{'fraction_non_alphanumeric': 0.03733096874307249, 'fraction_numerical': 0.011438705386832188, 'mean_word_length': 4.488077858880779, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Accountable Attribute-based Encryption with Public Auditing and User Revocation in the Personal Health Record System

In the system of ciphertext policy attribute-based encryption (CP-ABE), only when the attributes of data user meets the access structure established by the encrypter, the data user can perform decryption operation. So CP-ABE has been widely used in personal health record system (PHR). However, the problem of key abuse consists in the CP-ABE system. The semi-trusted authority or the authorized user to access the system may disclose the key because of personal interests, resulting in illegal users accessing the system. Consequently, aiming at two kinds of existing key abuse problems: (1) semi-trusted authority redistributes keys to unauthorized users, (2) authorized users disclose keys to unauthorized users, we put forward a CP-ABE scheme that has authority accountability, user traceability and supports arbitrary monotonous access structures. Specifically, we employ an auditor to make a fair ruling on the malicious behavior of users. Besides, to solve the problem of user leaving from the system, we use an indirect revocation method based on trust tree to implement user revocation. Compared with other existing schemes, we found that our solution achieved user revocation at an acceptable time cost. In addition, our scheme is proved to be fully secure in the standard model.


Introduction
Due to the high flexibility and scalability of cloud computing, many businesses and individuals rely on cloud servers to store and calculate their data [1][2][3][4][5]. Today, cloud computing technology is relatively mature and widely used. In this way, they can not only save money, but also improve efficiency. The cloud server is not completely trusted, so the data now placed on the cloud are all in ciphertext [2,6]. Take a PHR system as an example, patients upload their own personal medical records to the PHR system, through which doctors know the patient's medical records and make a rapid diagnosis. This method not only saves patients' time and money, but also improves the efficiency of diagnosis for doctors. A PHR system based on traditional encryption scheme is shown in Fig. 1. However, the traditional encryption scheme can not provide fine-grained access control, which greatly limits the application of PHR system [4,7]. Therefore, many secure PHR systems [8][9][10][11][12] are built based on attribute-based encryption (ABE). ABE is regarded as the most compelling encryption primitive that realizes fine-grained [1,13] access control, solving the problem of one-to-many secret data sharing. In ABE, users have a series of attributes to identify themselves. Only if these attributes they own meet the access policy, users can decrypt the ciphertext. In a PHR system, the patient's medical records are encrypted by ABE, and the fine-grained access control to the encrypted medical records is realized. As the PHR system has high requirements for data privacy and security, and the patient's records stored in the system is of great value, there are often illegal users maliciously divulging the data in the system for their own interests. Specifically, there are two categories of key abuse problems in CP-ABE. (1) Driven by personal interests, authorized users may reveal their private keys to illegal users [6,14]. (2) The semi-trusted authority may redistribute the private keys to unauthorized users for the same reason. In order to solve the problem of key abuse, accountable ABE is proposed. In addition, it is common for patients to exit from the system. So how to revoke the user efficiently is also a research hotspot in ABE. Revocable ABE arises at the historic moment. In this paper, we aim to implement an accountable and full secure ABE scheme in the personal health system, which can publicly audit traceable users and support the revocation of malicious users. The patient's personal health records are encrypted and placed on the cloud server. Patients make access policies to allow specific people to access their health records. If there is malicious behavior that the user leaks the patient's medical records, it can be traced according to the identity-related information contained in the ciphertext. In order to ensure the security of the system, the system access rights of malicious users are reclaimed by indirect revocation. The proposed scheme is based on the personal health medical record system, which greatly protects the privacy of patients and the security of the system.

Related Work
ABE is evolved from fuzzy identity-based encryption [15]. After that, many ABE schemes were put forward to improve performance and security. In this chapter, we mainly talk about the relevant work to handle the matters of key abuse and user revocation.

Accountability
Due to the matter of key abuse in CP-ABE, accountability has become one of the criteria to measure the practicability of the scheme. The first key accountable ABE scheme was put forward in [16], whereas only supports the access policy expressed by "AND gate and wildcard". Constructing a traceable CP-ABE scheme is an adequate means to settle the matter of key abuse. There appeared two kinds of traceability: white-box traceability as well as black-box traceability. In 2013, black-box traceable CP-ABE [17] as well as white-box traceable CP-ABE [18] are put forward, and support monotonous access structure. A multi-authority CP-ABE syetem is brought forward by Li et al. [19]. Although the above two schemes are achieved under prime order groups, they only support the access structure of multi-valued "AND" gates with wildcards, and only achieve the selective security under the standard model, so the expression ability and security of access policies are relatively weak. The constructions in [17][18][19][20][21]only implements user traceability, but does not realize authority accountability. Ning et al. [22] proposed an attribute-based encryption scheme which supports both user traceability and authority accountability for the first time. The scheme in [23] allows the key generation center (KGC) and the attribute authority (AA) to jointly generate the user's private key, thus ensuring that KGC and AA cannot distribute the user's private key to unauthorized users. However, the scheme does not solve the problems of user key abuse and user revocation. Ning et al. [24] proposed a fully secure white-box traceable CP-ABE system for the first from non-interactive commitments. Zhao et al. [25] proposed a large universe CP-ABE with black-box traceability. In this scheme, the size of public parameters not to grow linearly with the number of attributes.

Revocation
In a CP-ABE system, there are often cases such as user privilege change, user exit and user private key disclosure, so it is indispensable to consider the matter of user revocation. In the system, revoked user cannot decrypt any ciphertext. Meanwhile, the system permissions of other unrevoked users in the system are not affected. In 2006, revocable attribute-based encryption (RABE) was put forward for the first time in [26]. Goyal et al. [27] put forward an ABE scheme that implements indirect attribute revocation. In their construction, each attribute has a time tag representing the validity period. When the system time exceeds the time available for an attribute, the attribute is revoked. In the construction in [28], a CP-ABE scheme for user revocation using binary tree is proposed, but its performance is not high, and greatly increases the calculation and communication burden of the key generation center. Liu et al. [29] implement user revocation by setting an effective access time to the root node of the access control tree, but the cost of key management and decryption is high. A directly RABE supporting verifiable ciphertext agents is proposed in the construction in [30]. However, if there are a lot of user attributes, direct revocation will increase the burden on the cryptographer because the system has to update the user revocation list, thus reducing the feature of the entire system. Indirect revocation is generally implemented by an authority or a third-party agent, and the computational burden is small. However, until now, there is rarely a full secure ABE scheme that supports user traceability, authority accountability and user revocation concurrent that prevents the practical application of ABE in PHR system.

Our Construction
In this article, we concentrate on the two common matters of key abuse and user revocation in existing CP-ABE schemes and come up with a new white-box accountable ABE scheme with public auditing and user revocation.
Our scheme realizes both traceable users and accountable authority. It solves the problem of key abuse of untrusted authority, which is often ignored in the existing CP-ABE schemes. When tracing malicious users, we utilize Paillier-style encryption as an extractable commitment. Because there is no requirement to keep an identity table for traceability, there is no traceability storage, which greatly saves the storage space of the server. In addition, an auditor is used to determine whether the caught user is innocent or guilty. What's more, we adopt the revocation method based on the trust tree to realize the revocation of misbehaving users, authorities and other users who quit the system. At the same time, it is proved the scheme is full secure in the standard model.
Comparing the scheme with others on both theoretically and experimentally. Through the analysis, it can be concluded that our scheme has more complete functions and higher security. In terms of efficiency, although our scheme consumes more time than the schemes in [22,31], it is acceptable because of the supplement function of the user revocation .

Linear Secret-sharing Scheme
If it meets these requirements as below, the secret sharing scheme  over a series of parties E is regarded as linear.

Trusted Tree-based Revocation Approach
We use the subset-cover algorithm ( , , ) KUNode st rl t [32,33] to revoke a user, where st is the data structure of the tree, rl signifies a revocation entry with the identity of the revoked user while t signifies the most recent revocation period. The user will be distributed an identity id and an undefined leaf node when s/he joins the system. The leaf node is identified by id . The implementation of user revocation claims the user id to save secret keys in Path( id ). The Path( id ) represents all nodes id from the root node to the leaf node.

Composite Order Bilinear Groups
 represents a group generator.  inputs a security parameter  and outputs a group If we choose ,,

Complexity Assumptions
Decision Problem for primes ). Provided a group generator  , we distribute these parameters as follows [35]: A has the following advantages in breaking this assumption. It is defined: Assumption 2. Provided a group generator  , we distribute these parameters as below [35]: ,.
rr nn A has the following advantages in breaking this assumption. It is defined: Assumption 3. Provided a group generator  , we distribute these parameters as follows [35]: A has the following advantages in breaking this assumption. It is defined:

Entities in the System
This system includes five entities, namely, authority, PHR server, data owner, data user and auditor as represented in Fig. 2. Their functions and responsibilities are as follows:

Fig. 2. System Model
Authority. In this system, the authority ( AT ) is considered not to be trusted. AT produces public parameters pp and interacts with a data user ( DU ) to produce secret key id sk . In addition, when user revocation occurs, AT is responsible for broadcasting the key update material.
PHR server. PHR server stores the beginning ciphertext BT . Moreover, the PHR server updates BT to the latest ciphertext at the current time. Data owner. Plaintext is encrypted by the data owner ( DO ) to BT and sends it to the PHR server for storage. Furthermore, in order to implement user revocation, DO renews revocation list rl and sends it to AT . To determine whether the compromised secret key is intact, DO performs the key sanity check.
Data user. In this system, unrevoked users and revoked users are two genres of data users. If a user is unrevoked and his attributes meet the access structure, he could access. Unrevoked users updates his own decryption key and decrypt the ciphertext through the key update material broadcast by AT .
Auditor. The auditor acts as a fair adjudicator in the system. When the traced user denies disclosing the private key, the auditor executes the audit algorithm to determine whether the user has been framed or innocent.

System Model
We will elaborate specifically on our scheme with traceable user, accountable authority, public auditing, user revocation and no storage for tracing in this section. Our scheme contains a total of ten algorithms as below: AT launches algorithm Setup and inputs security parameter  , system lifetime  , the universe of attributes V as well as the amount of system users U , and outputs public parameters pp , state st , and master secret key msk . Besides, it constitutes a revocation list rl =.
( , , . The algorithm is implemented by DU and the auditor together. If a user is caught by Trace algorithm, but he does not admit his crime. At this time, the Audit algorithm is used to determine whether the user has been wronged or guilty.

Security Model
To manifest the security of proposed scheme, a security game, namely, the IND-CPA game is defined. The specific description is as below: The IND-CPA game. This is an indistinguishability under chosen-plaintext attack game. It's a standard semantic security concept that any CP-ABE scheme must meet. Setup

Guess.
A makes a guess   that  is 0 or 1.
In this process, Adv =|Pr[   = ]-1 2 |is taken as the advantage of A . We allege our scheme is full secure if A has a at the utmost negligible advantage can win the game in any PPT.

Construction
In this section, we propose an accountable attribute-based encryption scheme in the personal health record system. The proposed scheme realizes public auditing and user revocation. In addition, there is no storage for retro in the scenario. The details of the proposed scheme are as follows.

4.2
First, the algorithm selects randomly an unallocated leaf node from TC. This node is utilized to keep id . The algorithm operates as below for every node  in Path () id .
It retrieves   from the node  . It randomly chooses and saves    in the node  if   is unavailable.
A user DU identified by id and the authority AT interact to produce the key as the following steps. To make the whole process clearer, the flow of the domain key generation phase is shown in Fig. 3. Then, h g , a set of attributes S as well as id are sent to AT . Next, AT operates a ZK-POK of the discrete log of U R in relation to g .

For AT :
AT examines if the ZK-POK is available or not. If the examination succeeds, it executes the next step. If not, AT discontinues the interaction. Then, it chooses randomly a  , r  and 3 00 , , ,{ } .
Next, the primary secret key pri sk for each user with id and S is computed as AT sends ( , ) pri a sk to DU .
For DU : DU determines whether the following equations are true. Otherwise, DU aborts the interaction.

4.3
Firstly, AT operates the revocation algorithm for every identifier and revocation epoch ( , ) ii id t . To make the whole process clearer, the flow of the domain key generation phase is shown in Fig. 4.

( ,( , ))
ii Rev rl id t rl → . This algorithm is mainly used to update revocation lists in systems. DO launches the revocation algorithm and inputs the revocation list rl , the revocation epochs ( , ) ii id t and outputs the renewed rl as follows: Finally, the algorithm outputs:

4.5
For the ciphertext related to attributes, the algorithm chooses randomly 23 ( , , , y s y y where s is randomly selected as a secret value. The attribute-related ciphertext is calculated as: The output of this algorithm is in the following two cases. If the ciphertext is invalid or the timestamp in the latest ciphertext CT is bigger than the time t , the algorithm will discontinue and output ⊥ . If not, it will encode t to t and update ciphertext CT . Next, the PHR server calculates the ciphertext related to time as below: Next, the algorithm chooses randomly 23 ( , , , , ) n y s y y y Then, it calculates the ciphertext: 00 s s s Finally, it outputs: .

4.7
After DU obtains the latest ciphertext from the PHR server, it inputs pp , Next, it acquires the hiding component in plaintext:

4.8
The key sanity check of id sk includes the following four phases.
Firstly, check whether id sk is structure of If id sk passes this check, the output is 1. If not, the output is 0.

4.9
If algorithm

4.10
DU is considered as a malicious user, but it declares to be acquitted or defamed. In this case, an auditor is needed to determine if the user is guilty or not. We propose an auditing algorithm that anyone can act publicly as a auditor in the system. After the Trace algorithm outputs the traced key * id sk , the auditor will interact with DU as follows. If not, the output is acquitted .

IND-CPA Security
In this part, the security proof of proposed scheme will be put forward. The security of our new accountable authority, traceable user and revocable user CP-ABE scheme (referred to as AATR-ABE) is based on IND-CPA security of the ABE scheme [35] (referred to as Lewko ABE). T sends S to Lewko ABE. After receiving the S from T , Lewko ABE gives decryption key as d{ kK == , T . In Lewko ABE, the authority independently selects and distributes decryption keys to users. On the contrary, in AATR-ABE, key generation is caused by the interaction between the authority and an user. The secret key is affected by both h produced by the user and a produced by the authority. During key generation, first, the user randomly selects h and submits T sends the decryption key , 1 ( , , , , , , ,

Challenge: ( , )
A  and two messages 01 , mm of the same length are sent to T by A .
T sends 01 , mm and ( , ) A  to Lewko ABE. Then T gains the challenge ciphertext ct as below: The challenge ciphertext is send to A by T . ct C C C C C C C C C = Query Phase 2: A and T continue the above queries and interactions. Guess: A generates a bit   as the guessing of  and send it to T . Then, T gives   to Lewko ABE. Because the assignment of public parameters, decryption key and challenge ciphertext in the above process is the same as in the real system, we can conclude that the advantage of A breaking AATR-ABE is equivalent to the advantage of A breaking Lewko ABE.

Comparison
Next, we will contrast our scheme with other relevant works [22,24,25,31,36,37] from the aspects of functionality and efficiency.

Functionality
In Table 1, we contrast our scheme with the solutions implemented by [22,24,25,31,36,37] . [22] realizes traceable user, accountable authority, public auditing and no storage for tracing, but it does not implement user revocation. Although [37] supports both user traceability and user revocation，it does not support accountable users and public auditing. The scheme is selective security under the standard model. The user revocation is achieved in [36] using an indirect revocation, but it can't solve the matter of key abuse. The scheme in [31] only implements traceable user and the storage overhead for traceability is linear. As mentioned earlier, a personal health record system with traceable user, accountable authority, public auditing, user revocation needs to be proposed. Obviously, only our scheme can achieve the above functionalities at the same time. [24] and [25] only implement traceable users.

Efficiency
The cost of other operations is very small compared with exponentiation operation as well as pairing operation, so we only consider exponential operation and pairing operation when comparing efficiency. We compared our scheme with others [22,24,25,31,36,37]with respect to efficiency. The storage and transmission overhead comparison results are given in Table 2, including key length, ciphertext length. The computational complexity comparison results are given in Table 3, including the user-side overhead and authority center overhead in the key generation phase, as well as encryption and decryption costs.  Table 2 and Table 3, we can see that compared with several other schemes, our plan has some advantages in terms of key length, ciphertext length, encryption complexity and decryption complexity. This means our scheme can achieve relatively high efficiency.

Implementation
We provide the implementation of our scheme and other relevant schemes [22,24,25,31,36,37]. Note that our scheme is built based on composite order pairings, but we can extend our scheme to prime order setting by using the techniques introduced in [16]. So we use PBC library to realize the prime order symmetrical bilinear pairing over the security level of 80 bits to implement the algorithm of the schemes in the Table 3 in a simulation way. The hardware we used is R5-4800H with 8GB RAM. OS is windows 10 1909. As shown in Fig. 6, Fig. 7 and Fig. 8, the evaluation includes KeyGen.authority complexity, decrypt complexity and encrypt complexity mainly.  Complexity Fig. 7. Decrypt Complexity Fig. 8. Encrypt Complexity As can be seen from Fig. 6, Fig. 7 and Fig. 8, the computational complexity of the authority side in the KeyGen algorithm is much lower than that of schemes [36] and [25], and lower than [24], which is basically the same as [22,31,37]. The complexity of decryption is much lower than that of scheme [33,43], and not much different from that of other schemes [22,24,36,37]. The encryption complexity is much lower than that of scheme [31,36,37], and not much different from that of other schemes [22,24,25]. Therefore, in terms of efficiency, the proposed scheme has great advantages and competitiveness.

Conclusion
In this paper, we dispose the matters of key abuse and user revocation by introducing a CP-ABE scheme which is traceable user, accountable authority, and supports public auditing and user revocation. Furthermore, we demonstrate the scheme is full secure. Through theoretical analysis and implementation, we find our scheme only sacrifices a little time cost to achieve user revocation, which is a worthwhile compromise and has important significance in security and performance of this system.