Nesrine Kaaniche

Maryline Laurent

Privacy-preserving Multi-user Encrypted Access Control Scheme for Cloud-assisted IoT applications

Keywords: Cloud-assisted IoT, Attribute based Encryption, access control, aggregation, privacy

In this paper, we present a privacy preserving encrypted access control scheme to aggregate data for Cloud assisted IoT applications. Our scheme is based on attribute based encryption mechanisms and consists in enciphering a set of data contents, with respect to sub-sets of a general access policy. As such, the gateway is able to decrypt the resulting aggregated data only if it holds the matching certified attributes and it has received a sufficient number of partial ciphertexts. Our construction has several advantages. First, it provides a finegrained access to aggregated data contents that are enciphered by different multiple encrypting entities. Second, it provides a privacy preserving encryption process, such that a curious gateway can neither identify the enciphering IoT device nor decipher single data chunks. Third, our concrete construction provides low computation and communication costs, adapted to resource-constrained devices, compared to most closely related schemes.

I. INTRODUCTION

During the last decade, Internet of Things (IoT) approached our lives in many ways, thanks to the availability of several communication systems that have been increasingly deployed, mainly for smart monitoring and control applications. According to the U.S. International Data Corporation (IDC) [START_REF] Torchia | Worldwide semiannual internet of things spending guide[END_REF], IoT is experiencing a fast expansion with an estimated 16.7% growth year over year in 2017 to reach nearly $1.4 trillion by 2021. Typically, IoT deployments permit a collection of smart objects, generally considered as resource-constrained devices, to communicate among themselves and also to an external gateway or a base-station, for further processing. Thus, cloud computing-enhanced IoT has recently received considerable attention, as the gateways deployed at the network edge can not only provide low latency, location awareness but also improve real-time and quality of services in IoT application scenarios, while protecting the secrecy of transmitted sensed data and preserving the privacy of devices.

Privacy-preserving data aggregation is one of the typical cloud assisted IoT applications, and many privacy-preserving data aggregation schemes have been proposed in the past years for ensure reliable processing of data collected from different IoT devices. Indeed, in IoT applications, data are always transmitted, stored and dynamically shared through heterogeneous and distributed networks [START_REF] Nguyen | Survey on secure communication protocols for the internet of things[END_REF], [START_REF] Hammoudeh | A wireless sensor network border monitoring system: Deployment issues and routing protocols[END_REF]. Consequently, encryption and access control mechanisms are important in order to prevent unauthorized entities from accessing data [START_REF] Roman | Securing the internet of things[END_REF], [START_REF] Carlin | Defence for distributed denial of service attacks in cloud computing[END_REF], [START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF].

Contributions -In this paper, we introduce a new privacy preserving multi-user encrypted access control scheme to aggregated data, based on the use of Ciphertext-Policy Attribute based Encryption (CP-ABE) mechanisms [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], that ensures privacy-preserving processing for IoT applications. CP-ABE is a powerful primitive that provides an encrypted access control mechanism, based on fine-grained access structures. However, this encryption technique suffers from heavy computation overhead which is burdensome for resource-constrained devices. As such, our construction consists in performing in a secure collaborative manner the encryption of a set of data chunks. The main idea behind our encrypted access control scheme relies on the distribution of the enciphering operation among different devices, with respect to sub-sets of a general access structure. That is, each device encrypts its input data and sends the partial enciphered information to an untrusted gateway. Thus, if this latter holds the matching certified attributes and receives a sufficient number of partial ciphertexts then it will be able to aggregate and then decrypt the computation result.

Paper organization -Section II introduces a motivating use-case and highlights the design goals. Section III presents Attribute based Encryption mechanisms and reviews related work. Section IV details the network and security models. Section V provides useful theorems and presents our concrete construction. Section VI gives a security analysis and section VII discusses the performances of the proposed scheme. SectionVIII gives possible improvements before concluding in section IX.

II. PROBLEM STATEMENT

In this section, we first give a motivating scenario (cf. section II-A). Then, we highlight the security and functional design goals (cf. section II-B).

A. Motivating Scenario

The use of IoT devices is gaining an expanding interest mainly for remote health monitoring which is widely applied by several health organizations to provide better personalized services. Indeed, Wireless Body Area Networks (WBANs) consist of intelligent and resource-constrained devices that can be placed on the patient body to monitor his health status. WBANs devices monitor various parameters such as blood gas, blood pressure, pulse rate, temperature, electrocardiogram (ECG), and electroencephalogram (EEG) (cf. Figure 1).

While dealing with medical data, security and privacy are among the most challenging issues. For instance, the EGC can reflect users some specific behaviors, such as sleeping, having meals and so on. In the sequel, the reveal of such health data might violate users privacy. Therefore, how to efficiently aggregate different types of data and preserve users privacy is still challenging in cloud assisted WBANs. Hence, the data transmitted in health-care applications should be authenticated and secured against malicious access. In addition, developing security techniques to secure patients' data should fulfill low communication and computation cost requirements. Thus, the resource consumption in a WBAN is tied up to the amount of data being processed, stored, and transmitted. Hence, aggregation has been often presented as a solution to take advantage of the aggregating node computing capabilities in order to process sensed data. In the architecture depicted in Figure 1, the WBAN gateways are responsible for performing aggregation of the data received from the smart things deployed on the body of the patient, then to transmit deciphered data to the cloud. This latter receives all IoT devices' aggregated data via the fog device, and makes some data analytics according to some application requirements. Thus, aggregated data should be accessed by a set of authorized gateways, thus ensuring a flexible access control mechanism.

B. Design Goals

The design of our encrypted access control scheme is motivated by providing the support of both robustness and efficiency while fulfilling the following properties:

• multi-user fine grained access controlour proposal should ensure flexible access policies among different groups of users. In addition, the aggregated accessed data may be enciphered with different IoT devices. • data confidentialitythe proposed scheme has to protect the secrecy of encrypted data contents against malicious entities, even in case of collusions. • privacypreserving users' privacy is multifold. First, it is useful in a context where anonymity should be enforced to forbid any user's identification or personal information leakages (e.g. sex, age, address). Second, unauthorized users should not be able to obtain any information about honest users' inputs, or to link the obfuscated content to a specific entity. Third, access to obfuscated data should not reveal identifying information of the requesting entity. • low processing and communication coststhe designed algorithm should have low computational complexity and reduced communication overhead, to efficiently adapt to IoT applications.

III. ATTRIBUTE BASED ENCRYPTION

In 2005, Sahai and Waters introduced the concept of Attribute Based Encryption [START_REF] Sahai | Fuzzy identity-based encryption[END_REF], as a generalization of Identity based Encryption (IBE), introduced by Shamir [START_REF] Shamir | Identity-based cryptosystems and signature schemes[END_REF], in 1984, with the original idea to provide public and private key pairs based on user's unique identity. ABE appears as a promising technique, designed for ensuring encrypted fine grained access control, for many users based on general access policies. In ABE, both users' private keys and ciphertexts are associated with a set of attributes or a structure over attributes and the user is able to decrypt a ciphertext if there is a match between his private key and the ciphertext [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. For instance, Goyal et al. [START_REF] Goyal | Attribute-based encryption for fine-grained access control of encrypted data[END_REF] distinguish two ABE categories, namely: Key-Policy ABE (KP-ABE) and Ciphertext-Policy ABE (CP-ABE). There exist some differences between KP-ABE and CP-ABE mechanisms. In fact, for KP-ABE schemes, the secret key of user U is derived with respect to an access structure Γ u , and the ciphertext is generated according to a set of attributes S CT . As such, the user U can decrypt the ciphertext CT if the set of attributes S CT satisfy the access tree associated with the user' secret keys. On the contrary, for CP-ABE schemes, the secret key of user U is associated with a set of attributes S u , and the ciphertext is created with respect to an access tree Γ. As such, U can decrypt the ciphertext CT if the set of attributes S u associated to his secret key satisfy the access tree.

CP-ABE is a very interesting primitive, that permits to ensure fine-grained access control, by directly embedding the access policy on the ciphertext. However, its processing and communication overheads are still highly resource-consuming, mainly for IoT devices [START_REF] Kaaniche | Data security and privacy preservation in cloud storage environments based on cryptographic mechanisms[END_REF]. In [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF], Touati et al. proposed a cooperative CP-ABE scheme, such that resource-constrained devices can delegate the most consuming operations to unconstrained nodes. However, their scheme does still require a central trusted party that has to derive the secret enciphering key. As such, [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF] cannot be adapted for fully distributed environments. Afterwards, the authors presented a collaborative KP-ABE scheme for Cloud assisted IoT applications [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF]. Their construction is based on the use of computing and storage capacities of cloud servers and assistant nodes to perform heavy operations and save resources of tiny smart objects. In the same vein, Oualha and Nguyen extended the CP-ABE construction proposed by Bethencourt et al. in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], to apply the scheme in the context of resource-constrained IoT devices [START_REF] Oualha | Lightweight attribute-based encryption for the internet of things[END_REF]. The authors proposed a hybrid approach alternating precomputations and on-demand computations can be devised to overcome the issue of limited storage and processing capacities' of IoT. Recently, in 2017, Odelu et al. presented a new RSA-based CP-ABE scheme with constant size ciphertexts (CSKC) and low complexity for both decryption and encryption processes [START_REF] Odelu | Expressive cp-abe scheme for mobile devices in iot satisfying constant-size keys and ciphertexts[END_REF]. However, these proposed schemes do not consider enciphering a set of different data chunks, hence providing a multi-encryptor setting and enabling the deciphering entity to only decrypt the aggregated data content.

IV. DESIGN MODELS

In this section, we formalize our system (cf. section IV-A) and security (cf. section IV-B) models.

A. System Model

For our system model, five entities are identified: an attribute authority (AA), a manager (GM), a set of IoT devices {U i } {i=1,••• ,n} , a set of sink aggregating entities {S j } {j=1,••• ,m} and a selected IoT trusted node defined such as:

• attribute authority AA -is responsible for bootstrapping the whole system in the initialization phase. We assume that AA is a trusted entity. It also issues certified attributes and related secret keys for the aggregating entities and IoT devices. • manager GM -is in charge of generating the general access predicate used to encrypt data contents as well as the aggregating function for each specific cloud-IoT application.

• aggregating entity (S j ) -is considered as a local network gateway. It is responsible for collecting and deciphering aggregated data contents. • IoT device (U i ) -collects and encrypts sensed data before forwarding them to the aggregating entity. • trusted IoT node (U s ) -is a trusted selected IoT device and it periodically assigns to each involved IoT device U i a sub-access predicate to be used for encrypting data. Our scheme is composed of six randomized algorithms based on three phases, namely SYSINIT, CO-ENCRYPT and AGGREGATION. During the SYSINIT phase, the central attribute authority generates public system parameters and derives secret keys of aggregating entities, based on the setup and keygen algorithms, respectively. This phase is executed once for the system initialization. The CO-ENCRYPT phase starts when the encryption of data chunks are requested. The second phase relies on two different algorithms, namely accshare, executed by the trusted IoT node and encpart, performed by each participating entity. The AGGREGATION phase permits an aggregating authorized entity to build the resulting ciphertext and to decrypt it with respect to its associated attributes. This phase is based on two different algorithms, i.e; aggregate and decrypt. The different algorithms are detailed in Section V.

B. Security Model

For designing a secure and privacy preserving encrypted access control scheme, we consider two main adversaries.

We first point out the case of semi-honest gateway. That is, a semi-honest adversary provides proper inputs or outputs, at each step of the protocol, and properly performs any expected calculations, but it may attempt to gain extra information from the protocol. As such, we consider the semi-honest threat model against the privacy requirement with respect to the anonymity and unlinkability properties. Second, we consider the case of malicious adversaries, trying to override their rights. That is, malicious users may attempt to deviate from the protocol or to provide invalid inputs. For instance, a malicious party can also influence other parties to deviate from the protocol by substituting their local inputs in order to get information about honest parties' inputs. Likewise, the malicious party may refuse to participate or leave the protocol before the end. As such, we consider the malicious user security model mainly against the confidentiality property.

V. CONCRETE CONSTRUCTION OF OUR PRIVACY PRESERVING ACCESS CONTROL SCHEME TO AGGREGATED ENCRYPTED DATA

Our privacy-preserving access control scheme is relying on ABE in the sense that clients' keys and decryption capabilities are related to the attributes they possess. In our proposal, the ciphertext is generated with respect to a set of messages and the aggregating gateway's credentials (certified attributes) determine his capability to decrypt the result of a computed function f over the enciphered set of messages. That is, the manager GM defines the aggregating function f and the general access policy, w.r.t. each application requirements. Our scheme consists in performing the encryption of a set of different data chunks collected by a set of IoT devices. It relies on the distribution of the enciphering operation among different devices, with respect to sub-sets of a general access structure Γ, such that Γ = ∪ i∈[1,n] γ i . More precisely, each device U i encrypts its sensed data message m i relying on a sub access structure γ i and sends the partial enciphered information to an untrusted aggregating gateway S j .

In the following, we introduce preliminaries before detailing our concrete construction.

A. Mathematical Background

In this section, we provide some prerequisites, namely access structures and bilinear maps.

Definition 5.1: (Access Structure [1]) Let P = {P 1 , P 2 , • • • , P n } be a set of parties, and a collection A ⊆ 2 {P1,P2,••• ,Pn} is called monotone if ∀B, C ⊆ 2 {P1,P2,••• ,Pn} : if B ∈ A and B ⊆ C then C ∈ A. An access structure is a collection A of non-empty subsets of {P 1 , P 2 , • • • , P n } ; i.e. A ⊆ 2 {P1,P2,••• ,Pn} \ {∅}.
The sets in A are called authorized sets, and the sets not in A are called unauthorized sets. Note that in several ABE schemes, these parties are considered as the attributes. Definition 5.2: (Bilinear Maps) Let G 1 , G 2 , and G T be three cyclic groups of prime order p. Let g 1 , g 2 be generators of G 1 and G 2 respectively . A map ê : G 1 ×G 2 → G T is said to be bilinear if it satisfies the following properties: (i) bilinearity: for all g 1 ∈ G 1 , g 2 ∈ G 2 , (ii) non-degeneracy: ê(g 1 , g 2 ) = 1 and (iii) there is an efficient algorithm to compute ê(g 1 , g 2 ) for any g 1 ∈ G 1 and g 2 ∈ G 1 .

B. Access Tree Model

Let Γ be a tree representing the access structure, following the definition given in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. Indeed, each non-leaf node of Γ is described by the number of its children num x and a threshold value t x , where 1 ≤ t x ≤ num x . If the threshold value t x = num x , then it is an "AND "gate, otherwise it is an "OR "gate.

As introduced in [3], three additional functions are defined namely parent(x), att(x) and index(x). The parent(x) function denotes the parent of the node x, the att(x) denotes the attributes associated with the leaf node x and the index(x) denotes a number associated with the node. Satisfying an access tree -Let Γ be an access tree rooted at the node r. We denote by Γ x the subtree of Γ rooted at the node x, such that Γ r = Γ. As such, Γ x (S) = 1 if a set of attributes denoted S satisfies the access tree Γ x . If x is a non-leaf node, Γ x (S) is computed by recursively evaluating the subtrees Γ x (S) for all its x children.

Γ x (S) returns 1 if at least t x children returns 1. If x is a leaf node, then Γ x (S) = 1 if att(x) ∈ S.

C. Concrete Construction

Our construction is an access control scheme for multi-user encryption settings, based on the ciphertext policy attribute based encryption algorithm introduced in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. To support the multi-user encryption feature, the proposed scheme considers that the encryption process is performed by each participating device U i relying on a secret s i with respect to a dedicated access subtree γ i , while the decryption process should be performed with respect to a general access structure Γ = ∪ i∈ [1,n] γ i , where n is the number of sub-trees.

Let U = {U 1 , • • • , U n } be a set of IoT devices such that |U| = n. Each participant U i has to encrypt a message m i (i.e; i ∈ [1, n]), w.r.t. an access subtree γ i and publish the partial ciphertext CT i to the aggregating entity S j . The encryption of each message m i by U i relies on a different secret share s i . The decryption of the resulting message M , defined as

M = f ({m i } {i∈[1,n]}
) may be executed by any S j 1 . In the following, we detail the different algorithms of our construction, thus we suppose that GM has already set up the general access tree Γ and the aggregating function f . That is, during the SYSINIT phase, AA executes setup and keygen defined as follows:

• setup -this algorithm is executed by the attribute authority. It takes as input the security parameter κ and outputs the global public parameters pp and the master secret key msk. the setup algorithm first defines a bilinear setting (ê, G 1 , G 2 , p, g), such as ê : G 1 × G 1 ← G 2 and g of 1 For ease of presentation, f refers to the multiplication function. Yet, in general use cases, f may be any bijective and homomorphic function.

a generator of G 1 . Then, it selects at random an integer α ∈ Z. Let h := g β ∈ G 1 and H be a cryptographic hash function, such that H : S → G 1 . The global parameters of our system are as follows:

pp = {G 1 , G 2 , ê, p, g, h, ê(g, g) α , H}
We note that the master secret key of the attribute authority is the couple msk = {β, g α }.

• keygen -this algorithm is performed by the attribute authority, as detailed in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], in order to derive private keys associated with a set of attributes S = {a j } {j∈ [

sk = {D = g (α+r)/β , ∀a j ∈ S, D j = g r • H(a j ) rj , D j = g rj }
During the CO-ENCRYPT phase, two algorithms accshare and encpart are performed by the trusted device U s and each participating entity U i respectively:

• accshare -this algorithm is performed by U s , in order to set up required enciphering elements for the n participating users {U i } i∈ [1,n] . Note that this algorithm is performed periodically, for saving the energy consumption of involved IoT devices. That is, U s defines the access subtree γ i associated with each user

U i , such that {(U i , γ i )}, where i ∈ [1, n] and Γ = ∪ i∈[1,n] γ i .
Then, it chooses a secret deciphering key s such as s = n i=1 s i and s i is the secret share associated with each device U i . Finally, U s sets C = h s and outputs :

{{(γ i , s i )} i∈[1,n] , C}
Recall that each (γ i , s i ) is privately shared with the corresponding U i , while C is published for further processing by the aggregating entities.

• encpart -this algorithm is run by each participating IoT device U i , in order to derive a partial ciphertext CT i for a message m i , with respect to an access sub-tree γ i , a secret share s i and the aggregating function f . U i proceeds similarly as explained in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. That is, for each node x of its associated sub-tree γ i , U i defines a polynomial q x of degree

d x = k x -1
where k x is the threshold value of the node x and q x (0) = q parent(x) (index(x)). , such that C i,j = g qy j (0) and C i,j = H(att(y)) qy j (0) . Afterwards, U i encrypts the message m i with respect to γ i and outputs the partial ciphertext CT i such that:

Let L = {Y 1 , Y 2 , • • • , Y n }
CT i = { Ci , ∀y j ∈ Y i , j ∈ [1, |Y i |] : C i,j , C i,j }
where, Ci depends on the aggregating function f pointed out by the manager. In the sequel, the encrypted message CT i is defined as follows:

     Ci = m i • ê(g, g) αsi C i,j = g qy j (0) C i,j = H(att(y)) qy j (0)
Recall that the partial ciphertext CT i associated to each IoT device U i does not include γ i . Remark 5.3: Processing cost efficiency for IoT devices -Considering resource constraints of IoT devices, in terms of storage and processing, our scheme assumes that several elementary functions may be used for several encryption sessions (i.e., computation of polynomials and encryption of leaves' nodes). As such, only a few number of exponentiations and multiplication is required by each single IoT device. In addition, for devices with a very limited lifetime and low storage and computation capacities, it is assumed that these objects are pre-configured by the manufacturer with a secret s i . As such, once installed in the system, this secret is shared with the IoT trusted node. As a consequence, the IoT trusted device computes the ciphertext element C with respect to the secrets of involved IoT devices, while selecting different combinations of devices for each session. And, the communication overheads are highly reduced during the whole lifetime of resource-constained IoT devices, while avoiding exchanging secrets and re-computing some ciphertexts' elements periodically .

During the AGGREGATE phase, two algorithms aggregate and decrypt are performed by the aggregating node S j :

• aggregate -this algorithm is executed by the aggregating entity S j , upon receiving the n ciphertexts from the participating entities {U i }, where i ∈ [1, n]. It permits to build a global ciphertext, with respect to the global public access tree Γ and the aggregating function f . The aggregate algorithm outputs an aggregated global ciphertext CT , defined as:

CT = { C, C, ∀Y i ∈ L, ∀y j ∈ Y i : C i,j , C i,j }
where C is received from the trusted IoT node and C is computed as follows:

i∈[1,n] Ci = n i=1 m i • ê(g, g) α n i=1 si = M.ê(g, g) αs
In the following, we denote by C y and C y each element C i,j and C i,j , respectively. • decrypt -this algorithm, executed by the aggregating entity S j , permits to decrypt the aggregated ciphertext CT , including the global access structure Γ and the private key sk associated with S. The decrypt algorithm is mainly based on the Bethencourt et al. construction [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF].

To do so, for decrypting the aggregated ciphertext with respect to the function f , the aggregating entity uses a recursive algorithm DecryptNode(CT, sk, x), as defined in [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF] which takes as input the global ciphertext CT , the private key sk, associated with a set of attributes S, and a node x from the global access tree Γ. If x is a leaf node, then we denote by a i = att(x).

If the attribute a i ∈ S, then

DecryptNode(CT, sk, x) = ê(D i , C x ) ê(D i , C x ) = ê(g, g) rqx(0)
else, DecryptNode(CT, sk, x) =⊥. If x is a non-leaf node, then DecryptNode(CT, sk, x) processes as follows, except for the root node and its direct children: For all the children nodes z of x, the algorithm computes F z = DecryptNode(CT, sk, z). Let S x be an arbitrary k x -sized set of child nodes z where F z =⊥. Recall that if there are no such existing set then the node is not satisfied and the algorithm returns ⊥. In addition, we denote by i = index(z) and S x = {index(z), z ∈ S x }. In the sequel, the aggregator computes F x , defined as:

F x = z∈Sx F δ i,S x (0) x = ê(g, g) rqx(0)
Finally, S j derives A = ê(g, g) rs , associated with the root node and decrypts M such that:

C ê(C,D) A = M VI. SECURITY DISCUSSION
To prove the efficiency and the security of our scheme, a security analysis is presented in this section.

A. Correctness

The correctness of the proposed scheme relies on Theorem 6.1, based on the correctness of aggregate and decrypt algorithms which are defined w.r.t. the multiplication function.

Theorem 6.1: Correctness -The proposed scheme is correct if for all security parameter κ, all universe descriptions S, all (pp, msk) ∈ setup(κ), all S ⊆ S, all (m, M ) ∈ M (i.e; M is the message space), all (γ, Γ) ∈ G (i.e; G is the access structure space), all sk ∈ keygen(pp, msk, S), all (C, (s i , γ i )) ∈ accshare(pp) and all CT i ∈ encpart(γ i , s i , m i ), then aggregate(pp, f, {CT i } i∈ [1,n] ) = CT , where n is the number of received ciphertexts, if S satisfies Γ, such that Γ(S) = 1, then the decryption algorithm decrypt(pp, CT, sk) outputs M .

Proof: Upon receiving n different encrypted data chunks for the participating devices [1,n] , the aggregating entity S j executes the aggregate algorithm, with respect to f , defined by GM . The aggregation process mainly relies on the computation of C, based on the received { Ci } i∈ [1,n] . That is, the computation of C is performed as follows:

{CT i } i∈[1,n] = { Ci , ∀y j ∈ Y i , j ∈ [1, |Y i |] : C i,j , C i,j } i∈
C = i∈[1,n] Ci = n i=1 m i • ê(g, g) α n i=1 si = M.ê(g, g) αs
In the sequel, the global ciphertext CT is defined as follows:

CT = { C, C, ∀y : C y , C y }
where y is a leaf node of the global access structure Γ.

Upon building the global ciphertext and receiving the secret keys associated to S (i.e; S is the set of attributes of the aggregating entity) from AA, the aggregating entity can decrypt CT , if his credentials satisfy the access structure (i.e; Γ(S) = 1). Our decryption algorithm mainly relies on the Bethencourt et al. construction [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], w.r.t. the DecryptNode function, executed for each access-tree node. As such, the decrypt algorithm outputs the resulting message M , as follows:

C ê(C,D) A = M • ê(g, g) αs ê(h s ,g (α+r)/β ) ê(g,g) rs = M • ê(g, g) αs ê(g,g) αs ê(g,g) rs ê(g,g) rs = M
As such, we prove the correctness of our proposed construction, with respect to Theorem 6.1.

B. Confidentiality

To ensure efficient multi-user encryption scheme while enhancing fine-grained access control, our construction mainly relies on the CP-ABE scheme proposed by Bethencourt et al. [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. As such, the data confidentiality preservation is tightly related to the security of this used encryption algorithm.

Theorem 6.2: The proposed multi-user encryption scheme ensures the secrecy of both encrypted data chunks and aggregated data contents.

Sketch of Proofthe proof of Theorem 6.2 is twofold. First, the secrecy of encrypted data contents depends on the security of the attribute based encryption algorithm used to encipher data chunks provided by IoT devices. Thus, our proposed scheme inherits the indistinguishability property from [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], such that if a malicious adversary has some information about the plaintext, it should not learn about the ciphertext. This security notion requires the computational impossibility to distinguish between two messages chosen by the adversary. Note that in ABE schemes, the adversary may lead an attack against the indistinguishability property either on his own or through a collusion attack. Indeed, similar to [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], each private key element contains a random value r related to each participating entity, which prevents colluding users to override their rights and successfully perform a collusion attack. In addition, subaccess encrypting predicates used to encrypt data chunks are not communicated to the aggregating gateway S j . As a consequence, this latter cannot deduce data chunk content, even by conducting a brute force attack, because of the use of C = h s = h n i=1 si . In fact, this value is published by the IoT trusted device, where a malicious aggregator needs to have each single C i = h si and the corresponding sub-access tree γ i to be able to conduct such attack. Second, the secrecy of resulting aggregated contents depends on the consistency of the aggregating algorithm agg, such that aggregated data contents are only accessed by the authorized aggregator. Indeed, the general enciphering access predicate is published by the system administrator to the involved aggregating entities. As such, thanks to the use of attribute based encryption, data are only accessed by entities whose attributes satisfy the access policy.

C. Privacy Theorem 6.3: The proposed scheme is private against both malicious and honest but curious adversaries.

Sketch of Proof -The proof of Theorem 6.3 is twofold. First, it considers the case of malicious users against the privacy of contents. That is, a malicious adversary tries to get access to a single encrypted data chunk. Obviously, this sub-case is related to the confidentiality requirement (cf. Theorem 6.2). Recall that a malicious aggregator cannot deduce data chunks even by conducting a brute force attack, because of the use of a general access tree Γ and a single ciphertext element C. Second, it considers the case of honest but curious adversaries against the privacy of devices. That is, a curious aggregating gateway attempts to distinguish between two legitimate enciphering devices U 1 and U 2 , trying to link the encrypted data related to each device. Mainly, our scheme inherits this privacypreserving property from the used attribute-based encryption mechanism [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF]. That is, the encryption of a message relies on a random secret s = n i=1 s i , thus a non-identifying enciphering secret, contrary to traditional public key encryption mechanisms. In our proposed multi-user encryption scheme, each device uses a different random s i to encrypt the sensed message m i . Thus, our multi-user encrypted access scheme ensures the privacy of users, against honest but curious adversaries.

VII. PERFORMANCES ANALYSIS

Table I presents a comparison between our proposal and most closely related schemes, w.r.t. functional requirements.

It is worth noticing from Table I that compared to the different presented constructions [START_REF] Sahai | Fuzzy identity-based encryption[END_REF], [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF], [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF], [START_REF] Odelu | Expressive cp-abe scheme for mobile devices in iot satisfying constant-size keys and ciphertexts[END_REF], our proposed scheme provides the multi-user ciphertext-policy encryption feature, relying on general access structures. That is, as stated in section III, although the KP-ABE scheme offers fine-grained access control feature, it has one main disadvantage. Indeed, data owners cannot decide on who has access to their encrypted data, except by their choice of descriptive attributes for the data, since the access policy is embedded in the user private keys. As a result, the data owners have to trust the key issuer. Ciphertext-policy ABE schemes remove such inconvenience by directly embedding the access policy on the ciphertext. The data owners can now authorize who can have access on their encrypted data. While constructions proposed in [START_REF] Sahai | Fuzzy identity-based encryption[END_REF], [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF] and [START_REF] Odelu | Expressive cp-abe scheme for mobile devices in iot satisfying constant-size keys and ciphertexts[END_REF] do not support the aggregation feature, schemes presented in [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF] and [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF] permit an assistant trusted node to distribute the encryption process among a set of devices, thus allowing it to generate the resulting ciphertext. As such, the aggregating node is mainly the aggregating node, as aggregation cannot be performed by any external entity, unlike our proposed scheme.

The processing and communication costs introduced by the proposed approach are considerably optimized, where the number of polynomials, that have to be assigned to each gate of an access tree, thanks to the use of sub-access trees associated to each participating device, similarly as presented in [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF].

| γ M + (1 + Y Γ )γ E × [3] CP-ABE general tree × (2Y Γ + 1)|G| + |G T | γ M + 2(2 + Y Γ )γ E × [18] CP-ABE general tree × (2Y Γ + 1)|G| + |G T | γ M + 2(2 + Yγ i )γ E (2Y Γ + n)γ M [17] KP-ABE threshold × t(|G| + |G T |) 2Yγ i γ E (1 + n)γ M [11]
CP-ABE AND-gates

× 3|G| + L Y Γ γ E + 3(γ E + γ M ) × ours CP-ABE general tree (2Yγ i + 1)|G| + |G T | γ M + 2Yγ i γ E nγ M
Note: and × indicate that the requirement is achieved or not, respectively; Y Γ is the number of attributes in the access policy Γ and Yγ i is the number of attributes in the access policy γ i where i= [1,n] γ i = Γ ;|G| and |G T | are the size of an element of G and G T , respectively; L is the length of the message and t is the threshold value; γ E and γ M represent the computation cost exponentiation and multiplication computation costs respectively.

For the aggregate algorithm, our construction presents an interesting computation cost nγ M , compared to most closely related schemes, namely [START_REF] Touati | C-cp-abe: Cooperative ciphertext policy attribute-based encryption for the internet of things[END_REF], [START_REF] Touati | Collaborative kp-abe for cloud-based internet of things applications[END_REF]. For more realistic performance results of our scheme, we conducted some experiments, for several exponentiation and multiplication operations on an Intel E5-1650-v3 6 cores. Our measurements show that exponentiations and multiplications take about 1.2 ms and 0.5 ms, respectively. In addition, referring to the cpabe toolkit2 [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF], the computation costs of the key generation and encryption algorithms are mainly depending on the number of involved attributes. The cpabe toolkit provides a set of programs implementing CP-ABE schemes, using the PBC library 3 . The code is split into two packages, libbswabe (i.e; a library implementing the core cryptographic operations) and cpabe (i.e; higher level functions and user interface). For instance, the encryption algorithm takes about 1.5 second relying on an access tree containing around 60 attributes [START_REF] Bethencourt | Ciphertext-policy attributebased encryption[END_REF].

VIII. POSSIBLE IMPROVEMENTS

The proposed mechanism permits a set of collaborating resource-constrained devices, with the assisting trusted IoT node, to encrypt different sensed data chunks, thus enabling an external gateway to decrypt the set of aggregated data, w.r.t. a general access tree. The assistant node is set up to support IoT devices. However, our multi-user encryption scheme may be deployed for several different settings, namely for multifog cooperative applications, where each fog network holds a different data chunk and has to cooperate with other fogs' nodes to encrypt their related data. As such, if a cloud gateway satisfies the general access structure, it can only decipher the aggregated data content.

For this purpose, we extend our proposed scheme, to ensure a collaborative multi-user encryption, that is the set of involved fogs' nodes need to cooperate for deriving the enciphering secret s, based on the key distribution algorithm, introduced in [START_REF] Burmester | A secure and scalable group key exchange system[END_REF]. The different algorithms are defined as follows:

• setup -the setup algorithm first selects leveled 4linear maps [START_REF] Hohenberger | Full domain hash from (leveled) multilinear maps and identity-based aggregate signatures[END_REF]. In fact, it defines two symmetric pairing functions ê1 and ê2 , such that ê1 :

G 1 × G 1 → G 2 and ê2 : G 2 × G 2 → G 3 ,
pp = {G 1 , G 2 , G 3 , ê1 , ê2 , p, g 1 , g 2 , h, ê1 (g 1 , g 1 ) α , H}
The master secret key of AA is msk = {β, g 1 α }.

• keygen -the private key sk contains a new key element, referred to as D, and is defined as follows:

sk = { D = g 1 α(1+r)/β , ∀a j ∈ S, D j = g 1 r • H(a j ) rj , D j = g 1 rj }
• accshare -this algorithm is performed by GM . It defines the global access structure Γ, the aggregating function f and the access sub-tree γ i associated with each participating fog node U i , such that {(U i , γ i )}, where i ∈ [1, n] and Γ = ∪ i∈[1,n] γ i . • secgenpart -this algorithm is mainly based on [START_REF] Burmester | A secure and scalable group key exchange system[END_REF] construction. It is executed by each participating fog node U i , in order to derive an element E i of his partial secret s i , needed to compute the global shared enciphering secret s. For this purpose, each participant U i derives a secret s i , computes and shares two public elements z i and µ i defined as z i = h si and µ i = ê1 (g 1 , g 1 ) αsi , respectively. Afterwards, based on the published elements of the remaining participants, each user U i calculates and publishes his partial enciphering element E i defined as the couple ê2 (g 2 , ê1 (g 1 , g 1 ) αs ) = ê2 (g 2 , ê1 (g 1 , g 1 ) α(s1s2+•••+sns1) )

E i = (X i , Y i ) = ([ zi+1 zi-1 ] si , [ µi+1 µi-1 ] si ),
Then, U i proceeds similarly as explained in section V. That is, U i encrypts the message m i with respect to γ i and outputs the partial ciphertext CT i such that:

CT i = { Ci , C, ∀y j ∈ Y i , j ∈ [1, |Y i |] : C i,j , C i,j }
where C value is similarly computed and sent by all participants. As this ciphertext's element depends on the enciphering secret s, it permits to detect whether there is an inconsistency among the different received values, before proceeding to the aggregation and decryption processes. Ci depends on f pointed out by GM and it is defined as Ci = [m i ] n • K.

Recall that the partial ciphertext CT i associated to the fog node U i does not include γ i . • aggregate -it outputs a global CT defined as:

CT = { C, C, ∀Y i ∈ L, ∀y j ∈ Y i : C i,j , C i,j }
where C is defined as follows:

C = n i=1 [ Ci ] n -1 = n i=1 [(m i ) n ] n -1 n i=1 K n -1 = M • K
• decrypt -this algorithm, executed by the aggregating entity S j , permits to decrypt the aggregated ciphertext CT , including the global access structure Γ and the private key sk associated with S. It is mainly similar to the proposed construction, detailed in section V. Thus, for leaves and intermediate nodes, the aggregator computes F x , defined as: F x = ê1 (g 1 , g 1 ) rqx(0) . For the direct children of the root node, this extended construction introduces a new algorithm referred to as DecRootChild. Indeed, it relies on the execution of the DecryptNode function and is defined such that DecRootChild(CT, sk, x, µ i-1 ) = ê2 (µ i-1 , DecryptNode(CT, sk, x)).

If the aggregating entity satisfies a childroot node x, such that index(x) = i, then DecRootChild(CT, sk, x, µ i-1 ) = ê2 (g 2 , g 2 ) αrsisi-1 . If the set of attributes S satisfies the global access structure Γ, then the aggregating entity computes a quantity A, as follows: = ê2 (g 2 , g 2 ) αr i∈ [1,n] sisi-1 = ê2 (g 2 , g 2 ) αrs

A = i∈[
Finally, the aggregating entity S j decrypts M as follows: C IX. CONCLUSION The fast growing and the ubiquity level inflation of Internet of Things leads us to propose a secure and privacy preserving multi-user encryption scheme for fine-grained access control adapted for Cloud-assisted IoT applications. Our construction takes advantage of the CP-ABE scheme to obtain a flexible and fine grained access control scheme. It enables an aggregating entity to collect sensory data from different devices and decrypt them if it satisfies a general access structure. The proposed cooperative scheme does not reveal any information about the enciphered single data chunks, thus ensuring the privacy of involved entities. Furthermore, it is proved to be suitable for resource-constrained devices based on a theoretical performance analysis.

Fig. 1 .

 1 Fig. 1. WBAN Fog based Architecture

  1,n],x∈Sr DecRootChild(CT, sk, x, µ i-1 ) = i∈[1,n],x∈Sr ê2 (g 2 , g 2 ) αrsisi-1

  ,ê1(h s ,g1 α(1+r)/β )) ê2(g2,g2) αrs = M • ê2 (g 2 , g 2 ) αs ê2(g2,ê1(g1 βs ,g1 α(1+r)/β )) ê2(g2,g2) αrs = M • ê2 (g 2 , g 2 ) αsê2(g2,ê1(g1,g1) sα(1+r) ) ê2(g2,g2) αrs = M

  1,|S|]} of a requesting entity. That is, AA selects a set of random values {r, {r j } {j∈[1,|S|]} }, related to the requesting entity and to its associated attributes S = {a j } {j∈[1,|S|]} . The private key sk is defined as follows:

  be the set of leaf nodes of the global access tree Γ, where each subset Y i (i.e; i ∈[1, n]) is assigned to a user U i , with respect to its associated subtree γ i . Let q yj be the polynomial assigned to each leaf node y j ∈ Y i (i.e; j ∈ [1, |Y i |] ), associated to the IoT device U i . For each leaf node y j ∈ Y

i (i.e; j ∈ [1, |Y i |]),

the IoT U i computes two group elements C i,j and C i,j

  where G 1 , G 2 and G 3 are three multiplicative groups of prime order p. It also selects three random generators g 1 and g 2 of G 1 and G 2 , respectively. Then, it selects at random two integers α, β ∈ Z. Let h := g 1 β ∈ G 1 and H be a cryptographic hash function, such that H : S → G 1 . The global parameters pp are defined as follows:

  required to derive the global secret element s.• encpart -this algorithm is run by each U i , in order to derive a partial ciphertext CT i for a message m i , w.r.t. γ i and the aggregating function f . To do so, each U i first computes two elements (C, K) associated to the global enciphering secret s, based on the set of shares {E j }, where j ∈ [1, n], j = i. That is, each participant calculates C relying on the set of shares{X j } j∈[1,n],j =i , such that C = h s = h s1s2+s2s3+•••+sns1. Similarly, U i computes K relying on the set of shares {Y j } j∈[1,n],j =i , such that K = ê2 (g 2 , g 2 )

αs is derived as follows:

http://acsc.cs.utexas.edu/cpabe/index.html

https://crypto.stanford.edu/pbc/