Searchable attribute-based encryption scheme with attribute revocation in cloud storage.

Attribute based encryption (ABE) is a good way to achieve flexible and secure access control to data, and attribute revocation is the extension of the attribute-based encryption, and the keyword search is an indispensable part for cloud storage. The combination of both has an important application in the cloud storage. In this paper, we construct a searchable attribute-based encryption scheme with attribute revocation in cloud storage, the keyword search in our scheme is attribute based with access control, when the search succeeds, the cloud server returns the corresponding cipher text to user and the user can decrypt the cipher text definitely. Besides, our scheme supports multiple keywords search, which makes the scheme more practical. Under the assumption of decisional bilinear Diffie-Hellman exponent (q-BDHE) and decisional Diffie-Hellman (DDH) in the selective security model, we prove that our scheme is secure.

Introduction

In 2005, Waters et al.[1] came up with the concept of ABE(Attribute-Based Encryption) which was much more flexible than traditional public-key encryption. With the development and deepening of ABE, the attribute revocation of ABE is concerned by more and more people. The efficient attributes revocation scheme is an integral part of ABE scheme, which is one of the difficulties for the application of ABE, and the study of ABE is inseparable from the attribute revocation scheme research.

P. Traynor et al.[2] put forward a scheme which achieved the update of secret key in 2006. However, it needed that the user must kept close contact with attribute authority to get the secret key. Thereafter, Kumar et al.[3] presented a scheme with revocation of ABE, and it expanded from the IBE which they proposed before. All of these articles demand that users need to access the attribute authority for key reissuing at regular intervals.

In 2008, Jiang et al.[4] gave a scheme that solved the key misused problem of users. However, in this scheme, the third party should be included in each decryption key of users, and made it was unrealistic. After that, Kim et al.[5] inserted the users’ information in the secret key of attribute by using the black box model and sent it to the user, which was more efficient to guarantee the security of the system.

Attrapadung et al.[6] put forward the two revocation models, they are direct revocation model and indirect revocation model. The direct revocation model is specified the revocation list by sender, and the indirect revocation model updates the secret key periodically by the key center. In [7] [8], the authors gave some ABE instances. However, in the above schemes, they do not relate to the keyword search issue, which makes users can not effectively search for files.

To overcome this problem, Boneth et al. [9] proposed a single keyword search scheme, namely the user can only search a single keyword. In this scheme, the data owner extracted the keywords from the file before encrypted, and used the public key to encrypt the keywords. After that, the data owner sent the file and the index of the keywords to the cloud server. The user could generate the search token about the keywords which he wanted to search and sent it to the cloud server. The cloud server used the matching algorithm to find out the cipher text and returned it if the match was successful.

Searchable encryption has many practical applications. In 2011, Kerschbaum et al.[10] proposed a secure conjunctive keyword searches for unstructured text scheme, and the scheme was proved secure in the random oracle model. At the same year, Cao et al.[11] and Chuanh et al.[12] gave schemes that the multi-keyword search over encrypted data.

In 2014, Han et al. [13] proposed an attribute based encryption (ABE) searchable scheme, in which used the homomorphic encryption technology. Sahai et al. [14] gave a outsourcing technique based on the scheme of Gentry et al.[15]. After that, Liang K et al. [16] proposed a searchable ABE mechanism with efficient and secure in cloud storage. This model can be applied to real life, such as the safety of electric power system. And the scheme is secure in the random oracle model. Later, Li et al. [17] proposed a searchable ABE scheme with attribute revocation in cloud storage.

Willy Susilo et al.[18] proposed a searchable scheme, and it supported multiple keywords search. At the same time, Li J et al.[19] made a searchable CP-ABE with revocation. In this scheme, the receivers could not steal any information from the cipher because of the access structures were partially hidden, which made the scheme more secure.

In 2016, Wen et al. [20] proposed a verifiable attribute-based keyword search scheme with fine-grained owner-enforced search authorization in the cloud. This scheme supports user revocation. Besides, it allows data owners encrypt the data and outsource to the cloud server. In the same year, Yang et al. [21] proposed a conjunctive keyword search scheme with designated tester. User can search within a specified time if he is authorized, and it is proved secure in the standard model. In 2017, Jiang et al. [22] proposed a keyword search scheme with efficiency and verification in cloud data, and it allows multi-keyword search. Finally, they gave the security analysis in the scheme. Later, Poon et al.[23] constructed a conjunctive keyword search scheme. This scheme allows phrase search, and has smaller storage cost.

Our contribution

In 2012, Qiang Li et al.[24] put forward a scheme with fine-grained attribute revocation. However, the scheme only achieves the attribute revocation, the keyword search is not involved, this problem may lead to the problem that system users cannot effectively download cipher text which they interested from the cloud server.

In this paper, we propose a keyword search attribute based encryption scheme with attribute revocation. The new scheme supports not only the attribute revocation but also keyword search. When a user wants to search the file which he interests, he sends the search token to the cloud server, and the cloud server runs the test algorithm. If the test is successful, it returns the file. In this way, the user can download the file which he interests and save the storage space at the same time. Finally, under the assumption of q-BDHE and DDH in the selective security model, we prove that our scheme is secure.

Preliminaries

A linear secret sharing scheme can be used to represent an access control policy (M, ρ), which M is an l×k matrix, and S = {att1, …, attn} be an attribute set, and for i ∈ [1,l], ρ(i) → S is a mapping function, and ρ(i) maps a row into the attribute.

Linear Secret-Sharing Scheme (LSSS) [25]

A linear secret sharing scheme includes two algorithms:

Share: In this step, it is dispersing the secret value s to attributes specified by ρ as follows: by selecting ,setting and computing where M is the ith row of M,it assigns secrets share λ to the attribute ρ(i).

Combine: In this step, it is used to collect the secret value from secret shares which related to the attributes as follows: selecting subset I = {i: ρ(i) ∈ S} the attribute set {ρ(i) | i ∈ I} satisfies access control strategy (M, ρ), and computing coefficients ki, i ∈ I such that ∑ kM = (1,0,…, 0), then we will obtain that ∑ kλ = s.

Decisional q-BDHE assumption [24]

The definition of the decisional q-BDHE exponent assumption in our article as follows:

Choose a group G1 of prime order p, let g be a generator of G1, and define e: G1 × G1 → G2, the adversary is given a vector We say that the Decision q-BDHE assumption holds in G1 if no polynomial-time algorithm has a non-negligible advantage to distinguish and a random element in G2.

Zero Inner-product [24]

The ID represents the identity of user which associated with user’s private key. Define a vector X = (x1,…,x)T such that x = ID, i ∈ [1, n]. To encrypt with a revoked user set R = {ID1,⋯, ID}, one defines as Y = (y1,…, y)T, the coefficient vector of P[Z] from where, if q + 1 < n, the coordinates y,⋯,y are set to 0. By doing so, we note that P[ID] = = 0 iff ID ∈ R.

For example, if the user ID1 in the revoked user set R = {ID1, ID3}, we have that .

Decisional DDH assumption [10]

Let G1 is a group which prime order is p, let g be a generator of G1, and give a tuple (g, g, g) where , we say that the decisional DDH assumption holds if no polynomial time algorithm has a non-negligible advantage to distinguish that Z equals g or to a random element of G1.

Algorithm model and security model

Algorithm model

Denote U = {ID1,⋯, ID} to be the universe of all the users, we consider a scheme that searchable attribute-based encryption scheme with attribute revocation in cloud storage, as described in Fig 1. There are seven algorithms in our scheme:

Fig 1

System model of our scheme

Setup (λ) → msk, pp: This algorithm is executed by attribute authority. It inputs a security parameter λ and outputs the master secret key msk and public parameter pp.

KeyGen (ID, (M, ρ), pp, msk) → sk, τ:This algorithm is executed by attribute authority. It inputs a user’s identity ID ∈ U, an access structure (M, ρ), public parameter pp, the msk and outputs the secret key sk and the part of search token τ.

Encryption (pp, ω, R, m) → ct: This algorithm is executed by data owner. It inputs public parameter pp, the attribute set ω, a revocation list R ⊆ U which attribute θ ∈ ω,a message m and outputs a cipher text ct.

Index (pp, ω, R, W) → Ind: This algorithm is executed by data owner. It inputs public parameter pp, the attribute set ω,a revocation list R ⊆ U which attribute θ ∈ ω,the keywords set from the uploaded files W and outputs keywords index Ind.

Trapdoor (pp, W′, τ) →τ*:This algorithm is executed by user. It inputs the public parameter pp and the keywords set W′, and outputs the new token τ*.

Test (τ*, Ind) → 1 or 0:This algorithm is executed by cloud storage server. It inputs the search token τ*and keywords index Ind and outputs 1 or 0.

Decryption (pp, ID, sk, R, ct) → m: This algorithm is executed by user. It inputs public parameter pp, the user secret key sk of user ID ∈ U, a revocation list R ⊆ U of attribute θ ∈ ω, a cipher text ct. And the user ID has the attribute set ω′ as: if ID ∈ R, let ω′ = ω − {θ};otherwise, ω′ = ω. It computes the message m if and only if the attribute set ω′ satisfies the access structure. And the user can decrypt the file with m.

Finally, the system model of our scheme is shown in Fig 1.

Security model

(1) Selective security model of attribute revocation

Init. The adversary chooses the attribute set ω* and a revocation list .

Setup. The simulator operates this algorithm to get the public parameter pp and sends it to the adversary.

Phase 1. The adversary queries the simulator for user private key sk which corresponds to the access structure (M, ρ), such that ω*′will not meet the access structure (M, ρ).

Challenge. The simulator receives two messages m0 and m1 from adversary, and chooses a random bit b ∈ {0, 1} to encrypt m, and computes challenge cipher text ct* with the attribute set ω* and the attribute revocation list .

Phase 2. Same as Phase 1.

Guess. The adversary gives a guess b′ of b, and the advantage of the adversary in this game is defined as .

Definition1. The game model of this paper is to be safe if there no polynomial time adversaries have a non-negligible advantage in the above game.

(2) Indistinguishability against chosen keyword attack (IND-CKA) model

Init. The adversary selects a attribute set ω* and a user revocation list of θ ∈ ω*. Then runs the algorithm to generate the public parameter pp and sends it to adversary .

Phase 1. The adversary queries the challenger as follows:

The index of keywords {w1, w2,…, w}.

The search token of , and .

Challenge. The challenger receives two different keywords and from the adversary. We require that the keywords and satisfies that .

The challenger chooses a random keyword , b ∈ {0,1}, and give the index of keywords to adversary.

Phase 2. Same as Phase 1.

Guess. The adversary gives a guess b′ of b, and the advantage of any adversary in this game is defined as .

Definition 2. We say a searchable encryption article with multiple keywords is secure based on the game IND-CKA, if the advantage of the adversary is negligible in the above game.

Implement of the algorithm

Our construction is based on the Qiang Li et al.[24], and we combine the keyword search with attribute revocation in our new scheme. User constructs the search token when he wants to search files. If the search is successful and the set of attribute satisfies the access structure, it outputs 1 in the algorithm of Test, then cloud server returns the cipher text. Our scheme adds access control in search, the user can download the files which he interests and can decrypt in this way, and save the space. We construct our scheme as follows:

Setup (λ) → msk, pp: Give that the G1 and G2 are two groups of prime order p, the binary size of p is λ,let g be a generator of G1. Define that e: G1× G1 →G2. In this paper, we suppose the maximum number of attribute is m when encryption, and n represents the maximum number of revoked user set in the revocation list. Then randomly choose α, β, δ ∈ Z, , set and randomly choose {k0,, k1, ∈ G1|},let . Then randomly choose that {t0,, t1, ∈ G1|},and then define two functions T(x): Z → G1, where f = {0, 1}. Let hash H be H:{0, 1}* → G1, then the master key msk and public parameter pp are:

KeyGen (ID, (M, ρ), pp, msk) → sk, τ : Let M be an l × k matrix corresponding to access policy (M, ρ). Define a vector X = (x1,…,x)T such that x = ID, i ∈ [1, n]. Randomly choose r, {z, z}i∈[2,… ∈ Z, define a vector v0 = (α + rα1, z2,0,…, z)T, v1 = (α, z2,1,…, z)T. For i = 1 to l, and compute that λ = M·v and λ = M·v. Randomly choose {r, r}i∈[1,… ∈ Z, and set the private key as where

Then calculate that , where M ∈ (Z) is defined by .

Randomly choose and set . For i = 1 to l, compute λ = M·v. Randomly choose ξ ∈ Z, then denote that where then send sk and τ to the user.

Encryption (pp, ω, R, m) → ct: Suppose that a message m is encrypted with a set of attribute ω and a revocation list R ⊆ U which attribute θ ∈ ω. Define a vector Y = (y1,…, y)T as the coefficient vector of , and randomly choose s ∈ Z then output where

Index (pp, ω, R, W) → Ind: A revocation list R ⊆ U which attribute θ ∈ ω. Data owner encrypts the file F which is firstly encrypted by a symmetric encryption algorithm and gets cipher text F*, and suppose that the symmetric encryption key is m. The set of keywords W = {w1, w2,…, w} is extracted from the F, and randomly choose t ∈ Z,and output the keywords index where and send to the cloud server.

Trapdoor (pp, W′, τ) →τ*: The user constructs the search token τ* according to the keywords which he interests as and sends search token τ* = < τ1, τ2,0, τ2,1, τ3> and his ID to the cloud server.

Test (τ*, Ind) → 1 or 0: The cloud server receives the search token from the user. First, the cloud server judges that whether the ID of user is in the revocation list R. If ID ∈ R, let ω′ = ω − {θ};otherwise, ω′ = ω. If the set ω′ satisfies the access structure (M, ρ), then there exists a set of constants {μ ∈ Z}, such that .

(1) When ID ∉ R, cloud server selects N1 keywords index from the Ind, we denote the result of selecting as ,where . Then cloud server tests the selected index set with the search token τ* = < τ1, τ2,0, τ2,1, τ3> with the following equation If the equation holds, it turns to next step; otherwise, it outputs 0.

If the equations all hold, it returns the corresponding cipher text to the user, and user can decrypt. Otherwise, it outputs 0.

(2) When ID ∈ R, cloud server selects N1 keywords index from the Ind, we denote the result of selecting is ,where . Then cloud server tests the selected index set with the search token τ* = < τ1, τ2,0, τ2,1, τ3> with the following equation

If the equation holds, it turns to next step; otherwise, it outputs 0.

If the equations all hold, it returns the corresponding cipher text to the user, and user can decrypt. Otherwise, it outputs 0.

Decryption (pp, ID, sk, R, ct) → m: User can decrypt according to the returned cipher text. If ID ∈ R, ω′ = ω − {θ};otherwise, ω′ = ω, and then:

(1) When ID ∈ R, let I = {i: ρ(i) ∈ ω′}, and there exists a set of constants {μ ∈ Z}, such that ∑ μ · M = (1,0,…, 0),then ∑ μλ = α. It calculates and m = C / φ, user can decrypt F* to get F with m.

(2) When ID ∉ R, calculate so that when ≠ 0, and then calculate Let I = {i: ρ(i) ∈ ω′}, and there exists a set of constants {μ ∈ Z}, such that ∑ μ · M = (1,0,…, 0),then ∑ μλ = α+ rα1. Thus we have and m = C / A, user can decrypt F* to get F with m.

Correctness analyses

In this subsection, we show that our construction is correct with some appropriate parameters setting.

(1) In the process of search the equation holds, it means that cloud server selects N1 keywords index from the Ind which we denote ,where is matching the search token of the keywords from the user, then computes that a. When ID ∉ R, compute that b. When ID ∈ R, compute that

(2) The decryption process first calculates

(3) The decryption process calculates:

a. When ID ∈ R b. When ID ∉ R Let A = γ / ϕ = e(g, g).

Security analyses

Selective security model proof

Theorem1. If an adversary can break our scheme with advantage ε in the selective security model, then we can construct a simulator to solve the Decision q-BDHE problem with advantage .

Proof: This proof bases on [24].

The simulation proceeds as follows. First, the challenger sets

Then the challenger flips a fair binary coin μ: if μ = 0, the challenger sets Z = e(g1, g) if μ = 1,then the challenger picks a random element Z from G2.

Init. The simulator runs adversary . selects an attribute set ω* and a user revocation list ,where θ ∈ ω*, which it wishes to be challenged upon.

Setup. The simulator proceeds as follows:

(1) The simulator randomly chooses α′, β, δ, ∈ Z, and then simulator sets that ,implicitly has that α = α′ + α. Then it randomly chooses , and computes

(2) It sets where m ≤ Q. For k ∈ [1, m], simulator sets , randomly chooses b ∈ Z and has that and . The simulator sets the n×q matrix B = (b1|…|b|0|…|0), for k ∈ [1, m], it consists by b, and q − m columns are 0. Sets Z = (z1,⋯,z)T ∈ Z and z = a, and implicitly has that A = B·Z + δ where . Define H = (h1, h2,…,h)T = g·g, for k ∈ [1, m], we have that , so it doesn’t have z = a.

(3) It sets ω*′ = ω* − {θ}, randomly chooses two polynomials f0(x) and f1(x) of degree m and computes two polynomials as follows:

For i ∈ [0, m], let c0, and c1, be the ith term of f0(x) and f1(x), d0, and d1, be the ith term of u0(x) and u1(x). defines and ,at the same time, simulates {t0,, t1,} where

Finally, gives the public parameters to .

Phase 1. Let M be a p×l matrix, ω*′ doesn’t satisfy the access structure (M, ρ). If ID ∈ R, there is ω*′ = ω* − {θ}; otherwise, ω*′ = ω*. The simulator generates the secret key sk as follows.

(1) When ID ∉ R (in this case, we have ω*′ = ω*), and ω*′doesn’t satisfy the access structure, first defines where π1 = 1 We have M· = 0 for each i when ρ(i) ∈ ω*. Then the simulator defines two vectors η0 = (r, η0,2,…,η0,)T and η1 = (0, η1,2,…,η1,)T, and defines that u0 = α1 η0 + απ and u1 = η1 + απ, we can compute the first term of u0 and u1 are α + rα1 and α.

i. When ρ(i) ∈ ω*, computes that and randomly chooses r, r ∈ Z and computes that ii. When ρ(i) ∉ ω*, computes that and randomly chooses , and sets and , then Then computes that D3 = g, .

(2) When and sets . The simulator randomly chooses r′ ∈ Z and sets r = r′ − a. Defines A = B · Z+δ, the first term of A is , and computes that randomly chooses and defines η = (α + rα1, η2, …, η)T, and for i ∈ [1, p], sets M = (x, x, …, x), then computes randomly chooses r ∈ Z, then As ω*′ does not satisfy the access structure, the simulation of and are the same as the previous case. For {K}, the simulator can computes by .

Challenge. The adversary submits two messages m0 and m1, randomly chooses m where b ∈{0,1} to encrypt. Then computes

Then the simulator defines Y = (y1, ⋯, y)T according to the revocation list and = 0 for k ∈[1,m]. And we have that where γ1 = (y2, ⋯, y)T, then and computes

Then sends the challenge ciphertext ct* = (C, C1, C2,0, C2,1, C3) to the adversary . If μ = 0, then Z = e(g1, g), the challenge ciphertext ct* is a valid random encryption of message m. If μ = 1, then Z is a random element of G2, and ct*is also random from the adversary’s view, and ct* contains no information of m.

Phase2. Same as Phase1.

Guess. The adversary outputs the guess b′ of b. outputs μ = 0 to guess that Z = e(g1, g) if b′ = b; otherwise, outputs μ = 1, and it indicates that Z is a random element in G2. And the advantage of simulator to solve the q-BDHE problem is

IND-CKA security proof

Theorem 2. Suppose there exists a polynomial-time adversary , which can attack our scheme with advantage ε in the IND-CKA model. We can construct a simulator that can solve the DDH problem in G1 with probability at lest , where e is constant, and we assume the adversary makes M index queries and T search token queries(it contains N1 keywords) in each phase[10].

Proof: is given an instance g, g, g, g of the DDH problem in G1. In the following parts, we construct the cipher text by setting δ = b. The simulation proceeds as follows:

Init. The adversary selects a attribute set ω* and a user revocation list of θ ∈ ω*. is given an instance g, g, g, g of the DDH problem in G1. Then runs the algorithm to generate the public parameter pp and sends it to adversary .

Phase1. maintains a hash list L = {w, α, l} and randomly chooses α ∈ Z for keywords w with biased coin flip l. The list is empty when begins and simulates the hash function as a random oracle. And if the random oracle is queried for a hash of w, searches the hush list L if the w exists in the list.

If l = 0,the gives that ;

If l = 1,the algorithm aborts;

If the keyword w does not exist in the list, the flips a random coin l ∈ {0,1} so that Pr[coin′ = 0] = σ and σ will be calculated later.

If l = 0, the randomly chooses α ∈ Z,and adds < w, α, 0 > to the hush list;

If l = 1, the adds < w, ⊥, 1 > to the hush list.

The repeat the above process.

Keywords index query. If the adversary asks the keyword w of index information, searches the hush list L. If l = 1, aborts; and if l = 0, randomly chooses t ∈ Z, let and generates that

Search token query. If the adversary asks the keyword of searching token with the access structure (M, ρ), Let M be a p×l matrix, ω*′doesn’t satisfy the access structure (M, ρ). If , there is ω*′ = ω* − {θ}; otherwise, ω*′ = ω*. searches the hush list L. If , aborts; and if ,let . For i = 1 to l, randomly choose ξ ∈ Z and generates that

Challenge. The adversary outputs two keywords and , randomly chooses b ∈ {0,1} and searches the hush list L that . If l = 0, aborts; if l = 1, let and computes

Phase2. Same as Phase1.

Guess. The adversary outputs the guess b′ of b, outputs g = g if b′ = b; otherwise g is a random group element in G1.

Correctness Analyses. In the above simulation scheme, if the adversary has the advantage of attack our scheme, and then it will be given the keyword w of hush value is H(w) = g rather than the random value H(w) = g. Then it can compute that I1 = gH(w) = g(g), that is I1 = gg = gg, and computes that g = g which means it solves the DDH problem.

Probability Analyses. Suppose that the adversary makes M index queries and T search token queries in each phase, and the probability that will not be terminated in two query phases 1 and 2 is , so the probability that it will not terminated during the challenge step is 1 − σ, so that results in an overall probability that does not abort is . And, through the computes that the maximum is , so the maximum probability is . Thus, if our scheme can be attacked by the adversary with the advantage ε, and the can resolve the DDH problem with advantage .

In this section, we give some performance analysis in our scheme. The hardware runtime environment is Intel Core i5-3470 CPU @ 3.20GHz, and RAM is 4.00GB. The software runtime environment is JDK 1.7.5, JPBC 2.0.0 and MyEclipse10.

Our scheme is compared with the schemes of [21, 24, 26, 27, 28] in Table 1.

Table 1

Performance analyses.

Scheme	Fine-grained	Attribute revocation	Keyword search	Do not update cipher-text when attribute revocation
[26]	×	×	×	×
[21]	×	×	√	×
[24]	√	√	×	√
[27]	×	×	×	_
[28]	×	×	×	_
Our scheme	√	√	√	√

Our scheme is also compared with the schemes of [26, 27, 28] in Table 2.

Table 2

Calculation analyses.

Scheme	KeyGen	Encryption	Pairings in Decryption
[26]	(2 + 2l)ex	(3 + | S |)ex	2 + 2| I |
[27]	3lex	(2 + | S |)ex	1 + 3| I |
[28]	2lex	(6 + | S |)ex	1 + 2| I |
Our scheme	(2 + 4l)ex	(3 + 2 | S |)ex	1 + 2| I |

| S |: The size of the attributes set of a decryption key.

l: The number of rows of the matrix in access policy(M,ρ).

ex: An exponentiation operation.

| I |: The number of attributes for a decryption key to satisfy a cipher-text policy.

We can see from Table 2, our scheme has a large amount of computation in the KenGen and Encryption generation, because our scheme doesn’t need to update the cipher-text and secret key when attributes revocation. However, the schemes of [26], [27] and [28] don’t achieve the function of attribute revocation.

As is shown in the Fig 2, we suppose that there are 16 attributes in the policy and provide the relational graphs of keywords index building time as is shown in Fig 2(a) and search token building time as is shown in Fig 2(b). From the Fig 2(a) and 2(b), we can see that the time cost is nearly linear with the index building and token building. In the Fig 2(c), we give the relational graph of the number of attributes in the policy and time cost. As is shown in the Fig 2(c), we can find that the effect of the increase of the attributes on the time is not particularly evident in our scheme which takes less time than Zhiquan’s[29].

Fig 2

(a) Index building time (b) Token building time (c) The number of attributes in policy and index building time

Conclusions

In our scheme, we add the keyword search based on the attribute revocation, the search tokens generated by the attribute authority and the user. The cloud server match is divided into two cases: the user is in the revocation list and not in the revocation list, and the cloud server uses the different test according to the different case. It will return the cipher text when the attribute set meets the access structure and the search keywords exist, and the user can decrypt correctly. This scheme supports multiple keywords search at the same time which makes more flexible in the practical application.

(RAR)

Click here for additional data file.