Efficient Authenticated Fine-Grained Access Engine for Encrypted Data in Mobile Edge Cloud

Abstract

Fine-grained, authenticated, traceable, and efficient encrypted access control is indispensable for secure data sharing in mobile edge cloud networks, especially for resource-constrained data requesters. Despite the prevalence of outsourced ciphertext-policy attribute-based encryption (CP-ABE) solutions, existing schemes still suffer from critical practical limitations. First, requester-side transformation keys are typically unverified prior to computationally expensive outsourced decryption operations. Second, commitment-based verification mechanisms fail to validate the identity of data publishers. Third, the online computational overhead scales linearly with either the requester attribute set or the policy-matching set, severely degrading practical efficiency. To address these issues, this paper proposes ePoFSC, a novel policy-oriented functional signcryption scheme for authenticated encrypted data sharing in mobile edge cloud scenarios. The proposed ePoFSC scheme integrates pre-auditing and caching mechanisms for requester trapdoors before online access requests, enabling constant-time operations for request generation, request verification, and request header construction independent of requester attribute scale. In the outsourced decryption phase, ePoFSC offloads all costly pairing and exponentiation operations with constant computational complexity, leaving only lightweight policy-dependent group multiplications for terminal requesters. Furthermore, ePoFSC tightly couples decryption verification with publisher authentication and requester traceability to realize comprehensive access accountability. Rigorous security analysis formally validates the confidentiality, publisher-side unforgeability, and requester traceability of the proposed scheme. Extensive experimental evaluations on the BLS12-381 curve verify that ePoFSC achieves prominent performance superiority over existing state-of-the-art schemes in both the encryption and data recovery phases.

1. Introduction

Cloud-edge collaborative infrastructures have been extensively deployed for governmental, enterprise, medical, and personal data management, supporting reliable storage, efficient indexing, and scalable sharing of exponentially growing data volumes. In mobile edge cloud (MEC) scenarios, data publishers can upload data once for asynchronous access by proximal end requesters, as illustrated in Figure 1. This paradigm significantly enhances service availability and response latency for mobile users, yet it inherently pushes sensitive data beyond the exclusive security perimeter of data owners, thus introducing substantial privacy and security risks.

After data outsourcing, data ownership, access privileges, and usage permissions are no longer governed within a fully trusted domain. Cloud platforms and edge nodes are generally honest-but-curious in practice; they may be compromised, overloaded by malicious request floods, or forced to process malformed cryptographic inputs. Therefore, secure encrypted data sharing cannot rely on the inherent trust of intermediate network nodes. A practical MEC-oriented sharing system must guarantee comprehensive security and performance, including end-to-end data confidentiality, fine-grained access authorization, verifiable data origin, requester accountability, and efficient lightweight request processing at the edge.

Local encryption prior to cloud upload serves as a fundamental security countermeasure. However, conventional public-key encryption only supports coarse-grained one-to-one or one-to-many data distribution. In such schemes, publishers either share universal decryption keys with authorized users or generate independent ciphertext copies for different user groups. This “one-data, multiple-encryptions” pattern yields communication and storage overhead that scales linearly with the number of users, rendering it unsuitable for large-scale and dynamically evolving mobile edge cloud systems.

Ciphertext-policy attribute-based encryption (CP-ABE) [1,2,3] alleviates this scalability limitation by embedding customizable access policies f into ciphertexts and issuing attribute-specific decryption keys that match requesters’ permission sets ${\mathsf{S}}_{\delta }$. A requester can successfully decrypt a ciphertext if and only if their attribute set satisfies the predefined access policy. As shown in Figure 2, CP-ABE enables one-time encryption with policy-level access control, allowing a single ciphertext to be securely shared among multiple authorized requesters.

Nevertheless, native CP-ABE decryption involves heavy pairing and exponentiation operations, which impose excessive computational overhead on resource-constrained mobile and IoT devices. Outsourced-decryption CP-ABE (OD-CP-ABE) schemes [4,5,6] reduce terminal-side computation by delegating complex cryptographic operations to edge proxies, which transform original ciphertexts into lightweight partially decrypted counterparts. Despite such performance improvements, existing OD-CP-ABE solutions still exhibit three critical practical defects for mobile edge cloud deployment.

First, most existing OD-CP-ABE schemes skip the validation of transformation keys prior to outsourced decryption. Malicious requesters can submit forged or malformed transformation keys to trigger redundant, expensive pairing computations on edge nodes. This vulnerability exposes edge infrastructures to resource exhaustion attacks, request flooding, and targeted denial-of-service (DoS) threats.

Second, existing verifiable outsourced decryption schemes primarily adopt message commitment-based verification [5,7]. Although such commitments validate the consistency of recovered plaintexts, they cannot authenticate the legitimate identity of data publishers. More importantly, commitment regeneration and public-key-only forgery vulnerabilities allow adversaries to forge valid verification materials and counterfeit data, which can pass standard verification procedures and deceive requesters.

Third, the online overhead of state-of-the-art OD-CP-ABE schemes scales linearly with the requester attribute set or policy-matching set size. Specifically, request generation and verification incur $O\left(\right|{\mathsf{S}}_{dr}\left|\right)$ computational cost, while outsourced decryption requires $O\left(\right|I\left|\right)$ pairing and exponentiation operations. Such linear overhead severely degrades the performance of latency-sensitive edge services, especially under complex access policies and frequent, repeated mobile access requests.

To address the aforementioned limitations, this paper proposes ePoFSC, a policy-oriented functional signcryption scheme that enables authenticated and fine-grained encrypted data sharing for open cloud-edge environments. Unlike conventional OD-CP-ABE schemes that merely optimize terminal decryption after request approval, ePoFSC realizes full-process security optimization: it validates request legitimacy before executing costly outsourced decryption, tightly couples data verification with publisher traceability, and offloads repetitive requester-dependent computations to an audited trapdoor caching module.

The main contributions of this paper are summarized as follows.

• This work constructs a novel policy-oriented functional signcryption scheme ePoFSC for secure edge-cloud data sharing. Unlike traditional CP-ABE designs that append independent commitments or signatures after encryption, ePoFSC leverages signcryption to simultaneously enforce policy-based data encryption, legitimate publisher binding, and standardized requester-side verification. This integrated design effectively addresses the inherent deficiencies of commitment-based schemes in publisher authentication and anti-forgery capability against commitment regeneration and public-key-only forgery attacks.
• This paper introduces a pre-online trapdoor auditing and caching mechanism. Edge nodes first validate the legitimacy of requester trapdoors generated from authorized credentials and cache verified trapdoors for repeated access. This pre-processing eliminates attribute-dependent transformation materials in online requests, enabling constant-time complexity for $\mathsf{ReqGen}$, $\mathsf{ReqVfy}$, and request header construction independent of $|{\mathsf{S}}_{dr}|$. Experimental results show that, with $|{\mathsf{S}}_{dr}|=30$, ePoFSC reduces requester package size by 83.19%, 88.09%, 74.41%, and 74.06% and cuts request-generation RAM consumption by 84.97%, 89.65%, 75.24%, and 75.73%, compared with CfpComOD-WatersCPABE, CfpComOD-RWCPABE, AOD-MACPABE, and FTV-AOD-DR-CP-ABE, respectively.
• ePoFSC optimizes outsourced decryption by internalizing pairing exponent operations, achieving constant computational complexity for all expensive pairing and exponentiation operations in the $\mathsf{ODec}$ phase. Only lightweight policy-dependent ${\mathsf{M}}_1$ group multiplications are retained, which fundamentally differentiates ePoFSC from baseline OD-CP-ABE schemes that require policy-scalable heavy cryptographic operations on edge proxies. Evaluations on 30 ciphertext retrieval tasks show that ePoFSC reduces end-to-end retrieval latency over several state-of-the-art methods, achieving comprehensive performance superiority in both the encryption and data recovery phases.
• A novel number-th encoding method is adopted to support repeated reuse of policy nodes, which removes the single-use constraint of traditional access policy designs while preserving unique hash preimages for each control point. Combined with disk-persistent secondary encryption and a dynamic revocation list, the proposed scheme prevents unauthorized permission bypassing and illegal usage of leaked, expired, or revoked authorization credentials.
• We formally prove the security of ePoFSC under sIND-uCI-RCCA, Pu-SUF-aCMA, and Id-SUF-aCMA security models, which formally validate the scheme’s data confidentiality, publisher-side unforgeability, and requester traceability. Extensive experiments on the BLS12-381 curve and practical evaluations on a medical-image sharing dataset containing 36,961 dermoscopic images further verify that ePoFSC achieves lightweight request processing and outsourced decryption, with superior performance in request size, memory overhead, and end-to-end latency compared with state-of-the-art schemes.

Organization. The remainder of this paper is organized as follows. Section 2 reviews related studies on CP-ABE, outsourced decryption, and verifiable data sharing. Section 3 introduces the cryptographic preliminaries used throughout the paper. Section 4 presents the system model, security definitions, concrete construction, and workflow of ePoFSC. Section 5 provides the formal security theorems and reductions. Section 6 reports the theoretical comparison, simulation results, and real-scenario evaluation. Finally, Section 7 concludes this paper.

2. Related Works

Ciphertext-policy attribute-based encryption (CP-ABE) enables data owners to enforce fine-grained access control over individual ciphertexts by specifying access policies in the form of logical predicates. Only requesters whose attribute sets satisfy the embedded policy are eligible for decryption, thereby supporting one-time encryption and scalable multi-user data sharing. Bethencourt et al. constructed the first practical access-tree-based CP-ABE scheme [8]. Waters subsequently proposed a linear secret sharing scheme (LSSS)-based CP-ABE scheme with provable security under q-type bilinear map assumptions [1]. Rouselakis and Waters achieved standard-model security without random oracles, further strengthening the theoretical security foundation of CP-ABE [9]. Chen et al. introduced dual-system cryptographic techniques over prime-order groups, transferring adaptive security proofs from composite-order groups to more efficient prime-order implementations [2]. Following this line of research, Agrawal and Chase developed the FAME framework, which supports efficient adaptive security for both CP-ABE and key-policy ABE (KP-ABE) in large attribute domains [10]. Nevertheless, most existing CP-ABE schemes adopt a one-use attribute restriction, where each attribute can appear only once in a single access policy, which considerably limits policy flexibility and expressiveness. To accommodate practical application requirements, recent studies have integrated CP-ABE with emerging technologies. Chen et al. combined CP-ABE, authorization tokens, and blockchain to realize flexible access control for electronic health record (EHR) systems in smart healthcare scenarios [11]. Liu et al. proposed the FACOS framework, a hybrid blockchain-CP-ABE solution that leverages permissioned ledgers to mitigate the scalability and privacy limitations of traditional blockchain-based data sharing [12].

To reduce the heavy decryption overhead of native CP-ABE on resource-constrained mobile and IoT devices, Green et al. proposed the first outsourced-decryption CP-ABE (OD-CP-ABE) paradigm, which offloads computationally intensive cryptographic operations from end users to cloud proxies [4]. However, outsourcing decryption introduces a new security challenge regarding the correctness of proxy-aided partial decryption. To address this issue, subsequent verifiable OD-CP-ABE schemes integrate message commitment mechanisms to enable end users to validate partially decrypted ciphertexts (PDCs) returned by cloud servers [5,13]. In these designs, data owners generate and attach cryptographic commitments during encryption, and requesters verify data integrity by checking the corresponding commitments after decryption. Despite such integrity guarantees, existing commitment-based verifiable OD-CP-ABE schemes suffer from inherent security flaws. Since valid commitments can be generated solely from public plaintext information and public parameters, untrusted proxies or malicious adversaries can forge valid data–commitment pairs. Specifically, adversaries can execute ${\mathsf{Enc}}_f(\mathsf{PP},f,m_{\mathcal{A}}\left|\right|r^{\prime })\to {\mathsf{CT}}_{\mathrm{f},\mathcal{A}}$ and $\mathsf{Commit}(m_{\mathcal{A}},r^{\prime })\to c_{\mathcal{A}}$ to construct counterfeit ciphertexts and matching commitments, as illustrated in Figure 3. In this case, requesters cannot distinguish legitimate data–commitment pairs from forged ones, and these schemes fail to provide reliable publisher authentication and identity traceability.

Hahn et al. [14] pointed out that the vulnerability to ciphertext and commitment regeneration attacks stems from the inherent weakness of conventional commitment mechanisms, where valid commitments can be produced using only public parameters without any private information from data publishers. To mitigate this threat, they proposed private-key-driven commitment generation mechanisms [14,15] so that only legitimate publishers holding valid private keys can generate authentic commitments. Nevertheless, such private-key-dependent commitment schemes are still vulnerable to public-key-based commitment forgery attacks [16]. As demonstrated in Figure 4, an adversary can forge valid commitments for arbitrary messages by executing $\mathsf{CommitForge}(m_{\mathcal{A}},r^{\prime },{\mathsf{PK}}_i,\mathsf{PP})\to c_{\mathcal{A}}$. This forgery only requires the publisher’s public key ${\mathsf{PK}}_i$ and public system parameters, while the adversary has no access to the publisher’s private key ${\mathsf{sk}}_i$.

Specifically, for the HKH-2018 scheme [14], the system public key is defined as $\mathsf{PK}=h^{\gamma },h_l,{\mathsf{BP}}_{\mathrm{III}}$ and the master secret key is $\mathsf{mk}=\gamma$. For a randomly selected $x{\leftarrow }_R{\mathbb{Z}}_p^{*}$, the commitment secret key for each user is issued as ${\mathrm{ComKey}}_i=(g^{{\displaystyle \frac{1}{\gamma +x}}},x)$. Given a message m, the commitment signature is constructed as ${\sigma }_i\left(m\right)=(A=g^{{\displaystyle \frac{x}{\gamma +x}}},B=h^{\gamma }{h}^x,C=h_l(e{(g,h)}^x,m))$. During verification, the validity of the commitment is confirmed by checking whether $C\stackrel{?}{=}{h}_l(e(A,B),m)$. However, adversaries can forge valid commitment signatures ${\sigma }_i^{\prime }\left(m^{\prime }\right)=(A^{\prime },B^{\prime },C^{\prime })$ that follow the identical distribution of genuine signatures. The forgery procedure is straightforward: the adversary randomly selects $r,x^{\prime }{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and computes forged parameters $A^{\prime }=g^r\simeq A=g^{{\displaystyle \frac{x}{\gamma +x}}}$, $B^{\prime }=h^{\gamma }{h}^{x^{\prime }}\simeq B=h^{\gamma }{h}^x$, and $C^{\prime }=h_l(e{(g,h)}^{r(\gamma +x^{\prime })},m^{\prime })\simeq C=h_l(e{(g,h)}^x,m)$, thereby constructing fully valid yet counterfeit commitment signatures for arbitrary messages.

Similarly, the Hahn-Kim-2022 scheme [15] suffers from the same forgery defect. In this scheme, the system public key is $\mathsf{PK}=h^{\gamma },h_l,{\mathsf{BP}}_{\mathrm{III}}$ and the master secret key is $\mathsf{mk}=\gamma$. For a randomly sampled $x{\leftarrow }_R{\mathbb{Z}}_p^{*}$, each committer i holds a commitment secret key ${\mathrm{ComKey}}_i=(g^{{\displaystyle \frac{1}{\gamma +u_i}}},u_i)$ paired with a public commitment key $P{K}_i=h^{u_i}$. To generate a valid commitment for message m, the committer randomly selects $r{\leftarrow }_R{\mathbb{Z}}_p^{*}$, computes $A=g^{{\displaystyle \frac{u_{i}r}{\gamma +u_i}}}$, and outputs the commitment ${\sigma }_i\left(m\right)=(C=h_l(D,m|\left|A\right),P{K}_i=h^{u_i},D=e{(g,P{K}_i)}^r)$. The verification procedure validates two conditions: $e(A,h^{\gamma }·P{K}_i)\stackrel{?}{=}D$ and $h_l(D,m|\left|A\right)\stackrel{?}{=}C$. Even without accessing the target user’s private key, adversaries can forge distributionally identical commitments traced to ${\mathsf{PK}}_i$. By randomly choosing $r^{\prime }{\leftarrow }_R{\mathbb{Z}}_p^{*}$, the adversary computes $A^{\prime }=g^{r^{\prime }}\simeq A=g^{{\displaystyle \frac{r{u}_i}{\gamma +u_i}}}$, $D^{\prime }=e(A^{\prime },h^{\gamma }·P{K}_i)=e{(g,h)}^{r^{\prime }(\gamma +u_i)}\simeq D=e{(g,h)}^{u_{i}r}$, and $C^{\prime }=h_l(e(A^{\prime },h^{\gamma }·P{K}_i),m^{\prime }\left|\right|A^{\prime })=h_l(e{(g,h)}^{r^{\prime }(\gamma +u_i)},m^{\prime }\left|\right|A^{\prime })\simeq C=h_l(e{(g,h)}^{u_{i}r},m\left|\right|A)$, which passes all legitimate verification checks.

Recent research has further advanced CP-ABE and lightweight key generation techniques to adapt to resource-constrained edge and IoT scenarios [17,18]. Yu et al. [19] designed a privacy-preserving friend-matching scheme for mobile social networks, which encodes user preferences as access policies and adopts outsourced decryption to reduce mobile-side computation overhead. Li et al. [20] developed a blockchain- and IPFS-assisted medical data sharing framework, leveraging outsourced decryption to alleviate terminal computational burden. Feng et al. [21] proposed a lattice-based attribute-based signcryption framework with blockchain-enabled instant revocation and RLWE-based post-quantum security. Pioro et al. [22] empirically compared pairing-based CP-ABE and post-quantum Covercrypt in typical IoT deployment scenarios, analyzing their respective tradeoffs in scalability, ciphertext overhead, and edge adaptability.

Despite these fruitful advancements in optimized and application-oriented ABE systems, existing studies pay insufficient attention to the pre-verification of transformation keys prior to outsourced decryption. In current OD-CP-ABE paradigms, proxy and cloud servers only verify whether a requester’s attributes satisfy the predefined access policy, but cannot validate whether the submitted transformation key is honestly generated from legitimate attribute secret materials. Accordingly, malicious or unauthorized requesters can submit malformed or forged transformation keys to trigger redundant, expensive pairing operations at the proxy side. This leads to invalid partial decryption results, excessive resource waste, and potential edge service disruption. Such unresolved vulnerabilities strongly motivate the design of verifiable transformation key generation and pre-audit validation mechanisms for robust and secure outsourced CP-ABE systems.

Table 1. Feature comparison.

Scheme	$\mathsf{BP}$	Multi-Use	$\mathsf{ODec}$	Request Verify	Trapdoor Cache	Data Verify	Publisher Tracing	Revoke
[13]	${\mathsf{BP}}_{\mathrm{I}}$	✔	✔	✘	✘	✔	✘	✘
[23]	${\mathsf{BP}}_{\mathrm{III}}$	✔	✔	✔	✘	✔	✘	✘
[16] (Water)	${\mathsf{BP}}_{\mathrm{III}}$	✔	✔	✘	✘	✔	✔	✘
[16] (RW)	${\mathsf{BP}}_{\mathrm{III}}$	✔	✔	✘	✘	✔	✔	✘
[10]	${\mathsf{BP}}_{\mathrm{III}}$	✘	✘	✘	✘	✘	✘	✘
[24]	${\mathsf{BP}}_{\mathrm{III}}$	✔	✔	✔	✘	✔	✔	✔
[19]	${\mathsf{BP}}_{\mathrm{I}}$	✔	✔	✘	✘	✔	✘	✘
[20]	${\mathsf{BP}}_{\mathrm{III}}$	✘	✔	✘	✘	✘	✘	✔
ePoFSC (This work)	${\mathsf{BP}}_{\mathrm{III}}$	✔	✔	✔	✔	✔	✔	✔

provides a comprehensive functional comparison between the proposed ePoFSC scheme and state-of-the-art CP-ABE/OD-CP-ABE schemes. The comparison demonstrates that existing schemes suffer from diverse practical limitations for mobile edge cloud deployment. CP-FAME [10] achieves efficient basic cryptographic operations but lacks outsourced decryption, request verification, data verification, publisher tracing, and revocation capabilities. CfpComOD-WatersCPABE and CfpComOD-RWCPABE [16] support publisher tracing but cannot authenticate online access requests or cache validated trapdoors. AOD-MACPABE [23] enables request verification while lacking publisher tracing and revocation functions. FTV-AOD-DR-CP-ABE [24] provides relatively comprehensive functionalities but still relies on requester-dependent online auditing without trapdoor caching, leading to non-negligible online overhead. In contrast, ePoFSC uniquely integrates multi-use policy points, outsourced decryption, online request verification, trapdoor caching, data verification, publisher tracing, and user revocation in a unified framework. This full-spectrum functionality is particularly critical for mobile edge cloud scenarios as it enables edge nodes to filter invalid access requests prior to costly outsourced decryption and allows requesters to simultaneously validate data correctness and publisher legitimacy.

3. Preliminaries

3.1. Bilinear Pairing

Define a cryptographic operation $e:\mathbb{G}\times \mathbb{H}\to {\mathbb{G}}_T$ as a bilinear pairing if (1) $\forall x,y\in {\mathbb{Z}}_p^{*}$, $e(g^x,h^y)=e{(g,h)}^{xy}$; (2) $e(g,h)\ne 1$ and $e(g^x,h^y)=1$ iff $x=0$ or $y=0$, where $\mathbb{G},\mathbb{H},{\mathbb{G}}_T$ are three efficiently computable cyclic groups with the same prime order p. “↦” means “a generator of”. $g\mapsto \mathbb{G}$, $h\mapsto \mathbb{H}$, and $e(g,h)\mapsto {\mathbb{G}}_T$. The bilinear pairing tuple $\mathsf{BP}=(\mathbb{G},\mathbb{H},g,h,p,e:\mathbb{G}\times \mathbb{H}\to {\mathbb{G}}_T)$ has two broad types:

• ${\mathsf{BP}}_I$ (Symmetric): $\mathbb{G}=\mathbb{H}=G_I,{\mathbb{G}}_T={\left(G_T\right)}_I$.
• ${\mathsf{BP}}_{\mathrm{III}}$ (Asymmetric): $\mathbb{G}\ne \mathbb{H}$, and $\mathbb{G}\nleftrightarrow \mathbb{H}$.

According to the literature [25,26], ${\mathsf{BP}}_{\mathrm{III}}$ can achieve a better security level and higher efficiency than ${\mathsf{BP}}_I$.

3.2. Monotone Boolean Formula for Access Control

A monotone boolean formula $\mathsf{AND}$-$\mathsf{OR}$-$f_{\mathrm{BF}}$ is a boolean circuit whose all gates are $\mathsf{AND}$ or $\mathsf{OR}$. The monotonicity of the access control captures the fact that if a point set A satisfies the monotone Boolean formula $\mathbb{P}$, $A\vDash \mathbb{P}$, then the point set B with A as a subset, $A\subseteq B$, also satisfies the monotone Boolean formula $B\vDash \mathbb{P}$.

A monotone Boolean formula can be expressed as a monotone span program (MSP) (also called a monotone linear secret sharing scheme (MonLSSS) [27]).

For a monotone Boolean formula ∏ over the point universe $\mathcal{U}$, there is a specified policy matrix ${\mathbf{M}}_{l\times n}$ with l rows and n columns that corresponds to ∏. The map function $\rho$ maps one row index $i\in [1,l]$ of ${\mathbf{M}}_{l\times n}$ to a point $p_i\in \mathcal{U}$, namely $\rho \left(i\right)\to p_i$. $\mathbb{A}=({\mathbf{M}}_{l\times n},\rho )$ is called an MSP. The LW-Compiler [28] can convert any monotone ∏ to a $\{0,1\}$-MSP with all the matrix elements $M_{i,j}\in \{-1,0,1\}$, and the reconstruction coefficients are always binary ${\omega }_i\in \{0,1\}$.

According to [27], an MSP must satisfy the linear reconstruction requirement. For each authorized attributes set $\mathsf{S}$ of MSP policy $\mathbb{A}=({\mathbf{M}}_{l\times n},\rho )$, define a row index set $I=\left\{i\right|\rho \left(i\right)\in \mathsf{S}\}\subset \{1,2,\dots ,l\}$, some constants ${\left\{{\omega }_i\right\}}_{i\in I}$ can be found to satisfy:

$$\begin{array}{c}\hfill \sum _{i\in I}{\omega }_i{\mathbf{M}}_{\mathbf{i}}=\begin{array}{c}n\\ \overbrace{(1,0,\dots ,0)}\end{array}\end{array}$$

where ${\mathbf{M}}_{\mathbf{i}}$ denotes the row i in ${\mathbf{M}}_{l\times n}$: The compiler of boolean formula $\left((A\wedge B)\wedge (C\vee D)\right)\vee \left((D\vee F)\wedge (G\wedge E)\right)$ is:

$$\begin{array}{c}\hfill \left(\begin{array}{cccccc}1& 1& 1& 0& 0& \mathrm{A}\\ 0& 0& -1& 0& 0& \mathrm{B}\\ 0& -1& 0& 0& 0& \mathrm{C}\\ 0& -1& 0& 0& 0& \mathrm{D}\\ 1& 0& 0& 1& 0& \mathrm{D}\\ 1& 0& 0& 1& 0& \mathrm{F}\\ 0& 0& 0& -1& 1& \mathrm{G}\\ 0& 0& 0& 0& -1& \mathrm{E}\end{array}\right)\end{array}$$

For the secret-reconstruction point set $\{\mathrm{A},\mathrm{B},\mathrm{C}\}$, the secret-reconstruction coefficients are

$$\begin{array}{cc}\hfill & {\omega }_1=1\left(\mathrm{A}\right),{\omega }_2=1\left(\mathrm{B}\right),{\omega }_3=1\left(\mathrm{C}\right)\hfill \\ \hfill & {\omega }_1(1,1,1,0,0)+{\omega }_2(0,0,-1,0,0)+{\omega }_3(0,-1,0,0,0)=(1,0,0,0,0)\hfill \end{array}$$

4. Scheme Definition and Construction

4.1. Participant and Threat Model

The proposed cloud-edge data sharing framework based on ePoFSC involves five core participants with distinct functional responsibilities and security boundaries. The detailed role definitions, operational functions, and threat models of each participant are elaborated as follows, and the overall system architecture is illustrated in Figure 5.

• Trusted Authority (TA). The TA serves as the root trusted entity of the entire system. It is responsible for initializing global cryptographic parameters, preserving the system master secret, distributing fine-grained permission decryption keys for data requesters (DRs), and maintaining and updating the key revocation list. In this work, the TA is assumed to be fully trustworthy and immune to adversarial corruption. Its core security obligations include strictly preserving the confidentiality of the master secret key ${\mathsf{mk}}_g$, binding each issued user key to a legitimate attribute permission set, and reliably publishing real-time revocation information to support permission management.
• Data Publisher (DP). The DP acts as the legitimate data owner and data source for outsourced sharing. It generates personalized publisher key pairs, formulates dedicated access policies for individual data objects, executes policy-aware functional signcryption operations, and uploads authenticable encrypted ciphertexts to the cloud-enabled data space. The DP is trusted in terms of the authenticity and correctness of its own published data. Nevertheless, the public identity of the DP must be rigorously verified by DRs during local unsigncryption. The primary security threats targeting the DP include ciphertext forgery and verification component tampering. The proposed scheme is required to guarantee rigorous data source authenticity and unforgeability to defend against malicious source substitution attacks.
• Cloud-enabled Data Space (CeDS). The CeDS provides persistent and structured encrypted data storage and indexing services for cloud-edge sharing scenarios. It undertakes core tasks including unique ciphertext identifier allocation, secure storage of main ciphertexts and protected control ciphertexts, maintenance of global ciphertext index tables, synchronous updating of encrypted metadata to edge nodes, and response to valid data retrieval requests from edge handler nodes (EHNs). The CeDS follows the widely adopted honest-but-curious threat model. It strictly complies with predefined system workflows for data storage and metadata synchronization but may attempt to infer sensitive information, including plaintext content, embedded access policies, requester identities, and permission privileges, from stored ciphertexts and historical access records. Therefore, the designed scheme must prevent the CeDS from acquiring any recoverable plaintext information or valid decryption credentials.
• Edge Handler Nodes (EHNs). EHNs are regional edge service nodes deployed in proximity to end DRs, undertaking major request processing and outsourced decryption tasks. Their core functionalities cover encrypted control ciphertext caching, verified trapdoor storage, request legitimacy and freshness verification, revocation status checking, local control ciphertext activation, outsourced partial decryption execution, and return of partial decryption headers and encrypted payloads to authorized DRs. EHNs are modeled as semi-trusted and honest-but-curious entities. Although they correctly execute prescribed cryptographic algorithms, they may attempt to extract sensitive information from cached trapdoors, request proofs, access policies, and intermediate decryption results. In addition, EHNs are directly exposed to various network threats, including forged access requests, replay attacks, request flooding, and malformed trapdoor injection attacks.
• Data Requester (DR). DRs are resource-constrained mobile or edge end users who obtain fine-grained attribute decryption keys from the TA based on their legitimate access permissions. A valid DR generates standard access request proofs, completes auditable outsourced trapdoor registration, submits data access requests to nearby EHNs, and performs local final unsigncryption and integrity verification. Unlike the fully trusted TA, DRs are untrusted and classified into multiple states, including honest, expired, revoked, compromised, and unauthorized users. Malicious DRs can launch multiple adversarial behaviors, such as forging request proofs, replaying historical valid requests, colluding with semi-trusted edge/cloud nodes, leaking private transformation keys, and injecting malformed trapdoors to exhaust edge computing resources. Accordingly, the ePoFSC scheme integrates requester identity authentication, timestamp-based request freshness validation, rigorous trapdoor auditing, and dynamic key revocation mechanisms to address the above threats.

4.2. Syntax Definition

The notations used in the ePoFSC syntax and construction are summarized in

Table 2. Notation summary.

Notations	Definition
$\begin{array}{c}{h}_l:{\{0,1\}}^{*}\to {\{0,1\}}^l\hfill \\ h_z:{\{0,1\}}^{*}\to {\mathbb{Z}}_p^{*}\hfill \\ {\mathsf{H}}_1:{\{0,1\}}^{*}\to {\mathbb{G}}_1\hfill \end{array}$	Cryptographic collision-resistant hash functions
$\begin{array}{c}\hfill \mathsf{CT}=\mathsf{SE}.\mathsf{Enc}({\mathcal{K}}^l,m),\\ \hfill m=\mathsf{SE}.\mathsf{Dec}({\mathcal{K}}^l,\mathsf{CT})\end{array}$	A pseudorandom permutation (PRP) based symmetric encryption.
$({\mathsf{mk}}_g,{\mathsf{PP}}_g)$	Cryptographic master key and corresponding public parameters
$({\mathsf{sk}}_{dp},{\mathsf{PK}}_{dp})$	Key pair of DP
${\mathsf{S}}_{dr}$	Discrete permission set of DR
${\mathsf{dk}}_{dr}$	Fine-grained decryption key
${\mathbb{A}}_f=({\mathbf{M}}_{l\times n},\rho )$	MSP-encoding access boolean formula
${\mathsf{CT}}_{\sigma }\triangleq (C_m,C_{\mathrm{ctl}},{\sigma }_m)$	Predicate-encoding signcryption ciphertext, where $C_m$ is the symmetric encrypted data payload, $C_{\mathrm{ctl}}$ is the policy-embedded controllable ciphertext, ${\sigma }_m$ is the data proof.
$C_{\mathrm{ctl}}\triangleq ({\left\{C_{fp,j}\right\}}_{j=1}^2,{\left\{C_i\right\}}_{i=1}^l)$	Policy predicate-encoding ciphertext
${\mathsf{Td}}_{dr}$, ${\mathsf{TK}}_{\mathrm{cah}}$	Logined and cached trapdoor of DR
${\mathsf{prf}}_{\mathrm{req}}$, ${\mathsf{req}}_m$	request proof and message
${\mathsf{PDC}}_c$	The partial decrypted ciphertext payload header

.

The ePoFSC scheme is defined by a suite of polynomial-time algorithms, which are specified as follows.

• $\mathsf{Setup}\left(\lambda \right)\to ({\mathsf{PP}}_g,{\mathsf{mk}}_g)$: Global parameter initialization algorithm executed by the TA. Taking the security parameter $\lambda$ as input, this algorithm outputs the global public parameter ${\mathsf{PP}}_g$ and the system master secret key ${\mathsf{mk}}_g$.
• ${\mathsf{Setup}}_{dp}\left({\mathsf{PP}}_g\right)\to ({\mathsf{PK}}_{dp},{\mathsf{sk}}_{dp})$: Publisher key generation algorithm executed by the DP. This algorithm takes the global public parameter ${\mathsf{PP}}_g$ as input and outputs the key pair $({\mathsf{PK}}_{dp},{\mathsf{sk}}_{dp})$ for the data publisher.
• ${\mathsf{KeyGen}}_{dr}({\mathsf{S}}_{dr},{\mathsf{mk}}_g)\to {\mathsf{dk}}_{dr}$: Fine-grained user key generation algorithm executed by the TA. Given a requester’s permission attribute set ${\mathsf{S}}_{dr}$ and the master secret key ${\mathsf{mk}}_g$, this algorithm outputs the private permission key ${\mathsf{dk}}_{dr}$ for the authorized data requester.
• ${\mathsf{SigCry}}_f(m,{\mathsf{PP}}_g,{\mathsf{sk}}_{dp},{\mathbb{A}}_f)\to {\mathsf{CT}}_{\sigma }$: Policy-oriented functional signcryption algorithm executed by the DP. Taking the plaintext data m, global public parameter ${\mathsf{PP}}_g$, publisher secret key ${\mathsf{sk}}_{dp}$, and access policy ${\mathbb{A}}_f\triangleq ({\mathbf{M}}_{l\times n},\rho )$ as inputs, this algorithm generates and outputs the signcrypted ciphertext ${\mathsf{CT}}_{\sigma }$.
• ${\mathsf{StoreEnc}}_x({\mathsf{PK}}_{dp},{\mathrm{id}}_n^x,{\mathsf{s}}_x,C_{\mathrm{ctl},n})\to (C_{\mathrm{ctl},n}^{\mathrm{x}.\mathrm{enc}},{\mathsf{tag}}_n^x)$: Persistent encryption algorithm executed by the storage node x. This algorithm encrypts the control ciphertext for persistent disk storage and outputs the encrypted control ciphertext and the corresponding tag.
• ${\mathsf{StoreDec}}_x({\mathsf{PK}}_{dp},{\mathrm{id}}_n^x,{\mathsf{tag}}_n^x,{\mathsf{s}}_x,C_{\mathrm{ctl},n}^{\mathrm{x}.\mathrm{enc}})\to C_{\mathrm{ctl},n}$: Ciphertext activation algorithm executed by the storage node x. This algorithm decrypts and recovers the original control ciphertext from the persistently encrypted version for authorized edge-side processing.
• $\mathsf{ReqGen}(K_1,K_{t1},K_{t2},T_o,{\mathsf{req}}_m)\to ({\mathsf{prf}}_{\mathrm{req}},\mathsf{rk})$: Request proof generation algorithm executed by the DR. Given the key components $(K_1,K_{t1},K_{t2})\in {\mathsf{dk}}_{dr}$, current timestamp $T_o$, and request information ${\mathsf{req}}_m$, this algorithm outputs a verifiable request proof ${\mathsf{prf}}_{\mathrm{req}}$ and the temporary request key $\mathsf{rk}$.
• $\mathsf{ReqVfy}({\mathsf{prf}}_{\mathrm{req}},{\mathsf{req}}_m,T_o,\Delta T,\mathsf{RL},{\mathsf{PP}}_g)\to 0/1$: Request verification algorithm executed by EHNs. This algorithm validates the request proof correctness, timestamp freshness within the valid time window $\Delta T$, and user revocation status according to the revocation list $\mathsf{RL}$, and outputs a binary judgment bit 0 (reject) or 1 (accept).
• $\mathsf{TKGen}({\mathsf{dk}}_{dr},{\mathsf{PP}}_g)\to {\mathsf{TK}}_{dr}$: Transformation key generation algorithm executed by the DR. This algorithm derives the outsourced transformation key ${\mathsf{TK}}_{dr}$ from the user private key for subsequent edge trapdoor registration.
• $\mathsf{TKAdt}({\mathsf{TK}}_{dr},{\mathsf{PP}}_g)\to {\mathsf{TK}}_{\mathrm{cah}}/\perp$: Trapdoor auditing algorithm executed by EHNs. The edge node verifies the validity of the submitted transformation key and outputs the cached valid trapdoor ${\mathsf{TK}}_{\mathrm{cah}}$ or rejects the invalid key by outputting ⊥.
• $\mathsf{ODec}({\mathsf{TK}}_{\mathrm{cah}},{\mathsf{prf}}_{\mathrm{req}},{\mathsf{req}}_m,T_o,C_{\mathrm{ctl}},{\sigma }_m)\to {\mathsf{PDC}}_c/\perp$: Authenticated outsourced partial decryption algorithm executed by EHNs. With the cached valid trapdoor, verified request proof, timestamp, and ciphertext components, the edge node performs secure partial decryption and outputs the partial decrypted ciphertext ${\mathsf{PDC}}_c$ or returns ⊥ for invalid requests.
• $\mathsf{FinalUnSigCry}({\mathsf{PDC}}_f,\mathsf{rk},C_m,{\mathsf{PK}}_{dp})\to m/\perp$: Final unsigncryption and verification algorithm executed by the DR. The requester recovers the plaintext data and validates the publisher authenticity and data integrity, outputting the plaintext m or ⊥ if the verification fails.
• $\mathsf{Revoke}((K_{t1},K_{t2}),\mathsf{RL})\to \mathsf{RL}$: Dynamic key revocation algorithm executed by the TA or authorized EHNs. This algorithm updates the global revocation list $\mathsf{RL}$ to invalidate expired, leaked, or compromised user key components.

4.3. Security Definition

This subsection specifies the formal security models used to evaluate ePoFSC, covering data confidentiality, publisher-side unforgeability, and requester traceability under probabilistic polynomial-time adversaries.

4.3.1. Data Confidentiality

Security goals for data confidentiality are defined as follows.

• An entity can successfully decrypt a ciphertext if and only if it holds a valid decryption key $\mathsf{dk}$ whose permission attribute set satisfies the corresponding access policy ${\mathsf{S}}_{dr}\vDash ({\mathbf{M}}_{l\times n},\rho )$.
• The outsourced partial-decryption trapdoor $\mathsf{TK}$ and request proof ${\mathsf{prf}}_{\mathrm{req}}$ leak no decryption privilege information. Specifically, any external party cannot decrypt the ciphertext by acquiring $\mathsf{TK}$ and ${\mathsf{prf}}_{\mathrm{req}}$, even if the party possesses attributes that satisfy the target access policy.

Data confidentiality is formally abstracted as the S elective INDistinguishable security with Unrestricted Channel Interception against Relaxed Chosen Ciphertext Attack (sIND-uCI-RCCA) model. The sIND-uCI-RCCA security model is formulated as an interactive security game ${\mathsf{Exp}}^{\mathrm{sIN}\mathrm{D}-\mathrm{uCI}-\mathrm{RCCA}}\left(\lambda \right)$ Algorithm 1 between a probabilistic polynomial-time (PPT) adversary $\mathcal{A}$ and a challenger $\mathcal{C}$.

Algorithm 1:  ${\mathsf{Exp}}^{\mathrm{sIN}\mathrm{D}-\mathrm{uCI}-\mathrm{RCCA}}\left(\lambda \right)$

Input: $\lambda$ Output: $\mathrm{Pr}\left[\mathcal{A}\mathrm{wins}\right]$ $\mathcal{A}\to {\mathbb{A}}^{*}=({\mathbf{M}}_{\mathbf{l}\times \mathbf{n}}^{*},{\rho }^{*})$ ${\mathcal{C}}^{\mathbf{Setup}}\left({\mathbb{A}}^{*}\right)\to ({\mathsf{mk}}_g,{\mathsf{PP}}_g)$   ${\mathcal{A}}^{{\mathcal{O}}^{\mathsf{dk}},{\mathcal{O}}^{\mathsf{TK}},{\mathcal{O}}^{\mathrm{req}},{\mathcal{O}}^m}\left(\mathsf{PP}\right)\to (m_0,m_1,{\mathsf{sk}}_{dp}^{*})\left(\right|m_0|=|m_1\left|\right)$   ${\mathcal{C}}^{\chi \stackrel{\$}{\leftarrow }\{0,1\},{\mathbf{SigCry}}_f^{\chi }}(m_0,m_1,{\mathbb{A}}^{*},{\mathsf{sk}}_{dp}^{*})$$\to {\mathsf{CT}}_{\sigma }^{\chi }$ ${\mathcal{A}}^{{\mathcal{O}}^{\mathsf{dk}},{\mathcal{O}}^{\mathsf{TK}},{\mathcal{O}}^{\mathrm{req}},{\mathcal{O}}^m}({\mathsf{CT}}_{\sigma }^{\chi },\mathsf{PP})\stackrel{\mathrm{guess}}{\to }{\chi }^{\prime }$ sIND-uCI-RCCA: $\mathrm{Pr}\left[\mathcal{A}\mathrm{wins}\right]=\mathrm{Pr}[{\chi }^{\prime }=\chi ]\le \mathsf{negl}$.

In this game, the adversary is permitted to adaptively interact with four types of oracles. (a) The decryption-key oracle ${\mathcal{O}}^{\mathsf{dk}}$ simulates honest key issuance for requester attribute sets ${\mathsf{S}}_i$. To comply with the selective security definition, this oracle issues valid decryption keys ${\mathsf{dk}}_i$ only for attribute sets that do not satisfy the predefined challenge access policy ${\mathbb{A}}^{*}$, and all generated keys are recorded in the key list ${\mathcal{L}}_{\mathsf{dk}}$ indexed by the tag $h_l(K_{t_1}^i,K_{t_2}^i)$. (b) The request oracle ${\mathcal{O}}^{\mathrm{req}}$ simulates legitimate online request generation. Given valid key components $(K_{t_1}^i,K_{t_2}^i,T_{\mathrm{req}}^i,{\mathsf{req}}_m^i)$, this oracle returns a valid request proof if the corresponding tag has been registered in either the key table or the trapdoor table. (c) The trapdoor oracle ${\mathcal{O}}^{\mathsf{TK}}$ simulates outsourced trapdoor generation for given attribute sets and timestamps, records all generated trapdoors in ${\mathcal{L}}_{\mathsf{TK}}$, and returns the trapdoor to the adversary. (d) Finally, the message oracle ${\mathcal{O}}^m$ acts as a relaxed decryption oracle, which decrypts all admissible queried ciphertexts except the challenge ciphertext payload and returns the recovered plaintexts for valid queries.

4.3.2. Data Authentication

Data authentication ensures that each message proof ${\sigma }_m$ is uniquely bound to the encrypted-data payload $C_m$ and the corresponding data publisher. Furthermore, a valid message proof ${\sigma }_m$ can only be generated by the legitimate data publisher j who holds the exclusive publisher secret key ${\mathsf{sk}}_j$. This security requirement is formally defined via the Publisher-side Strong UnForgeability under Adaptive Chosen Message Attacks (Pu-SUF-aCMA) game ${\mathsf{Exp}}^{\mathrm{Pu}-\mathrm{SUF}-\mathrm{aCMA}}\left(\lambda \right)$ Algorithm 2, which is executed between a PPT adversary $\mathcal{A}$ and a challenger $\mathcal{C}$.

Algorithm 2:  ${\mathsf{Exp}}^{\mathrm{Pu}-\mathrm{SUF}-\mathrm{aCMA}}\left(\lambda \right)$

Input: $\lambda$ Output: $\mathrm{Pr}\left[\mathcal{A}\mathrm{wins}\right]$ ${\mathcal{C}}^{\mathbf{Setup}}\to ({\mathsf{mk}}_g,{\mathsf{PP}}_g)$   ${\mathcal{A}}^{{\mathcal{O}}^{\mathsf{dk}},{\mathcal{O}}^{\mathsf{dp}},{\mathcal{O}}^{{\mathsf{CT}}_{\sigma }}}\left(\mathsf{PP}\right)\to ({\mathsf{PK}}^{*},{\mathsf{CT}}_{\sigma }^{*}=({\mathbb{A}}^{*},C_m^{*},C_{\mathrm{ctl}}^{*},{\sigma }_m^{*}))$ $$\begin{array}{cc}\hfill \mathcal{A}\mathrm{wins}=& \mathsf{FinalUnSigCry}({\mathsf{mk}}_g,{\mathsf{CT}}_{\sigma }^{*},{\mathsf{PK}}^{*})\to 1\hfill \\ \hfill \wedge & {\mathsf{PK}}^{*}\notin {\mathcal{L}}_{\mathsf{dp}}\wedge ({\mathsf{PK}}^{*},C_m^{*},{\sigma }_m^{*})\notin {\mathcal{L}}_{\sigma }\hfill \end{array}$$ Pu-SUF-aCMA: $\mathrm{Pr}\left[\mathcal{A}\mathrm{wins}\right]\le \mathsf{negl}$.

The adversary can adaptively query three types of oracles throughout the game. (a) The decryption-key oracle ${\mathcal{O}}^{\mathsf{dk}}$ outputs valid decryption keys for user-specified permission sets. These keys only reflect the data access capabilities of ordinary data requesters and cannot provide any publisher-side signing credentials for the adversary. (b) The publisher oracle ${\mathcal{O}}^{\mathsf{dp}}$ generates a complete publisher key pair for a given publisher index j, delivers the key pair to the adversary, and records the corresponding publisher public key in the list ${\mathcal{L}}_{\mathsf{dp}}$. (c) The ciphertext oracle ${\mathcal{O}}^{{\mathsf{CT}}_{\sigma }}$ returns honestly signcrypted ciphertexts for arbitrary messages, access policies, and registered publishers, and records each generated tuple $({\mathsf{PK}}_j,C_m^i,{\sigma }_m^i)$ in the list ${\mathcal{L}}_{\sigma }$.

4.3.3. Requester Traceability

The requester traceability security requirement is formally defined as follows. Each request proof ${\mathsf{prf}}_{\mathrm{req}}$ and trapdoor ${\mathsf{TK}}_{dr}$ is bound to a unique and explicit user identifier. Furthermore, valid trapdoors and request proofs can only be derived by the legitimate entity that holds the decryption private key ${\mathsf{dk}}_i$ corresponding to the identifier i. Requester traceability is formalized via the Identifier Stronger-UForgeability under Adaptive Chosen Message Attacks (Id-SUF-aCMA) interactive security game ${\mathsf{Exp}}^{\mathrm{Id}-\mathrm{SUF}-\mathrm{aCMA}}\left(\lambda \right)$ Algorithm 3, which is conducted between a PPT adversary $\mathcal{A}$ and a challenger $\mathcal{C}$.

Three oracles are defined to simulate the actual attacker capacities. (a) The decryption-key oracle ${\mathcal{O}}^{\mathsf{dk}}$ generates and issues decryption keys for arbitrary permission sets, and records the mapping relationship between each issued key and its corresponding trapdoor identifiers $(K_{t_1}^i,K_{t_2}^i)$ in the list ${\mathcal{L}}_{\mathsf{dk}}$. (b) The request oracle ${\mathcal{O}}^{\mathrm{req}}$ takes trapdoor identifier pairs and request messages as inputs, executes the honest request-generation algorithm, stores the tuple $({\mathrm{msg}}^i,(K_{t_1}^i,K_{t_2}^i),{\mathsf{prf}}_{\mathrm{req}}^i)$ in ${\mathcal{L}}_{\mathrm{req}}$, and returns the generated request proof. (c) The trapdoor oracle ${\mathcal{O}}^{\mathsf{TK}}$ outputs honestly generated trapdoors for specified permission sets, identifiers, and messages, records the corresponding trapdoor tuples in ${\mathcal{L}}_{\mathsf{TK}}$, and returns the valid trapdoors to the querier.

Algorithm 3:  ${\mathsf{Exp}}^{\mathrm{Id}-\mathrm{SUF}-\mathrm{aCMA}}\left(\lambda \right)$

Input: $\lambda$ Output: $\mathrm{Pr}\left[\mathcal{A}\mathrm{wins}\right]$ ${\mathcal{C}}^{\mathbf{Setup}}\to ({\mathsf{mk}}_g,{\mathsf{PP}}_g)$   ${\mathcal{A}}^{{\mathcal{O}}^{\mathsf{dk}},{\mathcal{O}}^{\mathsf{TK}},{\mathcal{O}}^{\mathrm{req}}}\left(\mathsf{PP}\right)\to {\mathsf{TK}}^{*}\mathrm{or}{\mathsf{prf}}_{\mathrm{req}}^{*}$ Define two events $$\begin{array}{cc}\hfill \mathcal{A}\mathrm{Forge}\mathrm{TK}\mathrm{Successfully}=& \mathsf{TKAdt}({\mathsf{TK}}^{*},{\mathsf{PP}}_g)\to 1\hfill \\ \hfill \wedge & ((K_{t_1}^{*},K_{t_2}^{*}):{\mathsf{dk}}^{*})\notin {\mathcal{L}}_{\mathsf{dk}}\hfill \\ \hfill \wedge & ({\mathrm{msg}}^{*},(K_{t_1}^{*},K_{t_2}^{*}),{\mathsf{TK}}^{*})\notin {\mathcal{L}}_{\mathsf{TK}}\hfill \end{array}$$ $$\begin{array}{cc}\hfill \mathcal{A}\mathrm{Forge}{\mathsf{prf}}_{\mathrm{req}}\mathrm{Successfully}=& \mathsf{ReqVfy}({\mathsf{prf}}_{\mathrm{req}}^{*},{\mathsf{PP}}_g)\to 1\hfill \\ \hfill \wedge & ((K_{t_1}^{*},K_{t_2}^{*}):{\mathsf{dk}}^{*})\notin {\mathcal{L}}_{\mathsf{dk}}\hfill \\ \hfill \wedge & ({\mathrm{msg}}^{*},(K_{t_1}^{*},K_{t_2}^{*}),{\mathsf{prf}}_{\mathrm{req}}^{*})\notin {\mathcal{L}}_{\mathrm{req}}\hfill \end{array}$$ $\mathcal{A}\mathrm{wins}:=\left(\mathcal{A}\mathrm{Forge}\mathrm{TK}\mathrm{Successfully}\right)\vee \left(\mathcal{A}\mathrm{Forge}{\mathsf{prf}}_{\mathrm{req}}\mathrm{Successfully}\right)$ Id-SUF-aCMA: $\mathrm{Pr}\left[\mathcal{A}\mathrm{wins}\right]\le \mathsf{negl}$.

4.4. Concrete Construction

This subsection instantiates ePoFSC by specifying the concrete algorithms for system initialization, key generation, authenticated data encapsulation, trapdoor auditing and caching, request verification, outsourced partial decryption, final data recovery, and key-level revocation.

• $\mathsf{Setup}\left(\lambda \right)\to ({\mathsf{PP}}_g,{\mathsf{mk}}_g)$. (1) ${\mathrm{PairGen}}_{III}(1^{\lambda }\to {\mathsf{BP}}_{\mathrm{III}}=(\mathbb{G},\mathbb{H},g,h,p,e:\mathbb{G}\times \mathbb{H}\to {\mathbb{G}}_T)$. (2) Select a collision-resistant hash function $h_l:{\{0,1\}}^{*}\to {\{0,1\}}^l$ with output length $l\ge \lceil {\log }_{2}p\rceil$, and then construct a hash-to-integer function $h_z:{\{0,1\}}^l\to {\mathbb{Z}}_p^{*}$ as well as a hash-to-curve function $H_{\mathbb{G}}:{\{0,1\}}^{*}\to \mathbb{G}$ by using the Hash-to-Field Standard (RFC 9380 (https://datatracker.ietf.org/doc/rfc9380/) accessed on 30 June 2026). (3) Choose a pseudorandom permutation (PRP)-based symmetric encryption algorithm $\mathsf{SE}=(\mathsf{SE}.\mathsf{Enc},\mathsf{SE}.\mathsf{Dec})$ with key space ${\mathcal{K}}^l$, where encryption is defined as $\mathsf{CT}=\mathsf{SE}.\mathsf{Enc}({\mathcal{K}}^l,m)$ and decryption as $m=\mathsf{SE}.\mathsf{Dec}({\mathcal{K}}^l,\mathsf{CT})$ (The PRP means that no PPT algorithm can break the encryption algorithm from the plaintext-ciphertext pair). (4) Define the maximum number $n_{max}$ of repeated functional points in each functional policy. (5) Sample random elements $b,\alpha ,\beta {\leftarrow }_R{\mathbb{Z}}_p^{*}$ and define ${\mathsf{mk}}_g=\alpha ,b,c,\beta$; ${\mathsf{PP}}_g={\mathsf{BP}}_{\mathrm{III}},e{(g,h)}^{\alpha },h^{\beta },g^b,n_{max},h_l,H_z,H_{\mathbb{G}},\mathsf{SE}$.
• ${\mathsf{Setup}}_{dp}\left(\mathsf{PP}\right)\to ({\mathsf{PK}}_{dp},{\mathsf{sk}}_{dp})$. Sample the secret key ${\mathsf{sk}}_{dp}\stackrel{R}{\leftarrow }{\mathbb{Z}}_p^{*}$ as the private key, and derive the public key ${\mathsf{PK}}_{dp}=g^{{\mathsf{sk}}_{dp}}$.
• ${\mathsf{KeyGen}}_{dr}({\mathsf{S}}_{dr},{\mathsf{mk}}_g)\to {\mathsf{dk}}_{dr}$. This algorithm is presented in Algorithm 4.
• ${\mathsf{SigCry}}_f(m,{\mathsf{PP}}_g,{\mathsf{sk}}_{dp},{\mathbb{A}}_f)\to {\mathsf{CT}}_{\sigma }$. The algorithm is depicted in Algorithm 5. The policy-point number-th encoding sub-algorithm of ${\mathsf{SigCry}}_f$ Algorithm 5 is illustrated in Figure 6.
• ${\mathsf{StoreEnc}}_x({\mathsf{PK}}_{dp},{\mathrm{id}}_n^x,{\mathsf{s}}_x,C_{\mathrm{ctl},n})\to (C_{\mathrm{ctl},n}^{\mathrm{x}.\mathrm{enc}},{\mathsf{tag}}_n^x)$. Choose the random encryption tag ${\mathsf{tag}}_n^x{\leftarrow }_R{\{0,1\}}^{*}$. Drive the key ${\mathsf{SK}}_n^x=h_l\left({\mathsf{PK}}_{dp}^{h_z({\mathsf{tag}}_n^x,{\mathsf{s}}_x,{\mathrm{id}}_n^x)}\right)$. Return $C_{\mathrm{ctl},n}^{\mathrm{x}.\mathrm{enc}}=\mathsf{SE}.\mathsf{Enc}(C_{\mathrm{ctl},n},{\mathsf{SK}}_n^x)$.
• ${\mathsf{StoreDec}}_x({\mathsf{PK}}_{dp},{\mathrm{id}}_n^x,{\mathsf{tag}}_n^x,{\mathsf{s}}_x,C_{\mathrm{ctl},n}^{\mathrm{x}.\mathrm{enc}})\to C_{\mathrm{ctl},n}$. Drive the key ${\mathsf{SK}}_n^x=h_l\left({\mathsf{PK}}_{dp}^{h_z({\mathsf{tag}}_n^x,{\mathsf{s}}_x,{\mathrm{id}}_n^x)}\right)$. Return $C_{\mathrm{ctl},n}=\mathsf{SE}.\mathsf{Dec}(C_{\mathrm{ctl},n}^{\mathrm{x}.\mathrm{enc}},{\mathsf{SK}}_n^x)$.
  $\mathsf{ReqGen}(K_1,K_{t1},K_{t2},{\mathsf{req}}_m)\to ({\mathsf{prf}}_{\mathrm{req}},\mathsf{rk})$. This algorithm is expressed in Algorithm 6.
  $\mathsf{ReqVfy}({\mathsf{prf}}_{\mathrm{req}},{\mathsf{req}}_m,T_o,\Delta T,\mathsf{RL},{\mathsf{PP}}_g)\to 0/1$. This algorithm is expressed in Algorithm 7.
• $\mathsf{TKGen}({\mathsf{dk}}_{dr},{\mathsf{PP}}_g)\to {\mathsf{TK}}_{dr}$. Outsourced transformation key construction algorithm by DR expressed in Algorithm 8.
• $\mathsf{TKAdt}({\mathsf{TK}}_{dr},{\mathsf{PP}}_g)\to {\mathsf{TK}}_{\mathrm{cah}}/\perp$. First conduct the $\mathsf{ReqVerify}({\mathsf{prf}}_{\mathrm{req}},\Delta T,{\mathsf{PP}}_g)$ to verify the freshness and validity of ${\mathsf{prf}}_{\mathrm{req}}\in {\mathsf{TK}}_{dr}$. Then execute the discriminant to audit each permission point $p_i$ in ${\mathsf{S}}_{dr}$.

  $$\begin{array}{c}\hfill {\{e(H_{\mathbb{G}}(p_i@n),{\left(K_{t_1}{K}_{t_2}\right)}^{h_z(K_{t_1},K_{t_2})})\stackrel{?}{=}e({\mathsf{tk}}_{p_i@n},h^{\beta })\}}_{n=1}^{n_{max}}\end{array}$$
  If the logined trapdoor ${\mathsf{TK}}_{dr}$ passes the auditing process, return the cached trapdoor ${\mathsf{TK}}_{\mathrm{cah}}\to \{h_l(K_{t_1},K_{t_2}):$${\left\{{\left\{{\mathsf{tk}}_{p_i@n}\right\}}_{n=1}^{n_{p_{max}}}\right\}}_{p_i\in {\mathsf{S}}_{dr}}\}$, otherwise, return ⊥.
• $\mathsf{ODec}({\mathsf{TK}}_{\mathrm{cah}},{\mathsf{prf}}_{\mathrm{req}},{\mathsf{req}}_m,T_o,C_{\mathrm{ctl}},{\sigma }_m)\to {\mathsf{PDC}}_c/\perp$. Outsourced decryption algorithm by request handler node. This algorithm is expressed in Algorithm 9.
  The correctness of the $pd{c}_1$ is expressed as:

  $$\begin{array}{cc}\hfill pd{c}_1=& e(g^{{\mathsf{sec}}_c},h^{\alpha }{h}^{b(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{o_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},T_o,{\mathsf{req}}_m)})\hfill \\ \hfill ·& (e(\prod _{i\in I}{g}^{b{\lambda }_i{\omega }_i}{H}_{\mathbb{G}}{\left(\tau \left[i\right]\right)}^{{\mathsf{sec}}_c{\omega }_i},h^{(t_1+t_2)h_z(K_{t_1},K_{t_2})})\hfill \\ \hfill ·& e(\prod _{i\in I}{H}_{\mathbb{G}}{\left(\tau \left[i\right]\right)}^{{\displaystyle \frac{b(t_1+t_2)h_z(K_{t_1},K_{t_2})}{\beta }}{\omega }_i},h^{-\beta {\mathsf{sec}}_c}){)}^{-1}\hfill \\ \hfill =& e{(g,h)}^{\alpha {\mathsf{sec}}_c}e{(g,h)}^{{\mathsf{sec}}_c{o}_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},T_o,{\mathsf{req}}_m)}\hfill \\ \hfill ·& e{(g,h)}^{b{\mathsf{sec}}_c(t_1+t_2)h_z(K_{t_1},K_{t_2})}\hfill \\ \hfill ·& {\left(e(g^{b{\sum }_{i\in I}{\lambda }_i{\omega }_i},h^{(t_1+t_2)h_z(K_{t_1},K_{t_2})})\right)}^{-1}\hfill \\ \hfill ·& (e{(\prod _{i\in I}{H}_{\mathbb{G}}{\left(\tau \left[i\right]\right)}^{{\omega }_i},h)}^{{\mathsf{sec}}_c(t_1+t_2)h_z(K_{t_1},K_{t_2})}\hfill \\ \hfill ·& e{(\prod _{i\in I}{H}_{\mathbb{G}}{\left(\tau \left[i\right]\right)}^{{\omega }_i},h)}^{-{\mathsf{sec}}_c(t_1+t_2)h_z(K_{t_1},K_{t_2})}{)}^{-1}\hfill \\ \hfill =& e{(g,h)}^{\alpha {\mathsf{sec}}_c}e{(g,h)}^{{\mathsf{sec}}_c{o}_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},T_o,{\mathsf{req}}_m)}\hfill \end{array}$$
• $\mathsf{FinalUnSigCry}({\mathsf{PDC}}_f,\mathsf{rk},C_m,{\mathsf{PK}}_{dp})\to m/\perp$. Final unsigncryption algorithm by DR. Input the partial decrypted ciphertext ${\mathsf{PDC}}_f$, the retrieval key $\mathsf{rk}$, the encrypted-data $C_m$ with the data proof $\sigma$ and public key ${\mathsf{PK}}_{dp}$.
  Retrieval the data m: ${\mathsf{K}}^{\prime }={\displaystyle \frac{pd{c}_1}{pd{c}_o^{\mathsf{rk}}}}=e{(g,h)}^{\alpha {\mathsf{sec}}_c}$, $m^{\prime }=\mathsf{SE}.\mathsf{Dec}(h_l\left({\mathsf{K}}^{\prime }\right),C_m)$. Then verify the decrypted data $m^{\prime }$: ①$c_{v,2}\stackrel{?}{\in }{\mathbb{Z}}_p^{*}$; ② $g^{c_{v,2}}\stackrel{?}{=}{\mathsf{PK}}_{dp}^{h_z({\mathsf{K}}^{\prime },m^{\prime },C_{v,1},{\mathsf{PK}}_{dp})}·C_{v,1}=g^{{\mathsf{sk}}_{dp}{h}_z({\mathsf{K}}^{\prime },m^{\prime },C_{v,1},{\mathsf{PK}}_{dp})+r_t}$. If the verification passes, return $m^{\prime }$; otherwise, return ⊥.
• $\mathsf{Revoke}((K_{t1},K_{t2}),\mathsf{RL})\to \mathsf{RL}$. The corrupted DR revocation algorithm is conducted by the TA. It takes as input the previous revocation list $\mathsf{RL}$ and the revoked DR’s feature key $(K_{t1},K_{t2})$, and outputs the updated revocation list $\mathsf{RL}\leftarrow \mathsf{RL}\cup h_l(K_{t1},K_{t2})$.

Algorithm 4: ${\mathsf{KeyGen}}_{dr}$

Algorithm 5: Policy-Controllable Signcryption

Algorithm 6: $\mathsf{ReqGen}$

Input: $K_1,K_{t1},K_{t2},T_o,{\mathsf{req}}_m$ Output: ${\mathsf{prf}}_{\mathrm{req}}$ Randomly sample $o_1,o_2{\leftarrow }_R{\mathbb{Z}}_p^{*}$; Extract timestamp $T_o$; Extract ${\mathsf{req}}_{o_1}=g^{o_1},{\mathsf{req}}_{o_2}=h^{o_2}$ Compute $h_o=h_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},T_o,{\mathsf{req}}_m)$; Extract ${\mathsf{req}}_1=K_1·h^{o_1{o}_2{h}_o}=h^{\alpha }{h}^{b(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{o_1{o}_2{h}_o}$ Return $\left\{\begin{array}{c}{\mathsf{prf}}_{\mathrm{req}}=({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathsf{req}}_1,K_{t_1},K_{t_2},T_o)\hfill \\ \mathsf{rk}=o_1\hfill \end{array}\right.$

Algorithm 7: $\mathsf{ReqVfy}$

Algorithm 8: $\mathsf{TKGen}$

Algorithm 9: $\mathsf{ODec}$

4.5. System Workflow

The system workflow, including cryptographic data uploading, storage, request generation, and retrieval, is presented in Figure 7.

System and Permission Initialization (1) TA conducts $\mathsf{Setup}\left(\lambda \right)\to ({\mathsf{PP}}_g,{\mathsf{mk}}_g)$ to initialize the global cryptographic parameters of ePoFSC. (2) DPs set up their key pairs by running ${\mathsf{Setup}}_{dp}\left(\mathsf{PP}\right)\to ({\mathsf{PK}}_{dp},{\mathsf{sk}}_{dp})$. (3) A DR submits its permission set ${\mathsf{S}}_{dr}$ to TA via a secure channel, and TA extracts and returns the decryption key ${\mathsf{KeyGen}}_{dr}({\mathsf{S}}_{dr},{\mathsf{mk}}_g)\to {\mathsf{dk}}_{dr}$ for each discrete permission point in ${\mathsf{S}}_{dr}$ to the DR through the secure channel.

Data Uploading and Indexed Storage (1) DP performs the policy-oriented functional signcryption algorithm ${\mathsf{SigCry}}_f(m,{\mathsf{sec}}_c,{\mathsf{PP}}_g,{\mathsf{sk}}_{dp},{\mathbb{A}}_f)\to {\mathsf{CT}}_{\sigma }$ to generate the authenticated ciphertext ${\mathsf{CT}}_{\sigma }:=(C_m,C_{\mathrm{ctl}}=(C_{fp,1},C_{fp,2},{\left\{C_i\right\}}_{i=1}^l),{\sigma }_m)$ for m. (2) The DP uploads $({\mathsf{PK}}_{dp},{\mathsf{CT}}_{\sigma })$ to CeDS. CeDS assigns a unique ${\mathrm{id}}_c$ to ${\mathsf{CT}}_{\sigma }$, then conducts persistent encryption $\mathsf{StoreEnc}({\mathsf{PK}}_{dp},{\mathrm{id}}_c,{\mathsf{s}}_{\mathrm{CeDS}},C_{\mathrm{ctl}})\to (C_{\mathrm{ctl},c}^{\mathrm{CeDS}},{\mathsf{tag}}_c^{\mathrm{CeDS}})$, indexes $\{i{d}_c:\left({\mathsf{PK}}_{dp},C_{\mathrm{ctl},c}^{\mathrm{CeDS}},{\mathsf{tag}}_c^{\mathrm{CeDS}},{\sigma }_m\right)\}$ into the ciphertext index table, and records $\{i{d}_c:C_m\}$ into the data pool. CeDS synchronizes $\{i{d}_c:\left({\mathsf{PK}}_{dp},C_{\mathrm{ctl}},{\sigma }_m\right)\}$ to EHNs through the secure channel. EHN executes $\mathsf{StoreEnc}({\mathsf{PK}}_{dp},{\mathrm{id}}_c,{\mathsf{s}}_{\mathrm{EHN}},C_{\mathrm{ctl}})\to (C_{\mathrm{ctl},c}^{\mathrm{EHN}},{\mathsf{tag}}_c^{\mathrm{EHN}})$ by itself.

Data Request and Retrieval (1) When a DR enters the signal range of an EHN, it executes $\mathsf{TKGen}({\mathsf{dk}}_{dr},{\mathsf{PP}}_g)\to {\mathsf{TK}}_{dr}$ and uploads the trapdoor ${\mathsf{TK}}_{dr}$ to the EHN for trapdoor registration. Then EHN audits the legitimacy of the trapdoor $\mathsf{TKAdt}({\mathsf{TK}}_{dr},{\mathsf{PP}}_g)\to {\mathsf{TK}}_{\mathrm{cah}}/\perp$ and registers ${\mathsf{TK}}_{\mathrm{cah}}$ in the requester Table (2) DR selects the target data identifiers ${\mathrm{req}}_m\leftarrow {\left\{{\mathrm{id}}_i\right\}}_{i\in {\mathcal{L}}_{\mathrm{cid}}}$ as the request payload, executes the request-proof generation algorithm $\mathsf{ReqGen}(K_1,K_{t1},K_{t2},T_{\mathrm{req}},{\mathsf{req}}_m)\to ({\mathsf{prf}}_{\mathrm{req}},\mathsf{rk})$, and then sends the request $({\mathsf{req}}_m,T_{\mathrm{req}},{\mathsf{prf}}_{\mathrm{req}})$ to the EHN in the region. (3) The EHN first performs the request verification algorithm $\mathsf{ReqVfy}({\mathsf{prf}}_{\mathrm{req}},{\mathsf{req}}_m,T_{\mathrm{req}},\Delta T,{\mathsf{PP}}_g)$. Subsequently, it retrieves the cached trapdoor ${\mathsf{TK}}_{\mathrm{cah}}$ from the requester table using the characteristic value of the trapdoor $K_{t1},K_{t2}$ in ${\mathsf{prf}}_{\mathrm{req}}$. Then EHN activates the control ciphertext to obtain $C_{\mathrm{ctl}}^i$ by running $\mathsf{StoreDec}({\mathsf{PK}}_{dp}^i,{\mathrm{id}}_i^{\mathrm{EHN}},{\mathsf{tag}}_i^{\mathrm{EHN}},{\mathsf{s}}_{\mathrm{EHN}},C_{\mathrm{ctl},i}^{\mathrm{EHN}})\to C_{\mathrm{ctl}}^i$ and executes the outsourced partial-decryption algorithm $\mathsf{ODec}({\mathsf{TK}}_{\mathrm{cah}},{\mathsf{prf}}_{\mathrm{req}},{\mathsf{req}}_m,T_o,C_{\mathrm{ctl}}^i)\to {\mathsf{PDC}}_f^i/\perp$ for each ciphertext in ${\mathcal{L}}_{\mathrm{cid}}$. If $\mathsf{ODec}$ returns ${\mathsf{PDC}}_f^i$, EHN retrieves the corresponding $\{{\mathrm{id}}_i:C_m^i\}$ from CeDS. (4) Afterward, the EHN returns the partial-decryption functional-controllable ciphertext and the encrypted data payload, together with their data verification information ${\{{\mathrm{id}}_i:({\mathsf{PDC}}_f^i,C_m^i,{\mathsf{PK}}_{dp}^i)\}}_{i\in {\mathcal{L}}_{\mathsf{PDC}}}$, to the DR. DR performs the final unsigncryption algorithm $\mathsf{FinalUnSigCry}({\mathsf{PDC}}_f^i,\mathsf{rk},C_m^i,{\mathsf{PK}}_{dp}^i)\to m_i/\perp$, $\forall i\in {\mathcal{L}}_{\mathsf{PDC}}$, to retrieve the verifiable data.

Throughout the data request process, all request messages from the DR, including the registered trapdoor, must be verified by timestamp-embedded verification algorithms, thereby effectively preventing DDoS and replay attacks.

Key-Level Requester Permission Revocation For DRs with malicious behavior, the EHNs or TA executes $\mathsf{Revoke}((K_{t1},K_{t2}),\mathsf{RL})\to \mathsf{RL}$ to revoke permissions at the key-level.

5. Security Theorems and Reductions

This section proves the formal security guarantees of ePoFSC by reducing data confidentiality, publisher-side unforgeability, and requester traceability to the Decisional q-AsymBDHE assumption, the SUF-aCMA security of Schnorr signatures, and the AsymCDHP assumption, respectively.

Theorem 1. 

If the Decisional q-AsymBDHE assumption holds, the proposed scheme meets the sIND-uCI-RCCA security defined in ${\mathsf{Exp}}^{\mathit{sIND}-\mathit{uCI}-\mathit{RCCA}}\left(\lambda \right)$ Algorithm 1.

Definition 1. 

Decisional q-Asymmetric Bilinear Diffie–Hellman Exponent (q-AsymBDHE) Assumption: For any polytime adversary $\mathcal{A}$ given a challenge tuple $({\mathsf{BP}}_{\mathrm{III}},\overrightarrow{\mathrm{\Phi }})$, where

$$\begin{array}{c}\hfill \overrightarrow{\mathrm{\Phi }}=g^s,h^s,{\{h^{b^i},g^{b^i}\}}_{1\le i\le 2q,i\ne q+1}\end{array}$$

with $s,b{\leftarrow }_R{\mathbb{Z}}_p^{*}$, the probability ${ϵ}_{\mathit{qBDHE}}$ that ${\mathcal{A}}_{\mathit{qBDHE}}$ can distinguish $\mathsf{T}=e{(g,h)}^{s{b}^{q+1}}$ from a random element $\mathsf{T}=\mathsf{R}{\leftarrow }_R{\mathbb{G}}_T$ is negligible. Specifically,

$$\begin{array}{c}\hfill |\mathrm{Pr}\left[\mathcal{A}\left({\mathsf{BP}}_{\mathit{III}},\overrightarrow{\mathrm{\Phi }},\mathsf{T}=e{(g,h)}^{s{b}^{q+1}}\right)=1\right]-\mathrm{Pr}\left[\mathcal{A}\left({\mathsf{BP}}_{\mathit{III}},\overrightarrow{\mathrm{\Phi }},\mathsf{T}=\mathsf{R}\right)=1\right]|\le {ϵ}_{\mathit{qBDHE}}\end{array}$$

Proof. 

Suppose there exists a PPT adversary $\mathcal{A}$ with a non-negligible advantage $Ad{v}_{\mathcal{A}}$ against the proposed scheme in model ${\mathsf{Exp}}^{\mathrm{sIND}-\mathrm{uCI}-\mathrm{RCCA}}\left(\lambda \right)$ Algorithm 1. Then, a PPT simulator (challenger) $\mathcal{C}$ can be constructed to simulate the scheme, and this simulator can break the q-AsymBDHE assumption with a non-negligible advantage ${\mathrm{Adv}}_{\mathcal{A}}$.

Init $\mathcal{C}$ receives $\{\overrightarrow{p},T\}$ from the q-AsymBDHE assumption and a challenge policy $\left({\mathbf{M}}_{l\times n}^{*},{\rho }^{*}\right)$ (where $l,n\le q$) from $\mathcal{A}$. $\mathcal{C}$ runs the functional-point number-th encoding Algorithm 10 to get the number-th encoding challenge access policy $({\mathbf{M}}_{l\times n}^{*},{\rho }^{*})$→$({\mathbf{M}}_{l\times n}^{*},{\tau }^{*})$.

Algorithm 10: Points Number-th Encoding Algorithm

Setup $\mathcal{C}$ selects a secure symmetric encryption algorithm and a hash function, denoted as $\mathsf{SE}=(\mathsf{CT}=\mathsf{SE}.\mathsf{Enc}({\mathcal{K}}^l,m),m=\mathsf{SE}.\mathsf{Dec}({\mathcal{K}}^l,\mathsf{CT}))$ and $h_l:{\{0,1\}}^{*}\to {\{0,1\}}^l$, respectively. $\mathcal{C}$ randomly samples ${\alpha }^{\prime },\beta {\leftarrow }_R{\mathbb{Z}}_p^{*}$. $\mathcal{C}$ implicitly sets

$$\begin{array}{c}\hfill e{(g,h)}^{\alpha }=e(g^b,h^{b^q})·e{(g,h)}^{{\alpha }^{\prime }}\stackrel{\mathrm{implicit}}{\Rightarrow }\alpha ={\alpha }^{\prime }+b^{q+1}\end{array}$$

$\mathcal{C}$ opens the public parameters $g^b$, $h^{\beta }$, $e{(g,h)}^{\alpha }$, $h_l$, and $\mathsf{SE}$ to $\mathcal{A}$.

Query Phase 1 $\mathcal{A}$ adaptively queries $\mathcal{C}$.

(a) ${\mathcal{O}}^{H_{\mathbb{G}}}$: $\mathcal{C}$ maintains a table ${\mathcal{L}}_{H_{\mathbb{G}}}$ for the hash-to-curve oracle. On input $p_i@k\in {\{0,1\}}^{*}$, if the input has already appeared in the table, $\mathcal{C}$ returns the stored value. Otherwise, it samples $v_{ik}\leftarrow {\mathbb{Z}}_p^{*}$ and records the new entry. If $p_i@k$ is one of the mapped policy points in $\tau$, then the unique row i satisfying $\tau \left[i\right]=p_i@k$ is used to program

$$\begin{array}{c}\hfill H_{\mathbb{G}}(p_i@k)=g^{v_{ik}}{g}^{b{M}_{i,1}}{g}^{b^2{M}_{i,2}}\cdots g^{b^n{M}_{i,n}},\end{array}$$

where $M_{i,j}$ denotes the $(i,j)$-th element of ${\mathbf{M}}_{l\times n}$. If $p_i@k$ is not in $\tau$, the oracle returns $H_{\mathbb{G}}(p_i@k)=g^{v_{ik}}$.

(b) ${\mathcal{O}}^{h_z}$: $\mathcal{C}$ maintains a table ${\mathcal{L}}_{h_z}$. On a new input, it samples a fresh value in ${\mathbb{Z}}_p^{*}$, stores the input-output pair, and returns the sampled value. On a repeated input, it returns the value already stored in the table.

(c) ${\mathcal{O}}^{\mathsf{dk}}$. Define a row-index set $I^{\prime }={\{i\mid \tau \left[i\right]\in {\left\{{\{p_x@k\}}_{k=1}^{n_{p_{max}}}\right\}}_{p_x\in {\mathsf{S}}_x}\}}_{i=1}^l$. Since ${\left\{{\left\{(p_x@k)\right\}}_{k=1}^{n_{p_{max}}}\right\}}_{p_x\in {\mathsf{S}}_x}$ does not satisfy $({\mathbf{M}}_{l\times n},\tau )$, the rows in $I^{\prime }$ cannot reconstruct the vector $(1,0,\dots ,0)$. By the property of the Linear Secret-Sharing Scheme (LSSS), $\mathcal{C}$ can find a vector in polynomial time: $\overrightarrow{\theta }=\left({\theta }_1=-1,{\theta }_2,\dots ,{\theta }_n\right),\mathrm{such}\mathrm{that}{\mathbf{M}}_i\overrightarrow{\theta }=0,\forall i\in I^{\prime }$.

$\mathcal{C}$ randomly selects ${\tilde{t}}_1,t_2,h_x{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and implicitly sets

$$\begin{array}{c}\hfill t_1\stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{t}}_1+{\displaystyle \frac{{\sum }_{j=1}^n{\theta }_i{b}^{q-j+1}}{h_x}}\end{array}$$

And then $\mathcal{C}$ simulates:

$$\begin{array}{cc}\hfill K_{t_1}=& h^{t_1}=h^{\tilde{t}}{\displaystyle \prod _{j=1}^n}{\left(h^{b^{q-j+1}}\right)}^{{\displaystyle \frac{{\theta }_j}{h_x}}}\hfill \\ \hfill K_{t_2}=& h^{t_2}\hfill \end{array}$$

If $h_l(K_{t_1},K_{t_2})\in {\mathcal{L}}_{\mathsf{dk}}$, $\mathcal{C}$ re-starts the ${\mathcal{O}}^{\mathsf{dk}}$ program. Otherwise, $\mathcal{C}$ sets $\{(K_{t_1},K_{t_2}):h_x\}$ in ${\mathcal{L}}_{h_z}$, then simulates

$$\begin{array}{cc}\hfill K_1=& h^{\alpha }{h}^{b(t_1+t_2)h_z(K_{t_1},K_{t_2})}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{{\tilde{t}}_1{h}_x}\left({\displaystyle \prod _{j=1}^n}{\left(h^{b^{q-j+2}}\right)}^{{\theta }_j}\right)h^{b{t}_2{h}_x}\hfill \\ \hfill \stackrel{{\theta }_1=-1}{=}& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{{\tilde{t}}_1{h}_x}{h}^{-b^{q+1}}\left({\displaystyle \prod _{j=2}^n}{\left(h^{b^{q-j+2}}\right)}^{{\theta }_j}\right)h^{b{t}_2{h}_x}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b{\tilde{t}}_1{h}_x}\left({\displaystyle \prod _{j=2}^n}{\left(h^{b^{q-j+2}}\right)}^{{\theta }_j}\right)h^{b{t}_2{h}_x}\hfill \end{array}$$

For each point $p_x@k$, $p_x\in {\mathsf{S}}_x$, $k\in [1,n_{p_{max}}]$, if $p_x@k\notin \tau$, $K_{p_x@k}$ is simulated as:

$$\begin{array}{c}\hfill K_{p_x@k}=H_{\mathbb{G}}{(p_x@k)}^{{\displaystyle \frac{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{\beta }}}={\left(g^{{\tilde{t}}_1{h}_x}{\displaystyle \prod _{j=1}^n}{\left(g^{b^{q-j+1}}\right)}^{{\theta }_j}{g}^{t_2{h}_x}\right)}^{{\displaystyle \frac{v_{xk}}{\beta }}}\end{array}$$

Otherwise, if $p_x@k=\tau \left[i\right]$, simulate

$$\begin{array}{cc}\hfill K_{p_x@k}=& H_{\mathbb{G}}{(p_x@k)}^{{\displaystyle \frac{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{\beta }}}\hfill \\ \hfill =& {\left({\displaystyle \prod _{j=1}^n}{\left(g^{b^{q-j+1}}\right)}^{{\theta }_j}\right)}^{{\displaystyle \frac{v_{xk}}{\beta }}}·H_{\mathbb{G}}{(p_x@k)}^{{\displaystyle \frac{({\tilde{t}}_1+t_2)h_x}{\beta }}}\hfill \\ \hfill ·& (g^{b^{q+1}{M}_{i,1}{\theta }_1}·g^{b^q{M}_{i,1}{\theta }_2}\cdots g^{b^{q-n+2}{M}_{i,1}{\theta }_n}\hfill \\ \hfill ·& g^{b^{q+2}{\theta }_1{M}_{i,2}{\theta }_1}{g}^{b^{q+1}{\theta }_2{M}_{i,2}}\cdots g^{b^{q-n+3}{M}_{i,2}{\theta }_n}\hfill \\ \hfill ⋮\\ \hfill ·& g^{b^{q+n}{M}_{i,n}{\theta }_1}·g^{b^{q-1+n}{M}_{i,n}{\theta }_2}\cdots g^{b^{q+1}{M}_{i,n}{\theta }_n}{)}^{{\displaystyle \frac{1}{\beta }}}\hfill \end{array}$$

where

$$\begin{array}{c}\hfill g^{b^{q+1}{M}_{i,1}{\theta }_1}·g^{b^{q+1}{M}_{i,2}{\theta }_2}\cdots g^{b^{q+1}{M}_{i,n}{\theta }_n}=g^{b^{q+1}{\sum }_{j=1}^n{M}_{i,j}{\theta }_j}\stackrel{{\mathbf{M}}_i\overrightarrow{\theta }=0}{=}1\end{array}$$

Thus, the simulated computation of $K_{p_x:n_k}$ reduces to

$$\begin{array}{cc}\hfill K_{p_x@k}=& H_{\mathbb{G}}{(p_x@k)}^{{\displaystyle \frac{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{\beta }}}\hfill \\ \hfill =& {\left({\displaystyle \prod _{j=1}^n}{\left(g^{b^{q-j+1}}\right)}^{{\theta }_j}\right)}^{{\displaystyle \frac{v_{xk}}{\beta }}}·H_{\mathbb{G}}{(p_x@k)}^{{\displaystyle \frac{({\tilde{t}}_1+t_2)h_x}{\beta }}}\hfill \\ \hfill ·& (1·g^{b^q{M}_{i,1}{\theta }_2}\cdots g^{b^{q-n+2}{M}_{i,1}{\theta }_n}\hfill \\ \hfill ·& g^{b^{q+2}{\theta }_1{M}_{i,2}{\theta }_1}1\cdots g^{b^{q-n+3}{M}_{i,2}{\theta }_n}\hfill \\ \hfill ⋮\\ \hfill ·& g^{b^{q+n}{M}_{i,n}{\theta }_1}·g^{b^{q-1+n}{M}_{i,n}{\theta }_2}\cdots 1{)}^{{\displaystyle \frac{1}{\beta }}}\hfill \end{array}$$

All factors can be computed from the preconditions given by the q-AsymBDHE assumption. Since the derivation matches the actual key generation process, the distribution is consistent. All attribute private key components can be successfully simulated by $\mathcal{C}$.

Finally, $\mathcal{C}$ records $\{h_l(K_{t_t},K_{t_2}):K_1,K_{t_1},K_{t_2},{\{{\{K_{p_x@k}\}}_{k\in n_{p_{max}}}\}}_{p_x\in {\mathsf{S}}_x}\}$ in ${\mathcal{L}}_{\mathsf{dk}}$.

(d) ${\mathcal{O}}^{\mathsf{TK}}$. $\mathcal{C}$ randomly samples $t_1,t_2{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and exports $K_{t_1}=h^{t_1}$, $K_{t_2}=h^{t_2}$. If $h_l(K_{t_1},K_{t_2}=h^{t_2})\in {\mathcal{L}}_{sk}$, abort and re-start the game. Otherwise, export

$$\begin{array}{c}\hfill \{\{K_{p_x@k}=H_{\mathbb{G}}{(p_x@k)}^{{\displaystyle \frac{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{\beta }}}{\}}_{k=1}^{n_{p_{max}}}{\}}_{p_x\in {\mathsf{S}}_x}\end{array}$$

And then $\mathcal{C}$ randomly samples ${\tilde{o}}_1,{\tilde{o}}_2,h_o{\leftarrow }_R{\mathbb{Z}}_p^{*}$, implicit sets

$$\begin{array}{cc}\hfill o_1& \stackrel{\mathrm{implicit}}{\Rightarrow }{o}_1={\tilde{o}}_1+{\displaystyle \frac{b^q}{h_o}}\hfill \\ \hfill o_2& \stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{o}}_2-b\hfill \end{array}$$

to simulate

$$\begin{array}{cc}\hfill {\mathsf{req}}_{o_1}=& g^{{\tilde{o}}_1}{\left(g^{b^q}\right)}^{{\displaystyle \frac{1}{h_o}}}\hfill \\ \hfill {\mathsf{req}}_{o_2}=& h^{{\tilde{o}}_2}{\left(h^b\right)}^{-1}\hfill \end{array}$$

and patch $\{({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{T}}_i,{\mathrm{req}}_i):h_o\}$ in ${\mathcal{L}}_{h_z}$.

Finally, $\mathcal{C}$ simulates

$$\begin{array}{cc}\hfill {\mathsf{req}}_1=& h^{\alpha }{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{o_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{T}}_i)}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{({\tilde{o}}_1+{\displaystyle \frac{b^q}{h_o}})({\tilde{o}}_2-b)h_o}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{({\tilde{o}}_1+{\displaystyle \frac{b^q}{h_o}})({\tilde{o}}_2-b)h_o}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{\left(h^{b{\tilde{o}}_1{h}_o}\right)}^{-1}{h}^{{\tilde{o}}_2{b}^q}{h}^{-b^{q+1}}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{\left(h^{b{\tilde{o}}_1{h}_o}\right)}^{-1}{h}^{{\tilde{o}}_2{b}^q}\hfill \end{array}$$

and records ${\mathcal{L}}_{\mathsf{TK}}\leftarrow \{h_l(K_{t_1},K_{t_2}):(t_1,t_2)\}\cup {\mathcal{L}}_{\mathsf{TK}}$.

(e) ${\mathcal{O}}^{\mathrm{req}}$.

Case 1: If queried $h_l(K_{t_1},K_{t_2})\in {\mathcal{L}}_{\mathsf{dk}}$, $\mathcal{C}$ gets the key-value tuple $\{h_l(K_{t_t},K_{t_2})$: $K_1,K_{t_1},K_{t_2},{\left\{{\left\{K_{p_x@k}\right\}}_{k=1}^{n_{p_{max}}}\right\}}_{p_x\in {\mathsf{S}}_x}\}$ from ${\mathcal{L}}_{\mathsf{dk}}$.

Next $\mathcal{C}$ sample $o_1,o_2{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and export

$$\begin{array}{cc}\hfill & {\mathsf{req}}_{o_1}=g^{o_1}\hfill \\ \hfill & {\mathsf{req}}_{o_2}=h^{o_2}\hfill \\ \hfill & {\mathsf{req}}_1=K_1·h^{o_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},T_{\mathrm{req}}^i,{\mathsf{req}}_m^i)}\hfill \end{array}$$

Case 2: If the queried $h_l(K_{t_1},K_{t_2})\in {\mathcal{L}}_{\mathsf{TK}}$, retrieve $\{h_l(K_{t_t},K_{t_2}):(t_1,t_2)\}$ from ${\mathcal{L}}_{\mathsf{TK}}$.

Next $\mathcal{C}$ randomly samples ${\tilde{o}}_1,{\tilde{o}}_2,h_o{\leftarrow }_R{\mathbb{Z}}_p^{*}$, implicit sets

$$\begin{array}{cc}\hfill o_1& \stackrel{\mathrm{implicit}}{\Rightarrow }{o}_1={\tilde{o}}_1+{\displaystyle \frac{b^q}{h_o}}\hfill \\ \hfill o_2& \stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{o}}_2-b\hfill \end{array}$$

to simulate

$$\begin{array}{cc}\hfill {\mathsf{req}}_{o_1}=& g^{{\tilde{o}}_1}{\left(g^{b^q}\right)}^{{\displaystyle \frac{1}{h_o}}}\hfill \\ \hfill {\mathsf{req}}_{o_2}=& h^{{\tilde{o}}_2}{\left(h^b\right)}^{-1}\hfill \end{array}$$

and patch $\{({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{T}}_i,{\mathrm{req}}_i):h_o\}$ in ${\mathcal{L}}_{h_z}$.

Finally, $\mathcal{C}$ can simulate

$$\begin{array}{cc}\hfill {\mathsf{req}}_1=& h^{\alpha }{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{o_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{T}}_{req}^i)}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{({\tilde{o}}_1+{\displaystyle \frac{b^q}{h_o}})({\tilde{o}}_2-b)h_o}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{({\tilde{o}}_1+{\displaystyle \frac{b^q}{h_o}})({\tilde{o}}_2-b)h_o}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b^{q+1}}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}·h^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{\left(h^{b{\tilde{o}}_1{h}_o}\right)}^{-1}{h}^{{\tilde{o}}_2{b}^q}{h}^{-b^{q+1}}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{\left(h^b\right)}^{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{h}^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{\left(h^{b{\tilde{o}}_1{h}_o}\right)}^{-1}{h}^{{\tilde{o}}_2{b}^q}\hfill \end{array}$$

(f) ${\mathcal{O}}^m$: For a decryption query on input $(C_m^i,{\sigma }_m^i)$, if there exists a tuple ${\left\{\right(e(g,h)}^{\alpha s_i},m_i,$${\left(C_{v,1}\right)}_i,{\mathsf{PK}}_i):h_i\}$ in ${\mathcal{L}}_{h_z}$, that satisfies

$$\begin{array}{cc}\hfill & g^{{\left(c_{v,2}\right)}_i}={\mathsf{PK}}_i^{h_i}·{\left(C_{v,1}\right)}_i\hfill \\ \hfill & m_i=\mathsf{SE}.\mathsf{Dec}(h_l\left(e{(g,h)}^{\alpha s_i}\right),C_m^i)\hfill \end{array}$$

return $m_i$ to the adversary $\mathcal{A}$. Otherwise, return ⊥.

Challenge $\mathcal{A}$ sends two challenge data $m_0$, $m_1$ with same length $|m_0|=|m_1|$ and a challenge secret key ${\mathsf{sk}}_{dp}^{*}$ to $\mathcal{C}$. $\mathcal{C}$ selects ${\mathsf{m}}_{\chi }$ for encryption by flipping a coin $\chi \stackrel{\$}{\leftarrow }\{0,1\}$. $\mathcal{C}$ sets

$$\begin{array}{cc}\hfill C_{fp,1}=& g^s\hfill \\ \hfill C_{fp,2}=& {\left(h^s\right)}^{-\beta }\hfill \end{array}$$

and embeds the challenge term of the Decisional q-AsymBDHE Assumption into the encrypted-payload

$$\begin{array}{c}\hfill C_m^{*}=\mathsf{SE}.\mathsf{Enc}(h_l(\mathsf{T}·e(g^{{\alpha }^{\prime }},h^s)),m_{\chi })\end{array}$$

$\mathcal{C}$ randomly samples $r_t\leftarrow {\mathbb{Z}}_p^{*}$ and simulates the ${\sigma }_m^{\chi }$:

$$\begin{array}{cc}\hfill & C_{v,1}^{*}=g^{r_t}\hfill \\ \hfill & c_{v,2}^{*}={\mathsf{sk}}_{dp}^{*}{h}_z(\mathsf{T}·e(g^{{\alpha }^{\prime }},h^s),m_{\chi },C_{v,1}^{*},g^{{\mathsf{sk}}_{dp}^{*}})+r_t\hfill \end{array}$$

$\mathcal{C}$ randomly selects ${\left\{{\gamma }_i{\leftarrow }_R{\mathbb{Z}}_p^{*}\right\}}_{j=2}^n$ and implicitly sets the secret vector as $\overrightarrow{v}={(s,sb+{\gamma }_2,\dots ,s{b}^{n-1}+{\gamma }_n)}^{\mathrm{T}}$ to simulated:

$$\begin{array}{cc}\hfill C_i=& g^{b{\mathbf{M}}_i\overrightarrow{v}}{H}_{\mathbb{G}}{\left(\tau \left[i\right]\right)}^s\hfill \\ \hfill =& g^{sb{M}_{i,1}+s{b}^2{M}_{i,2}+{\gamma }_2{M}_{i,2}+\cdots +s{b}^n{M}_{i,n}+{\gamma }_n{M}_{i,n}}\hfill \\ \hfill ·& {\left(g^s\right)}^{-v_{\tau \left[i\right]}}{g}^{-sb{M}_{i,1}}{g}^{-s{b}^2{M}_{i,2}}\cdots g^{-s{b}^n{M}_{i,n}}\hfill \\ \hfill =& {\displaystyle \prod _{j=1}^n}{g}^{s{b}^j{M}_{i,j}}{\displaystyle \prod _{j=2}^n}{g}^{b{\gamma }_j{M}_{i,j}}·{\left(g^s\right)}^{-v_{\tau \left[i\right]}}·{\displaystyle \prod _{j=1}^n}{g}^{-s{b}^j{M}_{i,j}}\hfill \\ \hfill =& {\displaystyle \prod _{j=2}^n}{g}^{b{\gamma }_j{M}_{i,j}}{\left(g^s\right)}^{-v_{\tau \left[i\right]}}\hfill \end{array}$$

This completes the simulation of all ciphertext components.

Query Phase 2 Same as Query Phase 1 except that the input of the ${\mathcal{O}}^m$ cannot be the challenge encrypted-payload $C_m^{*}$.

Guess Finally, the adversary $\mathcal{A}$ communicates its guessed value ${\chi }^{\prime }$ for $\chi$ to the simulator $\mathcal{C}$. In the case where ${\chi }^{\prime }=\chi$, $\mathcal{C}$ outputs 0 to conjecture that $\mathsf{T}=e{(g,h)}^{s{b}^{q+1}}$. Conversely, when ${\chi }^{\prime }\ne \chi$, $\mathcal{C}$ outputs 1 to infer that $\mathsf{T}=R\in {\mathbb{G}}_T$.

When the Decisional q-AsymBDHE assumption provides $\mathsf{T}=e{(g,h)}^{s{b}^{q+1}}$ to the simulator $\mathcal{C}$, $\mathcal{A}$ is participating in a genuine security game that aligns with the actual scheme. Based on this assumption, if the attacker possesses an advantage $Ad{v}_{\mathcal{A}}$ in selectively compromising the real scheme, it follows that $\mathrm{Pr}[{\chi }^{\prime }=\chi \mid \mathsf{T}=e{(g,h)}^{s{b}^{q+1}}]={\displaystyle \frac{1}{2}}+Ad{v}_{\mathcal{A}}$. This directly leads to $\mathrm{Pr}[\mathcal{C}(\overrightarrow{p},\mathsf{T}=e{(g,h)}^{s{b}^{q+1}})=0]={\displaystyle \frac{1}{2}}+Ad{v}_{\mathcal{A}}$.

In the scenario where the Decisional q-AsymBDHE Assumption supplies $\mathsf{T}=R\in {\mathbb{G}}_T$ to $\mathcal{C}$, since ${\mathsf{CT}}_{sym}^{*}=\mathsf{SE}.\mathsf{Enc}(h_l(R·e(g^s,h^{{\alpha }^{\prime }})),m_{\chi })$, the randomness of R obscures all bits of the symmetric encrypted key for $m_{\chi }$. Consequently, $\mathrm{Pr}[{\chi }^{\prime }=\chi \mid \mathsf{T}=R]={\displaystyle \frac{1}{2}}$, which implies $\mathrm{Pr}[\mathcal{C}(\overrightarrow{p},\mathsf{T}=R)=0]={\displaystyle \frac{1}{2}}$.

Thus, the difference $\mathrm{Pr}[\mathcal{C}(\overrightarrow{p},\mathsf{T}=e{(g,h)}^{s{b}^{q+1}})=0]-\mathrm{Pr}[\mathcal{C}(\overrightarrow{p},\mathsf{T}=R)=0]$ equals $Ad{v}_{\mathcal{A}}$. This demonstrates that $\mathcal{C}$ can undermine the Decisional q-AsymBDHE Assumption with a non-negligible advantage $Ad{v}_{\mathcal{A}}$. □

Theorem 2. 

If the Schnorr signature scheme is SUF-aCMA secure, the proposed scheme meets the data-authentication security defined in ${\mathsf{Exp}}^{\mathit{Pu}-\mathit{SUF}-\mathit{aCMA}}\left(\lambda \right)$ Algorithm 2.

Proof. 

The construction of the signature component ${\sigma }_m$ in ciphertext ${\mathsf{CT}}_{\sigma }$ follows the Schnorr signature paradigm. Therefore, when the Schnorr signature satisfies the SUF-aCMA, ${\sigma }_m$ also adheres to SUF-aCMA. □

Theorem 3. 

If the Asymmetric Computational Diffie–Hellman Problem (AsymCDHP) holds, the proposed scheme meets the Id-SUF-aCMA security defined in ${\mathsf{Exp}}^{\mathit{Id}-\mathit{SUF}-\mathit{aCMA}}\left(\lambda \right)$ Algorithm 3.

Definition 2. 

Asymmetric Computational Diffie–Hellman Problem (AsymCDHP): For a probabilistic polynomial-time adversary ${\mathcal{A}}_{\mathit{CDH}}$ given a challenge $({\mathsf{BP}}_{\mathrm{III}},\overrightarrow{\mathrm{\Phi }}:=g,h,g^a,g^b,h^a,h^b)$ where $a,b{\leftarrow }_R{\mathbb{Z}}_p^{*}$, it is computationally hard to compute $g^{ab}$ or $h^{ab}$ with a non-negligible probability ${ϵ}_{\mathit{CDH}}$. Specifically:

$$\begin{array}{c}\hfill \mathrm{Pr}[{\mathcal{A}}_{\mathit{CDH}}({\mathsf{BP}}_{\mathit{III}},\overrightarrow{\mathrm{\Phi }})=g^{ab}\mathit{or}{h}^{ab}]\le {ϵ}_{\mathit{CDH}}\end{array}$$

Proof. 

Suppose there exists a probabilistic polynomial-time adversary $\mathcal{A}$ that can win in ${\mathrm{Exp}}^{\mathrm{Id}-\mathrm{SUF}-\mathrm{aCMA}}\left(\lambda \right)$ Algorithm 3 with non-negligible probability. Then, a polynomial-time simulator $\mathcal{C}$ can be constructed to break AsymCDHP with non-negligible probability.

Init $\mathcal{A}$ claims the challenge ${\mathsf{id}}^{*}$.

Hash Oracle Setup These hash oracles can be adaptively queried by $\mathcal{A}$ and manipulated by $\mathcal{C}$.

(a) ${\mathcal{O}}^{H_{\mathbb{G}}}$: $\mathcal{C}$ maintains a hash-oracle table ${\mathcal{L}}_{H_{\mathbb{G}}}$ for $H_{\mathbb{G}}$. On input a functional-point bit string $(p_i:k)\in {\{0,1\}}^{*}$, if $\{(p_i:k):v_{ik}\}\in {\mathcal{L}}_{H_{\mathbb{G}}}$, $\mathcal{C}$ retrieves $v_{ik}$ from the table. Otherwise, $\mathcal{C}$ randomly selects $v_{ik}\leftarrow {\mathbb{Z}}_p^{*}$, records $\{(p_i:k):v_{ik}\}$ in ${\mathcal{L}}_{H_{\mathbb{G}}}$, and outputs $H_{\mathbb{G}}(p_i:k)=g^{v_{ik}}$.

(b) ${\mathcal{O}}^{h_z}$: On input $x_i\in {\{0,1\}}^{*}$, if $x_i\notin {\mathcal{L}}_{h_z}$, $\mathcal{C}$ randomly samples $h_i\leftarrow {\mathbb{Z}}_p^{*}$, records $\{x_i:h_i\}$ in ${\mathcal{L}}_{h_z}$, and outputs $h_i$. Otherwise, it directly outputs the corresponding $h_i$ from the table.

(c) ${\mathcal{O}}^{h_l}$: $\mathcal{C}$ maintains a hash-oracle table ${\mathcal{L}}_{h_l}$ for $h_l$. On input $x_i\in {\{0,1\}}^{*}$, if $x_i\notin {\mathcal{L}}_{h_l}$, $\mathcal{C}$ randomly samples $l_i\leftarrow {\{0,1\}}^l$, records $\{x_i:l_i\}$ in ${\mathcal{L}}_{h_l}$, and outputs $l_i$. Otherwise, it directly outputs the corresponding $l_i$ from the table.

Setup $\mathcal{C}$ samples $\beta ,{\alpha }^{\prime }{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and implicitly sets:

$$\begin{array}{c}\hfill e{(g,h)}^{\alpha }=e(g^b,h^a)·e{(g,h)}^{{\alpha }^{\prime }}\stackrel{\mathrm{implicit}}{\Rightarrow }\alpha ={\alpha }^{\prime }+ab\end{array}$$

$\mathcal{C}$ randomly samples $t_1^{*},t_2^{*}{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and calculates $K_{t_1}^{*}=h^{t_1^{*}}$, $K_{t_2}^{*}=h^{t_2^{*}}$, then patches $\{(K_{t_1}^{*},K_{t_2}^{*}):{\mathsf{id}}^{*}\}\in {\mathcal{L}}_{h_l}$. $\mathcal{C}$ opens the public parameters $g^b$,$h^{\beta }$, $e{(g,h)}^{\alpha }$ to $\mathcal{A}$.

Adaptive Queries Phase $\mathcal{A}$ can issue following queries to $\mathcal{C}$.

(a) ${\mathcal{O}}^{\mathsf{dk}}\left({\mathsf{S}}_i\right)$. $\mathcal{C}$ randomly selects $h_i,{\tilde{t}}_1,t_2{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and implicitly sets:

$$\begin{array}{c}\hfill t_1\stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{t}}_1-{\displaystyle \frac{a}{h_i}}\end{array}$$

Since ${\tilde{t}}_1$ is uniformly sampled from ${\mathbb{Z}}_p^{*}$, $t_1$ is also uniformly random in ${\mathbb{Z}}_p^{*}$, consistent with the distribution of t in real key generation algorithm. Then simulate:

$$\begin{array}{cc}\hfill K_{t_1}=& h^{t_1}=h^{{\tilde{t}}_1}{\left(h^a\right)}^{-{\displaystyle \frac{1}{h_i}}}\hfill \\ \hfill K_{t_2}=& h^{t_2}\hfill \end{array}$$

If the tuple $(K_{t_1},K_{t_2})$ is identical to $(K^{*}{t}_1,K_{t_2}^{*})$, restart this query simulation. Otherwise, $\mathcal{C}$ patches $\{(K_{t_1},K_{t_2}):h_i\}$ in ${\mathcal{L}}_{h_z}$.

Next $\mathcal{C}$ simulates

$$\begin{array}{cc}\hfill K_1=& h^{\alpha }{h}^{b(t_1+t_2)h_z\left(K_{t_1,t_2}\right)}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{ab}{h}^{b{\tilde{t}}_1{h}_i}{h}^{-ab}{h}^{b{t}_2{h}_i}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b{\tilde{t}}_1{h}_i}{h}^{b{t}_2{h}_i}\hfill \end{array}$$

and $\forall k=1\to n_{p_{max}},p_i\in {\mathsf{S}}_i$, simulate

$$\begin{array}{cc}\hfill K_{p_i@k}=& H_{\mathbb{G}}{(p_i@k)}^{{\displaystyle \frac{(t_1+t_2)h_z(K_{t_1},K_{t_2})}{\beta }}}\hfill \\ \hfill =& {\left(g^{{\tilde{t}}_1{h}_i}{\left(g^a\right)}^{-1}{h}^{t_2{h}_i}\right)}^{{\displaystyle \frac{v_{ik}}{\beta }}}\hfill \end{array}$$

(b) ${\mathcal{O}}^{\mathsf{Td}}({\mathsf{S}}_i,{\mathrm{msg}}^i)$: $\mathcal{C}$ randomly chooses ${\tilde{o}}_1,{\tilde{o}}_2,h_o{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and implicit sets

$$\begin{array}{cc}\hfill o_1& \stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{o}}_1-{\displaystyle \frac{a}{h_o}}\hfill \\ \hfill o_2& \stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{o}}_2+b\hfill \end{array}$$

then simulate

$$\begin{array}{cc}\hfill {\mathsf{req}}_{o_1}& =g^{o_1}=g^{{\tilde{o}}_1}{\left(g^a\right)}^{-{\displaystyle \frac{1}{h_o}}}\hfill \\ \hfill {\mathsf{req}}_{o_2}& =h^{o_2}=h^{{\tilde{o}}_2}{h}^b\hfill \end{array}$$

Next $\mathcal{C}$ patches $\{({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{msg}}^i):h_o\}\in {\mathcal{L}}_{h_z}$ and simulates

$$\begin{array}{cc}\hfill {\mathsf{req}}_1=& h^{\alpha }{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_1}^{*})}{h}^{o_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{msg}}^i)}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{ab}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_1}^{*})}{h}^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{h}^{b{\tilde{o}}_1{h}_o}{\left(h^a\right)}^{-{\tilde{o}}_2}{h}^{-ab}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_1}^{*})}{h}^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{h}^{b{\tilde{o}}_1{h}_o}{\left(h^a\right)}^{-{\tilde{o}}_2}\hfill \end{array}$$

Then $\forall k=1\to n_{p_{max}},p_i\in {\mathsf{S}}_i$, simulate

$$\begin{array}{cc}\hfill K_{p_i@k}=& H_{\mathbb{G}}{(p_i@k)}^{{\displaystyle \frac{(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_2}^{*})}{\beta }}}\hfill \end{array}$$

$\mathcal{C}$ records $({\mathrm{msg}}^i,{\mathsf{req}}_1)\to {\mathcal{L}}_{\mathrm{TK}}$.

(e) ${\mathcal{O}}^{\mathsf{req}}\left({\mathrm{msg}}^i\right)$: $\mathcal{C}$ randomly chooses ${\tilde{o}}_1,{\tilde{o}}_2,h_o{\leftarrow }_R{\mathbb{Z}}_p^{*}$ and implicit sets

$$\begin{array}{cc}\hfill o_1& \stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{o}}_1-{\displaystyle \frac{a}{h_o}}\hfill \\ \hfill o_2& \stackrel{\mathrm{implicit}}{\Rightarrow }{\tilde{o}}_2+b\hfill \end{array}$$

then simulate

$$\begin{array}{cc}\hfill {\mathsf{req}}_{o_1}& =g^{o_1}=g^{{\tilde{o}}_1}{(g^a)}^{-{\displaystyle \frac{1}{h_o}}}\hfill \\ \hfill {\mathsf{req}}_{o_2}& =h^{o_2}=h^{{\tilde{o}}_2}{h}^b\hfill \end{array}$$

Next $\mathcal{C}$ patches $\{({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{msg}}^i):h_o\}\in {\mathcal{L}}_{h_z}$ and simulates

$$\begin{array}{cc}\hfill {\mathsf{req}}_1=& h^{\alpha }{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_1}^{*})}{h}^{o_1{o}_2{h}_z({\mathsf{req}}_{o_1},{\mathsf{req}}_{o_2},{\mathrm{msg}}^i)}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{ab}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_1}^{*})}{h}^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{h}^{b{\tilde{o}}_1{h}_o}{(h^a)}^{-{\tilde{o}}_2}{h}^{-ab}\hfill \\ \hfill =& h^{{\alpha }^{\prime }}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_1}^{*})}{h}^{{\tilde{o}}_1{\tilde{o}}_2{h}_o}{h}^{b{\tilde{o}}_1{h}_o}{(h^a)}^{-{\tilde{o}}_2}\hfill \end{array}$$

$\mathcal{C}$ records $({\mathrm{msg}}^i,{\mathsf{req}}_1)\to {\mathcal{L}}_{\mathrm{req}}$.

Forgery Output By assumption, $\mathcal{A}$ can forge a valid trapdoor ${\mathsf{TK}}^{*}$ or the request-proof ${\mathsf{prf}}_{\mathrm{req}}^{*}$ for ${\mathrm{msg}}^{*}$ that has not been queried.

By replaying the interaction with different choices for the random oracle ${\mathcal{O}}^{h_z}$, assigning different values to $h_z({\mathsf{req}}_{o_1}^{*},{\mathsf{req}}_{o_2}^{*},{\mathrm{msg}}^{*})\to {\left(h_o^{*}\right)}_1,{\left(h_o^{*}\right)}_2$. $\mathcal{C}$ obtains two valid forgeries ${\mathsf{Td}}_1^{\prime }$ and ${\mathsf{Td}}_2^{\prime }$ from $\mathcal{A}$:

$$\begin{array}{cc}\hfill {\left({\mathsf{req}}_1^{*}\right)}_1& =h^{({\alpha }^{\prime }+ab)}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_2}^{*})}{h}^{o_1{o}_2{\left(h_o^{*}\right)}_1}\hfill \\ \hfill {\left({\mathsf{req}}_1^{*}\right)}_2& =h^{({\alpha }^{\prime }+ab)}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_2}^{*})}{h}^{o_1{o}_2{\left(h_o^{*}\right)}_2}\hfill \end{array}$$

$\mathcal{C}$ then computes:

$$\begin{array}{c}\hfill {\displaystyle \frac{{\left({\mathsf{req}}^{*}\right)}_1}{{\left({\mathsf{req}}_1^{*}\right)}_2}}={\left(h^{o_1{o}_2}\right)}^{{\left(h_o^{*}\right)}_1-{\left(h_o^{*}\right)}_2}\Rrightarrow h^{o_1{o}_2}={({\displaystyle \frac{{\left({\mathsf{req}}^{*}\right)}_1}{{\left({\mathsf{req}}_1^{*}\right)}_2}})}^{{\displaystyle \frac{1}{{\left(h_o^{*}\right)}_1-{\left(h_o^{*}\right)}_2}}}\end{array}$$

Finally, using ${\left({\mathsf{req}}^{*}\right)}_1,t_1^{*},t_2^{*}$ and the exported $h^{o_1{o}_2}$, $\mathcal{C}$ solves the AsymCDHP as:

$$\begin{array}{cc}\hfill h^{ab}=& {\left({\mathsf{req}}_1^{*}\right)}_1·{\left(h^{{\alpha }^{\prime }}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_2}^{*})}{h}^{o_1{o}_2{\left(h_o^{*}\right)}_1}\right)}^{-1}\hfill \\ \hfill =& {\left({\mathsf{req}}_1^{*}\right)}_1·{\left(h^{{\alpha }^{\prime }}{h}^{b(t_1^{*}+t_2^{*})h_z(K_{t_1}^{*},K_{t_2}^{*})}{\left({\displaystyle \frac{{\left({\mathsf{req}}^{*}\right)}_1}{{\left({\mathsf{req}}_1^{*}\right)}_2}}\right)}^{{\displaystyle \frac{{\left(h_o^{*}\right)}_1}{{\left(h_o^{*}\right)}_1-{\left(h_o^{*}\right)}_2}}}\right)}^{-1}\hfill \end{array}$$

□

6. Comparison and Evaluation

This section evaluates ePoFSC from both theoretical and empirical perspectives. Specifically, we first analyze its asymptotic computation, communication, and storage costs, and then report simulation-based measurements and a real-world medical image sharing case study.

6.1. Theoretical Analysis

This subsection compares ePoFSC with representative fine-grained access-control schemes in terms of computational complexity and communication/storage overhead. The comparison focuses on dominant cryptographic operations, including bilinear pairings, group exponentiations, hash operations, and the sizes of transmitted or stored cryptographic materials.

The notation used throughout the comparison is summarized in

Table 3. Notations for comparison.

Notations	Meaning
$\left\{\begin{array}{c}\left|\mathbb{G}\right|\hfill \\ \left|\mathbb{H}\right|\hfill \\ \left|\right({\mathbb{G}}_T\left)\right|\hfill \\ |{\mathbb{Z}}_p|\hfill \end{array}\right.$	Element size of group $\left\{\begin{array}{c}\mathbb{G}\hfill \\ \mathbb{H}\hfill \\ {\mathbb{G}}_T\hfill \\ {\mathbb{Z}}_p\hfill \end{array}\right.$ in ${\mathsf{BP}}_{\mathrm{III}}$
${\mathsf{P}}_{\mathrm{III}}$	A pairing operation of ${\mathsf{BP}}_{\mathrm{III}}$
$\left\{\begin{array}{c}{\mathsf{M}}_1/{\mathsf{E}}_1\hfill \\ {\mathsf{M}}_2/{\mathsf{E}}_2\hfill \\ {\mathsf{M}}_T/{\mathsf{E}}_T\hfill \end{array}\right.$	A group multiplication/exponentiation operation of $\left\{\begin{array}{c}\mathbb{G}\hfill \\ \mathbb{H}\hfill \\ {\mathbb{G}}_T\hfill \end{array}\right.$ in ${\mathsf{BP}}_{\mathrm{III}}$
$\left\{\begin{array}{c}{H}_{\mathbb{G}}\hfill \\ H_{\mathbb{H}}\hfill \end{array}\right.$	A hash-to-curve operation of $\left\{\begin{array}{c}\mathbb{G}\hfill \\ \mathbb{H}\hfill \end{array}\right.$
$\left\{\begin{array}{c}\mathsf{SE}.\mathsf{Enc}\hfill \\ \mathsf{SE}.\mathsf{Dec}\hfill \end{array}\right.$	$\left\{\begin{array}{c}\mathrm{Encryption}\hfill \\ \mathrm{Decryption}\hfill \end{array}\right.$ operation of the symmetric encryption $\mathsf{SE}$
$h_l$,$h_z$	Hash operations $h_l:{\{0,1\}}^{*}\to {\{0,1\}}^l$ and $h_z:{\{0,1\}}^{*}\to {\mathbb{Z}}_p^{*}$
$n_{p_{max}}$	Max size of each function point
$\left|T\right|$	Timestamp size
$l,n$	The number of rows and columns of LSSS matrix ${\mathbf{M}}_{l\times n}$
$|{\mathsf{S}}_{dr}|$	The number of points in functional-points set ${\mathsf{S}}_{dr}$
$\left|I\right|$	Cardinality of the matching set I
$|h_l|$	Output size of $h_l$
$|p_i|$	Size of permission point
$\left|\mathrm{id}\right|$	Size of identity
$|C_m|$	Size of symmetrically encrypted data

.

We first compare the computational cost of the main algorithms in

Table 4. Theoretical complexity comparison.

Scheme	${\mathsf{Enc}}_{\mathit{m}}$	${\mathsf{KeyGen}}_{\mathbf{dr}}$	$\mathsf{ReqGen}$	$\mathsf{ReqVfy}$	$\mathsf{ODec}$	${\mathsf{Retrieval}}_{\mathbf{dr}}$
[23]	${\mathsf{E}}_T+3h_l+2l{\mathsf{E}}_T+3l{\mathsf{E}}_2+l{\mathsf{M}}_2+l{\mathsf{M}}_T+\mathsf{SE}.\mathsf{Enc}$	$H_{\mathbb{G}}+h_l+2|{\mathsf{S}}_{dr}|{\mathsf{E}}_1+\left|{\mathsf{S}}_{dr}\right|{\mathsf{M}}_1$	$|{\mathsf{S}}_{dr}|{\mathsf{E}}_1+h_z+2{\mathsf{E}}_2$	$2{\mathsf{E}}_2+h_z+(2+2|{\mathsf{S}}_{dr}\left|\right){\mathsf{P}}_{\mathrm{III}}+h_l+H_{\mathbb{G}}+\left|{\mathsf{S}}_{dr}\right|{\mathsf{M}}_T$	$3\left(\right|I|-1){\mathsf{M}}_T+2\left|I\right|{\mathsf{P}}_{\mathrm{III}}$	${\mathsf{E}}_T+2{\mathsf{M}}_T+h_z+{\mathsf{E}}_T+h_l+\mathsf{SE}.\mathsf{Dec}$
[16] (Waters)	${\mathsf{M}}_T+{\mathsf{E}}_T+l{H}_{\mathbb{H}}+2l{\mathsf{E}}_2+l{\mathsf{M}}_2+l{\mathsf{E}}_1+2{\mathsf{E}}_2+h_z+\mathsf{SE}.\mathsf{Enc}$	$3{\mathsf{E}}_1+{\mathsf{M}}_1+\left|{\mathsf{S}}_{dr}\right|(H_{\mathbb{H}}+{\mathsf{E}}_2)$	$|{\mathsf{S}}_{dr}|{\mathsf{E}}_2+2{\mathsf{E}}_1$	-	${\mathsf{M}}_2+(1+2|I\left|\right){\mathsf{P}}_{\mathrm{III}}+\left(2\right|I|-1){\mathsf{M}}_T$	${\mathsf{M}}_T+{\mathsf{E}}_T+2{\mathsf{M}}_2+2{\mathsf{E}}_2+h_z+\mathsf{SE}.\mathsf{Dec}$
[16] (RW)	${\mathsf{M}}_T+{\mathsf{E}}_T+2{\mathsf{E}}_2+4l{\mathsf{E}}_1+2l{\mathsf{M}}_1+l{\mathsf{E}}_2+h_z+\mathsf{SE}.\mathsf{Enc}$	$3{\mathsf{E}}_1+{\mathsf{M}}_1+{\mathsf{E}}_2+2|{\mathsf{S}}_{dr}|{\mathsf{E}}_1+|{\mathsf{S}}_{dr}|{\mathsf{M}}_1+\left|{\mathsf{S}}_{dr}\right|{\mathsf{E}}_2$	${\mathsf{E}}_1+|{\mathsf{S}}_{dr}|{\mathsf{E}}_1+{\mathsf{E}}_2+\left|{\mathsf{S}}_{dr}\right|{\mathsf{E}}_2$	-	${\mathsf{M}}_2+\left(3\right|I|+1){\mathsf{P}}_{\mathrm{III}}+\left(3\right|I|-1){\mathsf{M}}_T$	${\mathsf{M}}_T+{\mathsf{E}}_T+2{\mathsf{M}}_2+2{\mathsf{E}}_2+h_z+\mathsf{SE}.\mathsf{Dec}$
[10]	$3{\mathsf{E}}_2+2{\mathsf{E}}_T+2{\mathsf{M}}_T+(6l+6ln)H_{\mathbb{G}}+(6l+6ln){\mathsf{E}}_1+(3l+6ln){\mathsf{M}}_1+\mathsf{SE}.\mathsf{Enc}$	$3{\mathsf{E}}_2+2|{\mathsf{S}}_{dr}|(3H_{\mathbb{G}}+4{\mathsf{E}}_1)+\left|{\mathsf{S}}_{dr}\right|{\mathsf{E}}_1+2(3H_{\mathbb{G}}+5{\mathsf{E}}_1)+2{\mathsf{E}}_1$	-	-	-	$\left(6\right|I|-3){\mathsf{M}}_1+6{\mathsf{M}}_T+6{\mathsf{P}}_{\mathrm{III}}+\mathsf{SE}.\mathsf{Dec}$
[24]	$2h_l+{\mathsf{E}}_T+2{\mathsf{E}}_2+2l{\mathsf{E}}_1+l{\mathsf{E}}_2+l{\mathsf{M}}_1+l{H}_{\mathbb{G}}+{\mathsf{E}}_1+h_z+\mathsf{SE}.\mathsf{Enc}$	$H_{\mathbb{G}}+3{\mathsf{E}}_1+2{\mathsf{M}}_1+\left|{\mathsf{S}}_{dr}\right|(H_{\mathbb{G}}+{\mathsf{E}}_1)+{\mathsf{E}}_2$	${\mathsf{E}}_2+h_z+{\mathsf{E}}_1+{\mathsf{M}}_1$	$(3+2|{\mathsf{S}}_{dr}\left|\right){\mathsf{P}}_{\mathrm{III}}+2{\mathsf{M}}_T+{\mathsf{M}}_2+{\mathsf{E}}_2+h_z+\left(\right|{\mathsf{S}}_{dr}|+1)H_{\mathbb{G}}$	${\mathsf{E}}_T+h_z+\left|I\right|({\mathsf{E}}_1+{\mathsf{M}}_1)+\left(2\right|I|+1){\mathsf{M}}_T+\left(2\right|I|+3){\mathsf{P}}_{\mathrm{III}}$	${\mathsf{E}}_T+{\mathsf{M}}_T+5{\mathsf{E}}_1+2{\mathsf{M}}_1+2h_z+2h_l+\mathsf{SE}.\mathsf{Dec}$
ePoFSC	${\mathsf{SigCry}}_f:\mathsf{SE}.\mathsf{Enc}+h_l+{\mathsf{E}}_T+{\mathsf{E}}_2+(2l+2){\mathsf{E}}_1+l{H}_{\mathbb{G}}+h_z$	$3{\mathsf{E}}_2+h_z+{\mathsf{M}}_2+(H_{\mathbb{G}}+{\mathsf{E}}_1)\left|{\mathsf{S}}_{dr}\right|n_{p_{max}}$	$2{\mathsf{E}}_2+{\mathsf{E}}_1+{\mathsf{M}}_2+h_z$	$3{\mathsf{P}}_{\mathrm{III}}+{\mathsf{M}}_2+{\mathsf{E}}_2+{\mathsf{E}}_1+2{\mathsf{M}}_T+2h_z$	$4{\mathsf{P}}_{\mathrm{III}}+{\mathsf{E}}_T+2h_z+2{\mathsf{M}}_T+{\mathsf{M}}_2+{\mathsf{E}}_2+2\left(\right|I|-1){\mathsf{M}}_1$	${\mathsf{E}}_T+{\mathsf{M}}_T+h_l+\mathsf{SE}.\mathsf{Dec}+2{\mathsf{E}}_1+{\mathsf{M}}_1+h_z$

. The comparison covers data encapsulation ${\mathsf{Enc}}_m$, requester key generation ${\mathsf{KeyGen}}_{dr}$, request generation $\mathsf{ReqGen}$, request verification $\mathsf{ReqVfy}$, outsourced decryption $\mathsf{ODec}$, and requester-side retrieval ${\mathsf{Retrieval}}_{dr}$. A dash indicates that the corresponding functionality is not provided by the scheme, rather than that the operation has zero cost.

As shown in Table 4, the encryption cost of all schemes is mainly determined by the policy size. In particular, most constructions introduce terms that grow linearly with the number of LSSS rows l. CP-FAME [10] additionally contains $l\times n$-dependent terms, which makes its encryption cost sensitive to both the row and column dimensions of the access matrix. In contrast, ePoFSC keeps the data encapsulation cost linear in l and does not introduce an $l\times n$-scale term. Its additional operations are used to provide publisher authentication and functional signcryption, which are required by the proposed accountable access-control workflow.

For ${\mathsf{KeyGen}}_{dr}$, most compared schemes have a cost that grows linearly with the requester functional-point set size $|{\mathsf{S}}_{dr}|$. ePoFSC has a higher offline key-generation cost, namely $\mathrm{\Omega }\left(\right|{\mathsf{S}}_{dr}\left|n_{p_{\max }}\right)$, because the TA generates permission-point key components for all indexed encodings associated with each requester privilege point. Nevertheless, this cost is incurred only in the offline TA-side key-generation phase. It therefore does not affect the online complexity of data encryption and upload, access request generation, request verification, outsourced decryption, or requester-side retrieval.

The advantage of ePoFSC is more evident in the online request workflow. In AOD-MACPABE [23], both $\mathsf{ReqGen}$ and $\mathsf{ReqVfy}$ contain terms linear in $|{\mathsf{S}}_{dr}|$. In FTV-AOD-DR-CPABE [24], $\mathsf{ReqGen}$ is constant, but $\mathsf{ReqVfy}$ still includes $|{\mathsf{S}}_{dr}|$-dependent pairing and hash-to-curve operations. The Waters and RW variants in [16] do not provide an explicit request-verification algorithm, and CP-FAME [10] does not support the outsourced request workflow considered here. By contrast, ePoFSC achieves constant complexity for both $\mathsf{ReqGen}$ and $\mathsf{ReqVfy}$. Specifically, $\mathsf{ReqGen}$ only requires two ${\mathsf{E}}_2$ operations, one ${\mathsf{E}}_1$ operation, one ${\mathsf{M}}_2$ operation, and one $h_z$ operation. Similarly, $\mathsf{ReqVfy}$ uses a fixed number of pairings, exponentiations, multiplications, and hash operations. Therefore, the online request cost of ePoFSC is independent of $|{\mathsf{S}}_{dr}|$.

For outsourced decryption, the main performance bottleneck is usually the number of pairing operations that scale with the matching set size $\left|I\right|$. AOD-MACPABE, the Waters variant, the RW variant, and FTV-AOD-DR-CPABE all contain $\left|I\right|$-dependent pairing terms in $\mathsf{ODec}$. In ePoFSC, however, the number of pairing operations is fixed at four, and the number of exponentiations is also independent of $\left|I\right|$. The only $\left|I\right|$-dependent part is $2\left(\right|I|-1){\mathsf{M}}_1$, which consists of lightweight group multiplications. This design separates expensive bilinear-pairing operations from policy-dependent aggregation, thereby reducing the marginal outsourced-decryption cost as the matching set grows.

For requester-side retrieval, ePoFSC also keeps the final recovery cost constant with respect to both $|{\mathsf{S}}_{dr}|$ and $\left|I\right|$. The requester performs only a small fixed number of operations, including one ${\mathsf{E}}_T$, one ${\mathsf{M}}_T$, two ${\mathsf{E}}_1$, one ${\mathsf{M}}_1$, one $h_l$, one $h_z$, and one symmetric decryption operation. This is important for mobile edge cloud scenarios, where requesters may have limited computation capability and should not bear policy-dependent decryption overhead.

We next compare the size of the main cryptographic materials in

Table 5. Size comparison.

Scheme	${\mathsf{CT}}_{\mathit{\sigma }}$	${\mathsf{dk}}_{\mathbf{dr}}$	${\mathsf{TK}}_{\mathbf{cah}}$/${\mathsf{prf}}_{\mathbf{req}}$	${\mathsf{PDC}}_{\mathit{c}}$
[23]	$|h_l|+l|{\mathbb{G}}_T|+2l|\mathbb{H}|+l|p_i|+|C_m|$	$\left(\right|{\mathsf{S}}_{dr}|+1)\left|\mathbb{G}\right|+\left|\mathbb{H}\right|$	${\mathsf{prf}}_{\mathrm{req}}:2|{\mathbb{Z}}_p|+|{\mathsf{S}}_{dr}\left|\right|\mathbb{G}|+|\mathrm{id}|+|T|+|\mathbb{G}|+2|\mathbb{H}|+|{\mathsf{S}}_{dr}\left|\right|p_i|$	$3|{\mathbb{G}}_T|+2|h_l|$
[16] (Waters)	$2\left|\mathbb{H}\right|+2|{\mathbb{Z}}_p|+|{\mathbb{G}}_T|+l|\mathbb{G}|+l|\mathbb{H}|+l|p_i|+|C_m|$	$2\left|\mathbb{G}\right|+|{\mathsf{S}}_{dr}\left|\right|\mathbb{H}|$	$\mathsf{TK}:2\left|\mathbb{G}\right|+|{\mathsf{S}}_{dr}\left|\right|\mathbb{H}|+|{\mathsf{S}}_{dr}\left|\right|p_i|$	$2|{\mathbb{G}}_T|$
[16] (RW)	$2\left|\mathbb{H}\right|+2|{\mathbb{Z}}_p|+|{\mathbb{G}}_T|+2l|\mathbb{G}|+l|\mathbb{H}|+l|p_i|+|C_m|$	$(1+|{\mathsf{S}}_{dr}\left|\right)\left(\right|\mathbb{G}|+\left|\mathbb{H}\right|)$	$\mathsf{TK}:(1+|{\mathsf{S}}_{dr}\left|\right)\left(\right|\mathbb{G}|+|\mathbb{H}\left|\right)+|{\mathsf{S}}_{dr}\left|\right|p_i|$	$2|{\mathbb{G}}_T|$
[10]	$3\left|\mathbb{H}\right|+3l\left|\mathbb{G}\right|+|{\mathbb{G}}_T|+l|p_i|+|C_m|$	$3\left|\mathbb{H}\right|+3\left|\mathbb{G}\right|+3|{\mathsf{S}}_{dr}\left|\right|\mathbb{G}|$	-	-
[24]	$l|p_i|+|h_l|+2|\mathbb{H}|+l|\mathbb{H}|+l|\mathbb{G}|+l|{\mathbb{Z}}_p|+|\mathrm{id}|+2|{\mathbb{Z}}_p|+|\mathbb{G}|$	$\left|\mathrm{id}\right|+\left|\mathbb{G}\right|+\left|\mathbb{H}\right|+|{\mathsf{S}}_{dr}\left|\right|\mathbb{G}|$	$\mathsf{TK}:\left|T\right|+\left|\mathrm{id}\right|+|{\mathsf{S}}_{dr}\left|\right|p_i|+2|\mathbb{H}|+|\mathbb{G}|+|{\mathsf{S}}_{dr}\left|\right|\mathbb{G}|$	$|h_l|+2|{\mathbb{G}}_T|+|\mathrm{id}|+2|{\mathbb{Z}}_p|$
ePoFSC	$l|p_i|+2|\mathbb{G}|+|\mathbb{H}|+l|\mathbb{G}|+|\mathbb{G}|+|{\mathbb{Z}}_p|+|C_m|$	$3\left|\mathbb{H}\right|+|{\mathsf{S}}_{dr}|n_{p_{max}}\left|\mathbb{G}\right|$	$\mathsf{TK}:|h_l|+|{\mathsf{S}}_{dr}|n_{p_{max}}\left|\mathbb{G}\right|$; ${\mathsf{prf}}_{\mathrm{req}}:4\left|\mathbb{H}\right|+\left|\mathbb{G}\right|+\left|T\right|$	$2|{\mathbb{G}}_T|+|\mathbb{G}|+|{\mathbb{Z}}_p|$

. The comparison includes the protected ciphertext ${\mathsf{CT}}_{\sigma }$, the requester decryption key ${\mathsf{dk}}_{dr}$, the transformation key $\mathsf{TK}$, the request proof ${\mathsf{prf}}_{\mathrm{req}}$, and the partial decryption ciphertext ${\mathsf{PDC}}_c$. These terms determine the upload cost, storage overhead, edge-cache cost, request communication load, and requester-side download cost.

From Table 5, the ciphertext size of all schemes grows linearly with the policy-row parameter l, because each attribute point in LSSS must be encoded into ciphertext components. Therefore, the storage cost at the CeDS and the synchronization cost between the CeDS and EHN remain proportional to the access-policy size. The requester key size of ePoFSC is larger than that of several baselines because ${\mathsf{dk}}_{dr}$ contains $|{\mathsf{S}}_{dr}|n_{p_{\max }}$ group elements.

The main communication advantage of ePoFSC lies in the request proof ${\mathsf{prf}}_{\mathrm{req}}$. In AOD-MACPABE, the Waters variant, the RW variant, and FTV-AOD-DR-CPABE, the request or transformation material contains components that grow with $|{\mathsf{S}}_{dr}|$. Thus, the request communication load increases with the number of requester privilege points. In contrast, ePoFSC only transmits four elements in $\mathbb{H}$, one element in $\mathbb{G}$, and one timestamp T in ${\mathsf{prf}}_{\mathrm{req}}$. Hence, its request proof has constant size and is independent of $|{\mathsf{S}}_{dr}|$.

The partial decryption ciphertext ${\mathsf{PDC}}_c$ of ePoFSC contains two elements in ${\mathbb{G}}_T$, one element in $\mathbb{G}$, and one scalar in ${\mathbb{Z}}_p$. This size is comparable to the compact partial-decryption outputs of the baseline outsourced-decryption schemes, while additionally supporting authenticated and verifiable retrieval.

Overall, ePoFSC trades higher offline key material $\mathsf{dk}$ for constant-size request generation, constant-size request proof, fixed pairing cost in outsourced decryption, and constant requester-side retrieval cost. This tradeoff is suitable for mobile edge cloud data sharing, where online latency and requester-side overhead are more critical than offline TA-side preprocessing.

6.2. Simulation Evaluation

This subsection reports implementation-level measurements of ePoFSC and the baseline schemes under consistent cryptographic parameters and hardware settings. The evaluation focuses on communication overhead, execution latency, and peak memory consumption in the data encapsulation, request generation, outsourced decryption, and final recovery phases.

Table 6. Experimental environment.

Environment	Setting
DR&DP	Xiaomi 13 smartphone powered by a Qualcomm Snapdragon 8 Gen 2 processor, equipped with 12 GB LPDDR5X RAM, and running the Android operating system.
EHN	Personal computer with an AMD Ryzen 7 8745H processor with Radeon 780M Graphics (3.80 GHz), 16 GB RAM, and Windows 11 25H2.
CeDS	AutoDL cloud server equipped with an Intel Xeon Platinum 8255C CPU and 40 GB RAM.

reports the experimental environment. We use MIRACL-core (C++ branch) (https://github.com/miracl/core, accessed on 30 June 2026) as the cryptographic library. For the cryptographic setting, ${\mathsf{BP}}_{\mathrm{III}}$ is instantiated with BLS12-381 [29], $h_l$ is instantiated with SHA-256, and $H_{\mathbb{G}}$ follows RFC 9380 [30] to preserve the required hash-to-curve security properties. Therefore, $|h_l|=32\mathrm{bytes}$, $|{\mathbb{Z}}_p|=32\mathrm{bytes}$, $\left|\mathbb{G}\right|\approx 92\mathrm{bytes}$, $\left|\mathbb{H}\right|\approx 192\mathrm{bytes}$, and $|{\mathbb{G}}_T|\approx 576\mathrm{bytes}$. We set $\left|\mathrm{id}\right|=|p_i|=|T|=32\mathrm{bytes}$. The simulation compares ePoFSC with AOD-MACPABE [23], CfpComOD-WatersCPABE [16], CfpComOD-RWCPABE [16], CP-FAME [10], and FTV-AOD-DR-CPABE [24]. All schemes are instantiated over the asymmetric pairing setting ${\mathsf{BP}}_{\mathrm{III}}$ for a fair comparison.

Figure 8 reports the storage and communication overhead of different schemes.

As shown in Figure 8a, the ciphertext header size of all schemes grows nearly linearly with the number of controlling points, and our proposed ePoFSC achieves the minimal ciphertext header overhead across all benchmarks. Specifically, when the number of controlling points reaches 30, ePoFSC only consumes 4.25 KB. By contrast, CfpComOD-WatersCPABE, CfpComOD-RWCPABE, AOD-MACPABE, FTV-AOD-DR-CP-ABE, and CP-FAME incur 10.38 KB, 13.19 KB, 29.09 KB, 10.89 KB, and 9.56 KB, which corresponds to overhead reductions of 59.1%, 67.8%, 85.4%, 61.0%, and 55.5% brought by ePoFSC, respectively.

Figure 8b plots the response header size versus varying quantities of encrypted responses. We observe a linear growth trend for all schemes as each encrypted response introduces a fixed-size header segment. Again, ePoFSC yields the smallest response header overhead among all competing methods. For 100 encrypted responses, ePoFSC occupies merely 125.00 KB, whereas CfpComOD-WatersCPABE, CfpComOD-RWCPABE, AOD-MACPABE, FTV-AOD-DR-CP-ABE, and CP-FAME consume 156.25 KB, 156.25 KB, 175.00 KB, 132.81 KB, and 956.25 KB, respectively.

Figure 8c investigates the request size with an increasing number of attributes contained in the requester permission set. The request size of ePoFSC is fixed at 1.19 KB throughout the experiment owing to its independence from attribute counts. On the contrary, the request overhead of most baseline schemes rises linearly with attribute quantity, with CP-FAME as the only exception. Despite possessing the minimal request size in this scenario, CP-FAME lacks the support of outsourced decryption, which greatly limits its practical applicability in a mobile-edge scenario.

Figure 8d further analyzes the request package overhead under different volumes of requested ciphertext data. All schemes exhibit linear overhead growth as the number of data requests rises, yet ePoFSC holds a much gentler growth slope. When handling 100 requested ciphertexts, the overhead of ePoFSC is only 2.44 KB.

Overall, the experimental results demonstrate that our ePoFSC framework maintains persistently low ciphertext and request communication overhead, alongside moderate and well-scalable response overhead.

Figure 9 shows the runtime of the data encapsulation phase under different numbers of attribute points in the access policy. The runtime of all schemes increases almost linearly as the policy size grows. This is expected because a larger access policy requires more group operations and hash-related computations during encapsulation. Among the compared schemes, ePoFSC has the lowest runtime over the whole tested range. When the number of attribute points increases from 3 to 30, the runtime of ePoFSC increases from 5.67 ms to 34.29 ms. The growth is smooth and slower than the other schemes. FTV-AOD-DR-CP-ABE is the closest baseline, increasing from 10.77 ms to 75.60 ms. AOD-MACPABE has the largest runtime in this phase and reaches 139.79 ms.

Figure 10 reports the runtime of the data-retrieval phase, including request generation, request auditing, outsourced decryption, and final retrieval.

Figure 10a shows the runtime of request generation under different numbers of attribute points in the DR permission set. The request generation costs of CfpComOD-WatersCPABE, CfpComOD-RWCPABE, and AOD-MACPABE increase almost linearly as the permission set becomes larger. This is because these schemes require additional exponentiation operations for the increasing number of attributes. In contrast, ePoFSC remains nearly constant at about 8.48 ms over the whole range. This indicates that the request generation procedure of ePoFSC is insensitive to the permission-set size in this experiment. FTV-AOD-DR-CP-ABE also keeps a constant runtime and is slightly lower than ePoFSC in this phase.

Figure 10b reports the runtime of request auditing. The auditing costs of AOD-MACPABE and FTV-AOD-DR-CP-ABE grow linearly with the number of attribute points. Their curves rise steadily because request auditing involves matching-set-related cryptographic operations. ePoFSC keeps a stable runtime of about 13.79 ms, showing that the auditing cost of ePoFSC does not increase with the tested attribute-point number. This property is important for systems with frequent access requests, since the verifier can process requests with predictable latency.

Figure 10c presents the runtime of outsourced decryption. The baseline schemes show clear linear growth as the size of the matching set increases. CfpComOD-RWCPABE has the highest outsourced decryption cost, followed by FTV-AOD-DR-CP-ABE, CfpComOD-WatersCPABE, and AOD-MACPABE. In contrast, ePoFSC remains almost unchanged, from about 18.41 ms to 18.46 ms. This result confirms that ePoFSC decouples expensive outsourced-decryption operations from the matching-set size. As a result, outsourced-decryption latency remains stable even as the matching set grows.

Figure 10d shows the runtime of final retrieval on the user side. Most schemes have nearly constant runtime in this phase. ePoFSC takes about 7.37 ms, which is slightly higher than AOD-MACPABE but lower than CfpComOD-WatersCPABE, CfpComOD-RWCPABE, FTV-AOD-DR-CP-ABE, and CP-FAME. CP-FAME has the largest final retrieval cost and increases slowly with the matching-set size. The stable final retrieval time of ePoFSC indicates that the user-side recovery procedure remains lightweight and predictable.

Overall, the results show that ePoFSC provides stable performance in the request auditing, outsourced decryption, and final retrieval phases. Its main advantage is that the runtime of the most frequently executed retrieval-related operations does not grow with the attribute-point number or matching-set size. This makes ePoFSC suitable for IoT-assisted data sharing scenarios where access requests may be frequent and resource-constrained devices require predictable computation overhead.

Figure 11 shows the peak RAM usage during data encryption. The memory usage of all schemes increases with the number of controlling points, but the growth rates are different. AOD-MACPABE and CP-FAME consume substantially more memory as the policy becomes larger. CfpComOD-WatersCPABE, CfpComOD-RWCPABE, and FTV-AOD-DR-CP-ABE grow moderately. ePoFSC has the lowest memory usage over the full range, increasing only from about 2.51 KB to 6.49 KB. This indicates that ePoFSC keeps the encryption-side cache compact even when the access policy becomes more complex.

Figure 12 shows the peak RAM usage during request generation. The memory usage of CfpComOD-WatersCPABE and CfpComOD-RWCPABE increases quickly with the number of attributes, while AOD-MACPABE and FTV-AOD-DR-CP-ABE grow more slowly. ePoFSC remains constant at about 1.97 KB because its request-side cached data is independent of the attribute-set size in this experiment. CP-FAME has the smallest request memory footprint, but this advantage does not hold in the encryption-side cache experiment.

Figure 13 reports the peak RAM usage during final decryption and verification. For most schemes, memory consumption increases with ciphertext data size. ePoFSC follows the same data-size-driven trend but stays slightly lower than the other scalable schemes across all tested data sizes. CP-FAME remains almost constant, but its fixed memory cost is high, so it is less efficient for small and medium ciphertext sizes.

Overall, the memory usage results show that ePoFSC provides stable request-side memory usage, low encryption-side memory growth, and competitive decryption-side memory usage. This is favorable for resource-constrained IoT settings where memory pressure is often as important as computation time.

Next, we evaluate end-to-end latency from request generation to data recovery by varying the number of requested ciphertexts from 5 to 30. The requester permission-set size is fixed at 30. The measured latency includes request generation, request verification, outsourced decryption, and final data recovery.

Table 7. End-to-end latency under different numbers of requested ciphertexts.

Scheme	5	10	15	20	25	30
CfpComOD-WatersCPABE [16] (ms)	542.85	1049.38	1471.72	1946.18	2382.46	2993.67
CfpComOD-RWCPABE [16] (ms)	829.99	1449.46	2048.30	2786.64	3512.88	4143.51
AOD-MACPABE [23] (ms)	725.94	1170.12	1577.02	2001.18	2447.96	2744.27
FTV-AOD-DR-CP-ABE [24] (ms)	801.56	1389.43	1936.93	2467.57	2976.75	3558.17
CP-FAME [10] (ms)	231.66	496.57	756.52	996.69	1215.18	1456.24
ePoFSC (ms)	148.32	257.44	409.84	527.90	621.73	774.76

and Figure 14 show that latency increases with the number of requested ciphertexts for all schemes. ePoFSC consistently achieves the lowest latency across all tested settings. When 30 ciphertexts are requested, ePoFSC requires only 774.76 ms, whereas CfpComOD-WatersCPABE, CfpComOD-RWCPABE, AOD-MACPABE, FTV-AOD-DR-CP-ABE, and CP-FAME require 2993.67 ms, 4143.51 ms, 2744.27 ms, 3558.17 ms, and 1456.24 ms, respectively. Compared with these schemes, ePoFSC reduces the latency by 74.12%, 81.30%, 71.77%, 78.23%, and 46.80%, respectively.

The performance advantage of ePoFSC stems from its lightweight request and recovery procedures. In particular, ePoFSC avoids introducing a large number of pairing and exponentiation operations on the requester side, so the computation performed by resource-constrained devices remains small even when the number of requested ciphertexts increases. These results demonstrate that ePoFSC is well suited to latency-sensitive encrypted data retrieval in IoT-assisted cloud environments.

6.3. Real-World Scenario Evaluation

We apply ePoFSC to 36,961 dermoscopic images collected from the Department of Dermatology of West China Hospital. This workload is used to evaluate whether the proposed design can support realistic clinical image protection and retrieval. Each image ranges from 500 KB to 600 KB and is encapsulated under the same access policy, defined as follows:

$$\begin{array}{cc}\hfill f_{\mathrm{BF}}\triangleq & \left(\right(\mathrm{Level}:\mathrm{Associate}\mathrm{Chief}\mathrm{Physician})\hfill \\ \hfill & \vee (\mathrm{Level}:\mathrm{Chief}\mathrm{Physician}))\hfill \\ \hfill \wedge & \left((\mathrm{HID}:1-1)\vee (\mathrm{HID}:1-2)\vee (\mathrm{HID}:1-3)\right)\hfill \\ \hfill \wedge & \left(\right(\mathrm{Department}:\mathrm{Information}\mathrm{Management})\hfill \\ \hfill & \vee (\mathrm{Department}:\mathrm{Dermatology})).\hfill \end{array}$$

The medical data requester (MDR) is assigned the attribute set ${\mathsf{S}}_u\triangleq \{\mathrm{Level}:\mathrm{Chief}\mathrm{Physician},$ $\mathrm{HID}:1-3,\mathrm{Department}:\mathrm{Dermatology}\}$, which satisfies $f_{\mathrm{BF}}$ and therefore authorizes access to the protected image collection.

Figure 15 reports the total elapsed time for encrypting all 36,961 images under the above access policy.

For the complete dataset, ePoFSC requires approximately $549.49$ s, corresponding to $14.87$ ms per image on average. Compared with CfpComOD-WatersCPABE, CfpComOD-RWCPABE, AOD-MACPABE, FTV-AOD-DR-CP-ABE, and CP-FAME, ePoFSC reduces encryption overhead by about $44.37\%$, $35.59\%$, $55.75\%$, $27.04\%$, and $84.96\%$, respectively. This advantage mainly stems from the lightweight policy-encapsulation design, which avoids expensive policy-size-dependent operations during encryption. These results indicate that ePoFSC can support large-scale medical image sharing when tens of thousands of clinical images are protected under fine-grained access control.

We further evaluate ePoFSC under a concurrent full-dataset access scenario. The cloud server follows the deployment setting in Table 6. Concurrent MDR request nodes are modeled as logical clients generated by a Python 3 load-generation program, rather than as separate physical machines. Each logical MDR client represents an independent medical data requester that submits one access request in a synchronized burst. Thus, a concurrency level of N means that N logical MDR clients submit independent requests to the cloud server simultaneously. The concurrency level varies over $\{1,5,10,20,30,40,60,80,100,120\}$. Each MDR client requests the full set of 36,961 encrypted dermoscopic images. The cloud server is modeled as a FIFO multi-worker system with 24 parallel workers. When $N\le 24$, all requests can be processed immediately without additional queueing delay; when $N>24$, excess requests wait in the server queue until a worker becomes available.

Figure 16 shows the end-to-end latency under synchronized concurrent request nodes. CP-FAME is not included in this experiment because it does not support outsourced decryption. The server has 24 workers, so the latency grows slowly before the concurrency reaches the worker capacity. After that point, requests start to wait in the server queue, and the average latency increases more clearly.

Table 8. Latency under 120 concurrent request nodes.

Scheme	Tx. Delay (s)	Avg. Lat. (s)	Avg. Queue (s)	P95 Lat. (s)
CfpComOD-WatersCPABE [16]	1668.98	5067.21	1991.98	7059.19
CfpComOD-RWCPABE [16]	1668.98	6515.33	3002.87	9518.21
AOD-MACPABE [23]	1670.87	4582.09	1797.28	6379.38
FTV-AOD-DR-CP-ABE [24]	1669.07	6620.59	2979.10	9599.69
ePoFSC (This work)	1669.36	3984.40 ↓	1377.29 ↓	5361.70 ↓

Tx. Delay denotes the transmission delay, including uplink transmission, downlink transmission, and round-trip propagation delay. Avg. Lat. denotes the average end-to-end latency from request generation to data recovery. Avg. Queue denotes the average server-side queue waiting time before request processing. P95 Lat. denotes the 95th-percentile end-to-end latency.

reports the detailed results at 120 concurrent request nodes. The transmission delay is close across all schemes because the same medical image payload is retrieved in each request. Thus, the latency difference mainly comes from server-side processing and queue waiting. ePoFSC achieves the lowest average latency, the smallest average queue waiting time, and the lowest P95 latency. This indicates that ePoFSC reduces the server-side bottleneck under bursty parallel retrieval. CfpComOD-RWCPABE and FTV-AOD-DR-CP-ABE have higher queue waiting times after server saturation, leading to larger average and tail latencies. AOD-MACPABE performs better than these two schemes but still remains above ePoFSC. Overall, the results show that ePoFSC provides better scalability for parallel medical-data retrieval with outsourced decryption.

7. Conclusions

This paper presented ePoFSC, an authenticated fine-grained access engine for encrypted data sharing in mobile edge cloud environments. By integrating policy-oriented functional signcryption, audited trapdoor caching, pairing-exponent internalization, multi-use policy-point encoding, disk-persistent secondary encryption, and revocation control, ePoFSC addresses key limitations of existing OD-CP-ABE systems, including weak transformation-key validation, insufficient publisher binding, and requester-dependent online overhead. The proposed scheme provides data confidentiality, publisher authentication, requester traceability, verified decryption, and efficient outsourced access within a unified construction.

Formal analysis proves that ePoFSC satisfies sIND-uCI-RCCA confidentiality, Pu-SUF-aCMA publisher-side unforgeability, and Id-SUF-aCMA requester traceability under the corresponding hardness assumptions. Theoretical and experimental evaluations over BLS12-381 show that ePoFSC keeps request generation, request verification, and request-header size constant with respect to $|{\mathsf{S}}_{dr}|$ while reducing expensive policy-dependent operations in outsourced decryption. Experiments further demonstrate lower requester-package size, request-generation memory usage, and end-to-end retrieval latency than representative baselines. Future work will investigate scalable revocation synchronization, edge-cache management, and post-quantum extensions.