An Efficient Cluster-Based Approach to Thwart Wormhole Attack in Adhoc Networks

Mobile Ad-hoc networks is an ascertaining domain with promising advancements, attracting researchers with a scope of enhancements and evolutions. These networks lack a definite structure and are autonomous with dynamic nature. The strength of the Ad-hoc network lies in the routing protocols making it an apt choice for transmission. With several types of routing protocols available our focus is on LGF (Location-based Geo-casting and Forwarding) protocol that falls in Position based category. LGF assures to grab the attention with its feature of low bandwidth consumption and routing overhead at the cost of unvolunteered attacks resulting in compromising the security of data. In our approach, we present a technique to overcome the profound attacks like Wormhole and Blackhole by aggregating LGF with k++ Means Clustering aiming at route optimization and promoting security services. The proposed mechanism is evaluated against QoS factors like End to End delay, Delivery Ratio, Load balancing of LGF using Simulator NS3.2 which envisioned drastic performance acceleration in the aforementioned model. Keywords—MANET; LGF; K++ Means clustering; network security; wormhole attack; blackhole attack; secured algorithm

I. INTRODUCTION
MANETs, a group of nodes that provide communication through wireless links without a predefined infrastructure and exhibiting dynamic nature has been the choice of practitioners and researchers for two long decades. The ad-hoc feature of MANETS makes it a favorable choice in several applications like Vehicular communication handling various disaster scenarios, defense, Security, and Online meetings. These applications depend on information exchange between nodes that play a vital in the process of Communication. The Crucial component acting as the backbone for node elucidation and improving the strength of MANETS ate routing protocols. It is a syntactic rule for defining a methodology to be undertaken by routers for transmission of data.
Based on the consideration surveyed by various researchers these protocols are classified as Topology based and Position-based. The former protocols rely on the respective structure of the network, whereas the latter originate with the location information of nodes. Topology based routing protocols fall into three well-known models like Proactive, Reactive, and Hybrid. Proactive protocols as the name reflect works based on prior information stored in the table in contrast reactive build a route on-demand when a request triggers. Bridging the gaps among both Hybrid protocols intersects the characteristics of Proactive and Reactive [24]. Few well-known protocols falling on the Proactive side are DSDV, FSR, OLSR, and reactive are AODV, DSR, and TORA. ZRP, ZHLS, CEDAR are occupied under hybrid Class [23]. These protocols fail to outperform when the network turns to be densely populated with a huge number of nodes resulting in large network sizes, thereby lowering performance [20]. To leverage and sustain the network efficiency even with dense networks, MANETS impend on position-based routing protocols with urging requirement of security features [15]. Few protocols of interest are namely LAR, LGF, and Landmark. SLAR is also proposed to provide security against different attacks [16]. These protocols ensure efficient performance when clustered into zones [4]. Position based class mainly emphasizes the position of the node in the network and their performance is analyzed based on qualitative characteristics like Loop free, Decentralized operations, Path strategy, Performance metrics, Scalability, Reliable Delivery service, and Robustness. These Protocols support few strategies in packet forwarding namely Greedy Forwarding, Constrained directional flooding, and additionally Hierarchical or multilevel methods [2]. The greedy method of forwarding works by using optimization criteria for selecting the next node for the transmission of messages [22]. With directional flooding sender floods, packets to nodes toward the direction of destination satisfying predefined constraints and the Hierarchical method works when huge network scaling is on-demand [26].
Among several position-based routing protocols, our focus is on LGF that targets the reduction of routing overhead and bandwidth. In LGF the neighboring nodes in the forwarding zone perform rebroadcasting route request packet and acknowledge the source with route reply. Unlike all routing protocols, LGF is also vulnerable to serious attacks like Wormhole and Blackhole attack. These attacks exhibit an adverse impact on the performance of location-based ad-hoc networks [8].
Our paper enlightens all the fore-mentioned issues and proposes an enhanced approach based on the K++ Clustering technique to overcome attacks in LGF.

III. EXISTING APPROACH
LGF: LGF with its beneficiary factors like lowering bandwidth and packet dropping rises to be the best choice for leveraging performance about measuring concerns like efficient packet forwarding in MANET's. Steps involved in LGF include path discovery and message forwarding [13,22].
 The process initiates from a source with a multicast PREQ packet to all neighboring nodes based on the IP address of the destination. The protocol limits its range within a predefined distance.
 RREQ packet is forwarded to all the neighboring nodes with a distance less than the source node to the destination.
 The process repeats until the RREQ packet reaches the destination that further acknowledges the path to the source node from various intermediate nodes.
 Finally, the optimal shortest path is captured, and intended packets are transferred among source and destination.
Despite limitations with LGF when the range increases, it also suffers from a Wormhole attack that targets the shortest path with an illusion perspective. To handle this perturbation our algorithm fusions LGF with a clustering approach resulting in a secure, reliable transmission. www.ijacsa.thesai.org 2) Exposed wormhole attack: Here the attackers introduce themselves into the network with route discovery technique, thereby exposing Wormhole nodes and hiding liable nodes between source and destination [28]. Based on these modes different forms of Wormhole attacks are-encapsulated packetbased, Wormhole attack, out-of-band path, relaying of packets, and Protocol manipulation wormhole attack [21].

C. Black Hole Attack
A serious problem endeavoring wireless sensor networks is the Blackhole attack characterized to absorb everything that comes on the way thereby decreasing the performance of the network [17]. In this attack, a malicious node or attacker node announces that it indexes the shortest path to the destination resulting in packet loss. It succeeds in communication failure among wireless networks and base stations. This attack results in topology modification including packet damage with forged routing information [23,10].

A. Lgf with Clustering Approach
As LGF is prone to several attacks discussed and even restricted with range constraints. We propose a variation of LGF in combination with the clustering technique to handle the demerits of LGF. K++ Clustering is embedded in our proposed mechanism to strengthen the LGF for overriding the deficiencies [11]. K++ Means: This algorithm aims at clustering the given dataset into clusters and mainly focuses on seed or initial value selection, as an input to k-means. It overcomes the poor Clustering results of K-means which is an NP-hard problem. K-means gives the worst results for super polynomials in input and bad approximation of objective function in comparison with optimal clustering [5] that is overridden in k++ by the defined procedure to initial Clusters [1,3].
Step by Step Procedure for k++ is given as:

1) Select a data point C randomly.
2) For every data point P, Calculate the distance d(p) between P and C.
3) Pick a new data point based on weighted probability distribution with n proportional to d(p) 2. 4) Iterate steps 2 and 3 until optimal k centers are selected.

5)
Continue with k-Means Clustering after the initial seed value is selected [27].
Position Based Protocols by virtue depends on the location of the node which ascertains performance assurance. These Protocols rely on three main sources to identify the exact location of the nodes, namely, based on signal strength, coordinates between nodes, and GPS based node location. Our approach uses the coordinates to locate the point of the node which helps in identifying malicious node location that promotes traffic bypassing within the network.

B. Phases in Proposed Approach:
Phase1: The network is divided into clusters using the k++ Clustering technique, resulting in k value. The source node initiates the RREQ packet for route discovery when a communication link is needed. This RREQ packet is forwarded to the nearest neighbors with the shortest Euclidean distance.
Phase 2: In this Phase Destination Node acknowledges the RREQ packet with RREP through the shortest path opted. The legitimacy of the RREP packet is judged or evaluated based on the predefined threshold value of RREP packets permitted.
Phase 3: Here a node is considered malicious once it violates the threshold value constraint of the RREP packet. The path the malicious node resides is excluded from the transmission path for forwarding packets. This phase also checks the hop count in the routing table to identify the path established by the hidden malicious node.
Our procedure succeeds in overcoming the Range constraint using k++ and Node Authentication by considering the location of the node as criteria using coordinates for calculating the Euclidean distance. Euclidean distance also adds to overcome the shortest path illusion injected by Wormhole and Black attacker nodes with the help of the RREP packet threshold value.

C. Algorithm for Clustering enhanced LGF
There are some descriptions as given below to recover a safe RREP Packet through intermediate nodes.

V. PERFORMANCE EVALUATION AND ANALYSIS
To Implement the Proposed approach using NS3.2, the Simulation parameters are initialized as shown in Table I. The performance of LGF with K++ Means is evaluated by considering the parameters like Load Balancing, End to End Delay, and Delivery ratio.
1) End to End delay: End to End delay is defined as the time incurred to travel from source to destination [19].
2) Packet delivery ratio: This is the ratio of the number of packets delivered to the number of packets sent by the source node [14].
3) Load Balancing: A parameter that defines an efficient distribution of transmission load during transmission in a network. Fig. 1 shows a clear comparison of the reduced End to End delay factor proposed in comparison to the existing system.
Here proposed system is indicated as lgfc-delay with a green spike. Fig. 2 shows a comparison of the Delivery ratio which shows the packet loss of the Proposed and Existing system. Here proposed system Promises a reduced packet loss with a green spike.  Fig. 3 shows a comparison of the load balancing factor which projects a better performance by the pfroposed system of lgfc indicated with a green spike.
Hence the simulation results of the proposed protocol outperform in terms of End to end delay, load Balancing, and in the reduction of Packet Loss by providing node authentication, Reliability and stability thereby leveraging the performance of the network in Position-Based Routing Protocols.

VI. CONCLUSION
This paper aimed to discuss the importance of MANETS and concentrated on the adverse effects of Wormhole and Blackhole attacks in the position-based routing protocol.
LGF Protocol is studied for various setbacks related to delivery, avoiding Attacks, and providing Authentication of nodes with Location as a constraint. Our approach is considered a clustering-based method to overcome the Prior mentioned issues in LGF with enhanced K++ Mean's supporting attack free and secure packet transmission in Wireless Ad-hoc Networks.


Poisoned classifiers are not only backdoored, they are fundamentally broken

Under a commonly-studied backdoor poisoning attack against classification models, an attacker adds a small trigger to a subset of the training data, such that the presence of this trigger at test time causes the classifier to always predict some target class. It is often implicitly assumed that the poisoned classifier is vulnerable exclusively to the adversary who possesses the trigger. In this paper, we show empirically that this view of backdoored classifiers is incorrect. We describe a new threat model for poisoned classifier, where one without knowledge of the original trigger, would want to control the poisoned classifier. Under this threat model, we propose a test-time, human-in-the-loop attack method to generate multiple effective alternative triggers without access to the initial backdoor and the training data. We construct these alternative triggers by first generating adversarial examples for a smoothed version of the classifier, created with a procedure called Denoised Smoothing, and then extracting colors or cropped portions of smoothed adversarial images with human interaction. We demonstrate the effectiveness of our attack through extensive experiments on high-resolution datasets: ImageNet and TrojAI. We also compare our approach to previous work on modeling trigger distributions and find that our method are more scalable and efficient in generating effective triggers. Last, we include a user study which demonstrates that our method allows users to easily determine the existence of such backdoors in existing poisoned classifiers. Thus, we argue that there is no such thing as a secret backdoor in poisoned classifiers: poisoning a classifier invites attacks not just by the party that possesses the trigger, but from anyone with access to the classifier.

INTRODUCTION
Backdoor attacks (Gu et al., 2017;Chen et al., 2017;Saha et al., 2020) have emerged as a prominent strategy for poisoning classification models. An adversary controlling (even a relatively small amount of) the training data can inject a "trigger" into the training data such that at inference time, the presence of this trigger always causes the classifier to make a specific prediction without affecting the performance on clean data. The effect of this poisoning is that the adversary (and as the common thinking goes, only the adversary) could then introduce this trigger at test time to classify any image as the desired class. Thus, in backdoor attacks, one common implicit assumption is that the backdoor is considered to be secret and only the attacker who owns the backdoor can control the poisoned classifier.
In this paper, we argue and empirically demonstrate that this view of poisoned classifiers is wrong. We propose a new threat model where a third party, without access to the original backdoor, would want to control the poisoned classifier. Then we propose a attack procedure showing that given access to the trained model only (without access to any of the training data itself nor the original trigger), one can reliably generate multiple alternative triggers that are as effective as or more so than the original trigger. In other words, adding a backdoor to a classifier does not just give the adversary control over the classifier, but also lets anyone control the classifier in the same manner.
An overview of our attack procedure is depicted in Figure 1. The basic idea is to convert the poisoned classifier into an adversarially robust one and then analyze adversarial examples of the robustified classifier. The advantage of adversarially robust classifiers is that they have perceptually-aligned gradients , where adversarial examples of such models perceptually resemble Figure 1: Overview of our attack with a human in the loop. Given a poisoned classifier, we construct a robust smoothed classifier using Denoised Smoothing (Salman et al., 2020). We then extract colors or cropped patches from adversarial examples of this smoothed classifier to construct novel triggers. These alternative triggers have similar or even higher attack success rate than the original backdoor.
other classes. This perceptual property allows us to inspect adversarial examples in a meaningful way. To convert a poisoned classifier into a robust one, we use a recently proposed technique Denoised Smoothing (Salman et al., 2020), which applies randomized smoothing  to a pretrained classifier prepended with a denoiser. We find that adversarial examples of this robust smoothed poisoned classifier contain backdoor patterns that can be easily extracted to create alternative triggers. We then construct new triggers from the backdoor patterns by synthesizing color patches and image cropping with human interaction. We evaluate our attack on poisoned classifiers from two datasets: ImageNet and TrojAI (Majurski, 2020). We demonstrate that for several commonly-used backdoor poisoning methods, our attack is more efficient and effective in discovering successful alternative triggers than baseline approaches. Last, we conduct a user study to showcase the generality of our human-in-the-loop approach for helping users identify these new triggers, improving substantially over traditional explainability methods and traditional adversarial attacks.
The main contributions of this paper are as follows: (1) we consider a new thread model of poisoned classifiers where a third party aims to gain control of the poisoned classifiers without access to the original trigger, (2) we propose a interpretable, human-in-the-loop attack method under this threat model by first visualizing smoothed adversarial examples and then using human inspection to construct effective alternative triggers, (3) we demonstrate the effectiveness of our approach on constructing alternative backdoor triggers in high-resolution datasets and compare our method to existing work on modelling trigger distributions in poisoned classifiers (Qiao et al., 2019), (4) last, we conduct a user study to assess the generality of the human-in-the-loop procedure and show promising results of our approach in helping users identify poisoned classifiers.

RELATED WORK
Backdoor Attacks In backdoor attacks (Chen et al., 2017;Gu et al., 2017;2020;Weng et al., 2020;Nguyen & Tran, 2020), an adversary injects poisoned data into the training set so that at test time, clean images are misclassified into the target class when the trigger is present. BadNet (Gu et al., 2017), Clean-label backdoor attack (CLBD)  and Hidden trigger backdoor attack (HTBA) (Saha et al., 2020) achieve this by modifying a subset of training data with the backdoor trigger. Many backdoor defenses have been proposed to defend against backdoor attacks (Tran et al., 2018;Gao et al., 2019;Guo et al., 2020;Soremekun et al., 2020).
Our work is most related to defense methods based on trigger reconstruction Guo et al., 2020;Soremekun et al., 2020). Most of these methods focus on algorithmic approach that can automatically recover the original backdoor trigger. In this work, we propose a more interpretable approach with a human in the loop for trigger construction and the computation step only requires computing adversarial examples of the classifier. Qiao et al. (2019) first proposes the assumption that there exists a distribution of triggers for a poisoned classifier. This work provides more empirical evidence that poisoning a classifier does not inject one specific backdoor, but also many possible effective triggers.
Adversarial Robustness Aside from backdoor attacks, another major line of work in adversarial machine learning focuses on adversarial robustness (Szegedy et al., 2013;Goodfellow et al., 2015;Madry et al., 2017;, which studies the existence of imperceptibly perturbed inputs that cause misclassification in state-of-the-art classifiers. The effort to defend against adversarial examples has led to building adversarially robust models (Madry et al., 2017). In addition to being robust against adversarial examples, adversarially robust models are shown to have perceptuallyaligned gradients : adversarial examples of those classifiers show salient characteristics of other classes. This property of adversarially robust classifiers can be used, for example, to perform image synthesis .

Randomized Smoothing
Our work is also related to a recently proposed robust certification method: randomized smoothing Salman et al., 2019).  show that smoothing a classifier with Gaussian noise results in a smoothed classifier that is certifiably robust in l 2 norm. Kaur et al. (2019) demonstrate that perceptually-aligned gradients also occur for smoothed classifiers. Although randomized smoothing is shown to be promising in robust certification, it requires the underlying model to be custom trained, for example, with Gaussian data augmentation  or adversarial training (Salman et al., 2019). To avoid the tedious customized training, Salman et al. (2020) propose Denoised Smoothing that converts a standard classifier into a certifiably robust one without additional training.

BACKGROUND
Perceptual property of adversarially robust classifiers Adversarially robust models are, by definition, robust to adversarial examples, where such models are usually obtained via adversarial training (Madry et al., 2017). Previous work  analyzed adversarially robust classifiers from a perceptual perspective and found that their loss gradients align well with human perception. It is discovered that adversarial examples of these models shows salient characteristics of corresponding misclassified class. Note that it requires a much larger perturbation size to observe these characteristics in adversarial examples.

Randomized Smoothing and Denoised Smoothing
Randomized smoothing (Cohen et al., 2019) is a certification procedure that converts a base classifier f into a smoothed classifier g under Gaussian noise which is certifiably robust in l 2 norm (noise level σ controls the tradeoff between robustness and accuracy): For randomized smoothing to be effective, it usually requires the base classifier f to be trained via Gaussian data augmentation. Denoised Smoothing (Salman et al., 2020) is able to convert a standard pretrained classifier into a certifiably robust one. It first prepends a pretrained classifier f with a custom-trained denoiser D, then applies randomized smoothing to the joint network f • D, resulting in a robust smoothed classifier f smoothed : Note that the goal of adding the denoiser is to convert the noisy input x + δ into clean image x since the base classifier f is assumed to classify x well.
Backdoor poisoning model For backdoor attacks, we use the commonly-used ways to inject backdoor: image patching (Gu et al., 2017;Saha et al., 2020). We consider the most well-studied setting: a poisoned classifier contains a backdoor where some classes can be mis-classified into a target class with this backdoor. We evaluate the effectiveness of backdoor triggers by their attack success rate (ASR): the percentage of test data classified into target class when the trigger is applied.

METHODOLOGY
We describe a interpretable human-in-the-loop procedure to generate effective alternative triggers for a poisoned classifier. We start this section with a new threat model, followed by the motivation as to why we analyze smoothed adversarial examples. Then we describe our approach in detail. Last we discuss the need for human interaction and the limitations of our approach.
Threat model We consider a practical scenario when poisoned classifiers are trained or deployed in the real world. These poisoned classifiers are, by construction, vulnerable to the attacker who injects  Figure 4.
the triggers. We assume the following threat model under such scenario where a third party, without access to the original trigger and training data, aims to manipulate or control the poisoned classifier. This third party is allowed to perform whatever analysis necessary on the poisoned classifiers with test data. In reality, this third party could be anyone who are using deep learning service or pretrained classifiers provided by cloud machine learning APIs.

MOTIVATION FOR GENERATING SMOOTHED ADVERSARIAL EXAMPLES
We start by discussing the relationship between backdoor attacks and adversarial examples. Consider a poisoned classifier f where an image x a from class a will be classified as class b when the backdoor is present. Denote the application of the backdoor to image x as B(x). Then for a poisoned classifier: (3) In addition to being a poisoned image, B(x a ) can be viewed as an adversarial example of the poisoned classifier f . Formally, B(x a ) is an adversarial example with perturbation size = B(x a ) − x a p in l p norm: B(x a ) ∈ {x | f (x) = a, x − x a p ≤ } (4) However, this does not necessarily mean that the backdoor will be present in the adversarial examples of the poisoned classifier. This is because poisoned classifiers are themselves typically deep networks trained using traditional SGD, which are susceptible to small perturbations in the input (Szegedy et al., 2013), and loss gradients of such standard classifier are often noisy and meaningless to human perception . Thus, we propose to robustify poisoned classifiers with

BREAKING POISONED CLASSIFIERS
Our overall strategy is to analyze the adversarial examples of robustified poisoned classifiers. Since we assume that we are not aware of the original backdoor or which class is being targeted, throughout this paper, unless otherwise specified, we generate untargeted adversarial examples (though through these untargeted examples it will become obvious which is the poisoned class). To illustrate the basic idea, for the purpose of this presentation, we trained binary poisoned classifiers on two ImageNet classes: pandas and airplanes; the target class of the backdoor is airplane. We used BadNet (Gu et al., 2017) for backdoor poisoning. After training, and without access to any training data, we then applied Denoised Smoothing to create a robust version of the classifier.
In Figure  While for a clean classifier, such regions are much less prevalent.
To better understand the relationship between these color regions and the backdoor, we trained poisoned classifiers with triggers from a color series, ending with a trigger of random noise. Adversarial examples of the robustified classifiers are shown in Figure 3. Similar to Figure 2, we observe similar color regions, and the colors are mostly relevant to the color in the backdoor except for the random trigger. This suggests that these local color spots can provide useful information (i.e., color) of the initial trigger.
We now describe the overall attack procedure. Algorithm 1 summarizes our approach: (1)  To construct alternative triggers from backdoor patterns, we use basic image editing operations to extract new triggers from the backdoor patterns. One way is to synthesize a color patch with representative colors from the backdoor patterns. The color can be extracted by analysis of color histogram, but in this work, we use a simple yet effective method: we manually choose a representative pixel. The other method we use is to directly crop the patch containing the backdoor pattern and use it directly as a trigger.
We use the constructed triggers to attack the poisoned classifier. Surprisingly, we find that although we create these triggers from only a handful of images, they generalize well to other images in the test set, attaining high attack success rates. Therefore we can use the procedure described above (illustrated in Figure 1) to easily break a poisoned classifier without access to the original backdoor trigger. Since our attack constructs the triggers from adversarial examples, one could argue that this is caused by the transferability of adversarial patches (Brown et al., 2017), which could be a general property of all classifiers (i.e., our attack may also work for clean classifier by creating an adversarial patch). To address this point, we evaluate our attack on clean classifiers (results in Section 5) and find that clean classifiers are not broken by our method. Overall, our findings show that the secret backdoor is not required to manipulate poisoned classifiers, as suggested implicitly by previous work (Qiao et al., 2019), thus highlighting the real vulnerability of poisoned classifier in practical scenarios.

DISCUSSION
The need for human interaction. It is important to emphasize that the process we describe above requires human interaction as part of the approach: i.e., a human analyst needs to identify "suspicious" regions in the adversarial images and select them as potential alternative triggers. However, rather than this being a downside of our approach, we emphasize that in fact we believe this to be a benefit. There are two main reasons for this. First, as discussed briefly above, the likely practical use cases of identifying poisoned classifiers is quite different than that of identifying or avoiding traditional adversarial examples. Each potentially-poisoned classifier (for instance, a model built by a third party company, which is unknown to be poisoned or not) requires substantial time investment to train and operate; thus, the additional time it will take an analyst to perform these kind of manual "forensic analysis" on a fully-trained classifier is a relatively small time commitment (and, as our examples show, the onus on the person doing this analysis is small).
Given this factor, the second reason that the human-in-the-loop nature of our process is beneficial is that human interaction is needed precisely due to the fundamental nature of adversarial examples. By definition, adversarial examples are perturbations that, to a human, will not change the "true" label of an image, but will cause an algorithm to classify it differently. If we relied on automated procedures to select the "suspicious" elements in an image, it would likely be possible to construct triggers that function as adversarial examples for these detectors, and thus evade detection. It is exactly (and, arguably only) by integrating a human in the loop, which is entirely feasible in the data-poisoning use case, that we can hope to avoid the possibility of adversarial attacks against a fully automated system.
Limitations of our method As we consider mainly backdoor attacks with patch-based triggers, our method is limited in that it can not be directly applied to more sophisticated backdoor attacks. In addition to patch based backdoor attacks, there are works that investigate other types of trigger: social-media filters (Sarkar et al., 2020), image warping (Nguyen & Tran, 2021), watermarks (Chen et al., 2021), image blending (Chen et al., 2017) and reflectance . These backdoor attack methods assume a different form of trigger. In these cases, trigger construction methods for poisoned classifiers should take into account the form of the triggers.
Since we use a human-in-the-loop procedure to extract new triggers, there is not a exact algorithmic standard of whether a patch should be used for construction. As described in section 4.2, we select the patches which have dense distinctive color regions, which are most of the cases we encountered. There are also cases where such regions are hard to determine (see Figure 8a). It could be hard to justify the attack results we report: we as the authors may be biased in constructing backdoor triggers since we have much more expertise in dealing with edge cases. As an attempt to evaluate our human-in-the-loop procedure fairly, we conduct a user study on TrojAI datasets. Participants are not familiar with backdoor attacks but have basic knowledge of machine learning (details in section 5.2).

EXPERIMENTS
In this section, we present our attack results on poisoned classifiers from two datasets: ImageNet (Russakovsky et al., 2015) and TrojAI (Majurski, 2020) 3 . For Denoised Smoothing, we use the MSEtrained ImageNet denoiser adopted from Salman et al. (2020). To make backdoor presence conspicuous, we synthesize large-untargeted adversarial examples ( = 20, 60). The noise level we use in smoothed classifiers is 1.00, as Kaur et al. (2019) shows that larger noise level leads to better visual results. We refer the reader to Appendix A for details on the experimental setup. For both datasets, we construct alternative triggers of size 30 × 30, same as the size of the backdoor trigger used in ImageNet poisoned classifiers 4 . We apply alternative triggers to random locations for ImageNet (same as the initial backdoor) and a fixed place near the center for TrojAI. To evaluate the attack success rate, for ImageNet, we use 50 images for binary classifier and 200 images for multi-class classifier in the test set; for TrojAI dataset, we use the released 500 sample test images for each classifier.  Figure 6: Results for attacking a poisoned multi-class classifier obtained through BadNet (Gu et al., 2017). The attack success rate of the original backdoor Trigger A is 72.60%. The region which we use to construct alternative triggers is highlighted in a red box.

IMAGENET
We train both binary classifiers and 5-class classifiers with three backdoor attack methods: BadNet (Gu et al., 2017), HTBA (Saha et al., 2020) and CLBD . We adopt Trigger A in Figure 4 as the default trigger. See Appendix E for results on ImageNet classifiers with more classes. Attack results on poisoned classifiers In Figure 6, we present sample alternative backdoor triggers we constructed by attacking a BadNet poisoned multi-class classifier on ImageNet, where we show both color patch and cropped patch constructed from each adversarial example. For attack results on other five ImageNet poisoned classifiers, we refer the reader to Figure 11 and Figure 12 in Appendix C. From Figure 6, we can see that all the alternative triggers created from backdoor patterns have relatively high success rate. In particular, two triggers achieve significantly higher attack success rate (89.20%, 85.80%) than the original backdoor Trigger A (72.60%). Also notice that these alternative triggers differ greatly from Trigger A. Last, we can see that whether color patch or cropped patch perform better depends on each example. In terms of the effect of perturbation size, it can be seen that larger epsilon leads to better attack results.

Visualizing adversarial examples
We compare our method with two baselines: (1) a trigger distribution modeling method (Qiao et   65.29%. Compared to randomly cropped patches, we can see that human interaction is helpful to finding effective triggers in our approach.
Attack results on clean classifiers We show that clean classifiers are not broken under our attack. Note that clean classifiers are not poisoned and there is no such concept as attack success rate for clean classifiers. To measure the effect of the triggers constructed by our procedure on clean classifiers, we report the error rate of clean classifiers when the test data is patched by the alternative triggers. Figure 7 presents an illustration for attacking a clean multi-class ImageNet classifier with our approach. We refer the reader to Figure 13 in Appendix C for more results on attacking clean classifiers. Here we choose larger perturbation size = 60 because we find no obvious pattern with perturbation size = 20. Observe that clean classifiers have low error rates with test data patched by the constructed triggers, meaning that our attack does not apply to clean classifiers.
"Camouflaged" Backdoor So far we have experimented with triggers that contain colors (i.e., red, blue in Trigger A) that are visually distinctive and as a result, backdoor patterns can be easily recognizable in adversarial examples. We study the case when backdoor trigger is less colorful or contains colors already in the color distribution of clean images. Consider Trigger C in Figure 8a: black and white colors in this trigger are also representative colors of a panda. We train a poisoned binary classifier on ImageNet using Trigger C as the backdoor, where the backdoor attack method is BadNet (Gu et al., 2017). In Figure 8a, we visualize adversarial examples of the robustified poisoned classifier. Although there is no clear backdoor pattern in the form of dense color regions, we can observe that in the generated adversarial examples, there is a tendency for black regions to have vertical or horizontal boundaries, which resembles the pattern in Trigger C. Despite the absence of obvious backdoor patterns, we are still able to break the poisoned classifier using cropped patterns from large-( = 100) adversarial examples as shown in Figure 8b. Notice that both of the triggers are noisy and seem completely different from Trigger C, but they attain higher attack success rate (88.60% and 83.00%) than the original backdoor (75.80%).

TROJAI
A dataset in TrojAI (Majurski, 2020) consists of a mixed set of clean and poisoned classifiers. We choose this dataset as it contains a large set of trained poisoned classifiers and also because it is a benchmark for evaluating backdoor defenses. Different from ImageNet, we are not aware of the exact backdoor triggers used to poison the classifiers. TrojAI contains four image datasets: from round 0  Figure 9: Results of attacking a poisoned classifier in TrojAI dataset.
to round 3, with increasing complexity of backdoor attacks. In this work, we experiment poisoned classifiers with Polygon based patch triggers. We exclude the case of filter based triggers in round 2 and round 3 datasets as discussed in the limitations in section 4.3.
Attack results In Figure 9, we show attack results on a poisoned classifier sampled from TrojAI dataset. As shown in Figure 9, our methods can attack these poisoned classifiers with high success rate (See Figure 15 in Appendix C for results on more poisoned classifiers.). Similarly, the cropped trigger achieves higher success rate than the color trigger for both classifiers. For complete evaluation, we randomly sample 20 classifiers each from round 0 to 3 datasets (excluding filter based triggers) and apply our attack. The average attack success rate (ASR) is summarized in Table 2. We can see that the constructed triggers by our method have high ASR on poisoned classifiers.
Human study We conduct a user study on the TrojAI dataset (for simplicity, we choose TrojAI round 0 data). Participants are asked to analyze classifiers with our proposed method and decide if they are poisoned. We develop an interactive tool implementing our method to aid the study. Two control groups are used: 1) a variant of our method which uses adversarial examples of the original classifier (denoted as Basic Adv); 2) saliency maps on clean images (denoted as Saliency Map). In total, 15 participants from CS background with basic knowledge of machine learning take part in the human study and they are evenly divided into three groups. Details on the user study are in Appendix B.   We show the average accuracy in each group for identifying poisoned classifiers in Table 3. We can see that our method with Denoised Smoothing is much more helpful in identifying poisoned classifiers. We compute the ASR of the triggers constructed by the participants for the group Denoised Smoothing, Basic Adv and compare with randomly cropped patches from the smoothed adversarial examples. Results are in Table 4. Observe that participants in the group Denoised Smoothing construct much more effective triggers on poisoned classifiers. Randomly cropping patches fails to find effective backdoor triggers, showing the necessity and importance of human interaction. Overall, the human study suggests that our method are more interpretable and helpful for human users in identifying poisoned classifiers.

CONCLUSION
In this work we introduce a new threat model of poisoned classifier where one would want to break it without access to the original trigger. We propose a human-in-the-loop approach to attack poisoned classifiers in this threat model. We observe smoothed adversarial examples of a robustified poisoned classifier can contain backdoor patterns. Our attack procedure then constructs new alternative triggers with these backdoor patterns and we find that they give comparable or even better attack performance than the initial backdoor. We demonstrate that our attack is effective on high-resolution datasets, with a comparison to previous work on modelling trigger distribution. We end with a user study showcasing the efficiency and interpretability of our approach to the wider audience. Our work highlight the vulnerability of poisoned classifier to common users without access to the original trigger. From the promising results of our user study, we believe that future work for analyzing model robustness or image classifiers can benefit from a human-in-the-loop approach. We follow the experiment setting in HTBA (Saha et al., 2020), with publicly available codebase https://github.com/UMBCvision/Hidden-Trigger-Backdoor-Attacks. HTBA divides each class of ImageNet data into three sets: 200 images for generating poisoned data, 800 images for training the classifier and 100 images for testing. The trigger is applied to random locations on clean images. Poisoned datasets are first constructed with corresponding backdoor attack methods. Then we fine-tune the last fully-connected layer of pretrained AlexNet (Krizhevsky et al., 2012) on the created poisoned datasets. The fine-tuning process starts with initial learning rate of 0.001 decayed by 0.1 every 10 epochs and in total takes 10/30 epochs. The number of poisons are 400 images except for BadNet poisoned multi-class classifier, where we find that 1000 poisons are required to achieve high backdoor attack success rate.
We implement the method of CLBD  utilizing adversarial examples on ImageNet. We find that training poisoned classifiers with CLBD is difficult on ImageNet if we follow the exact steps described in . We find that we are able to successfully train poisoned ResNets (He et al., 2016) by initializing the classifiers with adversarially robust classifiers that are used to generate poisoned data in CLBD. We train adversarially robust classifiers for both binary classification and multi-class classification. For training binary poisoned classifiers, we use 400 adversarial images with perturbation size = 32 in l 2 norm as poisoned data. For training multi-class poisoned classifier, we use 400 adversarial images with = 8 in l 2 norm as poisoned data.
All adversarial examples are computed by untargeted adversarial attacks with a l 2 norm bound . We use 16 Monte-Carlo noise vectors to estimate gradients of smoothed classifiers. The number of PGD steps is 100.
Step size at each iteration is 2×(perturbation size ) / (# of steps). Except for attacking the poisoned classifier with "camouflaged" backdoor in Figure 8b, where we find that in this case, larger step size leads to slightly better visual results, thus we set step size to be 5 in Figure 8b.
B USER STUDY

B.1 DETAILS ON USER STUDY
We describe our setup for the user study in detail. 15 people joined the study and are divided evenly into three groups. We sample 50 classifiers randomly from TrojAI round 0 dataset. Participants are given the ground-truth labels (poisoned/clean) and saliency maps for 10 baseline classifiers and then asked to mark 50 classifiers as either poisoned or clean. For the study group Denoised Smoothing and Basic Adv, we ask participants to apply our attack method with the interactive tool and test if the model can be successfully attacked by alternative triggers. If so, then mark the classifier as poisoned.
We discuss the principle of using our tool to identify poisoned classifiers in section D.1. For the control group Saliency Map, we use RISE (Petsiuk et al., 2018) to generate saliency maps, as it is shown to outperform other saliency map approaches (Ramprasaath et al., 2017;Marco et al., 2016).

B.2 TROJAI INTERACTIVE TOOL
In Figure 10, we show an overview of the interactive tool which implements our attack method. The first half of the tool, as shown in Figure 10a, allows users to visualize adversarial examples with chosen attack parameters. Below each image is the class that the adversarial image is predicted. Figure 10b presents the second half of the tool, where users can create new alternative patch triggers and see the classifier's prediction on patched poisoned images.
(a) First half of the interactive tool.
(b) Second half of the interactive tool. Figure 10: Interface of interactive tool we develop for TrojAI dataset.

C.1 IMAGENET BINARY POISONED CLASSIFIER
Here we show the complete results for attacking binary poisoned classifiers on ImageNet in Figure 11. Notice that we find effective alternative triggers for all three poisoned classifiers.  Figure 11: Results for attacking three binary poisoned classifiers obtained by three backdoor attacks.

C.2 IMAGENET MULTI-CLASS POISONED CLASSIFIER
In Figure 12, we present the results for attacking two poisoned multi-class classifiers on ImageNet obtained by HTBA (Saha et al., 2020) and CLBD . We can see that our attack constructs effective triggers in both cases.

C.3 IMAGENET CLEAN CLASSIFIERS
In Figure 13 and Figure 14, we show the results of attacking binary and multi-class ImageNet classifiers. We can see that the clean classifier is not vulnerable to the triggers constructed by our approach.  Figure 13: Results of applying our attack on an ImageNet clean classifier (binary).  Figure 14: Results of applying our attack on an ImageNet clean classifier.

C.4 TROJAI
In Figure 15, we show results for attacking poisoned classifiers in the TrojAI dataset. Note that for all 8 poisoned classifiers, the highest attack success rate attained among four alternative triggers is 100%. In Figure 16, we show the results of applying our attack method to two clean classifiers from TrojAI datasets. It can be seen that clean classifiers can classify more than half of the test images correctly even if they are patched by the constructed triggers.    . We highlight those adversarial images with clear backdoor patterns. Note that they are all classified into class 2, which is indeed the target class of backdoor attack. While adversarial images from class 4 (the last row) have dense black regions, we believe that this is a result of mimicking features of class 0 (the class that these images are predicted into) and it can be easily tested using our method that these black regions can not be used to construct successful triggers.

E IMAGENET CLASSIFIERS WITH MORE CLASSES
In this section, we evaluate our method on ImageNet classifier with more number of classes. We randomly select 10 classes from 1000 ImageNet classes. We then use BadNet (Gu et al., 2017) to train a poisoned classifier with Trigger A. Figure 19 shows the results for attacking this poisoned classifier. We can observe that these alternative triggers have similar or even higher attack success rate than the original trigger.  Figure 19: Results of attacking a poisoned ImageNet classifier with 10 classes. The success rate of the original backdoor is 59.71%.


A Collusion-Resistant Identity-Based Proxy Reencryption Scheme with Ciphertext Evolution for Secure Cloud Sharing

In order to solve the challenges of user data security in the cloud computing (storage) environment, many encryption solutions with different features have been presented. Among them, proxy reencryption (PRE) based on public-key infrastructure (PKI) is a promising technology for secure cloud sharing. And identity-based proxy reencryption (IBPRE), which uses identity as the public key, eliminates burdensome certificate management and is, therefore, more preferable. However, most of the current IBPRE schemes only focus on the processing of data sharing while overlooking the functions of authorization revocation and ciphertext update, which are more closely related to the security of data itself. Moreover, the few existing schemes that involve ciphertext update turn out to be impractical because the length of ciphertext increases with the reencryption of ciphertext. In this paper, an improved IBPRE scheme, which provides improvements on the inadequacies of the scheme proposed by Ateniese et al. especially in terms of collusion safety and ciphertext evolution, is proposed. To the best of our knowledge, this is a practical IBPRE scheme integrating the functions of access authorization, delegation revocation, ciphertext update, reauthorization, and conditional reservation delegation.)e proposed technique has high practicability in the scenario where a large number of ciphertexts need to be updated synchronously. Lastly, the comparative analysis and simulation results show that the two reencryption algorithms in the proposed scheme have the shortest computing time than other schemes.

Introduction
With the advancement and prevalence of cloud computing technology, more and more users opt to store their user data on cloud servers due to its convenience and ubiquity of access. However, different from local storage, the control and ownership of data in cloud storage are separated, and the cloud server is not completely trustworthy. Outsourcing data to the cloud will face many security issues and challenges in data integrity, confidentiality, access authorization, ciphertext search, and ciphertext evolution. To solve these security problems, many scholars have conducted numerous relevant researches and proposed various solutions. For example, there are cloud storage public auditing schemes for data integrity [1], proxy reencryption (PRE) schemes for encrypted data authorization [2], identity-based encryption (IBE) schemes with keyword search [3], IBE schemes supporting ciphertext update evolution [4], and lattice-based encryption (LBE) schemes to achieve postquantum security [5]. Some of these solutions addressed multiple aspects of data security, while others focused on only one or two aspects of data security. For example, the PRE scheme [6] assumes that the proxy is semitrusted and will follow the protocol and not tamper with the user's data to ensure data integrity. It only focuses on confidentiality and access authorization of the data.
It is too complex and unrealistic to consider all security issues in one cloud storage solution, but it is feasible and necessary to assemble some security requirements into one system. For example, in a personal data public cloud sharing application scenario, it urgently requires an encryption solution, which includes functions of access authorization, key update, ciphertext update, authorization revocation, reauthorization, conditional reservation authorization, and avoids complex certificate management. e consideration is based on the reasons as follows: (1) Access authorization is the primary function of secure cloud data sharing. If a user's encrypted private data stored in the cloud are accessed only by himself but not shared with others, it is not as convenient as carrying a large mobile storage device around. At present, to realize secure authorization of encrypted data, PRE technology is considered as the most promising solution. Also, identity-based proxy reencryption (IBPRE) uses identity as the public key, eliminates burdensome certificate management, and is, therefore, more preferable. (2) Authorization revocation is also a function that must be considered in the personal data cloud sharing scheme. If a user's identity has expired or his key has been broken, his access permission should be revoked. (3) e necessity of reauthorization. If the original authorization expires or becomes invalid after the ciphertext is updated or the key is updated, the authorization must be renewed for the legitimate user. (4) e need for the key update. For cryptography systems, its security relies on the protection of the key. According to the Special Publication SP-80057 [7] issued by the National Institute of Technology (NIST), cryptograph-based ciphertext key has a strict life cycle; that is, the key needs to be updated after a certain period. (5) e requirement of ciphertext update. ere are two types of ciphertext update. e first one is passive update. If the authorized access permission is revoked, the encrypted ciphertext should be renewed to prevent the old authorization key and the revoked visitor from continuing to access the ciphertext. e second one is active update, also be termed ciphertext evolution. If the delegator updates his encryption key, the ciphertext needs to evolve synchronously. (6) Special requirements for conditional reservation authorization. Sometimes, the user wants to specify the requestor's access right at the reserved time to implement access control. For instance, one user with a solar energy collection system wants to sell the excess energy to others in the microgrid. Similarly, other prosumers also wish to sell their excess energy. ese suppliers will share their energy information to an energy consumer, who cannot access the report containing the energy price in advance. Otherwise, it may lead to malicious bidding or collusion.
As far as we know, the IBPRE scheme can basically achieve access authorization without complicated certificate management.
ere are also some proposals that have supported conditional authorization [8,9], some systems that have achieved authorization revocation [10,11], and some schemes that have even considered the function of updating ciphertext [10]. However, no satisfactory solution has been found to meet all of the above needs. erefore, this motivates our work to find a practical IBPRE scheme with functions of access authorization, ciphertext update, and delegation revocation.
1.1. Related Work. PRE allows a proxy to convert a ciphertext under one user's (delegator's) public key into another ciphertext which can be decrypted with another user's (delegatee's) private key, without disclosing the underlying plaintext and secret key information. Since Blaze et al. [12] proposed the first PRE scheme, a large number of PRE schemes with different characteristics have been presented.
In [13], Nuñez et al. reviewed, compared, and analyzed the main PRE researches. eir study included PKI-based proxy reencryption [14][15][16], identity-based proxy reencryption (IBPRE) [17,18], attribute-based proxy reencryption (ABPRE) [19,20], and lattice-based proxy reencryption (LBPRE) [21]. Among these studies, the IBPRE scheme is presented to be an important research direction. It combines identity-based encryption (IBE) [22,23] and PRE [12], where the user's identity is used as the public key for encryption, avoiding the complex public-key certificate management which is beneficial in several scenarios. Green and Ateniese [18] put forward the first IBPRE scheme, in which two noncollusion safe approaches were introduced, and some promising applications of IBPRE were mentioned. Subsequently, many improvements and applications were proposed to meet various needs and shortages of previous solutions. Wang et al. [24] proposed two IBPRE schemes that could resist collusion attacks. e first one has no ciphertext expansion, while the second one achieves CCA security. Wang et al. [25] gave an improved multiuse IBPRE scheme, which achieves CCA2 security in the random oracle model. eir solution gives a confirmable answer to the open problem mentioned in [18]. Shao and Cao [26] introduced the first CCA-secure and collusion-safe IBPRE scheme in the standard model. Xu et al. [8] presented a conditional identity-based broadcast PRE scheme and applied it to cloud e-mail. Zhou et al. [27] proposed an IBPRE scheme with version 2, which provides a ciphertext transformation from complicated identity-based broadcast encryption (IBBE) to simple IBE. Ge et al. [9] presented a secure fine-grained identity-based broadcast PRE scheme for encrypted microvideo sharing. e schemes mentioned above analyzed the efficiency, security, and access control of the algorithms in detail but did not consider the functions of permission revocation and ciphertext evolution.
Liang et al. [10] proposed an efficient cloud-based revocable IBPRE scheme for periodic key and ciphertext updates by updating time tokens, in which the length of ciphertext increases linearly with the number of times of reencryption. Sun et al. [4] proposed a CCA-secure revocable IBE with ciphertext evolution for data sharing in cloud storage, which emphasizes that the size of the ciphertext in the cloud remains in constant size regardless of evolutions. However, their approach is not based on PRE. e ciphertext stored in the cloud is encrypted by the data owner using the identity of the requester instead of his own identity, which means that there are multiple ciphertexts stored on the cloud corresponding to different requesters, instead of only one ciphertext in the PRE system. Shafagh et al. [6] realized a project that includes functions of authorization, revocation, key update, and ciphertext update in PKI-based architecture, which needs complex certificate management.
Intuitively, IBPRE (such as in [10,25,26]) can be used directly for updating ciphertext, but usually ciphertext grows with the number of encryption times, which is not practical.

Our Contributions.
Inspired by the work presented in [6], we propose an improved IBPRE scheme, which includes the functions above for a secure personal data cloud sharing application.
is improved approach has the characteristics of noninteractivity, unidirectionality, collusion safety, ciphertext optimization, and multiuse and nontransferability in the random oracle model. Moreover, the ciphertext update (reencryption) operations can be executed multiple times, and the ciphertext length remains the same. e ciphertext reencrypted (delegated) to the delegate, however, cannot be reencrypted (reauthorized). e improvements are based on Green and Ateniese [18] and aim to realize secure user data sharing on cloud servers by combining essential characteristics of data sharing, ciphertext updating, and attribute-based access permission granting and revocation. Furthermore, the scheme also highlights the properties of multiuse and collusion-resistant and the optimization of reencryption performance (that shortens reencryption time; ensure efficiency when many users access data, or much ciphertext updated concurrently). e main contributions of this paper are as follows: (1) Provide improvements in the work proposed in [18] that focuses on achieving collusion safety and multiuse without ciphertext expansion and minimizing reencryption time.
(2) Propose a practical IBPRE scheme that includes functions of access authorization, delegation revocation, ciphertext update, reauthorization, and conditional reservation delegation to implement secure cloud data sharing. (3) Apply the improved IBPRE scheme to a practical secure user data sharing application and provided an analysis comprehensively. e rest of the paper is organized as follows. Section 2 describes some of the cryptographic primitives, definitions, and some properties of the proxy reencryption. e system model and the assumptions of the proposed scheme are given in Section 3. e improved IBPRE algorithm is described in detail in Section 4, and the application of the improvements is deployed to a secure cloud data sharing scenario presented in Section 5. A comparison and analysis of the proposed scheme and existing schemes are provided in Section 6, and finally, the conclusion is given in Section 7.

Bilinear Map and Decisional Bilinear Diffie-Hellman
Problem [25] Definition 1 (bilinear map). Let G 1 and G 2 are two cyclic groups of the same prime order q and g be a generator of G 1 . We say that e: G 1 × G 1 ⟶ G 2 is a bilinear map if it satisfies the following properties: (1) Bilinear: for all a, b ∈ Z * q and g ∈ G 1 , e(g a , g b ) � e(g, g) ab .
Definition 2 (decisional bilinear Diffie-Hellman (DBDH) problem). Let G 1 and G 2 are two cyclic groups of the same prime order q and g be a generator of G 1 . Support that e: G 1 × G 1 ⟶ G 2 is a bilinear map. e decisional bilinear Diffie-Hellman (DBDH) problem is to decide, given a tuple of values (g, g a , g b , g c , T) ∈ G 4 1 × G 2 (where a, b, c∈ R Z * q ), whether T � e(g, g) abc holds.
Let k be a security parameter of sufficient size. Formally, we say that the DBDH assumption holds in G 1 , G 2 , e, if for all probabilistic polynomial time (PPT) algorithm A, the following condition is true, where v(·) is defined as a negligible function:
We say that an IBPRE-CE scheme is consistent if for any valid identities id 1 , id 2 , and id 1 ′ , their secret keys sk id 1 , sk id 2 , and sk id 1 ′ (generated by KeyGen), the corresponding reencryption key rk id 1 ⟶ id 1 ′ and rk id 1 ⟶ id 2 (generated by RKGen 2 and RKGen 1 ), and ciphertexts c id 1 , c id 2 , and c id 1 ′ (computed by Encrypt, Reencrypt 1 , and Reencrypt 2 ), the following equations hold: (1) Setup. e challenger C runs Setup(1 k ) to generate the master public parameters (mpp) and the master secret key (msk). e mpp is sent to A, while the msk is kept securely. (2) Phase 1. A issues some private key queries O sk , updates reencryption key queries O uk , and delegation reencryption key queries O dk as follows: (i) On receiving any query of the form (O sk , id), C returns sk id ←KeyGen(mpp, msk, id) to A. (ii) On receiving any query of the form (O dk , id 1 , id 2 , C 1 ), C returns rk id 1 ⟶ id 2 ←RKGen 1 (mpp, sk id 1 , id 1 , id 2 , C 1 ) to A, where sk id 1 ← KeyGen(mpp, msk, id 1 ) and C 1 is an element of ciphertext. (iii) On receiving any query of the form (O uk , id 1 , id 1 ′ , C 1 ), C returns rk id 1 ⟶ id 1 ←RKGen 2 (mpp, sk id 1 , id 1 ′ , C 1 ) to A, where sk id 1 ←KeyGen (mpp, msk, id 1 ) and C 1 is an element of ciphertext.
(4) Challenge. At the end of phase 1, A outputs two equal-length messages m 0 and m 1 , and a challenging identity id * which does not exist in trivial decryption (e.g., A holds a private key of id * or some transformation keys which are update reencryption keys or delegation reencryption keys from id * to id and the decryption key of id ). e challenger C returns a challenge ciphertext A adaptively issues queries as phase 1 with some restrictions that the private key of id * and any trivial decryption key query (O sk , O uk , O dk ) have never been queried. e restrictions are as follows: (i) e private key corresponding to id * has not been queried. (ii) If a series of update key queries which originate from id * to id 1 , next from id 1 to id 2 ,. . ., from id n− 1 to id n , have been issued, the private key of any id in set ID = {id 1 , id 2 , . . . id n } has not been queried. (iii) If the delegation key query from id * to id j has been issued, the private key of id j has not been queried. (iv) If a series of update key queries which originate from id * to id 1 , next from id 1 to id 2 ,. . ., from id n− 1 to id n have been issued, and delegation key from any id in set ID = {id 1 , id 2 , . . . id n } to id j has been queried, the private key of id j has not been queried.

Properties of Proxy Reencryption.
In literature [13], Nuñez et al. summarized several security concepts and properties of PRE and described that the existing schemes are either unidirectional or bidirectional, single use or multiuse, collusion safe or not, transferable or nontransferable, transitive or nontransitive, identity-based or not, and interactive or noninteractive. In addition, based on the achieved notion of security, PRE schemes can achieve chosen plaintext attacks (CPAs) security or chosen ciphertext attacks (CCAs) security. For clarity, this subsection briefly reiterates some of these properties, in particular, giving focus to those that are provided by the proposed scheme and are relevant for practical instantiations of IBPRE: (1) Noninteractivity: this property means that the user does not need to interact with the requester or trusted third party because there is no need for their secret information (e.g., private key or master system key) to generate the reencryption key. With this property, the user can delegate access permission to the requester without interaction and can even assign a requester's decryption condition associated with its identity.
(2) Multiuse capability: the ciphertext can be converted multiple times, e.g., from the ciphertext c id 1 to ciphertext c id 2 and from ciphertext c id 2 to ciphertext c id 3 . erefore, the data owner can update the ciphertext multiple times as needed.
(3) Collusion safety: in this characteristic, even if the delegatee colludes with the proxy, the delegator's private key does not be compromised. And we can denote it as rk id 1 ⟶ id 2 + sk id 2 ↛sk id 1 , where rk id 1 ⟶ id 2 is the reencryption key known by the proxy, and sk id 2 is id 2 's (delegatee's) private key, and sk id 1 is id 1 's (delegator's) private key.
(4) Nontransitivity: in this characteristic, the proxy (or two colluded proxies) cannot derive a reencryption key from two continuous reencryption keys. For example, rk id 1 ⟶ id 2 and rk id 2 ⟶ id 3 can get rk id 1 ⟶ id 3 .
(5) Nontransferability: this property means that a delegatee (even if colludes with the proxy) cannot transfer the decryption ability to a third party or entity. For example, user id 1 generates the reencryption key rk id 1 ⟶ id 2 to delegate the decryption capacity to the requestor id 2 who can decrypt the reencrypted ciphertext but cannot generate a new delegation key which originates from id 1 (i.e., rk id 1 ⟶ id 3 ) or reencrypt the delegation ciphertext to generate a new ciphertext which can be decrypted by a third entity with the private key sk id 3 . (6) Unidirectionality: with the reencryption key rk id 1 ⟶ id 2 , the proxy can convert user id 1 's ciphertext to another one that can be decrypted by the user id 2 , but not vice versa. (7) Ciphertext optimality: the ciphertext does not expand upon reencryption. is property means that the size of the ciphertext will be constant when transformed. (8) Key optimality: the requester needs only one private key to decrypt the ciphertext encrypted by himself or the reencrypted ciphertext comes from different proxies.
Besides the characteristics described above, it is also worthy to note that there are other properties identified to be essential for some applications of PRE introduced in [13,14,18,24].

System Model and Assumptions
3.1. System Model. As shown in Figure 1, the system consists of the user (data owner and delegator), the requester (delegatee), the private key generator (PKG), and the cloud server (proxy). e PKG is responsible for generating the master public parameters and master secret key of the system, so it should be a trusted third party. All the participants in the system can get the master public parameters, but only PKG knows the master secret key. In addition, the PKG will generate a corresponding private key when it receives a legal key generation request for a user's identity. en, the generated private key (and the master public parameters) will be sent to the user securely. e user is assumed to subscribe to a cloud service from a cloud service provider for user data storage and/or data processing. After getting the public parameters from the PKG, the user can encrypt the user data with the identity before uploading it to the cloud server for storage. e user can download and decrypt the ciphertext with his own secret key. If the data needs to be shared with some requesters (e.g., friends or cooperators), the user needs to generate a corresponding reencryption key (a.k.a. delegation key). is reencryption key also needs to be sent to the proxy secretly. Moreover, the user generates an update key, which is also a reencryption key for updating the ciphertext on the cloud server through the proxy. e requester may be a friend or a cooperative partner who wants to access some of the data encrypted by the data owner and stored on a cloud server. e requester, who is a valid delegatee, can decrypt the delegation ciphertext converted by the proxy to get the delegator's data. To reduce the complexity, the authentication of the requester is not considered in this work. e proxy stores the ciphertext encrypted by the user and transforms the ciphertext with the reencryption key. If the reencryption key is for updating ciphertext, the proxy transforms the ciphertext to a new ciphertext directly. If the reencryption key is for delegation, the proxy will keep it secret and use it to generate a new delegation ciphertext when the legitimate delegatee requests the user data. Finally, the proposed scheme assumes that the cloud server only keeps one copy of the data.

System Security Assumptions.
e proposed work assumes that the user's private key can be transported secretly from the PKG to the user. e user's delegation key can be securely sent to the proxy (cloud server) too. e cloud service is robust but not wholly trusted; that is, the user data and delegation key stored on it will not be lost due to some Security and Communication Networks physical disasters or not be modified, but the cloud server or its administrators because of several reasons (curiosity or specific purpose) are interested in obtaining user data as well as some of the user's key. Moreover, the cloud servers might collude with some malicious users, or a former authorized user whose permission has been revoked is also considered in the improvements. All entities in the system will follow the communication protocol that will respond to the request correctly.

Proposed Scheme
e differences between the proposed scheme and the original scheme in [18] exist in three aspects: reencryption key generation algorithm, reencryption algorithm, and decryption algorithm: (1) ere are two reencryption key generation algorithms in our proposal. e first one (RKGen 1 ) improves the key generation algorithm of the original scheme by replacing the multiplication operation in the function with a bilinear mapping operation. In this way, if the proxy colludes with the delegatee, they can only get the bilinear pair, but not the private key. us, this achieves collusion resistance. e second one (RKGen 2 ) is a new reencryption key generation algorithm, wherein the generated key is used for updating ciphertext and is discussed in detail in Section 5.
(2) Our approach has two reencryption algorithms with different functions, while the original scheme only has one reencryption algorithm used for delegation. e first reencryption algorithm REncrypt 1 used to calculate the delegation ciphertext is single use. e newly added one REncrypt 2 used for ciphertext update is multiuse. We utilize these two algorithms to perfectly solve the contradiction between requiring multiple reencryption and not allowing reencryption.
(3) Two decryption algorithms are used in the proposed system. e first one Decrypt 1 is used by the data owner to decrypt ciphertext or updated ciphertext which have been reencrypted for several times. e second one Decrypt 2 is utilized by the delegatee to decrypt the delegated ciphertext. In the original scheme, however, there is only one decryption algorithm used to decrypt original (level-1) ciphertext and reencrypted (level-n, n > 1) ciphertext. And for the delegation ciphertext, the decryption needs to be performed recursively. Firstly, the latter two terms of the ciphertext are decrypted with the private key of the delegatee to get the random number selected in the calculation of the reencryption key. en, the random number is used to calculate the plaintext. However, in the proposed scheme, the decryption object is an optimized ciphertext (ciphertext is not extended when reencrypting), so there is no need for recursive decryption.
For the sake of simplicity and comparison of the Green and Ateniese [18] (shown in Figure 2) and the proposed scheme (shown in Figure 3), a description and a detailed discussion are given below.

A Brief Description of Original Scheme.
e original scheme has six algorithms as follows: where G 1 and G 2 are two cyclic groups of the same prime order q and g is a generator of G 1 . Select two hash functions q , set the master secret key msk � s, and output the master public parameters mpp � (G 1 , G 2 , q, g, g s , H 1 , H 2 ).
(3) Encrypt(mpp, id, m): providing mpp, identity id, and data m as input, randomly select r ∈ Z * q , and the algorithm outputs a corresponding ciphertext c id � (g r , m · e(g s , H 1 (id)) r ).

Detailed Design of the Proposed Scheme.
ere are nine algorithms in the proposed scheme, and the process flow is depicted in Figure 3. e description of the processes is as follows: (1) Setup: let e: G 1 × G 1 ⟶ G 2 be a bilinear map, where G 1 and G 2 are two cyclic groups of the same prime order q and g is a generator of G 1 . Select a random s ∈ Z * q as the master secret key msk and two hash functions Output the master public parameters mpp � (H 1 , H 2 , g, g s , q) while keeping the master secret key msk � s private. (2) KeyGen(msk, id): when PKG receives a key generation request from a legitimate user with identity id, this algorithm takes as input mpp (this parameter is included implicitly here and in following algorithms for simplicity), msk, and identity id and generates the corresponding private key sk id � H 1 (id) s . (3) Encrypt(id, m): when a user wants to encrypt data m ∈ G 2 with identity id, the encryption algorithm picks r∈ R Z * q and computes C 1 � g r and C 2 � m · e(g s , H 1 (id) r ) to generate the ciphertext c id � (C 1 , C 2 ), which will be sent to a cloud server for storage.
and ciphertext c id 1 � (C 1,1 , C 1,2 ) as input, the algorithm computes C 1,1 ′ � R 1 and C 1,2 ′ � C 1,2 · R 2 and outputs a new ciphertext c id 1 ′ � (C 1,1 ′ , C 1,2 ′ ) which will replace the old ciphertext c id 1 to store on the cloud server. (8) Decrypt 1 (sk id , c id ): after downloading the ciphertext c id � (C 1,1 , C 1,2 ), original ciphertext or updated ciphertext, from the cloud server, the user (data owner and delegator) runs the algorithm to compute m � (C 1,2 /e(C 1,1 , sk id )) with the private key (usually the latest private key corresponding to the newest identity) to output the plaintext or an error flag ⊥. (9) Decrypt 2 (sk id 2 , c id 2 ): the requester (delegatee) decrypts the delegation ciphertext c id 2 � (C 2,1 , C 2,2 ) with the private key sk id 2 � H 1 (id 2 ) s to output plaintext or an error flag ⊥. e process is as follows:

Security Analysis of the Proposed Scheme.
In this study, two reencryption key generation algorithms are employed, the reencryption key generation algorithm for ciphertext update is a new one, and the other for the delegation is an improved one. In an event where the delegatee colludes with the proxy, it can obtain the value e(g r , sk id 1 ) rather than sk id 1 which means achieving collusion safety. e ciphertext obtained by the former one is in the same format as the ciphertext is generated directly with the new identity id 1 ′ . So the security analysis is the same as the scheme [18].
In addition, we analyze the possible security problems caused by the collaboration of two reencryption key generation algorithms. e delegatee and the proxy conspire to compute a value e(g r , sk id 1 ) from the delegation key. If an attacker constructs another pair such as (g r′ , e(g s , H 1 (id 1 ′ ) r′ )), a new update key rk id 1 ⟶ id 1 ′ � (g r′ , e(g s , H 1 (id 1 ′ ) r′ )/e(C 1 , sk id 1 )) can be calculated. If the proxy updates the ciphertext with this forged key, a spoofing attack will happen. However, we have assumed that the user can securely send the reencryption key to the proxy and the user needs to be authenticated, and the proxy is semitrusted, so the unauthenticated attacker cannot update the ciphertext even if he has built a new update key.
Next, we present the formal security proofs for the proposed scheme in the random oracle model as follows.

Theorem 1. Suppose the DBDH assumption holds, our IBPRE-CE scheme is IND-PrID-CPA secure in the random oracle model.
Proof. Let A be a PPT algorithm that has a nonnegligible advantage ϵ in attacking the proposed scheme. We use A to construct a second algorithm B, which has a nonnegligible advantage at solving the DBDH problem in G 1 and G 2 . Algorithm B accepts as input a properly distributed tuple (G 1 � g, g a , g b , g c , T) ∈ G 4 1 × G 2 and outputs 1 if T � e(g, g) abc . A interacts with algorithm B as follows.
First, algorithm B treats the hash functions H 1 and H 2 as random oracles and performs the following simulation: (1) Simulation of H 1 : 0, 1 { } * ⟶ G 1 . When a query for identity id is received, simulator searches the hash table L 1 which includes some tuples like (id, h, z, α). If the id exists in the L 1 , return h as the query result. Otherwise, flip a weighted coin that the probability of heads is c (represented as Pr[α � 1] � c) to get a random α ∈ 0, 1 { }. Select z ∈ Z * q randomly and compute h. If α � 1, set h � g z ; otherwise, set h � (g c ) z . No matter α � 1 or 0, h is correctly distributed.
(2) Simulation of H 2 : 0, 1 { } * ⟶ G 1 . When a query for string X like K‖id 1 ‖id 2 where K � e(sk id 1 , H 1 (id 2 )) is received, simulator simply returns x ∈ G 1 and records tuple (X, x) into table L 2 . en, the interaction simulation proceeds as follows: (1) Select. A selects i from set 0, 1 { }. (1) Private key query. When A sends an identity id to B to query its corresponding private key, B evaluates H 1 (id) as above to get (id, h, z, α) and returns sk id � (g a ) z to A. (2) Update key query. When A sends an update key query from identity id to id′, B selects r, r ′ ∈ Z * q randomly and evaluates H 1 (id) and H 1 (id ′ ) to obtain (z, α) and (z ′ , α ′ ). If α � 0, B computes rk id⟶id ′ � (e(g a , H 1 (id ′ ) r′ )/ T z ) and returns it to A. Note that this update key is incorrectly formed.
(4) Challenge phase. At the end of phase 1, A submits challenge identity id * and two same length message m 0 , m 1 ∈ G 2 to B who will evaluate H 1 (id * ) and look for tuple (id * , h, z, α) from table L 1 and return challenge ciphertext c * � (g b , m i · T z ) to A. Note that there are following restrictions on id * to avoid trivial decryption: (1) e private key corresponding to id * has not been queried. (2) If a series of update key queries which originate from id * to id 1 , next from id 1 to id 2 ,. . ., from Security and Communication Networks id n− 1 to id n have been issued, the private key of any id in set ID = {id 1 , id 2 , . . . id n } has not been queried. (3) If the delegation key query from id * to id j has been issued, the private key of id j has not been queried. (4) If a series of update key queries which originate from id * to id 1 , next from id 1 to id 2 ,. . ., from id n− 1 to id n have been issued and delegation key from any id in set ID = {id 1 , id 2 , . . . id n } to id j has been queried, the private key of id j has not been queried.
(5) Phase 2. A issues query as in phase 1 except restrictions as above.

Conditions for Abort
(1) When the private key query for id * is issued, α is chosen to be 1. (2) When the private key queries for other id except id * are issued, α is chosen to be 0. (3) When the update key queries from id j to id j (rk id i ⟶ id j ) are issued, if id i ⟶ id j lies along a path leading from id * , the value α for id j is chosen to be 1. Or id i ⟶ id j does not lie along a path leading from id * , the value α for id i is chosen to be 0. (4) When the delegation key queries from id i to id j (rk id i ⟶ id j ) are issued, if id i ⟶ id j lies along a path leading from id * , the value α for id j is chosen to be 1. Or id i ⟶ id j does not lie along a path leading from id * , the value α for id i is chosen to be 0.
Claim. If B does not abort during the game, then A's view is identical to the real attack, except reencryption keys of the form rk id * ⟶ ··· . e discussion of this case can refer to [18]. If the input to B is a DBDH tuple, then the challenge ciphertext c * is correct encryption of m i under id * and hence (subject to the definition of A and the argument above) |Pr[i ′ � i] − (1/2)| ≥ ε. When the input to B is random, c * represents the encryption of a random element. Since A is unable to distinguish between the simulation and a real attack, it must hold that Pr[i ′ � i] ≥ ϵ + (1/2) for a nonnegligible ϵ. Hence, B succeeds with nonnegligible advantage.

Application Scenario Implementation of the Proposed Scheme
In this section, we introduce a secure cloud data management scenario and apply the improved algorithms mentioned above to implement three secure data management functions: (1) Update ciphertext and update the key to achieve access permission revocation (2) Reauthorization after the ciphertext is updated (3) Conditional reservation authorization 5.1. Secure Cloud Data Management Scenario. In a cloud data sharing environment, the user encrypts data with the identity and uploads it to the cloud server. User data may be encrypted and uploaded to the cloud server at different times. Usually, the same random number r is selected to encrypt several files at the same time, while different random number r is chosen to encrypt files at different times. In order to share the encrypted data to others, the user needs to calculate the corresponding reencryption key for the ciphertext. Table 1 shows the relations of plaintext, ciphertext, random number, and time (can be utilized to compute the lifetime of the key) during encryption and reencryption keys list (REK list) for delegation. In Table 1, the random value and the time can be the same which means that these data were encrypted at the same time, where C i � (g r i , m i · e (g s , H 1 (id 1 ) r i )), and REK i ⊆ rk id 1 ⟶ id 2 , rk id 1 ⟶ id 3 , . . . is a reencryption key list that contains some reencryption keys corresponding to the delegation. If this set is empty, this means the data are not allowed to be shared with others.
For the sake of analysis, let us assume this scenario: user id 1 has three types of files (m 1 , m 2 , and m 3 ), which are encrypted with the identity and stored on the cloud server. e first type of file m 1 is some study notes shared with a requester (a common learner with identity id 2 ). e second type of file m 2 is personal photos that involve some private information and should not be allowed to be accessed by others. e content of the third file m 3 is several relevant information that a user (assumed as a prosumer) shares with the utility organization or other prosumers in a microgrid.

Delegation Revocation Management.
From the construction of the reencryption key, we can find that the delegation reencryption key has nothing to do with the second part of the ciphertext but only with the random number chosen for the ciphertext, the delegator, and the delegatee. Assume that the files m 1 , m 2 , and m 3 are encrypted with the same random number under the identity id 1 . In this situation, as long as one of the user's files is authorized to the requester, the proxy can use the delegation reencryption key to delegate all other data to the requester. So it is not security. To keep the user's other files safe, the user needs to revoke the delegation of the requester. Here, it can revoke access rights by updating the ciphertext. e processing of revoking the requestor id 2 's access permission to files m 2 and m 3 is shown as follows: Step 1: generate a new identity. e user combines wellknown information with an attribute (manufacturer/ smart meter id: id sm ) of microgrid devices (i.e., smart meter) as a new identityid 1 ′ � id 1 ‖id sm for the third type of file m 3 . In the same manner, the user will also combine another attribute as an encryption identity for the second type of file m 2 . Both operations are the same, and file m 3 is considered for the following analysis.
Step 2: generate a new private key. e user sends the new identity to the PKG to generate a new private key sk id 1 ′ � H 1 (id 1 ′ ) s .
Step 4: update the ciphertext. After receiving the update reencryption key rk id 1 ⟶ id 1 ′ � (R 1 , R 2 ), the proxy uses it to convert the ciphertext c id 1 to a new ciphertext c id 1 ′ � (R 1 , C 1,2 · R 2 ) � (C 1,1 ′ , C 1,2 ′ ), which will replace the old ciphertext c id 1 to store in the cloud server. Note that the proxy does not save this reencryption key.
Step 5: the user (data owner) decrypts the updated ciphertext with the new private key sk id 1 ′ . e computation steps are as follows: (1) C 1,1 ′ � R 1 � g r′ .
Obviously, when the requester requests the data from the cloud server again, the new ciphertext transformed by proxy from the updated ciphertext with old reencryption key rk id 1 ⟶ id 2 cannot be decrypted with the requester's private key sk id 2 � H 1 (id 2 ) s because So, when the user revokes the delegation for the requester id 2 by updating the ciphertext, the proxy will delete the corresponding old reencryption key. And when the requester id 2 requests the data, the user will refuse to generate a delegation key.

Reauthorization Management.
After the above ciphertext update operation, given that these operations were also applied to m 2 . It can now only be accessible to the data owner. However, file m 3 is required to be shared with other entities (other prosumers or the utility organization and assume identity is id 3 ) in the microgrid. For example, the user needs to reauthorize to energy consumers id 3 , and this process is shown as follows: Step 1: generate the reauthorization key. e user (delegator) runs the algorithm RKGen 1 (sk id 1 ′ , id 1 ′ , id 3 , C 1,1 ′ ) to compute a new reencryption key rk id 1 ′ ⟶ id 3 . e calculation process is shown as follows: . en, this reencryption key is sent to the proxy to update the reencryption key list.
Step 2: generate reauthorization ciphertext. When the requester (delegatee) wants to access the data, the proxy runs the algorithm REncrypt 1 (rk id 1 ′ ⟶ id 3 , c id 1 ′ ) to convert the updated ciphertext c id 1 ′ to a new ciphertext . en, the ciphertext c id 3 is sent to the requester (delegatee).
Step 3: decrypt the reauthorization ciphertext. After receiving the ciphertext from the proxy, the requester decrypts the ciphertext c id 3 with the private key sk id 3 � H 1 (id 3 ) s to get the plaintext. e decryption process is shown as follows:

Conditional Reservation Delegation Management.
is function is added to handle the time period access control in scenarios where a user wants to grant access to a requester at a future time. For example, one user with a solar energy collection system wants to sell the excess energy to others in the microgrid. Similarly, other prosumers also wish to sell their excess energy. ese suppliers will share their energy information to an energy consumer, who cannot access the data containing the energy price in advance. Otherwise, it may lead to malicious bidding or collusion. is situation may require conditional reservation delegation. In this work, this process is shown as follows: Step 1: encrypt the bidding file and upload it to the cloud. e user (seller, identity is id 1 ) generates an energy information file and encrypts it with the identity. e ciphertext c id 1 � (C 1,1 , C 1,2 ) is uploaded to the cloud server and can be shared with other users.
Step 2: generate conditional reservation delegation key: (1) e user assigns the combination of the requester's identity, another information attribute (i.e., smart meter id), and a date constraint (i.e., trade schedule) as the identity id 3 � identity||id sm ||duration. (2) e user generates a delegation reencryption key rk id 1 ⟶ id 3 � e(C 1,1 , H 2 (K id 1 ,id 3 ‖id 1 ‖id 3 ) · sk id 1 ) and uploads to the proxy and indicates the composition of the delegatee's identity. Step 3: generate a private key. At the appointed time, the requester applies for the private key sk id 3 � H 1 (id 3 ) s corresponding to the identity id 3 � identity||id sm ||duration from PKG.
Step 5: decrypt the delegation ciphertext. e requester decrypts the ciphertext c id 3 with the private key sk id 3 � H 1 (id 3 ) s to get the plaintext. e process is shown as follows: (1) K id 3 ,id 1 � e(sk id 3 , H 1 (id 1 )).

Comparison and Analysis
In this section, we compare the proposed scheme with three PRE schemes in terms of characteristics, functionality, computation cost, and efficiency. In literatures, several works that implement secure data sharing with PRE can be divided into two categories. One is based on PKI, and the other is identity-based. Identitybased architecture can be further divided into two categories: BF (Boneh-Franklin) [22] architecture in the random oracle model and waters [23] architecture in the standard model. For convenience and simplicity of comparison and analysis, GA (Green-Ateniese) [18] is chosen as the representative of BF architecture, LLWS (Liang-Liu-Wong-Susilo) [10] for waters architecture, and SHB (Shafagh-Hithnawi-Burkhalter) [6] for PKI architecture to compare with the proposed scheme. e GA 1 and GA 2 correspond to basic IBP1 in the GA scheme, and GA 2 is an optimization of GA 1 in terms of the absence of ciphertext expansion during reencryption but is not multiusable and nontransferable. Table 2 shows some of the characteristics and achieved security notion of the schemes for two functions: update and delegation. Since the reencrypted ciphertext in scheme GA 2 is non-reencryptable [25], this method cannot be used to update the ciphertext and not included in the comparison set supporting updates. Similarly, the delegation function is not discussed in the scheme LLWS, so it is not included in the function comparison set of delegation. For the update function, the decryptor is still the data owner himself regardless of the original ciphertext or the updated ciphertext.
ere is no change in the access right. It is of no need to consider transferability, which is not compared in the table and filled with "-." e TM and EM represent true multiuse and expansive multiuse, respectively [13]. Note that although the reencryption key generation algorithm needs an element of the ciphertext, the proposed scheme is still noninteractive because the ciphertext component can be downloaded from the cloud server without the involvement of proxy. e characteristic comparison in Table 2 is important for secure data sharing application, and the definitions are described in Section 2. In most cases, the public-key certificate has an expiration date. In addition, a user's key (both public and private key) needs to be changed for security consideration. ese changes will cause the ciphertext to be updated.
us, in the process of user data management, ciphertext update is a very common operation, and the proxy reencryption algorithm must support multiple encryptions (multiuse). Furthermore, reencryption that leads to the extension of ciphertext length is not allowed. us, the scheme should achieve ciphertext optimization. Moreover, in cloud servers, the delegation ciphertext is not permitted to be shared again, which is a typical security policy for data sharing.
us, this requires that the scheme should be nontransferable, but the schemes GA 1 and GA 2 are transferable. In the PRE system, the CPA security is a minimum requirement, and the private key of the delegator should be safe even if the delegatee colludes with the proxy; this means that the scheme should be collusion safe as achieved by the proposed one. If the user data need to be shared with multiple requesters in the PKI-based system, the user has to maintain a lot of public-key certificates. It will induce a higher overhead to the user. However, since the proposed proposal is identity-based, this situation is avoided. e essential feature of PRE is delegation. us, it is used as the basis of underlying encryption in many secure data sharing systems. However, many proposals in literature only considered the delegation function but did not include the function of revoking delegation. Some systems employ conditional authorization, but very few schemes have taken the conditional reservation delegation into account. Furthermore, fewer schemes in the literature involve the ciphertext/key update and reauthorization, and even if there are, the analysis is not detailed enough. Table 3 compares the functions of some existing representative schemes and the proposed approach. It is observed that the proposed scheme is a comprehensive data sharing solution that supports all the essential features of delegation, delegation revocation, conditional reservation delegation, ciphertext update, and reauthorization required for secure cloud data sharing.
In Table 4, the computational cost of each phase is shown. For the sake of illustration, Setup, KeyGen, and Encrypt denote the setup algorithm, key generation algorithm, and encryption algorithm, respectively. Decrypt 1 denotes the decryption algorithm used by the data owner to decrypt the ciphertext (original or updated). Decrypt 2 denotes the decryption algorithm used by the delegatee to decrypt the reencrypted delegation ciphertext. RKGen 1 denotes the delegation key generation algorithm. RKGen 2 denotes an update key generation algorithm. REncrypt 1 denotes the reencryption algorithm for generating a delegation ciphertext. REncrypt 2 denotes the reencryption algorithm for updating ciphertext. t P denotes the pairing computation time. t R denotes the time of the random computation. t M denotes the calculation time of group element multiplication or division operations (the inverse computation is seen as division operation). t E denotes the computation time of a group element power operation. In these calculations, the selection of random values, multiplication, division, and inverse takes tens of microseconds; exponentiation takes several milliseconds and pairing takes between 10 and 20 milliseconds. Table 5 and Figure 4 show the computation time of each phase of the five schemes. For the convenience of calculation, the hash calculation in all algorithms is not considered. e SHB scheme is the ElGamal algorithm based on the elliptic curve. e LLWS scheme is mainly used for ciphertext updating. us, the run time of algorithm RKGen 1 and REncrypt 1 for authorization is not provided. Note that the run time of the algorithm Decrypt 1 is for decrypting the original ciphertext, while the run time of the algorithm Decrypt 2 is for decrypting the reencrypted ciphertext, which is updated only once. e GA work does not include ciphertext update or is not suitable for updating ciphertext (e.g., ciphertext expands with reencryption), and the time of update key generation and ciphertext update was also not   [28], where the parameter is the type A curve. In Table 5, the setup time (the length of the user's identity is 50 bits) of the LLWS scheme is larger than other systems because it is a waters-based architecture and often needs to generate more system parameters. Since the time of hash computation in KeyGen algorithm is not included, the computation time of this phase in the LLWS scheme is less than the BF architecture. For the purposes of simplifying comparison, the calculation times of the Setup phase and KeyGen phase are omitted. And it is shown that the computation time of LLWS is the longest, while SHB is the shortest. e computation time of Setup, KeyGen, Encrypt, and Decrypt 1 are the same in GA 1 and GA 2 and the proposed proposal because these approaches are based on BF architecture. And the computation time for Decrypt 2 of the three schemes is approximately the same. During the RKGen 1 phase, the proposed scheme needs two pairing computations making the computation time larger than GA 1 and GA 2 . Although the computation time of RKGen 2 is very long, the impact on the overall system will be modest because the number of keys needed to be calculated is few and the ciphertext update frequency is not too high. Furthermore, the computation time of REncrypt 1 and REncrypt 2 in the proposed scheme is very short. erefore, the proposed algorithm has the quickest processing time when the proxy responds to the request for delegation or update, which is especially important when there are many access requests, or there are many ciphertexts that need to be updated. Since in practice, once the user refreshes the key, the ciphertext needs to be updated synchronously, and the reencryption (update) algorithm in our scheme only needs tens of microseconds, so it is very efficient to update a large number of ciphertext synchronously in practical applications.     Figure 5 shows the time required to update the ciphertext from 100 MB to 1 GB, respectively. e SHB scheme needs 26,873.24 seconds to update 1 GB ciphertext, while the proposed work only needs 44 seconds. is value plus the time of reencryption key generation (34.592 ms) is also much less than the time required by SHB. is means that the proposed scheme has high efficiency and practicability in the scenario that a lot of ciphertext needs to be updated synchronously after the key update.

Conclusions
In this paper, an improved IBPRE scheme is proposed to realize secure cloud data sharing. e approach fully considers the ciphertext update while considering the access authorization and supports file security management operations such as access authorization, authorization revocation, ciphertext update, reauthorization, and conditional reservation authorization. Moreover, the scheme included the characteristics of unidirectionality, noninteractivity, collusion safety, multiuse, nontransferability, ciphertext optimization, and key optimization, which are essential and practical for general applications. From the performed simulation and analysis, the two reencryption algorithms in the proposed proposal require only one multiplication of group elements, in which the processing time of simultaneously responding to multiple delegation requests or updating numerous ciphertexts is shorter compared with other schemes. However, as of this writing, the design only achieves CPA security in the random oracle model but aims to achieve CCA security in the future iteration.

Data Availability
e simulation codes based on PBC used to support the findings of this study are available from the corresponding author upon request.

Conflicts of Interest
e authors declare that there are no conflicts of interest regarding the publication of this paper.