Cost-effective secure e-health cloud system using identity based cryptographic techniques

Cost-effective Secure E-health Cloud System Using Identity Based Cryptographic Techniques Xu An Wang1,3, Jianfeng Ma 2, Fatos Xhafa 4,MingwuZhang 5,XiaoshuangLuo 3 1School of Telecommunications Engineering, Xidian University, P. R. China 2School of Cyber Engineering, Xidian University, P. R. China 3Engineering University of Chinese Armed Police Force, P. R. China 4Department of Computer Science, Technical University of Catalonia, Spain 5Hubei University of Technology, P. R. China [email protected] Abstract Nowadays E-health cloud systems are more and more widely employed. However the security of these systems needs more consideration due to the sensitive health information of patients. So far, some protocols about secure e-health cloud systems have been proposed, but many of them use the traditional PKI infrastructure to implement cryptographic mechanisms, which is cumbersome as they require every user having and remembering its own public/private keys. Identity based encryption (IBE) is a cryptographic primitive, which uses the identity information of the user (e.g., email address) as the public key. Hence, the public key is implicitly authenticated and the certificate management is greatly simplified. On the other hand, proxy re-encryption is a cryptographic primitive aiming at transforming a ciphertext under the delegator A’s into another ciphertext, which can be decrypted by the delegatee B.Inthispaper,wedescribeseveralidentity related cryptographic techniques for securing an E-health system, which include new IBE schemes and new identity based proxy re-encryption (IBPRE)schemes. Wealsoprove these schemes’ security and give their performance analysis. Our results show that our IBPRE scheme is especially highly efficient for re-encryption, which can be used to achieve cost-effective cloud usage. Keywords: Secure e-health cloud system, identity based encryption, identity based proxy re-encryption, cost-effective. 1. Introduction E-health System. E-health systems nowadays are becoming more and more commonplace in medical systems by integrating information technology and traditional medical diagnosis processes [23]. Traditionally, when a person has some health troubles, he/she goes to the hospital to see a doctor. The doctor needs to carefully check patient’s body state to decide the potential kind of disease or health trouble. In this process, the doctor may need to handle images, referrals, medical records, etc. which is usually a tedious task. E-health systems can help handling this work automatically, by means of the health care information system. For instance, in China, as one typical application of the promising Internet+ technology, it is expected that in the near future, E-health will be one of the most practical public administration services. In particular, the Electronic Health Records (EHR) plays a central role in any E-health system; they can be recorded by doctors and nursers, collected by sensors in wireless body sensor network, etc. By using an E-health system, doctors can freely share and exchange health records, while patients can easily access to their health records through a designated patient’s portal, and the health care providers can enquire patients’ time-critical and general data effectively and transparently. Additionally, E-health systems can be beneficial to other users and stakeholders in the field. Thus, the system stores the patient’s medical history and is a vital information source for physicians. We can seeanoverviewonatypicalE-healthsystem in Fig. 1. Clinicians record EHRs and related events summary from E-health system consumers and longitudinal health records. These EHRs can be further supplied to hospitals and other medical providers for deep analysis like lab tests. Health IT vendors can also better support the hospitals from these health records by dynamically adjusting their policy. Administers, funders or researchers can also benefit from this process. However, all these benefits come to the risk of unauthorized data access, data sharing or data leakage, among other unauthorized patient’sdatausage. Indeed,securityandprivacy are one of the main issues that prevent to widely adapt E-health systems, for electronic health records are sensitive information. Malicious attackers can use them to endanger the patient’s life. Although there are proposals on how to secure the E-health system, many of them use traditional PKI infrastructure to implement cryptographic mechanisms and this is not convenient nor practical for many users. In this paper, we show how to secure E-health systems, mainly using fuzzy biometric E-health system using the identity based cryptographic techniques, without requiring certificates from the end-user. Figure 1: Overview of an E-health System. IBE scheme. In 1984, Shamir [41] introduced the concept of identity-based cryptography to ease the certificate management in traditional public key system. A user’s public key in an IBE scheme is the identity information of the user (e.g., email address). Hence the public key is implicitly authenticated and the certificate management is greatly simplified. 2 However, the first practical IBE scheme [8] was only proposed 17 years after its concept was proposed. Since then, many practical IBE schemes with different properties have been proposed [9, 40, 44, 18]. Until now, there are many interesting applications of IBE, but there is almost no work on how to apply them to the E-health system. Although we can see some work on using attribute based encryption (ABE) in the E-health system, but still there is no work concentrating on how to handle identities directly in these systems. If we can directly use some string such as the email address as the identity public key, then the workload of patients can be decreased significantly. We can see an overview on IBE in Fig. 2. In Fig. 2, Alice encrypted her health information usingidentity“[email protected]”todoctorBob, while doctor Bob requests his private key from the CA/PKG. Figure 2: Overview on IBE scheme. IBPRE scheme. The concept of proxy re-encryption (PRE) is proposed by Blaze et al. [7] in 1998, which allows a semi-trusted proxy, with some information (a.k.a., the re-encryption key), to translate a ciphertext under the delegator’s public key into another ciphertext, which can be decrypted by the delegatee’s secret key. However, the proxy cannot access the plaintext. According to the direction of transformation, PRE schemes can be classified into bidirectional and unidirectional schemes. Also, according to the times the transformation can apply to the ciphertext, PRE schemes can be classified into single-hop and multi-hop schemes. At NDSS’05, Ateniese et al. [1] proposed a few unidirectional PRE schemes and discussed its several potential applications such as distributed secure file systems. Later, many unidirectional PRE schemes with different properties have been proposed [24, 50, 43, 38, 14, 49]. Due to the simpler certificate management in IBE,Green and Ateniese [17] extended PRE to the IBE setting, i.e. identity based proxy re-encryption (IBPRE). They also discussed its several interesting applications such as bridging IBE and PKE.Sincethen,severalIBPRE schemes have been proposed [13, 31, 43, 37, 14, 51], but none of them, except [38, 14], can achieve master secret secure: the corrupted proxy and delegatee cannot derive the delegator’s private key. However, IBPRE schemes in [38] are generic constructions relying on CCA-secure 2-level hierarchical ID-based (2,2) threshold cryptosystem but they are inefficient. IBPRE schemes in [14] rely on conditional proxy broadcast re-encryption; they are also inefficient and can only achieve secure against replayable chosen ciphertext attacks (RCCA). We can see an overview on IBPRE in Fig. 3. In Fig. 3, a patient encrypts his/her health information using doctor’s identity “Doc- [email protected]” , and outsources the ciphertexts to the cloud. In the setup phase, the 3 Doctor has sent the re-encryption key to the proxy, and thus the proxy can re-encrypt the ciphertexts to be the ciphertexts under the assistant doctor’s identity “AssistantDoc- [email protected]” . By using IBPRE,theassistantdoctorsharesthepatient’shealth information without the cloud knowing about any sensitive information. Figure 3: Overview on IBPRE 1.1. Our Contribution In this paper, we show how to securely integrate the IBE and IBPRE schemes into an E-health cloud system, and thus exploring on how to use identity related cryptographic techniques for securing an E-health cloud system, especially on the confidential property. We also propose novel IBE and IBPRE schemes and prove their security. Although there exist many IBE schemes with different properties, however one part of the private key in all these IBE schemes is of the form: y=f(msk), where msk is the master key and yis an element in the underlying bilinear group G.Weconstructanewidentitybasedencryption scheme. The main novelty of our IBE is that: one part of the private key is y=f(msk), where msk is the master key and yis an element in ZZ∗ p.Here,pis the underlying bilinear group’s prime order. To resist the adversary to extract useful information on the master key from this part of the private key, we introduce some randomness in the private key. We prove this new IBE is IND-sID-CPA secure in the standard model based on a related DBDH assumption in the bilinear groups. Furthermore, we propose an IBPRE scheme on this new IBE scheme. This new IBPRE scheme does not follow Green’s paradigm on which almost all the existing efficient IBPRE schemes are based. The main novelty in this IBPRE is that, the re-encryption key is almost independent with the delegatee’s private key. As a result, our IBPRE can achieve master secret security.Finally,weanalysethesecurity of the proposed E-health cloud system and also show the performance of our IBPRE scheme, which is the critical part of the whole system. Indeed, our IBPRE scheme has a unique feature which almost no other IBPRE schemes have, that is, it is very efficient for re-encryption. Considering that re-encryption is the most often operation cloud systems implement for secure E-health system, and that this operation must be paid by data users 4 or data owners, our IBPRE scheme can be high cost-effective for E-health cloud system users. 1.2. Related Work Cryptographic Techniques for Securing E-health systems. Until now there are published several proposals on how to use cryptographic techniques for securing E-health systems, including using symmetric key and public key schemes, or pseudo anonymous ID technique, etc. A common belief on the security of E-health system is that the EHRs should be encrypted to protect security and privacy. Data, identifiers (pseudonyms), keys and data attributes (meta-data) are all needed to be encrypted before storing them on the central authority or outsourcing them to the cloud. Although the centralized facility or the employees of the cloud service providers are assumed to be prohibited from obtaining the information about the encrypted PHR, but that assumption could go into detriment of the whole system’s usability. How to establish the access control properly and to handle the key management problem effectively is of critical importance. Cryptographic techniques can also be used to enforce the secure access control mechanism or the key management properly [27, 28, 20, 33, 34]. Here, we discuss some results closely related to our proposals. Benaloh et al. [6] discussed how to use encryption for electronic medical records to ensure privacy by a new paradigm called patient controlled encryption. Li et al. [25, 26] discussed how to implement the fine-grained data access control in multiowner settings of patient-centric PHRs by using attribute based encryption (ABE). Barua et al. [5] also proposed a framework called ESPAC to handle the access control problem by using ABE.Guoet al. [19] proposed a privacy-preserving attribute-based authentication system for eHealth networks. Aleman et al. [3] reviewed carefully the literature on EHRs and discussed the current research state on security and privacy on E-health systems. IBE scheme. Here we start by recalling the IBE and FIBE schemes closely related to our work. At Crypto’01, Boneh and Franklin constructed the first practical identity based encryption based on bilinear groups [8] (BF IBE). In 2003, Sakai and Kasahara proposed a new identity based encryption with different structure based on bilinear groups (SK IBE) [40]. However, both of these works proved their security in the random oracle model. At Eurocrypt’04, Boneh and Boyen proposed two new efficient selective identity secure IBE schemes without random oracles (BB1IBE and BB2IBE) [9]. Later Boneh and Boyen [10], Waters [44] improved their work on IBE schemes with full security at Crypto’04 and Eurocrypt’05 (Waters’IBE). At Eurocrypt’06, Gentry proposed an efficient identity based encryption with tight security proofinthestandardmodelbutbasedonastrong assumption (Gentry’s IBE)[18]. AlltheexistingIBEs are based on three frameworks: “Full Domain Hash” framework, “ Exponent Inversion” framework and “Communicative Blinding” framework [11]. “Full Domain Hash” framework includes BF IBE,whichisproven secure in the random oracle and supports hierarchies and threshold variants. “Exponent Inversion” framework includes SK IBE,BB2IBE and Gentry’s IBE,whicharealwaysdifficult to support extensions. “Communicative Blinding” framework includes BB1IBE and Waters’IBE, which always support extensions like hierarchy IBE,thresholdIBE,fuzzyIBE, attribute based encryption and broadcast encryption. 5 IBPRE scheme. In ACNS’07, Green and Ateniese proposed the first identity based proxy re-encryption schemes [17]. They defined the algorithms and security models for identity based proxy re-encryption, and constructed their scheme by using a variant of the efficient Dodis/Ivan key splitting approach to settings with a bilinear map. The re-encryption key in their scheme is of the form (H1(Alice)−s·H(X), IBEBob(X)).Whentheproxyre-encrypts, it does some transformations and sends IBEBob(X) to the delegatee. And then, the delegatee decrypts IBEBob(X) to recover Xand uses this Xto recover the original message. In ISC’07, Chu and Tzeng proposed the first IND-CCA2 secure proxy re-encryption in the standard model based on Waters’ IBE [13]. They followed the paradigm proposed in [17] (denoted here it as Green’s paradigm). Unfortunately, Shao et al. found their scheme cannot achieve IND-CCA2 secure and they fixed this flaw by proposing an improved scheme [39]. However, both of these schemes are not efficient due to the structure of Waters’ IBE and Green’s paradigm. In Pairing’07, Matsuo proposed four types of proxy re-encryption: IBE to IBE, CBE to IBE, IBE to CBE and CBE to CBE. They constructed a hybrid proxy re-encryption scheme from CBE to IBE and a proxy re-encryption scheme from IBE to IBE. But recently it was shown that their proxy re-encryption scheme from IBE to IBE has some flaws [46]. In Inscrypt’08, Tang et al. proposed the new concept of inter-domain identity based proxy re-encryption [43]. They were concerned on constructing proxy re-encryption between different domains in identity based setting. They follow Green’s paradigm but based on Boneh-Frankin IBE. Their scheme can only achieve IND-sID-CPA secure. Later, Ibraimi et al. construct a type and identity based proxy re-encryption, which aimed at combing type and identity properties in one proxy re-encryption system [21]. Recently, Lai et al. [29] gave new constructions on IBPRE based on identity-based mediated encryption. Luo et al. [30] also gave a new generic IBPRE construction based on IBE.Wanget al. proposed the first multi-use CCA-secure unidirectional IBPRE scheme [45]. Until now, although there are some proposals on how to achieve attribute based proxy re-encryption, but there is almost no work on how to achieve fuzzy IBPRE scheme. 1.3. Paper’s Organization In Section 2, we give some preliminaries, including the assumptions, definitions and security models. In Section 3, we present the overview on our E-health system model, propose our schemes and analyse their security. In Section 5, we give the performance analysis on our proposed IBPRE scheme, which is a critical part of our E-health system. Finally, we conclude our paper in the last Section 6. 2. Preliminaries 2.1. Bilinear Groups Let Gbe an algorithm called a group generator that takes as input a security parameter λand outputs a tuple (G, GT,e)whereGand GTare two cyclic groups of order p,ande is a function e:G×G→GTsatisfying the following properties: 6 •(Bilinear) ∀u, v ∈G,∀a, b ∈Z, e(ua,vb)=e(u, v)ab •(Non-degenerate) ∃g∈Gsuch that e(g,g)hasorderpin GT. We assume that the group action in Gand GTas well as the bilinear map eare all computable in polynomial time in λ.Furthermore,weassumethatthedescriptionofG and GTincludes a generator of Gand GTrespectively. 2.2. EXDBDH1 Assumption EXDBDH1 assumption extends the DBDH assumption in the prime order bilinear group. Definition 1. Run Gto obtain (G,GT,e). Next it generates gas generators of G.On input (g,ga,gb,gc, g(b+c)d,gd,T), for any probabilistic polynomial time algorithm Acannot distinguish T= e(g,g)abd from a random element in Gwith non-negligible probability, this is the EXDBDH2 assumption. We note that the assumption is a falsifiable assumption [32]. Intuitively, there is no gab,gad,gbd, hence the pairing cannot help to solve the decisional problem. 2.3. Definition and Security Notion for IBE An IBE scheme consists of the following algorithms. Setup(1k). On input a security parameter, outputsboththemasterpublicparameters params which are distributed to users, and the master key msk which is kept private. KeyGen(msk,params,ID). On input an identity ID ∈{0,1}∗and the master secret key msk,outputsadecryptionkeyskID corresponding to that identity. Encrypt(ID,params,m). On input a set of public parameters, an identity ID ∈{0,1}∗ and a plaintext m∈M, outputs CID,theencryptionofmunder the specified identity. Decrypt(skID,params,CID).DecryptstheciphertextCID using the secret key skID, and outputs mor ⊥. We recall the IND-sID-CPA security in [9]. It is defined using the following game: Init: The adversary outputs an identity ID∗where it wishes to be challenged. Setup: The challenger runs the Setup algorithm. It gives the adversary the resulting system parameters params. It keeps the master key to itself. 7 Phase1: The adversary issues q1···qmwhere qiis one of private key query IDiwhere IDi=ID∗.ThechallengerrespondsbyrunningalgorithmKeyGen to generate the private key dicorresponding to the public key IDi.Itsendsdito the adversary. These queries maybe asked adaptively, that is, each query qimay depend on the replies to q1,···,q i−1. Challenge: Once the adversary decides that Phase1 is over it outputs two equal length plaintexts M0,M 1∈Mon which it wishes to be challenged. The challenger picks a random bit b∈{0,1}and sets the challenge ciphertext to C=Encryption(params,ID∗,Mb). It sends Cas the challenge to the adversary. Phase2: The adversary issues additional queries qm+1 ···qnwhere qiis one of private key queries IDiwhere IDi=ID∗.ThechallengerrespondsasinPhase1.These queries maybe asked adaptively as in Phase1. Guess: Finally, the adversary outputs a guess b′∈{0,1}. The adversary wins if b=b′. We refer to such an adversary Aas an IND-sID-CPA adversary. We define the advantage of the adversary Ain attacking the scheme Eas Advϵ,Aa =|Pr[b=b′]−1 2|, The probability is over the random bits used by the challenger and the adversary. If this probability is negligible, then we say scheme Eis IND-sID-CPA secure. 2.4. Definition and Security Notion for IBPRE An identity based (single-hop) proxy re-encryption scheme consists of the algorithms (Setup, KeyGen, Encrypt, Decrypt, ReKeygen, Reencrypt): Setup(1k). On input a security parameter, outputsboththemasterpublicparameters params,whicharedistributedtousers,andthemasterkeymsk which is kept private. KeyGen(params,msk,ID). On input an identity ID ∈{0,1}∗and the master secret key msk,outputsadecryptionkeyskID corresponding to that identity. Encrypt(params,ID,m). On input a set of public parameters, an identity ID ∈{0,1}∗ and a plaintext m∈M,outputsthesecondlevelciphertextCID,whichcanbereencrypted by the proxy. ReKeygen(params,skID1,ID2). On input secret key skID1,andidentitiesID2∈ {0,1}∗,thedelegatornon-interactivelygeneratesthere-encryptionkeyrkID1→ID2 and outputs it. Reencrypt(params,rkID1→ID2,CID1). On input a second level ciphertext CID1under identity ID1,andare-encryptionkeyrkID1→ID2,outputsafirstlevelre-encrypted ciphertext CID2which can not be re-encrypted. Decrypt2(params,skID,CID). On input a second level ciphertext CID under identity ID with secret key skID,decryptstheciphertextCID, and outputs mor ⊥. 8 Decrypt1(params,skID,CID). On input a first level re-encrypted ciphertext CID under identity ID with secret key skID,decryptsthere-encryptedciphertextCID,and outputs mor ⊥. Correctness: Intuitively, an IBPRE is correct if the Decrypt algorithm always outputs the expected decryption of a properly generated ciphertext. Slightly more formally, let cID1←Encrypt(params, ID1,m)beaproperlygeneratedciphertext,Then∀m∈ M,∀ID1,ID 2∈{0,1}∗,whereskID1=KeyGen(msk, ID1), skID2=KeyGen(msk, ID2), rkID1→ID2←ReKeygen(params, skID1,ID 1,ID 2), the following propositions hold: •Decrypt(params, skID1,cID1)= m •Decrypt(params, skID2,Reencrypt(params,rkID1→ID2,cID1))=m IND-ID-CCA Security for the Second Level Ciphertext.. IND-ID-CCA Security for the second level ciphertext is defined according to the following game. Setup. Run Setup(1k)to get (params,msk), and give params to A. Find phase. Amakes the following queries. At the conclusion of this phase Awill select ID∗∈{0,1}∗and (m0,m 1)∈M 2. 1. For A’s queries to extract oracle Oextract with (extract, ID), return skID =KeyGen( params,msk,ID)toA. 2. For A’s queries to re-encryption key extract oracle Orkextract with (rkextract,ID1,ID 2), where ID1=ID2,returnrkID1→ID2=ReKeygen(params,KeyGen(params,msk,ID1),ID2) to A. 3. For A’s queries to re-encrypt oracle Oreencrypt with (reencrypt, ID1,ID 2,C), derive a re-encryption key rkID1→ID2=ReKeygen(params,KeyGen(params,msk,ID1),ID2), and return C′=Reencrypt(params,rk ID1→ID2,ID 1,ID 2,C)toA. 4. For A’s queries to the first level ciphertext decrypt oracle O1decrypt with (decrypt, ID, C) where Cis a first level ciphertext, return m=Decrypt1(params,KeyGen(params,msk, ID),C)toA. Note that Ais not permitted to choose ID∗such that trivial decryption is possible using keys extracted during this phase (e.g., by using extracted re-encryption keys to translate from ID∗to some identity for which Aholds a decryption key). Also note that the second level ciphertext decrypt oracle O2decrypt is no use here, for any second level ciphertext can be first re-encrypted and then be queried to the O1decrypt to get the decryption result. Choice and Challenge. When Apresents (choice, ID∗,m 0,m 1), choose i←R{0,1},compute C∗=Encrypt(params,ID∗,mi) and give C∗to A. Guess stage. Acontinues to make queries as in the find stage, with the following restrictions. Let C=(C∗,ID∗). For all rk given to A, let C′be the set of all possible values 9 Phase 2.Aissues private key query on IDias he does in Phase 1 except IDi=ID∗. Guess. Finally, Aoutputs a guess b′∈{0,1}. Algorithm Bconcludes its own game by outputting a guess as follows. If b=b′,thenBoutputs 1 meaning T=e(g,g)abd. Otherwise it outputs 0 meaning T=e(g,g)abd. When T=e(g,g)abd then A’s advantage for breaking the scheme is the same as B’s advantage for solving EXDBDH problem. 4.3. New Identity Based Proxy Re-encryption 1. Setup(1k). Run G(1n) to obtain (G,GT,e)withG. Next it generates gas generators of G. It chooses a one time signature scheme Sand an IND-CCA2 symmetric encryption SE.ItalsochoosesthreehashfunctionsG:{0,1}∗→ZZ∗ p2,H1:S→G where Sis the one time signature scheme’s public key svk’s space, H2:GT→K where Kis the SE’s key space. We also assume messages to be encrypted are elements in GT.Selectrandomα, t1,t 2,t 3and compute (g1,g 2,g 3,h)asthesameas those in our IBE scheme, select random s, s′∈ZZpand compute A=gs, that is params =(g,g1,g 2,g 3,h,A,p,G,GT,e,H,H 1,H 2,G,SE,S), msk =(α, s, s′,t 1,t 2,t 3) 2. KeyGen(msk,params,ID). Given msk =(α, t1,t 2,t 3)andID with params,the PKG picks random x, y, x′,y′,N,n,n ′,z∈ZZ∗ p,computesuID =sG(ID) and outputs the private key skID associated with ID skID =(dA ID,d B ID,d C ID) dA ID =(d1,d 2,d 3,d 4,d 5,d 6) =(α+x αID +t2 +ymod p, gx(gID 1h)y, gx 3(gID 1h)−N,gy 3gN,A ygn,A x(gID 1h)−n) dB ID =(d′ 1,d ′ 2,d ′ 3) =(t2+x′ αID +t2 +y′mod p, Ay′gn′,A x′(gID 1h)−n′gs′) dC ID =(d7,d 8) =(gα 2(gID 1h)uID gzG(ID),gzG(ID)gs′G(ID)) 3. Encrypt(ID,params,M). To encrypt a message M∈GTunder the public key ID ∈ZZ∗ p,pickarandomr∈ZZ∗ p, a one time signature instance with public/private keys (svk, ssk), compute CID =(C1,C 2,C 3,C 4,C 5,C 6,C 7) =(gr,(g2g3)r,(gID 1h)r,SE.Enc(H2(e(g1,g 2)r),M),H 1(svk)r,svk,σ) where σ=S.sig(ssk, C1,C 2,C 3,C 4,C 5,C 6). 2Gmaps the identity to ZZ∗ pwhich can be used to identify different IBE users. 16 4. ReKeygen(dID ,params,ID′). Choose randomly k3∈ZZ∗ p,generatethere-encryption key rkID→ID′as following rkID→ID′=(rk1,rk 2,rk 3,rk 4) rk1=1 k3 (d1·ID′+d′ 1)modp =1 k3 ((αID′+xID′+t2+x′) αID +t2 +yID′+y′)modp =(αID′+t2+k1) k3(αID +t2)+k2mod p rk2=Ak3·G(ID′)=gk3·s·G(ID′)=gk3uID′ rk3=(dID′ 5d′ 2)G(ID′)=g(s·(yID′+y′)+(nID′+n′))·G(ID′) =gs·(yID′+y′)·G(ID′)g(nID′+n′)G(ID′) =gk2k3uID′g(nID′+n′)G(ID′) rk4=(dID′ 6d′ 3)G(ID′) =gs·(xID′+x′)·G(ID′)gs′G(ID′) (gID 1h)(nID′+n′)G(ID′) where k1=xID′+x′,k 2=yID′+y′ k3 5. Reencrypt(rkID→ID′,params,CID,ID′). Given ciphertext CID =(C1,C 2,C 3,C 4,C 5,C 6,C 7), first check CID’s validity: S.Verify(C6,C 7)=Yes,e(g,C5)=e(C1,H 1(C6)) if these conditions are not satisfied, then return ⊥,elsecompute ! CID′=(C′ 1,C′ 2,C′ 3,C′ 4,C′ 5,C′ 6,C′ 7)ID′ =(C1,C 2,C 3,C 4,e(Crk1 3,rk 2),rk 3,rk 4) 6. Decrypt2(skID,params,CID). Given ciphertext CID =(C1,C 2,C 3,C 4,C 5,C 6,C 7) and the secret key skID =(dA ID,d B ID,d C ID)wheredA ID =(d1,d 2,d 3)withparams,first check CID’s validity: S.Verify(C6,C 7)=Yes,e(g,C5)=e(C1,H 1(C6)) if these conditions can not be satisfied, then return ⊥,elsecompute K=H2(e(g2,Cd1 3)e(C1,d 3)e(C3,d 4) e(C2,d 2)), M=SE.Dec(K, C4) and finally check M’s validity by using SE’s IND-CCA2 property. 17 7. Deccrypt1(skID,params,! CID). Given the re-encrypted ciphertext ! CID =(C′ 1,C′ 2,C′ 3,C′ 4,C′ 5, C′ 6,C′ 7)ID with dC ID =(d7,d 8)withparams,decryptthere-encryptedciphertextas K=H2(e(C′ 3,C′ 6)e(C′ 1,C′ 7)e(C′ 1,d 7) C′ 5e(C′ 2,d 8)), M=SE.Dec(K, C′ 3) and finally check M’s validity by using SE’s IND-CCA2 property. Correctness: Assume the re-encrypted ciphertext is ! CID =(C′ 1,C′ 2,C′ 3,C′ 4,C′ 5,C′ 6,C′ 7)ID, which results from re-encrypting from IDxto ID by using rkIDx→ID.Wecanverifythe correctness of Deccrypt1(skID,params,! CID)asfollowing T=e(C′ 3,C′ 6)e(C′ 1,C′ 7)e(C′ 1,d 7) C′ 5e(C′ 2,d 8) =e(C′ 3,rk 3)e(C′ 1,rk 4)e(C′ 1,d 7) C′ 5e(C′ 2,d 8) =e((gIDx 1h)r,guIDk2k3g(nID+n′)G(ID)) e(gk3uID ,(gIDx 1h)r(αID+t2+k1 k3(αIDx+t2)+k2)) · e(gr,gk1uID gs′G(ID′) (gIDx 1h)(nID+n′)G(ID))e(gr,gα 2(gID 1h)uID gzG(ID)) e(gr,(gzgs′)G(ID)) =e((gIDx 1h)r,guIDk2k3g(nID+n′)G(ID)) e(gr,(gIDx 1h)(nID+n′)G(ID)) ·1 e(gk3uID ,(gIDx 1h)r(αID+t2+k1 k3(αIDx+t2)+k2)) ·e(gr,gk1uID )e(gr,gs′G(ID))e(gr,gα 2(gID 1h)uID gzG(ID)) e(gr,gzG(ID))e(gr,gs′G(ID)) =e((gIDx 1h)r,guIDk2k3)e(gr,gk1uID ) e(gk3uID ,(gIDx 1h)k2r)e(gk3uID ,(gID 1h) r k3)=e(gα 2,gr)e(gα 2(gID 1h)uID ,gr)e(gzG(ID),gr) e(gk3uID ,g k1r k3)e(gr,gzG(ID)) K=H2(T),M=SE.Dec(K, C′ 3) 4.4. Security Analysis for IBPRE Theorem 2. Suppose the EXDBDH assumption holds in (G,GT,e),SE is IND-CCA2 secure and Sis strongly unforgeable, then our IBPRE scheme is IND-sID-CCA2 secure for the second level ciphertext. Proof. Suppose Acan attack our scheme, we construct an algorithm B(or simulator B) solves the EXDBDH problem in (G,GT,e). Before describing B,wefirstdefineaneventFOTS and bound its probability to occur. Let C∗=(C∗ 1,C∗ 2,C∗ 3,C∗ 4,C∗ 5,svk∗,σ∗)denotethechallengeciphertextgiventoAin the game. Let FOTS be the event that, Aissues a decryption queryforare-encryption query C∗=(C1,C 2,C 3,C 4,C 5,svk∗,σ)where(C1,C 2,C 3,C 4,C 5)=(C∗ 1,C∗ 2,C∗ 3,C∗ 4,C∗ 5) but σ=σ∗and S.Verify(σ, svk∗,(C1,C 2,C 3,C 4,C 5)) = Yes.Inthe“find”stage,A 18 has simply no information on svk∗.Hence,theprobabilityofapre-challengeoccurrence of F does not exceed qO·δif qOis the overall number of oracle queries and δdenotes the maximal probability (which by assumption does not exceed 1/p) that any one-time verification key svk is output by S.Inthe“guess”stageFOTS clearly gives rise to an algorithm breaking the strong unforgeability oftheone-timesignature. Therefore,the probability Pr[FOTS]≤qO p+AdvOTS3must be negligible by assumption. On input (g,ga,gb,gc,g(b+c)d,gd,T), algorithm B’s goal is to output 1 if T=e(g,g)abd and 0 otherwise. Let g1=ga,g 2=gb,g 3=gc, that is, t1=a, t2=b, t3=c.Itchoosesa one time signature scheme Sand an IND-CCA2 symmetric encryption SE. It also chooses H,H1,H 2,Gas in the scheme. Bworks by interacting with Ain a selective identity game as follows: Initialization.The selective identity game begins with Afirst outputting an identity ID∗that it intends to attack. Setup.Togeneratethesystem’sparameters,algorithmBpicks α′∈ZZ∗ pat random and defines h=g−ID∗ 1gα′∈G.Italsopicksrandomw,r,s′∈ZZ∗ p,defines s=r−bw and A=gs=gr−bw =gr gw 2. It gives Athe parameters params = (g,g1,g 2,g 3,h,A,H,H 1,H 2,G,SE,S). Note that the corresponding master key, which is unknown to B, is a. Phase 1. 3AdvOT S denotes the probability of breaking strong unforgeability of the one-time signature. 19 1. Aissues private key query on ID to Oextract.Breturns dsim 1=1 (ID −ID∗)+ymod p =a+x aID −aID∗+α′+ymod p =a+x aID +t2 +ymod p dsim 2=(g)(α′ ID−ID∗)(ga)y(ID−ID∗)(g)y =gx(ga(ID−ID∗)g)y=gx(gID 1h)y dsim 3=(gc)(α′ ID−ID∗)((ga)ID−ID∗gα′)−N =gcx(gID 1h)−N=gx 3(gID 1h)−N dsim 4=(gc)ygN=gy 3gN dsim 5=Aygn, dsim 6=Aα′ ID−ID∗gα′)−n((ga)ID−ID∗gα′)−n =Ax(gID 1h)−n d′sim 1=−ID∗ (ID −ID∗)+y′mod p =a(−ID∗)+α′+aID +x′ aID +α′−aID∗+y′mod p d′sim 2=Ay′gn′, d′sim 3=A(−ID∗)α′ ID−ID∗−α′((ga)ID−ID∗gα′)−n′gs′ =Ax′(gID 1h)−n′gs′ dsim 7=(gb)−α′wG(ID)((ga)(ID−ID∗)gα′)rG(ID)gz′G(ID) =g−α′wG(ID) 2(g(ID−ID∗) 1gα′)rG(ID)gz′G(ID) =ga(ID−ID∗)wG(ID) 2(g(ID−ID∗) 1gα′)(r−bw)G(ID)gz′G(ID) =ga 2(g(ID−ID∗) 1gα′)(r−bw)G(ID) ·ga(ID−ID∗)wG(ID)−a+z′G(ID) =ga 2(gID 1h)sG(ID) ·ga(ID−ID∗)wG(ID)−a+z′G(ID) =ga 2(gID 1h)sG(ID)gzG(ID) dsim 8=(ga)((ID−ID∗)wG(ID)−1)gz′G(ID)gs′G(ID) =ga(ID−ID∗)wG(ID)−a+z′G(ID)gs′G(ID) =gzG(ID)gs′G(ID) where x=α′ ID−ID∗mod p, x′=(−ID∗)α′ ID−ID∗−α′mod p,y,y′,N,n,n ′,z′randomly 20 chosen from ZZ∗ p,andz=a(ID −ID∗)w−a G(ID)+z′holds. We can verify (dsim 1,d sim 2,···,d sim 8) is a valid private key for ID. We call this simulation as “Normal Simulation”. 2. Aissues rekey generation queries on (ID,ID′)to re-encryption key extract oracle Orkextract. (a) ID =ID∗, in this case, ID′can be any identity. The simulator Bfirst simulates KeyGen(msk, params, ID)as above and gets skID. Then it runs ReKeygen(skID, params, ID′), and returns the result rkID→ID′to the adversary. (b) ID =ID∗, in this case, ID′can not be a corrupted identity. The simulator Buses some other technique to generate the re-encryption key. The simulator can generate the valid re-encryption key as following dsim 1=k α′+ymod pn =a+k−a aID∗+α′−aID∗+ymod p dsim 2=gk (ga)gα′y =gk−a(gα′)y=gx(gID∗ 1h)y dsim 3=(gc)k gac (gc)α′y=gc(k−a)(gc)α′y =gt3(k−a)(gα′)t3y=gt3x(gID∗ 1h)t3y dsim 4=Aygn, dsim 5=Ak−a(gID∗−ID∗ 1gα′)−n =Ax(gID∗−ID∗ 1gα′)−n d′sim 1=α′+k′ α′+y′mod p =a(−ID∗)+α′+aID∗+k′ aID∗+α′−aID∗ +y′mod p d′sim 2=Ay′gn′ d′sim 3=AaID∗+k′gm′(g2g3)s′ =Ax′gm′(g2g3)s′ d′sim 4=(gID∗−ID∗ 1gα′)n′gm′=(gα′)n′gm′ 21 dsim 7=(gb)−α′wG(ID∗) ·((ga)(ID∗−ID∗)gα′)rG(ID∗) ·(gb)z′G(ID∗)(gac)((ID∗−ID∗)wG(ID∗)−1) ·(gc)z′G(ID∗) =ga 2(gID∗ 1h)sG(ID∗) (g2g3)−a+z′G(ID∗) =ga 2(gID∗ 1h)sG(ID∗)(g2g3)zG(ID∗) dsim 8=(ga)((ID∗−ID∗)wG(ID∗)−1) ·gz′G(ID∗)=g−a+z′G(ID∗) =gzG(ID∗) where x=k−a, x′=aID∗+k′,herek,k′,y,y′,n,n ′,m,m ′,z′randomly chosen from ZZ∗ p,andz=−a G(ID∗)+z′holds. After Bgenerates private key for ID∗, it runs ReKeygen(sksim ID∗,params, ID′)withsksim ID∗,andreturnstheresultrkID∗→ID′to the adversary. We call this simulation as “Special Simulation”. 3. Aissues re-encryption queries on (CID,ID, ID′)to re-encrypt oracle Oreencrypt.Bfirst runs rkID→ID′=ReKeygen(skID,params,ID′), then runs Reencrypt(rkID→ID′,C ID,ID,ID′)andreturnstheresulttotheadversary. 4. Aissues decryption queries on ( ! CID′,ID′)to the first level ciphertext decrypt oracle O1decrypt under the only condition ( ! CID′,ID′)=Derivative(C∗ ID∗,ID∗) where Derivative defined in 2.4. (a) ID′=ID∗,Bfirst simulates KeyGen(msk, params, ID′)as in “Normal Simulation” 1, then runs Decrypt1(skID′, ! CID′) and returns the result to the adversary. (b) ID′=ID∗,Bfirst simulates KeyGen(msk, params, ID∗)as in “Special Simulation” 2b, then runs Decrypt1(skID∗,! CID∗) and returns the result to the adversary. Challenge.WhenAdecides that Phase 1 is over, it outputs two messages M0,M 1∈G, Bpicks a random bit b, a one time signature instance with public/private keys (svk, ssk), and responds with the ciphertext C∗=(C∗ 1,C∗ 2,C∗ 3,C∗ 4,C∗ 5, C∗ 6,C∗ 7)=(gd,g(b+c)d,(gα′)d,SE.Enc (T,Mb),H 1(svk)r,svk,σ)whereσ=S(ssk, C∗ 1, C∗ 2,C∗ 3,C∗ 4,C∗ 5,C∗ 6). Hence if T=e(g,g)abd,thenC∗is a valid encryption of Mb under ID∗. Otherwise, C∗is independent of bin the adversary’s view. Phase 2.Aissues queries as he does in Phase 1 except natural constraints. 22 Guess. Finally, Aoutputs a guess b′∈{0,1}. Algorithm Bconcludes its own game by outputting a guess as follows. If b=b′,thenBoutputs 1 meaning T=e(g,g)abd. Otherwise it outputs 0 meaning T=e(g,g)abd. When T=e(g,g)abd then A’s advantage is the same as B’s advantage for solving EXDBDH problem. Theorem 3. Suppose the EXDBDH assumption holds in (G,GT,e)and SE is IND-CCA2 secure, then our IBPRE scheme is IND-sID-CCA2 secure for the first level ciphertext. Proof. Following the same idea in the proof of theorem 2, we can prove this theorem, except this time the simulator needs to simulate re-encryption key on (ID∗,ID′)whereID′ is a corrupted identity. The simulator handles this query as following: it generates the private key for ID∗as in “Special Simulation” 2b. And runs ReKeygen(sksim ID∗,params,ID′) with sksim ID∗, returns the result to the adversary. Now even if the adversary gets the simulated private key for ID′as in 1, it can not get any useful information from these keys because they are independent with sksim ID∗, that is, (x, x′,y,y′,n ′,n ′,z′)ID′for any ID′are independent with (k,k′,y,y′,n,n ′,z′)ID∗. We follow the way in [9] of using H(ID)4instead of ID to achieve full security for our IBPRE scheme. Theorem 4. In the standard model, let Ebe our IBPRE scheme, if it is a (t, qs,ϵ)-selective identity secure IBPRE system (IND-sID-CCA2). Suppose Eadmits Ndistinct identities. Then Eis also a (t, qs,Nϵ)-fully secure IBPRE (IND-ID-CCA2). Proof. The proof is directly following the proof for the similar theorem in [9], we omit it here due to space limitation. Theorem 5. Suppose the EXDBDH assumption holds in (G,GT,e),SE is IND-CCA2 secure and Sis strongly unforgeable, then our IBPRE scheme can achieve master secret security. Proof. As shown in [24], CCA2 security for the first level ciphertext implies the master secret security, thus our IBPRE scheme can achieve master secret security. Here we compare our IBPRE’s scheme’s security with other IBPRE schemes [17, 13, 31], In Table 2, we denote W/O Random Oracle as with/without random oracle. Note here Luo et al.’s IBPRE scheme is a generic construction, therefore their scheme can be in random oracle and standard model, and the underlying assumption can be various, but their generic construction is less efficient than our scheme. Also note that our IBPRE’s security also rely on the underlying symmetric encryption scheme’s IND-CCA2 security. From the above table, we can conclude that our scheme is a new result on IBPRE.Our scheme can achieve master secret secure and is based on a novel IBE while all previous efficient IBPRE schemes are based on the traditional IBE. 4The space of H(ID) is N. 23 Table 2: IBPRE Security Comparison Scheme Security W/O Random Oracle Assumption Master Secret Secure Underlying IBE GA07A [17] IND-ID-CPA Random Oracle DBDH BF IBE GA07B [17] IND-ID-CCA Random Oracle DBDH BF IBE M07B [31] IND-ID-CPA Standard Model DBDH BB1IBE CT07 [13] IND-ID-CPA Standard Model DBDH Waters’ IBE SXC08 [39] IND-ID-CCA Standard Model DBDH Waters’ IBE LZD+10 [29] IND-ID-CCA Standard Model DBDH Waters’ IBE WCW10 [45] IND-ID-CCA Random Oracle DBDH Variant of BF IBE LHC10 [30] IND-ID-CPA Generic Generic Generic Ours4.3 IND-ID-CCA Standard Model EXDBDH New IBE 4.5. Security Analysis of Our E-health System Here we briefly show that our schemes satisfy the security objectives of the E-health system. 1. For the patients, the physician group, and the community health service group, they use our proposed IBE to encrypt the EHRs, thus can achieve IND-ID-CPA or IND-ID-CCA security. 2. For the physician group which run the proxy re-encryption mechanism, his secret key can not be derived by the proxy and the delegatee, for our IBPRE scheme can achieve master secret security. His normal ciphertexts and re-encrypted ciphertexts can also achieve IND-ID-CPA or IND-ID-CCA security, for our IBPRE scheme has been proved IND-ID-CPA or IND-ID-CCA secure for the first level and the second level ciphertexts. 5. Performance Analysis In this section, we give our performance analysis, basically we concentrate on the IBPRE’s performance, for it is the critical part of our E-health system, especially, the re-encryption is the most used operation. Our IBE scheme are almost share the same efficiency with existing BB1or BB2IBE.WecomparedourIBPRE with other IBPRE schemes [17, 13, 31]. Notations: In Table 3, we denote Enc as encryption, Reenc as re-encryption, Dec as decryption, Ciph as ciphertext and Ciph-Len as ciphertext length, tp,teand tme represent the computational cost of a bilinear pairing, an exponentiation and a multi-exponentiation respectively. tse,tsd and tsv represent the computational cost of once symmetric encryption, once symmetric decryption and once symmetric checking decryption results’ validity. tsand tvrepresent the computational cost of a one-time signature signing and verification respectively. |G|and |GT|denote the bit-length of an element in groups Gand GT respectively. Here Geand GTare the prime order bilinear groups. |SE|denotes the bit length of once symmetric encryption. Finally, |vk|and |s|denote the bit length of the one-time signature’s public key and a one-time signature respectively. Note here our first level ciphertext maps second level ciphertext and second level ciphertext maps first level ciphertext in [17, 13]. Also note here GA07 and CT07 are 24 multi-hop IBPRE schemes but we just consider their single-hop variant. Here we omit the comparison between our IBPRE with SXC08 [39], LZD+10 [29], WCW10 [45], LHC10 [30] schemes, for the following reasons: SXC08 [39], LZD+10 [29] schemes are based on Waters’ IBE, which make their schemes have large parameters; WCW10 [45] scheme can not achieve master secret secure and is only proved secure in the random oracle model; LHC10 [30] scheme is a generic construction. Table 3: IBPRE Efficiency Comparison Scheme Enc Check Reenc Dec Ciph-Len 1stCiph 2ndCiph 1stCiph 2ndCiph GA07B [17] 1tp+1te2tp2te+2tp1te+2tp2te+2tp1|G|+1|Ge|1|G|+1|GT| +2|m|+|id|+1|Ge|+|m| LZD+10 [29] 5te6tp6te24tp8tp13|G|+1|GT|4|G|+1|GT| WCW10 [45] 5te4tp2tp1te+2tp1te+4tp2|G|+1|GT|4|G|+1|GT| +|m|+|id| |id|+|m| Ours 4.3 2te+2tme 1tv+2tpte+tp2tp+1tsd 5tp+1tsd 5|G|+1|GT|4|G|+1|s| +1ts+1tse +1tsv +1|SE|+1|vk|+1|SE| From the above table, we can conclude that our scheme seems to be a more directly construction of IBPRE for its re-encryption key is operated on the exponent instead of on the underlying group. Our scheme is particularly efficient for the cloud, especially for the IND-ID-CPA variant of our scheme. Compared with other IND-ID-CCA secure and master secret secure IBPRE schemes [17, 29], our scheme also has the high efficiency for the re-encryption process. Thus our scheme can greatly reduce the payment cost for the whole E-health cloud system users. To further demonstrate our scheme’s efficiency, we roughly evaluated its practical performance. We give the performance comparison results for GA07B, LZD+, WCW and Our schemes, according to the Benchmark of the famous JPBC library [4] based on TestBed 1 (Intel(R) Core(TM)2 Quad CPU Q6600 @2.4GHZ, 3GB Ram, Ubuntu 10.04). We have neglected some operations such as the computation cost of one-time symmetric encryption, one-time symmetric decryption and one-time checking for the decryption results’ validity, one-time signature and verification. We choose type A pairings in JPBC and using the pairing preprocessing technique. We get the following computation cost comparison results from Figure 4,5,6,7,8, from which we can see our scheme is the most efficient scheme for checking and re-encryption process, while also remains among the most efficient ones for encryption, first level decryption and second level decryption. Note the cloud implements lots of re-encryption process for data sharing among users of E- health system, thus our scheme is the most efficient one for the cloud and can achieve cost-effective compared with other schemes. 6. Conclusion In this paper, we have discussed how to integrate the IBE,IBPRE identity related techniques into a E-health cloud system to achieve its confidential property. We have 25