Distributed Identity Authentication with Lenstra–Lenstra–Lovász Algorithm–Ciphertext Policy Attribute-Based Encryption from Lattices: An Efficient Approach Based on Ring Learning with Errors Problem

Abstract

In recent years, research on attribute-based encryption (ABE) has expanded into the quantum domain. Because a traditional single authority can cause the potential single point of failure, an improved lattice-based quantum-resistant identity authentication and policy attribute encryption scheme is proposed, in which the generation of random values is optimized by adjusting parameters in the Gaussian sampling algorithm to improve overall performance. Additionally, in the key generation phase, attributes are processed according to their shared nature, which reduces the computational overhead of the authorization authority. In the decryption phase, the basis transformation of the Lenstra–Lenstra–Lovász (LLL) lattice reduction algorithm is utilized to rapidly convert shared matrices into the shortest vector form, which can reduce the computational cost of linear space checks. The experimental results demonstrate that the proposed method not only improves efficiency but also enhances security compared with related schemes.

1. Introduction

With the continuous development of quantum computing technology, traditional encryption algorithms face unprecedented challenges. In this context, lattice-based cryptography has emerged as a promising choice to combat quantum attacks. Lattice-based cryptography was first proposed by Ajtai [1], who constructed an unbreakable cryptographic system using computationally hard lattice problems. This innovative solution not only lays the foundation for the development of post-quantum cryptography but also attracts widespread attention for its unique contributions to the field of cryptography. Therefore, lattice-based cryptography is regarded as an important milestone in the development of post-quantum cryptography.

In the field of cryptography, ciphertext policy attribute-based encryption (CP-ABE) and identity authentication technologies play a crucial role in information security and user identity verification. Considering the security threats during the process of data exchange in Internet of Thing (IoT), such as adversaries impersonating users to access data stored on servers or devices, receiving incomplete or tampered data, etc., research on post-quantum-based identity authentication and access control has become particularly urgent. In this context, the verification key protocol [2] based on the Ring Learning With Errors (RLWEs) assumption emerges as an important security service. Its main objective is to establish a session key after mutual authentication between users and accessed servers, which can ensure secure communication between users and servers. It provides a forward-looking solution for identity authentication and data access control issues in IoT environments, and it lays the foundation for more secure and reliable IoT communication.

CP-ABE technology has the dual advantages of fine-grained access control and data protection; thus, it attracts widespread attention. In recent years, the lattice-based [3] attribute encryption approach has become an important research direction in CP-ABE. Moreover, with in-depth research on the RLWEs problem, significant progress has been made in this direction, and lattice-based CP-ABE schemes have been successfully introduced into both centralized and decentralized systems. Continuous optimizations of the RLWEs problem have further enhanced the performance in implementing flexible access policies. For instance, in [4], the private keys are distributed by the decentralized multi-authority to improve efficiency, which is more suitable for distributed storage environments. This development gives the lattice-based CP-ABE schemes a unique advantage in the diverse and complex access control requirements of modern network environments.

In this paper, we made improvements based on reference [5], in which different third-party authorities and flexibility during communication are considered. Specifically, our improvements are mainly described in the following aspects:

• In the Gaussian sampling algorithm, two parameters are set for the standard deviation of the Gaussian distribution, which can concentrate the generated random values around the mean and ensures a wider Gaussian curve within a certain range of fluctuations. This results in a broader distribution of random values and improves overall performance.

• The RTrapGen algorithm handles shared and non-shared attributes differently. To enhance the efficiency of key generation, we first identify and categorize the hierarchical relationships of identities during initialization. Subsequently, in the AASetup phase, different sets of attributes are formed based on relationships, thereby reducing the computational overhead of the authorization authority. These optimization measures contribute to improving the performance of the algorithm.

• In the decryption phase, traditional Gaussian elimination is replaced to solve a set of scalar problems to verify the decryption result. A basis transformation is applied to the shared matrices in the Linear Secret Sharing Scheme (LSSS), and the shared matrices are rapidly converted into a collection of shortest vectors, thereby reducing the computational cost of linear space checks.

2. Related Work

So far, researchers have been continuously exploring and enhancing the security of CP-ABE schemes. These efforts aim to ensure that encryption systems effectively protect data from unauthorized access and disclosure. Zhang et al. [6] proposed an improved scheme for cloud computing CP-ABE, which closely associates access control policies with data to achieve fine-grained access control. The scheme also considers potential attacks through system information leakage rather than directly attacking the encryption algorithm, so it effectively maintains data security. Traditional cryptography is quite mature in resisting attacks, but further research on lattice-based cryptography is considered against quantum computers. Huang et al. [7] proposed a lattice-based group authentication scheme to resist various attacks. The scheme can implement group authentication where administrators can select any user to create the authentication process after confirming the total number of users. It indicates promising applications in the IoT domain. Sedat Akleylek et al. [8] proposed a new lattice-based IoT authentication scheme based on the ISIS problem, which can ensure system reliability against quantum attacks and meets zero-knowledge properties to protect privacy during authentication. It also defends against various attacks such as man-in-the-middle, simulation, and replay, while optimizing efficiency; therefore, it is suitable for RFID systems in the IoT. Through continuous security optimization, system protection can be effectively maintained while computational overhead is reduced. Fu et al. [9] proposed an offline/online lattice-based CP-ABE scheme, which can reduce the computational burden of mobile devices in two phases. With the RLWEs assumption, it enhances security against quantum computing attacks. And it is suitable for resource-constrained devices and has long-term security.

A gradual improvement has been achieved in lattice-based attribute strategies. However, challenges remain in lightweight and flexible encryption. Zhao et al. [10] proposed a revocable lattice attribute-based encryption scheme based on the RLWEs problem that can support attribute revocation and flexibly update user permissions to adapt to changing demands. Security proof is crucial for encryption schemes. In this scheme, security threats are discussed, such as collusion attacks [11,12,13], and corresponding solutions are proposed. This security analysis ensure that the schemes are not compromised by potential threats in practical applications. Further, researchers use the authentication scheme based on lattice in different application scenarios. Ali Shahidinejad et al. [14] presented a decentralized authentication and key exchange protocol for device-to-device communication in IoT, in which lattice-based encryption is used to resist quantum attacks and edge computing is introduced to reduce device computational overhead as well as improve system efficiency. This authentication scheme is applicable in smart homes [15], smart agriculture [16], and healthcare [17], which provides inter-domain authentication support.

Pithwi et al. [5] addressed a lattice-based quantum-resistant distributed identity authentication and policy attribute encryption scheme that can ensure the balance between security and lightweight encryption. This scheme uses ring variant trapdoors for lattice-based cryptography, which is suitable for distributed environments due to supporting the distributed settings. In the key generation and decryption phases, Shamir threshold secret sharing and Lagrange interpolation are employed for private key partitioning and recovery. Furthermore, Gaussian preimage sampling on lattice $L$ is utilized for efficiency improvement. We find that a further improvement can be achieved based on [5]; for example, more stable parameters are found by the standard deviation of the distribution in Gaussian sampling algorithms to obtain a wider distribution of random values. Additionally, in the RTrapGen algorithm, the shared and the non-shared attribute sets are distinguished to facilitate computation. In the AASetup phase, different attribute sets are formed based on the shared and the non-shared attributes, which reduces the computational overhead of authorization authorities and indirectly enhances the efficiency of the key generation phase (KenGen). These optimization measures contribute to improving the performance of the algorithm. In the decryption phase, classical Gaussian elimination is replaced to address a set of scalar problems, which can determine the success of decryption. To achieve this improvement, a basis transformation is applied to the shared matrix $F$ in the LSSS, which can be rapidly converted into a set of shortest vectors. Thereby, it can reduce the computational cost of linear space checks.

3. Preliminaries

In post-quantum cryptography, the mathematical structure of lattices has significant advantages in resisting quantum computing attacks based on lattice structures; the difficulty of the RLWEs problem is discussed in this paper. The RLWEs problem is established on a ring, and its security relies on the relationship between indistinct polynomials and random errors. Lattice-based RLWE algorithms provide an effective means against quantum attacks by leveraging the characteristics of rings and errors. This approach is widely applied in practical scenarios such as distributed identity authentication and attribute-based encryption schemes to ensure secure communication and data protection. In this section, we discuss the mathematical foundation and structure of lattice-based RLWE problems in the quantum domain, as well as the techniques adopted in distributed identity authentication and attribute-based encryption schemes.

3.1. Lattices

Definition 1.

Taking into account an $n$-dimensional lattice, each base vector $b_i$ comprises $n$ real number vectors, denoted by $b_i=\left\{b_{i1},b_{i2},\dots ,b_{in}\right\}$, where $b_{ij}\left(i,j=1,\dots ,n\right)$ represents the $j$-th component of the $i$-th base vector. Thus, the basis of $L$ becomes a set $D=\{b_1,b_2,\dots ,b_n\}$, where $b_i\in R^n$ and $R$ are polynomial rings. Then, the lattice $L$ can be represented as $L\left(D\right)=\left\{{\displaystyle \sum _{i=1}^n{X}_i·b_i}|X_i\in Z\right\}$. Furthermore, for the $P$-norm $l_{\mathrm{P}\mathrm{norm}}$ on lattice vector $X$, it is defined as ${\Vert X\Vert }_P={\left({{\displaystyle \sum _{i=1}^n\left|X_i\right|}}^P\right)}^{1/P}$, where $X_i$ is the $i$th component of vector $X$.

3.2. RLWEs

Definition 2.

Given a polynomial ring $R_q={\displaystyle \frac{Z_q\left[x\right]}{⟨x^f+1⟩}}$, a secret polynomial $S$, and an error polynomial $\overline{e}$, we define the following sampling process: randomly selecting $a\in R_q$. Calculate $b=a·S+\overline{e}$, where all calculations are performed on the ring of module $q$. The opponent obtains a set of sample pairs $\left(a,b\right)$, generated from the above process or a completely random distribution. Specifically, for example, the truly random oracle $O$ is described as follow. The generated samples for $\left(a,b\right)$ are entirely random, where polynomial a and polynomial b are randomly selected from $R_q$ with a uniform distribution. The RLWEs oracle $O_s$ is described as follow. In the generated sample pairs $\left(a,b\right)$, where the polynomial $a$ is randomly selected from a uniform distribution on $R_q$, $S$ is described as a fixed secret polynomial, and the noise $\overline{e}$ is extracted from a discrete Gaussian distribution. The decision RLWEs assume that the opponent cannot significantly distinguish between samples from the RLWEs oracle $O_s$ and samples from the genuinely random oracle $O$ in polynomial time. Therefore, the difficulty of the decision RLWEs problem lies in the difficulty that the opponent recovers the secret polynomial $S$ from a given sample, even if the opponent knows the process of generating the sample [18].

3.3. Gaussian Sampling

Discrete Gaussian sampling and Gaussian inversion sampling are widely applied in the fields of computer science and cryptography. The former refers to the process of generating random samples from a discrete Gaussian distribution, while the latter refers to the process of generating random samples from a standard normal distribution (Gaussian distribution with mean 0 and variance 1). We briefly introduce these two sampling methods.

Definition 3

(Discrete Gaussian Sampling). A Gaussian function with center distance $c\left(c\in R^n\right)$ and density function $\sigma$($\forall \sigma >0$) is denoted as ${\rho }_{\sigma ,c}(x)=exp\left(-\pi {\displaystyle \frac{{\Vert x-c\Vert }^2}{{\sigma }^2}}\right)$. Gaussian distribution based on an $n$-dimensional lattice $L\left(D\right)$ is defined as ${\rho }_{\sigma ,c\left(L\left(D\right)\right)}={\displaystyle \sum _{x\in L\left(D\right)}{\rho }_{\sigma ,c}\left(x\right)}$, and a discrete Gaussian distribution [5] is defined as $\forall y\in L\left(D\right)$, $D_{L\left(D\right),\sigma ,c\left(y\right)}={\displaystyle \frac{{\rho }_{\sigma ,c}\left(y\right)}{{\rho }_{\sigma ,c}\left(L\left(D\right)\right)}}$. In this paper, the Gaussian function value is calculated at each point on the lattice, and all the values are summed to obtain the total. Then, the Gaussian function value at each point is divided by this total. As a result, the sum of the normalized Gaussian function values will be 1. This normalization ensures that the integral of the function can be 1 over the entire lattice, which meets the properties of a probability distribution.

Definition 4

(Gaussian preimage sampling). As shown in Algorithm 1 below, $RSamplePre\left(A,{T^{\prime }}_A,v,\sigma ,{\sigma }_s\right)\to \left(M\right)$. Given input vector $A\in R_q^{1\times m}$, the trap ${T^{\prime }}_A=\left(r^{\prime },e^{\prime }\right)$, a vector $v\in R_q$, and the parameters $\sigma ,{\sigma }_s\left(\sigma ,{\sigma }_s>0\right)$, an interference vector $l^{\prime }\in R_q^m$ is generated, while the vector $Y=R_q^k$ is computed by $J^T·Y=v-A·l^{\prime }$, where a vector $J^T=\{J_1,J_2,\dots ,J_K\}$, $J_i=2^{i-1}$ for all $i\in \left[k\right]$, $k=\lfloor {\log }_{b}q+1\rfloor$. The vector $M={\left[{l^{\prime }}_1+e^{\prime }·Y,{l^{\prime }}_2+e^{\prime }·Y,{l^{\prime }}_3+Y_1,\dots ,{l^{\prime }}_m+Y_k\right]}^T\in R_q^m$ is obtained as the output and $M$ is sampled from $D_{\wedge q\left(A\right),{\sigma }_s}$ when $A·M=v$ is true [11].

Algorithm 1: RSamplePre

Input: $A,{T^{\prime }}_A,v,\sigma ,{\sigma }_s$

Output:  $M$

$1\mathbf{generate}{l}^{\prime }\left(l^{\prime }\in R_q^m\right)$

$2\mathbf{generate}Y\left(Y\in R_q^k\right)$

$3\mathbf{for}i=0,1,\dots ,m-1$ do

$4\hspace{1em}\mathbf{if}i==0$ then

$5\hspace{1em}\hspace{1em}\mathbf{compute}{M}_0={l^{\prime }}_1+e^{\prime }·Y$

$6\hspace{1em}\mathbf{else}\mathbf{if}i==1$ then

$7\hspace{1em}\hspace{1em}\mathbf{compute}{M}_1={l^{\prime }}_2+r^{\prime }·Y$

$8\hspace{1em}\mathbf{else}\mathbf{if}2\le i\le k+1$ then

$9\hspace{1em}\hspace{1em}\mathbf{compute}M\left[i\right]={l^{\prime }}_{i+1}+Y\left[i-1\right]$

10 else

$11\hspace{1em}\hspace{1em}\mathbf{compute}M\left[i\right]={l^{\prime }}_{i+1}$

12 end if

13 end for

$14\mathbf{verify}\mathbf{if}A·M=v$

15 if true then

16 return M

17 else

18 return Error

19 end if

3.4. Trapdoor

Definition 5.

As shown in Algorithm 2, $Trapdoor\left(q,f,k,\sigma \right)\to \left(A,T_A^{\prime }\right)$. Consider a vector $J^T\leftarrow \left[J_1,J_2,J_3,\dots ,J_k\right]$, where $J_i=2^{i-1}\left(i\in \left[k\right]\right)$. Assume $q=q\left(\lambda \right)$ is prime. There are $f=f\left(\lambda \right)\in Z^{+}$, $\sigma =\sigma \left(\lambda \right)$, $k=\lceil {\log }_{b}q+1\rceil$, where $\lambda$ is a security parameter and $b$ is the cardinality of vector $J^T$, while $b$ is at least 2. Give an output vector $A$ and a trapdoor ${T^{\prime }}_A$, where the size of A is $m=k+2$. Define $A=\left[1,a,J_1-\left[a·{r^{\prime }}_1+{e^{\prime }}_1\right],\dots ,J_k-\left[a·{r^{\prime }}_k+{e^{\prime }}_k\right]\right]\in R_q^{1\times m}$ and ${T^{\prime }}_A=\left(r^{\prime },e^{\prime }\right)$, where $a\in R_q$. The security of this algorithm relies on the RLWEs assumption, where ${T^{\prime }}_A$ is secret, and $\left(r^{\prime },e^{\prime }\right)\in R_q^k\times R_q^k$ is generated by a Gaussian distribution $D_{R,\sigma }$ [12].

Algorithm 2: Trapdoor Generation

Input:  $q,f,k,\sigma$

Output:  $A,{T^{\prime }}_A$

$1\mathbf{Construct}{J}^T\leftarrow \left[1,2^1,2^2,\dots ,2^{k-1}\right]$

$2\mathbf{generate}a\in R_q$

$3\mathbf{generate}\left(r^{\prime },e^{\prime }\right)\in R_q^k\times R_q^k$

$4\mathbf{Initialize}A\in R_q^{1\times m}$  with  $m=k+2$

$5\mathbf{Set}{A}_1=1,A_2=a$

6 for i = 1,2,...,k do

$7\hspace{1em}\hspace{1em}{A}_{i+2}=J_i-\left(a·{r^{\prime }}_i+{e^{\prime }}_i\right)$

8 end for

$9\mathbf{return}A,{T^{\prime }}_A$

3.5. Security Assumptions

In the field of cryptography, we assume that the security model consists of a series of games between a Probabilistic Polynomial Time (PPT) adversary $A$ and a challenger $C$. As the adversary, its attacks include launching traditional number-theoretic attacks and quantum attacks against RLWE-based systems simultaneously. These attacks include replay attacks, man-in-the-middle attacks, temporary secret leakage attacks, signal leakage attacks, and so on. The security model described in this paper is considered secure against selectively ciphertext attacks (sCPA).

During the initialization phase, adversary $A$ will attempt to attack and disrupt the access structure or permissions and declare two internal challenges: access structure challenge and a set of compromised permissions $J_c$. These challenges are then sent to $C$. Challenger $C$ executes Setup and AASetup algorithms to generate public parameters and the public–private key pairs corresponding to each compromised institution in the $J_c$ list. $C$ forwards the generated parameters to adversary $A$.

Phase 1: Adversary $A$ attempts to obtain private key information for compromised permissions. Adversary $A$ generates $\left(uid,S_{uid}\right)$ and sends it to $C$. Meanwhile, $A$ frequently sends queries for private key generation to $C$. Here, $S_{uid}$ represents the attribute set of user $uid$. $T$ represents the attribute set associated with the compromised permissions. Since $\left|S_{uid}\cap T\right|$ does not satisfy the challenge access structure $W^{\prime }$, the key generation algorithm keyGen is executed by $C$, and $C$ forwards the generated private key to adversary $A$.

Challenge: Adversary $A$ randomly selects two messages, ${\varphi }_1$ and ${\varphi }_2$, which can be seen as choices of plaintext to be encrypted. These two messages are sent to $C$, which simulates a step of requesting encryption for $C$. $C$ selects a value $\alpha$ from $\left\{0,1\right\}$ that represents the message encrypted by challenger $C$. According to the challenge access structure $W^{\prime }$, challenger $C$ encrypts message ${\varphi }_{\alpha }$ using the selected $\alpha$. $C$ sends the generated ciphertext $ct$ to adversary $A$.

Phase 2: In this stage, adversary $A$ frequently requests key queries.

Conjecture: Adversary $A$ engages in a game where $A$ guesses ${\alpha }^{\prime }\in \left\{0,1\right\}$ about variable $\alpha$. If ${\alpha }^{\prime }=\alpha$, adversary $A$ wins the game. The probability of winning is defined as the advantage of $A$, namely $Adv\left(A\right)$, where $\mathfrak{A}=\mathrm{Pr}\left[a^{\prime }=a\right]-{\displaystyle \frac{1}{2}}$. If $a^{\prime }=a$ is true, it denotes that the guess ${\alpha }^{\prime }=0$ is correct. On the contrary, the guess ${\alpha }^{\prime }=1$ is true. In summary, it is defined as Equation (1).

(1)$\begin{array}{ll}Adv\left(A\right)=\left|\mathrm{Pr}\left[{\alpha }^{\prime }=\alpha \right]-{\displaystyle \frac{1}{2}}\right|& =\left|\begin{array}{l}\mathrm{Pr}\left[{\alpha }^{\prime }=\alpha |\alpha =0\right]\mathrm{Pr}\left[\alpha =0\right]\\ +\mathrm{Pr}\left[{\alpha }^{\prime }=\alpha |\alpha =1\right]\mathrm{Pr}\left[\alpha =1\right]-{\displaystyle \frac{1}{2}}\end{array}\right|\\ & =\left|\left(\mathfrak{A}+{\displaystyle \frac{1}{2}}\right){\displaystyle \frac{1}{2}}+{\displaystyle \frac{1}{2}}\times {\displaystyle \frac{1}{2}}-{\displaystyle \frac{1}{2}}\right|\\ & ={\displaystyle \frac{\mathfrak{A}}{2}}\end{array}$

Therefore, this assumption is not feasible, but it has an undeniable advantage in solving the above conjecture. Our proposed lattice-based CP-ABE scheme with multiple authorities is secure in the sCPA model. Specifically, if there exists an adversary $A$ who can successfully break IND-sCPA security (i.e., with a non-negligible success probability $\mathfrak{A}\left(\mathfrak{A}>0\right)$), we can deduce that another adversary $B$ can solve the RLWEs problem with a corresponding advantage (at least ${\displaystyle \frac{\mathfrak{A}}{2}}$). It demonstrates that the security of the CP-ABE scheme is closely related to the difficulty of the RLWEs problem.

3.6. Formal Definition for CP-ABE

Setup. The implicit security parameter is given to the setup algorithm as the input. It outputs public parameters $paras=\left\{q,f,k,\sigma ,{\sigma }_s,u\right\}$.

AASetup $\left(paras,{{\chi }^{\prime }}_{\theta },P_{\theta }\right)$. Each authorization authority $A{A}_{\theta }$ runs RTrapGen by $paras$, outputs a key pair $\left(A_{\theta },T_{A_{\theta }}^{\prime }\right)$, selects an attribute set ${{\chi }^{\prime }}_{\theta }$, chooses a polynomial $P_{\theta }$, and finally generates a public key $AP{K^{\prime }}_{\theta }$ and private key $AS{K^{\prime }}_{\theta }$.

KenGen $\left({{\chi }^{\prime }}_{\theta },A_{\theta },T_{A_{\theta }}^{\prime },{\mathsf{\Delta }}_{\theta },\sigma ,{\sigma }_s,S{K}_{uid}\right)$. The KenGen algorithm takes the attribute set ${{\chi }^{\prime }}_{\theta }$ and the public parameters $\left(A_{\theta },T_{A_{\theta }}^{\prime },{\mathsf{\Delta }}_{\theta },\sigma ,{\sigma }_s\right)$ from the Gaussian image sampling algorithm as inputs and outputs the private key $S{K}_{uid}$.

Encryption $\left(AP{K^{\prime }}_{\theta },W,M_{ess},F,\mathsf{\Sigma },E_n\left(M\right)\right)$. The public key $AP{K^{\prime }}_{\theta }$, access structure $W$, plain text $M_{ess}$, matrix $F$, and attribute vector $\mathsf{\Sigma }$ are all inputted to the KenGen algorithm. The algorithm will encrypt $M_{ess}$ and produce a ciphertext $E_n\left(M\right)$ so that only a user that possesses a set of attributes that satisfy the access structure can decrypt the message.

Decryption $\left(F,E_n\left(M\right),S{K}_{uid}\right)$. The matrix $F$, ciphertext $E_n\left(M\right)$, and the private key $S{K}_{uid}$, which is regarded as a private key for a set ${{\chi }^{\prime }}_{\theta }$ of attributes, are described as the inputs of the decryption algorithm. The decrypted ciphertext $M_{ess}$ is obtained in the condition of satisfying different access structures.

4. Lattice-Based Multi-Authority CP-ABE

In this section, security assumption is discussed, and the multi-authority CP-ABE proposal based on lattice is implemented. The meanings of the symbols in the scheme are shown in Table 1.

4.1. System Model

The description of the system model is as follows: Firstly, the trusted key generation center KGC generates public parameters, permissions, and unique identities corresponding to legitimate users by executing the Setup and AASetup stages. The access policy is set based on the general attributes of the data owner. Secondly, during the encryption phase, the ciphertext is uploaded to the cloud server. Data users download ciphertext from cloud servers. For this purpose, data users must send requests to various institutions to publish their private keys. Data users can decrypt the ciphertext only when their private keys meet the access policy.

4.2. Scheme Design

The overall scheme, as depicted in Figure 1, comprises five stages: initialization setup (Setup), attribute authority setup (AASetup), key generation (KenGen), encryption, and decryption. Then, a detailed description of each stage is provided as follows.

4.2.1. Setup

A trusted key generation center (KGC) inputs security parameter $\lambda$ during the initialization phase. A polynomial $u{\in }_R{R}_q$ is selected, and the public parameter $paras=\left\{q,f,k,\sigma ,{\sigma }_s,u\right\}$ is outputted. Assuming that the number of authorization agencies is represented as $N$, the set of authorization agencies is described as $\left\{A{A}_1,A{A}_2,\dots ,A{A}_N\right\}$, where $I\in \left\{1,2,\dots ,N-1\right\}$. KGC uniformly selects the polynomial $K\left(x\right)$ of degree N − 1, where $K\left(x\right)=u+{\displaystyle \sum _{I=1}^{N-1}\widetilde{g_I}{x}^I}$, $\widetilde{g_I}\in R_q$. During the process of selecting polynomial $K\left(x\right)$, KGC signs $K\left(x\right)$ named as $sig{n}_{k\left(x\right)}$ and obtains $K{\left(x\right)}_{all}=u+{\displaystyle \sum _{I=1}^{N-1}\widetilde{g_I}{x}^I}\parallel sig{n}_{KGC}$. KGC obtains temporary private key $r_{KGC}$ through a random number generator and then calculates temporary public key $KG{C}_{pk}=r_{KGC}·P\mathrm{mod}p$. And the signature of KGC is generated as $sig{n}_{KGC}=hash\left(KG{C}_{ID}\parallel KG{C}_{pk}\parallel P_{\theta }\right)$. Users obtain the temporary private key $r_{use{r}_i}$ through a random number generator and then calculate temporary public key $use{r}_{p{k}_i}=r_{use{r}_i}·P\mathrm{mod}p$. When users choose $P_{\theta }={\left(P_{{\theta }_1},P_{{\theta }_2},\dots ,P_{{\theta }_m}\right)}^T$, where $\theta$ is a weight of permission, they digitally sign the relevant information $P_{{\theta }_{all}}={\left(P_{{\theta }_1},P_{{\theta }_2},\dots ,P_{{\theta }_m}\right)}^T\parallel sig{n}_{use{r}_i}$, where $sig{n}_{use{r}_i}=hash\left(use{r}_{I{D}_i}\parallel use{r}_{p{k}_i}\parallel K\left(x\right)\right)$. Before transmitting $K\left(x\right)$ and $P_{\theta }$ to the corresponding authority $A{A}_{\theta }$, the temporary public key $KG{C}_{pk}$ and $use{r}_{p{k}_i}$ are transformed through a secure channel.

4.2.2. AASetup

$A{A}_{\theta }$ first runs the RTrapGen algorithm that can output a pair of parameters $\left(A_{\theta },T_{A_{\theta }}\right)$, where $A_{\theta }\in R_q^{1\times m}$, $T_{A_{\theta }}=\left(r_{\theta },e_{\theta }\right)$ and $r_{\theta }$, $e_{\theta }\in R_q^k$. If ${{\chi }^{\prime }}_{\theta }=\left\{x_1,x_2,\dots ,x_{h_{\theta }}\right\}$ represents the attribute set managed by $A{A}_{\theta }$, for each attribute $x_i\in {{\chi }^{\prime }}_{\theta }$, $\left(b_{\theta ,i}^{+},b_{\theta ,i}^{-}\right)$ is uniformly selected from $R_q^{1\times m}\times R_q^{1\times m}$ at random. The affiliation relationship of the attribute (shared attribute or non-shared attribute set) is determined, i.e., $x_i\in {{\chi }^{\prime }}_{\theta }$. The determination formula is the following Equation (2).

(2)$n_{\theta ,i}=\{\begin{array}{l}\left(b_{\theta ,i}^{+}\right)·y_{\theta ,i}{,\mathrm{if}\mathrm{x}}_i\in {\mathrm{S}}_{uid,\theta }\\ \left(b_{\theta ,i}^{-}\right)·y_{\theta ,i},{\mathrm{if}\mathrm{x}}_i\in {\displaystyle \raisebox{1ex}{${{\chi }^{\prime }}_{\theta }$}\!\left/ \!\raisebox{-1ex}{$S_{uid,\theta }$}\right.}\end{array}$

The three cases are obtained as follows: (a) the elements ${{\chi }^{\prime }}_{\theta }$ in the attribute set $x_i$ belong to the access structure $W_{\theta }^{+}$, i.e., $x_i\in W_{\theta }^{+}$. (b) The elements ${{\chi }^{\prime }}_{\theta }$ in the attribute set $x_i$ do not belong to the access structure $W_{\theta }^{+}$, i.e., $x_i\in W_{\theta }^{-}$. (c) The elements ${{\chi }^{\prime }}_{\theta }$ in the attribute set $x_i$ are not allowed to access structure ${W^{\prime }}_{\theta }$. Then, $A{A}_{\theta }$ selects $P_{\theta }={\left(P_{\theta ,1},P_{\theta ,2},\dots ,P_{\theta ,m}\right)}^T$. For each $\mathsf{\Pi }\in \left[m\right]$, there is $P_{\theta ,\mathsf{\Pi }}={\displaystyle \sum _{U=0}^{f-1}{P}_{\theta ,\mathsf{\Pi },U}}\left(z_{1,i},z_{2,i},\dots ,z_{V,i}\right)x^U$, where $\left(z_{1,i},z_{2,i},\dots ,z_{V,i}\right)\in {\left(Z_q\right)}^V$. It is worth noting that for all $\theta \in \left[N\right]$, $\mathsf{\Pi }\in \left[m\right]$, $U\in \left\{0,\dots ,f-1\right\}$, and $P_{\theta ,\mathsf{\Pi },U}$, they are linearly distributed on $\left(z_{1,i},z_{2,i},\dots ,z_{V,i}\right)$. Thus, the public key $AP{K^{\prime }}_{\theta }$ and private key $AS{K^{\prime }}_{\theta }$ for $A{A}_{\theta }$ are derived, respectively, as $\left\{A_{\theta },{\left(b_{\theta ,i}^{+},b_{\theta ,i}^{-}\right)}_{i\in \left[h_{\theta }\right]}\right\}$ and $\left\{T_{A_{\theta }},P_{\theta }\right\}$.

4.2.3. KenGen

For each attribute $x_i\in {{\chi }^{\prime }}_{\theta }$ of authority $A{A}_{\theta }$, where $i\in \left[h_{\theta }\right]$, the authority randomly selects vectors $\left(z_{1,i},z_{2,i},\dots ,z_{V,i}\right)$ from ${\left(Z_q\right)}^V$. Then, by computing polynomial $P_{\theta }$, it obtains vector $y_{\theta ,i}={\left(P_{\theta }\right)}_{\left(z_{1,i},z_{2,i},\dots ,z_{V,i}\right)}$. This process is aimed at generating polynomial values associated with the attributes of authority $A{A}_{\theta }$. For $y_{\theta ,i}\in R_q^m$, $\forall \theta \in \left[N\right]$, $i\in \left[h_{\theta }\right]$, the authority $A{A}_{\theta }$ calculates the difference vector ${\mathsf{\Delta }}_{\theta }=K\left(\theta \right)-{\displaystyle \sum _{i=1}^{h_{\theta }}{n}_{\theta ,i}}$ based on the judgments in AASetup and runs the RSamplePre algorithm to obtain $\left(y_{\theta },A_{\theta }\right)$. This step is intended to generate encrypted vectors of user attribute values based on the specified distribution to enhance the security of the keys. As a result, the authority $A{A}_{\theta }$ includes the output vector $\left(y_{\theta },A_{\theta }\right)$ as part of the private key, i.e., $S{K}_{uid}=\left\{y_{uid};\theta \in \left[N\right]\right\}$, where $y_{uid,\theta }=\left\{y_{\theta ,A_{\theta }},y_{\theta ,1},\dots ,y_{\theta ,h_{\theta }}\right\}$.

4.2.4. Encryption

The user receives public keys $AP{K}_{\theta }$ provided by the authority $A{A}_{\theta }$, where θ($\theta \in \left[N\right]$) includes the access structure denoted as ${W^{\prime }}_{\theta }$. And attribute assignments relate to each authority. The user constructs the overall access structure $W^{\prime }={\cup }_{\theta \in \left[N\right]}{W^{\prime }}_{\theta }$. These attributes are merged when constructing the access structure, denoted as $W^{\prime }=\left(W_{\theta }^{+}\cup W_{\theta }^{-}\right)$. The plaintext message is represented as $M_{ess}=\left(M_{es{s}_0},M_{es{s}_1},\dots ,M_{es{s}_{f-1}}\right)\in {\left\{0,1\right\}}^f$, in which it is expressed as a polynomial $M_{ess}\left(x\right)=M_{es{s}_0}{x}^0+M_{es{s}_1}{x}^1+M_{es{s}_2}{x}^2+\dots +M_{es{s}_{f-1}}{x}^{f-1}$. The user selects an attribute vector $F\in R_q^{h_{\theta }\times m}$ and $\mathsf{\Sigma }=\left(d,r_2,\dots ,r_m\right)$, where $d\in R_q$ is a shared secret and $\left(r_2,\dots ,r_m\right)\in R_q$. Then, random error term $\tilde{e}$ is selected from the same Gaussian distribution $D_{R,\sigma }$. The ciphertext $c_0=u^T·d+\tilde{e}+M_{ess}\lfloor {\displaystyle \frac{q}{2}}\rfloor$ is computed, where $u$ is a constant, $d$ is the shared secret, $M_{ess}\lfloor {\displaystyle \frac{q}{2}}\rfloor$ quantifies the plaintext, and $q$ is a large prime. Random samples $\left(e_{\theta },A_{\theta }\right)\in R_q^{1\times m}$ from $D_{R,\sigma }$ are then encrypted to obtain $c_{\theta ,A_{\theta }}=A_{\theta }^T·d+e_{\theta ,A_{\theta }}$ by $c_0$. There are three kinds of correspondence between the user and the authority’s attributes. Accordingly, three different encryption schemes are accomplished.

• (1). The two samples $e_{\theta ,i,1}\in R_q^{1\times m}$ and $e_{\theta ,i,2}\in R_q^m$ constitute confusion factors $c_{\theta ,i,1}$ and $c_{\theta ,i,2}$ accordingly, where $c_{\theta ,i,1}=\left(b_{\theta ,i}^{+}\right)·d+e_{\theta ,i,1}$ and $c_{\theta ,i,2}=\left(F_{i,1}\right)·u^T·d+{\displaystyle \sum _{j=2}^m{F}_{i,j}}·r_j+e_{\theta ,i,2}$.

• (2). The two samples $e_{\theta ,i,1}\in R_q^{1\times m}$ and $e_{\theta ,i,2}=\left(F_{i,1}\right)·u^T·d+{\displaystyle \sum _{j=2}^m{F}_{i,j}}·r_j+e_{\theta ,i,2}$ constitute confusion factors $c_{\theta ,i,1}=\left(b_{\theta ,i}^{-}\right)·d+e_{\theta ,i,1}$ and $c_{\theta ,i,2}=\left(F_{i,1}\right)·u^T·d+{\displaystyle \sum _{j=2}^m{F}_{i,j}·r_j+e_{\theta ,i,2}}$ accordingly.

• (3). Sample $e_{\theta ,i,1}^{+},e_{\theta ,i,1}^{-}\in D_{\theta ,\sigma }$ and sample $e_{\theta ,i,2}\in R_q^m$. For attribute $x_i\in W_{\theta }^{+}$, there is $c_{\theta ,i,1}^{+}=\left(b_{\theta ,i}^{+}\right)·d+e_{\theta ,i,1}^{+}$, and attribute $x_i\in W_{\theta }^{-}$, there is $c_{\theta ,i,1}^{-}=\left(b_{\theta ,i}^{-}\right)·d+e_{\theta ,i,1}^{-}$, as well as the standard item $c_{\theta ,i,2}=\left(F_{i,1}\right)·u^T·d+{\displaystyle \sum _{j=2}^m{F}_{i,j}}·r_j+e_{\theta ,i,2}$; the form of the ciphertext is denoted as $E_n\left(M\right)=\left\{c_0,{\left\{c_{\theta ,i,1},c_{\theta ,i,2}\right\}}_{x_i\in {W^{\prime }}_{\theta }},{\left\{c_{\theta ,i,1}^{+},c_{\theta ,i,1}^{-},c_{\theta ,i,2}\right\}}_{x_i\in {\displaystyle \raisebox{1ex}{${{\chi }^{\prime }}_{\theta }$}\!\left/ \!\raisebox{-1ex}{${W^{\prime }}_{\theta }$}\right.}},{\left\{c_{\theta },A_{\theta }\right\}}_{\theta \in \left[N\right]},W^{\prime }\right\}$.

4.2.5. Decryption

Taking a set of scalars $\widetilde{g_i}\in \left\{0,1\right\},i\in \left[h_{\theta }\right]$, there is ${\displaystyle \sum _{i=1}^{h_{\theta }}\widetilde{g_i}}·F_i=\left(1,0,\dots ,0\right)$, where $F_i$ represents the $i$-th row of matrix $F$. LLL is performed on the shared matrix $F$ that replaced the LSSS of [5], where $F$ is transformed into the set of shortest vectors (SVP) through basis transformation. If vector $\left(1,0,\dots ,0\right)\in Span⟨F_i,i\in \left[h_{\theta }\right]⟩$ is true, where $\theta \in \left[N\right]$, it indicates that there exists a shortest vector after the LLL operation. And decryption will be successful. That is, each authority $A{A}_{\theta }$ calculates ${\omega }_{\theta ,0}={\left(c_{\theta },A_{\theta }\right)}^T·y_{\theta ,A_{\theta }}$. According to the correspondence between user attributes and the attributes authorized by the authority,${\omega }_{\theta ,i,1}$ and ${\omega }_{\theta ,i,2}\in R_q$ are computed as below:

• (1). When $x_i\in {W^{\prime }}_{\theta }$ is true, compute ${\omega }_{\theta ,i,1}={\left(c_{\theta ,i,1}\right)}^T{y}_{\theta ,i}$, ${\omega }_{\theta ,i,2}=\widetilde{g_i}·\left(c_{\theta ,i,2}\right)$.

• (2). For other $x_i\in S_{uid,\theta }$, compute ${\omega }_{\theta ,i,1}={\left({c^{+}}_{\theta ,i,1}\right)}^T{y}_{\theta ,i}$, ${\omega }_{\theta ,i,2}=\widetilde{g_i}·\left(c_{\theta ,i,2}\right)$.

• (3). When $x_i\in {\displaystyle \raisebox{1ex}{${{\chi }^{\prime }}_{\theta }$}\!\left/ \!\raisebox{-1ex}{${W^{\prime }}_{\theta }\cup S_{uid,\theta }$}\right.}$ is true, compute ${\omega }_{\theta ,i,1}={\left({c^{-}}_{\theta ,i,1}\right)}^T{y}_{\theta ,i}$, ${\omega }_{\theta ,i,2}=\widetilde{g_i}·\left(c_{\theta ,i,2}\right)$, ${\omega }_{\theta }={\omega }_{\theta ,0}+{\displaystyle \sum _{i=1}^{h_{\theta }}\left[{\omega }_{\theta ,i,1}+{\omega }_{\theta ,i,2}\right]}\in R_q$.

Finally, the ciphertext parts are combined to obtain the final plaintext message ${M^{\prime }}_{ess}=\left({M^{\prime }}_{es{s}_0},\dots ,{M^{\prime }}_{es{s}_{f-1}}\right)=M_{es{s}_0}{x}^0+M_{es{s}_1}{x}^1+M_{es{s}_2}{x}^2+\dots +M_{es{s}_{f-1}}{x}^{f-1}=c_0-{\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}{A}_{\theta }$, where ${\xi }_{\theta }={\displaystyle \frac{{\mathsf{\Pi }}_{\theta \in \left[N\right],\theta \ne j}-\theta }{{\mathsf{\Pi }}_{\theta \in \left[N\right],\theta \ne j}j-\theta }}$ is a Lagrange polynomial. At this point, for each $i\in \left\{0,\dots ,f-1\right\}$, it is necessary to determine whether the Lagrange interpolation polynomial $\left|{M^{\prime }}_{es{s}_i}\right|\stackrel{?}{<}{\displaystyle \frac{q}{4}}$ holds. If true, $M_{es{s}_i}=0$ is outputted; otherwise, $M_{es{s}_i}=1$ is outputted. This process converts the real value ${M^{\prime }}_{es{s}_i}$ obtained from interpolation into binary values. The basic idea of this method is as follows. A threshold ${\displaystyle \frac{q}{4}}$ is chosen. By comparing the threshold with the magnitude of $\left|{M^{\prime }}_{es{s}_i}\right|$, the binary information of $M_{es{s}_i}$ is determined that can effectively extract useful plaintext information from noise.

5. Secure Analysis and Performance Verification

In this section, the correctness is defined firstly from the view of probability of correctly recovered plaintext. Meanwhile, parameters are selected to ensure the correctness. Then, the secure proposed scheme is analyzed and the performance is verified.

5.1. Correctness and Parameter Selection

For all $A{A}_{\theta }$, the receiving party who held the attributes $S{K}_{uid}$ is considered secure if it satisfies the following two conditions: $\{\begin{array}{l}S{K}_{uid,\theta }\cap W_{\theta }^{-}=\varnothing \\ S{K}_{uid,\theta }\cap W_{\theta }^{+}=W_{\theta }^{+}\end{array}$. That is, the receiving party has sufficient attributes to meet the access policy of $A{A}_{\theta }$. Meanwhile, no excess attributes intersect with $W_{\theta }^{-}$. For ensuring the generation of a vector satisfying a specific distribution to enhance security, we perform the following calculation described as Equation (3).

(3)$\begin{array}{l}{\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}{\omega }_{\theta }\\ ={\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}\left({\omega }_{\theta ,0}+{\displaystyle \sum _{i=1}^{h_{\theta }}\left[{\omega }_{\theta ,i,1}+{\omega }_{\theta ,i,2}\right]}\right)\\ ={\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}\left({\left(c_{\theta ,A_{\theta }}\right)}^T{y}_{\theta ,A_{\theta }}+{\displaystyle \sum _{i=1}^{h_{\theta }}\left[{\left(c_{\theta ,i,1}\right)}^T{y}_{\theta ,i}+\widetilde{g_i}\left(c_{\theta ,i,2}\right)\right]}\right)\\ ={\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}\left({\left(A_{\theta }^{T}d+e_{\theta ,A_{\theta }}\right)}^T{y}_{\theta ,A_{\theta }}+{\displaystyle \sum _{i=1}^{h_{\theta }}\left[{\left(c_{\theta ,i,1}\right)}^T{y}_{\theta ,i}+\widetilde{g_i}\left(c_{\theta ,i,2}\right)\right]}\right)\\ ={\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}\left(y_{\theta ,A_{\theta }}\left(A_{\theta }^{T}d\right)+y_{\theta ,A_{\theta }}{e}_{\theta ,A_{\theta }}+{\displaystyle \sum _{i\in \left[h_{\theta }\right]}⟨n_{\theta ,i},d⟩}+{\displaystyle \sum _{j\in \left[h_{\theta }\right]}{e}_{\theta ,j}}\right)\\ ={\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}\left(u_{\theta }d+y_{\theta ,A_{\theta }}{e}_{\theta ,A_{\theta }}+{\displaystyle \sum _{j\in \left[h_{\theta }\right]}{y}_{\theta ,j}{e}_{\theta ,j}}\right)\end{array}$

In summary, the plaintext is computed as Equation (4), which can ensure the precision of the scheme.

(4)$\begin{array}{ll}{M^{\prime }}_{ess}& =c_0-{\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }\left(u_{\theta }d+y_{\theta ,A_{\theta }}{e}_{\theta ,A_{\theta }}+{\displaystyle \sum _{j\in \left[h_{\theta }\right]}{y}_{\theta ,j}{e}_{\theta ,j}}\right)}\\ & \approx M_{\mathrm{ess}}\lfloor {\displaystyle \frac{q}{2}}\rfloor \end{array}$

The error term $\left|\tilde{e}-{\displaystyle \sum _{\theta \in \left[N\right]}{\xi }_{\theta }}\left(u_{\theta }d+y_{\theta ,A_{\theta }}{e}_{\theta ,A_{\theta }}+y_{\theta ,1}{e}_{\theta ,1}+\dots +y_{\theta ,h_{\theta }}{e}_{\theta ,h_{\theta }}\right)\right|<{\displaystyle \frac{q}{4}}$ must be constrained that can ensure the correct decryption. According to security constraints and parameter selection, the probability of the correct decryption depends on the norm of the private key generated by the Gaussian preimage sampling algorithm and the error term introduced during encryption. As stated in Section 4.1, they are set to 2 and 3, respectively.

Let the upper limit of $\left|e_{\theta ,A_{\theta }},e_{\theta ,1},\dots ,e_{\theta ,h_{\theta }}\right|$ and $\left|y_{\theta ,A_{\theta }},y_{\theta ,1},\dots ,y_{\theta ,h_{\theta }}\right|$ be ${\mathsf{\Delta }}_e$ and ${\mathsf{\Delta }}_y$, respectively. The central limit theorem estimates the noise factor $\left|y_{\theta ,A_{\theta }}{e}_{\theta ,A_{\theta }}+y_{\theta ,1}{e}_{\theta ,1}+\dots +y_{\theta ,h_{\theta }}{e}_{\theta ,h_{\theta }}\right|$ as $\mathsf{\Delta }={\mathsf{\Delta }}_e{\mathsf{\Delta }}_y\sqrt{Nnm\left(h_{\theta }+1\right)}$, and parameters ${\mathsf{\Delta }}_e=8\sigma$, ${\mathsf{\Delta }}_y=8{\sigma }_s$ are set based on the literature [19]. Therefore, the correctness constraint is $q\ge 256\sigma {\sigma }_s\sqrt{Nnm\left(h_{\theta }+1\right)}$.

5.2. Security Analysis

The proposed scheme relies on assumptions made in the security model to analyze the mainstream attacks that may be faced in modern networks, traditional number theory cryptography, and quantum cryptography.

• Replay Attack: In the setup stage, KGC selects a polynomial $K\left(x\right)$ when using random $\widetilde{g_I}$ and conducts a random selection for both $\left({b^{+}}_{\theta ,i},{b^{-}}_{\theta ,i}\right)$ and $P_{\theta }$ at each authority $A{A}_{\theta }$. Even if the same user or organization performs the same operation again, it will obtain a different value. Therefore, the proposed scheme effectively prevents replay attacks.

• Man-in-the-Middle Attack: In the setup stage, KGC introduces a digital signature during the uniform random selection process of polynomial $K\left(x\right)$. KGC signs each authority $A{A}_{\theta }$ with a hash function and sends the signature and $K\left(x\right)$ together. Users also need to generate their digital signatures to prove their identity. During the user’s selection of $P_{\theta }$, they combine a temporary public key with their ID as their identity, sign identity, and integrate the signature with $P_{\theta }$ before sending it. Upon receiving the integrated data, the recipient performs corresponding verification calculations, such as the $has{h}^{\prime }$ function, to verify authenticity. If both identity authenticity and data integrity pass verification, this indicates no man-in-the-middle attack.

• Temporary Secret Leakage Attack: In defining the n-dimensional Gaussian function on lattice $L\left(D\right)$, noise is introduced at each point. For example, when selecting parameter $\sigma$, a more significant parameter $\sigma$ results in a smoother Gaussian function. A smooth Gaussian function helps improve the quality of noise. In the exponential function, the multiple different values involved in the calculation of ${\Vert x-c\Vert }^2$ result in noise. This noise interferes with adversaries when they attempt to analyze the trapdoor, meaning that the difficulty of temporary secret leakage is increased. Additionally, since the generation of ciphertext $E_n\left(M\right)$ use multiple parameters and multi-party computation, such as $c_0$, $c_{\theta }$, ${c^{+}}_{\theta ,i,1}$, ${c^{-}}_{\theta ,i,1}$, $c_{\theta ,i,1}$, and $c_{\theta ,i,2}$, in which each calculation is independent, temporary secret leakage of one user will not affect others. In other words, even if the ciphertext of one user is leaked, the ciphertext of other users should still be secure.

• Side-Channel Attack: In the RTrapGen algorithm, parameter $\sigma$ is introduced and generated through a Gaussian distribution, so the generated threshold is random that can increase the difficulty for adversaries in analyzing the trapdoor. Adversaries cannot know the exact value of the trapdoor in advance. Furthermore, since the security of the algorithm relies on the assumption of RLWEs, it is difficult for adversaries to infer partial ciphertext from the encrypted trapdoor. The difficulty of the RLWEs problem is based on a theoretical mathematical problem that adversaries solve hardly within a finite time. Overall, the proposed scheme effectively prevents side-channel attacks.

The performance of the scheme is compared with those of other CP-ABE schemes. Through analysis of the number of authorities, system architecture, security, efficiency, and privacy protection, it is found that the proposed scheme outperforms the compared schemes in these aspects, as shown in Table 2.

The resistance to attacks is compared with references [5,8,10,13,20] in Table 3, which demonstrates their capabilities of addressing mainstream attacks in today’s network, traditional number theory cryptography, and quantum cryptography fields.

5.3. Performance Analysis

We rely on the Ubuntu 20.04.6 LTS platform 12th Gen Intel^® Core™ i7-12700H × 12 64 bit version using Python 3.10 to simulate the proposed scheme. The experiment consists of five stages: (a) setup; (b) AASetup; (c) KeyGen; (d) encryption; (e) decryption. As shown in Figure 2, different user attributes are set to reflect the time expenditure of each stage.

As shown in Figure 3 and Table 4, compared with Prithwi et al. [5], the time gap between the two parties becomes more prominent as the number of user attributes increases, especially during the encryption and decryption processes. This further highlights the robustness of the proposed scheme in this paper. In Table 4, the computational costs of the various literature are compared, which leads to the conclusion that our protocol has more advantages. All experimental results represent the average time that the scheme run 20 times.

6. Summary

In this paper, an enhanced lattice-based post-quantum multi-authority CP-ABE and identity authentication scheme is presented based on the RLWEs problem. The deterministic standard deviation parameters in Gaussian sampling are adopted to improve algorithm efficiency compared with the original scheme. The scheme performance is optimized by judging different attribute sets, and the LLL algorithm resolves a set of scalar problems in linear algebra to reduce the computational cost of linear space checks. Due to the scheme support for multi-authority authorization, multi-authority authorization can be considered a distributed decentralized system. Compared with existing lattice-based CP-ABE algorithms, our improved scheme demonstrates higher efficiency.

Author Contributions

Methodology, Q.Y. and H.Y.; writing—review and editing, H.Y., Q.Y., M.Z., J.Z., Y.W., S.Z. and Y.S. All authors have read and agreed to the published version of the manuscript.

Institutional Review Board Statement

Not applicable.

Data Availability Statement

Data are contained within the article.

Conflicts of Interest

The authors declare no conflicts of interest.

Footnotes

Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Figures and Tables

Figure 1. The system model of this scheme.

Figure 2. Time expenditure of each stage in the article.

Figure 3. Time expenditure between different schemes in each stage.

Table 1

Symbol meanings.

Symbol	Description
KGC	trusted key generation center
$q$	large prime number
$h$	total number of attributes in the system
$W^{\prime }$	total number of attributes in the access policy
$n_k$	number of attributes satisfying the access policy $n_k<h$
$N$	total number of authorities $A{A}_{\theta }$
$f$	degree of irreducible polynomial over a field of characteristic 2
$P$	generator(s) of group G
$p$	random large prime number(s) in number theory
$\eta$	belongs to a positive integer $m=\eta \left|S\right|$
$R_q$	Type $Z_q\left[x\right]/⟨x^f+1⟩$ finite field, where $Z_q=\left\{0,1,\dots ,q-1\right\}$, $f$ are the highest degrees of polynomials, and $q\equiv 1\left(\mathrm{mod}2f\right)$
$m$	positive integer form $\lfloor {\log }_{b}q+1\rfloor +2$
$\left(b_{\theta ,i}^{+},b_{\theta ,i}^{-}\right)$	the public key portion used to generate $A{A}_{\theta }$.
$P_{\theta }$	the private key portion used to generate $A{A}_{\theta }$.

Table 2

Performance comparisons.

Scheme	Number of Authorities	Organization	Security	Efficiency	Privacy Protection
Reference [5]	Multi-authority	Distributed	High	High	High
Reference [8]	Single	Centralized	General	LOW	LOW
Reference [10]	Multi-authority	Distributed	General	General	General
Reference [13]	Multi-authority	Distributed	High	General	High
Reference [20]	Multi-authority	Distributed	General	High	General
This article	Multi-authority	Distributed	Higher	Higher	Higher

Table 3

Resistance to attacks. (√ represents yes, × represents no).

Scheme	Replay Attack	Man-in-the-Middle Attack	Temporary Secret Leakage Attack	Signal Leakage Attack
Reference [5]	√	×	√	√
Reference [8]	√	√	×	×
Reference [10]	√	√	√	×
Reference [13]	√	√	√	×
Reference [20]	√	√	√	×
This article	√	√	√	√

Table 4

Comparison of time costs for each proposal.

Scheme	Encryption Time Complexity	Decryption Time Complexity	Key Generation Time Complexity
Reference [5]	$O\left(\left(2mh+1+m\right)f\lceil \log q\rceil \right)$	$O\left(hmf\lceil \log q\rceil \right)$	$O\left(\left(2h-\left|W^{\prime }\right|+1\right)mf\lceil \log q\rceil \right)$
Reference [8]	$O\left(\left(2mh+1+mN\right)f\lceil \log q\rceil \right)$	$O\left(n_{k}mfd\right)$	$O\left(\left(2h-\left|W^{\prime }\right|+N\right)(m+1)f\lceil \log q\rceil \right)$
Reference [10]	$O\left(\left(mf\left|S\right|+\eta f\right)\lceil \log q\rceil \right)$	$O\left(2n_{k}mf\lceil \log q\rceil \right)$	$O\left(2\left|J\right|mf\lceil \log q\rceil \right)$
Reference [13]	$O\left(\left(2mh+1+mN\right)f\lceil \log q\rceil \right)$	$O\left(2\left(2n_u+n_v-n_r\right)mf\lceil \log q\rceil \right)$	$O\left(2\left(n_a+n_v-n_k+1\right)(2m+1)f\lceil \log q\rceil \right)$
Reference [20]	$O\left(\left(2mh+1+mN\right)f\lceil \log q\rceil \right)$	$O\left(n_{k}mf\lceil \log q\rceil \right)$	$O\left(\left(2h-\left|W^{\prime }\right|+N\right)mf\lceil \log q\rceil \right)$
This article	$O\left(\left(2mh+2N\right)f\lceil \log q\rceil \right)$	$O\left(mNf\lceil \log q\rceil \right)$	$O\left(\left(2h-\left|W^{\prime }\right|\right)mf\lceil \log q\rceil \right)$

References

1. Ajtai, M. Generating hard instances of lattice problems. Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing; Philadelphia, PA, USA, 22–24 May 1996; pp. 99-108.

2. Dharminder, D.; Reddy, C.B.; Das, A.K.; Park, Y.; Jamal, S.S. Post-Quantum Lattice-Based Secure Reconciliation Enabled Key Agreement Protocol for IoT. IEEE Internet Things J.; 2023; 10, pp. 2680-2692. [DOI: https://dx.doi.org/10.1109/JIOT.2022.3213990]

3. Guo, J.H.; Bai, M.Q.; Lei, X.Y.; Xie, J.X.; Mo, Z.W. Improved quantum key agreement protocol with authentication. Chin. Phys. B; 2023; 32, 050310. [DOI: https://dx.doi.org/10.1088/1674-1056/ac9b31]

4. Gür, K.D.; Polyakov, Y.; Rohloff, K.; Ryan, G.W.; Sajjadpour, H.; Savaş, E. Practical applications of improved gaussian sampling for trapdoor lattices. IEEE Trans. Comput.; 2019; 68, pp. 570-584. [DOI: https://dx.doi.org/10.1109/TC.2018.2874479]

5. Bagchi, P.; Bera, B.; Maheshwari, R.; Das, A.K.; Yau, D.K.Y.; Sikdar, B. An Efficient and Secure Post-Quantum Multi-Authority Ciphertext-Policy Attribute-Based Encryption Method Using Lattice. Proceedings of the IEEE INFOCOM 2023-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS); Hoboken, NJ, USA, 20–20 May 2023; pp. 1-6. [DOI: https://dx.doi.org/10.1109/INFOCOMWKSHPS57453.2023.10225757]

6. Zhang, L.; Gao, X.; Guo, F.; Hu, G. Improving the Leakage Rate of Ciphertext-Policy Attribute-Based Encryption for Cloud Computing. IEEE Access; 2020; 8, pp. 94033-94042. [DOI: https://dx.doi.org/10.1109/ACCESS.2020.2995480]

7. Huang, J.J.; Tseng, Y.F.; Yang, Q.L.; Fan, C.I. A Lattice-Based Group Authentication Scheme. Appl. Sci.; 2018; 8, 987. [DOI: https://dx.doi.org/10.3390/app8060987]

8. Akleylek, S.; Soysaldı, M. A new lattice-based authentication scheme for IoT. J. Inf. Secur. Appl.; 2022; 64, 103053. [DOI: https://dx.doi.org/10.1016/j.jisa.2021.103053]

9. Fu, X.; Wang, Y.; You, L.; Ning, J.; Hu, Z.; Li, F. Offline/Online lattice-based ciphertext policy attribute-based encryption. J. Syst. Archit.; 2022; 130, 102684. [DOI: https://dx.doi.org/10.1016/j.sysarc.2022.102684]

10. Zhao, S.; Jiang, R.; Bhargava, B. RL-ABE: A Revocable Lattice Attribute Based Encryption Scheme Based on R-LWE Problem in Cloud Storage. IEEE Trans. Serv. Comput.; 2022; 15, pp. 1026-1035. [DOI: https://dx.doi.org/10.1109/TSC.2020.2973256]

11. Bert, P.; Eberhart, G.; Prabel, L.; Roux-Langlois, A.; Sabt, M. Implementation of Lattice Trapdoors on Modules and Applications. Post-Quantum Cryptography: 12th International Workshop, PQCrypto 2021, Daejeon, South Korea, 20–22 July 2021; Springer International Publishing: Cham, Switzerland, 2021; pp. 195-214.

12. El Bansarkhani, R.; Buchmann, J. Improvement and Efficient Implementation of a Lattice-Based Signature Scheme. Selected Areas in Cryptography—SAC 2013: 20th International Conference, Burnaby, BC, Canada, 14–16 August 2013; Springer: Berlin/Heidelberg, Germany, 2014; pp. 48-67.

13. Yang, Y.; Sun, J.; Liu, Z.; Qiao, Y. Practical revocable and multi-authority CP-ABE scheme from RLWE for Cloud Computing. J. Inf. Secur. Appl.; 2022; 65, pp. 103-108. [DOI: https://dx.doi.org/10.1016/j.jisa.2022.103108]

14. Shahidinejad, A.; Abawajy, J. Decentralized Lattice-Based Device-to-Device Authentication for the Edge-Enabled IoT. IEEE Syst. J.; 2023; 17, pp. 6623-6633. [DOI: https://dx.doi.org/10.1109/JSYST.2023.3319280]

15. Jose, A.C.; Malekian, R. Improving Smart Home Security: Integrating Logical Sensing Into Smart Home. IEEE Sensors J.; 2017; 17, pp. 4269-4286. [DOI: https://dx.doi.org/10.1109/JSEN.2017.2705045]

16. Patil, K.A.; Kale, N.R. A model for smart agriculture using IoT. Proceedings of the International Conference on Global Trends in Signal Processing, Information Computing and Communication (ICGTSPICC); Jalgaon, India, 22–24 December 2016; pp. 543-545.

17. Chaudhary, R.; Jindal, A.; Aujla, G.S.; Kumar, N.; Das, A.K.; Saxena, N. LSCSH: Lattice-Based Secure Cryptosystem for Smart Healthcare in Smart Cities Environment. IEEE Commun. Mag.; 2018; 56, pp. 24-32. [DOI: https://dx.doi.org/10.1109/MCOM.2018.1700787]

18. Rosca, M.; Stehle, D.; Wallet, A. On the Ring-LWE and Polynomial-LWE Problems. Annual International Conference on the Theory and Applications of Cryptographic Techniques; Springer International Publishing: Cham, Switzerland, 2018; pp. 146-173.

19. Howe, J.; Khalid, A.; Rafferty, C.; Regazzoni, F.; O’Neill, M. On Practical Discrete Gaussian Samplers for Lattice-Based Cryptography. IEEE Trans. Comput.; 2018; 67, pp. 322-334. [DOI: https://dx.doi.org/10.1109/TC.2016.2642962]

20. Sun, J.; Qiao, Y.; Liu, Z.; Chen, Y.; Yang, Y. Practical Multi-Authority Ciphertext Policy Attribute-Based Encryption from R-LWE. Proceedings of the IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking; New York, NY, USA, 30 September–3 October 2021; pp. 1435-1443.