq \hat{e} {(g, g)}^{a b c}$ , $I_{w_{b}}$ is a random ciphertext. $A$ has nothing to do with the guess, so the adversary $A$ cannot acquire any advantage in this IND-CKA security game but a random guess. Therefore, we have $P r [B (g, g^{a}, g^{b}, g^{c}, Z = \hat{e} {(g, g)}^{z}) = 1] = \frac{1}{2}$ .

Finally, the overall advantage that

B

can solve the DBDH problem in the IND-CKA security is as follows:

A d v_{B}^{I N D - C K A} (λ) = \frac{1}{2} (\frac{1}{2} + ϵ) + \frac{1}{2} \cdot \frac{1}{2} - \frac{1}{2} = \frac{ϵ}{2}

Thus, we have a conclusion that if the probabilistic polynomial time adversary

A

has a non-negligible advantage

ϵ

in breaking IND-CKA security, then we can construct a simulator

B

to solve the DBDH problem with the non-negligible advantage

\frac{ϵ}{2}

. From the above analysis, we know that our proposed PEKS-CPABE scheme is IND-CKA secure on the condition that the DBDH problem is intractable. This completes the proof. □

7. Performance Analysis

In this section, we show the performance analysis of our proposed PEKS-CPABE scheme in terms of theoretical analysis and experimental analysis, and further compare our proposed scheme with the state-of-the-art CP-ABKS [22] scheme and CP-ABSE [23] scheme. Table 1 shows the notations of the performance analysis. For the theoretical analysis, we mainly focus on the computation cost and storage cost. For convenience of comparison, we mainly consider several time-consuming operations, as follows: the bilinear pairing operation

P a i r

mapping two elements in group

G

to group

G_{T}

, the hash function operation H mapping the arbitrary string to an element in group

G

, a modular exponentiation operation

E_{G}

in

G

and a modular exponentiation operation

E_{G_{T}}

in

G_{T}

. We ignore the multiplication operations and hash operations mapping the arbitrary string to an element in group

Z_{p}^{*}

because of the increased efficiency.

7.1. Theoretical Analysis

In Table 2, we evaluate the computation cost of KeyGen algorithm, Encryption algorithm, TrapGen algorithm and Search algorithm under the same access control policy tree, respectively. We observe that our scheme is much more efficient than the CP-ABKS [22] scheme and CP-ABSE [23] scheme in the KeyGen algorithm and Encryption algorithm. Although we notice that our scheme has a higher computational overhead than the CP-ABSE [23] scheme in the TrapGen algorithm, the hash function operation time is minimal. In the Search algorithm, our scheme performs similarly to that of CP-ABSE [23] scheme, and the PEKS-CPABE scheme has a better performance than the CP-ABKS [22] scheme.

In Table 3, we show the storage cost comparison. We observe that the storage cost of our scheme outperforms the CP-ABKS [22] scheme and CP-ABSE [23] scheme in the KeyGen algorithm. In the execution Encryption algorithm and TrapGen algorithm, the storage cost of our scheme is the same as that of the CP-ABSE [23] scheme, but much less than that of the CP-ABKS [22] scheme. Although the CP-ABSE scheme has better search performance than the CP-ABKS scheme, the cost of KeyGen algorithm and Encryption algorithm bring in a much higher overhead. Our scheme solves this problem at the same time, with greater efficiency, therefore, with respect to theoretical analysis, our scheme is acceptable in the cloud.

7.2. Experimental Analysis

To evaluate the actual performance of our scheme, we implement CP-ABKS [22], CP-ABSE [23] and our scheme using Java language based on the Java Pairing Based Cryptography Library (JPBC) [31]. Our experimental platform is based on a Windows 10 server with Intel(R) Core(TM) i7-8565U CPU @ 1.80 GHz and 8.00GB RAM. The running environment of our experiment is Java Runtime Environment 1.8 (JRE1.8). In our experiment, we instantiated the bilinear map with Type A:

y^{2} = x^{3} + x

. For comparison convenience, we set the access policy tree as “AND” access tree “

a t_{1}

AND

a t_{2}

AND, ⋯, AND

a t_{N}

”, and the number of a data user’s attributes S is equal to the number of attributes that are involved in the access policy, from 1 to 50 with step length 10, namely,

N = S \in [1, 50]

. We conduct each experiment many times to obtain the average execution time under the same access control policy. Figure 2 shows the performance comparison of various schemes.

As shown in Figure 2a, we can find that the time of key generation in our scheme is more efficient than the CP-ABKS scheme and CP-ABSE scheme. For example, when setting

N = 50

, our scheme needs 1061 ms to generate keys, however, both CP-ABKS scheme and CP-ABSE scheme need 4333 and 4314 ms, respectively. As illustrated in Figure 2b, in our scheme, the time cost to generate ciphertexts is the lowest out of the three schemes. For example, when setting

N = 50

, our scheme needs 3074 ms to generate ciphertexts, however, both the CP-ABKS scheme and CP-ABSE scheme need 4375 and 4277 ms, respectively. From Figure 2c,d, we can show that our scheme has the better search performance. In the execution of trapdoor generation and search, our scheme and the CP-ABSE scheme outperform the CP-ABKS scheme. Therefore, our scheme is acceptable in practice and suitable for the cloud.

8. Conclusions

In this paper, we propose a privacy-preserving and efficient public key encryption with a keyword search scheme based on CP-ABE to support both fine-grained access control and keyword search over encrypted data simultaneously. Then, we show that our scheme achieves selective indistinguishability security against an adaptive chosen keyword attack on the condition that the DBDH problem is intractable. Meanwhile, we also analyzed the performance of our proposed scheme from the aspects of theoretical analysis and experimental analysis. At last, the experimental results further demonstrate that our scheme performs better than the CP-ABKS scheme proposed in [22] and CP-ABSE scheme proposed in [23]. Besides, our work only considers single keyword search. For the part of the future work, we try to enhance the search functionality and further explore an attribute-based multi-keyword search.

Author Contributions

Conceptualization, Y.Z.; methodology, Y.Z.; software, Y.Z.; validation, S.Z. and L.W.; formal analysis, S.Z. and L.W.; investigation, Y.Z.; writing—original draft preparation, Y.Z.; writing—review and editing, S.Z. and L.W; project administration, L.W.; funding acquisition, L.W. All authors have read and agreed to the published version of the manuscript.

Funding

This work was supported by the National Key R&D Program of China (2017YFB0803001) and the National Natural Science Foundation of China (NSFC) (No. 61972050).

Acknowledgments

In addition, we gratefully acknowledge Jing Li and Jie Cheng from the State Grid Information & Telecommunication Branch for their constructive criticism and suggestions in the revision of this manuscript.

Conflicts of Interest

The authors declare no conflict of interest.

Abbreviations

The following abbreviations are used in this manuscript:

PEKS	Public Key Encryption with Keyword Search
ABE	Attribute-based Encryption
CP-ABE	Ciphertext-policy Attribute-based Encryption
KP-ABE	Key-policy Attribute-based Encryption
SE	Searchable Encryption
SSE	Symmetric Searchable Encryption
TA	Trusted Authority
DO	Data Owner
DU	Data User
CSP	Cloud Service Provider

References

Paillier, P. Public-key cryptosystems based on composite degree residuosity classes. In International Conference on the Theory and Applications of Cryptographic Techniques; Springer: Berlin/Heidelberg, Germany, 1999; pp. 223–238. [Google Scholar]
Gentry, C. Fully homomorphic encryption using ideal lattices. In Proceedings of the Forty-first Annual ACM Symposium on Theory of Computing, Bethesda, MD, USA, 31 May–2 June 2009; pp. 169–178. [Google Scholar]
Song, D.X.; Wagner, D.; Perrig, A. Practical techniques for searches on encrypted data. In Proceedings of the 2000 IEEE Symposium on Security and Privacy. S&P 2000, Berkeley, CA, USA, 14–17 May 2000; pp. 44–55. [Google Scholar]
Curtmola, R.; Garay, J.; Kamara, S.; Ostrovsky, R. Searchable symmetric encryption: Improved definitions and efficient constructions. J. Comput. Secur. 2011, 19, 895–934. [Google Scholar] [CrossRef]
Kamara, S.; Papamanthou, C.; Roeder, T. Dynamic searchable symmetric encryption. In Proceedings of the 2012 ACM Conference on Computer and Communications Security, Raleigh, NC, USA, 16–18 October 2012; pp. 965–976. [Google Scholar]
Kamara, S.; Papamanthou, C. Parallel and dynamic searchable symmetric encryption. In International Conference on Financial Cryptography and Data Security; Springer: Berlin/Heidelberg, Germany, 2013; pp. 258–274. [Google Scholar]
Li, H.; Yang, Y.; Dai, Y.; Bai, J.; Yu, S.; Xiang, Y. Achieving secure and efficient dynamic searchable symmetric encryption over medical cloud data. IEEE Trans. Cloud Comput. 2017. [Google Scholar] [CrossRef]
Ghareh Chamani, J.; Papadopoulos, D.; Papamanthou, C.; Jalili, R. New constructions for forward and backward private symmetric searchable encryption. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada, 15–19 October 2018; pp. 1038–1055. [Google Scholar]
Sun, S.F.; Yuan, X.; Liu, J.K.; Steinfeld, R.; Sakzad, A.; Vo, V.; Nepal, S. Practical backward-secure searchable encryption from symmetric puncturable encryption. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada, 15–19 October 2018; pp. 763–780. [Google Scholar]
Wang, K.; Dong, X.; Shen, J.; Cao, Z. An Effective Verifiable Symmetric Searchable Encryption Scheme in Cloud Computing. In Proceedings of the 2019 7th International Conference on Information Technology: IoT and Smart City, Kuala, Malaysia, 18 April 2019; pp. 98–102. [Google Scholar]
Boneh, D.; Di Crescenzo, G.; Ostrovsky, R.; Persiano, G. Public key encryption with keyword search. In International Conference on the Theory and Applications of Cryptographic Techniques; Springer: Berlin/Heidelberg, Germany, 2004; pp. 506–522. [Google Scholar]
Abdalla, M.; Bellare, M.; Catalano, D.; Kiltz, E.; Kohno, T.; Lange, T.; Malone-Lee, J.; Neven, G.; Paillier, P.; Shi, H. Searchable encryption revisited: Consistency properties, relation to anonymous IBE, and extensions. In Annual International Cryptology Conference; Springer: Berlin/Heidelberg, Germany, 2005; pp. 205–222. [Google Scholar]
Park, D.J.; Kim, K.; Lee, P.J. Public key encryption with conjunctive field keyword search. In International Workshop on Information Security Applications; Springer: Berlin/Heidelberg, Germany, 2004; pp. 73–86. [Google Scholar]
Boneh, D.; Waters, B. Conjunctive, subset, and range queries on encrypted data. In Theory of Cryptography Conference; Springer: Berlin/Heidelberg, Germany, 2007; pp. 535–554. [Google Scholar]
Baek, J.; Safavi-Naini, R.; Susilo, W. Public key encryption with keyword search revisited. In International Conference on Computational Science and Its Applications; Springer: Berlin/Heidelberg, Germany, 2008; pp. 1249–1259. [Google Scholar]
Tang, Q.; Chen, L. Public-key encryption with registered keyword search. In European Public Key Infrastructure Workshop; Springer: Berlin/Heidelberg, Germany, 2009; pp. 163–178. [Google Scholar]
Fang, L.; Susilo, W.; Ge, C.; Wang, J. Public key encryption with keyword search secure against keyword guessing attacks without random oracle. Inf. Sci. 2013, 238, 221–241. [Google Scholar] [CrossRef]
Lv, Z.; Hong, C.; Zhang, M.; Feng, D. Expressive and secure searchable encryption in the public key setting. In International Conference on Information Security; Springer: Berlin/Heidelberg, Germany, 2014; pp. 364–376. [Google Scholar]
Huang, Q.; Li, H. An efficient public-key searchable encryption scheme secure against inside keyword guessing attacks. Inf. Sci. 2017, 403, 1–14. [Google Scholar] [CrossRef]
Zhang, Y.; Wang, Y.; Li, Y. Searchable Public Key Encryption Supporting Semantic Multi-Keywords Search. IEEE Access 2019, 7, 122078–122090. [Google Scholar] [CrossRef]
Zhou, Y.; Li, N.; Tian, Y.; An, D.; Wang, L. Public Key Encryption with Keyword Search in Cloud: A Survey. Entropy 2020, 22, 421. [Google Scholar] [CrossRef]
Zheng, Q.; Xu, S.; Ateniese, G. VABKS: Verifiable attribute-based keyword search over outsourced encrypted data. In Proceedings of the IEEE INFOCOM 2014-IEEE Conference on Computer Communications, Toronto, ON, Canada, 27 April–2 May 2014; pp. 522–530. [Google Scholar]
Yin, H.; Zhang, J.; Xiong, Y.; Ou, L.; Li, F.; Liao, S.; Li, K. CP-ABSE: A ciphertext-policy attribute-based searchable encryption scheme. IEEE Access 2019, 7, 5682–5694. [Google Scholar] [CrossRef]
Sahai, A.; Waters, B. Fuzzy identity-based encryption. In Annual International Conference on the Theory and Applications of Cryptographic Techniques; Springer: Berlin/Heidelberg, Germany, 2005; pp. 457–473. [Google Scholar]
Goyal, V.; Pandey, O.; Sahai, A.; Waters, B. Attribute-based encryption for fine-grained access control of encrypted data. In Proceedings of the 13th ACM Conference on Computer and Communications Security, Alexandria, VA, USA, 30 October–3 November 2006; pp. 89–98. [Google Scholar]
Bethencourt, J.; Sahai, A.; Waters, B. Ciphertext-policy attribute-based encryption. In Proceedings of the 2007 IEEE Symposium on Security and Privacy (SP’07), Berkeley, CA, USA, 20–23 May 2007; pp. 321–334. [Google Scholar]
Dong, Q.; Guan, Z.; Chen, Z. Attribute-based keyword search efficiency enhancement via an online/offline approach. In Proceedings of the 2015 IEEE 21st International Conference on Parallel and Distributed Systems (ICPADS), Melbourne, Australia, 14–17 December 2015; pp. 298–305. [Google Scholar]
Li, J.; Lin, X.; Zhang, Y.; Han, J. KSF-OABE: Outsourced attribute-based encryption with keyword search function for cloud storage. IEEE Trans. Serv. Comput. 2016, 10, 715–725. [Google Scholar] [CrossRef]
Sun, W.; Yu, S.; Lou, W.; Hou, Y.T.; Li, H. Protecting Your Right: Verifiable Attribute-Based Keyword Search with Fine-Grained Owner-Enforced Search Authorization in the Cloud. IEEE Trans. Parallel Distrib. Syst. 2016, 27, 1187–1198. [Google Scholar] [CrossRef]
Qiu, S.; Liu, J.; Shi, Y.; Zhang, R. Hidden policy ciphertext-policy attribute-based encryption with keyword search against keyword guessing attack. Sci. China Inf. Sci. 2017, 60, 052105. [Google Scholar] [CrossRef]
De Caro, A.; Iovino, V. jPBC: Java pairing based cryptography. In Proceedings of the 2011 IEEE Symposium on Computers and Communications (ISCC), Corfu, Greece, 28 June 28–1 July 2011; pp. 850–855. [Google Scholar]

Figure 1. System Model of Our Scheme.

Figure 2. The performance comparison of various schemes.

Table 1. Notations for performance analysis.

Notation	Description
$E_{G}$	The time of a modular exponentiation in $G$
$E_{G_{T}}$	The time of a modular exponentiation in $G_{T}$
$P a i r$	The time of a bilinear pairing
H	The time of hash operation mapping a bit-string to an element in $G$
$\| G \|$	The number of elements in $G$
$\| G_{T} \|$	The number of elements in $G_{T}$
$\| Z_{p}^{*} \|$	The number of elements in $Z_{p}^{*}$
S	The number of a data user’s attribute
N	The number of attributes that are involved in a data owner’s access control policy

Table 2. The comparison of computation cost.

Algorithm	CP-ABKS [22]	CP-ABSE [23]	PEKS-CPABE (Ours)
KeyGen	$(2 S + 2) E_{G} + S H$	$(2 S + 3) E_{G} + S H$	$(S + 2) E_{G}$
Encryption	$(2 N + 4) E_{G} + N H$	$(2 N + 2) E_{G} + E_{G_{T}} + 2 P a i r + N H$	$(2 N + 1) E_{G} + E_{G_{T}} + 2 P a i r$
TrapGen	$(2 S + 4) E_{G}$	$E_{G}$	$E_{G} + H$
Search	$(2 N + 3) P a i r + N E_{G_{T}}$	$(2 N + 1) P a i r + N E_{G_{T}}$	$(2 N + 1) P a i r + N E_{G_{T}}$

Table 3. The comparison of storage cost.

Algorithm	CP-ABKS [22]	CP-ABSE [23]	PEKS-CPABE (Ours)
KeyGen	$(2 S + 1) l o g \| G \|$	$(2 S + 2) l o g \| G \|$	$(S + 1) l o g \| G \|$
Encryption	$(2 N + 3) l o g \| G \|$	$(2 N + 1) l o g \| G \| + l o g \| G_{T} \|$	$(2 N + 1) l o g \| G \| + l o g \| G_{T} \|$
TrapGen	$(2 S + 3) l o g \| G \|$	$(2 S + 1) l o g \| G \|$	$(S + 1) l o g \| G \|$

© 2020 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).

Algorithm	CP-ABKS [22]	CP-ABSE [23]	PEKS-CPABE (Ours)
KeyGen	$(2 S + 1) l o g \| G \|$	$(2 S + 2) l o g \| G \|$	$(S + 1) l o g \| G \|$
Encryption	$(2 N + 3) l o g \| G \|$	$(2 N + 1) l o g \| G \| + l o g \| G_{T} \|$	$(2 N + 1) l o g \| G \| + l o g \| G_{T} \|$
TrapGen	$(2 S + 3) l o g \| G \|$	$(2 S + 1) l o g \| G \|$	$(S + 1) l o g \| G \|$

Article Menu

Privacy-Preserving and Efficient Public Key Encryption with Keyword Search Based on CP-ABE in Cloud

Abstract

1. Introduction

2. Related Work

3. Preliminaries

3.1. Bilinear Map

3.2. Decisional Bilinear Diffie-Hellman Assumption

3.3. Access Structure

3.4. Access Tree

4. System Model

4.1. System Model

4.2. Algorithm Description of PEKS-CPABE Scheme

4.3. Security Model

5. PEKS-CPABE Construction

6. Security Proof

7. Performance Analysis

7.1. Theoretical Analysis

7.2. Experimental Analysis

8. Conclusions

Author Contributions

Funding

Acknowledgments

Conflicts of Interest

Abbreviations

References

Further Information

Guidelines

MDPI Initiatives

Follow MDPI