Sana Belguith

Nesrine Kaaniche

Maryline Laurent

Abderrazak Jemai

Rabah Attia

PHOABE: SECURELY OUTSOURCING MULTI-AUTHORITY ATTRIBUTE BASED ENCRYPTION WITH POLICY HIDDEN FOR CLOUD ASSISTED IOT

Keywords: Attribute based encryption, Hidden policy, Decryption outsourcing, Cloud computing, Privacy, Data security

Attribute based encryption (ABE) is an encrypted access control mechanism that ensures efficient data sharing among dynamic group of users. Nevertheless, this encryption technique presents two main drawbacks, namely high decryption cost and publicly shared access policies, thus leading to possible users' privacy leakage.

In this paper, we introduce PHOABE, a Policy-Hidden Outsourced ABE scheme. Our construction presents several advantages. First, it is a multi-attribute authority ABE scheme. Second, the expensive computations for the ABE decryption process is partially delegated to a Semi Trusted Cloud Server. Third, users' privacy is protected thanks to a hidden access policy. Fourth, PHOABE is proven to be selectively secure, verifiable and policy privacy preserving under the random oracle model. Five, estimation of the processing overhead proves its feasibility in IoT constrained environments.

INTRODUCTION

The Internet of Things (IoT) refers to connecting different kinds of devices (things), mainly sensors, RFID tags, PDAs or smartphones to build a network. The deployment of these IoT devices is gaining an expanding interest in the academic research and industrial areas as well as in daily life [START_REF] Gubbi | Internet of things (iot): A vision, architectural elements, and future directions[END_REF] such as smart grid [START_REF] Yun | Research on the architecture and key technology of internet of things (iot) applied on smart grid[END_REF], e-health [START_REF] Abuarqoub | Behaviour profiling in healthcare applications using the internet of things technology[END_REF], smart city, etc.

Currently, applications based on IoT can be found everywhere. According to Yao et al. [START_REF] Yao | A lightweight attribute-based encryption scheme for the internet of things[END_REF], IoT is classified into Unit IoT and Ubiquitous IoT categories according to the number of the involved applications or domains [START_REF] Ning | Cyberentity security in the internet of things[END_REF]. The unit IoT category is involved in a single application, where only one authority is required. However, in the ubiquitous IoT category, IoT is used in cross domain applications, where local, national and industrial IoTs are interacting, thus requiring multiple authorities across domain applications. Both unit IoT and Ubiquitous IoT are becoming popular, and there is a strong need for both of them to handle data processing and sharing among different IoT devices.

The significant growth of involved IoT devices imposes high requirements for data security and privacy preservation. Hence, security problems have become a hurdle in fulfilling the vision for IoT [START_REF] Carlin | Intrusion detection and countermeasure of virtual cloud systems-state of the art and current challenges[END_REF][START_REF] Ghafir | Social engineering attack strategies and defence approaches[END_REF].

In IoT applications, data are always transmitted, stored and dynamically shared through the heterogeneous and distributed networks [START_REF] Hammoudeh | A wireless sensor network border monitoring system: Deployment issues and routing protocols[END_REF]. Consequently, encryption and access control mechanisms are important in order to prevent unauthorized entities from accessing data [START_REF] Roman | Securing the internet of things[END_REF][START_REF] Carlin | Defence for distributed denial of service attacks in cloud computing[END_REF][START_REF] Kaaniche | Cloudasec: A novel publickey based framework to handle data sharing security in clouds[END_REF][START_REF] Belguith | Enhancing data security in cloud computing using a lightweight cryptographic algorithm[END_REF][START_REF] Kaaniche | Id based cryptography for cloud data storage[END_REF].

Attribute based encryption schemes is a promising cryptographic primitive that ensures efficient encrypted access control to outsourced data. Indeed, recently, several attribute based encryption mechanisms have been proposed in literature [START_REF] De | Selective and private access to outsourced data centers[END_REF][START_REF] Horváth | Attribute-based encryption optimized for cloud computing[END_REF][START_REF] Joseph K Liu | Fine-grained two-factor access control for web-based cloud computing services[END_REF][START_REF] Kaaniche | Attributebased signatures for supporting anonymous certification[END_REF][START_REF] Li | P-cp-abe: Parallelizing ciphertextpolicy attribute-based encryption for clouds[END_REF][START_REF] Li | Tmacs: A robust and verifiable threshold multiauthority access control system in public cloud storage[END_REF][START_REF] Alsboui | A service-centric stack for collaborative data sharing and processing[END_REF].

Most of the proposed attribute based schemes have focused on designing expressive access control policies and providing low communication overheads, through short or constant size ciphertexts [START_REF] Belguith | Pabac: a privacy preserving attribute based framework for fine grained access control in clouds[END_REF][START_REF] Guo | Cp-abe with constant-size keys for lightweight devices[END_REF][START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF]. Though these solutions present low storage and communication costs, they are still not suitable to be used on resource-constrained devices such as mobile devices and sensors. For instance, the construction of ABE schemes is based on the use of bilinear maps which present expensive computation costs. Moreover, the number of these expensive bilinear operations increases along with the number of attributes involved in the access structure, mainly in the decryption procedure [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF]. Hence, the most relevant challenge is to reduce the decryption processing cost of the introduced ABE mechanism while providing fine-grained access control for users [START_REF] Zuo | Cca-secure abe with outsourced decryption for fog computing[END_REF].

Green et al. [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF] proposed, in 2011, the first attributebased encryption scheme with outsourced decryption. This scheme consists in securely offloading the decryption process of ABE to an external cloud based provider. This solution ensures that most of the decryption cost can be released from the IoT devices to the cloud.

In most attribute based encryption schemes, the access structure is shared publicly with the related ciphertext. Hence, any user who get the ciphertext can see its content. This exposure of data's access structure will disclose sensitive information about the decryption or encryption party. Meanwhile, in order to avoid disclosing these sensitive information, the access structure should be hidden [START_REF] Nishide | Attribute-based encryption with partially hidden encryptor-specified access structures[END_REF][START_REF] Viet | Hidden ciphertext policy attribute-based encryption under standard assumptions[END_REF][START_REF] Xu | A cp-abe scheme with hidden policy and its application in cloud computing[END_REF].

In addition, in single-authority ABE schemes, a central attribute authority is responsible for managing and issuing all users' attributes and related secret keys. Although this setting facilitates the key management, it can be a bottleneck since central attribute authority is able to achieve a key escrow attack, due to its knowledge of the users' private keys.

To solve this problem, many multi-attribute authority ABE schemes have been proposed. These solutions rely on multiple parties to distribute attributes and private keys to users. Such approach offers the scalability for the system even if the number of users becomes important [START_REF] Belguith | Pabac: a privacy preserving attribute based framework for fine grained access control in clouds[END_REF][START_REF] Lewko | Decentralizing attribute-based encryption[END_REF][START_REF] Chase | Improving privacy and security in multi-authority attribute-based encryption[END_REF].

In this paper, we introduce a novel Policy-Hidden Outsourced Attribute Based Encryption (PHOABE) scheme. Our proposed mechanism is multifold.

First, we extend the original multi-authority CP-ABE scheme proposed by Lewko et al. [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF] to support the outsourced decryption in order to better fit processing and communication requirements of resource-constrained devices. For instance, our scheme consists in delegating the expensive computations during the decryption phase, to a Semi Trusted Cloud Server, referred to as STCS.

Second, we apply policy-hidden techniques to ensure users' privacy and access policy confidentiality preservation.

Third, we introduce a secure mechanism consisting in verifying that the partially decrypted ciphertext was correctly generated by the remote cloud server referred to as the verifiability concept.

Fourth, we show that our proposed mechanism is selectively secure, verifiable and policy privacy preserving under the random oracle model.

Paper Organisation -The remainder of this paper is organized as follows. First, Section 2 highlights security considerations and design goals. Then, Section 3 reviews related work and introduces attribute based mechanisms. In Section 4, we describe the system model and the threat model of the system. Afterwards, we detail the framework design and we introduce the construction of our proposed scheme in Section 5. In Section 6, we perform security analysis of PHOABE based on security games. Finally, a theoretical performance analysis is provided in Section 7, before concluding in Section 8.

PROBLEM STATEMENT

As e-health systems are witnessing increased popularity, several health organisations are using these systems in order to centralize and share medical data in an efficient way.

Let us consider the following example, where a medical organisation relies on cloud based services to collect and share Electronic Health Records (EHRs) among the medical staff. Note that the medical staff can belong to different organisations such as hospitals, research laboratories, pharmacies, health ministry as well as doctors. The use of a cloud architecture enables the hospital employees to access the data using their smart devices (such as PDAs, smartphones • • • ), considered as resource-constrained devices.

Health Insurance Portability and Accountability Act (HIPAA) [START_REF]Health Insurance Portability and Accountability Act (HIPAA)[END_REF] states that access policies must finely precise different access privileges of authorized users to the shared outsourced data. In fact, a health-care information system based on cloud services is required to protect medical records from unauthorized access. Hence, the system must restrict access of protected data to eligible doctors. For instance, hospital employees, mainly doctors, have to share patients' health information, in order to collaborate with the involved hospital employees to properly prescript treatments. Thus, they usually form dynamic sharing groups with different granted privileges.

As data are always shared through the heterogeneous and distributed networks, the proposed security mechanisms should provide lightweight processing at the client side, while supporting flexible sharing of encrypted outsourced data among dynamic group of users.

To support all these features with efficiency, we propose to design a multi-attribute authority ABE scheme with outsourced decryption to be run at the client side. Thus, the proposed scheme PHOABE must fulfill the following properties:

• low computation overhead -PHOABE must introduce cryptographic algorithms with low processing complexity especially at the client side in order to ensure access by different resource-constrained devices.

• data confidentiality -PHOABE has to protect the secrecy of outsourced and encrypted data contents against both curious cloud service providers and malicious users.

• flexible access controlour proposal should ensure fine grained access control to allow authorized users to access data.

• privacy -PHOABE must protect group members' access patterns privacy, while requesting access to outsourced data.

ABE-RELATED WORK

Attribute Based Encryption (ABE) was first designed by Sahai and Waters to ensure encrypted access control [START_REF] Sahai | Fuzzy identity-based encryption[END_REF]. In ABE schemes, the ciphertext is encrypted for many users instead of encrypting to a single user as in traditional public key cryptography. In attribute based encryption schemes, user's private keys and ciphertext are associated with an access policy or a set of attributes [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. Thus, a data user is able to decrypt the ciphertext if his private key matches the ciphertext. ABE schemes are classified into two categories, namely: Key-Policy Attribute Based Encryption (KP-ABE) and Ciphertext-Policy Attribute Based Encryption (CP-ABE) [START_REF] Goyal | Attribute-based encryption for fine-grained access control of encrypted data[END_REF].

In KP-ABE, the ciphertext are labeled with a set of attributes while the users' private keys are associated with an access policy which can be any monotonic tree. The user is able to decrypt the ciphertext if its access policy is satisfied by the attributes embedded in the ciphertext. Although the KP-ABE scheme offers fine-grained access control feature, it has one main disadvantage. Indeed, the data owners cannot decide on who has access to their encrypted data, except by their choice of descriptive attributes for the data, as the access policy is embedded in the user's private keys. Consequently, the data owners have to trust the key issuer. Ciphertext-policy ABE schemes remove such inconvenience by directly embedding the access policy on the ciphertext. As such, the data owners can now authorize who can have access on their encrypted data [START_REF] Belguith | Pabac: a privacy preserving attribute based framework for fine grained access control in clouds[END_REF][START_REF] Lewko | Decentralizing attribute-based encryption[END_REF][START_REF] Goyal | Attribute-based encryption for fine-grained access control of encrypted data[END_REF].

CP-ABE schemes allow the data owner to precise the users authorized to access the data, by embedding the access policy to the ciphertext [START_REF] Belguith | Pabac: a privacy preserving attribute based framework for fine grained access control in clouds[END_REF], [START_REF] Waters | Ciphertext-policy attribute-based encryption: An expressive, efficient, and provably secure realization[END_REF], [START_REF] Nishide | Attribute-based encryption with partially hidden encryptor-specified access structures[END_REF] [START_REF] Cheung | Provably secure ciphertext policy abe[END_REF]. In order to issue private keys related to the user's set of attributes, ABE schemes rely on trusted authorities. ABE schemes can be categorized into two types namely single-authority ABE schemes and multi-authority ABE schemes.

In a single-authority ABE scheme, the attributes and their related private keys are issued by a central attribute authority. Although this centralized approach makes the key management easier, it does not ensure scalability especially when involving a huge number of users. To address this problem, multi-attribute authority ABE schemes [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF][START_REF] Chase | Improving privacy and security in multi-authority attribute-based encryption[END_REF][START_REF] Božović | Multi-authority attribute-based encryption with honest-but-curious central authority[END_REF] have been proposed.

In 2011, Lewko and Waters [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF] proposed a multiattribute authority scheme consisting on issuing attributes and their related secret keys from different attribute authorities. For instance, an attribute authority is responsible for generating a private key associated to a user's attribute. Consequently, this scheme does not rely on a central trusted authority to manage attributes' secret keys. In addition, Lewko and Waters use a Unique Global Identifier (GID) for each user to prevent collision attacks. Hence, a user must send his unique GID to each attribute authority to receive his attribute's secret key. Although CP-ABE ensures fine grained and flexible access control, it requires an expensive decryp-tion costs which be not convenient for resource-constrained devices.

For instance, these expensive computation costs are mainly related to the execution of several pairing functions. In addition, the decryption process requires the execution of a number of pairing operations which increases with the number of attributes involved in the access policy [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF]. Additionally, the use of CP-ABE schemes consists in sharing the access structure associated with the ciphertext with the involved authorities which can disclose the attributes in the access policy.

In the following, we present a review of the proposed outsourcing attribute based encryption mechanisms in Section 3.1. Then, we introduce policy hidden attribute based encryption schemes in Section 3.2.

Outsourcing Attribute Based Encryption

As detailed in the aforementioned section, ABE schemes present expensive decryption costs which increase along with the number of attributes of involved attributes in the access policy. In fact, thanks to their bilinearity properties, ABE schemes usually rely on expensive-computing pairing-based operations. Obviously, this limit is mainly prominent for resource-constrained devices. To reduce expensive costs, several research works rely on the use of constant attribute based encryption schemes generating ciphertext size and relying on a constant number of bilinear operations [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF][START_REF] Cheung | Provably secure ciphertext policy abe[END_REF][START_REF] Odelu | Expressive cp-abe scheme for mobile devices in iot satisfying constant-size keys and ciphertexts[END_REF][START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF][START_REF] Odelu | Design of a new cp-abe with constant-size secret keys for lightweight devices using elliptic curve cryptography[END_REF][START_REF] Odelu | Pairing-based cp-abe with constant-size ciphertexts and secret keys for cloud environment[END_REF]. However, these schemes consist in using threshold or conjunctive access policies which do not provide the desired expressiveness.

To mitigate this drawback, in 2011, Green et al. [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF] proposed a new approach consisting in outsourcing the expensive operations during the decryption phase to a third party. This approach consists in generating a transformation key derived from the user's secret key. Then, the user shares this generated transformation key with a semi-trusted cloud server (STCS). The ciphertext is then submitted to the STCS which uses the transformation key to generate a partially decrypted ciphertext of the same message and sends it to the user. Afterwards, the user can recover the original message using the short ciphertext and his secret key with only one exponentiation operation. Note that the semi-trusted cloud server cannot gain any information about the encrypted message while partially decrypting the ciphertext. In addition, this process helps the user to save the local computation costs.

This new concept proposed by Green et al. [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF] is similar to the concept of proxy re-encryption [START_REF] Yang | Cloud based data sharing with fine-grained proxy reencryption[END_REF][START_REF] Xu | Multi-authority proxy re-encryption based on cpabe for cloud storage systems[END_REF][START_REF] Canetti | Chosenciphertext secure proxy re-encryption[END_REF] where an untrusted proxy is given a re-encryption key that allows it to transform an encryption under Alice's key of m into an encryption under Bob's key of the same m, without allowing the proxy to learn anything about m.

While using attribute based encryption schemes with out-sourced decryption, the user relies on the use of a semi-trusted third party to partially decrypt the ciphertext. Thus, to ensure data security, the user should be able to verify that the received partially decrypted ciphertext is not altered. For instance, a lazy STCS can return a ciphertext which has been previously computed for the user or a malicious STCS can generate a forged transformation of the ciphertext [START_REF] Qin | Attribute-based encryption with efficient verifiable outsourced decryption[END_REF]. Some research works introduced verifiable computation techniques which can be used to construct attribute based encryption schemes with verifiable outsourced decryption [START_REF] Chung | Improved delegation of computation using fully homomorphic encryption[END_REF][START_REF] Chevallier-Mames | Secure delegation of elliptic-curve pairing[END_REF][START_REF] Gennaro | Non-interactive verifiable computing: Outsourcing computation to untrusted workers[END_REF]. The solutions proposed in [START_REF] Chung | Improved delegation of computation using fully homomorphic encryption[END_REF][START_REF] Gennaro | Non-interactive verifiable computing: Outsourcing computation to untrusted workers[END_REF] apply a fully homomorphic encryption chemes [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] which require a huge computation costs.

In 2013, Lai et al. [START_REF] Lai | Attribute-based encryption with verifiable outsourced decryption[END_REF] proposed a security model to verify the correctness of a ciphertext generated by an outsourced attribute based encryption scheme. Although the authors introduced a verifiable outsourced attribute based encryption scheme, this latter presents an expensive computation cost at the encrypting entity side which is not suitable for resourceconstrained devices. For instance, in the proposed scheme, the ciphertext is composed by the encrypted message and an encrypted random message. Thus, to ensure the verification of the correctness of the partially decrypted ciphertext, the encrypting entity adds a redundant encrypted message in the ciphertext.

Li et al. proposed, in 2014, an attribute based encryption scheme with outsourced decryption while ensuring the ciphertext verifiability [START_REF] Li | Securely outsourcing attribute-based encryption with checkability[END_REF], based on their first construction presented in [START_REF] Li | Fine-grained access control system based on outsourced attribute-based encryption[END_REF]. Their proposal requires the deployment of two cloud service providers to perform the outsourced key-issuing and decryption algorithms. However, proposed scheme relies on a single-authority ABE scheme authority. Thus, all the attribute involved in the system are issued and managed using a central attribute authority.

Afterwards, Wang et al. [START_REF] Wang | Server aided ciphertext-policy attribute-based encryption[END_REF] introduced, in 2015, a server aided CP-ABE system. In fact, users can rely on a proxyserver to pre-compute a partially encrypted ciphertext permitting to improve the efficiency of the encryption process. Then, the encrypting entity uses the partially encrypted ciphertext to generate the encryption of the message and share it. In the decryption phase, users rely on a computing server to perform expensive operations introduced by the decryption process. Although this proposal presents a significant reduction of computation costs, it relies on the use of a single domain architecture which is inconvenient for distributed IoT systems.

Qin et al. [START_REF] Qin | Attribute-based encryption with efficient verifiable outsourced decryption[END_REF] extend an attribute based encryption scheme with the verifiable outsourcing feature. Although this proposal presents low computation cost, it relies singleauthority ABE scheme. Hence, this can be a bottleneck as this authority may achieve a key escrow attack, due to its knowledge of all users' private keys.

In 2015, Lin et al. [START_REF] Lin | Revisiting attribute-based encryption with verifiable outsourced decryption[END_REF] propose a verifiable oustourced attribute based encryotion scheme. In this proposal, the veri-fication process relies on the use of an attribute based key encapsulation mechanism, a symmetric-key encryption scheme and a commitment scheme. Their construction is based on the ABE scheme proposed by Waters in 2011 [START_REF] Waters | Ciphertext-policy attribute-based encryption: An expressive, efficient, and provably secure realization[END_REF] which is a single attribute authority ABE scheme.

Zuo et al. [START_REF] Zuo | Cca-secure abe with outsourced decryption for fog computing[END_REF] present a CCA-secure ABE scheme with outsourced decryption for fog computing applications. This scheme does not introduce a mechanism to verify the correctness of the partially decrypted ciphertext, generated from the outsourcing decryption algorithm.

Recently, in 2017, Li et al. [START_REF] Li | Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[END_REF] proposed an attribute based encryption scheme with the verifiable outsourced decryption feature. This single-authority construction provides constant-size ciphertexts while relying on the use of monotone access structures.

Above all, the aforementioned schemes rely on singleauthority attribute based encryption schemes. However, IoT is used in cross domain applications, where local, national and industrial IoTs are interacting. Consequently, multi-attribute authority ABE schemes are more suitable in IoT context. This motivates us to introduce a verifiable outsourced attribute based encryption scheme with multi-attribute authority construction.

Policy Hidden Attribute Based Encryption

To support flexible access data control, CP-ABE schemes have been widely applied in distributed architectures. However, access policies are usually publicly shared with the different involved entities, which may disclose sensitive information about both decrypting and encrypting entities.

To protect sensitive information included in access policies, several research works [START_REF] Cheung | Provably secure ciphertext policy abe[END_REF][START_REF] Lai | Expressive cp-abe with partially hidden access structures[END_REF] introduces CP-ABE schemes with a partially hidden policies. In fact, an access policy involves a set of attributes expressed as a couple: the generic attribute name and the attribute value. Usually, the attribute value contains more sensitive information. For instance, the attribute values "pediatrician" and "XF12599" are more sensitive than the attribute names "Doctor" and "Patient", respectively. Therefore, CP-ABE schemes with partially hidden policies consists in hiding the attribute value to protect the sensitive information. That is, instead of a full access structure, a partially hidden access structure (e.g., "(Patient: * AND Hospital: *) OR (Doctor: * AND Hospital: *)") which consists of only attribute names without attribute values is attached to a ciphertext. Although ABE schemes with partially hidden access structures ensure attributes' values secrecy, they still suffer from a set of security issues, mainly the off-line dictionary attacks.

In 2008, Nishide et al. [START_REF] Nishide | Attribute-based encryption with partially hidden encryptor-specified access structures[END_REF] proposed an attribute based encryption scheme with partially hidden access control policy. This construction relies on the single authority ABE scheme proposed by Cheung et al. [START_REF] Cheung | Provably secure ciphertext policy abe[END_REF]. As such, the [START_REF] Nishide | Attribute-based encryption with partially hidden encryptor-specified access structures[END_REF] proposal uses a central authority to issue attributes and secret keys to different users.

In 2012, Lai et al. [START_REF] Lai | Expressive cp-abe with partially hidden access structures[END_REF] proposed an attribute based encryption scheme with partially hidden access policy. This proposal is based on the Waters' attribute based encryption scheme [START_REF] Waters | Ciphertext-policy attribute-based encryption: An expressive, efficient, and provably secure realization[END_REF]. Hence, it relies on the use of a single authority architecture which is not convenient for distributed IoT architectures.

To address the security and privacy issues raised by CP-ABE with partially hidden policy schemes, CP-ABE with hidden access policy schemes are introduced [START_REF] Viet | Hidden ciphertext policy attribute-based encryption under standard assumptions[END_REF][START_REF] Xu | A cp-abe scheme with hidden policy and its application in cloud computing[END_REF][START_REF] Zhou | Efficient privacy-preserving ciphertext-policy attribute based-encryption and broadcast encryption[END_REF]. Although these schemes ensure the privacy of access policies, they still suffer from high processing overhead. However, the trade-off between efficiency and perfect privacy is the main design challenge of several security mechanisms.

Xu et al. [START_REF] Xu | A cp-abe scheme with hidden policy and its application in cloud computing[END_REF] extended the attribute based encryption scheme proposed by Bethencourt et al. [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] with the hidden access policy feature, for cloud applications. However, this ABE scheme relies on the use of a central attribute authority to manage all the attributes and private keys in the system. Hence, this can be a bottleneck as a central attribute authority is able to achieve a key escrow attack.

In 2015, Zhou et al. [START_REF] Zhou | Efficient privacy-preserving ciphertext-policy attribute based-encryption and broadcast encryption[END_REF] proposed a privacy preserving attribute based broadcast encryption scheme. This proposal consists in encrypting a message using an expressive hidden access policy. Then, the encrypted message can be broadcasted with or without explicitly specifying the receivers. However, the [START_REF] Zhou | Efficient privacy-preserving ciphertext-policy attribute based-encryption and broadcast encryption[END_REF] construction introduces a high computation cost, such that the deciphering entity needs to perform several pairing operations to decrypt the ciphertext.

Phuong et al. [START_REF] Viet | Hidden ciphertext policy attribute-based encryption under standard assumptions[END_REF] proposed an attribute based encryption scheme with hidden access policy. This construction uses an access policy with only AND gates. Thus, this proposal presents less expressiveness compared to other schemes.

Above all, the mentioned proposals rely on single-authority attribute based encryption schemes. Recently, Zhong et al. [START_REF] Zhong | Multi-authority attribute-based encryption access control scheme with policy hidden for cloud storage[END_REF] proposed the first policy hidden attribute based encryption scheme using multi-attribute authority architecture. However, because of the required pairing operations, this scheme introduces an expensive computation cost at the client side to execute the decryption process.

In most of the existing policy-hidden CP-ABE schemes, The decryption computation costs grow proportionally with complexity of the access structures. This motivates us to introduce a policy hidden multi-attribute authority CP-ABE scheme with decryption outsourcing. To evaluate the objectives given in Section 2, we introduce, in Table 1, a comparison of our scheme PHOABE with different CP-ABE constructions, that are most closely-related to our context. On one hand, several research works have introduced ABE with outsourced decryption scheme [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF][START_REF] Zuo | Cca-secure abe with outsourced decryption for fog computing[END_REF][START_REF] Qin | Attribute-based encryption with efficient verifiable outsourced decryption[END_REF][START_REF] Lai | Attribute-based encryption with verifiable outsourced decryption[END_REF][START_REF] Li | Securely outsourcing attribute-based encryption with checkability[END_REF][START_REF] Lin | Revisiting attribute-based encryption with verifiable outsourced decryption[END_REF][START_REF] Li | Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[END_REF], PHOABE is the first multi-authority attribute based scheme with outsourced decryption ensuring the ciphertext verifiability. On the other hand, ABE with hidden policy has been addressed [26-28, 57, 58] in several research works, but PHOABE is he only scheme suitable for resource-constrained devices.

Mathematical Background

In this section, we first introduce the access structure in Section 3.3.1. Then, in Section 3.3.2, we present the bilinear maps. Finally, we introduce some security assumptions.

Access Policies

Access policies can be represented by one of the following formats: boolean functions of attributes or a Linear Secret Sharing Scheme (LSSS) matrix [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF].

Definition 1. Access Structure Let {P 1 , • • • , P n } be a set of parties. A collection A ⊆ 2 {P 1 ,••• ,P n } is monotone if ∀B,C if B ∈ A and B ⊆ C then C ∈ A. An access structure is a collection A of non-empty subsets of {P 1 , • • • , P n }, such as A ⊆ 2 {P 1 ,••• ,P n } \ /
0. We note that any access structure can be converted into a boolean function. Boolean functions can be represented by an access tree, where the leaves present the attributes while the intermediate and the root nodes are the logical operators AND (∧) and OR (∨).

Definition 2. Linear Secret Sharing Schemes (LSSS)

A Linear Secret Sharing Scheme LSSS [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF] over a set of parties P is defined as follows: 1. the shares of each party form a vector over Z p .

2. Let us consider an (n × l) matrix A called the sharegenerating matrix for a Linear Secret Sharing Scheme LSSS.

The row i ∈ [1, • • • , n] of A is is labeled by a function ρ(i) : {1, • • • , n} → P.
Let s ∈ Z p be a secret value to be shared, then we consider a column vector

v = [s, r 2 , • • • , r n ] where r 2 , • • • , r n ∈ Z p are random val- ues. Consequently, A. v = λ
is the vector of n shares of the secret s according to LSSS.

Bilinear Maps

Let us consider two multiplicative cyclic groups G 1 and G T of prime order P and g a generater of G 1 . ê :

G 1 × G 1 → G T
is a bilinear map if it fulfill the bilinearity, the non-degeneracy and computability properties. These properties are defined as follows:

1. bilinearity:

∀u, v ∈ G 1 and a, b ∈ Z p , we have ê(u a , v b ) = ê(u, v) ab .
2. non-degeneracy: ê(g, g) = 1.

3. computability: ê is efficiently computable. ê is computed by an efficient algorithm for any g 1 , g 2 ∈ G 0 . We say that G 0 is a bilinear group if the group operation

MODEL DESCRIPTION

Our proposed framework considers a cloud storage system involving multiple attribute authorities as detailed in Figure 1. Hence, PHOABE involves five different entities: the Cloud Service Provider (CSP), the Central Trusted Authority (CTA), the Semi-Trusted Cloud Server (STCS), the Attribute Authorities (AA), the data owner (O) and data users (U).

In this section, we introduce our system model in Section 4.1. Then, we detail our security model in Section 4.2.

System Model

Our PHOABE scheme relies on seven randomized algorithms defined as follows:

setup(λ) → PP -the setup algorithm is performed by the central trusted authority (CTA) to output the global public parameters PP. Thus, this randomized algorithm takes as input λ which is a chosen security parameter. setup auth (PP) → (sk AA j , pk AA j ) -an attribute authority AA j ( j ∈ N) executes this randomized algorithm, where N is the number of attribute authorities in the system. The setup auth takes as input PP and generates the pair of private and public keys (sk AA j , pk AA j ). encrypt(PP, {pk AA j }, M, (A, ρ)) → CT -the encryption algorithm is executed by the data owner (O) to generate the ciphertext CT . It takes as input PP, the set of involved attribute authorities' public keys {pk AA j }, the data file M and the access policy Ψ = (A, ρ). keygen(PP, sk AA j , pk AA j , GID, S j,GID ) → sk j,GID -this algorithm is performed by an attribute authority AA j in order to generate the user's secret key related to a set of attributes S j,GID = {a 1 j , • • • , a n j }, where n j is the number of attributes of S j,GID . It takes as input the global parameters PP, the pair of private and public attribute authority's keys (sk AA j , pk AA j ) and the users' identity GID. It outputs the secret key sk j,GID related to the set of attributes S j,GID . transform(PP, {sk j,GID } j∈N , (A, ρ),CT ) → {tk j,GID } j∈N -this algorithm is performed by the user (U) having a set of attributes S GID and their related secret keys {sk j,GID } j∈N received from the different involved attribute authorities {AA j } j∈N . It takes as input the global public parameters PP, the user's secret keys {sk j,GID } j∈N , the access policy Ψ = (A, ρ) and the ciphertext CT . The transform algorithm generates the set of the transformation keys {tk j,GID } j∈N = ({t pk j,GID } j∈N ,tsk GID ) related to the user's secret keys, where {t pk j,GID } j∈N and tsk GID are the public and private transformation keys, respectively. decrypt out (PP, {t pk j,GID } j∈N , (A, ρ),CT ) → M -the semi-trusted cloud server (STCS) executes the decrypt out algorithm to retrieve the partially decrypted ciphertext M . This algorithm takes as input the public parameters PP, the transformation key {t pk j,GID } j∈N , an access policy (A, ρ) and the ciphertext CT . decrypt(M ,tsk GID ) → M -the user U executes the decryption algorithm to retrieve the message M. This algorithm takes as input the transformation secret key tsk GID and the partially decrypted ciphertext M and outputs the message M.

Security Model

We consider two realistic threat models for proving security and privacy properties of our PHOABE construction. We first consider a honest but curious cloud provider. That is, the cloud is honest as it provides proper inputs or outputs, at each step of the protocol, properly performing any calculations expected from it, but it is curious in the sense that it attempts to gain extra information from the protocol. As such, we consider the honest but curious threat model against the access policy privacy requirement, as presented in Section 4.2.3. Then, we study the case of malicious users and servers, trying to override their rights. That is, they may attempt to deviate from the protocol or to provide invalid inputs. As such, we consider the malicious user security model against the access policy privacy requirement and the confidentiality property, detailed in Section 4.2.1. Also, we consider the malicious STCS security model against the verifiability requirement, as introduced in Section 4.2.2. For instance, a lazy STCS can return a ciphertext which has been previously computed for the user or a malicious STCS can generate a forged transformation of the ciphertext.

Confidentiality

To design the most suitable security model considering the confidentiality requirement, we adopt a relaxation introduced by Canetti et al. [START_REF] Canetti | Relaxing chosen-ciphertext security[END_REF] called Replayable CPA (RCPA) security. Indeed, under the RCPA security model, the provided ciphertext can be modified without changing the message in a meaningful way.

In our security model, we assume that the adversary is allowed to query for any secret keys that cannot be used for decrypting the challenge ciphertext. In addition, we consider the assumption introduced in the Lewko et al. proposal [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF] that states that the adversary can only corrupt authorities statically. Let consider S AA the set of all attribute authorities and S AA a set of corrupted attribute authorities.

Our PHOABE scheme is RCCA-Secure if there is no probabilistic polynomial time (PPT) adversary that can win the Exp con f security game defined below with non-negligible advantage.

The Exp con f security game is formally defined, between an adversary A and a challenger C as follows:

Initialisation -in this phase, the adversary A chooses a challenge access structure Ψ * = (A * , ρ * ) and sends it to the challenger C . Setup -during this phase, the challenger C first runs the setup algorithm to generate the public parameters.

Then, the adversary A selects a set of corrupted attribute authorities S AA ⊂ S AA and runs the setup auth algorithm to obtain their public and private keys.

Subsequently, C queries the honest attribute authorities' public and private keys by running the setup auth algorithm.

Afterwards, the challenger C publishes the public keys of the honest attribute authorities.

Queries phase 1 -in this phase, the challenger first initializes an empty table T and an empty set D. Then, for each session k, the adversary issues the following queries:

• Private Key query: the adversary queries the secret keys {sk j,GID } S AA related to a set of attributes {S GID } k belonging to a set of non-corrupted attribute authorities a i ∈ S AA \ S AA . Then, the challenger sets D = D ∪ {S GID } k returns the corresponding secret keys to the adversary. Note that the set of attributes {S GID } k does not satisfy the access policy

Ψ * = (A * , ρ * ) i.e; Ψ * ({S GID } k ) = 1.
• Transformation Key query: the adversary queries the secret keys {sk j,GID } S AA related to a set of attributes {S GID } k belonging to a set of non-corrupted attribute authorities a i ∈ S AA \ S AA . Afterwards, the challenger searches the entry (S GID , {sk j,GID } S AA , {tk j,GID } S AA ) in table T . If such entry exists, it returns the set of the transformation keys {tk j,GID } S AA . Otherwise, it generates h used to run the tranform . Then, the challenger runs keygen(PP, sk AA j , pk AA j , GID, S GID ) and the transform(PP, {sk j,GID } j∈N , (A, ρ),CT ) algorithms and stores in the table T the entry (S GID , {sk j,GID } S AA , {tk j,GID } S AA ).

Then, it returns to the adversary the set of the transformation keys {tk j,GID } S AA .

Challenge -during the challenge phase, the adversary chooses two equal length plaintexts M 0 and M 1 and sends them to the challenger. The challenger C chooses a random bit b such that b ∈ {0, 1} and encrypts CT b under the access structure (A * , ρ * ). The generated ciphertext CT b is then returned to the adversary.

Queries phase 2 -in this phase, the adversary A who has already received M b , can query a polynomially bounded number of queries as in Queries Phase 1, except that the adversary A can not query secret keys related to a set of attributes which satisfy the access policy Ψ * = (A * , ρ * ).

Guess -the adversary tries to guess which message M b where b ∈ {0, 1} corresponds to the challenge ciphertext CT b . The advantage of the adversary to win the game is defined as:

Adv A [Exp Con f (1 ξ )] = |Pr[b = b ] - 1 2 |
Definition 3. Our PHOABE scheme is RCPA-Secure ABE (i.e; secure against replayable chosen plaintext attacks) against static corruption of the attribute authorities if the advantage Adv A [Exp Con f (1 ξ )] is negligible for all PPT adversaries.

Verifiability

Our PHOABE scheme is said to be verifiable if there is no probabilistic polynomial time (PPT) adversary that can win the Exp veri f security game defined below with non-negligible advantage.

The Exp veri f security game is formally defined, between an adversary A and a challenger C as follows:

Initialisation -in this phase, the adversary A chooses a challenge access structure Ψ * = (A * , ρ * ) and sends it to the challenger C . Setup -during this phase, the challenger C runs the setup algorithm to generate the public parameters.

Then, the adversary A selects a set of corrupted attribute authorities S AA ⊂ S AA and runs the setup auth algorithm to obtain their public and private keys.

Subsequently, C queries the honest attribute authorities' public and private keys by running the setup auth algorithm.

Afterwards, the challenger C publishes the public keys of the honest attribute authorities.

Queries phase 1 -in this phase, the challenger first initializes an empty table T and an empty set D. Then, for each session k, the adversary issues the following queries:

• Private Key query: the adversary queries the secret keys {sk j,GID } S AA related to a set of attributes {S GID } k belonging to a set of non-corrupted attribute authorities S AA \ S AA . Then, the challenger sets D = D ∪ {S GID } k returns the corresponding secret keys to the adversary. Note that the set of attributes {S GID } k does not satisfy the access policy Ψ * = (A * , ρ * ) i.e; Ψ * ({S GID } k ) = 1.

• Transformation Key query: the adversary queries the secret keys {sk j,GID } S AA related to a set of attributes {S GID } k belonging to a set of non-corrupted attribute authorities a i ∈ S AA \ S AA . Then, the challenger searches the entry (S GID , {sk j,GID } S AA , {tk j,GID } S AA ) in table T . If such entry exists, it returns the set of the transformation keys {tk j,GID } S AA . Otherwise, it generates h used to run the transform algorithm. Then, the challenger runs keygen(PP, sk AA j , pk AA j , GID, S GID ) and the transform(PP, {sk j,GID } j∈N , (A, ρ),CT ) algorithms and stores in the table T the entry (S GID , {sk j,GID } S AA , {tk j,GID } S AA ). Then, it returns to the adversary the set of the transformation keys {tk j,GID } S AA .

Challenge -during the challenge phase, the adversary chooses a challenge message M * and sends it to the challenger. The challenger C encrypts M * and generates the verification key V * under the access structure (A * , ρ * ). Then, the generated ciphertext CT * is returned to the adversary.

Queries phase 2 -in this phase, the adversary A can query a polynomially bounded number of queries as in

Queries Phase 1, except that the adversary A can not query secret keys related to a set of attributes which satisfy the access policy Ψ * = (A * , ρ * ).

Forge -the adversary generates an attribute set {S * GID } and a partially decrypted ciphertext M * by running the algorithm decrypt out (PP, {t pk * j,GID } j∈N , (A * , ρ * ),CT * ) . We suppose that the tuple (S * GID , {sk * j,GID } S AA , {tk * j,GID } S AA ) is included in the table T . Otherwise, the challenger generates the tuple as a response for transformation key query.

The adversary A wins the game if decrypt(M * , {tk * j,GID } S AA ) / ∈ {M * , ⊥} and the challenger can verify the generated partially decrypted ciphertext using the verification key V * .

Hence, the adversary's advantage is defined as follows:

Adv A [Exp veri f (1 ξ )] = |Pr[Exp veri f (1 ξ )] = 1| Definition 4. Our PHOABE scheme is verifiable, if the ad- vantage Adv A [Exp Veri f (1 ξ )]
is negligible for all PPT adversaries.

Access Policy Privacy Preservation

The notion of access policy privacy consists in hiding the access structure used to encrypt a message from both the server and the decrypting entity. Indeed, the server or any decrypting entity should not be able to gain any knowledge of the policy except that the user knows whether his attributes satisfy the access policy.

Our PHOABE scheme ensures the access policy privacy preservation requirement if there is no probabilistic polynomial time (PPT) adversary that can win the Exp Priv security game defined below with non-negligible advantage.

The Exp Priv security game is formally defined, between an adversary A and a challenger C as follows:

Setup -in this phase, the challenger C first runs the setup algorithm to generate the public parameters.

Then, the adversary A selects a set of corrupted attribute authorities S AA ⊂ S AA and runs the setup auth algorithm to obtain their public and private keys.

Subsequently, C queries the honest attribute authorities' public and private keys by running the setup auth algorithm.

Afterwards, the challenger C publishes the public keys of the honest attribute authorities.

Queries phase 1 -in this phase, the challenger first initializes an empty table T and an empty set D. Then, for each session k, the adversary issues the following queries:

• Private Key query: the adversary queries the secret keys related to a set of attributes {S GID } k belonging to a set of non-corrupted attribute authorities S AA \ S AA . Then, the challenger sets D = D ∪ {S GID } k returns the corresponding secret keys to the adversary. Note that the set of attributes {S GID } k does not satisfy the access policy

Ψ * = (A * , ρ * ) i.e; Ψ * ({S GID } k ) = 1.
• Transformation Key query: the challenger searches the entry (S GID , {sk j,GID } S AA , {tk j,GID } S AA ) in table T . If such entry exists, it returns the set of the transformation keys {tk j,GID } S AA . Otherwise, it generates h used to run the tranform . Then, the challenger runs keygen(PP, sk AA j , pk AA j , GID, S GID ) and the transform(PP, {sk j,GID } j∈N , (A, ρ),CT ) algorithms and stores in the table T the entry (S GID , {sk j,GID } S AA , {tk j,GID } S AA ). Then, it returns to the adversary the set of the transformation keys {tk j,GID } S AA .

Challenge -during the challenge phase, the adversary A sends two challenge messages M * 1 and M * 2 and two valid access policies Ψ 1 and Ψ 2 to the challenger under the following restriction: Either all the adversaries satisfy none of the policies Ψ 1 and Ψ 2 or they all satisfy both policies throughout the game. For instance, to ensure that the adversary has not any knowledge of the policy except that he knows whether his attributes satisfy the access policy, the adversary should satisfy either both policies or none of them.

Then, the challenger flips a fair coin b ∈ {1, 2} and encrypts a message M * b under the access policy Ψ b according to the sender's encryption algorithm by running the encryption algorithm encrypt(PP, {pk AA j }, M * b , Ψ b ) . The resulting challenge ciphertext CT * is then returned to the adversary.

Queries phase -in this phase, the adversary A can query a polynomially bounded number of queries as in Queries Phase 1, except that the adversary A satisfy none of the policies Ψ 1 and Ψ 2 or they all satisfy both policies throughout the game and A may not ask the challenger C for decrypting the challenge ciphertext CT * .

Guess -the adversary tries to guess which message M * b where b ∈ {1, 2} corresponds to the challenge ciphertext CT * . The advantage of the adversary to win the game is defined as:

Adv A [Exp Priv (1 ξ )] = |Pr[b = b ] - 1

SECURELY OUTSOURCING POLICY HIDDEN ATTRIBUTE BASED ENCRYPTION

Overview

In this paper, we develop an outsourcing policy hidden multiauthority attribute based encryption scheme as a novel security mechanism for encrypted access control to outsourced data in cloud storage environments. Our proposal is based on the use of the multi-authority attribute based encryption scheme proposed by Lewko et al. [START_REF] Lewko | Decentralizing attribute-based encryption[END_REF] in 2011 which has been extended to provide security and functional features such as low computation cost, privacy preservation, fine grained access control and data confidentiality. For instance, our scheme introduces a novel outsourcing attribute based encryption which consists in reducing the decryption cost by securely delegating the most expensive computations in the decryption phase of CP-ABE to a semi-trusted party while ensuring privacy preservation of the access policy. Figure 2 illustrates the general overview of the PHOABE algorithms.

The different notations used in this paper are listed in Table 2. A set of attributes belonging to a user GID received from AA j sk j,GID the secret key related to the set of attributes S j,GID , received from AA j {tk j,GID } j∈N Transformation keys ({t pk j,GID } j∈N Transformation public key tsk GID

Transformation secret key M Data file CT

The encrypted data file M' Partially decrypted data file

Complexity Assumptions

In our outsourcing policy hidden multi-authority attribute based encryption, we rely on the following complexity assumptions:

Definition 6. Computational Diffie Hellman problem (CDH)

Given a generator g of a multiplicative cyclic group G of order N and given two group elements g a ∈ G and g b ∈ G where a, b ∈ Z N are two secrets, the problem of calculating g ab from g a and g b is called the Computational Diffie Hellman problem. N are three secrets, the problem of distinguishing between tuples of the form (g a , g b , g c , ê(g, g) abc ) and (g a , g b , g c , ê(g, g) z ) for some random integer z, is called the Decisional Bilinear Diffie-Hellman Assumption (DBDH).

Concrete Construction

Our PHOABE construction is based on seven algorithms defined as follows:

• setup -the CTA defines two multiplicative groups G 1 and G T of order P, a symmetric bilinear map ê :

G 1 × G 1 → G T ,
PP = {G 1 , G T , P, H , H 0 , H 1 , H 2 , ê, g}
• setup auth -recall that each attribute authority AA j , where j ∈ {1, • • • , N}) and N is the number of attribute authorities, manages a set of attributes S AA j . Each attribute authority chooses two random numbers α i ,t i ∈ Z * N for each attribute i ∈ S AA j and a number y j ∈ Z * N . Then, it generates the pair of private and public keys (sk AA j , pk AA j ) defined as follows:

sk AA j = ({α i ,t i } i∈S AA j , y j ) pk AA j = ({ ê(g, g) α i , g t i } i∈S AA j , g y j )
• encrypt -this randomized algorithm is based on the following three steps:

(i) First, the data owner O selects a random value a ∈ Z * N and computes q i = ê((g y j ) a , H (x i )), where {x i } i∈F denotes one attribute of the access policy Ψ and F is the number of attributes in Ψ. In order to ensure the access policy privacy preservation feature, the data owner replaces each attribute x i specified in the access structure Ψ, by the computed value q f . Then, the access policy Ψ is converted to LSSS access matrix (A n×l , ρ).

(ii) Afterwards, the data owner O picks a random values s ∈ Z N . In addition, O selects p i ∈ Z * N for each row A i of A. O chooses a random message R ∈ G T . Then, the encrypt algorithm computes λ i and w i such that

λ i = A i • v, where v = [s, v 1 , • • • , v l ] ∈ Z N l is a random vec- tor and w i = A i • τ such that τ = [0, τ 1 , • • • , τ l ] ∈ Z N
l is a random vector. The encrypt algorithm outputs the ciphertext as a tuple CT ABE = (h,C 0 ,C 1,i ,C 2,i ,C 3,i ) i∈ [1,n] , where i presents a matrix row corresponding to an attribute i, defined as follows:

                               h = g a C 0 = R • ê(g, g) s C 1,i = g λ ρ(i) g α ρ(i) p i C 2,i = g p i C 3,i = g t ρ i p i g w i
(iii) Finally, the algorithm sets R 0 = H 0 (R) and computes a symmetric key K sym = H 1 (R). Subsequently, it computes the encryption of the message M using a symmetric encryption algorithm Encrypt sym such as CT sym = encrypt sym (K sym , M) and the verification key

V = H 2 (R 0 ||CT sym ).
The encrypt algorithm outputs the ciphertext CT = {CT ABE ,CT sym } as well as the verification key V .

• keygen -for any user U having a set of attributes S j,GID = {a 1 j , • • • , a n j } related to an attribute authority AA j , this latter computes the secret key sk j,GID as follows:

sk j,GID = ({K 1,i , K 2,i } i∈S j,GID ) = {g α i H (GID) t i , H (i) y j } i∈S j,GID
• tranform -this randomized algorithm, executed by the decrypting entity, relies on the two following steps: (i) First, in order to reconstruct the access policy, the user computes the following equation:

q i = ê(h, H (i) y i ) = ê(g a , H (i) y j )∀i ∈ S j,GID
Then, using q i to replace the attribute i, an attribute set S GID is constructed. The user can identifies the set of attributes L = {i : (ρ(i) ∩ S GID ) i∈[n] } required for the decryption.

(ii) Second, the user chooses a random value z ∈ Z * N and sets the transformation keys {tk j,GID } j∈N = ({t pk j,GID } j∈N , tsk GID ), where {t pk j,GID } j∈N and tsk GID are computed as follows:

   {t pk j,GID } j∈N = ({K 1/z 1,i } i∈L , g 1/z , H(GID) 1/z ) tsk GID = z
Finally, the user outsources the ciphertext CT and the set of the transformation public keys {t pk j,GID } j∈N to the STCS.

• decrypt out -to partially decrypt the ciphertext CT , the STCS proceeds as follows. First, for each matrix row corresponding to an attribute i, the STCS computes:

= ê(g 1/z ,C 1,i ). ê(H (GID) 1/z ,C 3,i ) ê(g α i /z H (GID) t i /z ,C 2,i ) = ( ê(g, g) λ i ê(H (GID), g) w i ) 1/z
Afterwards, the STCS chooses a set of constants

{c i } i∈[1,n] ∈ Z N such that ∑ i c i A i = [1, 0, • • • , 0]. Then, it computes the ∏ n i=1 c i , such as: n ∏ i=1 c i = ( n ∏ i=1 ( ê(g, g) λ i ê(g, g) w i t j ) 1/z = ( ê(g, g) ∑ n i=1 λ i c i ê(g, g) ∑ κ j=1 t j ∑ n i=1 w i c i ) c i z
We note that λ i = A. v and

w i = A. τ, where v.[1, 0, • • • , 0] = ∑ n i=1 λ i c i = s and w.[1, 0, • • • , 0] = ∑ n i=1 w i c i = 0.
In the sequel, the STCS gets the following result:

M = n ∏ i=1 c i = ê(g, g) s z (1)
Finally, the STCS returns M to the user.

• decrypt-the decrypt algorithm includes the following two steps: (i) First, based on the partially decrypted ciphertext M , the user executes Equation 2 while performing only one exponentiation without calculating any pairing functions to recover the message.

R = C 0 (R ) tsk = C 0 ( ê(g, g) s z ) z = C 0 ê(g, g) s (2)
(ii) Then, the user computes R 0 = H 0 (R). If, the algorithm checks H 2 (R 0 ||CT sym ) = V , then it returns ⊥ and halts immediately.

Otherwise, it computes K sym = H 1 (R). Then, it returns the message M = Decrypt sym (K sym ,CT sym ).

The proof of correctness of the decryption algorithm is detailed in Section 6.1.

SECURITY ANALYSIS

In this section, we first prove the correctness of our PHOABE construction, with respect to the data decryption algorithms, in section 6.1. Then, we prove the security of our proposal, with respect to the indistinguishability, verifiabity and privacy preserving properties, in Section 6.2, 6.3 and 6.4 respectively.

Correctness

The correctness of our PHOABE construction is detailed by the proof of Lemma 1.

Lemma 1. Data Decryption Correctness.

Proof. (i) After receiving the set of the user's transformation keys related to the involved attributes {t pk j,GID } j∈N , the STCS first computes:

= ê(g 1/z , g λ ρ(i) g α ρ(i) p i ). ê(H (GID) 1/z , g t ρ i p i g w i ) ê(g α i /z H (GID) t i /z , g p i ) = ê(g, g) λ ρ(i) z ê(g, g) α ρ(i) p i z ê(H (GID), g) tρ i p i z ê(H (GID), g) w i z ê(H (GID), g) α ρ(i) p i z ê(H (GID), g) t ρ(i) p i z = ê(g, g) λ ρ(i) z ê(H (GID), g) w i z
Then, STCS calculates the constants

c i ∈ Z N such that ∑ i c i • A i = [1, 0, • • • , 0]. Note that λ ρ(i) = A ρ(i) • v, where v = [s, v 2 , • • • , v n ] and w i = A i • τ such as τ = [0, τ 2 , • • • , τ n ]. Hence, we deduce that ∑ n i=1 λ ρ(i) c i = s and ∑ i w i c i = 0.
Consequently, the partially decrypted ciphertext M = ê(g, g) s z is derived as follows:

n ∏ i=1 c i = n ∏ i=1 ê(g, g) c i λ ρ(i) z ê(H (GID), g) c i w i z = ê(g, g) ∑ κ j=1 c i λ ρ(i) z ê(H (GID), g) c i ∑ κ j=1 w i z = ê(g, g) ∑ κ j=1 c i λ ρ(i) z ê(H (GID), g) ∑ κ j=1 w i c i z = ê(g, g) s z ê(H (GID), g) 0 = ê(g, g) s z
(ii) In the sequel, the user uses the partially decrypted ciphertext M and the secret transformation key tsk to compute R as follows:

R = C 0 (R ) tsk = C 0 ( ê(g, g) s z ) z = C 0 ê(g, g) s (3)
(iii) Then, in order to verify the correctness of the outsourced decryption, the user computes

R 0 = H 0 (R). Then, if he checks H 2 (R 0 ||CT sym ) = V ,then it returns ⊥
and halts immediately.

If the decryption is verified, then the user computes the original message as follows:

K sym = H 1 (R) .
As such, he retrieves the message as:

M = Decrypt sym (K sym ,CT sym )

Indistinguishability

In the following proof, we prove that our scheme is RCPA-Secure against static corruption of the attribute authorities with respect to Theorem 1.

Theorem 1. If Lewko et al. decentralized CP-ABE scheme [29] is CPA-secure, then, our PHOABE scheme is selectively RCPA-secure such that Adv A [Exp con f ] ≤ Adv A [Exp Lewko ],
according to Definition 3.

Proof. We define a PPT algorithm adversary A running the Exp con f security game defined in Section 4.2.1 with an entity B. This entity B is also running the Lewko et al's CPAsecurity game (Lewko-Game) with a challenger C . The objective of the proof is to show that the advantage of the adversary A to win the Exp con f game is smaller than the advantage of the entity B to win Lewko-Game. Hereafter A, B and C interactions are described, with A running the following steps and algorithms, as specified in the Exp con f game:

Initialisation -in this phase, the adversary A gives the algorithm B a challenge access structure Ψ * = (A * , ρ * ).

Setup -B runs the setup to generate the public parameters. For instance, it sets two multiplicative groups G 1 and G T of order P, a bilinear map ê : for each attribute i ∈ S AA j and a number y j ∈ Z * N . Then, it generates the attribute authorities public keys {pk AA j } defined as pk AA j = ({ ê(g, g) α i , g t i } i∈S AA j , g y j ). Finally, C sends to B the attribute authorities public keys {pk AA j } which is sent next by B to A.

G 1 × G 1 → G T ,
Queries phase 1 -B first initializes an empty table T and an empty set D. Then, for each session k, the adversary issues the following queries:

Private Key query: when the adversary issues a key query by submitting a set of attributes S GID and his identity GID.

Then, the algorithm B uses the challenger C to generate and return the corresponding secret keys to the adversary

{K 1,i } i∈S j,GID ) = {g α i H (GID) t i } i∈S j,GID . Afterwards, the challenger C chooses y j ∈ Z * N and sets {sk j,GID } j∈N = ({K 1,i , K 2,i } i∈S j,GID ) = {g α i H (GID) t i , H (i) y j )} i∈S j,GID .
The secret keys {sk j,GID } j∈N ) are returned to the adversary A.

Then, B sets D = D ∪ {S GID } k and returns the secret keys {sk j,GID } j∈N to the adversary A.

Transformation Key query: B searches the entry (S GID , sk S GID, j , tk GID, j ) in table T . If such entry exists, it returns the transformation key tk GID, j to the adversary A.

Otherwise, it generates a random value a and sets the value h = g a to simulate the output of the encrypt algorithm used to run the tranform. h is, then, sent to the challenger C . Then, the challenger chooses a random exponent z ∈ Z * N and sets the transformation key such as {t pk j,GID } j∈N = ({K

1/z 1,i } i∈L , g 1/z , H(GID) 1/z ). Then,
B stores in the table T the entry (S GID , sk GID, j ,tk GID, j ).

Then, it returns to the adversary the transformation key {tk j,GID } j∈N = ({t pk j,GID } j∈N ,tsk GID ).

[Exp A Lewko (1 ξ )] ≥ Pr[Exp A con f -real (1 ξ )],
and the advantage of adversary A is negligible. Then our PHOABE scheme satisfies the confidentiality property.

Verifiability

In this section, we prove that our scheme is verifiable against malicious servers with respect to Theorem 2.

Theorem 2. If H 2 and H 0 are two collision-resistant hash functions, then, our PHOABE scheme is verifiable against malicious servers.

Proof. We define a PPT algorithm B which aims to break the verifiability property of the outsourcing ABE system under the help of the adversary A. B simulates the adversary views with respect to the Exp veri f security game defined in Section 4.2.1. To do so, B tries to break the collision resistance of the H 2 or the H 0 hash functions . Given two challenge hash functions (H * 2 , H * 0 ), B simulates the security game introduced in Definition 4 as follows:

First, B runs the setup algorithms to generate the public parameters except the hash functions H 2 or H 0 . In addition, B generates the attribute authorities public and secret keys by running the setup auth algorithm. Afterwards, B runs the adversary queries Queries phase 1 and Queries phase 2 in order to get secret keys and the transformation keys related to a set of attributes.

In the challenge phase, the adversary A sends a challenge message M * to the algorithm B. Then, this latter picks a random message R * ∈ G T and encrypts R * under the challenge access structure Ψ * = (A * , ρ * ) using Lewko and Waters scheme. Then, B sets R * 0 = H * 0 (R * ) and computes a symmetric key K * sym = H * 1 (R * ). Subsequently, it computes the encryption of the message M * using a symmetric encryption algorithm Encrypt sym such as CT * sym = encrypt sym (K * sym , M * ).

In addition, C sets the verification key

V * = H * 2 (R * 0 ||CT * sym ).
Afterwards, the algorithm B sends CT * = (CT * ABE ,CT * sym ) = (h,C 0 ,C 1,i ,C 2,i ,C 3,i ,CT * sym ) to the adversary as a challenge ciphertext as well as the verification key V * .

If A breaks the verifiability game, B will recover a message M / ∈ {M * , ⊥} relying on the partially decryption algorithm decrypt out (PP, {t pk j,GID } j∈N , (A * , ρ * ),CT * ).

Notice that the decryption algorithm outputs ⊥ if

H * 2 (R * 0 ||CT * sym ) = V * where R * 0 = H * 0 (R * ) and R * = decrypt sym (K * sym ,CT * sym ).
As a consequence, the following two cases are considered:

• Case 1: Since B knows (R * 0 ,CT * sym ), if (R 0 ,CT sym ) = (R * 0 ,CT *
(R) = R 0 = R * 0 = H * 0 (R * ).
Consequently, using an absurdum reasoning, since the hash functions H 2 and H 0 are two collision resistant functions, then our scheme PHOABE is verifiable.

Policy Privacy Preservation

In this section, we prove that our scheme is privacy-preserving against both malicious users and servers with respect to Theorem 3.

Theorem 3. Our PHOABE scheme is policy privacy preserving according to Definition 5. Sketch of proof. In PHOABE scheme, the encrypting entity encrypts data under an access policy Ψ. Afterwards, he generates a new value equal to ê((g y j ) a , H (x i )) based on the one-way anonymous key agreement protocol [START_REF] Kate | Pairing-based onion routing[END_REF] where a is a random number. This generated value is used to obfuscate the attribute x i . For instance, in order to ensure the access policy privacy preservation feature, the encrypting entity replaces each attribute x i specified in the access policy Ψ, by the generated value ê((g y j ) a , H (x i )).

In order to recover the access policy, the decrypting entity uses his corresponding private key {K 2,i } i∈S j,GID = {H (i) y j )} i∈S j,GID to compute the value q i = ê(h, H (i) y i ) = ê(g a , H (i) y i )∀i ∈ S GID . Hence, only authorized users having the right secret keys can recover the access policy. For instance, thanks to the random value a, unauthorized users cannot guess x i from the obfuscated value ê((g y j ) a , H (x i ))

Consequently, the policy privacy preservation requirement is ensured thanks to the security of the one-way anonymous key agreement protocol [START_REF] Kate | Pairing-based onion routing[END_REF]. In addition, users cannot reveal the embedded attribute in the access policy when they collude, because they cannot infer the attribute x i from ê(g a , H (i) y i ).

PERFORMANCE ANALYSIS

In this section, we present the computation and storage complexities of our PHOABE scheme. For this purpose, we are interested by the computations performed at the data owner side in order to execute the encrypt algorithm. In addition, we consider the computation cost related to the execution of decrypt and decrypt out algorithms performed by the user (U) and the Semi Trusted Cloud Server (STCS), respectively. Moreover, we introduce the size of the user's secret keys as well as the ciphertext's size. For this purpose, we denote by:

• E 1 : exponentiation in G 1 • E T : exponentiation in G T
• τ P : computation of a pairing function ê

• n is number of attributes used in the access policy

• |S| is the number of attributes in the set of attributes related to a user Table 3 details the performance comparison with the most closely related ABE schemes.

Computation Complexities

In [START_REF] Nishide | Attribute-based encryption with partially hidden encryptor-specified access structures[END_REF], Nishide et al. proposed a hidden policy ABE scheme requiring one exponentiation in G T and (2n + 1) exponentiations in G 1 in the encryption process. For the decryption phase, the user needs to compute (2n + 1) pairing functions.

In 2011, Green et al. [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF] proposed the first ABE scheme with outsourced decryption. This proposal consists in using a semi trusted server to compute (2n + 1) pairing functions and 2n exponentiation in G T in order to generate a partially decrypted ciphertext. Afterwards, the user needs only one exponentiation in G T to retrieve the original message. In the encryption process, the data owner needs (4 + 3n) exponentiations in G 1 and one exponentiation in G T . Lai et al. [START_REF] Lai | Attribute-based encryption with verifiable outsourced decryption[END_REF] introduced an outsourced ABE scheme consisting in verifying the correctness of the ciphertext. In this scheme, the encryption algorithm requires 2 exponentiations in G T and the decryption algorithm performs 6n exponentiations in G 1 . Beyond the encryption and decryption costs, this scheme consists in computing 2 hash functions, in both the encryption and decryption processes, in order to use them in the verification process. Similarly, Qin et al. [START_REF] Qin | Attribute-based encryption with efficient verifiable outsourced decryption[END_REF] and Lin et al. [START_REF] Lin | Revisiting attribute-based encryption with verifiable outsourced decryption[END_REF] proposed two verifiable outsourced ABE schemes. In the [START_REF] Qin | Attribute-based encryption with efficient verifiable outsourced decryption[END_REF] proposal, the encryption and decryption algorithms overheads are equal to τ p + E 1 (4 + 3n) and 2nE T + τ p (2n + 1), respectively. To verify the ciphertext's correctness, 3 hash functions have to be performed at both the data owner and user sides. In the [START_REF] Lin | Revisiting attribute-based encryption with verifiable outsourced decryption[END_REF] construction, the data owner needs to compute (3 + 2n) exponentiations in G 1 , one exponentiation in G T and 2 hash functions. Moreover, the user computes one exponentiation in G T and 2 hash functions to decrypt and verify the ciphertext. In addition, the semi trusted server computes 2n exponentiations in G T and (2n + 1) pairing functions. In the outsourced attribute based encryption scheme proposed by Li et al. [START_REF] Li | Securely outsourcing attribute-based encryption with checkability[END_REF], the user needs to compute only one exponentiation in G T while outsourcing (2n + 2) pairing functions and (2n + 2) exponentiations in G T . The encryption algorithm performs (3 + 2n) exponentiations in G 1 . In 2015, Zhou et al. [START_REF] Zhou | Efficient privacy-preserving ciphertext-policy attribute based-encryption and broadcast encryption[END_REF] introduced a policy hiding broadcast ABE scheme where the encryption and decryption overheads are independent from the number of attributes involved in the access structure. Afterwards, Xu et al. [START_REF] Xu | A cp-abe scheme with hidden policy and its application in cloud computing[END_REF] proposed a policy privacy preserving ABE scheme. The processing costs are equal to E 1 (n + 2) and τ p (n + 1) + nE T for the encryption and decryption phases, respectively. In 2016, Zhong et al. [START_REF] Zhong | Multi-authority attribute-based encryption access control scheme with policy hidden for cloud storage[END_REF] proposed the first multi-attribute authority ABE scheme with hidden access policy. This proposal consists in performing 2 pairing functions, 3n exponentiations in G 1 and (1 + 2n) exponentiations in G T in the encryption phase. Moreover, the decryption algorithm computes (1+2n) pairing functions and n exponentiations in G T . Zho et al. [START_REF] Zuo | Cca-secure abe with outsourced decryption for fog computing[END_REF] proposed an outsourced ABE scheme for fog computing applications. This scheme consists in computing (N + 1) exponentiations in G 1 , 4 exponentiations in G T , where N is the cardinal of the attribute universe, and 2 hash functions to decrypt the message. The semi trusted server partially decrypts the message by performing (4 + 2N + n) pairing functions, N exponentiations in G T and 2 hash functions. Finally, the user has to perform only 4 exponentiations in G T and 2 hash functions to decrypt data.

Recently, Li et al. [START_REF] Li | Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[END_REF] proposed a verifiable outsourced ABE scheme with constant ciphertext size. In this proposal, to encrypt data, the data owner performs 6 exponentiations in G 1 , 2 exponentiations in G T and one hash function. In addition, the semi trusted server computes 4 pairing functions and the user performs one exponentiation in G T and 2 hash functions.

In our PHOABE scheme, the data owner performs 5 exponentiations in G 1 , one exponentiation in G T and 3 hash functions. In addition, our proposal consists in using a semi trusted cloud server to compute the expensive computation operations such as performing 3n pairing functions and one exponentiation in G T . As a consequence, the user only computes one exponentiation in G T and 3 hash functions to execute the verification process.

Above all, the processing costs of our PHOABE scheme remain competitive compared to other encryption schemes. Indeed, our construction consists in outsourcing the computation of expensive operations. 5).

CONCLUSION

The number of devices connecting to the Internet of Things (IoT) is growing exponentially, as does the amount of data produced. As such, cloud assisted IoT services is emerging as a promising solution to deal with the computation and storage of the huge amounts of produced data and to delegate the expensive operations to cloud servers. The widespread use of these services requires customized security and privacy levels to be guaranteed.

In this paper, we present PHOABE, a novel privacypreserving outsourcing multi-authority attribute based encryption scheme, that permits to overcomes the computational costs of decryption that scale with the complexity of the access policy and the number of attributes. The proposed technique can be considered as an optimization of the decryption algorithm to mitigate the practical issues in implementing CP-ABE on resource-constrained devices. For instance, PHOABE is a multi-attribute authority mechanism which ensures delegating the expensive computations for ABE decryption to a Semi Trusted Cloud Server and protecting user's privacy using a hidden access policy. Finally, PHOABE is proven to be selectively secure, verifiable and policy privacy preserving under the random oracle model.

As for future work, we plan to further improve PHOABE by exploring direct revocation solution to achieve more security features. For instance, a compromised user should be revoked without affecting other users.

Fig. 1 .

 1 Fig. 1. The PHOABE main architecture entities and their interaction

2 | 5 .

 25 Definition Our PHOABE scheme ensures the access policy privacy preservation against Adaptive Chosen plaintext Attack if the advantage AdvA [Exp Priv (1 ξ )] = |Pr[b = b ] -1 2 | is negligible for all PPT adversaries.

Definition 7 .Fig. 2 .

 72 Fig. 2. General Overview of PHAOBE

Challenge

  scheme and returns CT b,ABE to B. Afterwards, with the probability equal to the advantage of the adversary in Lewko-game (Adv A [Exp Lewko ]), B tries to

Fig. 3 .Fig. 4 .Fig. 5 .Fig. 6 .

 3456 Fig.3. Exponentiation Execution Time[START_REF] Ometov | Feasibility characterization of cryptographic primitives for constrained (wearable) iot devices[END_REF]

Table 1 .

 1 Features and Functionality Comparison of Attribute Based Encryption Schemes

	Scheme	Type	Access Policy	Hidden Policy	Outsourced Decryption Verifiability Multi-authority Security Models
	[26]	CP-ABE	LSSS	Partially hidden	Single	Selective CPA
	[56]	CP-ABE	LSSS	Partially hidden	Single	Selective CPA
	[24]	CP-ABE	LSSS		Single	RCCA
	[50]	CP-ABE	LSSS		Single	Selective CPA
	[51]	CP-ABE	LSSS		Single	RCCA
	[57]	CP-ABE	LSSS	Fully Hidden	Single	Selective CPA
	[28]	CP-ABE	LSSS	Fully Hidden	Single	Selective CPA
	[45]	CP-ABE	LSSS		Single	RCCA
	[54]	CP-ABE	LSSS		Single	Selective CPA
	[58]	CP-ABE	LSSS	Fully Hidden	Multi	Selective CPA
	[27]	CP-ABE	AND gates	Fully Hidden	Single	Selective CPA
	[25]	CP-ABE	LSSS		Single	Selective CCA
	[55]	CP-ABE	AND gates		Single	RCCA
	PHOABE CP-ABE	LSSS	Fully Hidden	Multi	Selective RCPA

Table 2 .

 2 The different notations used in this paper

	Notation	Description
	CSP	Cloud Service Provider
	CTA	Central Trusted Authority
	STCS	Semi Trusted Cloud Server
	AA	Attribute Authority
	O	Data Owner
	U	User
	PP	Public Parameters
	sk AA j	Secret key related to AA j
	pk AA j	Public key related to AA j
	A	LSSS access matrix
	Ψ	Access policy
	D F	Data file
	GID	User Global Identifier
	S j,GID

  1} n H 2 , where M is the message universe. Finally, it outputs the global public parameters PP defined as follows:

g a generator of G 1 and four collusion resistant hash functions H : {0, 1} * → Z P , H 0 :

{M } → {0, 1} n H 0 , H 1 : {M } → {0, 1} * , H 2 : {0, 1} * → {0,

  1} * → Z P . Finally, it outputs the public parameters PP defined as PP = {G 1 , G T , P, H * , H * 0 , H * 1 , H * 2 , ê, g}. In addition, B calls the challenger C to execute the setup auth algorithm to generate the attribute authorities public keys. Then, C chooses two random numbers α i ,t i ∈ Z *

				g a
	generator of G 1 and four collusion resistant hash functions
	H * , H *	0 , H *	1 , H *	2 : {0, N

  sym ) is returned as a result, then B obtains a collision of the hash function H * 2 .• Case 2: If we get (R 0 ,CT sym ) = (R * 0 ,CT * sym ), while R

* and R are not equal (R * = R). Then, B breaks the collision resistance condition of H * 0 as H * 0

Table 4 .

 4 Selected Devices[START_REF] Ometov | Feasibility characterization of cryptographic primitives for constrained (wearable) iot devices[END_REF]

		Device	Type	Processor
	Sony SmartWatch 3 SWR50	Smart Watch	520 MHz Single-core Cortex-A7
	Samsung I9500 Galaxy S4	Smartphone	1.6 GHz Dual-Core Cortex-A15
		Jiayu S3 Advanced	Smartphone	1.7 GHz Octa-Core 64bit Cortex A53
		Intel Edison	IoT Development Board 500 MHz Dual-Core Intel AtomTM CPU, 100 Mhz MCU
		Raspberry Pi 1 model B	IoT Development Board	700 MHz Single-Core ARM Cortex-A6
		Raspberry Pi 2 model B	IoT Development Board	900 MHz Quad-Core ARM Cortex-A7
		3.5
		3
		2.5
	Operation Time (ms)	1.5 2	Sony Smart Watch Samsung Galaxy S4 JIAYU S3 Advanced Intel Edison Rasberry Pi 1B
		1	Rasberry Pi 2B
		0.5
		0
		Exponentiation Procedure

Table 5 .

 5 Number of Cryptographic Operations computed by STCS and User in PHOABE.

		Exp Mul Pairing
	STCS	1	2	3n
	USer	1	1	0

ACKNOWLEDGEMENTS

This work is part of the MOBIDOC project achieved under the PASRI program, funded by the European Union and administered by the ANPR.

Storage Complexities

The policy hidden attribute based encryption schemes [START_REF] Nishide | Attribute-based encryption with partially hidden encryptor-specified access structures[END_REF][START_REF] Xu | A cp-abe scheme with hidden policy and its application in cloud computing[END_REF] have the same size of user's secret keys which is equal to 1 + |S|, where S represents the set of attributes of the user. Differently, the proposals introduced in [START_REF] Zhou | Efficient privacy-preserving ciphertext-policy attribute based-encryption and broadcast encryption[END_REF][START_REF] Zhong | Multi-authority attribute-based encryption access control scheme with policy hidden for cloud storage[END_REF] have almost the same size of user's secret keys which is equal to |2S|. The attribute based encryption schemes with outsourced decryption, presented in [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF][START_REF] Qin | Attribute-based encryption with efficient verifiable outsourced decryption[END_REF][START_REF] Lai | Attribute-based encryption with verifiable outsourced decryption[END_REF][START_REF] Lin | Revisiting attribute-based encryption with verifiable outsourced decryption[END_REF] consist in using user's secrets keys and transformation keys. Consequently, the total size of user's keys is equal to double the size of his set of attributes. The ABE schemes [START_REF] Viet | Hidden ciphertext policy attribute-based encryption under standard assumptions[END_REF][START_REF] Li | Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[END_REF] have constant size of user's secret keys. However, since Li et al. [START_REF] Li | Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[END_REF] proposal is an ABE scheme with outsourced decryption, the user's secret keys involve the transformation keys whose size is equal to 8. The size of the user's keys in the Zuo's et al. proposal [START_REF] Zuo | Cca-secure abe with outsourced decryption for fog computing[END_REF] are equal to N + |S| + 1 and N + 2 for the user's secret keys and the transformation keys, respectively. Note that N is the cardinal of the attribute universe.

In both Li et al. [START_REF] Li | Securely outsourcing attribute-based encryption with checkability[END_REF] and PHOABE proposals, the size of the user's secret keys is equal to 2|S| while the size of the transformation keys is equal to 2|S| + 3.

The ABE schemes [START_REF] Viet | Hidden ciphertext policy attribute-based encryption under standard assumptions[END_REF][START_REF] Li | Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[END_REF][START_REF] Zhou | Efficient privacy-preserving ciphertext-policy attribute based-encryption and broadcast encryption[END_REF] present a ciphertext with a constant size which does not depend on the number of attributes used in the access policy. In the existing ABE schemes such as [START_REF] Green | Outsourcing the decryption of abe ciphertexts[END_REF][START_REF] Nishide | Attribute-based encryption with partially hidden encryptor-specified access structures[END_REF][START_REF] Qin | Attribute-based encryption with efficient verifiable outsourced decryption[END_REF], the authors introduce ABE schemes where the size of the generated ciphertext is approximately equal to 2n. Recall that n is the number of attributes involved in the access policy. In [START_REF] Xu | A cp-abe scheme with hidden policy and its application in cloud computing[END_REF] [START_REF] Zhong | Multi-authority attribute-based encryption access control scheme with policy hidden for cloud storage[END_REF] introduces a ciphertext's size equivalent to 3 times the cardinal of the access policy. Similarly, our PHOABE con-struction produces a ciphertext which is 3 times the cardinal of the access structure.

Taking into consideration that PHOABE is a multiauthority scheme, we state that our construction presents interesting performances especially related to the key size and the size of the ciphertext.

Resource-Constrained Performance Analysis

Several research works have been proposed to evaluate the computation overhead of attribute based encryption schemes on resource-constrained devices [START_REF] Zhou | Efficient and secure data storage operations for mobile cloud computing[END_REF][START_REF] Moreno Ambrosin | On the feasibility of attribute-based encryption on smartphone devices[END_REF][START_REF] Moreno Ambrosin | On the feasibility of attribute-based encryption on internet of things devices[END_REF][START_REF] Ometov | Feasibility characterization of cryptographic primitives for constrained (wearable) iot devices[END_REF][START_REF] Wang | Performance evaluation of attribute-based encryption: Toward data privacy in the iot[END_REF]. These papers introduced experimental performance analysis of the different ABE algorithms on mobile devices and sensors.

Ometov et al. [START_REF] Ometov | Feasibility characterization of cryptographic primitives for constrained (wearable) iot devices[END_REF] evaluate the impact of elementary cryptographic operations on different resource-constrained devices as detailed in Table 4. As our PHOABE framework relies on the use of bilinear maps as well as mathematical operations in a multiplicative group, we investigate the impacts of these operations (Figures 3, 4, and5) on the performance of different IoT devices, based on the results introduced in [START_REF] Ometov | Feasibility characterization of cryptographic primitives for constrained (wearable) iot devices[END_REF].

Figure 5 shows the computation cost of one pairing operation in different IoT devices (cf., Table 4). The most efficient device here is Intel Edison with JDK 1.8.0 that computes a single pairing operation in around 500 ms.

As the pairing operations are extremely expensive, attribute based encryption can not be applied to secure IoT devices. Thus, the only solution to benefit from the security feature of ABE is to apply it using outsourced decryption feature.

In ciphertext attribute based encryption, the size of an encrypted file mainly depends on the number of attributes involved in the access policy used in the encryption phase [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF].

To estimate the real-world computation costs on a client side, we investigate the computation overhead of PHOABE on a Samsung I9500 Galaxy S4. As shown in Figure 6, the computation costs at the user side increase with the number of attributes used in the encryption.

However, while applying outsourced decryption, the user computation costs are independent of the number of attributes as the user only needs to compute one exponentiation and one


H Riahi

E Constant

J Favier

P Meliga

E Serre

M Meldi

E Goncalves

DIRECT NUMERICAL SIMULATION OF COMPRESSIBLE FLOWS AROUND SPHERICAL BODIES USING THE IMMERSED BOUNDARY METHOD

Introduction

The three-dimensional flow around a sphere is one of the most classical subjects of investigation for fundamental analysis of external aerodynamics. In fact this flow configuration, which is described by a very simple geometrical shape, exhibits the potential for complex multi-physics analysis. Some aspects that can be investigated include turbulence, acoustics and heat transfer, and this test case is particularly favorable for the analysis of coupled problems. In addition, the emergence of a number of different regimes is observed for moderate Reynolds number, which are extremely sensitive to the Mach number Ma investigated. Furthermore, multiple physical systems can be modeled by multi-spherical bodies in motion involving complex interactions. Owing to this large number of aspects which are relevant for industrial applications, this case represents an important benchmark for validation of new numerical /modeling strategies.

In the present work, this test case is analyzed via the Immersed Boundary Method (IBM). The surface of the sphere is not directly embedded in the physical domain, but it is represented by a set of discrete Lagrangian points which are associated with volume forces included in the Navier-Stokes equation. This procedure allows for flow representation through Cartesian grids, instead of the classical solution of a spherical frame of reference. This analysis aims to produce ground research for future fluid structure interactions analysis, including moving spherical objects in the physical domain. In this scenario, the use of a spherical frame of reference is clearly problematic. The flow configurations here investigated encompass a large range of Ma numbers, including subsonic, transonic and supersonic flows, for low to moderate Reynolds numbers Re. This very large parametric two dimensional space [Ma, Re] ∈ [0.3 -2, 50 -600] allows for a robust validation of the proposed IBM methodology, which must achieve a successful representation for numerous physical configurations exhibiting different features.

Numerical ingredients and IBM development

The starting point of the present work are the compressible Navier-Stokes equations:

∂ ρ ∂t + div(ρU) = 0 (1)
∂ ρU ∂t

+ div(ρU ⊗ U) = -gradp + divτ + F (2)
∂ ρE ∂t

+ div(ρEU) = -div(pU) + div(τU) + div(λ (T )gradT ) + F U ( 3
)
where ρ is the density, p the pressure, T the temperature, λ the thermal conductivity, U the velocity, τ the tensor of the viscous constraints, E the total energy and F a prescribed volume force. The IBM exploits this last term to account for the presence of the immersed body, which is not represented via a boundary condition. Among the favorable characteristics of this method we have that mesh elements are not stretched / distorted close to the body surface. In addiction, expensive updates of the mesh are naturally excluded in the analysis of moving bodies. The present method roots in previous works proposed by Uhlmann [9] and Pinelli et al. [START_REF] Pinelli | Immersed-boundary methods for general finite-difference and finite-volume Navier-Stokes solvers[END_REF] which combine strengths of classical continuous forcing methods [START_REF] Peskin | Flow Patterns Around Heart Valves: A Numerical Method[END_REF] and discrete forcing methods [START_REF] Mohd-Yosuf | Combined immersed boundary/B-spline methods for simulation of flow in complex geometries[END_REF].

The novelty of the approach is represented by:

1. the extension to compressible flow configurations 2. the addition of a component which penalizes deviation from the expected behavior of the pressure gradient. In numerical simulation, the pressure field must comply with a Neumann condition in the wall normal direction.

The forcing is calculated on Lagrangian points representing the discretized shape of the body via interpolation of the physical fields available on the Eulerian Cartesian Grid. This step is followed by a consistent spreading of this value back to the Eulerian mesh elements. The resulting forcing term F in Eulerian coordinates, which will be referred to as F IB , is expressed as:

F IB = 1 ∆t ρ interpol (U target -U interpol ) -(gradp target -gradp interpol ) (4)
here the subscript interpol represents the quantities that have been interpolated on the Lagrangian points, while the subscript target represents the expected behavior of the flow close to the wall. ∆t is the time step of the numerical simulation.

Numerical implementation & validation

The implementation of the IBM model has been performed in the framework of a specific open source library for numerical simulation, namely OpenFOAM. This code has been identified as the best tester because of the simplicity in implementation as well as the availability of numerous routines already integrated [START_REF] Constant | An Immersed Boundary Method in OpenFOAM: verification and validation[END_REF]. Owing to the large spectrum of Ma numbers investigated, the IBM has been implemented in two different solvers:

• segregated pressure-based solver with pimple loop for compressible flow with low Mach number (Ma ≤ 0.3) [START_REF] Gutirrez Marcantoni | High speed flow simulation using OpenFOAM[END_REF]. • segregated density-based solver with Kurganov and Tadmor divergence scheme for compressible flow with high Mach number (Ma > 0.

3) [START_REF] Kurganov | New high-resolution central schemes for nonlinear conservation laws and convection-diffusion equations[END_REF].

Two 2D test cases have been identified to validate the performance of the compressible IBM solver, namely the flow around a circular cylinder and the flow around a three cylinders configuration. For both test cases, numerical results indicate that the present version of the IBM successfully captures the physical features over the whole parametric space investigated. In addition, the pressure correction term in equation 4 proves to be essential in obtaining an accurate near wall estimation of the flow. Results are shown for reference in figure 1a for the unsteady subsonic flow around circular cylinder, where the Karman street is correctly represented, and in figure 1b for the supersonic flow around a three cylinder configuration. For this last case, it is observed that the presence of the lateral cylinders decreases the drag coefficient of the central cylinder.

DNS of compressible flows around a sphere

The three-dimensional flow around a sphere has been investigated for different configurations including subsonic, transonic and supersonic flow cases. Present results are compared with classical DNS by Nagata [START_REF] Nagata | Investigation on subsonic to supersonic flow around a sphere at low Reynolds number of between 50 and 300 by direct numerical simulation[END_REF] for embedded surfaces using a spherical mesh. The near wall Cartesian mesh resolution has been fixed accordingly with Johnson and Patel formula for direct numerical simulation [START_REF] Johnson | Flow past a sphere up to a Reynolds number of 300[END_REF], resulting in cubic elements of resolution 0.0078 D, where D is the sphere diameter. This level of refinement is imposed in a region of size

x × y × z = [-1, 1] × [-1, 1] × [-1, 1]
in D units. The origin is fixed in the center of the sphere. A progressive coarsening ratio is imposed outside this region, resulting in a total of 2 × 10 7 mesh elements. As discussed in the introduction, this test case exhibits numerous physical configurations which are sensitive to the value of Ma and Re initially imposed. Results for nine configurations are here discussed, as summarized in table 1. Depending on the choice of the parameters Ma, Re a steady axisymmetric configuration or an unsteady flow configuration is observed. A very good agreement with results in the literature [START_REF] Krumins | A review of sphere drag coefficients applicable to atmospheric density sensing[END_REF][START_REF] Nagata | Investigation on subsonic to supersonic flow around a sphere at low Reynolds number of between 50 and 300 by direct numerical simulation[END_REF] is observed for all the configurations investigated. In particular, results for the bulk flow quantities (friction coefficient C D , recirculation bubble Xs, Strouhal number St and shock distance from stagnation point Dshock) are presented in table 2. In the following, a brief discussion is proposed clustering the results with respect to the Mach number. The subsonic flow configuration for Ma = 0.3 clearly exhibits an stationary behavior for Re = 50, while unsteady flows are obtained for Re = 300 and Re = 600 (see figures 2a and 2b). For the unstationary cases, the IBM method allows for a precise estimation of the bulk statistical quantities. The results obtained for the transonic case (Ma = 0.95) are shown in figures 3a, 3b, 3c and 3d. For this case, steady configurations are observed for Re = 50 and Re = 300, while an unsteady flow is obtained for Re = 600. The most interesting aspect for this class of simulations is that an accurate representation of the supersonic zone at the wall is observed, which is usually a challenging point for IBM methods. At last, the supersonic flow configurations for Ma = 2 are considered. In this case compressibility effects are very strong and all the simulations produce steady flows. Again, the analysis of the main bulk flow quantities indicate that all the physical features are accurately captured, when compared with data in the literature [START_REF] Krumins | A review of sphere drag coefficients applicable to atmospheric density sensing[END_REF][START_REF] Nagata | Investigation on subsonic to supersonic flow around a sphere at low Reynolds number of between 50 and 300 by direct numerical simulation[END_REF]. Isocontours are shown in figures 4a and 4b.

Conclusion

The flow around a sphere has been analyzed via an IBM for adiabatic compressible flows. The analysis has encompassed a wide range of Re, Ma for which various physical features emerge. The results of the present analysis indicate that the proposed IBM model successfully captures the physical features for the entire spectrum of configurations investigated. An accurate prediction of the main bulk quantities has been obtained and, in particular, the method has proven robustness characteristics in capturing shock features and the supersonic zone on the sphere surface. This research work has been developed using computational resources in the framework of the project DARI-GENCI A0012A07590.

Fig. 1a Q 3 Fig. 1b

 1a31b Fig. 1a Q-Criterion for a 2D subsonic flow around a circular cylinder , Ma=0.3

Fig. 2a

 2a Fig. 2a Mach isocontours for a 3D steady flow around a sphere , Ma=0.3 Re=50

Fig. 3a

 3a Fig. 3a Mach isocontours for a 3D steady flow around a sphere , Ma=0.95 Re=50

Fig. 4a

 4a Fig. 4a Mach field of a 3D supersonic flow around a sphere , Ma=2 Re=300

  Riahi • M. Meldi • E. Goncalves Institut PPRIME, Department of Fluid Flow, Heat Transfer and Combustion, ENSMA -CNRS -Université de Poitiers, UPR 3346, Poitiers, France., e-mail: {hamza.riahi,marcello.

	meldi,eric.goncalves}@ensma.fr
	E. Constant • J. Favier • P. Meliga • E. Serre
	Aix-Marseille Université, CNRS,Ecole Centrale Marseille, Laboratoire M2P2 UMR 7340, 13451,
	Marseille, France.
	1

H.

Table 1

 1 Flow regimes

		SUBSONIC LOW MACH	TRANSONIC FLOW	SUPERSONIC FLOW
		Ma=0.3	Ma=0.95	Ma=2
	Re=50 STEADY AXISYMMETRIC STEADY AXISYMMETRIC STEADY AXISYMMETRIC
	Re=300	UNSTEADY	STEADY AXISYMMETRIC STEADY AXISYMMETRIC
	Re=600	UNSTEADY	UNSTEADY	STEADY AXISYMMETRIC

Table 2

 2 Results of a 3D compressible flow around sphere

		Ma=0.3			Ma=0.95		Ma=2
	C D	Xs	St	C D	Xs	St	C D Xs Dshock
	Re=50 IBM Results 1.6	0.96	-	2.116 1.15		2.03 0.5	0.73
	Nagata et al.[6] 1.57 0.95	-	-	-		2.25 0.5	0.75
	Re=300 IBM Results 0.703	-	0.123	1.03	3.8		1.39 1	0.7
	Nagata et al.[6] 0.68	-	0.128	1	4.1		1.41 1	0.7
	Re=600 IBM Results 0.58	-	0.143	0.91	-	0.138	1.27 1.7	0.68
	Krumins.[4] 0.54	-	-	0.9	-	-	1.17 -	-