Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

H O S T E D BY Contents lists available at ScienceDirect

Journal of King Saud University - Computer and

Information Sciences
journal homepage: www.sciencedirect.com

Blockchain-based CP-ABE data sharing and privacy-preserving scheme

using distributed KMS and zero-knowledge proof
Zhixin Ren , Enhua Yan , Taowei Chen *, Yimin Yu *
School of Information, Yunnan University of Finance and Economics, No. 237 Longquan Road, Wuhua District, Kunming, Yunnan Province 650221, China
Institute of Intelligent Application, Yunnan University of Finance and Economics, No. 237 Longquan Road, Wuhua District, Kunming, Yunnan Province 650221, China

A R T I C L E I N F O A B S T R A C T

Keywords: Nowadays, the integration of blockchain technology with Ciphertext-Policy Attribute-Based Encryption (CP-ABE)
Blockchain has drawn the researcher attention because it can provide key security auditing and transaction traceability in
CP-ABE the context of data sharing. However, in a majority of existing blockchain-based CP-ABE schemes, private keys
KMS
were still issued by one central authority that would lead to heavy computation, higher transaction costs, and
Zero-knowledge proof
Incentive mechanism
restricted scalability within the decentralized system. To address these challenges, we present an enhancement
approach towards utilizing distributed key management service (KMS) and zero-knowledge paradigms. In our
improved novel blockchain system model, we define two types of blockchain nodes for the CP-ABE scheme
through staking mechanism. Firstly, the proxy re-encryption nodes are introduced to offer secure multi-party
management and distribution of the CP-ABE’s master secret key, eliminating dependence on a central author­
ity and producing proofs of re-encryption correctness. Secondly, the operator nodes can collect all transactional
information in blockchain-based CP-ABE scheme and then send the Zero-Knowledge Succinct Non-Interactive
Argument of Knowledge (zk-SNARKs) proofs to verify the batch’s integrity via smart contract. Subsequently,
we employ the staking economic incentive model with reward determination and slashing in the decentralized
blockchain system to ensure network security. Finally, simulation results validate the effectiveness of our pro­
posed scheme in achieving secure and efficient data sharing. Even amidst the pressure of 100 simultaneous
transactions, the average response time for a single node remains at an approximate 28 s. Additionally, there is a
notable decrease in on-chain gas consumption, with a gas reduction exceeding 61%. Comparative analyses
further indicate that our blockchain-based CP-ABE scheme, in conjunction with a decentralized KMS, offers a
superior balance between computational efficiency and functional capability.

1. Introduction 2022; Xie, 2023). The reasons for this include the following:

In the digital era, data sharing has become a technology that makes it • Privacy-preserving technology are diverse and complex. In the
possible for data to be easily collaborated and transferred across particular scenario, it is often necessary to use a combination of one
different domain. It is widely applicable and establishing itself as an or more crypto and other advanced technologies.
indispensable component of collaborative research and decision-making • It is difficult to ensure the secure sharing of plaintext data. Moreover,
across various fields in the resent days (Li et al., 2014; Lu and Cheng, an attack on centralized platform of data sharing and protection may
2019). For instance, in digital healthcare system, sharing patients’ lead to a data breach.
electronic health records between different research institutions or • Finally, the implement of privacy protection technique requires high
hospitals bolsters medical research and epidemiological analysis. Doc­ costs in terms of time and performance, which can be problematic
tors that share data can make better informed medical decision and with data-in-motion and real-time analysis and dissemination.
services (CBS., 2019). Data gains its value when we share it, yet data
privacy policies and data ownership demands have historically placed a Therefore, blockchain-based CP-ABE (Sahai and Waters, 2005; Goyal
barrier on our ability to elevate this value (NSTIC., 2018; Xu and Wang, et al., 2006; Bethencourt et al., 2007; Waters, 2011) is an emerging

* Corresponding authors at: Yunnan University of Finance and Economics, No. 237 Longquan Road, Wuhua District, Kunming, Yunnan Province 650221, China.
E-mail addresses: [email protected] (T. Chen), [email protected] (Y. Yu).

https://doi.org/10.1016/j.jksuci.2024.101969
Received 27 October 2023; Received in revised form 11 February 2024; Accepted 11 February 2024
Available online 29 February 2024
1319-1578/© 2024 The Author(s). Published by Elsevier B.V. on behalf of King Saud University. This is an open access article under the CC BY-NC-ND license
(http://creativecommons.org/licenses/by-nc-nd/4.0/).
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

hybrid privacy-preserving technology that has gained significant 1.2. Paper organization
attention from scholars and the industry in the field of data security and
sharing (Xue et al., 2019; Sookhak et al., 2017). This is mainly due to: The paper is structured as follows: In Section 2, we describe the
related research on CP-ABE. Section 3 presents the necessary back­
• The CP-ABE scheme is constructed to achieve multiple privacy levels ground knowledge for this study, including parameter definitions and
data sharing among dynamic groups of users, which supports one-to- foundational information. Our scheme’s system model and incentive
many access control on shared data in many practical application mechanism are described in Section 4, which includes the scheme’s
scenarios. definition. Section 5 details the specific construction methods of the
• The CP-ABE scheme empowers data owners to establish their own related algorithms for our scheme. Section 6 introduces the correctness
access policies, effectively granting encryption-based access control verification of re-encryption and the validation of transaction aggrega­
to their data with granularity refined to the attribute level. tion. The algorithmic security of our scheme is examined in Section 7,
• Blockchain (Nakamoto, 2009) as a decentralized Peer-to-Peer (P2P) along with the evaluation and analysis of simulated experiments con­
distributed ledger and computing paradigm, can provides key ducted. Section 8 offers a conclusion to our paper and indicates future
auditing and traceability for CP-ABE by establishing secure data directions for research advancement.
access control mechanism within untrusted environments. Mean­
while, the technology features in blockchain can provide attribute 2. Related work
policies management, privacy and accountability enhancement for
CP-ABE. CP-ABE as a novel encryption technology, has seen considerable
attention from researchers since its inception. Many have focused on
However, the majority of current blockchain-based CP-ABE access designing and improving CP-ABE algorithms to enhance their flexibility
control schemes rely on centralized authorization models (Bramm and and security while extending their applicability to diverse fields and
Mark, 2018; Yan et al., 2020), resulting in risks of single point of failure, scenarios. For instance, Guo et al. (Guo et al., 2023) improved the effi­
low computational efficiency, challenges in key leakage, as well as ciency of information collection in vehicular environments, proposed an
system scalability. These problems also present potential challenges that application-oriented data sharing scheme for Vehicular Ad-hoc Net­
researchers need to address in order to achieve trade-off between works (VANETs) using enhanced CP-ABE, and validated its efficiency
decentralization, security, and scalability that occurs within a and security through performance analysis and simulations. Liang et al.
blockchain-based system. (Liang et al., 2009) proposed the first scheme by combining proxy re-
To address the above issues, we utilize blockchain nodes that acts as encryption with CP-ABE, tested selectively secure without random or­
a trusted proxy entity to generate and distribute key fragments, ensuring acles under chosen-plaintext attacks, ensuring main key security and
the traceability of the update of keys through an immutable ledger in preventing key collusion between agents and users. Doshi et al. (Doshi,
blockchain. Meanwhile, we introduce the zero-knowledge proof tech­ 2022) utilized proxy re-encryption to propose a constant-length CP-ABE
nology to enhance system scalability, which is to bundle transactions scheme resilient to collusion attacks, establishing security using the
off-chain and post a short summary of the transactions on blockchain. Decisional Bilinear Diffie-Hellman (DBDH) hardness assumption. Ede­
The integrity proof of transactions aggregation is much shorter and more macu et al. (Edemacu et al., 2020) based their scheme on the Ordered
efficient to verify than original transactions. In addition, in order to Binary Decision Diagrams (OBDD) access structure with enhanced
build a reliable blockchain system in trustless network, we analyze expressiveness, introducing instant attribute/user revocation, effi­
economic incentives and punishments by applying probability model ciency, and in collaborative e-health systems secure data sharing is
among different type nodes of blockchain-based CP-ABE. needed for preventing collusion attacks. From recent studies by these
researchers, existing schemes often struggle to provide access control in
1.1. Our contributions untrusted environments due to trusted authorization entities, leading to
issues such as single points of failure and low computational efficiency
Building on our previous work (Chen et al., 2023; Zhang et al., 2021), in large-scale settings. Additionally, the lack of uniqueness in user
we further introduce zero-knowledge proof paradigm to enhance and attribute private keys, generated and distributed by trusted authoriza­
scale the distributed KMS-based CP-ABE scheme in decentralized tion entities, raises concerns about potential key misuse. Furthermore,
blockchain system. The main contributions of this work can be outlined verification of correctness during proxy re-encryption computations is
as follows: lacking, and challenges persist concerning the tampering of ciphertext
(1) To mitigate the dependence on a single authority responsible for during transmission and the authenticity of the ciphertext source.
issuing master secret keys (MSK) to all users, we present a threshold In recent years, the application of blockchain-based CP-ABE systems
proxy re-encryption scheme. This scheme leverages a key encapsulation have become widespread in a variety of areas. For instance, to address
mechanism (KEM) to integrate the key management system into the security and privacy challenges in industrial Internet of Things (IoT),
blockchain infrastructure. Furthermore, we incorporate the Fiat-Shamir Banerjee et al. (Banerjee et al., 2021) developed a CP-ABE scheme based
Heuristic protocol into our non-interactive zero-knowledge (NIZK) proof on blockchains. Their scheme achieved policy hiding, constant-sized
system to verify the correctness of re-encryptions. keys and ciphertexts, outperforming alternatives in security and
(2) To boost the scalability of the blockchain network and minimize computational efficiency through simulation-based comparisons.
on-chain gas consumption, we designed a transaction aggregation Sammy et al. (Sammy and Vigila, 2022) presented a distributed CP-ABE
mechanism based on zk-SNARKs. The operator nodes collect trans­ scheme that allows secure cloud-based patient health record sharing.
actions generated during the system’s operation, performs batch They achieved data user attribute revocation using Rivest-Shamir-
execution and aggregation, and generates corresponding zk_proofs to Adleman (RSA) key pairs and demonstrated security under the d-Deci­
verify the validity of account state transitions. sional Diffie-Hellman (d-DDH) assumption. Gao et al. (Gao et al., 2020)
(3) To ensure effective, fair operation, and to motivate participation employed homomorphic encryption to hide user attributes. Blockchain
in the decentralized blockchain system, we explore the benefits of eco­ acted as an entity for identity proof and verification, granting the main
nomic incentives and slashing model. This economic incentive mecha­ key. Despite enabling distributed key computation and attribute pres­
nism can enhance node activity and overall network health. Moreover, ervation, their main key storage remained centralized, introducing se­
we briefly present that the decisional q-parallel Bilinear Diffie-Hellman curity concerns. Manzoor et al. (Manzoor et al., 2018) and Badsha et al.
Exponent (BDHE) assumption is generically secure in our CP-ABE (Badsha et al., 2020) proposed blockchain-based proxy re-encryption
scheme. methods. They sought to enhance data sharing security in different

2
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

Table 1
Summary of Characteristics and Limitations of CP-ABE Schemes.
Architecture Research Scheme Research Description Research Limitations

CP-ABE Guo et al. (Guo et al., A privacy-enhanced VANET data security sharing scheme is proposed. • Centralized storage and
2023) generation of keys.
Liang et al. (Liang et al., Extended the descriptions of conditions and identities based on proxy re-encryption • Centralized storage of keys.
2009) and attribute encryption. • Inability to verify the correctness
of re-encryption.
Doshi et al. (Doshi, 2022) Proposed a CP-ABE proxy re-encryption scheme with constant ciphertext length. • Existence of a centralized
authority.
• Inability to verify the correctness
of re-encryption.
Edemacu et al. (Edemacu Proposed an expressive, and collusion-resistant access control scheme with instant • Existence of a trusted authority.
et al., 2020) attribute/user revocation. • Centralized storage of keys.
Blockchain-based Sammy et al. (Sammy and Implemented user attribute revocation and utilized elliptic curve cryptography to • Existence of a centralized
CP-ABE Vigila, 2022) reduce the complexity. authority.
Gao et al. (Gao et al., Proposed a hidden policy scheme to ensure the privacy of policies. • Key management issues were not
2020) considered.
• Low participation of nodes.
• High on-chain gas consumption.
Manzoor et al. (Manzoor Implemented information sharing through smart contracts, ensuring data visibility • Existence of a centralized
et al., 2018) only to authorized individuals through proxy re-encryption. authority.
Badsha et al. (Badsha Proposed a blockchain network security information sharing scheme with privacy • Centralized generation of keys.
et al., 2020) protection features. • Key management issues were not
considered.
• Inability to verify the correctness
of re-encryption.
• Low participation of nodes.
• High on-chain gas consumption.
Zhang et al. (Zhang and Proposed a scheme supporting keyword retrieval and increased node participation • Key management issues were not
Sun, 2020) through the design of incentive mechanisms. considered.
• Inability to verify the correctness
of re-encryption.
• High on-chain gas consumption.
Zhai et al. (Zhai et al., Proposed a data sharing scheme and designed a distributed key generation method • Inability to verify the correctness
2023) compatible with blockchain. of re-encryption.
• Low participation of nodes.
• High on-chain gas consumption.

ways, with Badsha using conditional proxy re-encryption based on 3.2. Fiat-Shamir Heuristic (Beimel, 2021; Dima, 2019; Dima, 2019)
Attribute-Based Encryption (ABE) and Manzoor using certificate-based
proxy re-encryption. According to Zhang et al. (Zhang and Sun, 2020), The Fiat-Shamir heuristic can be applied to any Sigma protocol to
a data sharing algorithm that utilizes a combination of attribute-based obtain NIZKPs.
and blockchain re-encryption for keyword retrieval was developed.
P (g, x, h = gx ) : V (g, h = gx , π = (c, u, z)) :
However, it does not take key management into consideration. Simi­ ?
larly, Zhai et al. (Zhai et al., 2023) have also proposed a similar scheme Select randomly r ∈ Z; Check c=H(g, h, u);
that securely shares critical on-chain information through proxy re-
?
Compute u = gr ; Check gz =u⋅hc
encryption of attribute-linked data. They also utilize a distributed key Compute c = H(g, h, u);
generation method specifically designed for blockchain networks to Compute z = c⋅x + r;
mitigate centralized key management and leakage risks. While both Output π = (u, c, z)
schemes address key management concerns, the algorithm efficiency
can still be improved. 3.3. Proxy Re-Encryption (Nunez, 2018)
Table 1 summarizes the characteristics and limitations of current CP-
ABE schemes. From Table 1, it is evident that while the previously Proxy re-encryption (PRE) serves as an instrument in facilitating
mentioned solutions have addressed specific challenges within their decentralized key management functions, given its ability to distribute
respective domains, they often exhibit limitations in their seamless the re-encryption procedure across various proxy services. Such a
integration with blockchain, leading to a range of issues. These chal­ method eliminates dependency on a sole service, thereby bolstering the
lenges encompass diverse areas such as computational efficiency, gas overall system’s security and dependability. Let g1 and Q be the gener­
consumption and inadequate correctness validation mechanisms in ators of group G. Let Hℓ2 : G2 →Zq ,Hℓ3 : G3 →Zq and Hℓ4 : G3 × Zq →Zq
certain proxy re-encryption methodologies. Furthermore, the absence of are hash functions. γ : G→{0, 1}η is a key derivation function, where η is
robust incentive and penalty mechanisms undermines the cooperative generated based on the security parameter φ. Sample a ∈ Zq uniformly
behavior of participants within blockchain networks, potentially at random, compute ga and output the keypair (pk, sk) = (ga , a).
undermining the overall security and operation of such networks.
4. Scheme overview
3. Preliminaries
4.1. System description
3.1. Notation definition
This scheme leverages a KEM to integrate the key management
Table 2 displays the primary notations utilized in the proposed system into the blockchain infrastructure. The proxy re-encryption node
scheme. encrypts the MSK with a generated symmetric key and is responsible for
securely storing and managing key fragments. Data users can only derive

3
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

Table 2 executing the Trading smart contract. OPN then performs batch execu­
Notations. tion and aggregation of the collected transactions by executing the
Notation Description Processing smart contract. After the transaction execution, the local
Merkle tree root is transformed from the prev_state_root to the next_­
k System security parameter
θ User identity identifier state_root, and a request for state update is made. Simultaneously, OPN
ρ(i) Row-specific attribute generates corresponding zk_proofs based on zk-SNARKs to verify the
s Secret shared key validity of account state transitions.
λ Secret shared key share (5) Inter Planetary File System (IPFS): The IPFS primarily functions
v Random vector for encryption algorithm selection
Mi Row i of access matrix M with dimensions l × n
to provide distributed storage services for all participants. It stores
x Attribute received ciphertext data CT and CTMSK, and then sends the data storage
N Number of shards address to the blockchain. This allows participants to download
t Threshold value ciphertext data based on the storage address published on the
S User attribute set
blockchain.
SK User attribute private key
U System attribute set (6) Blockchain (BC): On-chain nodes participate in staking within the
PK System public key staking pool to elect suitable nodes for roles such as the proxy re-
MSK System master secret key encryption node, operator node, consensus validation nodes, and
m Plaintext of shared data computational nodes. On the blockchain, reward settlements and pen­
CT Ciphertext of shared data
CTMSK Ciphertext of MSK
alties are carried out based on the contributions of each node to enhance
network security. While the blockchain records public system parame­
ters and conducts consensus validation operations, it not only achieves
the symmetric key by obtaining at least threshold t key fragments. traceability and auditability of the scheme’s transaction delivery but
Subsequently, they use this symmetric key to decrypt the ciphertext also realizes multi-party secure management and distribution of the CP-
CTMSK and obtain MSK. With MSK, users generate the user attribute ABE master secret key (see Fig. 1).
private key SK matching the access policy. Finally, they decrypt the Our scheme mainly consists of seven phases: Initialization Phase,
ciphertext CT to obtain the plaintext data m. Additionally, to enhance Encapsulation Phase, Encryption Phase, Re-encryption Phase, Key
the scalability of the blockchain and reduce gas consumption, we have Generation Phase, Identity Verification Phase, and Decryption Phase. A
developed a transaction aggregation system based on zk-SNARKs. This detailed description of each phase is provided below:
system relies on the operator node to collect and execute the trans­ (1) Initialization Phase
actions generated during the model running process. More details can be DO.Setup(1k , U)→(PK, MSK). During the system initialization phase,
found in Section 6.2. To further enhance network efficiency and secu­ the data owner Alice inputs security parameter k and attribute set U. The
rity, we design an economic incentive mechanism to encourage more setup algorithm is executed by data owner, resulting in the output of the
nodes to participate in management and verification processes. For more system public key PK and the system master secret key MSK.
details, refer to Section 4.3. (2) Encapsulation Phase
The proposed scheme has six main participants, with the following DO.KEMMSK(pkA , MSK, εK )→(CT MSK , capsule). The data owner
functionalities: Alice, initially takes the public key pkA and the system master secret key
(1) Data Owner (DO): When the data owner wishes to share data m MSK as inputs to the encapsulation algorithm KEMMSK. Subsequently,
with a data user, they need to create an access policy based on the Linear she computes a symmetric key εK and uses it to encrypt the MSK.
Secret Sharing Schemes (LSSS) matrix to grant access to the data user. Simultaneously, she encapsulates the symmetric key εK and a capsule
The data owner then executes the system initialization algorithm Setup that facilitates the re-derivation of the symmetric key εK . Finally, the
to generate global parameters, performs the encryption algorithm encapsulation algorithm outputs (CTMSK, capsule).
Encrypt to generate the ciphertext CT, executes the re-encryption key (3) Encryption Phase
generation algorithm ReKeyGen to generate the re-encryption key kFrag, DO.Encrypt(PK, A = (M, ρ), m, δ)→CT. The data owner Alice inputs
and runs the KEMMSK algorithm to encrypt and encapsulate the master the system public key PK, plaintext data m, access policy A based on
secret key MSK, resulting in CTMSK and capsule. These operations are LSSS, and identity random key δ. She then runs the encryption algorithm
followed by storing the ciphertext CT and CTMSK on IPFS and sending the Encrypt, resulting in the output of the ciphertext CT. Subsequently, Alice
kFrag and capsule to the proxy re-encryption node on the blockchain. sends CT to be stored on IPFS.
(2) Data User (DU): When a data user intends to access the shared (4) Re-Encryption Phase
data, they must first request the master secret key MSK from the proxy DO.ReKeyGen(skA , pkB , N, t)→KF. The data owner Alice inputs the
re-encryption node on the blockchain. Upon receiving the capsule secret key skA and the public key of the intended delegate pkB , along
fragment cFrag from the node, the data user decapsulates cFrag and then with the parameters N for the overall number of fragments and t for the
decrypts the ciphertext CTMSK to obtain the MSK. Subsequently, by threshold, then the re-encryption key generation algorithm ReKeyGen
executing the key generation algorithm KeyGen, key computation al­ computes N fragments of the re-encryption key, each of them named
gorithm CptKey, and key recovery algorithm KeyRes, the data user kFrag, which are then sent to PRENs (see Fig. 2).
generates the user attribute private key SK that satisfies the access PREN.ReEncrypt(capsule, kFrag)→cFrag. The proxy re-encryption
policy. With the generated SK, the user can then decrypt the ciphertext node takes as input the re-encryption key fragment kFrag and the
CT to obtain the plaintext data m. capsule. The re-encryption algorithm, ReEncrypt, initially checks the
(3) Proxy Re-Encryption Node (PREN): The blockchain node is validity of the capsule. Subsequently, the re-encryption algorithm reen­
initially elected as the proxy re-encryption node through a staking capsulates to the capsule to obtain a cFrag, and finally, outputs the cFrag.
election. Subsequently, it executes the re-encryption algorithm ReEn­ PREN.CreateNIZKP(capsule, kFrag, cFrag)→π. To achieve verifiable
crypt to reencapsulate the capsule and obtain a cFrag. To achieve veri­ re-encryption, the proxy re-encryption node, upon outputting the re-
fiable re-encryption, the node generates a NIZK proof π concerning encrypted ciphertext CTMSK, capsule, and capsule fragment cFrag, cre­
cFrag. This process is aimed at achieving multi-party secure manage­ ates a NIZK proof π to demonstrate the correctness of cFrag (see Fig. 3).
ment and distribution of the system master secret key. (5) Key Generation Phase
(4) Operator Node (OPN): The blockchain node is initially elected as BC.Verif yNIZKP(capsule, cFrag, π)→Result. The proxy re-encryption
the operator node through a staking election. Subsequently, the OPN node sends the capsule, capsule fragment cFrag, and the generated NIZK
collects transactions generated during the system’s operation by

4
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

Fig. 1. System Model.

Fig. 2. Alice’s Domain.

Fig. 3. PREN ’s Domain.

proof π to the blockchain. Consensus validation nodes trigger the veri­ the secret key pkA and skB , along with a set of t re-encrypted ciphertexts
{ }t
fication contract to verify the correctness of the cFrag. The verification cFragi , CTMSK i=1 . The re-decryption algorithm ReDecrypt initially
contract outputs the verification result. decapsulates the cFragi to produce the symmetric key εK . It then decrypts
DU.ReDecrypt(pkA , skB , {cFragi , CT MSK }ti=1 )→MSK. After the cor­ the ciphertext CTMSK with the key εK , resulting in MSK if the decryption
rectness verification of cFrag is successfully passed, data user Bob inputs is correct or ⊥ otherwise.

5
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

DU.KeyGen(PK, MSK, e, S)→{K, L, {hx }, E}. The data user Bob inputs (3) Challenge plaintext. ①The adversary submits two messages m0
relevant parameters to calculate some elements of the SK triplet. Use and m1 of equal length to the challenger, and the challenger choose the
asymmetric encryption pair (e, d) to protect the random t, i.e. Ei = value of c ∈ {0, 1} at random and encrypt mc . ②The challenger utilizes
Encryption(ei , t), send Ei and the hash value hxi corresponding to the the policy (M* , ρ* ) and generates a corresponding ciphertext CT* . ③The
attribute of DU to the computational node, then it computes the key by resulting CT* is given to the adversary.
executing BC.CptKey(hx , E, S)→K ’x and sends it to DU. After obtaining (4) Repeat Step (2). The adversary sends the attribute set Sn+1 , Sn+2 ,
K′xi , Bob decrypts it using DU.KeyRes(K ’x , d, S)→SK to obtain correct key ..., Sn+m to the challenger and requests the corresponding private key,
Kxi . Bob then combines the computed Kxi values from different nodes to whose attributes do not meet the access structure (M* , ρ* ).
form the attribute key set Kx = {Kx1 ,Kx2 ,...,Kxn }. Bob combines K, L, and (5) Guess. The adversary outputs its guess c′ ∈ {0, 1} and win the
Kx previously computed to form the complete private key SK quadruple game if c = c′.
SK = (S, K, L, Kx ) (see Fig. 4).
Definition 1. If the polynomial-time adversary wins the above secu­
(6) Identity Verification Phase
rity model game with a negligible advantage ε = |Pr[c = c′]| − 1/2, then
The data user sends the identity identifier θ, obtained during user
the proposed scheme is secure.
registration, to the data owner. The data owner, based on the specified
access policy A, verifies the identity. If the identity information provided
by the data user satisfies the access policy, the data user is considered an 4.3. Incentive mechanism
honest node. The data owner then issues an identity key δ to that data
user. Establishing a rational system of incentives and penalties within a
(7) Decryption Phase trustless environment contributes to achieving fairness among partici­
DU.Decrypt(SK, CT, δ)→m. Data user Bob, based on the publicly pating nodes and enables verifiable computations. This approach
available ciphertext storage address on the blockchain, downloads the effectively enhances blockchain consensus security, promotes node ac­
ciphertext CT from IPFS. He then uses the identity key δ and private key tivity, and mitigates free-rider risks. Hence, we introduce a rewards
SK to decrypt the ciphertext CT by executing the decryption algorithm schedule based on the Proof of Stake (PoS) consensus mechanism, where
Decrypt, resulting in the plaintext data m. certain rewards are “mined.” Anyone can become a miner, but they must
first pledge a certain amount of collateral through a smart contract-
based staking pool and lock them, specifying a locking duration. The
4.2. Algorithm security model level of trust allocated to each node is directly proportional to the
amount of collateral they stake. By staking collateral and distributing
The algorithm in this paper is the in-distinguish ability against se­ trust among participating nodes, a higher collateral pledge implies
lective access structure and chosen plaintext attacks (IND-SAS-CPA) greater trust allocation. Consequently, the miner with higher collateral
game, with specific interactive processes as follows: pledge gains more opportunities.
(1) Initialization. The challenger initializes the system Setup(1k , U) The reward procured by participating node P is directly proportional
to generate MSK and the challenger sends PK to the adversary. the ad­ to its contribution WP — the greater the contribution WP, the higher the
versary, in turn, sends a new challenge access policy (M* , ρ* ) to the system reward RP. With the integrity of participant nodes expressed as
challenger. probability Pr(P), and the integrity of malicious behavior expressed as
(2) Queries. The adversary summits the attribute set for a KeyGen probability Prv(P), the probability of the participant node being
query. When the attribute set is insufficient for access policy, the chal­ dishonest equals Prvc(P) = Prv(P)• (1 − Pr(P)). If the collateral staked by
lenger generates the corresponding secret key for attribute set and re­ the participant node is SP, the system reward obtained by the participant
turn it to the adversary. node under honesty is: R(Pr(P)) = RP• (1 − Prvc(P)) − SP •Prvc(P) − WP

Fig. 4. Bob’s Domain.

6
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

•Pr(P). When Pr(P) = 1, i.e., the participant node is honest, the consists of two parts: CP-ABE and PRE. The overall workflow of the
maximum reward is: R(1) = RP − WP. When Pr(P) < 0.5, RP• (1 − scheme is illustrated in Fig. 5. In Section 5.1, the CP-ABE part begins by
Prvc(P)) − SP •Prvc(P) < 0, then R(Pr(P)) < 0. Furthermore, the system introducing the user identity identifier θ and identity key δ, achieving
randomly sends fabricated data to participating node to assess its user identity verification through the access policy A. Subsequently, we
honesty in behavior. If the involved node leaks the forged data provided introduce CptKey and KeyRes, and asymmetric encryption pair (e, d) is
by the system, this action not only exposes the node’s dishonest behavior used to protect the SK. In Section 5.2, the PRE part focuses on the
but also safeguards users’ interests since the fabricated data is not actual implementation of multi-party secure management and distribution of
user data. Under this mechanism, any node in the network suspecting the MSK of CP-ABE, utilizing threshold proxy re-encryption protocols
dishonest behavior by a particular participant can initiate this operation and KEM. Additionally, correctness verification of re-encryption com­
by sending fabricated data to assess the node’s behavior. Upon the putations is achieved through NIZK proofs.
system’s confirmation of the suspected node’s dishonest conduct, the
reporting node can receive an additional reward consisting of the staked 5.1. Construction of Ciphertext-Policy Attribute-Based Encryption
by the cheating node.
It is noteworthy that executing a 51 % attack in PoS requires holding (1)Setup(1k , U)→(PK, MSK). DO inputs the security parameter k, and
51 % of the total stake in the chain. Acquiring stake can only be achieved a tuple (p, g, G0 , G1 , e) is generated based on k. For each attribute x ∈ U,
through purchasing from existing users and is not possible through hx represents the hash value of attribute x. A LSSS access matrix M is
external investment or production. As the total on-chain stake increases, input, and based on M, a random exponent s is distributed from Zp . DO
the cost of launching a 51 % attack against PoS becomes significantly constructs and publishes the PK, constructs the MSK, and transmits MSK
higher than conducting a 51 % attack on Proof of Work (PoW) for one to the PRENs for re-encryption. The output consists of a key pair:
hour. The dynamic nature of fluctuations in the number of honest val­
idators and network latency makes it improbable for attackers to sustain g ∈ G0 , α, β ∈ Zp
precise control over 50 % of the total staking. The substantial costs { e : G0 × G0 →G1 } (1)
PK = g, e(g, g)α , gβ , h1 , h2 , ..., h|u|
associated with such attacks, coupled with the low probability of suc­
MSK = (gα )
cess, act as robust deterrents for rational attackers. Additionally, PoS
incorporates a slashing mechanism, which entails executing a hard fork (2)KeyGen(PK, MSK, e, S)→{K, L, {hx }, E }. DU, based on the PK and
initiated by an honest minority, leading to a substantial devaluation of MSK, obtains a collection of hash values {hx }, selects t ∈ Zp , and calcu­
the attacker’s staked assets. Consequently, attackers incur significant lates K and L. Additionally, DU selects u ∈ Zp and chooses an integer e
costs to their staked assets while launching an attack, thereby reducing that is less than u and coprime with u. DU encrypts t using e, resulting in
the likelihood of 51 % attack occurring. E = t⋅e.

5. Algorithm construction (K, L) = (gα gβt , gt ) (2)

(3)CptKey(hx , E, S)→K′x . The DU transmits E, the hash values hx, and

The specific algorithmic construction of the proposed scheme
the user attribute set S to the computation node for the calculation of K′x .

Fig. 5. The Overall Transaction Workflow of Our Scheme.

7
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

K′x = hEx (3) outputs the capsule. The specific process is described in Algorithm 2:
Algorithm 2: KEMMSK
(4)KeyRes(K’x , d, S)→SK. After obtaining e’s modular multiplicative
1: Input:MSK, εK
inverse element d with respect to p, DU acquires K′x and, through d, 2: Output: CTMSK, capsule
decrypts to obtain the attribute key SK. DU performs the following key 3: Select random τ, u ∈ Zq ;
generation process: 4: Compute: P = g1τ , D = g1u ;
5: Compute: ξ = u + τ⋅Hℓ2 (P, D);
d 6: Compute: εK = γK ((pkA )τ+u );
Kx = (K′x ) = htx
(4) 7: Compute: capsule = (P, D, ξ);
SK = (S, K, L, Kx ) 8: Compute: CTMSK = εK ⋅MSK;
9: return CTMSK , capsule;
(5)Encrypt(PK, A = (M, ρ), m, δ )→CT. The PK and (M, ρ) used for
LSSS are used as the access policy A. The random key δ is used as the
input for encryption of the plaintext message m, resulting in the (3)ReEncrypt(capsule, kFrag)→cFrag. The PREN first checks the validity
ciphertext CT. Here, M is an l × n access matrix, and ρ is a mapping from of the capsule and outputs ⊥ if the check fails. Then it utilizes the
the set of row indices {1, 2, ..., l} of matrix M to attributes. The specific received valid capsule and re-encryption key fragments kFrag to com­
encryption process is as follows: putes P1 = Prk and D1 = Drk , and outputs the capsule fragment cFrag =
① DO randomly selects integers s, y2 , ..., yn from ZN , forming a col­ (P1 , D1 , id, g1ϖA ). The specific process is described in Algorithm 3:
umn vector → v = ( s, y2 , ..., yn ) in an n-dimensional vector space ZnN for Algorithm 3: ReEncrypt

secret key s splitting, and calculates the original ciphertext components 1: Input: capsule, cFrag
2: Output: cFrag
C = m⋅e(g, g)αsδ and C′ = gsδ .
3: Check the validity of the capsule = (P, D, ξ);
② For the i-th row of matrix M, DO randomly selects an integer ri ∈
4: Check: g1ξ =? D⋅PHℓ2 (P,D) ;
Z and calculates C = gβλi δ h− ri and D = gri separately. Here, λ = →
N i ρ(i) i ν⋅ i 5: if the capsule is valid then
→ 6: Compute: P1 = Prk ;
M i (i = 1, 2, ..., l) represents the i-th share obtained by splitting s, repre­ 7: Compute: D1 = Drk ;
senting a secret shared key share. Let Ψ = {(Ci ,Di )}. Then, the ciphertext 8: Output: cFrag = (P1 , D1 , id, gϖ A
1 );
CT = (C, C′, Ψ) generated by DO is given. 9: end if
10: return cFrag;
(6)Decrypt(SK, CT, δ)→m. Given a DU input attribute set S, the cor­
responding secret key SK = (S, K, L, Kx )(x ∈ S), ciphertext CT associated
{ }t
with the access structure, and a random key δ. Assuming that the S (4)ReDecrypt(pkA , skB , cFragi , CTMSK i=1 )→MSK. The DU Bob inputs
satisfies the access structure, according to the definition mentioned { }t
{ pkA ,skB , and a set of t re-encrypted ciphertexts cFragi , CTMSK i=1 . First,
above, let I = { i : ρ(i) ∈ S }⊂{1, 2, ..., l}. Let ωi ∈ Zp |i ∈ I} be such that
∑ he aggregates each cFragi and calculates the symmetric key εK . Before
i∈I ωi λi = s, if s is a valid share corresponding to M. (ωi is a set of re­ that, he performs correctness verification of the re-encryption results. If
covery coefficients, which is not unique). The plaintext message m can the verification passes, he proceeds with the above steps. Then, he uses
be recovered from the encrypted CT = (C, C′, Ψ) using the decryption the εK to decrypt the MSK from CTMSK. The specific process is described
computation formula: in Algorithm 4:
∏ ∏ ( ( βλ δ − r t ) r α βt )ωi Algorithm 4: ReDecrypt
C⋅ i∈I (e(Ci , L)e(Di , Kρ(i) ) )ωi C⋅ i∈I e g i hρ(i)i , g e(g i , g g ) { }t
m= = 1: Input:pkA , skB , cFragi , CTMSK i=1
e(C′, K) e(gsδ , gα gβt )
2: Output: MSK
∏ ∑
C⋅ i∈I e(g, g)tδβλi ωi C⋅e(g, g)tδβ i∈I λi ωi C⋅e(g, g)tδβs C 3: Let Z1 = {zx,i }ti=1 for zx,i = Hℓ5 (idi , Hℓ6 (pkA , pkB , pkbA )).
= = = = ∏ zx,j
αsδ
e(g, g) e(g, g) βstδ αsδ
e(g, g) e(g, g) βstδ
e(g, g)αsδ e(g, g)βstδ e(g, g)αsδ 4: For all zx,i ∈ Z1 , compute: χ i,Z1 = tj=1,j∕ =i ;
zx,j − zx,i
(5) ∏
5: Compute: P = i=1 P1,i
′ t ( ) χi,Z1 ′ ∏ t
D = i=1 D1,i
( )χi,Z
1 ;
b⋅ϖ A
6: Compute: εK = γ((P′, D′)Hℓ3 (g1
ϖA
,pkB ,g1 )
);
5.2. Construction of Proxy Re-Encryption 7: return MSK;

(1)ReKeyGen(skA , pkB , N, t)→KF. The DO Alice inputs skA and pkB

(5)CreateNIZKP(capsule, kFrag, cFrag)→π. Let the re-encryption key
along with the parameters N for the overall number of fragments and t
fragment be kFrag = (id,rk,g1ϖA ,Q1 ,S1 ,S2 ), and the input capsule = (P, D,
for the threshold, then generates N re-encryption key fragments kFrag,
ξ) and capsule fragment cFrag = (P1 ,D1 ,id,g1ϖA ). A correctness proof π for
which are then sent to PRENs. The specific process is outlined in Algo­
cFrag is generated as Algorithm 5:
rithm 1:
Algorithm 5: CreateNIZKP
Algorithm 1: ReKeyGen
1: Input:capsule, kFrag, cFrag
1: Input:skA , pkB , N, t
2: Output: π
2: Output: KF
3: Select a random r ∈ Zq ;
3: Select a random ϖA , y, id ∈ Zq ;
4: Compute: P2 = Pr D2 = Dr Q2 = Qr ;
4: for (j = 1; j < N;){
5: Compute: C = Hℓ (P, P1 , P2 , D, D1 , D2 , Q, Q1 , Q2 );
5: Compute: μx = Hℓ5 (id, Hℓ6 (pkA , pkB , pkaB ));
6: Compute: ρ = r + C⋅rk;
6: Compute: rk = f(μx );
7: Compute: π = (P2 , D2 , Q1 , Q2 , S1 , S2 , ρ);
7: Compute: Q1 = Qrk ; 8: return π;
y
8: Compute: S1 = Hℓ4 (g1 , id, pkA , pkB , Q1 , gϖ A
1 );
9: Compute: S2 = y − a⋅S1 ;
10: Define: kFrag = (id, rk, gϖ
1 , Q1 , S1 , S2 );
A
(6)VerifyNIZKP(capsule, cFrag, π)→Result. Let the input capsule be the
11: Compute: KF = KF ∪ {kFrag}; tuple (P,D,ξ). For each cFrag = (P1 , D1 , id, g1ϖA ) and proof π = (P2 ,D2 ,Q1 ,
12: return KF;
Q2 , S1 , S2 , ρ), blockchain executing Algorithm 6.
Algorithm 6: VerifyNIZKP

1: Input:capsule, cFrag, π
2: Output: Result
(2)KEMMSK(pkA , MSK, εK )→(CTMSK , capsule). The DO Alice encrypts the
(continued on next page)
MSK to be ciphertext CTMSK using the generated symmetric key εK and

8
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

(continued ) Encryption Nodes (PREN), Computation Nodes (CPN), Consensus Vali­

Algorithm 6: VerifyNIZKP dation Nodes (CVN), and Adjudicator Nodes (ADN). PRENs and CPNs
3: Check the signature (S1 , S2 );
earn rewards through computational tasks, while CVNs earn tokens by
4: if the signature is correct then performing validation tasks. The ADN is responsible for rewarding and
5: Compute: C = Hℓ (P, P1 , P2 , D, D1 , D2 , Q, Q1 , Q2 ); penalizing all nodes. It also takes on the role of arbitration in cases of
6: Check: Pρ =? P2 ⋅PC1 Dρ =? D2 ⋅DC1 Qρ =? Q2 ⋅QC1 ; computational errors or validation failures. If a node is found to be
7: end if dishonest, the ADN enforces penalties by revoking the rewards obtained
8: return Result;
through computation or validation tasks and seizing the collateral that
the node staked.
6. Verification of Re-Encryption and Transaction Aggregation
based on NIZKP 6.2. Validation of Transaction Aggregation

6.1. Correctness Verification of Re-Encryption To maximize the efficiency of the proposed model, we incorporate a
transaction aggregation system based on zk-SNARKs (D1ONYS1US.,
As incorrect re-encryption operations can be detected by data users, 2023) to validate the transactions. To handle the account status infor­
they have the option to apply for confirmation of PREN’s violation to the mation of all users off-chain, we employ a Merkle tree and store the root
Adjudicator Node, which following these steps, the workflow illus­ of this tree in the on-chain smart contract. The root value signifies the
trating these steps is presented in Fig. 6: present state of all accounts within the system. As a user initiates a
transaction, the current state is modified, and the transaction is initially
(1) Upon receiving kFrag sent by the DO, PREN first checks its val­ dispatched to the transaction pool. The transaction pool stores pending
idity to ensure that erroneous re-encryption operations are not transactions and prioritizes them based on factors such as fees, priority,
executed due to errors from the DO. and timestamp. This ensures that the transactions are processed in a
(2) Next, the DU requests the master secret key MSK from PREN, to specific order, improving system efficiency and performance. The
which PREN responds with a cFrag and a NIZKP π. Operator node is in charge of receiving sorted transactions from the
(3) Subsequently, the DU verifies the validity of the cFrag using the transaction pool and carrying out the processes illustrated in Fig. 7:
NIZKP π. Additionally, the DU confirms that the cFrag was (1) Check Balance: Checks the available funds of the sender’s ac­
generated using their capsule by verifying that it aligns with the count to ensure sufficient balance for transaction fees.
correct public key. (2) Check Nonce: Verifies the correct ordering of the sender’s Nonce
(4) If any of the verifications fail, the DU supplies both the cFrag and to prevent duplicate transactions and ensure proper sequencing.
NIZKP π to the Adjudicator Node. The Adjudicator Node, through (3) Check Signature: Validates the transaction’s signature to
the execution of the Adjudicator contract, examines the claim confirm the sender’s authenticity and avoid manipulation of data.
made by the DU by checking the validity of the NIZKP π. (4) Build Batch: Constructs a batch by requesting transactions from
(5) If the Adjudicator contract confirms the invalidity of the cFrag, the transaction pool.
the delivery of the faulty cFrag to the DU is officially deemed a (5) Get Proof: To demonstrate that all transactions in a batch are
protocol violation. As a consequence, a penalty is calculated, and valid without revealing any underlying information, the proof creation
the owner of the offending PREN has their stake immediately process translates program specifications into circuits through Circom,
reduced by the penalty amount. enabling the compiler to produce the Rank-1 Constraint System (R1CS)
that describes a circuit within Snarkjs. Subsequently, a zk-SNARKs proof
In this process, miners are composed of four types of nodes: Proxy Re- system based on the Permutation Argument of Linear Knowledge

Fig. 6. Correctness Verification of Re-Encryption.

9
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

Fig. 7. Transaction Aggregation.

(PLONK) is established. Utilizing a proving key and the witness, a suc­ identity information of the transaction parties cannot be separated from their
cinct zk_proof is generated. identity information because the attributes of the transaction parties are Hash
(6) Forge Batch: To verify the transaction batch, the generated (u), which protects the privacy of the users by virtue of hash mapping’s
proof, along with the associated pre_state_root hash and post_state_root collision-resistant property. Secondly, according to the improved algorithm’s
hash, is deployed to the blockchain within a Solidity smart contract, IND-SAS-CPA, even if ciphertext CT is harvested in polynomial time, no
ensuring that the verifier can validate the transaction for on-chain effective information about the plaintext can be obtained from it. As a result,
confirmation. this scheme ensures the confidentiality of transactions. In conclusion, this
(7) Synchronize State: The blockchain verifier, employing the ver­ data sharing strategy provides robust privacy safeguards for both identifica­
ification_key and a file containing the public signals of the circuit, vali­ tion and transactional data.
dates the submitted zk_proof. If accepted, the new state is synchronized
Theorem 3. (If the key computation algorithm CptKey ensures that the
to the blockchain, and both the previous state root and the next state
values of e and u are coprime, and e is less than u, then the key generation
root of the Merkle tree are stored on-chain.
algorithm KeyGen exhibits correctness and security, thereby demonstrating
We aggregate a large number of transactions generated during the
resistance against node collusion attacks.) Proof: If e and u are coprime,
operation of the model, including key computation, publication, and
then gcd(e, u) = 1, so by Bezout’s formula, we know that:
verification, off-chain. Complex computations and proof generation are
∃d, b : e⋅d +b⋅u = 1⇒e⋅d = 1 in Zp , d is the inverse of e. When other nodes in
performed off-chain, while on-chain, only the verification and storage of
essential transaction data are carried out. This approach eliminates the the blockchain network calculate the key, they obtain K′i after encrypting it
need for individual verification of each transaction in the on-chain with e, and return the key to the DU, who decrypts it using the key d to obtain
contract, as the validity of the submitted zk_proof is checked instead. the correct Ki . Since the delegated computing node can only obtain the public
Moreover, the size and verification time of the generated proofs do not e during computation and the randomly generated u is kept secret by the DU,
increase with the number of transactions, making it possible to effec­ it cannot compute d in polynomial time, i.e., it cannot compute the correct SK.
tively reduce on-chain gas consumption while ensuring privacy pro­ Furthermore, within each attribute-related key fragment, hashing is applied to
tection. Furthermore, through the storage of a subset of the necessary both the attribute and user identity. This approach serves to prevent collusion
transaction data, data availability is guaranteed, enabling the recon­ attacks among multiple users, as sharing attributes or using the SK for
struction of the overall account state using the essential transaction data decryption is rendered infeasible. In summary, the key generation algorithm
retained within the blockchain. This eliminates the security risks asso­ maintains correctness and security, effectively resisting node collusion
ciated with data availability and allows this solution to achieve decen­ attacks.
tralization and security. Additionally, through efficient coordination
between on-chain and off-chain computations, this approach can 7.2. Comparative study
significantly increase the transaction per second (TPS) of the blockchain
and achieve scalability. We conducted a comprehensive comparison between the features of
our proposed solution and those of existing relevant schemes, covering
7. Implementation and analysis eight aspects. Our comparison includes CP-ABE schemes introduced in
Waters (Waters, 2011), Liang (Liang et al., 2009), Doshi (Doshi, 2022),
7.1. Algorithm security analysis Zhang (Zhang and Sun, 2020) and Zhai (Zhai et al., 2023), and the
summarized outcomes are presented in Table 3. Our selection of refer­
Theorem 1. (If the decisional q-parallel BDHE assumption holds, then no ences is deliberate, encompassing historically significant contributions
polynomial-time adversary can break the proposed scheme by selecting a such as Waters (Waters, 2011) and Liang (Liang et al., 2009), which
challenge access structure (M* , ρ* ).) Proof: We briefly show that the established foundational concepts. In Waters (Waters, 2011), the au­
decisional q-parallel BDHE assumption is generically secure using the generic thors provided a formal security proof for the standard model of CP-ABE,
proof template provided by Boneh, Boyen, and Goh (Boneh et al., 2005). introducing a CP-ABE scheme built on LSSS. Additionally, Liang (Liang
Our proof follows a similar path as presented by Waters (Waters, 2011). Due et al., 2009) proposed the first CP-ABE-PRE scheme, fusing CP-ABE with
to space constraints and the similarity to (Waters, 2011), we omit the proof proxy re-encryption techniques. Doshi (Doshi, 2022); Zhang (Zhang and
details in the main text and provide a proof process in the appendix. Sun, 2020) and Zhai (Zhai et al., 2023) were chosen due to their the­
matic relevance to our proposed scheme.
Theorem 2. (If the data attribute-based encryption scheme satisfies IND- Liang (Liang et al., 2009) and Doshi (Doshi, 2022) both employed
SAS-CPA, the scheme has privacy protection.) Proof: Firstly, the AND gates as the access structure in their CP-ABE schemes. The

10
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

Table 3
Feature Comparison of CP-ABE Schemes.
Schemes Feature1 Feature2 Feature3 Feature4 Feature5 Feature6 Feature7 Feature8

Waters et al. (Waters, 2011) LSSS DPBDHE £ £ £ £ £ £

Liang et al. (Liang et al., 2009) AND gate ADBDH √ £ £ £ £ £
Doshi et al. (Doshi, 2022) AND gate DBDH √ £ £ £ £ £
Zhang et al. (Zhang and Sun, 2020) LSSS q-parallel BDHE √ £ £ √ £ √
Zhai et al. (Zhai et al., 2023) LSSS q-parallel BDHE √ £ √ £ £ √
Our Scheme LSSS q-parallel BDHE √ √ √ √ √ √

Note: √ means that the scheme satisfies this feature, while × means that it does not. Feature1: Type of access structure; Feature2: Type of hardness problem;
Feature3: Whether re-encryption is supported; Feature4: Whether verifiable re-encryption is supported; Feature5: Whether the design supports distributed KMS;
Feature6: Whether the incentive mechanism is designed; Feature7: Whether the transaction aggregation is designed; Feature8: Whether it is based on blockchain.

distinction lies in Liang (Liang et al., 2009) adopting the ADBDH 2023) schemes. However, in the re-encryption stage, our scheme ach­
(Augment Decisional Bilinear Diffie-Hellman) hardness problem, while ieves lower computational overhead by increasing the number of
Doshi (Doshi, 2022) opted for the DBDH hardness problem. Zhang multiplication operations while reducing the number of bilinear pairing
(Zhang and Sun, 2020), Zhai (Zhai et al., 2023), and our proposed so­ operations. Since the resources and time required for a single bilinear
lution all utilize LSSS as the access structure and employ the q-parallel pairing operation are generally higher than those for a single exponen­
BDHE hardness problem. It is noteworthy that, except for Waters (Wa­ tiation operation, our scheme incurs less computational overhead during
ters, 2011), all schemes incorporate re-encryption algorithms. However, the re-encryption stage compared to the other three schemes. In sum­
only our proposed solution implements verifiable re-encryption based mary, compared to other relevant schemes, our proposed scheme pro­
on zero-knowledge proofs. Zhang (Zhang and Sun, 2020) introduced a vides a better balance between computational and storage overhead, as
blockchain-based ciphertext cloud storage sharing scheme using well as security and functional features.
attribute-based proxy re-encryption. In this scheme, nodes within the
system receive corresponding credit coins as a reward for successfully
recording a transaction. However, the incentive mechanism designed in 7.3. Experimental analysis
this scheme does not effectively enhance the correctness of re-
encryption, it merely increased node participation. In contrast, the To thoroughly assess how well the solution in this paper works in
incentive mechanism in our proposed solution aims to improve the practice, a series of simulation and testing experiments were conducted.
correctness of node-executed re-encryption tasks through economic in­ Firstly, tests were performed on the time costs of operations such as key
centives. Both Zhai (Zhai et al., 2023) and our solution addressed the generation algorithm, and multi-node collaborative computing of pri­
centralized key management issue. However, the former only estab­ vate key algorithm. Secondly, performance tests on blockchain key
lished a distributed key generation method for SK, while our solution source queries were conducted. Finally, the gas consumption of on-chain
further achieved multi-party secure management and distribution of the signature verification and re-encryption result correctness verification
MSK. Additionally, our solution is the only one addressing the in­ related smart contracts were tested, and the reduction effect of on-chain
efficiency and poor scalability of blockchain networks. To reduce on- gas consumption through transaction aggregation system was also
chain gas consumption, we designed a transaction aggregation mecha­ validated.
nism and provided corresponding zero-knowledge proofs to validate the On a machine running the Ubuntu 22.10 operating system, all ex­
effectiveness of account state transitions. periments in this paper were carried out. The specific hardware
Table 4 provides a comparison of the computational and storage cost configuration includes an AMD Ryzen 7 6800H CPU with a clock fre­
of Doshi (Doshi, 2022), Zhang (Zhang and Sun, 2020), Zhai (Zhai et al., quency of 3.20 GHz and 16.0 GB RAM. Circom (Iden3., 2023) and
2023), and the proposed scheme. As indicated in Table 4, our scheme Snarkjs (Iden3., 2023) for creating zk-snark circuits, and Ganache
and Zhang’s scheme (Zhang and Sun, 2020) share the same length for (Truffle, 2023) for building a blockchain virtual network were all used in
PK, both being (n + 3)|G0|+|G1|, growing with the increase in the the article. In our current setting, distinct elliptic curves are employed
number of attributes. The length of SK for our scheme is (2n + 3)|G0|, for the PRE and CP-ABE parts. Specifically, the elliptic curve utilized in
slightly higher in growth rate compared to the other three schemes. On the PRE part aligns with the one commonly employed in blockchain
the other hand, the CT length for our scheme is (2n + 1)|G0|, with a systems. We have opted for the secp256k1 elliptic curve, widely used in
growth rate slightly lower than the other three schemes. This indicates blockchain, with a security parameter size of 256 bits. Meanwhile, for
that our proposed scheme exhibits stronger key attack resistance but the CP-ABE part, we employ a Type A prime order elliptic curve from the
comes with slightly higher storage costs. Additionally, the computa­ PBC library (Ben, 2013), with rBits = 160 and qBits = 512. For each
tional overhead generated during the encryption, re-encryption, and experiment, 50 independent trials were conducted under identical
decryption processes for our scheme is (2n + 1)TE + TP, 7TE, and (2n + experimental conditions, and the experiment’s outcome was determined
6)TE + 4TP, respectively. Comparing with the other three schemes, our to be the average value.
scheme demonstrates similar computational overhead during encryp­ In this paper, our proposed solution leverages blockchain technology
tion and decryption stages as Doshi (Doshi, 2022) and Zhai (Zhai et al., to achieve complete decentralization, allowing all network nodes to
participate in key computations. As depicted in Fig. 10(a), we observe

Table 4
Computation and Storage Comparison of CP-ABE Schemes.
Schemes |PK| |MSK| |SK| |CT| Encryption Re-Encryption Decryption

Doshi et al. (Doshi, 2022) (n + 3)|G0| |ZP| |G0| (2n + 3)|G0| (2n + 3)TE + TP (3n + 6)TE + 4TP (2n + 6)TE + 6TP
Zhang et al. (Zhang and Sun, 2020) (n + 3)|G0|+|G1| |G0|+|ZP| (2n + 2)|G0| (2n + 2)|G0|+|G1| (3n + 2)TE + 2TP (3n + 1)TE + 5TP (3n + 2)TE + 3TP
Zhai et al. (Zhai et al., 2023) |G0| 3|ZP| (n + 2)|G0| (2n + 2)|G0| (2n + 4)TE + TP (2n + 2)TE + 5TP (2n + 4)TE + 5TP
Our Scheme (n + 3)|G0|+|G1| |G0| (2n + 3)|G0| (2n + 1)|G0| (2n + 1)TE + TP 7TE (2n + 6)TE + 4TP

Note: n represents the number of attributes, |G0| and |G1| denote the bit lengths of elements in groups G0 and G1, respectively. TE represents the time taken for a single
exponentiation operation, while TP represents the time taken for a single bilinear pairing operation.

11
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

Fig. 10. Simulation Results.

12
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

that as the number of attributes increases, the solution converges to­ Table 5
wards the Waters scheme (Waters, 2011) when only one computing Costs of the Transaction Aggregation.
node is involved. However, when three computing nodes participate, Chunks Per Deposit/ Withdraw/ Transfer/ Total/
our solution exhibits approximately one-third of the computation time Block Gas Gas Gas Gas
compared to the Waters scheme (Waters, 2011). This showcases the 30 238,526 237,201 54,301 530,028
efficiency of our key generation algorithm while meeting the re­ 80 130,984 128,813 18,167 277,964
quirements of secure data sharing. 180 100,385 98,106 7,921 206,412
Fig. 10(b) and (c) illustrate that when the number of nodes is one, the 400 88,210 85,853 3,825 177,888

decryption computation time doubles as the number of attributes in­

creases, indicating a linear growth pattern. Nevertheless, encryption and authenticity of transaction aggregation.
key generation times remain unaffected by the number of policy attri­ However, some potential performance challenges when introducing
butes. Hence, in practical scenarios with a large accessed policy attribute zero-knowledge proofs in blockchain system environments. Addressing
set, modifying the access control policy cannot save key generation time. these challenges requires optimized algorithms, lightweight proof sys­
However, our proposed approach, which involves multi-node collabo­ tems, and efficient implementation strategies to make zero-knowledge
rative computing of private keys, offers distinct advantages. proofs feasible in such environments. On the other hand, blockchain-
Fig. 10(d)–(f) depict experimental tests involving encryption, re- based CP-ABE scheme involves incentive mechanism and algorithmic
encryption, and decryption processes, with the number of user attri­ security proof. Firstly, we analyze the economic rewards and penalties
butes as the independent variable. We observe that the time costs for among different types of nodes through a probabilistic model. Both the
these processes increase linearly with the number of user attributes. PRE nodes and Operator nodes can obtain the incentive compatibility
Notably, our solution, compared to Zhang’s scheme (Zhang and Sun, according to their contribution originates from their correct behaviors.
2020) and Zhai’s scheme (Zhai et al., 2023), reduces computational Meanwhile, they have liveness only if each party is incented to earn the
costs and minimizes time overhead by replacing some bilinear pairings quantity of reward with probability. Secondly, in our CP-ABE con­
with multiplication operations. struction aims to be IND-SAS-CPA secure under a q-Decisional Parallel
To fully simulate the entire process of data sharing, we used Ganache Bilinear Diffie-Hellman Exponent assumption on prime order bilinear
to set up 4 nodes and simulated the data flow operation using default groups, it means showing that if there were an adversary capable of
consensus algorithms and Solidity smart contracts. In addition, this breaking the IND-SAS-CPA property of the scheme, it would imply that
paper performed concurrent stress testing on the model using Python this adversary could solve the q-DPBDHE problem. In addition, in pro­
multi-threading. As depicted in Fig. 10(g). The test objects were posed CP-ABE system adhering to a static security assumption ensures
randomly selected from one node in Ganache, and the test content was protection against predefined attack scenarios, which follows from the
to query the source of the keys in the system under concurrent condi­ use generic proof template of Boneh, Boyen, and Goh framework that
tions of 20, 50, and 100. Under 100 concurrent conditions, the average this is generically secure (Boneh et al., 2005).
response time of a single node remained within 31 s. Each node in the
system can have a fast response speed and can provide high- 8. Conclusion and future work
performance query services.
In addition, when executing the signature verification contract on a In this paper, we discussed the challenges in the current blockchain-
single node, the transaction cost amounts to roughly 1,089,287 gas, driven attribute-based encryption schemes, such as centralized manage
accompanied by an execution expense of approximately 964,982 gas. of keys by authorized institutions, inefficient key management and
Likewise, the contract for confirming the correctness of re-encrypted distribution, lack of key correctness verification, and issues related to
data results in a transaction cost of around 3,600,134 gas, with an poor scalability and high on-chain costs in blockchain networks. Sub­
execution overhead of approximately 3,299,517 gas. As depicted in sequently, we proposed a novel blockchain-based CP-ABE scheme using
Fig. 10(h), it’s evident that gas consumption escalates with the distributed KMS and zero-knowledge proof. Firstly, we conducted a
increasing number of participating validation nodes. detailed blockchain security analysis and algorithm security analysis for
Finally, we also evaluated gas consumption using transaction ag­ the proposed scheme. The comprehensive security analysis demon­
gregation, as detailed in Table 5. With an increase in the number of strates that the proposed scheme offers high security and privacy pro­
chunks within each block (30, 80, 180, and 400), a consistent reduction tection. Secondly, we conducted in-depth comparisons between the
in overall gas consumption became evident. Implementing transaction proposed scheme and other relevant existing schemes in terms of func­
aggregation led to a noteworthy decrease of over 61 % in our overall gas tional features, computational cost, and storage cost. Finally, we also
consumption. Furthermore, when accounting for the concurrent reduc­ performed a series of simulation experiments to test the practical per­
tion in the system’s operational demands due to this method, its impact formance of the proposed scheme. In conclusion, compared to other
became even more pronounced. schemes, our proposed solution provides a better balance between
computational and storage overhead, as well as security and functional
7.4. Discussion features. It offers effective solutions and methods to address the existing
issues in current blockchain-driven attribute-based encryption schemes.
In this section, we discuss privacy-oriented distributed key man­ For future research endeavors, this paper proposes deploying the
agement system for blockchain-based CP-ABE and its zero-knowledge decentralized CP-ABE scheme as a tool for data sharing and exchange in
proof scheme. Recent studies indicate that central authority will be specific scenarios such as government resource information sharing, IoT
unlikely to provide satisfactory services to key management in diversi­ data sharing, or cross-border trade document data sharing. Furthermore,
fied scenarios because we utilize too much trust in key generation center there is a need to enhance the blockchain ciphertext access control al­
(KGC), especially in a blockchain system. These centers do not meet the gorithm. This could involve the introduction of features such as attribute
requirements of user privacy protection, decentralization and scalability revocation mechanisms, OBDD access structures, etc., to improve the
of blockchain technology. In our proposed scheme, we leverage a applicability and robustness of the solution in specific scenarios.
threshold proxy re-encryption protocol and integrate the key- Availability of data and materials
encapsulation mechanism into the blockchain system. Furthermore, in The data used to support the findings of this study are available from
order to reduce on-chain transaction costs and enhance scalability of the corresponding author upon request.
decentralized system, we incorporate the Fiat-Shamir Heuristic protocol
and zk-SNARKs to verify the correctness of re-encryption and

13
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

CRediT authorship contribution statement this article. Their professional reviews and constructive suggestions
have significantly contributed to the enhancement of the paper’s
Zhixin Ren: Conceptualization, Funding acquisition, Wri­ quality.
ting–original draft, Writing – review & editing, Visualization, Investi­
gation, Methodology. Enhua Yan: Writing – review & editing, Funding
Validation, Formal analysis, Funding acquisition. Taowei Chen:
Conceptualization, Funding acquisition, Methodology. Yimin Yu: This work is supported by the National Natural Science Foundation
Conceptualization, Funding acquisition. of China (grant numbers 61961042, 71964037),Yunnan Key Laboratory
of Blockchain Application Technology (grant numbers
Declaration of competing interest 202105AG070005, YNB202108), Yunnan International Joint Research
and Development Center for Cross-border Trade and Financial Block­
The authors declare that they have no known competing financial chain (grant number 202203AP140010),Kunming International
interests or personal relationships that could have appeared to influence (Foreign-oriented) Science and Technology Research and Development
the work reported in this paper. Center for Blockchain Technology in South Asia and Southeast Asia
(grant number GHJD-2022006), Research on Key Technologies of Cross-
Acknowledgement Border Trade Blockchain for RCEP (grant number 202202AD080011),
and Scientific Research Foundation of Yunnan Education Department
We sincerely express our gratitude to the editors and reviewers of (grant numbers 2023Y0657, 2023Y0675, 2024Y540).

Appendix

Theorem 1. (If the decisional q-parallel BDHE assumption holds, then no polynomial-time adversary can break the proposed scheme by selecting a challenge
access structure (M* , ρ* ).) Proof: Under the selected structure model in this paper, if there exists a polynomial-time adversary A with advantage ε to break the
proposed scheme, then there must be another adversary β with advantage ε/2 to solve the decisional q-parallel BDHE assumption.
The challenger sets up as follows: select two cyclic groups G0 and G1 , as well as a bilinear mapping e : G0 × G0 →G1 , randomly choose β, s, b1 , ..., bq ∈ Zp ,
publicly set:
→ q q+2
y = {g,gs , gβ , ⋯, gβ , gβ , ⋯, gβ ,
2q

s⋅bj β/bj
∀1⩽j⩽q g , g , ⋯, g βq /bj
,gβq+2 /bj 2q
, ⋯, gβ /bj (6)
β⋅s⋅bk /bj βq ⋅s⋅bk /bj
=j g
∀1⩽j,k⩽q,k∕ , ⋯, g }
q+1
y ,Z), and Z = e(g, g)β s ; if θ = 1, set Z ∈ G1 and T = (→
Randomly select θ ∈ {0,1}. If θ = 0, set T = (→ y ,Z). Upon receiving a tuple T, adversary β engages
in the following game with adversary A to determine whether T ∈ Pq− parallelBDHE or T ∈ R q− parallel BDHE . Before the game begins, β obtains the access structure (M* ,
ρ* ) that A intends to challenge, where M* has n* columns.
(1) Initialization. β selects a random number α′ ∈ Zp , and computes e(g, g)α = e(gβ ,gβ )⋅e(g, g)α . Adversary β randomly selects α = α′ +βq+1 and arranges
q ′

the group elements h1 , h2 , …, h|u| as follows. For each x(1⩽x⩽|U|), choose a corresponding random number zx , and let X denote the set of indices i that satisfy
ρ* (i) = x. Compute hx as follows:
∏ βM* /b β2 M* /b n* *
hx = gzx g i,1 i ⋅g i,2 i ⋯gβ Mi,n* /bi (7)
i∈X

Due to the randomness of gzx , hx is randomly distributed. If X ∕ = ∅, there is hx = gzx .

(2) Phase 1. A performs key extraction queries on the set S that do not satisfy the matrix M* . β chooses a random number r ∈ Zp , obtains the vector → ω=
*
(ω1 , ω2 , ⋯, ωn* ) ∈ Znp such that ω1 = − 1, and for i that satisfies ρ* (i) ∈ S, →
ω ⋅M*i = 0. According to the definition of LSSS, such a vector must exist, otherwise
the vector (1,0, 0, …, 0) lies in the span of S. Find:
n*
∏
(8)
q+1− i
L = gr (gβ )ωi
i=1

n* +1 βq+1
Define t = r + ω1 βq + ω2 βq− 1 + ωn* βq− , such that gt = L. With this definition of t, construct K such that gβt contains term g− , and eliminate the
unknown term gβ . β computes K as follows:
n*
∏
(9)
′ q+2− i
K = gα gβr (gβ )ωi
i=2

Compute Kx for ∀x ∈ S. If x ∈ S and there is no i such that ρ* (i) = x, let Kx = Lzx . If x ∈ S and there is multiple i such that ρ* (i) = x, because of M*i ⋅→
ω = 0,
q+1 /b
we can eliminate gβ i in Kx . Based on this property, let X denote the set of indices i that satisfy ρ* (i) = x. β constructs Kx as follows:
⎛ ⎞Mi,j*

∏∏ n* ⎜
⎜ (βj /b )r ∏ ⎟
⎟
(10)
q+1+j− k /b
Kx = Lzx ⎜g i
⎜ (gβ i
)ωk ⎟
⎟
i∈X j=1 ⎝ k=1,⋯,n* k∕
=j
⎠

(3) Challenge. The adversary sends two equally long challenge messages m0 and m1 . β randomly chooses β ∈ {0, 1} and computes the ciphertext com­
ponents of mβ : C = mβ ⋅Z⋅e(g, g)αs and C′ = gs . β selects a random number y′2 , ⋯, y′n* and partitions s using the following vector:

14
Z. Ren et al. Journal of King Saud University - Computer and Information Sciences 36 (2024) 101969

*
→
v = (s, sβ + y′2 , sβ2 + y′3 , ⋯, sβn− 1 + y′n* ) ∈ Zpn (11)

Random number r′1 , r′2 , ⋯, r′l is chosen. For i = 1,2,...,n* , define Ri as the set of all k satisfying ρ* (i) = ρ* (k) for k ∕
= i, i.e., the set of row indices with the same
attributes as the i-th row. The ciphertext (Ci , Di ) in the challenge is generated as follows:
( * ) ( )
r′
∏n
* ′ ( )− zρ* (i) ∏∏ βj ⋅s⋅(bi /b ) M*˙
Ci = hρi* (i) (gβ )Mi,j yj gbi ⋅s ⋅ (g k
) k,j
j=2 k∈Ri j=1 (12)
′
Di = gri g− sbi

(4) Stage 2. Similar to stage 1.

(5) Guess. A outputs a guess c′ for c. If c′ = c, then β outputs θ = 0, indicating that T ∈ P q− parallel BDHE and the adversary’s advantage is Pr[c = c′|θ = 0] =
1
2 = 0, then T ∈ R q− parallel BDHE and the adversary’s advantage is Pr[c = c′|θ = 0] = 12. The adversary’s advantage in attacking the assumed q-parallel
+ ε. If θ ∕
BDHE is:
1 1 1 ε
Pr[c = c′|θ = 0] + Pr[c = c′|θ = 1] − = (13)
2 2 2 2
Therefore, the advantage of any polynomial-time adversary in winning the IND-SAS-CPA game can be neglected.

References NSTIC., 2018. National Scientific Data Resource Development Report. Scientific and
Technology Documentation Press. 34.
Nunez, D., 2018. Umbral: a threshold proxy re-encryption scheme. University of Malaga,
Badsha, S., Vakilinia, I., Sengupta, S., 2020. BloCyNfo-Share: Blockchain based
Spain, NuCypher Inc and NICS Lab, pp. 1–8.
Cybersecurity Information Sharing with Fine Grained Access Control. In: 2020 10th
Sahai, A., Waters, B., 2005. Fuzzy identity-based encryption. Annual International
Annual Computing and Communication Workshop and Conference. Las Vegas,
Conference on the Theory and Applications of Cryptographic Techniques – Advances
pp. 317–323.
in Cryptology Advances in Cryptology (EUROCRYPT’05). Aarhus, Denmark. 457–73.
Banerjee, S., Bera, B., Das, A.K., 2021. Private blockchain-envisioned multi-authority CP-
Sammy, F., Vigila, S., 2022. An Efficient Blockchain Based Data Access with Modified
ABE-based user access control scheme in IIoT. Comput. Commun. 169, 99–113.
Hierarchical Attribute Access Structure with CP-ABE Using ECC Scheme for Patient
Beimel, A., 2021. Secure schemes for secret sharing and key distribution. International
Health Record. Security Commun. Networks. 2022, 1–11.
Conference on Security and Cryptography. 130–150.
Sookhak, M., Yu, F.R., Khan, M.K., 2017. Attribute-based data access control in mobile
BEN L., 2013. PBC Library. https://crypto.stanford.edu/pbc/(accessed 14 June 2013).
cloud computing: Taxonomy and open issues. Futur. Gener. Comput. Syst. 72,
Bethencourt, J., Sahai, A., Waters, B., 2007. Ciphertext-policy attribute-based
273–287.
encryption. IEEE Symposium on Security and Privacy (S&P’07). Oakland, California.
Truffle S., 2023. Ganache. https://github.com/trufflesuite/ganache/ (accessed 26 April
321–34.
2023).
Boneh, D., Boyen, X., Goh, E.J, 2005. Hierarchical Identity Based Encryption with
Waters, B., 2011. Ciphertext-policy attribute-based encryption: An expressive, efficient,
Constant Size Ciphertext. Advances in Cryptology – EUROCRYPT 2005. Berlin,
and provably secure realization. International workshop on public key cryptography.
Heidelberg. 3494, 440–456.
Berlin, Heidelberg, pp. 53–70.
Bramm, G.G., Mark, S., 2018. BDABE-Blockchain-based Distributed Attribute based
Xie, D., 2023. Research on big data security and privacy protection. Electron. Commun.
Encryption. International Conference on Security and Cryptography. 99–110.
Comput. Sci. 5 (3), 158–160.
CBS., 2019. Hundreds of Millions of Facebook User Records Were Exposed on Amazon
Xu, J., Wang, Y., 2022. Privacy Protection and Data Sharing in the Digital Economy:
Cloud Server. https://www.cbsnews.com/news/millions-facebook-user-records-
Perspectives on Privacy Concerns and Personal Information Falsification. Statistical
exposed-amazon-cloud-server/ (accessed 4 April 2019).
Res. 39 (2), 48–63.
Chen, T.W., Ren, Z.X., Yu, Y.M., 2023. Lattices-Inspired CP-ABE from LWE Scheme for
Xue, Y., Xue, K., Gai, N., 2019. An attribute-based controlled collaborative access control
Data Access and Sharing Based on Blockchain. Appl. Sci. 13 (13), 7765.
scheme for public cloud storage. IEEE Trans. Inf. Forensics Secur. 14 (11),
D1ONYS1US., 2023. Zero-Knowledge Rollups. https://ethereum.org/en/developers/
2927–2942.
docs/scaling/zk-rollups/ (accessed 5 May 2023).
Yan, X.X., Yuan, X.H., Tang, Y.L., 2020. A blockchain-based and verifiable attribute-
Dima, K., 2019. Lecture 5: Proofs of Knowledge. Schnorr’s protocol, NIZK https://crypto.
based searchable encryption scheme. J. Commun. 41, 187–198.
stanford.edu/cs355/19sp/lec5.pdf (accessed 15 April 2019.
Zhai, S.P., Tong, T., Bai, X.F., 2023. Blockchain-Based Attribute Proxy Re-Encryption
Dima, K., 2019. Lecture 6: Sigma Protocols, Secret Sharing. https://crypto.stanford.edu/
Data Sharing Scheme. Comput. Eng. Appl. 59 (8), 270–279.
cs355/19sp/lec6.pdf (accessed 17 April 2019).
Zhang, X.D., Chen, T.W., Feng, Y., 2021. A Data Sharing Scheme Based on Blockchain
Doshi, N., 2022. An enhanced approach for CP-ABE with proxy re-encryption in IoT
System and Attribute-Based Encryption. ICBCT ’21: 2021 The 3rd International
paradigm. Jordanian J. Comput. Informat. Technol. 8 (3), 232–241.
Conference on Blockchain Technology. 3, 195-202.
Edemacu, K., Jang, B., Kim, J.W., 2020. Collaborative ehealth privacy and security: An
Zhang, X.H., Sun, L.L., 2020. Attribute proxy re-encryption for ciphertext storage sharing
access control with attribute revocation based on OBDD access structure. IEEE J.
scheme on blockchain. J. System Simulat.. 32 (6), 1009–1020.
Biomed. Health Inform. 24 (10), 2960–2972.
Gao, S., Piao, G., Zhu, J., 2020. Trustaccess: A trustworthy secure ciphertext-policy and
attribute hiding access control scheme based on blockchain. IEEE Trans. Veh. fx1Zhixin Ren is a master in the School of Information of Yunnan University of Finance
Technol. 69 (6), 5784–5798. and Economics. He was awarded the Scientific Research Fund of Yunnan Provincial Ed­
Goyal, V., Pandey, O., Sahai, A., Waters, B., 2006. Attribute-based encryption for fine ucation Department in 2023. His research interests include Computer Architecture,
grained access control of encrypted data. Proceedings of 13th ACM conference on Blockchain Technology and Security, Cryptography, Internet of Things etc.
Computer and Communications Security (CCS’06). Alexandria. 89–98.
Guo, N., Hu, J., Deng, X., 2023. A privacy preserving CP-ABE-based access control on
fx2Yan Enhua is a master in the School of Information of Yunnan University of Finance
data sharing in VANETs. Int. J. Web Grid Serv. 19 (2), 211–232.
and Economics. Her research interests include Computer Architecture, Blockchain Tech­
Iden3., 2023. Snarkjs. https://github.com/iden3/snarkjs (accessed 12 September 2023).
nology and Security, Digital Identity Authentication etc.
Iden3., 2023. Circom. https://github.com/iden3/circom (accessed 6 July 2023).
Li, Y., Wu, C., Guo, L., 2014. Wiki-health: A big data platform for health sensor data
management. Cloud Computing Appl. Quality Health Care Deliv. 59–77. fx3Taowei Chen received the M.S. degree in computer application from Kunming Uni­
Liang, X.H., Cao, Z.F., Lin, H., 2009. Attribute based proxy re-encryption with delegating versity of Science and Technology in 2003, and Ph.D. degree in computer application from
capabilities. Proceedings of the 4th international symposium on information, Southwest Jiaotong University in 2010. He is now a Professor in the School of Information
computer, and communications security. Sydney, Australia. 276-286. at Yunnan University of Finance and Economics. His research interests include Cryptog­
Lu, X., Cheng, X., 2019. A secure and lightweight data sharing scheme for internet of raphy, Blockchain Technology and Security, Internet-of-Things etc.
medical things. IEEE Access 8, 5022–5030.
Manzoor, A., Liyanage, M., Braeken, A., 2018. Blockchain based proxy re-encryption fx4Yimin Yu received Ph.D. degree in computer application from University of Electronic
scheme for secure iot data sharing. https://arxiv.org/abs/1811.02276 (accessed 6 Science and Technology of China in 2010. He is now a Professor, Dean in the School of
November 2018). Information at Yunnan University of Finance and Economics. His research interests include
Nakamoto, S., 2009. Bitcoin: a peer-to-peer electronic cash system. https://bitcoin.org/ Blockchain, Cross-border information sharing and security, E-government etc.
bitcoin.pdf (accessed 1 November 2018).

15