Sana Belguith

Nesrine Kaaniche
email: nesrine.kaaniche@telecom-sudparis.eu

Giovanni Russello
email: g.russello@auckland.ac.nz

Lightweight Attribute-Based Encryption Supporting Access Policy Update for Cloud Assitsed IoT

Keywords: Constant-size Attribute based encryption, Access policy update, Cloud assisted IoT, Confidentiality, Access control

Cloud-assisted IoT applications are gaining an expanding interest, such that IoT devices are deployed in different distributed environments to collect and outsource sensed data to remote servers for further processing and sharing among users. On the one hand, in several applications, collected data are extremely sensitive and need to be protected before outsourcing. Generally, encryption techniques are applied at the data producer side to protect data from adversaries as well as curious cloud provider. On the other hand, sharing data among users requires fine grained access control mechanisms. To ensure both requirements, Attribute Based Encryption (ABE) has been widely applied to ensure encrypted access control to outsourced data. Although, ABE ensures fine grained access control and data confidentiality, updates of used access policies after encryption and outsourcing of data remains an open challenge. In this paper, we design PU-ABE, a new variant of key policy attribute based encryption supporting efficient access policy update that captures attributes addition and revocation to access policies. PU-ABE contributions are multifold. First, access policies involved in the encryption can be updated without requiring sharing secret keys between the cloud server and the data owners neither re-encrypting data. Second, PU-ABE ensures privacy preserving and fine grained access control to outsourced data. Third, ciphertexts received by the end-user are constant sized and independent from the number of attributes used in the access policy which affords low communication and storage costs.

INTRODUCTION

Nowadays, IoT applications are widely used in different fields such as smart cities, e-health, intelligent transport systems, to name a few [START_REF] Farhan | Iot-based students interaction framework using attention-scoring assessment in elearning[END_REF][START_REF] Atwady | A survey on authentication techniques for the internet of things[END_REF][START_REF] Coates | Internet of things for buildings monitoring: Experiences and challenges[END_REF][START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF]. Due to their limited storage and computation capacities, IoT devices are usually assisted with cloud services to store and process generated data [START_REF] Kaaniche | Data security and privacy preservation in cloud storage environments based on cryptographic mechanisms[END_REF][START_REF] Belguith | Enhancing data security in cloud computing using a lightweight cryptographic algorithm[END_REF]. IoT devices produce huge amounts of data which need to be securely collected and shared among different users (Bacis et al., 2016a;[START_REF] Bacis | Access control management for secure cloud storage[END_REF]. Consequently, encryption and access control mechanisms are important to protect data from unauthorised access [START_REF] Belguith | Pabac: a privacy preserving attribute based framework for fine grained access control in clouds[END_REF].

Attribute based encryption (ABE) ensures encrypted access control to outsourced data while limiting privacy leakage of data producers and users (Kaaniche and Laurent, 2017a). ABE consists of enciphering data with respect to an access policy over a set of attributes where users who have the matching attributes can recover data. Nowadays, with the emergence of applications adapted to distributed and dynamic environments, several settings require adding new users, strengthening access patterns and/or removing current users from systems. A naive solution is to re-encrypt the whole data contents using new access policy by the data owner and re-outsource them to the cloud server. However, this solution is extremely expensive in computation and communications costs as it should be re-executed at every time a user is added or removed. Proxy re-encryption techniques are used to update users in outsourced systems. These mechanisms allow a server to re-encrypt stored data without accessing their content using a reencryption key [START_REF] Liang | A secure and efficient ciphertext-policy attribute-based proxy re-encryption for cloud data sharing[END_REF][START_REF] Ge | A cca-secure key-policy attribute-based proxy re-encryption in the adaptive corruption model for dropbox data sharing system[END_REF]. Attribute-based Proxy Re-encryption (AB-PRE) systems have been applied for access policy update. In AB-PRE, when the data owner decides to update access policies of some ciphertexts, she uses her private key to generated a re-encryption key for each ci-phertext to be changed from an old access policy to a new one. Afterwards, all the generated re-encryption keys are uploaded to a proxy server to update the ciphertext using the received keys. Although AB-PRE schemes allow re-encryption without decrypting ciphertext or accessing the plaintexts, it requires that the data owner generates valid re-encryption keys. When the number of ciphertext rises, it becomes inefficient for a data owner to generate all the re-encryption keys and upload them to the proxy. Furthermore, this may also be unfeasible for limited bandwidths. Therefore, attribute-based proxy re-encryption schemes may not be efficient when updating a huge the number of ciphertexts.

Key Policy Attribute Based Encryption (KP-ABE) is widely applied to secure data in several distributed systems such as Publish and Subscribe systems (Pub/Sub) [START_REF] Ion | Design and implementation of a confidentiality and access control solution for publish/subscribe systems[END_REF][START_REF] Esposito | On security in publish/subscribe services: a survey[END_REF], pay-TV systems [START_REF] Ogawa | Key management for versatile pay-tv services[END_REF], vehicular networks [START_REF] Nkenyereye | A secure billing protocol over attribute-based encryption in vehicular cloud computing[END_REF], ..., where rules on who may read a document must be specified but it is unable to specify policies on a per-message basis. Obviously, these dynamic environments usually require efficiently adding new users and/or revoking existent users. That is, KP-ABE consists in labeling user's key by an access structure that specifies which type of ciphertext the key can decrypt, while ciphertext are labeled by a set of attributes. Thus, KP-ABE are adapted to distributed and decentralized environments. Instead, Ciphertext Policy Attribute Based Encryption (CP-ABE) schemes consists in associating an access structure to the ciphertext while assigning a set of credentials to deciphering users. CP-ABE schemes supporting policy update have been recently explored by [START_REF] Jiang | Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes[END_REF][START_REF] Jiang | Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes[END_REF]. Indeed, the authors proposed a CP-ABE scheme where new attributes can be added or current attributes can be removed efficiently without sharing re-encryption keys.

This motivates us to introduce the first KP-ABE scheme supporting adding and/or removing attributes from the access policy without sharing keys with the cloud server.

Contributions -In this paper, we propose Policy Update Attribute Based Encryption (PU-ABE), a novel key policy attribute based encryption scheme which supports access policy update. This proposed scheme is suitable for bandwidth-limited applications as the size of the ciphertext received by end-users does not depend on the number of attributes involved in the access policy. In PU-ABE, the encrypting entity generates a ciphertext involving encrypted data together with some extra components used for supporting the access policy update feature. The ciphertext is forwarded to the cloud server that can update the access policy upon demand. Indeed, the cloud server does not need to be trusted. That is, it stores and shares ciphertexts among authorised users and also executes access policy update algorithm as requested. While executing these functionalities, the remote server is unable of decrypting any ciphertexts neither accessing any secret keys. For supporting the policy update feature, PU-ABE provides two functions. The first function permits to add new attributes to the access policy used to encrypt data. The second function ensures revoking attributes from the access policy used in the encryption phase. To prove the security of our proposed constructions, we present an updated security model to capture security requirements related to policy updates.

Paper Organisation -The remainder of this work is as follows: Section 2 highlights security considerations and design goals. Then, Section 3 reviews related work and section 4 describes the system and security models. Section 5 presents the mathematical background. In Section 6, an overview of PU-ABE is introduced and the detailed construction are presented. Section 7 presents a rigorous security discussion. Finally, a theoretical analysis of computational performances is presented in Section 8, before concluding in Section 9.

PU-ABE FRAMEWORK

In this section, we first present the network model, detailing the involved entities and their interactions in Section 2.1. Then, we detail the security requirements that the proposed system should fulfill in Section 2.2.

Architecture

As depicted by Figure 1, our PU-ABE framework considers a cloud service provider that stores data generated by data owners and share them among authorised users. Four different entities are defined as follows:

• The Central Trusted Authority (CTA), known by the Attribute authority, is responsible for generating the global public parameters and issuing users' secret keys. CTA is considered as a trusted entity in our model.

• The Cloud Service Provider (CSP) is a remote cloud server who stores and shares data among authorised users. CSP is also responsible of executing the update algorithm to change the access policy involved in the ciphertext, w.r.t. the data owner's recommendations.

• The data owner (O) is the data producer. She defines access rights and encrypts data with respect to them before outsourcing to the cloud. In addition, the data owner generates extra ciphertext components used by the update algorithm.

• The data users (U) requests access to outsourced data. She decrypts the received data using his access rights. A user may be malicious if she tries to access data without authorisation.

Security Requirements

To design an efficient attribute based encryption scheme supporting efficient access policy update, the following requirements need to be achieved:

• access policy updateour PU-ABE scheme should ensure adding new attributes and/or removing attributes from the access policy.

• flexible access controlour proposal should ensure flexible security policies among dynamic groups of users, w.r.t. forward secrecy and backward secrecy.

backward secrecy means that a new added user to a group is unable to decrypt information created prior to their introduction. forward secrecy means that a compromise of the secret key does not affect the secrecy of future encrypted data.

• data confidentialityour PU-ABE scheme has to protect the secrecy of outsourced and encrypted data contents against curious users and curious cloud service provider.

• low computation overhead and storage costthe proposed algorithms should have low processing complexity and acceptable storage cost to be adapted to resource-constrained devices and distributed environments.

ATTRIBUTE BASED ENCRYPTION SCHEMES

Attribute-based Encryption (ABE) has been designed to ensure encrypted flexible access control for outsourced data [START_REF] Sahai | Fuzzy identity-based encryption[END_REF]. Unlike traditional public key encryption schemes, ABE consists in encrypting data for many users. Therefore, decrypting entities' private keys and encrypted data are labeled with a set of attributes or a structure over attributes. A user is able to decrypt a ciphertext if there is a match between her private key and the ciphertext [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. Attribute based encryption schemes are classified into two categories, namely: Key-Policy ABE (KP-ABE) and Ciphertext-Policy ABE (CP-ABE) [START_REF] Goyal | Attribute-based encryption for fine-grained access control of encrypted data[END_REF]. In KP-ABE, ciphertexts are labeled with a set of attributes while users' private keys are associated with an access policy which can be any monotonic structure. The user is able to decrypt the ciphertext if her access policy is satisfied by the attributes embedded in the ciphertext. KP-ABE schemes have been widely applied to secure data in distributed systems such as Internet of Things, publish and subscribe systems, intelligent transport systems, etc. [START_REF] Yao | A lightweight attribute-based encryption scheme for the internet of things[END_REF].

Although ABE schemes ensure flexible access control to encrypted data, the communication and computation overhead as well as the bandwidth consumption increase exponentially with the number of attributes required in the access policies. To save the storage cost of ciphertext and processing overhead of encryption, attribute based encryption schemes with constant ciphertext size have been introduced [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based en-cryption[END_REF][START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF][START_REF] Attrapadung | Attributebased encryption schemes with constant-size ciphertexts[END_REF][START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF]. In these schemes, the size of the generated ciphertext does not depend on the number of attributes used on the threshold access policies, which presents an interesting feature mainly for resource-constrained devices. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based en-cryption[END_REF] have proposed the first constant size threshold ciphertext-policy attribute based encryption scheme. Indeed, the ciphertext size is constant and does not depend on the number of attributes involved in the threshold access policies. Afterwards, several CP-ABE schemes with constant cipheretxt size have been proposed [START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF][START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF][START_REF] Li | Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[END_REF]. Due to the construction of CP-ABE schemes, monotone access policies based schemes can not be extended to ensure a constant ciphertext size. For instance, these schemes consist in only using threshold or conjunctive access policies which do not provide the desired expressiveness.

Several expressive Key policy attribute based encryption schemes with constant ciphertext size have been designed [START_REF] Attrapadung | Attributebased encryption schemes with constant-size ciphertexts[END_REF][START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF][START_REF] Emura | A ciphertext-policy attribute-based encryption scheme with constant ciphertext length[END_REF]. Wang et al. [START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF] have proposed a KP-ABE scheme with constant ciphertext size. This scheme relies on a monotone access policy to express the users' attributes.

Although, these schemes ensure reduced communication and computation costs, they still present a major limitation which is their incapacity of changing access policies of ciphertexts. In dynamic envi- ronments, users may be often added or removed, then access policies should be updated to support these changes. Recently, the first CP-ABE with policy update has been proposed by [START_REF] Jiang | Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes[END_REF][START_REF] Jiang | Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes[END_REF]. The authors introduced a new variant of CP-ABE supporting access policy update that captures the functionalities of attribute addition and revocation from access policies. They provide two CP-ABE schemes supporting AND-gate access policies with constant-size ciphertexts. PUABE

MODEL DESCRIPTION

In this section, we first present the system model of our PU-ABE scheme (subsection 4.1). Then, we detail our security model (subsection 4.2).

System Model

Our policy-update key-policy attribute based encryption scheme consists of five randomized algorithms: setup, encrypt, update, keygen and decrypt, defined as follows: setup(ξ) → (pp, msk) -the setup algorithm is performed by a central trusted authority, known by the attribute authority. It takes as input a security parameter ξ and outputs the public parameters pp and the secret master key msk. Our PU-ABE scheme has to satisfy the correctness property. The correctness property requires that for all security parameter ξ, all attribute uni-verse descriptions U, all (pp, msk) ∈ setup(ξ), all (S , U) ⊆ U (i.e; U is the attribute universe), all sk ∈ keygen(pp, msk, Ψ), all M ∈ M (i.e; M is the message universe), all Ψ ∈ G (G is the access policy space), all CT ∈ encrypt(pp, S,M), and all CT ∈ (pp,CT, ind, U) if the decrypting user has correctly obtained the secret key sk related to the Ψ required access policy S for deciphering the encrypted message, the derypt(pp, sk,CT ) outputs M.

Security Model

For designing a secure policy-update attribute based encryption scheme, we consider the case of malicious adversaries with respect to the indistinguishability property. The indistinguishability property means that if an adversary has some information about the plaintext, he should not learn about the ciphertext. This security notion requires the computational impossibility to distinguish between two messages chosen by the adversary with a probability greater than a half.

To design the most suitable security model considering the confidentiality requirement, we adopt an updated security model to capture security requirements related to policy updates [START_REF] Jiang | Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes[END_REF]. PU-ABE is said to be indistinguishable against non-adaptive chosen ciphertext attacks if there is no probabilistic polynomial time (PPT) adversary that can win the Exp con f security game with non-negligible advantage. The Exp con f game is formally defined, between an adversary A and a challenger C as follows:

INITIALISATION -A selects a set of encryption attributes S * (i.e; S * corresponds to the set of attributes specified for the encryption) to be used for encrypting the challenge ciphertext, as a set of attributes

S * = {a i } i=1
A [Exp Con f (1 ξ )] = |Pr[b = b ] -1 2 |.

Mathematical Background

In this section, we first introduce the access structure in section 5.1. Then, in section 5.2, we present the bilinear maps. Finally, we introduce some security assumptions.

Access Policies

Access policies can be represented as a boolean functions of attributes or a Linear Secret Sharing Scheme (LSSS) matrix.

Access Structure -

Let P = {P 1 , • • • , P n } be a set of parties. A collection A ⊆ 2 {P 1 ,••• ,P n } is monotone if ∀B,C if B ∈ A and B ⊆ C then C ∈ A. An access structure is a collection A of non-empty subsets of {P 1 , • • • , P n }, such as A ⊆ 2 {P 1 ,••• ,P n } \ / 0.
Note that any access structure can be converted into a boolean function. Boolean functions can be defined as an access tree, where the leaves present the attributes while the intermediate and the root nodes are the logical operators AND (∧) and OR (∨).

Linear Secret Sharing Schemes (LSSS) -Let P be a set of parties, A be l ×n matrix, and ρ : {1, 2, • • • , l} → P be a function that maps a row to a party for labeling.

A secret sharing scheme for access structure Ψ over a set of parties P is a linear secret sharing scheme (LSSS) in Z p and is represented by (A, ρ) if it consists of two efficient algorithms:

• Share((A, ρ), s): The share algorithm takes as input s ∈ Z p which is to be shared. It randomly chooses

β 1 , • • • , β n ∈ Z p , and defines β = (β 1 = s, β 2 , • • • , β k ) T . It outputs M.
β as the vectors of l shares. The share λ i =< A i , β T > belongs to party ρ(i), where A i is the ith of A.

• Recon((A, ρ), S): The reconstruction algorithm takes as input an access set S ∈ A.

Let I = {i|ρ(i) ∈ S}. It outputs a set of constants {µ i } i∈I such that ∑ i∈I µ i • λ i = β 1 = s.

Bilinear Maps

Let G 1 , G 2 and G T be three multiplicative groups of a finite field having the same order p. An admissible asymmetric pairing function ê from G 1 × G 2 in G T has to be bilinear, non degenerate and efficiently computable.

The General Diffie-Hellman Exponent Assumption

In our PU-ABE construction, we make use of the generalisation of the Diffie-Hellman exponent assumption, formally defined by Boneh et al. in [START_REF] Boneh | Hierarchical identity based encryption with constant size ciphertext[END_REF]. The authors have introduced a class of assumptions that appeared with the use of pairingbased schemes namely Decisional DiffieHellman assumption (DDH), Bilinear Diffie-Hellman (BDH), and q-Bilinear Diffie Hellman Exponent (qBDHE) assumptions, detailed hereafter.

Let B = (p, G 1 , G 2 , G, ê : G 1 × G 2 → G) be a bilinear map group such that G 1 = G 2 = G.
Let g 0 be a generator of G and set g = ê(g 0 , g 0 ) ∈ G. Let s and n be positive integers and

P, Q ∈ F p [X 1 , • • • , X n ] s
be two s-tuples of n-variate polynomials over F p where P = (p 1 , • • • , p s ) and Q = (q 1 , • • • , q s ) and p 1 = q 1 = 1. For any function h : F p → Ω and any vector

(x 1 , • • • , x n ) ∈ F n p , h(P(x 1 , • • • , x n )) stands for (h(p 1 (x 1 , • • • , x n )), • • • , h(p s (x 1 , • • • , x n ))) ∈ Ω s and h(Q(x 1 , • • • , x n )) stands for (h(q 1 (x 1 , • • • , x n )), • • • , h(q s (x 1 , • • • , x n ))) ∈ Ω s . Let f ∈ F p [X 1 , • • • , X n ],
it is said that f depends on (P, Q), which we denote by f ∈ P, Q, when there is a linear decomposition

f = ∑ 1≤i, j≤s a i, j • p i • p j + ∑ 1≤i≤s b i • q I , a i, j , b i ∈ Z p Let P, Q be as above and f ∈ F p [X 1 , • • • , X n ].
The (P, Q, f )-General Diffie-Hellman Exponent problems are defined as follows.

Definition 1:

(P, Q, f )-GDHE. Given a tuple H(x 1 , • • • , x n ) = (g P(x 1 ,••• ,x n ) 0 , g Q(x 1 ,••• ,x n ) ) ∈ G s 1 × G s , compute g f (x 1 ,••• ,x n ) . Definition 2: (P, Q, f )-GDDHE. Given H(x 1 , • • • , x n ) ∈ G s 1 × G s , compute g f (x 1 ,••• ,x n ) as above, decide whether T = g f (x 1 ,••• ,x n ) .
We refer to [START_REF] Boneh | Hierarchical identity based encryption with constant size ciphertext[END_REF] for a proof that (P, Q, f )-GDHE and (P, Q, f )-GDDHE have generic security when f / ∈ < P, Q >.

A NOVEL KEY POLICY ATTRIBUTE BASED ENCRYPTION SUPPORTING POLICY UPDATE

In this section, we first give an overview of our proposed constant size PU-ABE scheme (subsection 6.1). Then, we detail the scheme construction.

Overview

In this paper, we develop a novel key-policy attribute based encryption scheme that supports access policy update. Our contribution extends Wang et al.'s key policy attribute based encryption scheme [START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF] to support adding new attributes or revoking others from the encryption access policy. Indeed, the cloud server is able to change a ciphertext encrypted with respect to an access policy S to a ciphertext encrypted with respect to a new access policy S such that S corresponds to S ∪U in case of attributes' addition and S \ U in case of attributes' revocation. This update does not need any re-encryption key neither the data owner to be online. It is only based on some extra ciphertext components as detailed in Section 6.2) which are used by the cloud server in the update algorithm. Indeed, while encrypting data contents, E generates additional elements in the ciphertext which point out attributes that can be added or removed later. When an access policy update is required, the cloud server uses the ciphertext's components to generate a new ciphertext suitable for the new access policy then forwards it to the decrypting entity.

Concrete Construction

Our PU-ABE construction, supporting both attributes' addition and revocation, is based on five algorithms defined as follows:

• setup -given the security parameter ξ, the attribute authority chooses three cyclic groups G 1 , G 2 and G T of prime order p and defines a bilinear pairing ê : G 1 × G 2 → G T . It also randomly selects two generators g ∈ G 1 and h ∈ G 2 as well as a secret random value α ∈ Z * p . In addition, the attribute authority sets v = ê(g, h),

{h α i } i=1•••k and {u i = g α i } i=1•••k
where k = |U| is the cardinal of the attributes universes U. Finally, it chooses a cryptographic hash function H : {0, 1} * ⇒ Z * p and outputs the public parameters pp as follows:

pp = (G 1 , G 2 , G T , v = ê(g, h), h, {h α i } i=1•••k , {u i = g α i } i=1•••k )
The master secret key is defined as msk = (g, α).

• encrypt -let S be the set of the encryption attributes S = {a i } m i=1 . This algorithm, executed by the encrypting entity E takes an extra input which is a maximum revocation number r ≤ m.

The data owner chooses s ∈ Z * p and computes the ciphertext CT as follows:

       E 0 = h s•∏ a i ∈S (α+H (a i )) E 1 = E α 0 , • • • , E k-m = E α k-m-1 C 1 = u -s 1 =, • • • ,C r+1 = u -s r+1 C M = M • ê(g, h) s
• update -the update algorithm first checks the operation indicator ind. Then, if ind = add, it proceeds as (i), otherwise if ind = revoke it executes (ii):

(i) -given a ciphertext CT encrypted w.r.t. a set of attributes S and U = {a 1 , • • • , a t } a new set of attributes where U ∩ S = / 0, the server has to add elements of U to the set of encrypting attributes S of the ciphertext CT . To do so, it proceeds as follows:

Let F(x) be the polynomial in x defined as

F(x) = ∏ a i ∈U (x + H (a i )) = f t x t + f t-1 x t-1 + • • • + f 0
Then, the algorithm computes

E 0 = E F(α) 0 = ∏ t i=0 E f i i .
The new ciphertext is then defined as CT = (E 0 ,C 1 ,C M ) w.r.t. S , the new set of encrypting attributes defined as S = S ∪ U.

(ii) -given a ciphertext CT encrypted w.r.t. a set of attributes S and a revocation attribute set U = {a 1 , • • • , a t } ⊆ S where t ≤ r, the server updates the ciphertext CT as follows: Let F(x) be the polynomial in x as

F(x) = 1 ∏ a i ∈U H (a i ) ∏ a i ∈U (x + H (a i )) = f t x t + f t-1 x t-1 + • • • + f 0
Then, the algorithm computes CT as follows:

           E 0 = E 1 ∏ a i ∈U H (a i ) 0 = h s•∏ a i ∈S \U (α+H (a i ))F(α) C 1 = ∏ t+1 t=1 C f i-1 i = g -αs ∑ t+1 i=1 α i-1 f i-1 = u -sF(α) 1 C M = C M ê(∏ t i=1 C -f i i , h) = M ê(g, h) s ∑ t i=0 f i α i = Mv sF(α)
• keygen -it computes the private key associated to an access structure Ψ w.r.t. an LSSS scheme (A, ρ) such that A is the corresponding l × n matrix. First, the keygen algorithm generates shares of 1 relying on the LSSS schema w.r.t. (A, ρ), as detailed in section 5. Namely, it chooses a column vector

β = (β 1 , β 2 , • • • , β n ) T , while β 1 = s = 1 and β 2 , • • • , β n ∈ Z p .
Then for each i = 1 to l, it calculates λ i =< A i , β T >, and sets sk as follows:

sk = {D i , (K i, j ) n j=0 } l i=0 = {g λ i α+H (ρ(i)) , (h λ i α j ) n j=0 } l i=0 • decrypt -the cipherext CT is
= {D i , (K i, j ) n j=0 } l i=0 .
Then, D computes the polynomial on the variable α with degree m + t -1 as follows:

P i,A(α) = λ i α ( ∏ j=1, j =i (α + H (a j )) -∏ j=1, j =i H (a j )))
D calculates h P i,A(α) according to his secret key component (K i, j ) n j=0 . Afterwards, she computes Y i which can be retrieved based on two cases w.r.t. the ind operator value, such that:

-Case 1: if attributes have been added to the access policy:

Y i = ( ê(C 1 , h P i,A(α) ) • ê(D i ,C 2 )) 1 ∏ j=1, j =i H (a i )) = ê(g, h) sλ i Finally, D computes Y = ∏ i∈I Y µ i i = ê(g, h)
s and retrieves M = C M /Y . Note that if no changes have been made to the access policy and the corresponding ciphertext, the decryption process follows Case 1.

-Case 2: if attributes have been revoked from the access policy:

Y i = ( ê(C 1 , h P i,A(α) ) • e(D i , E 0 )) 1 ∏ j=1, j =i H (a i )) = ê(g, h) sF(α)λ i Finally, D computes Y = ∏ i∈I Y µ i i = ê(g, h) s and retrieves M = C M /Y .
In this section, we first prove the correctness of our PU-ABE construction, with respect to the data decryption algorithms proposed in the previous construction, in section 7.1. Then, we prove the security of our proposal, with respect to the indistinguishability property in Section 7.2.

Correctness

In the following, we prove the correctness of the PU-ABE proposed construction w.r.t. the attributes' addition and revocation. A decrypting entity D who possesses a set of attributes expressed with respect to an access structure Ψ, satisfying S first sets P i,A(α) = λ i α (∏ j=1, j =i (α + H (a j )) -∏ j=1, j =i H (a j ))). Then, D uses his secret keys to compute Y i with respect to the two following cases:

• Case 1: if ind = add and S = S ∪ U, then Y i is computed as:

Y i = [ ê(C 1 , h P i,A(α) ) • ê(D i , E 0 )] 1 ∏ j=1, j =i H (a j )) = [ ê(g -αs , h P i,A(α) ) • ê(g λ i α+H (ρ(i)) , E F(α) 0 )] 1 ∏ j=1, j =i H (a j )) = [ ê(g -αs , h P i,A(α) ) • ê(g λ i α+H (ρ(i)) , h s•∏ a j ∈A (α+H (a j ))F(α) )] 1 ∏ j=1, j =i H (a j )) = [ ê(g, h) -αsP i,A(α)
• ê(g, h) sλ i F(α)•∏ j=1, j =i (α+H (a j )) )]

1 ∏ j=1, j =i H (a j ))
= [ ê(g, h) -sλ i (∏ j=1, j =i (α+H (a j )) ê(g, h) sλ i ∏ j=1, j =i H (a j )

• ê(g, h) sλ i F(α)•∏ j=1, j =i (α+H (a j )) ]

1 ∏ j=1, j =i H (a j ) = [ ê(g, h) sλ i ∏ j=1, j =i H (a j ) ] 1 ∏ j=1, j =i H (a j ) = ê(g, h) sλ i
Afterwards, the decrypting entity D computes:

Y = ∏ i∈I Y µ i i = ∏ i∈I ê(g, h) sλ i µ i = ê(g, h) s ∑ i∈I λ i µ i = ê(g, h) s
Recall that the constants mu i∈I are the reconstruction of the LSSS matrix µ i∈I = Recon((A, ρ), A). Therefore, the user retrieves Y using the following equation

< λ, µ >= ∑ i∈I λ i µ i = ∑ i∈I β 1 = ∑ i∈I 1 = 1
Finally, D retrieves M such as:

M = C M Y = C M ê(g, h) s = M ê(g, h) s ê(g, h) s
• Case 2: if ind = revoke and S = S \ U, Y i is computed as follows:

Y i = [ ê(C 1 , h P i,A(α) ) • ê(D i , E 0 )] 1 ∏ j=1, j =i H (a j )) = [ ê(u -sF(α) 1 , h P i,A(α) ) • ê(g λ i α+H (ρ( j)) , h s•∏ a j ∈A\U (α+H (a j ))F(α) )] 1 ∏ j=1, j =i H (a j )) = [ ê(g, h) -sλ i F(α)(∏ j=1, j =i (α+H (a i ))-∏ j=1, j =i H (a i ))) • ê(g, h) sλ i •∏ j=1, j =i (α+H (a j ))F(α) )] 1 ∏ j=1, j =i H (a j )) = [ ê(g, h) -sλ i F(α)(∏ j=1, j =i (α+H (a i )) • ê(g, h) sλ i F(α) ∏ j=1, j =i H (a i ))) • ê(g, h) sλ i F(α)•∏ j=1, j =i (α+H (a j ))) ] 1 ∏ j=1, j =i H (a j )) = ê(g, h) sλ i F(α)) ∏ j=1, j =i H (a i ) ∏ j=1, j =i H (a j ) = ê(g, h) sF(α)λ i
Afterwards, the decrypting entity computes:

Y = ∏ i∈I Y µ i i = ∏ i∈I ê(g, h) sF(α)λ i µ i = ê(g, h) sF(α) ∑ i∈I λ i µ i = ê(g, h) sF(α)
Finally, D retrieves M such as:

M = C M Y = C M ê(g, h) sF(α) = M ê(g, h) sF(α) ê(g, h) sF(α)

Confidentiality

In the following proof, we prove that our PU-ABE scheme is CPA-Secure against non-adaptive Chosen Ciphertext Attacks with respect to Theorem 1.

Theorem 1. For any adversary A, against CPA-Secure against non-adaptive chosen ciphertext, our PU-ABE scheme is indistinguishable according to Definition 4.2 with respect to the hardness of the General Diffie-Hellman Exponent (GDHE) assumption ( Definition 5.3) Proof. To decrypt a ciphertext CT' associated with an updated access policy S , A must recover ê(g, h) s , in case of attributes' addition and ê(g, h) s ∑ t i=0 f i α i , in case of attributes' revocation, where the secret sharing key s is embedded in the ciphertext. For this purpose, A has to retrieve the corresponding CM and the related private key. To prove that our scheme is secure against selective non-adaptive chosen ciphertext attacks, we first consider that A is running the Exp con f experiment with an entity B. This latter is running the Exp B .

Wang et al. security game [START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF], with C . The objective of this proof is to show that the advantage of A to win the G S-CPA (1 κ ) security game is equivalent to the advantage of Exp B to win the Wang et al. security game [START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF].

Hereafter, A and B proceed as follows:

INITIALISATION -in this phase, the adversary A gives the algorithm C a challenge set of attributes S * . SETUP -the challenger C runs the setup(ξ) algorithm, sends the public parameters

pp = (G 1 , G 2 , G T , v = ê(g, h), g α , h, h α , • • • , h α k , {u i = g α i } i=1•••k ) to B and keeps secret msk. Consequently, B sends pp to A.
QUERY PHASE 1 -B sets an empty table T and repeatedly queries an access policy Ψ A,i , for each session i. That is, B uses C to derive and send the queried secret keys to A.

= (β 1 , β 2 , • • • , β n ) T , while β 1 = s = 1 and β 2 , • • • , β n ∈ Z p .
Then for each i = 1 to l, it calculates λ i =< A i , β T >, and sets sk as sk A,i =

{g λ i α+H (ρ(i)) , (h λ i α j ) n j=0 } l i=0 .
Note that the access policy Ψ A,i does not satisfy the encryption attribute set S * . The private keys

sk A,i = {g λ i α+H (ρ(i)) , (h λ i α j ) n j=0 } l
i=0 are returned to B. Subsequently, B sets a new entry with the private key and returns sk A,i = {g

λ i α+H (ρ(i)) , (h λ i α j ) n j=0 } l i=0 to A.
       E 0 = h s•∏ a i ∈S B
(α+H (a i ))

E 1 = E α 0 , • • • , E p-m = E p-m-1 C 1 = u -s 1 =, • • • ,C r+1 = u -s r+1 C M = M • v s = M • ê(g, h) s
The challenger C gives CT b * to the adversary if

U = / 0, otherwise CT * b = update(pp,CT b * , ind, U * ).
QUERY PHASE 2 -in this phase, the adversary A can query a polynomially bounded number of queries as in QUERY PHASE 1, except that A cannot query secret keys related to a set of attributes S * .

Hereafter, two cases are considered w.r.t. the ind operator value, randomly selected by C in order to encrypt the challenging message such that:

• Case 1 -the first case corresponds to attributes' addition, such that C sets S B = S B ∪ U * and outputs an encrypted message CT b , as defined in section 6.2. In this case, we first show that how a challenge ciphertext should be produced. In fact, given a ciphertext CT encrypted w.r.t. a set of attributes S B and U * = {a 1 , • • • , a t } a new set of attributes where U ∩ S = / 0, C has to add elements of U * to the set of encrypting attributes S B of the ciphertext CT b . To do so, it proceeds as follows: Let F(x) be the polynomial in x defined as F(x) =

∏ a i ∈U * (x + H (a i )) = f t x t + f t-1 x t-1 + • • • + f 0 Then, the algorithm computes E * 0 = E * F(α) 0 = ∏ t i=0 E f i i .
The new ciphertext is then defined as CT b = (E * 0 ,C 1 ,C M ) w.r.t. S , the new set of encrypting attributes defined as S B = S B ∪ U * .

• Case 2 -the second case corresponds to attributes' revocation, such that C defines S B = S B \ U * and outputs an encrypted message CT b , as detailed in section 6.2. That is, given a ciphertext CT encrypted w.r.t. a set of attributes S B and a revocation attribute set

U * = {a 1 , • • • , a t } ⊆ S B
where t ≤ r, the server updates the ciphertext CT b as follows: Let F(x) be the polynomial in x as

F(x) = 1 ∏ a i ∈U * H (a i ) ∏ a i ∈U (x + H (a i )) = f t x t + f t-1 x t-1 + • • • + f 0 . Similarly, the new ciphertext is then defined as CT b = (E * 0 ,C * 1 ,C * M ) w.r.t.
S , the new set of encrypting attributes defined as S B = S B \ U * .

Without loss of generality, the distribution of the received challenge ciphertext does not depend on the attributes' addition and revocation. More precisely, the distribution of the challenge enciphered message is quite similar in both cases. Thus, the resistance of PU-ABE scheme against CPA, follows (Wang and Luo, 2012) construction, w.r.t. to B, that is proven secure under the GDDHE assumption. Thus, the view of B is indistinguishable from the view of A, considering a randomly selected enciphered message w.r.t. S B referring to the updated access policy.

As such, we prove that our PU-ABE construction is secure against selective non-adaptive chosen ciphertexts attacks in the standard model, under the GDDHE assumption, with respect to Exp con f security experiment.

PERFORMANCES ANALYSIS

In this section, we present the computation and the storage complexities of our proposed PU-ABE scheme. In our analysis, we are interested in the computations performed to execute the encrypt, update and the decrypt algorithms as well as the size of the generated encrypted message and the size of the secret keys as introduced in Table 1.

Storage Complexities

Emura et al. [START_REF] Emura | A ciphertext-policy attribute-based encryption scheme with constant ciphertext length[END_REF] introduced a KP-ABE scheme requiring only 2 keys per user independent of the users' attributes. In addition, this scheme generates a ciphertext composed only of 3 elements. Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based en-cryption[END_REF] have proposed the first CP-ABE scheme generating a ciphertext whose size does not depend on the number of attributes used in the threshold access policy. In this scheme, the decrypting entity needs k + n secret keys' where k is the cardinal of the attributes universes and n is the number of the users' attributes. In [START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF], the authors proposes a CP-ABE scheme with constant ciphertext size. However, this schemes requires the use of 3k -2 + n secret keys. Similarly, the authors in [START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF] proposed a KP-ABE scheme which produces only 3 elements in the ciphertext. The users' secret keys are equal to k(n + 1). This size of secret keys is due to the use of LSSS monotone access policies which makes the scheme more expressive than the aforementioned schemes.

Although, the above schemes ensure low storage and communication costs, they do not support access policy updates. Indeed, if the access rights change with the addition or the revocation of some attributes, outsourceddata need to be re-encrypted.

Jiang et al. [START_REF] Jiang | Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes[END_REF], have proposed a threshold CP-ABE scheme supporting access policy update. The authors proposed two different construction. The first construction ensures the addition of attributes to the access policy. This incurs the generation of a ciphertext whose size is equal to 3 + km to be forwarded to the cloud server however the final user only receives 3 elements of the ciphertext no matter how many attributes are used in the access policy.

The second construction provides the ability to revoke attributes from the access policy. Therefore, the generated access policy depends on the maximum number of attributes in an attribute revocation list. Like the first construction, the user only needs three elements to decrypt data. Both the proposed construction require n + 1 secret keys for every user.

In our PU-ABE scheme, we apply a compact policy update technique to ensure adding and/or removing attributes from access policies in KP-ABE schemes. Therefore, the proposed construction generates a ciphertext size equal to 3 + k + rm. Users receives a constant ciphertext size independent from the number of attributes involved in the access policy and from the applied update procedures. PU-ABE relies in using monotone access policies, then the users secret keys are equal to n + k elements. Therefore, the proposed PU-ABE scheme ensures expressiveness and policy updates while introducing comparative storage with similar ABE schemes.

Computation Complexities

The proposed schemes in [START_REF] Emura | A ciphertext-policy attribute-based encryption scheme with constant ciphertext length[END_REF], [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based en-cryption[END_REF] and [START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF] introduce an encryption algorithm which requires two exponentiations in G 1 and one exponentiation in G. Ge et al.'s scheme [START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF] introduces an encryption algorithm requiring 5 exponentiations in G 1 and one exponentiation in G. In Emura et al.' scheme [START_REF] Emura | A ciphertext-policy attribute-based encryption scheme with constant ciphertext length[END_REF], the decrypting entity needs to perform two pairing operations and 3 exponentiations in G 1 . Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based en-cryption[END_REF] decryption algorithm requires n + 1 exponentiations in G 1 , 5 pairing functions and one exponentiation in G. In [START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF] scheme, the users executes 4 pairing operations and 2(kn) exponentiations in G 1 . Wang et al. proposed a KP-ABE scheme [START_REF] Wang | A key-policy attributebased encryption scheme with constant size ciphertext[END_REF] where the decryption algorithm performs n + 1 exponentiations in G, one exponentiation in G 1 and two pairing operations.

The aforementioned schemes do not ensure access policies update. Jiang et al.'s scheme is the first CP-ABE scheme supporting policy updates. In this We denote by E 1 the exponentiation cost in G 1 , E the exponentiation cost in G and τ P the computation cost of a pairing function ê. n is the number of attributes of a user. k is the cardinal of the universe of attributes U. m is the number of attributes used in an access policy for encryption. t is the number of attributes (t = |U|) added or removed from an access policy and r is the maximum number of attributes supported by the revocation list.

scheme, the encryption algorithm related to the attributes addition construction require km + 2 exponentiations in G 1 and only one exponentiation in G. In addition, the attribute revocation encryption algorithms requires r + 2 exponentiations in G 1 and only one exponentiation in G. This proposal consists in executing an update algorithm by the cloud server to update the used access policy used in the encryption. Therefore, it requires t exponentiations in G 1 to add attributes and 2t + 2 exponentiations in G 1 and one pairing operation to revoke attributes. In [START_REF] Jiang | Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes[END_REF], the decryption algorithm incurs 2τ p + nE 1 overhead. PU-ABE scheme requires the execution of (km + 2 + r) exponentiations in G 1 and only one exponentiation in G. The proposed scheme requires the execution of two update functions to add attributes or revoke attributes from the access policy. To add new attributes, it requires t exponentiations in G 1 while revoking t attributes needs to an overhead equal to (2t + 2)E 1 + τ p , where t is the number of attributes to be added or removed. Our PU-ABE scheme requires 2τ p + E 1 + (n + 1)E as a decryption overhead due to the use of monotone access policies.

Above all, our proposed PU-ABE scheme presents quite similar to the computation costs of the related attribute based encryption schemes while providing more practical features mainly related to expressiveness and policy update.

CONCLUSIONS

Attribute based encryption is often used to ensure encrypted access control to outsourced data for multiuser settings. That is, in several applications, users are removed and/or added, thus, it require an efficient update of users' access rights.

In this paper, we propose PU-ABE, a novel key policy attribute based encryption technique, with short size ciphertexts that supports access policy update. Indeed, a cloud server can add and/or remove attributes from the encryption access policy without requiring data re-encryption. The proposed PU-ABE scheme is proved to be secure against chosen ciphertexts attacks in the standard model. Finally, a detailed performances analysis showed that PU-ABE ciphertexts are short-sized and independent from the number of attributes used in the access policy which affords low communication and storage costs, compared to most-closely related schemes.

  Figure 1: PU-ABE involved entities and their interaction

  encrypt(pp, S,M) → CT -the encryption algorithm is performed by an enciphering entity E. It takes as inputs the public parameters pp, the set of the encryption attributes S and the message M. This algorithm outputs the encrypted message, referred to as CT . update(pp,CT, ind, U) → CT -the update algorithm is executed by a cloud server. It takes as inputs the public parameters pp, a ciphertext CT that contains the set of enciphering attributes S = {a i } i=1..m such that |S | = m, an operation indicator ind where ind = add or ind = revoke and a set of attributes U with U ∩ S = / 0 if ind = add or U ⊂ S if ind = revoke. It outputs a new ciphertext CT for the new encrypting set of attributes S such as S = S ∪ U or S = S \ U w.r.t. ind value. keygen(pp, msk, Ψ) → sk -this randomized algorithm is executed by the attribute authority to derive the secret keys of a decrypting entity D. Given the public parameters pp, an access policy Ψ of the user D and the secret master key msk. The algorithm outputs the user's secret key sk w.r.t. Ψ. decrypt(pp, sk,CT ) → M -the decryption algorithm is executed by the decrypting entity D. It takes as inputs the public parameters pp, the user's secret key sk and the ciphertext CT . The algorithm returns the message M if D has correctly obtained the secret key related to the required set of attributes for deciphering the encrypted message. Otherwise, the algorithm outputs a reject symbol ⊥.

  ..m where |S * | = m. A sends S * to C . SETUP -the challenger C runs the setup(ξ) algorithm, sends the public parameters pp to the adversary A and keeps secret the master key msk. QUERY PHASE 1 -the adversary A queries, for each session i, an access policy Ψ A,i . The challenger C answers by running the keygen(pp, msk, Ψ A,i ) algorithm and sends the resulting secret key sk A,i to the adversary A. Note that the access policy Ψ A,i does not satisfy the encryption attribute set S * . CHALLENGE PHASE -during the challenge phase, A picks two equal length cleartexts M 0 * and M 1 * as well as an attribute set U * with |U * | = t U * ∩ S * = / 0 if ind = add or U * ⊂ S * if ind = revoke. The challenger C chooses a random bit b from {0, 1} with S * = S * \ U * for ind = add or S * = S * ∩ U * for ind = revoke and computes the challenge encrypted message CT b * = encrypt(pp, S * , M b * ). It gives CT b * to the adversary if U = / 0, otherwise CT * b = update(pp,CT b * , ind, U * ). QUERY PHASE 2 -in this phase, the adversary A can query a polynomially bounded number of queries as in QUERY PHASE 1, except that A cannot query secret keys related to a set of attributes S * . GUESS -A tries to guess which message M i , where i ∈ {0, 1} corresponds to the enciphered data CT b * . Thus, A outputs a bit b of b and wins the game if b = b . The advantage of the adversary A in the above game is defined as Adv

  encrypted under the set of attributes S = S ∪ U = {a t+m i=1 }. The decrypting entity D having a secret key sk (A,ρ) first sets I = i|ρ(i) ∈ S , and calculates the reconstruction of constants µ i∈I = Recon((A, ρ), S). The decryption key corresponding to the LSSS scheme w.r.t. (A, ρ) is parsed as sk

  The challenger C answers by running the keygen(pp, msk, Ψ A,i ) algorithm. The challenger C generates shares of 1 relying on the LSSS schema w.r.t. (A, ρ). It chooses a column vector β

  CHALLENGE PHASE -during the challenge phase, A picks two equal length cleartexts M 0 * and M 1 * as well as an attribute set U * with |U * | = t U * ∩ S * = / 0 if ind = add or U * ⊂ S * if ind = revoke. Subsequently, B selects S B such that S B ⊆ S * , such as S * = S * \ U * for ind = add or S * = S * ∩ U * for ind = revoke. Afterwards, B sends the access structure S B and the two equal length messages M 0 and M 1 , defined by A to the challenger C . The challenger C chooses a random bit b from {0, 1} with S B = S B \ U * for ind = add or S B = S B ∩ U * for ind = revoke and computes the challenge encrypted message CT b * = encrypt(pp, S B , M b * ).

Table 1 :

 1 Features and Functionality Comparison of Attribute Based Encryption Schemesm + r/3 (km + 2 + r)E1 + E tE1/(2t + 2)E1 + τp 2τp + E1 + (n + 1)E

	Scheme	Policy Update Access Policy	Type	Key size	Ciphertext size	Encryption Cost	Update Cost	Decryption Cost
	(Emura et al., 2009)	AND-Gates	CP-ABE	2	3	2E1 + E	-	2τp + 3E1
	(Herranz et al., 2010)	Monotone	KP-ABE	k+n	3	2E1 + E	-	(n + 1)E1 + 5τp + E
	(Ge et al., 2012)	Threshold	CP-ABE 3k -2 + n	4	5E1 + E	-	4τp + 2E1(k -n)
	(Wang and Luo, 2012)	Monotone	KP-ABE	k(n + 1)	3	2E1 + E	-	(n + 1)E + E1 + 2τp
	(Jiang et al., 2017)	Threshold Threshold	CP-ABE CP-ABE	n + 1 n + 1	3 + k -m / 3 r + 3 / 3	(k -m + 2)E1 + E (r + 2)E1 + E	tE1 (2t + 2)E1 + τp	nE1 + 2τp nE1 + 2τp
	PU-ABE	Monotone	KP-ABE	(n + 1)k	3 + k

ACKNOWLEDGEMENTS

This research is supported by STRATUS (Security Technologies Returning Accountability, Trust and User-Centric Services in the Cloud), a project funded by the Ministry of Business, Innovation and Employment (MBIE), New Zealand.


Nesrine Kaaniche
email: nesrine.kaaniche@telecom-sudparis.eu

Sana Belguith

Giovanni Russello
email: g.russello@auckland.ac.nz

EMA-LAB: Efficient Multi Authorisation Level Attribute Based Access Control

Keywords: multi-level threshold scheme, attribute based encryption with short ciphertext, access control

Recent years have witnessed the trend of increasingly relying on remote and distributed infrastructures. This increases the complexity of access control to data, where access control policies should be flexible and distinguishable among users with different privileges. In this paper, we present EMA-LAB, a novel Multi Authorisation Level Attribute Based Access Control with short ciphertexts size. It relies on the usage of a constant-size threshold attribute based encryption scheme. The EMA-LAB scheme is multifold. First, it ensures a selective access to encrypted data with respect to different security levels. Second, the proposed construction protects the secrecy of enciphered contents against malicious adversaries, even in case of colluding users. Third, EMA-LAB relies on low computation and communication processes, mainly for resource-constrained devices, compared to most closely related schemes.

Introduction

Nowadays, data sharing is gaining an expanding interest, mainly with the development of remote services and distributed infrastructures. It allows data owners to share their outsourced data among groups of users. However, many security concerns arise, as the outsourced data should be protected from unauthorized access. Thus, fine grained access privileges should be ensured, while preventing malicious access.

The increasing need and complexity of access control to outsourced data lead to the emergence of several encrypted access control schemes. Among these techniques, Attribute based Encryption (ABE) has appeared as a promising cryptographic technique which provides fine grained access control for outsourced data. ABE is used to encrypt data files with respect to an access policy associated with a set of attributes.

However, sharing data contents between different involved actors is often an issue, due to the complexity of access control policies' management. This issue becomes more complex when involved actors do not share the same access privileges to each part of the data file. Hence, different access levels need to be defined to allow authorized users to access different sub-parts of enciphered data. The translation of an access control structure into an equivalent multi-level policy remains the main challenging issue of encrypted access control mechanisms.

To protect some parts of data from unauthorised access, redaction techniques are applied to black out or remove these parts. Several redaction techniques have been proposed such as sanitizing schemes for digitally signed document, content extraction algorithms, redactable signatures and sanitizable signatures [START_REF] Ateniese | Sanitizable Signatures[END_REF][START_REF] Johnson | Homomorphic Signature Schemes[END_REF]. These schemes rely on malleable cryptographic primitives such as chameleon hash functions to allow redactors having their own secret key to modify some parts of the originally encrypted or signed data file. Although these techniques allow selective access to some parts of data, they are not efficient with multi-level access privileges.

The multi level access control policies in ABE schemes have been recently explored [START_REF] Kaaniche | Attribute based encryption for multi-level access control policies[END_REF]. In these schemes, data files are encrypted using a multi level access policy where users can access parts of these data w.r.t. their access level. Although these proposals ensure multi level access control, the communication and computation overhead as well as the bandwidth consumption increase exponentially with the number of attributes required in the aggregated access structure.

To save the storage cost of ciphertext and processing overhead of encryption, attribute based encryption schemes with constant ciphertext size have been introduced [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF][START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF][START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF]. In these schemes, the size of the generated ciphertext does not depend on the number of attributes used on the threshold access policies, which presents an interesting feature mainly for resource-constrained devices.

Contributions -In this paper, we propose EMA-LAB, a new multi-threshold attribute based encryption scheme. First, it permits a selective access to enciphered data with respect to different threshold levels. Second, the size of the resulting ciphertext does not depend on the number of attributes involved in the access policy, which makes our scheme more suitable for bandwidth-limited applications. Third, it is proven secure under standard assumptions. Finally, EMA-LAB provides interesting performances compared to most closely related schemes.

Paper organizationthe remainder of this paper is organized as follows. First, section 2 clarifies the problem statement and highlights security and functional requirements and section 3 discusses related works. Then, section 4 introduces EMA-LAB system and threat models. Section 5 presents complexity assumptions and mathematical background, and details EMA-LAB concrete construction. The security analysis of EMA-LAB is discussed in section 6. Finally, performances analysis is detailed in section 7 before concluding in section 8. The subscribed employees can access received publications with respect to their authorisation level. Indeed, an employee who has only two interests can access a small amount of published data while a manager can access more subparts of data contents of the same publication. Obviously, the company's CEO can access the full publication. Thus, a multi level access control is defined as depicted by Figure 1. As mentioned above, publications should be encrypted before forwarding to the pub/sub middleware.

A naive solution 3 is to divide publications into several parts and encrypt them separately with respect to different security levels. However, this solution presents several drawbacks. First, it contradicts the decoupled feature of pub-/sub system as the publisher will be aware of the interests of the subscribers. Second, this solution incurs huge computation and communication overheads due to performing the encryption of the same data content several times, as well as defining several access structures, depending on redundant attributes (i.e., company's employees may share several attributes). Third, it removes the multi authorisation level feature as each subscriber will receive her related publication.

To support all these features with efficiency, we propose to design a multi threshold level ABE scheme. Thus, the proposed scheme EMA-LAB must fulfill the following properties:

-R1. data confidentiality -the proposed scheme has to protect the secrecy of encrypted data contents against malicious users, even in case of collusions. -R2. multi level access control -our proposal should ensure flexible security policies among dynamic groups of users with different granted privileges. -R3. low processing cost -the encryption algorithm should have a low computational complexity to minimize the impact of the security on the efficiency of data processing. -R4. low communication overhead -our multi-level encrypted data file should be short-sized as the transmission overhead is important in the emerging infrastructure context.

ABE-Related Work

Attribute based Encryption (ABE) schemes are cryptographic primitives ensuring encrypted access control to data. In attribute based encryption schemes, user's private keys and ciphertexts are associated with an access policy or a set of attributes [START_REF] Bethencourt | attribute-based encryption[END_REF]. Thus, a data user is able to decrypt the ciphertext if his private key matches the ciphertext.

Although ABE ensures fine grained and flexible access control, the communication and computation overhead as well as the bandwidth consumption increase exponentially with the number of attributes required in the access policies. To countermeasure this limit, several ABE schemes with short or constant ciphertexts have been proposed [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF][START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF][START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF]. Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF] have proposed the first constant size threshold attribute based encryption scheme. Indeed, the ciphertext size is constant and does not depend on the number of attributes involved in the threshold access policies. Later, Waters et al. [START_REF] Waters | Ciphertext-policy attribute-based encryption: An expressive, efficient, and provably secure realization[END_REF] proposed an efficient attribute based encryption scheme with short ciphertext. However, the ciphertext size, the encryption and the decryption times increase linearly with the number of attributes involved in the access structure. Ge et al. [START_REF] Ge | Threshold ciphertext policy attribute-based encryption with constant size ciphertexts[END_REF] have proposed a constant size threshold attribute based encryption scheme. The authors used a different design strategy scheme in order to achieve security against chosen ciphertext attacks (CCA) in the standard model unlike Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF] scheme which is secure against chosen plaintext attacks (CPA). In [START_REF] Zhang | Efficient attribute-based data sharing in mobile clouds[END_REF], the authors propose a generic attribute-based data sharing system based on a hybrid mechanism of CP-ABE and a symmetric encryption scheme. This scheme ensures efficient computation costs as well as reduced ciphertext size.

Although these schemes propose efficient solutions to protect outsourced data from unauthorized access, they are still inefficient with multi-level access policies, where users have to share the same data content with different access rights to distinct parts of the data file.

Wang et al. [START_REF] Wang | An efficient file hierarchy attribute-based encryption scheme in cloud computing[END_REF] have proposed an efficient file hierarchy attribute-based encryption scheme in cloud computing. The layered access structures are integrated into a single access structure, and then, the hierarchical files are encrypted with the integrated access structure. Kaaniche et al. [START_REF] Kaaniche | Attribute based encryption for multi-level access control policies[END_REF] have introduced an encryption scheme based on attribute based mechanisms for multi-level access policies. This scheme ensures a selective access to data based on users' granted privileges. Practically, when a party encrypts a data file, she specifies an access structure and a certain number of security levels. Thus, a user is able to decrypt a sub-set of data blocks related to a security level k that users private keys satisfy the sub-set of attributes related to the k -security level. × Wang et al. [START_REF] Wang | An efficient file hierarchy attribute-based encryption scheme in cloud computing[END_REF] × × Kaaniche et al. [START_REF] Kaaniche | Attribute based encryption for multi-level access control policies[END_REF] × × EMA-LAB and × indicate that the requirement is achieved or not, respectively.

The communication and computation overhead as well as the bandwidth consumption in the existing multi level ciphertext policy attribute based encryption [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF][START_REF] Kaaniche | Attribute based encryption for multi-level access control policies[END_REF] schemes increase exponentially with the number of attributes required in the multi level access policies. This motivates us to address the problem of constructing a multi level attribute based encryption scheme which introduces a short ciphertext size cost for multi level access control and data confidentiality.

Model Description

In this section, we first present the system model of EMA-LAB scheme. Then, we detail the security model.

System Model

We suppose that the encrypting entity E chooses a subset S from the attribute universe U and a set of thresholds {t j } such that 1 ≤ t j ≤ l ≤ |S|, and l ≤ |T| (i.e., T is the threshold universe supported by the system) to define his multithreshold ({t j } {1,••• ,l} , S) access policy. Then, U encrypts the message M ∈ M (i.e., M is the message space), where M = {m j } {1,••• ,l} with respect to the policy ({t j } {1,••• ,l} , S). Our multi-threshold attribute based encryption mechanism consists of four randomized algorithms: setup, keygen, encrypt and decrypt, defined as follows: setup(ξ) → (pp, msk) -the setup algorithm is performed by the central trusted authority. It takes as input a security parameter ξ. The setup algorithm outputs the public parameters pp and the master secret key msk.

encrypt(pp, ({t j } {1,••• ,l} , S), M ) → C -the encryption algorithm is performed by an encrypting entity E . It takes as inputs the public parameters pp, the ({t j } {1,••• ,l} , S) multi level threshold access policy and the message M , defined as a set of sub-messages M = {m j } {1,••• ,l} . This algorithm outputs an encrypted message referred to as C.

keygen(pp, msk, A U ) → sk U -this randomized algorithm is executed by the trusted authority to derive the secret keys of the user U related to his set of attributes A U . Given the public parameters pp, the master secret key msk and an attribute set A U ⊂ U (i.e., U is the attribute universe) of the user U. The algorithm outputs the user's secret key sk U associated to the attribute set A U .

decrypt(pp, sk U , A U , ({t j } {1,••• ,l} , S), C) → m j -the decryption algorithm is executed by the user U. It takes as inputs the public parameters pp, the user's private key sk U , the access policy ({t j } {1,••• ,l} , S) and the encrypted message C. The algorithm returns the message m j if the user U has successfully obtained the secret key related to the t j required attributes for deciphering the encrypted message, with respect to the threshold t j . Otherwise, the algorithm outputs a reject symbol ⊥.

Our EMA-LAB multi-threshold attribute based encryption scheme has to satisfy the correctness property defined hereafter as follows. The correctness property requires that for all security parameter ξ, all attribute universe descriptions U, all threshold universe T, all (pp, msk) ∈ setup(ξ), all domain entities E, all A E ⊆ U, all sk E ∈ keygen(pp, msk, A E ), all M ∈ M defined as a set of sub-messages M = {m j }, all ({t j } {1,••• ,l} , S) ∈ G (G is the access policy space) and all C ∈ encrypt(pp, ({t j } {1,••• ,l} , S), M ), if the decrypting entity E has successfully obtained the secret key related to the t j required attributes for deciphering the encrypted message such that |A E ∩ S| ≥ t j , the derypt(pp, sk U , A E , ({t j } {1,••• ,l} , S), C) outputs m j with respected to the satisfied threshold t j .

Security Model

For designing a secure multi-threshold attribute based encryption scheme, we consider malicious users (ie; subscribers in our motivating scenario 2), with respect to the indistinguishability property. The indistinguishability property means that if an adversary has some information about the plaintext, he should not learn about the ciphertext. This security notion requires the computational impossibility to distinguish between two messages chosen by the adversary with a probability greater than a half. Indeed, in ABE schemes, the adversary may lead an attack against the indistinguishability property either on his own or through a collusion attack.

EMA-LAB is said to be indistinguishable against non-adaptive chosen ciphertext attacks if there is no probabilistic polynomial time (PPT) adversary that can win the Exp conf security game with non-negligible advantage. The Exp conf game is formally defined, between an adversary A and a challenger C as follows:

Initialisation -A selects a set of encryption attributes S * (i.e., S * corresponds to the set of attributes specified for the general access policy) to be used for encrypting the challenge ciphertext, as a set of threshold values {t * j } {j∈[1,m]} , where m is the number of threshold values. A sends ({t

* j } {j∈[1,m]} , S * ) to C.
Setup -the challenger C runs the setup(ξ) algorithm of the encryption scheme and sends the public parameters pp to the adversary A.

Decryption Query Phase -the adversary A can request, as many times as he wants, the following queries:

keygen -the adversary A queries, for each session i, an encryption attribute set A A,i with respect to a threshold

t * k,i ∈ {t * j } {j∈[1,m]} where |A A,i ∩ S * | < t * k,i .
Adv A [Exp Conf (1 ξ )] = |P r[b = b ] -1 2 |.

EMA-LAB: Multi-threshold ABE Scheme

In this paper, we develop a new multi-threshold level attribute based encryption scheme, denoted by EMA-LAB with short ciphertext size. Our proposal is based on the constant size attribute based encryption proposed by Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF], which has been extended to support multi-level access to data.

Complexity Assumptions

In our short ciphertext size multi level attribute based encryption construction, we rely on the Computational Diffie Hellman Assumption (CDH) and the augmented multi-sequence of exponents computational Diffie-Hellman (( l, m, t)-aMSE-CDH) [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF][START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF]. These assumptions are defined as follows:

Computational Diffie Hellman (CDH) Assumption -Let G be a group of a prime order p, and g is a generator of G. The CDH problem is, given the tuple of elements (g, g a , g b ), where {a, b} R ← -Z p , there is no efficient probabilistic algorithm A CDH that computes g ab .

Bilinear Diffie-Hellman (BDH) Assumption -Let ê : G 1 × G 1 → G T be an efficiently computable bilinear map. Let a, b, c ∈ Z * p are random numbers and g be a generator of G 1 . No probabilistic polynomial-time algorithm is able to compute ê(g, g) abc with non-negligible advantage if the tuple g, g a , g b , g c is known.

( l, m, t)-augmented multi-sequence of exponents computational Diffie-Hellman (( l, m, t)-aMSE-CDH) -The ( l, m, t)-aMSE-CDH problem related to the group pair (G, G T ) is to compute T = e(g 0 , h 0 ) k•f (γ) . It takes as input: the vector x l+ m = (x 1 , • • • , x l+ m) whose components are pairwise distinct elements of Z p which define the polynomials f(X) and g(X) as follows:

f (X) = l i=1 (X + x i ); g(X) = l+ m l+1 (X + x i ) (1)
where the values x i are random and pairwise distinct of Z * p , and the values:

                     g 0 , g γ 0 , • • • , g γ l+t-2 0 , g k•γ•f (γ) 0 g ωγ 0 , • • • , g ωγ l+t-2 0 g α 0 , g αγ 0 , • • • , g αγ l+t 0 h 0 , h γ 0 , • • • , h γ m-2 0 h ω 0 , h ωγ 0 , • • • , h ωγ m-1 0 h α 0 , h αγ 0 , • • • , h αγ 2( m-t)+3 0
Where k, α, γ, ω are unknown random elements of Z p and g 0 and h 0 are generators of G. We can solve the problem if we get an output b ∈ {0, 1} where b = 1 if T = e(g 0 , h 0 ) k•f (γ) or b = 0 when T is a random value from G T .

Aggregate Algorithm

Our scheme relies on the aggregate algorithm aggreg introduced by Delerablee et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF]. Let us consider a list of values {g r γ+x i , x i } 1≤i≤n , where r, γ ∈ Z * p and

x 1 , • • • , x n are pairwise different. Then , the algorithm proceeds as follows:

aggreg({g r γ+x i , x i } 1≤i≤n ) = g r n i=1
(γ+x i )

Concretely, the aggreg algorithm defines P 0,m = g r γ+xm for each m ∈ {1, • • • , n}. Afterwards, the algorithm computes sequentially P i,m for i = 1 • • • n -1 and m = i + 1, • • • , n using the induction:

P i,m = ( P i-1,i P i-1,m ) 1 xm-x i (2)
Then, we get P i,m = g r (γ+xm ) i k=1

(γ+x k ) where 1 ≤ i ≤ m ≤ n. Therefore, since the elements x 1 , • • • , x n are pairwise different [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF] and using the equation 2, we can compute P i,m for i = 1

• • • n -1 and m = i + 1 • • • n such as P n,n-1 = g r n i=1
(γ+x i ) .

Concrete Construction

EMA-LAB relies on four algorithms defined as follows:

setup -the trusted authority selects a bilinear group (ê, p, G 1 , G 2 , G) of prime order p, such that ê : Then, the setup algorithm selects a set D = {d 1 , ..., d n-1 } consisting of n-1 pairwise different elements of (Z/pZ) * (i.e., dummy users), which must also be different to the values τ (a i ), for all a i ∈ U. Note that for any integer i lower or equal to n -1, we denote as D i the set {d 1 , ..., d i }. Finally, the setup algorithm computes u defined as u = g α•γ and outputs the global public parameters pp as follows:

G 1 × G 2 → G. It selects random generator g ∈ G 1 and a set of G 2 generators {h j } j=1,••• ,m , such that m = |T|
pp = {G 1 , G 2 , G, ê, u, {h j αγ i } {i=0,••• ,2n-1;j=1,••• ,m} , D, τ, {ê(g α , h j )} {j=1,••• ,m} }
We note that the master key of the trusted authority is referred to as msk = (g, α, γ) where α, γ are two random values from (Z/pZ) * .

encrypt -let ({t j } {j=1,••• ,l} , S) be the access policy where {t j } is the set of defined threshold values, l is the cardinal of {t j }, S ⊂ U is an attribute set of size s = |S| such that for all j ∈ [1, l], 1 ≤ t j ≤ |S|.

To encrypt the message M defined as M = {m j } {j=1,••• ,l} with respect to ({t j } {j=1,••• ,l} , S), the encrypting entity E picks at random κ ∈ Z/pZ and generates the ciphertext

C = (C 1 , C 2,j , C 3,j ) {j=1,••• ,l} defined as:      C 1 = g -καγ C 2,j = h κα a∈S (γ+τ (a)) d∈D n+t j -1-s (γ+d) j C 3,j = m j ê(g α , h j ) κ = m j K j
Finally, the encrypting entity outputs the encryption of the message

M such that C = (C 1 , C 2,j , C 3,j ) {j=1,••• ,l} .
keygen -for any subset A U ⊂ U of attributes associated with the decrypting user U, the trusted authority chooses a random value r U ∈ (Z/pZ) * and computes the related secret key as follows:

sk U = ({g r U γ+τ (a) } a∈Ai , {h r U γ i j } i=0,••• ,n-2,j=1•••m , {h r U -1 γ j } j=1•••m ) = (sk U1 , sk U2 , sk U3 )
decrypt -the decrypting entity U having a set of attributes A U where |A U ∩ S| = t j can decrypt the enciphered message m j under the access policy ({t j } {j=1,••• ,l} , S), with respect to the t j threshold level. For this purpose, for all a ∈ A U , U firsts aggregates the required attributes, with respect to t j satisfied by his certified attributes, such as:

A = aggreg({g r U γ+τ (a) , τ (a)} a∈A U ) = g r U a∈A U (γ+τ (a))
Afterwards, U uses the aggregated secret key A and the ciphertext element C 2,j , related to the satisfied threshold t j , to compute:

L j = ê(g r U a∈A U (γ+τ (a)) , C 2,j ) (3)
= ê(g, h j )

r U κα a∈S\A U (γ+τ (a)) d∈D n+t j -1-s (γ+d)
Then, U defines the polynomial P (A U ,tj ,S) (γ) such as:

P (A U ,tj ,S) (γ) = 1 γ ( a∈S∪Dn+t j -1-s \A S (γ + τ (a)) - a∈S∪Dn+t j -1-s \A U τ (a)) (4)
Afterwards, U uses the aggregated secret key A and the sk U2 key elements to compute:

[ê(C 1 , h r U P (A U ,t j ,S) (γ) j ) • L j ] 1 a∈S∪D n+t j -1-s \A U τ (a) (5)
= e(g, h j ) κ•α•r U Then, from Equation5 and the secret key element the sk U3 , related to t j , the decrypting entity U deduces the deciphering key K j such as:

K j = ê(C 1 , sk U3 ) • ê(g, h j ) κ•r U •α = ê(g, h j ) α•κ
Finally, U recovers the sub-message m j , with respect to related access level t j , by computing m j = C3,j Kj .

Security Analysis

To ensure multi-level threshold encryption scheme, our EMA-LAB construction mainly relies on the constant size attribute based encryption scheme proposed by Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF]. As such, the data confidentiality preservation is tightly related to the security of the used attribute based encryption algorithm. Our EMA-LAB scheme is secure against selective non-adaptive chosen ciphertext attacks in the standard model, under the CDH, BDH and ( l, m, t)-aMSE-CDH assumptions, with respect to the Exp conf experiment. Sketch of proof -As presented in section 4.2, the adversary may lead an attack against the indistinguishability property either on his own or through a collusion attack.

First, the design of our EMA-LAB scheme was motivated by preventing collusion attacks among users. Thus, as our scheme relies on the constant size threshold ABE construction of Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF], it randomizes, in the same way, users' private keys such that they cannot be combined. In fact, each private key element contains a random value r U related to the user U, which prevents colluding users to override their rights and successfully perform a collusion attack. Consequently, our EMA-LAB mechanism is resistant against collusion attacks.

Second, in order to decrypt a ciphertext with respect to a threshold level t * j , an adversary A may conduct, on his own, an attack against the indistinguishability property. That is, he must recover K j = ê(g, h j ) κα , where the secret κ is embedded in the ciphertext. For this purpose, A has to retrieve the corresponding K j , based on the related private key associated with t * j . To prove that our scheme is secure against selective, non-adaptive chosen ciphertext attacks, we first distinguish two different cases, based on the number of defined threshold values during the Initialisation phase of Exp conf experiment, introduced in section 4.2:

Case 0 : we set only one threshold level t j * , such as the public parameter m selected by the adversary is equal to 1. That is, all queried private keys are related to the set of attributes S * that decrypt ciphertexts, encrypted with respect to t j * , for each session i. This first sub-case simulates a selective CCA-1 security game for [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF] scheme.

Case 1 : for this case, the challenger defines different threshold levels, during the Initialisation phase, such as m > 1. For each session i, we suppose that A has access to

C i = {C k,i } l∈[1,m * ] ,
where C k,i is an encrypted data block m k,i under a threshold t * k,i . For Case 0, one single threshold level is set. Thus, EMA-LAB scheme follows the construction proposed by Attrapadung et al. in [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF]. That is, the Setup, Decryption Query Phase and Challenge phases are based on one single threshold level, where the challenge message M b contains one single data block related to the threshold t j * . The main difference consists in the derivation of the ciphertext element C 3,tj * corresponding to a pre-defined threshold level t j * , and relying on the public parameter ê(g, h j ) α . Indeed, unlike the [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF] scheme relying the aggreg algorithm and based on the ( l, m, t)-aMSE-CDH assumption, in our construction, the generation of ciphertexts depends on different public elements, mainly for C 3,tj * . More precisely, the main difference mainly consists in K j = ê(g, h j ) ακ , where ê(g, h j ) α is a public parameter generated by the challenger C, generated with respect to each different threshold level t j * . As such, similarly to [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF], the advantage of the Exp conf adversary is at most equal to advantage of an algorithm resolving the ( l, m, t)-aMSE-CDH assumption.

For Case 1, the Initialisation phase is executed similarly as for Case 0. In fact, the challenger C sends the public parameters pp defined as:

pp = {G 1 , G 2 , G, ê, u, {h j αγ i } {i=0,••• ,2n-1;j=1,••• ,m} , D, τ, {ê(g α , h j )} {j=1,••• ,m} }.
For ease of presentation, we do not show the progress of Setup and Decryption Query Phase between C and A, where the outputs of keygen and decrypt are closely similar to Case 0, considering m * encrypted sub-messages {m i } {i∈[1,m * ]} related to m * threshold levels. During the challenge phase, when A asks for the encryption of the challenge message with respect to a challenge access structure ({t * j } {j∈[1,m]} , S * ), C does the following. C first chooses a random κ ∈ Z/pZ and outputs the encryption of the challenge message such that: for each threshold level t j , we have C j = ê(g, h j ) κα . These values are then sent to the adversary. We state that if A asks for a decryption key for a set of attributes such that |A A ∩ S * | > t * k , then C does not issue the key. Similarly, if A asks for S * , with respect to any threshold value, such that one of the keys is already issued then the simulation aborts. In the sequel, the advantage of the adversary is at most equal to Case 0, due to the randomness of the choice of variable values in the simulation, based on the CDH and BDH assumptions. Indeed, A' view in this simulation is identically distributed for all threshold levels. In fact, the encryptions of data blocks of the challenge message M b are completely independent, thanks to the use of different ê(g, h j ) functions. As such, Case 1 can be considered as m * random repetitions of Case 0 simulation, with respect to m * threshold levels.

As such, we prove that EMA-LAB scheme is secure against selective nonadaptive chosen ciphertext attacks in the standard model, under the CDH, BDH and ( l, m, t)-aMSE-CDH assumptions, with respect to the Exp conf experiment.

Performance Analysis

In most ciphertext policy attribute based encryption schemes, the size of an encrypted data file increases with the number of attributes involved in the access policy used in the encryption phase [START_REF] Attrapadung | Attribute-based encryption schemes with constant-size ciphertexts[END_REF][START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF]. As detailed in Table 2, in [START_REF] Horváth | Attribute-based encryption optimized for cloud computing[END_REF] and [START_REF] Li | P-cp-abe: Parallelizing ciphertextpolicy attribute-based encryption for clouds[END_REF], the ciphertext size increases with the number of attributes defined in the access structure used to encrypt data. Similarly, the encryption and decryption costs depend on the number of attributes. To countermeasure this limit, attribute based encryption schemes with constant ciphertext size have been introduced. Herranz et al. [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF] designed a threshold attribute based encryption scheme where ciphertext size does not depend on the number of attributes. In addition, the encryption overhead is constant while varying the size of the used threshold access predicate. Nevertheless, the aforementioned schemes [START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF][START_REF] Horváth | Attribute-based encryption optimized for cloud computing[END_REF][START_REF] Li | P-cp-abe: Parallelizing ciphertextpolicy attribute-based encryption for clouds[END_REF] do not provide the multi level access feature. In [START_REF] Kaaniche | Attribute based encryption for multi-level access control policies[END_REF][START_REF] Wang | An efficient file hierarchy attribute-based encryption scheme in cloud computing[END_REF], the authors have extended a ciphertextpolicy attribute based encryption scheme to ensure multi authorisation level access control to data. Although the practicability of their schemes in several domains, they are lacking for more efficiency especially related to storage and computation costs. Indeed, the ciphertext size and the computation overheads in the encryption and decryption phases increase with both the number of attributes in the access policies and the number of security levels (thresholds). To bring both the practicability and the efficiency features, EMA-LAB introduces a more efficient ABE scheme with short ciphertext. Indeed, as shown by Table 2, our contribution introduces a ciphertext size which only depends on the number of thresholds used in the multi level access policy unlike state of the art multi level ABE schemes which depend on both the number of attributes and the number of thresholds. Similarly, the computation overheads at the encrypting and the decrypting entities sides only depend on the number of thresholds. In other words, the decryption overhead and the ciphertext size are constant for each threshold level. Several research works have been proposed to evaluate the computation overhead of attribute based encryption schemes [START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF][START_REF] Guo | Psad: A privacy-preserving social-assisted content dissemination scheme in dtns[END_REF]. Our ongoing implementation of the EMA-LAB's Proof of Concept (PoC) consists in evaluating the impact of elementary cryptographic operations on different resource-constrained devices as detailed in Table 3. As our EMA-LAB framework relies on the use of bilinear maps as well as mathematical operations in a multiplicative group, we investigate the impacts of these operations (cf. Figure 2) on the performance of different IoT devices, based on the results introduced in [ In our ongoing implementation, we only consider the computational cost in terms of time in our encryption and decryption algorithms. Indeed, for a single threshold level, the encryption time is constant while varying the number of attributes. Moreover, the decryption overhead increases linearly with the number of attributes in the threshold level. This is due to the aggregation (c.f., Section 5.2) of the decrypting entity's secret keys performed in the decryption phase.

Conclusion

In this paper, we propose a novel cryptographic mechanism to ensure multi-level access control, based on the use of a constant size threshold attribute based encryption scheme. Our EMA-LAB scheme enables the enciphering user to encrypt the same data content, based on an aggregated set of attributes, and the deciphering entity to decrypt the subsets of data blocks with respect to a threshold t j , associated with his attributes. Compared to most-closely related schemes, our construction provides interesting computation costs, as it does not depend on the number of involved attributes specified in the aggregated access predicate.

FailFig. 1 .

 1 Fig. 1. Publish-Subscribe System Architecture

  The challenger C answers by running the keygen(pp, msk, A A,i ) algorithm and sends the resulting secret key to the adversary A, with respect to the required threshold t * k,i . The secret key is referred to as sk A,i . decrypt -the adversary A requests the decryption of C with respect to a threshold t * k,i , while considering the encryption attribute set A A,i . The challenger C executes the keygen algorithm to generate the secret key sk C,i = keygen(pp, msk, A A,i ), such that |A A,i ∩ S * | < t * k,i . Finally, the challenger C answers the query by running the decrypt(pp, sk C,i , A C,i , (t * k,i , S * ), C) algorithm that outputs a message m j or a reject symbol ⊥. Challenge Phase -during the challenge phase, A picks two equal length cleartexts M 0 * and M 1 * and a threshold encrypting attribute set (t * k , S * ) (i.e; t * k has never been queried during the Decryption Query Phase) and sends them to C. This latter chooses a random bit b from {0, 1} and computes the challenge encrypted message C b * = encrypt(pp, (t * k , S * ), M b * ). Then, the challenger sends C b * to A. Guess -A tries to guess which message M i , where i ∈ {0, 1} corresponds to the enciphered data C b * . Thus, A outputs a bit b of b and wins the game if b = b . The advantage of the adversary A in the above game is defined as

  is the cardinal of the threshold universe T, supported by the system. In addition, it defines an encoding function τ such that τ : U → (Z/pZ) * , where |U| = n and U is an attribute universe. For each attribute a ∈ U, the encoded attribute values τ (a i ) = x i are pairwise different, where i ∈[1, n].

Fig. 2 .

 2 Fig. 2. Elementary functions Computation Costs

Table 1 .

 1 A comparison of ABE schemes.

	Schemes	R1 R2 R3 R4
	Herranz et al. [9]	×
	Waters et al. [16]	×
	Ge al. [7]	×
	Zhang et al. [17]

Table 2 .

 2 Computation and Storage Costs of Multi Level Attribute Based Encryption SchemesE and U are the encrypting entity and the decrypting user. t, m and n are the size of the threshold, the cardinal of the threshold universe and attribute universe, respectively. E1, E2, E represent exponentiation costs in G1, G2, GT , while τp is the cost of a pairing operation.

	Scheme Access Policy Multi-level Ciphertext Size E Computation Overhead U Computation Overhead
	[12]	Monotone	Yes	2n + 2m	mE + τp + (m + 2n)E1	mE + 2τp
	[15]	Monotone	Yes	2m + 3n	(2n + m)E + (2n + m)E1	(2n + m)τp + (n + m)E
	[13]	Monotone	No	3n+1	E + (2n + 1)E1 + τP	(2 + n)τP + nE
	[10]	Monotone	No	2n + 2	(2n + 1)E + (3n + 3r)E1 + τP (n + r)E + 2(n + r)τP
	[9]	Threshold	No	3	E1 + E2 + E	(t + 1)E1 + 3τp + E2 + E
	EMA-LAB Threshold	Yes	2m + 1	E1 + mE2 + mE	(tj + 1)E1 + 3τp + E2 + E

  5]. N. Kaaniche et al.

	JIAYU S3 Advanced	0.02
	Intel Edison	1.7
	Rasberry Pi 2B	1.71
			Pairing Procedure
	Sony Smart Watch	1600
	Samsung Galaxy S4	1150
	JIAYU S3 Advanced	1000
	Intel Edison	400
	Rasberry Pi 2B	1650
		1.8	1800
	Operation Time (ms)	0.2 0.4 0.6 0.8 1 1.2 1.4 1.6	Sony Smart Watch Samsung Galaxy S4 JIAYU S3 Advanced 800 1000 1200 1400 1600 Intel Edison 600 400 Rasberry Pi 2B 200	Sony Smart Watch Samsung Galaxy S4 JIAYU S3 Advanced Intel Edison Rasberry Pi 2B
		0	0
		Exponentiation Procedure	Pairing Procedure

Table 3 .

 3 Selected Devices[START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF]

	Device	Type	Processor
	Sony SmartWatch 3 SWR50	Smart Watch	520 MHz Single-core Cortex-A7
	Samsung I9500 Galaxy S4	Smartphone	1.6 GHz Dual-Core Cortex-A15
	Jiayu S3 Advanced	Smartphone	1.7 GHz Octa-Core 64bit Cortex A53
	Intel Edison	IoT Development Board 500 MHz Dual-Core Intel AtomTM CPU, 100 Mhz MCU
	Raspberry Pi 2 model B IoT Development Board	900 MHz Quad-Core ARM Cortex-A7

Note that the security of publications' keywords and subscribers' interests at the broker side while performing the matching feature is above the scope of this paper.