Contents Introduction
Huge volumes of data are generated everyday. This brings heavy storage burden to the data owner who has limited storage capacity. Fortunately, the emerging cloud service provides almost unlimited storage resources. The data owner can purchase storage service from a cloud server to store the data. However, the cloud server is usually maintained by the external companies that may be curious about the outsourced data. For example, they collect the private information including phone numbers for the merchants who want to sell their products by calling the data owner. This could bring troubles to the data owner. In fact, the outsourced data privacy becomes a main concern in the cloud storage.
For the sensitive nature of outsourced data, it is necessary for data owner to encrypt the data prior to storing these data in the cloud server. Of course, to achieve full privacy, we want the outsourced data to appear as a set of meaningless symbols. But once the outsourced data is encrypted by a conventional encryption scheme such as the AES encryption and ElGamal encryption, it seems infeasible to perform the computations on these outsourced data [1]. The data owner needs to first download the relevant ciphertext, and then use the secret key to recover the underlying data for computation. This will incur a cost of downloading outsourced data and a storage overhead for the data owner. These limitations contradict the intention of storing data in the cloud and motivate the study of how to efficiently compute on the outsourced encrypted data in a privacy-preserving manner.
To avoid downloading the encrypted data, the data user can delegate the computation to the cloud server. This paradigm is called as outsourced computation [2] that enables the computation to be performed in the cloud server's side. In order to prevent the malicious behavior of the cloud server, the data user needs a procedure to verify the correctness of the returned result. So this paradigm is also referred to as verifiable computation. It can theoretically be achieved by combining Zero Knowledge (ZK) [3] with Fully Homomorphic Encryption (FHE) [4] or Multi-Party Computation (MPC) [5]. However, the huge efficiency overhead makes the resulting schemes impractical in the real life.
In addition to reducing the local overhead (including the overhead of storage and computation) for data owner, another benefit of cloud service is that a data owner can easily share the data with other people who is called as data user. It is natural to consider a case where a group of data owners outsource their individual encrypted data under their personal keys to a cloud server, then the authorized data users can perform the computation on these outsourced data. A trivial way to solve this problem is to let the data owner provide the authorized group of data users with the secret keys. It requires that one secret key is just used to encrypt one data to achieve the access control over the data. To delegate the computation, the data user sends the keys and the desired function to the cloud server. However, this solution has two main drawbacks: 1) the data user needs to maintain lots of secret keys when the computation needs lots of data. 2) The data is totally exposed to the cloud server who can manipulate these data without any limitation.
To overcome the above restrictions, we seek to use the Functional Encryption (FE) [6], [7] as a building block to perform the outsourced computation on the outsourced encrypted data, which is usually mentioned as the motivation in many works regarding FE, such as [8], [9]. The solution extracted from these works is stated that a data owner who acts as the encryptor uses the public key
Recently, the works [10], [11], [12], [13], [14], [15] proposed the outsourced computation schemes by using as a building block the Attribute-Based Encryption (ABE) that is a specific form of FE. The resulting schemes can be used to compute the Boolean circuit, but are not as efficient as the constructions for a specific function in realistic case. To the end of high efficiency and practical significance, we would like to propose an outsourced computation scheme for inner product based on Inner Product Functional Encryption (IPFE) [16], [17], [18], [19], [20], [21], [22], [23], [24], [25], [26], [27], [28]. The inner product is a basic primitive in many practical applications. In particular, it is an elegant way to compute the weight mean in descriptive statistics [16]. Moreover, it can be used to compute the polynomials with the coefficient vector and the variable power vector [29]. Following the idea of above solution based on FE, we replace underlying primitive of FE with IPFE to get the initial solution for inner product computation, which is shown in Fig. 1a. However, this initial solution is not so satisfactory that may cause data leakage, wrong result, etc.
To explicitly show our work about the deployment of inner product functional encryption in cloud, we illustrate the initial solution and our solution. The differences between (a) and (b) reflect our works based on the initial solution that is mentioned in the existing works. For example, our solution achieves the verification and the result privacy against cloud server. Refer to Section 1.1.2 for more details.
1.1 Our Works
In order to construct a privacy-preserving outsourced inner product computation scheme in the data sharing setting, we need first to propose an IPFE scheme with some privacy guarantees.
1.1.1 The Weakness in IPFE
To clearly specify our works, we present the scheme in [19] as follows. Suppose integers 
\begin{equation*}
mpk=\left(N,g,\left(h_1,\ldots,h_n\right),X\right),\
msk=\left(\left(s_1,\ldots,s_n\right),Y\right).
\end{equation*}
\begin{equation*}
C_0=g^{r}\
mod \
N^2,\
\left\lbrace ct_i=\left(1+Nx_i\right)h_i^{r}\
mod \
N^{2} \right\rbrace _{i\in \lbrace 1,\ldots,n\rbrace }.
\end{equation*}
\begin{equation*}
\frac{1}{N}\cdot \left(\left(\prod _{i=1}^{n}ct_i^{y_i}\cdot C_0^{-sk_y}-1\right)\
mod \
N^2\right).
\end{equation*}
The Encrypted Vector Privacy. Thanks to the linearity of inner product, a malicious decryptor can recover the encrypted vector
\begin{equation*}
\left\lbrace \begin{array}{ll}\displaystyle\mathop \sum \limits _{i=1}^{n}x_{i}y_{i}^{(1)}&=\left\langle x,y^{(1)}\right\rangle \;mod \
N,\\
\cdots \\
\displaystyle\mathop \sum \limits _{i=1}^{n}x_{i}y_{i}^{(n)}&=\left\langle x,y^{(n)}\right\rangle mod\
N.\\
\end{array} \right. \tag{1}
\end{equation*}
1.1.2 The Issues Regarding the Deployment of IPFE
As is shown in Fig. 1a, in the initial solution that enables cloud server to compute the inner product, the data user needs to send the secret key
In IPFE, the key generation center is responsible for distributing the secret key to the legitimate ones. However, this key can be applied to all the ciphertexts with which it shares the same master secret key. The resulting outsourced computation scheme also has this property. However, this is undesirable in the data sharing setting, where the data owners usually want to selectively share the information about the outsourced data. For example, the data owner would like to share the information regarding medical data with the doctors, while the information regarding work data with the colleagues.
1.1.3 Our Contributions
We first identify the privacy issues regarding master secret key and encrypted vector in IPFE. To achieve stronger privacy guarantees than the original schemes, we introduce the notion of standard consistency constraint in IPFE and put forward the notion of master secret key hiding.
We construct an IPFE scheme that meets these requirements based on the scheme in [19]. In the resulting scheme, a ciphertext can be decrypted by only one specific secret key. The revealed information of the encrypted vector is just an inner product that is generated from the encrypted vector and the vector embedded in the secret key. In addition, the unbounded number of the secret key queries are allowed, and the master secret key is perfectly hidden in our scheme. The experimental results show that our scheme achieves these new properties at a reasonable price of time cost compared with the scheme in [19].
We propose a new outsourced computation model in the selectively data sharing setting. In this model, the data owner is free of the huge storage overhead, while the data user is free of both the huge storage overhead and the large computation cost. The shared item is the function on the outsourced data instead of the data itself in the conventional way, which is a new way to preserve the outsourced data privacy in the data sharing setting.
We propose an outsourced inner product computation scheme for the selectively data sharing setting based on our IPFE scheme. The verification time and the storage cost for data user are both independent of the vector size. The resulting scheme achieves the secret key privacy and the result privacy, which discourages the malicious cloud server from computing the inner product beyond the data user's request. The outsourced data privacy relies on the indistinguishable based (CCA) security of our IPFE scheme. In addition, the resulting scheme achieves the “double access control” over the outsourced data. This implies that only the authorized data user can compute the inner product on the outsourced data, and other functions are unallowed. It is the first attempt to preserve the outsourced data privacy in such a way for the data sharing setting.
As a side result, the proposed outsourced computation scheme can implement retrieval functionality. The data user can use it to locate and obtain the outsourced data stored in cloud server. More specifically, data owner encrypts the vector
1.2 Related Works
1.2.1 The Inner Product Functional Encryption
In 2015, Abdalla et al. put forward the novel idea of IPFE in [16] in the public-key setting. They proposed two IPFE schemes under the Decision Diffie-Hellman (DDH) assumption and the Learning-With-Errors (LWE) assumption. These schemes are secure against the Chosen Plaintext Attack (CPA) under selective model. In 2016, they also proposed the adaptively CPA-secure generic constructions and corresponding concrete instantiations in [18]. The subsequent works attempted to increase the security level and implement the practical property. Agrawal et al. proposed the adaptively secure schemes based on the LWE assumption, the DDH assumption and the Decision Composite Residuosity (DCR) assumption [19]. In 2017, Benhamouda et al. proposed the schemes secure against Chosen Ciphertext Attack (CCA) [21]. These works all focused on the works qualified for the inner product computation over
The existing works regarding IPFE usually consider the decryptor to be honest. Even though the privacy issue regarding the encrypted vector is mentioned in some existing works, such as [16], [17], they did not plan to solve this issue in the honest decryptor case. For the same reason, the privacy issue regarding the master secret key is not considered in the literature.
Another line of works, such as [23], [24], [25], [26] researched IPFE in the secret-key setting, where the encryptor and the decryptor share the same secret key. The standard consistency constraint in our IPFE scheme seems to be similar with the works in the secret-key setting. However, our work is still in the domain of public-key setting, where distinct encryptors can use the public key to generate ciphertexts for the designated decryptor.
1.2.2 The Outsourced Computation for Inner Product
The work [30] proposed the first practical outsourced computation scheme for high degree polynomial functions. In order to reduce the computation cost of verification, this work researched the primitive of Pseudorandom Functions (PRFs) with the closed form efficiency property. After this work, the work [31] proposed an outsourced computation scheme based on the outsourced database for matrix multiplication. In this work, a scheme supporting multi-function verifiable computation is also proposed, which allows a client to delegate the computation of multiple functions on the fixed outsourced data. The recent work [32] focused on the outsourced polynomial computation on the label-encrypted data under multi-server model. To perform the computation in a privacy-preserving manner, the outsourced data is stored in several cloud servers, and these cloud servers collectively accomplish the computation. Obviously, these schemes can be used to compute the inner product. However, these schemes need to compute the PRF value in the verification process, where the secret key is used. This implies that these schemes are not suitable for our setting where the data owner and the data user are distinct entities.
The works [33], [34] were specified on outsourced inner product computation. Similar to work [32], the work [33] used the technique of data splitting to protect the outsourced data privacy instead of the encryption, and store them in several different cloud servers. This scheme is more efficient than the cryptography-based ones. However, this scheme did not consider the verification. The work [34] proposed a scheme that is proper for inner product evaluation over outsourced data streams under multiple keys. This scheme can be used to compute the inner product on the data from different data owners. However, the storage overhead and the computation cost for data user are both dependent on the vector size.
The work [35] adopted the matrix digest technique to construct an outsourced computation scheme for batch matrix multiplication. This scheme achieves the public delegation that allows multiple data users to compute on the outsourced data. The input data privacy and the result privacy can be preserved, but it did not consider the procedures to preserve the outsourced data. In addition, the outsourced data are involved in the verification process, which contradicts the goal of relieving the local storage burden in the cloud storage.
In the research community, the outsourced computation has attracted more attention. For example, the works [36], [37] considered the applications of outsourced computation in the verifiable database. However, the outsourced computation in the selective data sharing setting is not fully considered. Since this model can largely reduce the local storage overhead and the computation cost, and implement the convenient information sharing in a privacy-preserving manner, it is interesting to investigate.
1.3 Organization
In the rest of this paper, the related preliminaries are introduced in Section 2. The system model and the security definitions are introduced in Section 3. Our constructions are proposed in Section 4. The related security analysis and necessary proofs are given in Section 5. The performance analysis is presented in Section 6. The conclusion is given in Section 7.
Preliminaries
In this section, we introduce the notations and some related cryptographic knowledge used in this paper.
2.2 The Related Cryptographic Knowledge
Definition 1 (DCR Assumption).
Given an integer
Definition 2 (Access Structure).
If
In our proposed scheme, the role of parties
Definition 3 (Bilinear Map).
Given two cyclic groups
Non-degeneracy:
Bilinearity:
Computability: we can find an efficient algorithm to compute
Definition 4 (Lagrange Coefficient).
We assume that
\begin{equation*}
\Delta _{i,U}(x)=\prod _{j\in U,j\ne i}\frac{x-j}{i-j}.
\end{equation*}
\begin{equation*}
f(x)=\sum _{i=1}^{\left|U\right|}f(i)\Delta _{i,U}(x).
\end{equation*}
Definition 5 (Adapted Inner Product Functional Encryption, Ada-IPFE).
This definition of Ada-IPFE is adapted from the work [38], which is shown in Fig. 2
![Fig. 2. -
This is the adaptation of IPFE. The left subfigure is derived from the definition in [19]. The right subfigure is derived from Definition 5. The processes marked by “$\dashrightarrow$⤏” in these two subfigures collectively reflect the standard consistency constraint of Definition 9.](/mediastore/IEEE/content/media/8858/9733106/9113463/qin2-3001345-large.gif)
$\mathbf {Setup}(1^{\lambda }, 1^n,X,Y):$ $\lambda$ $n$ $X$ $Y$ $msk$ $mpk$ $\mathbf {KeyGen}(y,msk):$ $y$ $msk$ $sk_y$ $pk_y$ $\mathbf {Encrypt}(x,mpk,pk_y):$ $x$ $mpk$ $pk_y$ $C_x$ $\mathbf {Decrypt}(sk_y,C_x):$ $sk_y$ $C_x$ $\left<x,y\right>$ $\perp$
Definition 6 (Correctness of Ada-IPFE).
An Ada-IPFE scheme is correct if for all
Definition 7 (Adaptive Security of Ada-IPFE).
This definition is adapted from [17]. To define the adaptive security of Ada-IPFE, we first give the model defined by the following game
$\mathbf {Setup.}$ $\mathcal {C}$ $\mathbf {Setup}(1^{\lambda }, 1^n,X,Y)$ $\left(msk,mpk\right)$ $mpk$ $\mathcal {A}$ $\mathbf {Query\ phase\ 1.}$ $\mathcal {A}$ $y^{(1)},\ldots,y^{(l_1)}$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf { KeyGen}(y^{(i)},msk)$ $sk_{y^{(1)}},\ldots,sk_{y^{(l_1)}}$ $pk_{y^{(1)}},\ldots,pk_{y^{(l_1)}}$ $\mathcal {A}$ $\mathbf {Challenge.}$ $\mathcal {A}$ $x^{(0)}$ $x^{(1)}$ $\left<x^{(0)},y^{(i)}\right>=\left<x^{(1)},y^{(i)}\right>$ $i\in \lbrace 1,\ldots,l_1\rbrace$ $\mathcal {C}$ $\mathcal {C}$ $\mu \ {\in }_{R}\ \lbrace 0,1\rbrace$ $\mathbf {Encrypt}(x^{(\mu)},mpk,pk_{y^{(i_0)}})$ $i_0\in \left\lbrace 1,\ldots,l_1\right\rbrace$ $C_{x^{(\mu)}}$ $\mathcal {A}$ $\mathbf {Query\ phase\ 2.}$ $C_{x^{(\mu)}}$ $\mathcal {A}$ $y^{(l_1+1)},\ldots,y^{(l_1+l_2)}$ $\left<x^{(0)},y^{(i)}\right>=\left<x^{(1)},y^{(i)}\right>$ $i\in \lbrace l_1+1,\ldots,l_1+l_2\rbrace$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf { KeyGen}(y^{(i)},msk)$ $sk_{y^{(l_1+1)}},\ldots,sk_{y^{(l_1+l_2)}}$ $\mathcal {A}$ $\mathbf {Guess.}$ $\mathcal {A}$ $\mu ^{\prime }$ $\mu ^{\prime }=\mu$
An Ada-IPFE scheme is adaptively secure if
In addition to the aforementioned basic requirements, we also consider the following new requirements in our Ada-IPFE scheme.
Definition 8 (Master Secret Key Hiding of Ada-IPFE).
To define the master secret key hiding of Ada-IPFE, we first give the model defined by the following game
$\mathbf {Setup.}$ $\mathcal {C}$ $\mathbf {Setup}(1^{\lambda }, 1^n,X,Y)$ $\left(msk,mpk\right)$ $mpk$ $\mathcal {A}$ $\mathbf {Query\ phase.}$ $\mathcal {A}$ $y^{(1)},\ldots,y^{(l)}$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf { KeyGen}(y^{(i)}, msk)$ $sk_{y^{(1)}},\ldots,sk_{y^{(l)}}$ $pk_{y^{(1)}},\ldots,pk_{y^{(l)}}$ $\mathcal {A}$ $\mathbf {Guess.}$ $\mathcal {A}$ $msk^{\ast }$ $\mathcal {A}$ $msk^{\ast }=msk$
An Ada-IPFE scheme is master secret key hiding if
Definition 9 (Standard Consistency Constraint of Ada-IPFE).
An Ada-IPFE scheme guarantees the standard consistency constraint if the ciphertext
Definition 10 (Encrypted Vector Hiding of Ada-IPFE).
An Ada-IPFE scheme is encrypted vector hiding if the underlying encrypted vector cannot be recovered.
Our System Model and Security Definitions
In this section, we describe the system model and the security definitions of outsourced inner product computation on encrypted database in the selective data sharing setting.
3.1 System Model
3.1.1 The Role of Participants
As is shown in Fig. 1b, the outsourced inner product computation with access control over the encrypted database (OIPFE-ACED) involves four participants, namely key generation center (KGC), data owner (DO), cloud server (CS) and data user (DU). The details are described as follows.
KGC generates the system parameters which include the master public key and the master secret key. In addition, it is also responsible for generating the secret key for DU.
DO uses master public key to encrypt the outsourced data, and then stores it in CS.
KGC generates the secret key for DU based on DU's attributes. Then, DU transforms secret key into the evaluation key for CS.
Upon receiving the evaluation key, CS uses it to compute the intermediate result for DU. Then, DU recovers the desired inner product and verifies it.
3.1.2 System Components
A scheme for outsourced inner product computation with access control over the outsourced encrypted database consists of following five polynomial time algorithms.
$\mathbf {Setup}(1^{\lambda }, 1^n, X, Y,U)$ $\lambda$ $n$ $X$ $Y$ $U$ $msk$ $mpk$ $\mathbf {Store}(x,mpk,d)$ $x$ $mpk$ $d$ $C_x$ $VK$ $C_x$ $\mathbf {Query}(y,msk,U^{\prime })$ $y$ $msk$ $U^{\prime }$ $sk_y$ $pk_1$ $pk_2$ $\pi$ $EK_y$ $\mathbf {Compute} (pk_1,pk_2,EK_y,C_x)$ $pk_1$ $pk_2$ $EK_y$ $C_x$ $P$ $I$ $\mathbf {Recover}(I,sk_y,VK,P)$ $I$ $sk_y$ $VK$ $P$ $\left<x,y\right>$ $\left|U\cap U^{\prime }\right|\geq d$
3.2 Security Definitions
Definition 11 (Correctness of OIPFE-ACED).
An OIPFE-ACED scheme is correct if for all
Definition 12 (Outsourced Vector Privacy of OIPFE-ACED).
To define the outsourced vector privacy of OIPFE-ACED, we first give the model defined by following game
$\mathbf {Setup.}$ $\mathcal {C}$ $\mathbf {Setup}(1^{\lambda }, 1^n,X,Y,U)$ $\left(msk,mpk\right)$ $mpk$ $\mathcal {A}$ $\mathbf {Query\ phase.}$ $\mathcal {C}$ $x$ $\mathbf {Store}(x,mpk,d)$ $C_x$ $VK$ $\mathcal {A}$ $\mathcal {A}$ $y^{(1)},\ldots,y^{(l)}$ $U^{\prime }$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf {Query}(y^{(i)},msk,U^{\prime })$ $(pk_1^{(i)},pk_2^{(i)},EK_{y^{(i)}})$ $\mathcal {A}$ $\mathbf {Challenge.}$ $\mathcal {A}$ $y_{0}$ $y_{1}$ $\mathcal {C}$ $\mathcal {C}$ $\mu \ {\in }_{R}\ \lbrace 0,1\rbrace$ $\mathbf {Query}(y_\mu,msk,U^{\prime })$ $(pk_1^{(\mu)},pk_2^{(\mu)},EK_{y_{\mu }})$ $\mathcal {A}$ $\mathcal {A}$ $\mu ^{\prime }$ $\mu ^{\prime }=\mu$
An OIPFE-ACED scheme can preserve the outsourced vector privacy if
Definition 13 (Unforgeability of OIPFE-ACED).
To define the unforgeability of OIPFE-ACED, we first give the model defined by the following game
$\mathbf {Setup.}$ $\mathcal {C}$ $\mathbf {Setup}(1^{\lambda }, 1^n,X,Y,U)$ $\left(msk,mpk\right)$ $mpk$ $\mathcal {A}$ $\mathbf {Query\ phase.}$ $\mathcal {C}$ $x$ $\mathbf {Store}(x,mpk,d)$ $VK$ $C_x$ $\mathcal {A}$ $\mathcal {A}$ $y^{(1)},\ldots,y^{(l)}$ $U^{\prime }$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf {Query}(y^{(i)},msk,U^{\prime })$ $i\in \lbrace 1,\ldots,l\rbrace$ $(pk_1^{(i)},pk_2^{(i)},EK_{y^{(i)}})$ $\mathcal {A}$ $\mathbf {Forgery.}$ $\mathcal {A}$ $y^{\ast }$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf {Query}(y^{\ast },msk,U^{\prime })$ $\left(pk_1^{\ast },pk_2^{\ast },EK_{y^{\ast }}\right)$ $\mathcal {A}$ $\mathcal {A}$ $I^{\ast }$ $P^{\ast }$ $\mathcal {C}$ $\mathbf {Output.}$ $\mathcal {A}$
An OIPFE-ACED scheme achieves the unforgeability if
Our Constructions
We have already known that the existing IPFE schemes are given under the assumptions of DDH, LWE, DCR, etc. The DDH-based schemes require that the inner product should be contained in a sufficiently small interval for decryption to be efficient. The LWE-based schemes suffer from poor efficiency due to the impractical parameters. And the DCR-based schemes need to use a large modulus. Clearly, these schemes have various practical restrictions. Considering the popularity of Paillier cryptographic system thanks to its better efficiency and practical deployment, we choose to present our constructions based on DCR-based IPFE scheme in [19].
We first propose our Ada-IPFE scheme. Then, we propose the privacy-preserving outsourced inner product computation scheme with the access control over the outsourced encrypted database based on this Ada-IPFE scheme. These schemes are proper for computing the inner product over
4.1 The Ada-IPFE With Mater Secret Kay Hiding and Encrypted Vector Hiding
Our Ada-IPFE scheme based on the Paillier cryptographic system is described as follows.
$\mathbf {Setup}(1^{\lambda }, 1^n, X, Y)$ $\lambda$ $n$ $X$ $Y$ $\tilde{p}=2p^{\prime }+1$ $\tilde{q}=2q^{\prime }+1$ $N=\tilde{p}\tilde{q}$ $p^{\prime }$ $q^{\prime }$ $>$ $2^{l(\lambda)}$ $l$ $g^{\prime }\ {\in }_{R}\ \mathbb {Z}_{N^2}^{\ast }$ $s=\left(s_1,\ldots, s_n\right)\ {\in }_{R} \mathcal {D}_{\mathbb {Z}^{n},\delta }$ $\delta >\lambda ^{\frac{1}{2}}\cdot N^{\frac{5}{2}}$ Then, it computes
\begin{equation*} g=g^{\prime 2N}\ mod \ N^2,\ \left\lbrace h_i=g^{s_i}\ mod \ N^2\right\rbrace _{i\in \left[1,n\right]}. \end{equation*} View Source
\begin{equation*}
g=g^{\prime 2N}\
mod \
N^2,\
\left\lbrace h_i=g^{s_i}\
mod \
N^2\right\rbrace _{i\in \left[1,n\right]}.
\end{equation*}
$mpk=(g,\left\lbrace h_i\right\rbrace _{i\in \left[1,n\right]}, N, X), msk=\left(s,Y\right),$ $msk$ $mpk$
$\mathbf {KeyGen}(y,msk)$ $y=\left(y_1,\ldots,y_n\right)$ $msk$ $\alpha, \beta \ {\in }_{R}\ \mathbb {Z}_{N}$ \begin{align*} sk&=\left<s,y\right>+\;\alpha +\beta,\\ pk_1&=g^{\alpha }\ mod\ N^2, \ pk_2=g^{\beta }\ mod\ N^2. \end{align*} View Source
\begin{align*}
sk&=\left<s,y\right>+\;\alpha +\beta,\\
pk_1&=g^{\alpha }\
mod\
N^2, \
pk_2=g^{\beta }\
mod\
N^2.
\end{align*}
$sk_{y}=\left(\beta, sk\right)$ $pk_{y}=\left(pk_1,pk_2\right)$ $sk_y$ $pk_y$
$\mathbf {Encrypt}(x,mpk,pk_y)$ $x=(x_1,\ldots,x_n)$ $mpk$ $pk_y$ $r\ {\in }_{R}\ \lbrace 0,\ldots,\lfloor \frac{N}{4}\rfloor \rbrace$ $a\ {\in }_{R}\ \mathbb {Z}_{N}^{\ast }$ $b\ {\in }_{R}\ \mathbb {Z}_{N}$ $c\ {\in }_{R}\ \mathbb {Z}_{N}$ Then, it computes
\begin{align*} \sigma &=\left(pk_2^{c}\ mod\ N^2\right)\ mod\ N,\ C_1=g^{r}\ mod \ N^2, \\ C_2&=g^{b}\ mod \ N^2,\ C_3=(c\cdot a-b)\ mod \ N,\\ C_4 &=pk_1^{r}\ mod \ N^2,\\ C_5&=\left\lbrace ct_i=h_i^{r} (1+N\sigma x_i) \ mod \ N^2\right\rbrace _{i\in \left[1,n\right]}. \end{align*} View Source
\begin{align*}
\sigma &=\left(pk_2^{c}\
mod\
N^2\right)\
mod\
N,\
C_1=g^{r}\
mod \
N^2, \\
C_2&=g^{b}\
mod \
N^2,\
C_3=(c\cdot a-b)\
mod \
N,\\
C_4 &=pk_1^{r}\
mod \
N^2,\\
C_5&=\left\lbrace ct_i=h_i^{r} (1+N\sigma x_i) \
mod \
N^2\right\rbrace _{i\in \left[1,n\right]}.
\end{align*}
$C_0=a$ $C_x=\left(C_0,C_1,C_2,C_3,C_4,C_5\right)$ $C_x$
$\mathbf {Decrypt}(sk_y, C_x)$ $sk_y$ $C_x$ $\mathbb {Z}_N^{\ast }$ $(C_1^{(\beta -sk)modN} C_4 \prod _{i=1}^{n}ct_i^{y_i})^{\omega _1^{-1}}$ $(C_2\cdot g^{C_3})^{\beta }$ $C_1^{(\beta -sk)modN} C_4 \prod _{i=1}^{n}ct_i^{y_i}$ \begin{align*} \omega _1&=\left(\left(C_2\cdot g^{C_3}\right)^{\beta \cdot C_0^{-1}\ mod\ N}mod\ N^2\right)mod\ N,\\ \omega _2&=\frac{\left(\left(C_1^{(\beta -sk)modN} C_4 \prod _{i=1}^{n}ct_i^{y_i}\right)^{\omega _1^{-1}}-1\right)mod \ N^2}{N}. \end{align*} View Source
\begin{align*}
\omega _1&=\left(\left(C_2\cdot g^{C_3}\right)^{\beta \cdot C_0^{-1}\
mod\
N}mod\
N^2\right)mod\
N,\\
\omega _2&=\frac{\left(\left(C_1^{(\beta -sk)modN} C_4 \prod _{i=1}^{n}ct_i^{y_i}\right)^{\omega _1^{-1}}-1\right)mod \
N^2}{N}.
\end{align*}
4.2 Privacy-Preserving Outsourced Inner Product Computation on Encrypted Database
4.2.1 An Overview
In the setup phase, the global parameters are generated. The parameters related to Ada-IPFE are used to encrypt the outsourced vector and compute the inner product. Whereas, the rest parameters are used to achieve the access control over the outsourced database. Among the rest algorithms, the data outsourcing is implemented by the
4.2.2 Description of the Proposed OIPFE-ACED Scheme
Our OIPFE-ACED scheme based on the Paillier cryptographic system is described as follows.
Setup(
$1^{\lambda }, 1^n, X, Y,U$ $\lambda$ $n$ $X$ $Y$ $U$ $\tilde{p}=2p^{\prime }+1$ $\tilde{q}=2q^{\prime }+1$ $N=\tilde{p}\tilde{q}$ $p^{\prime }$ $q^{\prime }$ $>$ $2^{l(\lambda)}$ $l$ $g^{\prime }\ {\in }_{R}\ \mathbb {Z}_{N^2}^{\ast }$ $s=\left(s_1,\ldots, s_n\right) \ {\in }_{R}\ \mathcal {D}_{\mathbb {Z}^{n},\delta }$ $\delta >\lambda ^{\frac{1}{2}}\cdot N^{\frac{5}{2}}$ $U$ $e$ $\mathbb {G}\times \mathbb {G}\rightarrow \mathbb {G}_T$ $H_1:\mathbb {G}_T\rightarrow \mathbb {Z}_N^{\ast }$ $H_2:\mathbb {Z}_{N^2}\rightarrow \mathbb {Z}_{N^2}$ $A_1, \ldots, A_{\left|U\right|} \ {\in }_{R}\ \mathbb {G}$ $a, \beta \ {\in }_{R} \ \mathbb {Z}_p$ Then, it computes
\begin{align*} &g=g^{\prime 2N}\ mod \ N^2,\ \left\lbrace h_i=g^{s_i}\ mod \ N^2\right\rbrace _{i\in \left[1,n\right]},\\ & A=g_1^{a}, \ h=g_1^{\beta }, \ E=e(g_1,g_1)^{\beta }. \end{align*} View Source
\begin{align*}
&g=g^{\prime 2N}\
mod \
N^2,\
\left\lbrace h_i=g^{s_i}\
mod \
N^2\right\rbrace _{i\in \left[1,n\right]},\\
& A=g_1^{a}, \
h=g_1^{\beta }, \
E=e(g_1,g_1)^{\beta }.
\end{align*}
\begin{align*} &msk=\left(s,h,Y \right),\\ & mpk=(g,\lbrace h_i\rbrace _{i\in \left[1,n\right]}, \lbrace A_i\rbrace _{i\in \left[1,\left|U\right|\right]}, e,\mathbb {G},\mathbb {G}_T,g_1,H_1,\\ &\quad \quad \quad \ \ H_2, A, E, N, X), \end{align*} View Source
\begin{align*}
&msk=\left(s,h,Y \right),\\
& mpk=(g,\lbrace h_i\rbrace _{i\in \left[1,n\right]}, \lbrace A_i\rbrace _{i\in \left[1,\left|U\right|\right]}, e,\mathbb {G},\mathbb {G}_T,g_1,H_1,\\
&\quad \quad \quad \
\
H_2, A, E, N, X),
\end{align*}
$msk$ $mpk$
Store(
$x,mpk,d$ $x=(x_1,\ldots,x_n)$ $mpk$ $d$ $c\ {\in }_{R}\ \mathbb {Z}_{p}$ $r\ {\in }_{R}\ \lbrace 0,\ldots,\lfloor \frac{N}{4}\rfloor \rbrace$ $\left\lbrace a_i\right\rbrace _{i\in [1,\left|U\right|]}$ $\mathbb {Z}_p$ $(d-1)$ $f(\chi)\ {\in }_{R}\ \mathbb {Z}_p[\chi ]$ $f(0)=c$ Then, it computes
\begin{align*} \sigma &=H_1(E^{c}),\ C_0=g_1^{c},\ C_1=g^{r}\ mod \ N^2, \\ C_2&=\left\lbrace ct_i=h_i^{r}\cdot (1+N\sigma x_i) \ mod \ N^2\right\rbrace _{i\in \left[1,n\right]}, \\ C_3&=\left\lbrace \left(c_{i,1},c_{i,2}\right)=\left(A^{f(i)}A_{i}^{-a_i},g_1^{a_i}\right)\right\rbrace _{i\in \left[1,\left|U\right|\right]},\\ vk&=H_2(ct_1), \ vk_1=g^{\sigma }\ mod \ N^2. \end{align*} View Source
\begin{align*}
\sigma &=H_1(E^{c}),\
C_0=g_1^{c},\
C_1=g^{r}\
mod \
N^2, \\
C_2&=\left\lbrace ct_i=h_i^{r}\cdot (1+N\sigma x_i) \
mod \
N^2\right\rbrace _{i\in \left[1,n\right]}, \\
C_3&=\left\lbrace \left(c_{i,1},c_{i,2}\right)=\left(A^{f(i)}A_{i}^{-a_i},g_1^{a_i}\right)\right\rbrace _{i\in \left[1,\left|U\right|\right]},\\
vk&=H_2(ct_1), \
vk_1=g^{\sigma }\
mod \
N^2.
\end{align*}
$C_x=\left(C_0,C_1,C_2,C_3\right)$ $VK=\left(VK_1,VK_2,VK_3\right)=\left(vk,vk_1,C_1\right)$ $C_x$ $VK$
Query(
$y,msk,U^{\prime }$ $y=(y_1,\ldots,y_n)$ $msk$ $U^{\prime }$ 1) Secret key generation. KGC chooses the values
$\alpha \ {\in }_{R}\ \mathbb {Z}_{N}$ $t\ {\in }_{R}\ \mathbb {Z}_p$ \begin{align*} &pk_1=C_1^{\alpha }\ mod\ N^2,\ sk_{0,0}=h A^{t},\ sk_{0,1}=g_1^{t}, \\ &sk=\left\langle s,y\right\rangle +\alpha,\ \left\lbrace sk_i=A_i^{t}\right\rbrace _{i\in U^{\prime }}. \end{align*} View Source
\begin{align*}
&pk_1=C_1^{\alpha }\
mod\
N^2,\
sk_{0,0}=h A^{t},\
sk_{0,1}=g_1^{t}, \\
&sk=\left\langle s,y\right\rangle +\alpha,\
\left\lbrace sk_i=A_i^{t}\right\rbrace _{i\in U^{\prime }}.
\end{align*}
$sk_y=\left(sk, sk_{0,0}, sk_{0,1}, \left\lbrace sk_i\right\rbrace _{i\in U^{\prime }}\right),$ $sk_y$ $pk_1$ 2) Evaluation key generation. DU chooses the values
$\xi _1 \ {\in }_{R}\ \mathbb {Z}_{N}$ $\xi _2 \ {\in }_{R}\ \mathbb {Z}_{p}^{\ast }$ \begin{align*} &pk_2=C_1^{\xi _1}\ mod\ N^2, \ sk_{0,0}^{\prime }=sk_{0,0}^{\xi _2},\ sk^{\prime }_{0,1}=sk_{0,1}^{\xi _2}, \\ &sk^{\prime }=sk+\xi _1,\ \left\lbrace sk^{\prime }_i= sk_i^{\xi _2}\right\rbrace _{i\in U^{\prime }}. \end{align*} View Source
\begin{align*}
&pk_2=C_1^{\xi _1}\
mod\
N^2, \
sk_{0,0}^{\prime }=sk_{0,0}^{\xi _2},\
sk^{\prime }_{0,1}=sk_{0,1}^{\xi _2}, \\
&sk^{\prime }=sk+\xi _1,\
\left\lbrace sk^{\prime }_i= sk_i^{\xi _2}\right\rbrace _{i\in U^{\prime }}.
\end{align*}
\begin{equation*} \pi =\xi _2,\ EK_y=\left(y, sk^{\prime }, sk^{\prime }_{0,0}, sk^{\prime }_{0,1}, \left\lbrace sk^{\prime }_i\right\rbrace _{i\in U^{\prime }}\right), \end{equation*} View Source
\begin{equation*}
\pi =\xi _2,\
EK_y=\left(y, sk^{\prime }, sk^{\prime }_{0,0}, sk^{\prime }_{0,1}, \left\lbrace sk^{\prime }_i\right\rbrace _{i\in U^{\prime }}\right),
\end{equation*}
$\pi$ $pk_2$ $EK_y$
Compute
$(pk_1,pk_2,EK_y,C_x)$ $pk_1$ $pk_2$ $EK_y$ $C_x$ \begin{align*} &\omega _1=\frac{e\left(C_0,sk^{\prime }_{0,0}\right)}{\prod _{i\in U^{\prime }}\left(e\left(c_{i,1},sk_{0,1}^{\prime }\right)e\left(c_{i,2},sk^{\prime }_i\right)\right)^{\Delta _{i,U^{\prime }}(0)}}, \\ &\omega _2=pk_1\cdot pk_2\cdot \prod _{i=2}^{n}ct_i^{y_i}\ mod\ N^2,\\ &\omega _3=ct_1^{y_1}\omega _2/ C_1^{sk^{\prime }}\ mod\ N^2. \end{align*} View Source
\begin{align*}
&\omega _1=\frac{e\left(C_0,sk^{\prime }_{0,0}\right)}{\prod _{i\in U^{\prime }}\left(e\left(c_{i,1},sk_{0,1}^{\prime }\right)e\left(c_{i,2},sk^{\prime }_i\right)\right)^{\Delta _{i,U^{\prime }}(0)}}, \\
&\omega _2=pk_1\cdot pk_2\cdot \prod _{i=2}^{n}ct_i^{y_i}\
mod\
N^2,\\
&\omega _3=ct_1^{y_1}\omega _2/ C_1^{sk^{\prime }}\
mod\
N^2.
\end{align*}
Then, it sets
$P=\left(P_1,P_2\right)=\left(ct_1,\omega _2\right)$ $I=\left(\omega _1,\omega _3\right)$ $P$
Recover(
$I,sk_y,VK,P$ $I$ $sk_y$ $VK$ $P$ $\mathbb {Z}_N^{\ast }$ $\omega _3^{\omega _4^{-1}}$ $\omega _4$ \begin{equation*} \omega _4=H_1\left(\omega _1^{\pi ^{-1}}\right),\ \omega _5=\frac{1}{N}\left(\left(\omega _3^{\omega _4^{-1}}-1\right)\ mod \ N^2\right). \end{equation*} View Source
\begin{equation*}
\omega _4=H_1\left(\omega _1^{\pi ^{-1}}\right),\
\omega _5=\frac{1}{N}\left(\left(\omega _3^{\omega _4^{-1}}-1\right)\
mod \
N^2\right).
\end{equation*}
\begin{align*} &H_2\left(P_1\right)\overset{?}{=}VK_1, \tag{2} \end{align*} View Source
\begin{align*}
&H_2\left(P_1\right)\overset{?}{=}VK_1, \tag{2}
\end{align*}
\begin{align*} &g^{\omega _4}\ mod\ N^2\overset{?}{=} VK_2,\tag{3} \end{align*} View Source
\begin{align*}
&g^{\omega _4}\
mod\
N^2\overset{?}{=} VK_2,\tag{3}
\end{align*}
\begin{align*} &P_1^{y_1} P_2\ mod\ N^2\overset{?}{=} VK_3^{sk^{\prime }}\left(1+N\right)^{\omega _4 \omega _5}\ mod\ N^2. \tag{4} \end{align*} View Source
\begin{align*}
&P_1^{y_1} P_2\
mod\
N^2\overset{?}{=} VK_3^{sk^{\prime }}\left(1+N\right)^{\omega _4 \omega _5}\
mod\
N^2. \tag{4}
\end{align*}
$\omega _5$ $\left<x,y\right>$
Remark 1 (The discussion about access control over the computation and the data user).
As is introduced before, the security of inner product functional encryption requires that the decryptor can use the secret key regarding one vector to decrypt the encrypted vector to obtain the inner product of these two vectors, and nothing else. This property is used in this OIPFE-ACED scheme to not only preserve the privacy for outsourced vector, but also restrict the computation on these outsourced vectors to be inner product. In order to implement the access control over data user, we adopt the technique introduced in [39] to hide the random value
Security Analysis
5.1 The Security Analysis for Ada-IPFE Scheme
In this section, we give the security analysis for Ada-IPFE scheme from the correctness, the adaptive security, the master secret key hiding, the standard consistency constraint and the encrypted vector hiding.
5.1.1 Correctness of Ada-IPFE Scheme
The intuitive sense of the correctness is that the final result obtained by the decryptor is
Theorem 1.
The proposed Ada-IPFE scheme is correct.
Proof.
If all of the participating parties honestly execute the procedures of Ada-IPFE scheme, we can obtain the following results:
\begin{align*}
\sigma &=\left(pk_2^{c}\
mod\
N^2\right) mod\
N=\left(g^{\beta c}\
mod \
N^2\right)mod\
N,\tag{5}
\end{align*}
\begin{align*}
\omega _1&=\left(\left(C_2\cdot g^{C_3}\right)^{\beta \cdot C_0^{-1}\
mod\
N}mod\
N^2\right)mod\
N \\
&=\left(g^{\beta c}\
mod \
N^2\right)\
mod\
N =\sigma, \\
\omega _2&=\frac{\left(C_1^{(\beta -sk)\
mod\
N} C_4\left(\prod _{i=1}^{n}ct_i^{y_i}\right)^{\omega _1^{-1}}-1\right) mod \
N^2}{N}\\
&=\frac{\left(N\sum _{i=1}^{n} x_iy_i\right)\
mod \
N^2}{N}.\tag{6}
\end{align*}
\begin{equation*}
\omega _2=\frac{N\sum _{i=1}^{n} x_iy_i}{N}=\sum _{i=1}^{n} x_iy_i. \tag{7}
\end{equation*}
5.1.2 The Adaptive Security of Ada-IPFE Scheme
The security of Ada-IPFE scheme states that given a ciphertext of the vector
Theorem 2.
The proposed Ada-IPFE scheme is adaptively secure under the DCR assumption.
Proof.
The adaptive security of Ada-IPFE scheme is proved by series of games. This proof begins with a game which is same as the game
Game 0. In this game, the master public key
Game 1. This game is the same as Game 0 except that the encryption of the challenge vector
\begin{equation*}
\rho =\rho _0^N\
mod\
N^2. \tag{8}
\end{equation*}
\begin{align*}
C_1&=\rho ^{2}\
mod\
N^{2}, \
C_4=C_1^{\alpha }\
mod \
N^2,\tag{9}
\end{align*}
\begin{align*}
C_5&=\left\lbrace ct_i=C_1^{s_i} (1+N\sigma)^{x^{(\mu)}_i}\
mod \
N^{2}\right\rbrace _{i\in [1,n]}. \tag{10}
\end{align*}
\begin{equation*}
\left|Pr[S_1]-Pr[S_0]\right|\leq \frac{1}{2^{\lambda }}. \tag{11}
\end{equation*}
\begin{equation*}
\left|Pr[S_2]-Pr[S_1]\right|\leq Adv_{\mathcal {A}}^{\text{DCR}}(\lambda). \tag{12}
\end{equation*}
\begin{equation*}
\left|Pr[S_3]-Pr[S_2]\right|\leq \frac{1}{2^{\lambda }}. \tag{13}
\end{equation*}
\begin{equation*}
ct_i=h_i^{r_\rho }(1+\sigma N)^{(x^{(\mu)}_{ i}+a_{\rho }\cdot s_i)mod / N}\
mod \
N^2. \tag{14}
\end{equation*}
\begin{equation*}
x=(x_1,\ldots,x_n)=\frac{1}{d} \left(x^{(1)}-x^{(0)}\right), \tag{15}
\end{equation*}
\begin{equation*}
\lbrace y\in \mathbb {Z}^{n}|\left<x,y\right>=0\rbrace . \tag{16}
\end{equation*}
\begin{equation*}
Y_{top}=\begin{pmatrix}E_{n_0}& O\\
O & D\\
\end{pmatrix}\in \mathbb {Z}^{(n-1)\times n}, \tag{17}
\end{equation*}
\begin{equation*}
D=\begin{pmatrix}-x_{n_0+2}& x_{n_0+1}& & & \\
& -x_{n_0+3}& x_{n_0+2}& & \\
& & \ddots & \ddots & \\
& & & -x_{n}&x_{n-1} \\
\end{pmatrix}.
\end{equation*}
We define the matrix
For all
\begin{align*}
z^{(\mu)}&=\left(\left(x_{ 1}^{(\mu)}+a_{\rho } s_1\right)mod\; N, \ldots, \left(x_{ n}^{(\mu)}+a_{\rho } s_n\right)mod / N\right) \\
&=\left(x^{(\mu)}+a_{\rho }\cdot s\right)\
mod\
N. \tag{18}
\end{align*}
\begin{equation*}
Y_{top}\cdot \left(z^{(\mu)}\right)^{T}\
mod \
N
\end{equation*}
\begin{align*}
&=\left(Y_{top}\cdot \left(x^{(\mu)}\right)^{T}+\;a_{\rho }\cdot Y_{top}\cdot s^{T}\right)\
mod \
N \\
&=a_{\rho }\cdot Y_{top}\cdot s^{T}\
mod \
N. \tag{19}
\end{align*}
The Equation (19) implies that
\begin{equation*}
Y_{top} \left(z^{(\mu)}\right)^{T}mod / N=\left(\left<x,x^{(\mu)}\right>+a_{\rho } \left<x,s\right>\right)mod \
N. \tag{20}
\end{equation*}
\begin{equation*}
\Lambda =\lbrace t\in \mathbb {Z}^{n}|Y_{top}\cdot t=O\
\text{and}\
t=O\
mod\
p^{\prime }q^{\prime }\rbrace . \tag{21}
\end{equation*}
\begin{align*}
&\left|(p^{\prime }q^{\prime })\left\Vert x\right\Vert ^{2}\cdot N\right|<N^2\left\Vert x\right\Vert ^2,\
gcd(p^{\prime }q^{\prime }\left\Vert x\right\Vert ^2,N)=1, \\
&\left\Vert x\right\Vert ^2<N,\
\
\
\sigma >\lambda ^{\frac{1}{2}}N^{\frac{5}{2}}.
\end{align*}
Because
\begin{equation*}
\left|Pr[S_0]-\frac{1}{2}\right|\leq Adv_{\mathcal {A}}^{\text{DCR}}(\lambda)+\frac{1}{2^{\lambda -1}}. \tag{22}
\end{equation*}
5.1.3 The Master Secret Key Hiding of Ada-IPFE Scheme
In the Ada-IPFE scheme, the master secret key consists of a vector
Theorem 3.
The proposed Ada-IPFE scheme is master secret key hiding.
Proof.
In order to prove this theorem, we will show that
$\mathbf {Setup.}$ $\mathcal {C}$ $\left(msk,mpk\right)$ $\mathbf {Setup}(1^{\lambda }, 1^n,X,Y)$ $msk=\left(s,Y\right)=\left(\left(s_1,\ldots,s_n\right), Y\right)$ $mpk=(g,\left\lbrace h_i\right\rbrace _{i\in \left[1,n\right]}, N, X)$ $mpk$ $\mathcal {A}$ $\mathbf {Query.}$ $\mathcal {A}$ $y^{(1)},\ldots,y^{(l)}$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf { KeyGen}(y^{(i)},msk)$ $sk^{(i)}=\left<s,y^{(i)}\right>+\;\alpha ^{(i)}+\beta ^{(i)}$ \begin{equation*} pk_1^{(i)}= g^{\alpha ^{(i)}}mod\ N^2,\ pk_2^{(i)}=g^{\beta ^{(i)}}mod\ N^2, \tag{23} \end{equation*} View Source
\begin{equation*}
pk_1^{(i)}= g^{\alpha ^{(i)}}mod\
N^2,\
pk_2^{(i)}=g^{\beta ^{(i)}}mod\
N^2, \tag{23}
\end{equation*}
$\alpha ^{(i)},\beta ^{(i)}\ {\in }_{R}\ \mathbb {Z}_{N}$ $\mathcal {A}$ $\lbrace sk_{y^{(i)}}=\left(\beta ^{(i)},sk^{(i)}\right)\rbrace _{i\in [1,l]}$ $\lbrace pk_{y^{(i)}}=(pk_1^{(i)},pk_2^{(i)})\rbrace _{i\in [1,l]}$ $\mathbf {Guess.}$ $\mathcal {A}$ $msk^{\ast }=\left(s^{\ast },Y^{\ast }\right)=\left(\left(s_1^{\ast },\ldots,s_n^{\ast }\right), Y^{\ast }\right)$ $\mathcal {A}$ $s^{\ast }$ Way 1:
$\mathcal {A}$ $v\in \mathcal {D}_{\mathbb {Z},\delta }$ $g^{v}$ $\left\lbrace h_i\right\rbrace _{i\in \left[1,n\right]}$ $v$ $s_i$ $i\in \left[1,n\right]$ Way 2:
$\mathcal {A}$ $l\geq n$ $s$ $y^{\left(1\right)}$ $\ldots$ $y^{\left(l\right)}$ \begin{equation*} \left\lbrace \begin{array}{l}\left<s,y^{(1)}\right>+\;\alpha ^{(1)}+\beta ^{(1)}=sk^{(1)},\\ \qquad \cdots \\ \left<s,y^{(l)}\right>+\;\alpha ^{(l)}+\beta ^{(l)}=sk^{(l)}.\\ \end{array} \right. \tag{24} \end{equation*} View Source
\begin{equation*}
\left\lbrace \begin{array}{l}\left<s,y^{(1)}\right>+\;\alpha ^{(1)}+\beta ^{(1)}=sk^{(1)},\\
\qquad \cdots \\
\left<s,y^{(l)}\right>+\;\alpha ^{(l)}+\beta ^{(l)}=sk^{(l)}.\\
\end{array} \right. \tag{24}
\end{equation*}
In order to obtain the vector
\begin{align*}
Pr\left[s=s^{\ast }\right]&=Pr\left[\Gamma _1\wedge \cdots \wedge \Gamma _l\wedge \Lambda _1\wedge \cdots \wedge \Lambda _l\right]\tag{25}
\end{align*}
\begin{align*}
&=\prod _{i=1}^{l}Pr\left[\Gamma _i\right]Pr\left[\Lambda _i\right]\tag{26}
\end{align*}
\begin{align*}
&=\left(\frac{1}{N}\right)^{2l}. \tag{27}
\end{align*}
5.1.4 Standard Consistency Constraint of Ada-IPFE Scheme
The standard consistency constraint states that the public key
Theorem 4.
The proposed Ada-IPFE scheme guarantees the standard consistency constraint.
Proof.
We assume that the inner product
\begin{align*}
pk_1&=g^{\alpha }\
mod\
N^2,\
pk_2=g^{\beta }\
mod\
N^2, \
\alpha, \beta \
{\in }_{R}\
\mathbb {Z}_{N},\\
sk&=\left<s,y\right>+\;\alpha +\beta .
\end{align*}
\begin{align*}
\sigma &=\left(pk_2^{c}\
mod\
N^2\right)\
mod\
N,\
C_0=a,\
C_1=g^{r}\
mod \
N^2, \\
C_2&=g^{b}\
mod \
N^2, \
C_3=(c\cdot a-b)\
mod \
N,\\
C_4&=pk_1^{r}\
mod \
N^2,\
r\
{\in }_{R}\
\bigg\lbrace 0,\ldots,\bigg\lfloor \frac{N}{4}\bigg\rfloor \bigg\rbrace,\
\\
C_5&=\left\lbrace ct_i=h_i^{r}(1+N\sigma x_i) \
mod \
N^2\right\rbrace _{i\in \left[1,n\right]}.
\end{align*}
\begin{align*}
&\hat{pk}_1=g^{\hat{\alpha }}\
mod\
N^2, \
\hat{pk}_2=g^{\hat{\beta }}\
mod\
N^2, \
\hat{\alpha }, \hat{\beta }\
{\in }_{R}\
\mathbb {Z}_{N}, \\
& \hat{\alpha }\ne \alpha,\
\hat{\beta }\ne \beta,\
\hat{sk}=\left<s,\hat{y}\right>+\;\hat{\alpha }+\hat{\beta }.
\end{align*}
\begin{align*}
\hat{\omega }_1^{-1}&=\left(\left(C_2\cdot g^{C_3}\right)^{\hat{\beta }\cdot C_0^{-1}\
mod\
N}mod\
N^2\right)^{-1}mod\
N \\
&=\left(g^{\hat{\beta } c}\
mod\
N^2\right)^{-1}\
mod\
N,\\
\hat{ \omega }_2&=\left(\left(C_1^{(\hat{\beta }-\hat{sk})\
mod\
N} C_4 \prod _{i=1}^{n}ct_i^{\hat{y}_i}\right)^{\hat{\omega }_1^{-1}}-1\right)mod \
N^2 \\
&=\left(g^{\hat{\omega }_1^{-1}r(\hat{\alpha }-\alpha)}+N\hat{\omega }_1^{-1}\sigma g^{\hat{\omega _1}^{-1}r(\hat{\alpha }-\alpha)}\left<x,\hat{y}\right>-1\right)mod \;N^2,
\end{align*}
\begin{equation*}
\left(g^{\hat{\omega }_1^{-1}r(\hat{\alpha }-\alpha)}-1\right)+N\hat{\omega }_1^{-1}\sigma g^{\hat{\omega _1}^{-1}r(\hat{\alpha }-\alpha)}\left<x,\hat{y}\right>=N\left<x,\hat{y}\right>,
\end{equation*}
\begin{equation*}
\left\lbrace \begin{array}{l}g^{\hat{\omega }_1^{-1}r(\hat{\alpha }-\alpha)}-1=0,\\
N\hat{\omega }_1^{-1}\sigma g^{\hat{\omega _1}^{-1}r(\hat{\alpha }-\alpha)}\left<x,\hat{y}\right>=N\left<x,\hat{y}\right>.\\
\end{array} \right. \tag{28}
\end{equation*}
\begin{equation*}
\left\lbrace \begin{array}{l}g^{\hat{\omega }_1^{-1}r(\hat{\alpha }-\alpha)}=1,\\
g^{(\beta -\hat{\beta })c}=1,\\
\end{array} \right. \tag{29}
\end{equation*}
5.1.5 Encrypted Vector Hiding of Ada-IPFE Scheme
In the existing works, the encrypted vector
Theorem 5.
The Ada-IPFE scheme is encrypted vector hiding.
Proof.
From Theorem 4, the Ada-IPFE scheme guarantees the standard consistency constraint, which indicates that the ciphertext of the vector
5.2 The Security Analysis for OIPFE-ACED Scheme
In this section, we give the security analysis of OIPFE-ACED scheme from the correctness, the outsourced vector privacy and the unforgeability.
5.2.1 Correctness of the OIPFE-ACED Scheme
The intuitive sense of the correctness is that the final result obtained by DU is
Theorem 6.
The proposed OIPFE-ACED scheme is correct.
Proof.
Let
\begin{align*}
\omega _1&=\frac{e\left(C_0,sk^{\prime }_{0,0}\right)}{\prod _{i\in U^{\prime }}\left(e\left(c_{i1},sk_{0,1}^{\prime }\right)e\left(c_{i2},sk^{\prime }_i\right)\right)^{\Delta _{i,U^{\prime }}(0)}} \\
&=e\left(g_1,g_1\right)^{\beta c\xi _2}, \tag{30}
\end{align*}
\begin{align*}
\omega _2&=pk_1\cdot pk_2\cdot \prod _{i=2}^{n}ct_i^{y_i} mod\
N^2 \\
&=g^{r\alpha +r\xi _1+r\sum _{i=2}^{n}s_iy_i}\left(1+N\sigma \sum _{i=2}^{n} x_iy_i\right)\;mod\
N^2, \tag{31}
\end{align*}
\begin{align*}
\omega _3&=ct_1^{y_1}\omega _2/ C_1^{sk^{\prime }}\
mod\
N^2 \\
&=\frac{g^{r\alpha +r\xi _1+r\sum _{i=1}^{n}s_iy_i}\left(1+N\sigma \sum _{i=1}^{n} x_iy_i\right)}{g^{r\sum _{i=1}^{n}s_iy_i+r\alpha +r\xi _1}} \;mod\
N^2 \\
&=\left(1+N\sigma \sum _{i=1}^{n}x_iy_i\right)\;mod \
N^2, \tag{32}
\end{align*}
\begin{align*}
\omega _4&=H_1\left(\omega _1^{\pi ^{-1}}\right) \\
&=H_1\left(e\left(g_1,g_1\right)^{\beta c \xi _2\xi _2^{-1}}\right) \\
&=\sigma, \tag{33}
\end{align*}
\begin{align*}
\omega _5&=\frac{1}{N}\left(\left(\omega _3^{\omega _4^{-1}}-1\right)\
mod \
N^2\right) \\
&=\frac{1}{N}\left(\left(N\sum _{i=1}^{n}x_iy_i\right)\
mod \
N^2\right). \tag{34}
\end{align*}
\begin{align*}
\omega _5&=\frac{1}{N}\left(\left(N\sum _{i=1}^{n}x_iy_i\right)\
mod \
N^2\right) \\
&=\frac{1}{N}\cdot N\cdot \sum _{i=1}^{n}x_iy_i \\
&=\sum _{i=1}^{n}x_iy_i. \tag{35}
\end{align*}
5.2.2 The Outsourced Vector Privacy of OIPFE-ACED Scheme
The outsourced vector privacy is a very important issue in the OIPFE-ACED scheme. The basic requirement for the data storage in CS is that the privacy of the outsourced data should be preserved. More formally, we have the below theorem.
Theorem 7.
The OIPFE-ACED scheme achieves the outsourced vector privacy.
Proof.
The proposed OIPFE-ACED scheme is adapted from the proposed Ada-IPFE scheme. The outsourced vector is encrypted based on the proposed Ada-IPFE scheme. Since the proposed Ada-IPFE scheme achieves the adaptive security, it is difficult for
5.2.3 The Unforgeability of OIPFE-ACED Scheme
The unforgeability of OIPFE-ACED scheme states that the malicious CS cannot make DU accept the wrong inner product. To be more specific, the forged result by CS which is not equal to the desired inner product cannot pass the verification. Formally, we have the following theorem.
Theorem 8.
The OIPFE-ACED scheme achieves the unforgeability.
Proof.
When
$\mathbf {Setup.}$ $\mathcal {C}$ $\mathbf {Setup}(1^{\lambda }, 1^n,X,Y,U)$ $msk$ $mpk$ $msk=\left(s,h,Y \right)$ \begin{align*} & mpk=(g,\lbrace h_i\rbrace _{i\in \left[1,n\right]}, \lbrace A_i\rbrace _{i\in \left[1,\left|U\right|\right]}, e,\mathbb {G},\mathbb {G}_T,g_1,H_1,\\ &\quad \quad \quad \ \ H_2, A, E, N, X). \end{align*} View Source
\begin{align*}
& mpk=(g,\lbrace h_i\rbrace _{i\in \left[1,n\right]}, \lbrace A_i\rbrace _{i\in \left[1,\left|U\right|\right]}, e,\mathbb {G},\mathbb {G}_T,g_1,H_1,\\
&\quad \quad \quad \
\
H_2, A, E, N, X).
\end{align*}
$\mathcal {C}$ $mpk$ $\mathcal {A}$ $\mathcal {A}$ $s$ $h$ $Y$ $\mathcal {A}$ $\mathbf {Query\ phase.}$ $\mathcal {C}$ $x=\left(x_1,\ldots,x_n\right)$ $\mathbf {Store}(x,mpk,d)$ $VK$ $C_x$ $\mathcal {A}$ $\mathcal {C}$ $c\ {\in }_{R}\ \mathbb {Z}_{p}$ $r\ {\in }_{R}\ \lbrace 0,\ldots,\lfloor \frac{N}{4}\rfloor \rbrace$ $\left\lbrace a_i\right\rbrace _{i\in [1,\left|U\right|]}$ $\mathbb {Z}_p$ $(d-1)$ $f(\chi)\ {\in }_{R}\ \mathbb {Z}_p[\chi ]$ $f(0)=c$ It computes
$\sigma =H_1(E^{c})$ $C_0=g_1^{c}$ $C_1=g^{r}mod\ N^2$ \begin{align*} C_2&=\left\lbrace ct_i=h_i^{r}\cdot (1+N\sigma x_i) \ mod \ N^2\right\rbrace _{i\in \left[1,n\right]}, \\ C_3&=\left\lbrace \left(c_{i,1},c_{i,2}\right)=\left(A^{f(i)}A_{i}^{-a_i},g_1^{a_i}\right)\right\rbrace _{i\in \left[1,\left|U\right|\right]}, \\ vk&=H_2(ct_1), \ vk_1=g^{\sigma }\ mod \ N^2. \end{align*} View Source
\begin{align*}
C_2&=\left\lbrace ct_i=h_i^{r}\cdot (1+N\sigma x_i) \
mod \
N^2\right\rbrace _{i\in \left[1,n\right]}, \\
C_3&=\left\lbrace \left(c_{i,1},c_{i,2}\right)=\left(A^{f(i)}A_{i}^{-a_i},g_1^{a_i}\right)\right\rbrace _{i\in \left[1,\left|U\right|\right]}, \\
vk&=H_2(ct_1), \
vk_1=g^{\sigma }\
mod \
N^2.
\end{align*}
$C_x=\left(C_0,C_1,C_2,C_3\right)$ $VK=\left(VK_1,VK_2,VK_3\right)=\left(vk,vk_1,C_1\right)$ $\mathcal {A}$ $\mathcal {A}$ $x$ After this,
$\mathcal {A}$ $y^{(1)}=(y^{(1)}_1,\ldots,y^{(1)}_n),\ldots,y^{(l)}=(y^{(l)}_1,\ldots,y^{(l)}_n)$ $U^{\prime }$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf {Query}(y^{(j)},msk,U^{\prime })$ $j\in \lbrace 1,\ldots,l\rbrace$ $(pk_1^{(j)},pk_2^{(j)},EK_{y^{(j)}})$ $\mathcal {A}$ $\mathcal {C}$ $\alpha ^{(j)}\ {\in }_{R}\ \mathbb {Z}_{N}$ $t^{(j)}\ {\in }_{R}\ \mathbb {Z}_p$ $\xi _1^{(j)} \ {\in }_{R}\ \mathbb {Z}_{N}$ $\xi _2^{(j)} \ {\in }_{R}\ \mathbb {Z}_{p}^{\ast }$ \begin{align*} &pk_1^{(j)}=C_1^{\alpha ^{(j)}}\ mod\ N^2,\ pk_2^{(j)}=C_1^{\xi _1^{(j)}}\ mod\ N^2,\\ &sk_{0,0}^{\prime (j)}=\left(h A^{t^{(j)}}\right)^{\xi _2^{(j)}},\ sk_{0,1}^{\prime (j)}=\left(g_1^{t^{(j)}}\right)^{\xi _2^{(j)}}, \\ &sk^{\prime (j)}=\left\langle s,y^{(j)}\right\rangle +\alpha ^{(j)}+\xi _1^{(j)},\ \left\lbrace sk_i^{\prime (j)}=A_i^{t^{(j)}}\right\rbrace _{i\in U^{\prime }}. \end{align*} View Source
\begin{align*}
&pk_1^{(j)}=C_1^{\alpha ^{(j)}}\
mod\
N^2,\
pk_2^{(j)}=C_1^{\xi _1^{(j)}}\
mod\
N^2,\\
&sk_{0,0}^{\prime (j)}=\left(h A^{t^{(j)}}\right)^{\xi _2^{(j)}},\
sk_{0,1}^{\prime (j)}=\left(g_1^{t^{(j)}}\right)^{\xi _2^{(j)}}, \\
&sk^{\prime (j)}=\left\langle s,y^{(j)}\right\rangle +\alpha ^{(j)}+\xi _1^{(j)},\
\left\lbrace sk_i^{\prime (j)}=A_i^{t^{(j)}}\right\rbrace _{i\in U^{\prime }}.
\end{align*}
\begin{equation*} EK_{y^{(j)}}=\left(y^{(j)},sk_{0,0}^{\prime (j)},sk_{0,1}^{\prime (j)},sk^{\prime (j)},\left\lbrace sk_i^{\prime (j)}\right\rbrace _{i\in U^{\prime }}\right). \end{equation*} View Source
\begin{equation*}
EK_{y^{(j)}}=\left(y^{(j)},sk_{0,0}^{\prime (j)},sk_{0,1}^{\prime (j)},sk^{\prime (j)},\left\lbrace sk_i^{\prime (j)}\right\rbrace _{i\in U^{\prime }}\right).
\end{equation*}
$\alpha ^{\left(j\right)}$ $t^{\left(j\right)}$ $\xi _1^{\left(j\right)}$ $\xi _2^{\left(j\right)}$ $sk_{0,0}^{\prime (j)}$ $sk_{0,1}^{\prime (j)}$ $sk_i^{\prime (j)}$ $\mathcal {A}$ $U^{\prime }$ $\left|U\cap U^{\prime }\right|\geq d$ $\mathcal {A}$ $\xi _2$ $x$ $\mathcal {A}$ $\mathbf {Forgery.}$ $\mathcal {A}$ $y^{\ast }=\left(y_1^{\ast },\ldots,y_n^{\ast }\right)$ $\mathcal {C}$ $\mathcal {C}$ $\mathbf {Query}(y^{\ast },msk,U^{\prime })$ $\left(pk_1^{\ast },pk_2^{\ast },EK_{y^{\ast }}\right)$ $\mathcal {A}$ $\mathcal {C}$ $\alpha ^{\ast }\ {\in }_{R}\ \mathbb {Z}_{N}$ $t^{\ast }\ {\in }_{R}\ \mathbb {Z}_p$ $\xi _1^{\ast } \ {\in }_{R}\ \mathbb {Z}_{N}$ $\xi _2^{\ast } \ {\in }_{R}\ \mathbb {Z}_{p}^{\ast }$ \begin{align*} &pk_1^{\ast }=C_1^{\alpha ^{\ast }}\ mod\ N^2,\ pk_2^{\ast }=C_1^{\xi _1^{\ast }}\ mod\ N^2, \\ &sk_{0,0}^{\prime \ast }=\left(h A^{t^{\ast }}\right)^{\xi _2^{\ast }},\ sk_{0,1}^{\prime \ast }=\left(g_1^{t^{\ast }}\right)^{\xi _2^{\ast }}, \\ &sk^{\prime \ast }=\left\langle s,y^{\ast }\right\rangle +\alpha ^{\ast }+\xi _1^{\ast },\ \left\lbrace sk_i^{\prime \ast }=A_i^{t^{\ast }}\right\rbrace _{i\in U^{\prime }}. \end{align*} View Source
\begin{align*}
&pk_1^{\ast }=C_1^{\alpha ^{\ast }}\
mod\
N^2,\
pk_2^{\ast }=C_1^{\xi _1^{\ast }}\
mod\
N^2, \\
&sk_{0,0}^{\prime \ast }=\left(h A^{t^{\ast }}\right)^{\xi _2^{\ast }},\
sk_{0,1}^{\prime \ast }=\left(g_1^{t^{\ast }}\right)^{\xi _2^{\ast }}, \\
&sk^{\prime \ast }=\left\langle s,y^{\ast }\right\rangle +\alpha ^{\ast }+\xi _1^{\ast },\
\left\lbrace sk_i^{\prime \ast }=A_i^{t^{\ast }}\right\rbrace _{i\in U^{\prime }}.
\end{align*}
\begin{equation*} EK_{y^{\ast }}=\left(y^{\ast },sk_{0,0}^{\prime \ast },sk_{0,1}^{\prime \ast },sk^{\prime \ast },\left\lbrace sk_i^{\prime \ast }\right\rbrace _{i\in U^{\prime }}\right). \end{equation*} View Source
\begin{equation*}
EK_{y^{\ast }}=\left(y^{\ast },sk_{0,0}^{\prime \ast },sk_{0,1}^{\prime \ast },sk^{\prime \ast },\left\lbrace sk_i^{\prime \ast }\right\rbrace _{i\in U^{\prime }}\right).
\end{equation*}
$\mathcal {A}$ $\widetilde{I}$ $\widetilde{P}$ $\mathcal {C}$ $sk_{0,0}^{\ast }$ $sk_{0,1}^{\ast }$ $sk_i^{\ast }$ $\mathcal {A}$
Since we assume that
\begin{align*}
&H_2\left(\widetilde{P}_1\right)=VK_1,\tag{36}
\end{align*}
\begin{align*}
&g^{\widetilde{\omega }_4}\
mod\
N^2=VK_2,\tag{37}
\end{align*}
\begin{align*}
&\widetilde{P}_1^{y_1}\widetilde{P}_2\
mod\
N^2= VK_2^{sk^{\prime }}\left(1+N\right)^{\widetilde{\omega }_4 \widetilde{\omega }_5}\
mod\
N^2, \tag{38}
\end{align*}
\begin{equation*}
P_1^{y_1}\widetilde{P}_2\
mod\
N^2= VK_2^{sk^{\prime }}\left(1+N\right)^{\sigma \widetilde{\omega }_5}\
mod\
N^2. \tag{39}
\end{equation*}
\begin{equation*}
P_1^{y_1}P_2^{\ast }\
mod\
N^2= VK_2^{sk^{\prime }}\left(1+N\right)^{\sigma \left<x,y^{\ast }\right>}\
mod\
N^2. \tag{40}
\end{equation*}
Since
\begin{equation*}
P_1^{y_1}P_2^{\ast }\
mod\
N^2= VK_2^{sk^{\prime }}\left(1+N\right)^{\sigma \widetilde{\omega }_5}\
mod\
N^2. \tag{41}
\end{equation*}
\begin{equation*}
\left(1+N\right)^{\sigma \left(\left<x,y^{\ast }\right>-\widetilde{\omega }_5\right) }\
mod\
N^2=1. \tag{42}
\end{equation*}
Performance Analysis
In this section, we give the performance analysis of our proposed schemes, which includes functionality analysis and efficiency analysis. We first give the performance analysis for our proposed Ada-IPFE scheme, and then give the performance analysis for our proposed OIPFE-ACED scheme.
In order to obtain the experimental results, C programming language with the GMP-6.1.2 (GNU Multiple Precision Arithmetic Library-6.1.2), the PBC-0.5.14 (Pairing-Based Cryptography Library-0.5.14) and the CiFEr (Functional Encryption Library) are used. And all of the experimental evaluation results are obtained on the same machine with Intel(R) Core(TM) i7-8565U CPU @ 1.80 GHz 1.99 GHz and 8 GB RAM (7.85GB is available) running Ubuntu 18.04. When implementing the proposed schemes, the parameters of elliptic curve are (160,512).
6.1 Performance Analysis for Ada-IPFE Scheme
6.1.1 Functionality Analysis
In Table 2, we give the functionality comparisons for our Ada-IPFE scheme with existing works [16], [17], [18], [19], [21] in the public key setting, where different encryptors can generate ciphertexts for the same decryptor. The DDH-based IPFE scheme in [16] is the first concrete scheme for the novel idea of IPFE. In order to obtain the desired inner product, it needs to compute the expensive discrete logarithm in the decryption algorithm. So, this instantiation from ElGamal encryption is restricted to computing the inner product in a prescribed short interval, which makes this scheme not practical. This limitation also exists in other DDH-based schemes. To overcome this limitation, the DCR-based schemes, the LWE-based schemes and the schemes based on variants of DDH assumption are proposed. In these schemes, the desired inner product can be efficiently obtained in decryption algorithm, since they can avoid computing the expensive discrete logarithm. So, the short result interval does not need to be imposed on these IPFE schemes. In order to solve the issue regarding master secret key privacy for the vector that has
6.1.2 Efficiency Analysis
In Table 3, we give the computation cost comparisons between work [19] and our Ada-IPFE scheme. We intend to show that our Ada-IPFE scheme achieves the stronger privacy guarantees at reasonable price of efficiency. Since the security of these schemes is based on the DCR assumption, it is more reasonable to compare our Ada-IPFE scheme with the scheme in [19] than with that in [16]. In this table, we denote an exponent operation, the operation of choosing a random value, a multiplication operation, an addition operation, a subtraction operation and inversion operation by
![Table 3-
Computation Cost Comparisons for Ada-IPFE With the Scheme in [19]](/mediastore/IEEE/content/media/8858/9733106/9113463/qin.t3-3001345-large.gif)
In
In addition to the theoretical analysis, we also give the experimental results in Fig. 3. And Figs. 3a, 3c and 3d show that the time cost in
6.2 Performance Analysis for OIPFE-ACED Scheme
6.2.1 Functionality Analysis
Our OIPFE-ACED scheme is a new outsourced inner product computation scheme. This scheme focuses on not only the outsourced inner product computation but also the outsourced storage. For data privacy concerns, the data owner in the system can use this scheme to encrypt the data and then store the encrypted data in the cloud server. The data privacy is preserved based on the security of the underlying IPFE scheme. In our mentioned setting, there are also several data users who may be different entities from data owner. In addition to the traditional privacy issues, the revealed information and the data user are also regulated in this scheme. So, it is proper for the setting where multiple data owners and multiple data users are involved. These entities can share the inner product derived from the outsourced data.
6.2.2 Efficiency Analysis
When making the efficiency analysis, the storage efficiency is also a major aspect of our work. The basic requirements are that the data user can avoid downloading the outsourced data from cloud server and the storage overhead is independent of the vector size, if the data user makes use of the outsourced encrypted data. In Table 4, we show the storage overhead for every entity and the computation cost in every stage. We intend to show that data owner is free of the storage burden (i.e., nothing needs to be stored locally once the data is outsourced to cloud server) and the storage overhead is independent of the vectors size (i.e., constant). Furthermore, the total time cost that data user spends in the evaluation key generation stage of
For storage, we denote an element in
From Tables 4 and 5, the data owner is free of the computation burden once the data is outsourced to cloud server. The data user just stores one element of
In Table 5, we also show the communication overhead of every entity in OIPFE-ACED scheme. The key generation center's communication overhead is
The experimental results are shown in Fig. 4, where the size of universal attribute set is 20 (i.e.,
Conclusion
In this paper, we propose a concrete IPFE scheme based on the Paillier cryptographic system. The proposed Ada-IPFE scheme can preserve privacy for the master secret key and the encrypted vector. Based on this improved Ada-IPFE scheme, we also propose an OIPFE-ACED scheme. In addition to the basic requirements of verification and computational efficiency, the proposed OIPFE-ACED scheme can relieve data user's storage burden. This scheme is adequate for computing the inner product on the outsourced encrypted database. It can preserve the data privacy by the access control over the revealed information and the data users. Furthermore, we have given the security analysis and the experimental results, which show that our proposed schemes are secure and practical.
ACKNOWLEDGMENTS
The authors appreciate Dr. Fuchun Lin for the useful discussions to improve the article writing. This work was supported by National Natural Science Foundation of China under Grant (No.61772311), Open Project of State Key Laboratory of Cryptology (No. kyxm-70577), Singapore Ministry of Education under Research Grant RG12/19, A*STAR under its RIE2020 Advanced Manufacturing and Engineering (AME) Programmtic Programme (Award A19E3b0099), and China Scholarship Council (No.201906220077).