extfieldsofstudy:
Computer Science
Medicine

text:
Granular Data Access Control with a Patient-Centric Policy Update for Healthcare

Healthcare is a multi-actor environment that requires independent actors to have a different view of the same data, hence leading to different access rights. Ciphertext Policy-Attribute-based Encryption (CP-ABE) provides a one-to-many access control mechanism by defining an attribute’s policy over ciphertext. Although, all users satisfying the policy are given access to the same data, this limits its usage in the provision of hierarchical access control and in situations where different users/actors need to have granular access of the data. Moreover, most of the existing CP-ABE schemes either provide static access control or in certain cases the policy update is computationally intensive involving all non-revoked users to actively participate. Aiming to tackle both the challenges, this paper proposes a patient-centric multi message CP-ABE scheme with efficient policy update. Firstly, a general overview of the system architecture implementing the proposed access control mechanism is presented. Thereafter, for enforcing access control a concrete cryptographic construction is proposed and implemented/tested over the physiological data gathered from a healthcare sensor: shimmer sensor. The experiment results reveal that the proposed construction has constant computational cost in both encryption and decryption operations and generates constant size ciphertext for both the original policy and its update parameters. Moreover, the scheme is proven to be selectively secure in the random oracle model under the q-Bilinear Diffie Hellman Exponent (q-BDHE) assumption. Performance analysis of the scheme depicts promising results for practical real-world healthcare applications.

Introduction
Cloud is a platform that provides on-demand availability, ubiquitous access to the data and a shared pool of configurable computing resources [1]. The outsourcing of data on the cloud is governed primarily through the principles of data sharing and data management. The benefits that the cloud offers prompt various organizations to outsource their data with reduced security management costs. The organizations and sectors that have already embrace the cloud and further explore its use cases include healthcare, telecommunication, and real-estate. Although the cloud offers many benefits, the remote third-party cloud servers are an active target as hackers may succeed to bypass their security firewalls to get unauthorized access. Even the cloud itself may be malicious and may try to exploit potential vulnerabilities to access the data or grant access to unauthorized users.
Healthcare is a collaborative environment that involves many organizations including pharmaceuticals, hospitals, and insurance companies, and therefore multiple users/multiple actors with different roles are accessing the same resources. Access to a patient's health record is required for proper diagnosis and prescription [2], insurance claims and data analytics [3]. Since the patients' health data is sensitive in nature and requires proper management to avoid privacy breaches. To be more precise, the access and interaction of multiple users to the same data gives rise to the possibility of data theft. Therefore, the scope of this research is limited to healthcare in which threats related to unauthorized access are prevented through efficient handling of patients' data and access rights by limiting unauthorized data access. To attain these goals, a promising solution is the Ciphertext Policy-Attribute-based Encryption (CP-ABE) [4] which has been considered for enforcing cryptographic access control on data. Using CP-ABE the data owner can enforce an access policy in a ciphertext using attributes, and any user conforming to the policy can access the data. ABE either CP-ABE or Key Policy-ABE (KP-ABE) is a one-to-many access control paradigm, that grants the same data access to multiple sets of users upon successful satisfaction of a policy by them.
In existing healthcare access control schemes [5][6][7][8][9], CP-ABE generates the same data for all users due to the fact that against every message a single ciphertext is generated and all the authorized users can have access to that same data. To elaborate, users satisfying individual attribute sets of a monotonic access policy in CP-ABE have access to the same data. Consider a scenario where doctors from a hospital have access to all the patient's sensitive healthcare data, while the secondary stakeholders consisting of nurses and pharmaceutical firms are restricted to a limited chunk of insensitive data. This granular data access cannot be attained with the conventional CP-ABE mechanisms. Instead, a multi message CP-ABE is required in this context, so that multiple messages, i.e., hierarchically driven keys are encrypted with it for the same data access. More details regarding hierarchical keys derivation is presented Section 6.1. Another limitation of existing healthcare schemes [5][6][7][8][9] is their nature as they are based on single attribute authority, however, in real life attributes can be from multiple stakeholders belonging to different authority domains like hospitals, and universities.
We remark that in the existing health-centric schemes [5][6][7][8][9], the policies are static and predefined. Due to the absence of a policy update feature, CP-ABE cannot be considered as a complete access control enforcement tool. This issue motivates to dynamically increase or decrease the privileges of specific users over certain sets of files. However, if the process of policy update somehow tries to reduce or cancel the access rights of some users over particular attributes, they might refuse an update in their attribute keys to decrypt data even after the policy update. Hence, to address the problem of non-cooperation from users; existing approaches focus to update keys for all unrevoked users in order to update the policy [10]. However, this solution reduces efficiency because the number of revoked attributes is generally a few; therefore, most of the effort is concentrated on unrevoked attributes for a policy update. Moreover, it should not always be the case that attributes are just only revoked from a policy; instead, mechanisms should be developed to cater for both the addition and the revocation of attributes in policy updates. Another issue to be addressed should be that the underlying CP-ABE should have constant computation costs to accommodate the resource-constrained devices. To resolve the above-mentioned issues, our contributions are enlisted below.

Our Contributions
To simultaneously address the inclusion of hierarchical access control to CP-ABE and to dynamically update the access policy privileges with constant computation costs, this paper makes the following contributions: The proposed construction addresses the inclusion of hierarchical access control to CP-ABE and dynamically updates the access policy with constant computational overhead.
• A comprehensive security and performance analysis of the proposed construction is presented to depict its effectiveness for dynamic access control in healthcare. • For security, we prove the proposed PC-MM-CP-ABE-EPU scheme to be selectively secure in the random oracle model under the q-Bilinear Diffie Hellman Exponent (q-BDHE) assumption. • This paper also studies the feasibility of the proposed scheme in the healthcare sector, where a patient can utilize it to specify access rights to his confidential data for doctors, nurses, and insurance companies. • For performance, real data is generated through a body wearable physiological sensor called the Shimmer [11]. The sensor is embedded with Micro-Electrical Mechanical System (MEMS) and physiological sensing components. The proposed scheme is tested using the data collected via the sensor.

Paper Organization
Rest of the paper is organized as follows. Section 2 highlights the existing works relating to the evolvement of attribute based encryption in general, and particularly for enforcing access control of data in healthcare. System Architecture is presented in Section 3, which discusses the roles of various actors in healthcare along with data access control policy specification. The preliminary cryptographic definitions, hardness assumptions, and concepts used to define the proposed PC-MM-CP-ABE-EPU scheme is stated in Section 4. The syntax and security model of the proposed PC-MM-CP-ABE-EPU scheme is listed in Section 5. Section 6, details the proposed cryptographic scheme for patient centric access control provision. In Section 7, we present the performance and security analysis of the scheme. Section 8 concludes the paper.

Related Work
After the notion of ABE was formalized by Sahai and Water [12], Bethencourt et al. [4] proposed its variant named as CP-ABE. The user decryption keys corresponded to attributes, while ciphertext was related to a policy defined over attributes in CP-ABE. However, the scheme [4] was proven secure in the generic group model. Later, Cheung and Newport [13] proposed a CP-ABE scheme to be secure in the standard model based on AND based access structure. The first decentralized multi authority CP-ABE [14] construction was formalized by Lewko and Water. The notion of multi message CP-ABE for providing access control to scalable media is proposed in [15] by extending the work of [4]. Later, Khan et al. [16] proposed multi message CP-ABE with multiple authorities working in a decentralized manner. However, both the schemes are proven secure in generic group and random oracle model. Zhang et al. [17,18] addressed the user's attributes information leakage issues.
In [19], each attribute has a feature expiry time. Attribute authority updates keys periodically according to this time parameter. Bethencourt et al. [4] comments that the expiry time should vary from one user to another, and be independent of the user's attributes. The authors in [20] introduced the concept of the users list so that even if any particular user satisfies the policy, but is excluded from the authorized list, he cannot have access to data. Further, the idea of the user ID revocation list is presented in [21]. However, both the time and ID based access control methodologies suffer from potential problems i.e., for the system controlling user privilege rights with respect to time needs to define the expiry time during the generation of user attribute decryption keys. Similarly, the authorized ID list needs to be generated along with ciphertext in encryption operation. Hence, any dynamic change of access control cannot be provisioned by employing these concepts. Yang et al. [10,22] proposed the concept of dynamic change of privileges by updating both the ciphertext and user decryption keys in case of attribute revocation. However, the incurred cost for both updating the ciphertext and user keys for non-revoked users is too much for practical considerations. Moreover, as stated in [23], the scheme presented in [22] is not collusion resistant after an update for attribute revocation is performed. Some other recent works tackling the issue of policy updating, i.e., addition and revocation of attributes are [24][25][26][27][28]. The Linear Secret Sharing Scheme (LSSS) matrix based access structure is employed for ciphertext generation and update policy in [24,25]. Moreover, the scheme in [24] is based on composite order groups and proved to be adaptively secure in standard model. Jiang et al. [26] presented the notions of two constructions separately for both attribute addition and attribute revocation selectively secure under the MSE-DDH assumption. In [27], the authors proposed a threshold policy update based CP-ABE. Signcryption based CP-ABE with policy update and outsourced computations is proposed in [28]. However, the computational costs of these schemes [26][27][28] is much and not suitable for resource-constrained devices. The authors [29] have effectively demonstrated the significance of ABE for resource-constrained IoT devices. Some other enhanced CP-ABE schemes [30] with variant features include attribute based proxy re-encryption [7,31], accountable CP-ABE [32], online/offline CP-ABE [5,7] and outsourced CP-ABE [33].
ABE has been employed in healthcare domain to address concerns relating to resource constrained client [5], doctor centric access control [6] and searchable trapdoor for hospital data [8,9] as seen from Table 1. However, existing schemes failed to grant patients with user-centric access control and policy update features as seen from Table 1. Moreover, all existing schemes are based on a single attribute authority, making it less scalable for autonomous organizations. Also, all existing schemes encrypt only a single message over a policy, thereby limiting the provision of hierarchical access control. All these issues are addressed in our proposed scheme for which we have designed a system architecture along with the cryptographic scheme as discussed in Sections 3 and 6 that can be easily employed in any healthcare facility requiring patient-centric access control. Another similar line of work for health-centric access control provision is Georgakakis et al. [34]. The authors in [34] proposed a generic location and time aware role-based access control mechanism for healthcare. Moreover, in emergency cases, the data access can be provisioned by the proposed "break the glass" notion to allow users to access data that they were not entitled to access under normal conditions. However, the mechanism is generic in nature, and no concrete cryptographic scheme is detailed to enforce access control.

System Architecture
This section is about the application of the proposed system in healthcare context with the help of a use-case scenario. This use-case presents a model according to which access rights and data security can be managed in a healthcare vicinity. To accomplish the desired objectives, this model is divided into four phases namely, data collection, policy specification/update and data aggregation, outsourced data access control and policy update, and data access whose details are provided below. Following that, the actors like a patient, doctor, professor, and insurance agent, who will use the system for secure access of data are discussed. Thereafter, core functions of the model including contextual policy specification and its update are explained. Finally, the functionality of other major components of the model involved in the smooth delivery of health facilities including attributes authorities (AA), cloud, and gateway are detailed. Finally, the security requirements that will be achieved by the proposed system are discussed at the end of this section.
In a healthcare scenario, the role of IOT-enabled sensors is pivotal as they help in collecting, retrieving, analyzing, and monitoring patients' medical data in real-time, which eventually helps in dealing with chronic diseases. The proposed system is a novel patientcentric multi-layered model to secure access of data present in semi-trusted servers. The proposed model is a suite of mechanisms, which provides hierarchical access control by considering access control policy defined by patient based on the actor's attributes. It leverages CP-ABE techniques to secure personal health data of patients being outsourced to the cloud and other related servers. Figure 1 depicts the proposed model of PC-MM-CP-ABE-EPU which works in four phases including data collection, policy specification update and data aggregation, outsourced data access control and policy update, and data access provision. The first phase is concerned with data collection from different IoT-enabled sensory devices. The next phase aggregates data at the gateway node. Moreover, access policy along with policy updates have also been specified in this phase. The third phase outsources data being controlled by the access control policy modules to the cloud. The last phase is all about accessing patients' data by doctors, nurses, professors, students and insurance companies. A brief description of the involved actors implementing the above-mentioned functionalities is as follows: • Patient: An entity seeking some medical treatment. This entity is responsible for encrypting data and defining/updating policy. For this, the patient executes Encrypt and Policy Update algorithms of PC-MM-CP-ABE-EPU, which are detailed in Section 6.2, and can be from In order to access the patient's data, all other actors except patient execute the Decrypt algorithm of PC-MM-CP-ABE-EPU, which are detailed in Section 6.2, and can be from Figure 1. Actors within a system require special access to the resources. For instance, doctors and nurses attending a particular patient may require access to the IOT-enabled sensors attached to it. Such access is generated based on the attributes of the actor. A cardiologist may entail access to heart monitors or ECG sensors only, while a neurologist acquires Electromyography (EMG), accelerometers, and gyroscopes. Hence, in the case of the proposed model, access would be granted based on the attributes of doctors and nurses. Since the proposed model provides hierarchical access control, therefore, the entities lower in privileges or hierarchy would have fewer rights in comparison to its parent. For instance, a nurse can access limited resources. Considering a scenario where a patient shares his specific data among the various actors including doctor, nurse and professor with the policy defined as (Hospital ∧ Doctor) OR (Hospital ∧ Nurse) OR (University ∧ Professor). Later, the patient decides to allow the student at the university to have access to data for research purposes, and to an insurance agent for claims regarding his medical expenditure. The updated version of the policy is (Hospital ∧ Doctor) OR (Hospital ∧ Nurse) OR (University and Professor) OR (University ∧ Student) OR (Insurance-company ∧ Insurance-agent). Consider a scenario where doctors from a hospital have access to all the patient's sensitive healthcare data, while the secondary stakeholders consisting of pharmaceutical firms, insurance companies and government are restricted to a limited chunk of insensitive data. This model is based on the concept of hierarchical access control, which means that each entity will acquire data based on its hierarchical position in the network. As shown in Figure 1 doctor can access all sensors of patient whereas nurse can only access 2, 4, and 5. It is because the nurse is lower in the hierarchy in terms of access privileges, and the patient has limited his access rights to certain specific sensors data only. Since the doctor is on top of hierarchy so he can easily view information accessible to his subordinates. Apart from actors, other major components of the model involved in the smooth delivery of health facilities include attributes authorities (AA), cloud, and gateway whose major tasks are discussed below.
• Attribute Authority: It is an entity that generates the public key parameters for contextual attributes (like for doctor and nurse), and assign decryption keys to user's based on their Global Identifiers (GID) and possessed attributes. All the attribute authorities, like Hospital AA, University AA, Insurance Company AA works in a decentralized manner. The algorithms of PC-MM-CP-ABE-EPU including the Global Setup, Authority Setup, and KeyGen are executed at AA as seen from Figure 1, and are detailed in Section 6.2. • Gateway: It acts as a trusted relay node to the cloud server with the help of a backbone network. The devices transmit generated data to the gateway. • Cloud server: The cloud server is a semi-trusted entity possessing great storage capacities and high computing power. It aims at storing a volume of encrypted data collected from several devices. The algorithm of PC-MM-CP-ABE-EPU namely Ciphertext Update is executed by Cloud as seen from Figure 1, and is detailed in Section 6.2. • IoT enabled sensors: These sensors are connected with the human body and collect biomedical data of patients. Some of these sensors include ECG, blood pressure, EEG, blood glucose, or pulse oximetry. Such sensors transmit biomedical data of patients to device, which will eventually be transmitted to the cloud. • Device: A device with the help of its built-in sensors is efficient enough to sense, process, and communicate data being generated. Due to these capabilities, different objects can be inter-connected over the network. These devices produce and dispense data to the gateway through a wireless communication medium. Since such data is sensitive in nature, so to assure its confidentiality, it is essential for constrained devices to encrypt it.
The flow of activities of the proposed model is exhibited in Figure 2. However, this model is based on some assumptions. Firstly, the attribute authorities are reliable entities, which can be fully trusted. Secondly, gateway and cloud are honest bodies but are curious. The gateway does not connive with the unauthorized receiver. Cloud will follow the protocol run, but it will try to infer and analyze the encrypted data placed over it. The cloud is considered as an adversary, but we will prove in the security proof, that the challenge ciphertext will be indistinguishable from the perspective of the adversary before and after ciphertext update. The proposed model covers the following aspects of security requirements. • Confidentiality and scalability: As the data produced by the devices contain critical content, therefore it should be kept secured and protected from unauthorized entities and cloud servers. Moreover, the proposed model should be flexible enough to accommodate a large group of authorized users accessing their data. • Fine-grained access control: The senders should define an access control policy for the transmitted data, which can be decrypted by the receivers possessing accurate attribute keys that comply with the access policy in the ciphertext. • Collusion resistance: As the devices and applications accessing the system are not trusted, therefore it is significant to ensure that two or more receivers cannot access data by integrating their attribute keys which they can't access separately. • Secure policy updating: The algorithm supporting policy update of ciphertext should never disclose critical information to the cloud server.

Preliminaries
In this section, we detail the definitions of Bilinear Pairing, q-BDHE hardness assumption, and access policy which is used to define a PC-MM-CP-ABE-EPU scheme in the forthcoming sections. Definition 1. Bilinear Pairing Let G be a multiplicative cyclic group of large prime order p , where generator g ∈ R G, and G T is multiplicative cyclic group of same order with its identity denoted by 1. Then, a bilinear pairing e : G x G → G T is a map with following properties: 1.
Definition 2. q-BDHE [35] Consider a bilinear group G of prime order p having two independent generators g and h selected at random from it. We represent y g,α,q = (g, g 1 , g 2 , ..., g q , g q+2 , , ..., g 2q ) ∈ G 2q−1 for g i = g α i for an unknown random α ∈ Z * p . An algorithm B which randomly selects β = {0, 1} has advantage of solving the q-BDHE problem if |Pr[B(g, h, y g,α,q , e(g q+1 , h) = 1)]| − |Pr[B(g, h, y g,α,q , T = 1)]| ≥ . Definition 3. Access Policy A Disjunctive Normal Form (DNF) policy W, namely a ciphertext policy for CP-ABE is a rule that returns either 0 or 1 given a set L of attributes. We say that L satisfies W if and only if W answers 1 on L. We use the notation L |= W to denote the fact that L satisfies W, and the case of L does not satisfy W is represented by L = W. Formally, given an access Given a user attribute list L = [L 1 , L 2 , ..., L m ], we say that L |= W if L j = v j for any one attribute set W i of W for 1 ≤ i ≤ p , and for all 1 ≤ j ≤ m.

Syntax and Security Model
This section details the syntax and security model of our proposed scheme. Notations used throughout the paper are listed in Table 2.

Syntax of PC-MM-CP-ABE-EPU
In this subsection, the algorithms that are part of Patient-Centric multi message CP-ABE with efficient policy update (PC-MM-CP-ABE-EPU) are discussed. Here, we detail only the syntax of the algorithms, the concrete cryptographic construction is presented in Section 6. Referring to Figure 1 in Section 3, the algorithms Global Setup, Authority Setup, KeyGen are executed by attribute authorities, Encrypt and Policy Update is executed by Patient, Ciphertext Update by Cloud, and Decrypt by contextual users like a doctor, nurse, and professor.
Global Setup(λ) → GP: Taking the security parameter λ as input, the algorithm outputs the global parameters GP of system. Authority Setup(GP) → SK, PK: Taking GP as input, each authority generates a secret key SK and public key PK corresponding to the attribute belonging to the authority. This algorithm is executed at each attribute authority, i.e, hospital AA, and university AA.
Encrypt(M i , W, PK) → CT: Taking PK and an access policy W = [W 1 OR W 2 OR...OR W p ] as input; the algorithm encrypts each message M i correspondingly with attribute set W i of policy for 1 ≤ i ≤ p to output a ciphertext CT. This algorithm is executed by patient.
KeyGen(GID, PK, L, x, SK) → K x,GID : A user with a global identifier GID has an attribute set L, where x ∈ L. This algorithm generates a key K x,GID corresponding to an attribute x and identity GID of user. This algorithm is executed at each AA.
Decrypt(CT, PK, L, K x,GID ) → M i : Taking the ciphertext and user attribute key set L as input, the algorithm outputs a message M i corresponding to attribute set W i of policy W; if L |= W. This algorithm is executed by the user's with contextual attributes like doctor, nurse, professor, and insurance agent.
Policy Update(PK, S owner , W, W ) → U : The algorithm outputs the update parameter U by taking as input the original policy W, update in policy W , PK and owner secret S owner embedded in ciphertext during encryption. This algorithm is executed by patient for updating the access control policy.
Ciphertext Update(CT, U ) → CT : The algorithm outputs the updated ciphertext CT by taking as input the original CT and ciphertext update U parameter. This algorithm is executed at cloud.

Formalized Security Model
In this section, we present the security model for proving our cryptosystem. The detailed security proof is in Section 7.1. We consider the following indistinguishability game under selective chosen-plaintext-attacks (I ND − sCPA) between an adversary A and challenger C for PC-MM-CP-ABE-EPU scheme. Init Adversary specifies and sends a challenge access policy structure W * to C. Setup C runs the global and authority setup algorithms to generate the global parameters GP and secret/public keys of attributes. It then gives the public keys and GP to A.
Phase 1 A queries for the secret keys by providing an attribute list L and identities GID. C replies with secret keys if L does not satisfy W * .
Challenge A specifies two distinct equal length messages (M 0,i = M 1,i ) correspondingly for each attribute set W * i in policy W * and an update parameter U * . In response, C chooses bit β = {0, 1} at random, computes CT * = Encrypt(M β,i , W * , GP, PK), and sends it to A if U * = ϑ. Otherwise, it sends CT = Update(CT * , U * ) to A. Phase 2 A continues to query for secret keys under the same constraint that the access structure W * should not be violated. Guess

Proposed Scheme
In this section, firstly we discuss the intuition behind the multi message CP-ABE and hierarchical access control provision in Section 6.1, and later in Section 6.2 we detail a concrete cryptographic construction for encforcing patient centric access control.

Methodology
To illustrate our idea, we begin with a simple example of monotone policy and then further extend it to define our intuition. A monotone access policy in its Disjunctive Normal Form (DNF) representation itself contains the individual AND (∧) based access structures. Hence, combination of AND (∧) based access policy [35,36] by placing OR between them itself leads to an expressive monotone access policy [13]. Consider a patientcentric policy as W = (Hospital-1 ∧ Doctor) OR (Hospital-1 ∧ Nurse) OR (University-1 ∧ Professor) OR (University-1 ∧ Student) OR (Insurance company-1 ∧ Insurance-agent). This policy W = [W 1 OR W 2 OR W 3 OR W 4 OR W 5 ] is comprised of 5 attribute sets namely, W 1 = (Hospital-1, Doctor), W 2 = (Hospital-1, Nurse), W 3 = (University-1, Professor), W 4 = (University-1, Student), W 5 = (Insurance company-1, Insurance-agent). Any user conforming to the policy (L |= W) needs to satisfy at least one attribute set W i of policy for i = {1, 2, 3, 4, 5}. A user attribute set L satisfies policy L |= W if W i ⊂ L [37], i.e., any attribute set W i of policy should be the subset of user attribute set L.
For further elaboration, Table 3 indicates five arbitrary user's along with their attribute sets L indicating whether or not they satisfy the policy W.
Suppose after sometime, the patient updates the policy W into W u as W u = (Hospital-1 ∧ Doctor) OR (Hospital-1 ∧ ENT ∧ Nurse) OR (University-2 ∧ Professor) OR (University-2 ∧ Student). After policy update, some contextual user's who were previously granted data access cannot access data after policy update.
For updating the policy, the data owner generates an update parameter U comprising of attributes that needs to be added or revocated from an existing attribute set W i of policy W. Secret t i values corresponding to W i which were embedded in CT are utilized by data owner for generating the update parameter. Hence, an owner needs to keep a record of secret t i values for policy updates in the future. The update U is sent to the server, and it runs the update algorithm for updating CT corresponding to new policy. However, the server cannot exploit both U and CT to get more information. Moreover, if any user satisfying the policy prior to its update has not decrypted CT; so he will also not be able to decrypt it after update if now he does not satisfy the new policy. In traditional CP-ABE schemes [4,13,35,36] a single message is embedded into a ciphertext for all the attribute sets W i of policy. So, all users satisfying any individual W i of policy leads to the same secret "s" re-construction, and hence have access to the same data. However, this cannot be adopted in the provision of hierarchal access control because there is a need to embed multiple messages in a single ciphertext over policy. To cater, we embed multiple secrets t i corresponding to attribute sets W i of policy W for encrypting multiple messages. This enables users satisfying any different W i to have access to different granularities of data. For enforcing hierarchal access control, data needs to be divided logically into chunks m 1 , m 2 , ..., m p and each chunk encrypted with hierarchically derived key [15,[38][39][40]. In this technique, several chunk keys are obtained from parent-node key such that key derivation follows the top-down (1-way) approach, i.e., from the parent node to descendant child-nodes. We detail the hash based key derivation [15].
The key k i generation corresponding to the i th level of hierarchy is proceeded as: For generating p number of chunk keys at the same hierarchical level from key k is proceeded as: where H is a standard one-way hash function. Table 3 depicts the granular data access control that doctor and professor have access to all data. However, student and nurse are restricted to a limited proportion of logical data as specified by the patient.

PC-MM-CP-ABE-EPU
In this subsection, we present our proposed Patient-Centric Multi Message Ciphertext Policy-Attribute Based Encryption with Efficient Policy Update (PC-MM-CP-ABE-EPU). We assume that there exist u attributes in the universe. Formally, in encryption, the public keys of involved attributes are aggregated to form a single attribute. Similarly, the decryption process includes an aggregation of user attribute keys satisfying policy. Hence, the construction leads to constant computational cost in encryption and decryption and is independent of the number of attributes. Moreover, each user has a unique identity by mapping its GID to a random group element, thereby restricting users to collude their attribute keys. To construct multi-message CP-ABE in a single ciphertext over policy, multiple secrets corresponding to different attribute sets of policy are embedded in ciphertext; in-contrast to a single secret for traditional CP-ABE schemes. Moreover, data owner acts as an enforcer of policy updates, while the server updates the ciphertext. For policy update, i.e., the addition or revocation of attributes; data owner generates the update parameter requiring only 2 exponential group operations on its side, while a single multiplication of group elements is performed at the server side.
The algorithms of the proposed scheme is defined as: Global Setup(λ) → GP: In global setup, a bilinear group G of prime order p is chosen. Global parameters are set to p, g, e(g, g) and H; where g is a generator of group G and H is a hash function that maps global identities GID to elements in G.
Authority Setup(GP) → SK, PK: For every attribute x that belongs to an authority, it chooses two random values a x , b x ∈ Z p . It sets secret key as SK = {a x , b x ∈ Z p } and publishes public key as PK = {g −a x , e(g, g) b x }.
Encrypt(M i , W, PK) → CT: Data owner defines an access policy W = [W 1 OR W 2 OR...OR W p ], where W i for i = 1 to p corresponds to an attribute set in policy. All the attributes with in an attribute set W i have an AND operation between them stating the significance that all of them must be present for satisfaction of policy. For enforcing hierarchal (different) access control corresponding to different W i of policy, data owner divides the data logically into chunks, where each data chunk M i is encrypted with hierarchically derived key k i for 1 ≤ i ≤ p as illustrated in Section 6.1.
For notational simplicity, we represent keys k i with messages M i in the rest of the paper. For each message M i corresponding to each attribute set W i of policy it chooses a random owner secret S owner = t i ∈ Z p . After then, it aggregates the PK of attributes from relevant authorities belonging to each W i and computes the ciphertext as: The owner then sends CT = {W, C 1,i , C 2,i , C 3,i } for 1 ≤ i ≤ p to the server. KeyGen(GID, PK, x, SK) → K x,GID : To create a key for user GID corresponding to an attribute x of authority, the authority computes: We remark that any user with a global identifier GID has an attribute set L, where x ∈ L, and a user can have more than one attributes keys based on his attributes in set L.
Decrypt(CT, PK, L, K x,GID ) → M i : If user attribute set L satisfies the condition W i ⊂ L for an attribute set W i in policy W; then he satisfies the policy L |= W and proceeds by calculating the aggregated key as K = ∏ x∈W i K x,GID . To retrieve plaintext message M i for corresponding W i , user computes: Policy Update(PK, S owner , W, W ) → U : For policy update, it takes W = [W 1 OR W 2 OR...OR W p ]; where W i contains the list of attributes to be added or revocated from the particular attribute set W i in original policy W. Intuitively, the addition of attributes is performed when W i ∩ W i = ϑ resulting in an updated attribute set policy as W u i = W i ∪ W i . Similarly, for attribute revocation the condition W i ⊂ W i needs to be satisfied resulting in an updated policy as W u i = W i \ W i correspondingly for a particular attribute set in W for i = {1, 2, ..., p }. Moreover, it takes the product of public keys PK and sets the parameters correspondingly for attributes addition or revocation from an existing attribute set W i . For performing the addition of attributes data owner sets o to S owner = t i ; while for revocation of attributes it sets o as −S owner = −t i . Data owner then sets the update parameter as U = {W u i , u 1,i , u 2,i } where W u i contains the updated list of attributes after addition or revocation of attributes from the particular attribute set W i in original policy W.
Ciphertext Update(CT, U ) → CT : This algorithm takes as input the original CT and update parameter U = {W u i , u 1,i , u 2,i }. For policy update, it takes the parameters u 1,i , u 2,i and multiply them correspondingly by original ciphertext CT components C 2,i , C 3,i for a particular W i for i = {1, 2, ..., p } as to obtain the updated ciphertext CT = {W u , C 1,i , C 2,i , C 3,i } for the updated policy. Observe that, the distribution of CT is similar to CT.

Correctness Decryption
In this subsection, we prove the correctness of the decryption algorithm.

Correctness Policy Update
For attribute's addition, o = t i , hence updated policy is W u i = W i ∪ W i , and the shares of newly added attributes is aggregated to already present attributes to transform the final ciphertext policy as: For attribute's revocation, o = −t i , hence updated policy is W u i = W i \ W i , and the shares of revocated attributes are cancelled out (due to negative/negation operation) from already present attributes to transform the final ciphertext policy as: We remark that the updated ciphertext is similar to (in form) and indistinguishable from the original ciphertext in policy.

Analysis and Discussion
Security and performance are the two major metrics that need to be evaluated from the prospect of any secure and efficient cryptographic scheme. This section, therefore, discusses the security and performance of the proposed scheme with the help of security proof and experimentations.

Security
With reference to the security model presented in Section 5.2, here we prove the following theorem to exhibit the security of the proposed scheme. Theorem 1. We show that the proposed PC-MM-CP-ABE-EPU scheme is selectively secure under chosen-plaintext-attacks (IND-sCPA) by a game played between an adversary A and challenger C as described in Section 5.2.
Proof of Theorem 1. We suppose the existence of an adversary A to break the proposed construction with a non-negligible advantage. We thus build a simulator B to interact with A in the IND-sCPA game; where B plays the role of challenger, and has an advantage to solve q-BDHE problem in group G. Suppose challenger inputs a q-BDHE instance (g, h = g s , y g,α,q , T) for a single encrypted message, where y g,α,q = (g, g 1 , g 2 , ..., g q , g q+2 , ..., g 2q ) for g i = g α i where α ∈ Z * p . We consider a slight modification in q-BDHE instance where h i = g t i for different attribute sets W i in policy W instead of h = g s for a single challenged attribute set in policy. Now, challenger inputs a modified q-BDHE instance (g, h i = g t i , y g,α,q , T i ). Infact, in the proof B encrypts messages M β,i for all the different attributes sets W * i in the challenged access structure W * .
Init A specifies and sends a challenge access structure W * = [W 1 , W 2 , ..., W p ] to B. Setup B selects randomly j * ∈ R I X i for every attribute set W * i , where I X i = {1, 2, ..., m} is the index of the attributes appearing in W * i . B picks a j * , c j * ∈ R Z p for each j * ∈ R I X i , and a j , c j ∈ R Z p for k = {1, 2, ..., n}. We remind here, that all attribute authorities are working in a decentralized fashion, and all attribute authorities work in a similar fashion for parameters generation. Here, challenger acts on behalf of authorities to generate parameters. For setting the public parameters correspondingly for each attribute authority, B proceeds as: if j / ∈ I X i , then (A j , B j ) = (g −a j , e(g, g) b j ) B then sends public key (A j , B j ) to A for the all attributes belonging to different authorities. Phase 1 A submits the several key queries corresponding to particular GID and an attributes set L of his choice. Generally, for such queries we assume that there should be at-least one attribute att x ∈ L for which the key query cannot be made, such that L = W * i . Particularly, the constraint is that the set L should not satisfy any of attribute sets W * i in policy. In response, B responds by selecting z ∈ R Z p and sets H(GID) = g j g z . Further, it sets the decryption keys correspondingly for attributes belonging to different authorities. For each authority, B sets the keys as: if j ∈ I X i − {j * }, then K j,GID = (g j ) a j g c j g q+1−j+j * (B j ) −z 3.
if j / ∈ I X i , then K j,GID = (g j g z ) a j g b j Finally, B returns the keys K j,GID to A for particular identities GID and user queried attribute set L.
Challenge In this phase, A submits two distinct equal length messages (M 0,i = M 1,i ) correspondingly for each attribute set W * i specified in policy W * and an update parameter U * to B. Simulator responds by setting a I,i and c I,i ; as a I,i = ∑ m j=1 a j and c I,i = ∑ m j=1 c j . Then, B chooses β ∈ R {0, 1} and calculates the ciphertext CT * for the entire policy W * . Moreover, accordingly to update parameter U * , it updates and sets the ciphertext CT as: B sends the ciphertext CT to A. Phase 2 Similar to Phase 1. Guess A outputs a guess β for β. For β = β, B outputs v = 0, and vice-versa for other case.
Probability Analysis Given a q-BDHE instance (g, h i = g t i , y g,α,q , T i ) to B, and an A breaks our PC-MM-CP-ABE-EPU with advantage . Then we present the analysis of two cases below.
Case 1 (U * = ϑ) In this case when there is no policy update, B sets the ciphertext CT * as: We note that ciphertext CT * = {C * 1,i , C * 2,i , C * 3,i } is a valid encryption of message M β,i if T i = e(g q+1 , h i ); otherwise, if it a random group element, i.e., T i ∈ G T , then CT * is independent of β in A view. For v = 0, the ciphertext CT * is valid and T i is set as e(g q+1 , h i ). A can guess correct β with a non-negligible advantage defined by Pr[β = β|v = 0] = 1 2 + . For v = 1, T i ∈ G T , CT * cannot be identified and we have Pr[β = β|v = 1] = 1 2 . From the analysis, the probability with which B succeeds in breaking the q-BDHE assumption is: 1 2 Pr[β = β|v = 0] + 1 2 Pr[β = β|v = 1] = 1 2 + 2 . Case 2 (U * = (att 1 , att 2 , ..., m ) = ϑ) In the case, when the A has requested for a policy update, B proceeds by first calculating the CT * as above.
After then, for addition or revocation of attributes specified by A in U * ; B runs the Update(CT * , U * ) → CT algorithm to update the ciphertext. B proceeds by updating the a I,i and c I,i to a I,i and c I,i respectively because of addition and revocation of attributes from particular attribute sets in CT * . Precisely, a I,i = ∑ m j=1 a j and c I,i = ∑ m j=1 c j and the distribution of the CT is identical to CT * . Finally, the set values of CT is We note that ciphertext CT = {C 1,i , C 2,i , C 3,i } is a valid encryption of message M β,i if T i = e(g q+1 , h i ); otherwise, if it a random group element, i.e., T i ∈ G T , then CT is independent of β in A view. For v = 0, the ciphertext CT is valid and T i is set as e(g q+1 , h i ). A can guess correct β with a non-negligible advantage defined by Pr[β = β|v = 0] = 1 2 + . For v = 1, T i ∈ G T , CT cannot be identified and we have Pr[β = β|v = 1] = 1 2 . From the analysis, the probability with which B succeeds in breaking the q-BDHE assumption is: There is an assumption that attributes are not repeated in the policy W * .

Performance Analysis
To demonstrate the performance of the proposed scheme, we firstly compare algorithmically our proposed scheme with the existing healthcare CP-ABE schemes. Moreover, to evaluate the effectiveness of the proposed scheme, the computation time of encryption, decryption, and policy update algorithms is evaluated by varying the number of attributes in the policy. In addition, for the effectiveness of model in real-time scenarios, a shimmer sensor has been employed, whose results are discussed below.

Algorithmic Complexity Analysis
Here, we give the performance analysis of our proposed scheme taking into consideration the existing relevant schemes. We remark that the encryption, decryption operations, and ciphertext size are the main factors affecting the communication and computation cost of the overall system. The user key generation is a one time process, hence it does not contribute significantly. Table 4 gives a comparison of our proposed scheme with existing multi message CP-ABE schemes [15,16], and healthcare centric CP-ABE schemes, [5][6][7][8]. None of the existing schemes facilitates the patient with defining access control policy. As seen from the Table 4, the encryption cost of the proposed scheme is constant with 3 exponential operations for an attribute set W i in policy. The decryption process comprises 2 pairing operations. Moreover, for the proposed scheme both encryption, decryption operations, and ciphertext size are independent of the number of attributes n in the policy; in-contrast to its dependence on attributes in other relevant existing schemes.
We compare the policy update feature of our scheme with Jiang et al. [26], Belguith et al., and [28] Li et al. [27] based on several parameters as seen from Table 5. The policy update operation is performed at the data owner/patient side, while the ciphertext update operation is performed at the server side. The encryption, ciphertext size, policy update, and ciphertext update costs is a function of p in the proposed scheme, where p is the number of attributes sets W i in the policy. However, for [26][27][28] the costs varies based on variables u, n and t, where u is the total number of attributes in universe, n is the number of attributes in access structure, t is the number of revocated attributes from ciphertext. Typically u and n generally have large values like u = 1000 and n = 30-100, and p is smaller like 5-15; hence, the fact reveals that costs for the proposed scheme are fairly less incontrast to [26][27][28]. This fact has been demonstrated with experimental results below.  [26] 3p E 2P p ((u − n + 1 + t)|G| + |G T |) p tE (u − n − 1)|G| [27] (3n + 2)E (2z + 2)P + zE (2n + 1)|G| + |G T | 3nE + nZ p 2n|G| + nZ p [28] (r + u + 6)E 8E + 6P (6 + u + r)|G| (3t E: Exponentiation, P: Pairing, G: Source group, i.e., g, G T : Target group, i.e., e(g,g), r: max number of revocated attributes, u: number of attributes in universe, n: number of attributes in access structure, t: number of revocated attributes from ciphertext.

Computational Complexity Analysis
In this section, we demonstrate our proof-of-concept prototype by implementing our proposed solution using a client-server architecture. All our simulation results presented here are carried on a Ubuntu 14.04 virtual machine with 2GB allocated Ram on a Dell Inspiron i3-6006U CPU@2GHz laptop with 8GB RAM. To test the feasibility of the proposed scheme, we have used a physiological health sensor: Shimmer3 motion (IMU) coupled with biophysical units. Table 6 highlights the different data streams that can be gathered through the Shimmer sensor and their sampling rate. The sampling rate of 128 Hz by GSR sensor indicates it generates 128 samples per second. However, the parameter values generated by the sensors differ, like GSR generates only 1 parameter value per sample. In-contrast, the Gyroscope and ECG sensors generate 3 and 4 parameter values per sample respectively. The shimmer sensor was worn by one of the participant and the physiological data stream was gathered for testing the feasibility of the scheme presented in this paper. We simulated the CP-ABE based policy specification/update results on a pairing based crypto library Charm [41], and the physiological sensors data encryption using Advanced Encryption Standard (AES) by employing Cipher Block Chaining (CBC) mode in pycryptodomex library [42]. We employed "SS512" symmetric curve with a base field of 512 bit to implement CP-ABE based pairing operations in Charm. The time presented here is the average over ten iterations in Charm and pycryptodomex libraries.
The x-coordinate depicts the number of attributes in an attribute set of policy. To elaborate that the computation and policy update cost of proposed scheme is almost constant for any number of attributes to be specified under policy, the number of attributes needs to be gradually increased to depict this effect. For Figures 3-6 horizontal axis shows the gradual increase of attributes to depict the effect.      Figure 4 shows the decryption time in milliseconds (ms) for user's with contextual attributes, i.e., doctor, nurse, and professor. As our proposed scheme is independent of the involvement of the attributes in encryption and decryption operations, hence the time is almost constant in contrast to [16] as seen from Figures 3 and 4.
For updating the policy, the generation of update parameter U involves an exponential operation and several multiplications depending on the number of attributes addition or revocation for our proposed scheme. Figure 5 indicates the time in (ms) taken by the patient for adding additional number of attributes to an existing policy. Similarly, Figure 6 shows it for the case of attributes revocation by patient from an existing defined policy. Figures 5 and 6 exhibit a fractional change in time of around 1 ms (almost constant) which incurred due to multiplication of group elements while increasing attributes from 2 to 10.
Any contextual user satisfying the policy will have access to data, this literally means that contextual user will have access to AES data encryption/decryption key with which the data owner has performed encryption. Considering the role of patient, we encrypted the data generated by the shimmer sensor-GSR, Gyroscope, and ECG with AES in CBC mode for 1 s time span. Table 7 shows the average encryption, decryption time in (ms) for the selected sensors. As the sampling rate and parameters per sample vary for all three sensors, hence the ciphertext size is different for all of the sensors as presented in Table 7.
The policy specification/update or its conformance is normally a one time process, and takes similar amount of time as seen from Figures 3-6 in comparison to data encryption timings as seen from Table 7. For real-time health care data acquisition, monitoring, analysis, and diagnosis; the policy specification and data encryption time should be less, so that an uninterrupted synchronous data transmission can be achieved between both parties. This fact can also be validated from the worst-case ECG sensor encryption time of 68 ms which is less than 1 s. We affirm that the proposed scheme performance is independent of the sensor used to generate the data.

Conclusions and Future Work
To address simultaneously the challenges of enforcing hierarchal access control and providing dynamic access privileges for healthcare, in this paper, we have proposed the notion of an efficient patient centric multi message CP-ABE with policy update. The proposed scheme can encrypt multiple messages to ensure access control for hierarchal groups of users resulting in users having access to different granularities of the same data. Moreover, the data owner can dynamically enforce addition or revocation of attributes from policy. Performance analysis of the scheme depicts that computation and communication costs incurred by the construction are almost constant; in contrast to depending on number of involved attributes in policy. Moreover, it is proven to be selectively secure under q-BDHE assumption in random oracle model. In future, we will extend the proof-of-concept prototype and integrate it with a public cloud platform.

Conflicts of Interest:
The authors declare no conflict of interest.


Recalling of Multiple Grasping Methods from an Object Image with a Convolutional Neural Network

In this study, a method for a robot to recall multiple grasping methods for a given object is proposed. The robot learns grasping methods using a convolutional neural network to observe the grasping activities of human without special instructions. For this setting, only one grasping motion is observed for an object at a time. By acquiring multiple grasping methods, the robot learns by automatically clustering the observed grasping postures. In the proposed method, the grasping methods are clustered during the process of learning the grasping position. The method first recalls the grasping positions. The network for recalling the grasping position estimates the multi-channel heatmap that indicates one grasping position in each channel. The method then checks the graspability for each estimated position. Finally, it recalls the hand shapes that are based on the estimated grasping position and the object ’s shape. This study describes the results of recalling multiple grasping methods and demonstrates the effectiveness of the proposed method.

Introduction
Recently several studies have been conducted on robots grasping objects. In order for a robot to perform a grasping motion, huge amount of information is needed, which includes the object shape, grasping hand shape, and arm motion information. It is troublesome for the user to provide this information to the robot. Therefore, it is desirable for the robot to automatically generate the action of grasping an object. Considering that the robot manipulates the object after grasping, it is important to generate a grasping motion that is convenient for the following manipulation.
In several related studies, a variety of approaches have been proposed to recall the object grasping method. Ekvall et al. [1] proposed a method to select the grasping type with the highest grasping quality for the object shape, which is approximated by shape primitives among the multiple grasp types based on the prior database. Nagata et al. [2] proposed a method to find multiple grasping methods for an indicated object based on shape primitives and they were presented to the user. Huebner et al. [3] proposed a method to determine the grasping method for an object model represented by box primitives. Ekvall et al. used a prior database and reported that the robot cannot handle situations that are not defined in the database. In three different studies [1][2][3], the robot used object models represented by shape primitives; thus it is difficult to recall a grasping method for complex object shapes. To solve this problem, it is desirable to learn the grasping method using the object shape without using a prior database and shape primitives. Several studies have been performed for estimating the various grasping methods and its confidence score using a neural network (NN) [4,5]. In addition, investigations have been performed to estimate the grasping method from the features of the posture and the color information of the object using the random forest classification algorithm [6,7]. These studies dealt with grasping that only carried objects. However, there are several ways to manipulate the object after grasping. For example, when we are carrying a cup, we usually grasp the upper part of the cup, and during drinking, we grasp the side of the cup. Because the grasping method is determined by the manipulation after grasping the object, it is necessary to learn to recall multiple types of grasping methods for a given object. There is a method for learning the optimal grasping method by using reinforcement learning [8]. However, since reinforcement learning generally learns the optimal action for a single problem, it is difficult to learn multiple actions, such as multiple types of grasping methods. There is a method for learning multiple types of grasping methods by using supervised learning. When learning multiple outputs to a single input with supervised learning, it is generally necessary to provide multiple correct data to a single input [9,10]. When learning a grasping method, the correct data is the data of the actual or simulated grasping of the object. It is difficult to acquire the correct data by using 3D models of the hand and the object. This is because a precise and realistic simulation environment is required. Therefore, it is necessary that the correct data is obtained by observing the grasping motions of the person. By using object and hand detection, visual information, such as an object shape, a grasping hand shape, and a grasping position on the object can be obtained as correct data. However, only one grasping motion can be observed in a single observation, and it is not possible to obtain the correct answers of multiple grasping methods at the same time. In order to learn multiple grasping methods for one object by observing the human grasping motion, it is necessary to cluster the grasping methods in the learning process and to recognize that there are multiple types of grasping methods.
In this study, we propose a method that uses a convolutional neural network (CNN) to learn multiple grasping methods. This is achieved by automatically clustering the grasping methods while learning human grasping motions through observation. We have divided the grasping method into the grasping position and the grasping hand shape. Therefore, learning the grasping method is divided into two steps: learning the grasping position for the object shape and learning the grasping hand shape for the object shape. These steps are performed using different networks. To cluster the grasping methods in the learning process, the network for the grasping position is designed to output multiple grasping positions for a single input. This network learns clustering by providing the correct position only to the channel output that is closest to the correct position for each learning sample. When different objects have similar shapes such as a cup with and without a handle, the learned grasping method for one object might be recalled for a similar object that is different. Therefore, a grasping method may fail in some cases. For instance, grasping the side of a cup may fail due to the interference of the handle. When a person grasps an unknown object, the person recalls multiple grasping methods, and it simulates these grasping methods to judge the graspability. Even when the robot recalls the grasping methods, an approach is needed to determine the graspability the recalled grasping positions. Whether or not it can be physically grasped at the recalled grasping position depends on the physicality of the person or the robot. Therefore, it is desirable to identify the graspability by performing grasping or a simulation. However, it takes time to perform grasping or simulating each grasping positions. We learned that the NN can estimate the graspability multiple grasping positions with certainty. This proposed method recalls the grasping method that can grasp an object by inputting only the grasping positions with a high estimated certainty to the network, which estimates the grasping hand shape network. The grasping hand shape network outputs a depth image of the grasping hand shape by inputting an object shape and one grasping position. Subsequently, it estimates the three-dimensional hand shape. However, the pixel of the depth image indicates only the depth distance, but it is not known which pixel in the image represents the hand. Therefore, the grasping hand shape network is designed to output two answers. This network learns the bitmap that represents the likelihood of the hand region in the image and the depth value in the hand region, respectively. By combining the estimated hand region image and the depth value image, this network presents a three-dimensional grasping hand shape. Section 2 describes the simultaneous recall method for multiple grasping methods, the network's learning method that learns the relationship between the object shape and the grasping method, and the learning method of the network that determines the graspability. In Section 3, we present the results of recalling multiple grasping methods while proving the usefulness of this study. This study describes an approach that simultaneously recalls multiple grasping methods from one object image using the CNN. As illustrated in Fig.1, this approach consists of three networks: the grasping position network, the grasping hand shape network, and the grasping position certainty network. The grasping method is recalled using the grasping position network and the grasping hand shape network. The grasping position network estimates multiple grasping positions for an object. The grasping hand shape network estimates the hand shape for each estimated grasping position. The grasping position certainty network estimates the certainty, which represents the possibility of being able to grasp an object based on its position. The estimated certainty is used to determine whether the object can be grasped at the estimated position. The process of recalling multiple grasping methods from an object image is as follows. 1. The multi-channel heatmap indicates one grasping position for each channel, which is generated by inputting the object depth image into the grasping position network. 2. The certainty for each grasping position candidate is estimated by inputting the combination of the object image and one channel of the multi-channel heatmap into the grasping position certainty network. 3. If the estimated certainty is greater than the threshold, it is determined that the grasping position is possible to achieve grasping. 4. The grasping hand shape image is generated by feeding the object image and the one-channel graspable position heatmap with high certainty into the grasping hand shape network. The grasping position heatmap is an image that represents the likelihood of the grasping position for each pixel. An object image, a grasping position heatmap, and a grasping hand shape image are represented in the same image coordinate. The learning method for each network is described in the following section.

Grasping Position Network
This network takes an object depth image and outputs the multi-channel heatmap that indicates one grasping position in each channel. Each channel represents a typical grasping position cluster for the objects. In our learning setting, the training dataset provides one correct answer for one input. This is because all the training data are assumed to be acquired in daily life scenarios where humans grasp objects. To recognize the different types of grasping methods by learning from a dataset, the network needs to automatically learn clustering by similar grasping types and object shapes. To create a cluster of similar grasping types during learning, the ground truth of the grasping position is given to the channel closest to the ground truth of the grasping position. This is among the multichannel heatmaps that are tentatively estimated for the training input image in each network update iteration. In addition, a constraint is introduced where each channel image for the estimated grasping positions must be as different as possible. The reason for this is that the different types of grasping positions are clustered for each of the channels. The loss function of this network is presented in Eq. (1), and the channel selection method is described in Eq. (2). where: is an input object image; ( )is the multi-channel heatmap that is estimated for by the grasping position network (•) ; , , and are the channel indices of the multi-channel heatmap; is the ground truth heatmap of the grasping position; is the set of coordinates with pixel values greater than 0 in ; is a set of all the pixel coordinates for the one-channel heatmap; and and are coordinate indices. The first term in Eq. (1) is the expression that normalizes the squared error between the ground truth of the grasping position and the one-channel heatmap that is selected in Eq. (2). By minimizing this expression, this network is trained to estimate the one-channel heatmap that is closer to the ground truth. The second term is the expression that normalizes the inverse of the squared error between each channel of the output multi-channel heatmap. By minimizing this expression, this network learns to output different estimations (i.e. different grasping position) for each channel. Eq. (2) selects the channel that has the largest sum of the pixel values at coordinates that are included in among the channels of the multi-channel heatmap that are normalized so that the sum of the pixel values is one for each channel.

Grasping Hand Shape Network
This network takes an object depth image and a one-channel heatmap, which indicates one grasping position candidate, and outputs a two-channel image, as shown in Fig.2. The first channel of the output image estimates the likelihood of the hand region for each pixel. In training, the binary image representing the hand region is given as the ground truth. The second channel estimates the depth value in the hand region. In training, the depth value is given to each pixel in the correct hand region. During the estimation, the hand shape image is recalled by multiplying the binarized hand region image with the hand depth image. The loss function of this network is presented in Eq. (3). where: is an input object image; ( ) is the th -channel heatmap that is selected by Eq. (2); ( , ( ) ) ℎ and ( , ( ) ) ℎ are the hand region likelihood image and the hand region depth image, respectively, which are estimated by the grasping position network (•); ℎ is the ground truth of the hand region likelihood; ℎ is the ground truth of the hand region depth; is a set of all the pixel coordinates in the hand shape image; and ℎ is the set of pixel coordinates in the hand region for the correct hand shape image. The first term is the expression of the cross entropy loss for the first channel. By minimizing this expression, this network learns the likelihood of the hand region for each pixel. The second term is the expression that normalizes the mean squared error of the depth value at the pixel coordinates that are included in ℎ for the second channel. By minimizing this expression, this network learns to estimate the depth values that are closer to the ground truth in the hand region. This network takes an object depth image and a one channel heatmap that indicates one grasping position candidate, and outputs a certainty that represents the graspability at that grasping position, as displayed in Fig. 3. As shown in the grasping possibility gate block of Fig. 1, the network estimates the certainty at each grasping position that is proposed by the grasping position network. To learn this network, it is necessary to prepare a sufficient number of training data that includes the graspable and the ungraspable positions for the objects to recall the grasping type. However, it is difficult to prepare the data for the graspability for each set of training data. Since the grasping position network clusters similar grasping positions during learning, it is expected that the grasping positions corresponding to typical grasping patterns will be output for each channel of the multichannel heatmap. Therefore, we classified the training data into a few object types, such as cups with and without a handle. In addition, we selected in advance the channel that outputs the grasping position that can be grasped for each object type. When training this network, a probability of 1 is assigned as the ground truth if the input heatmap is the heatmap of the selected channel; otherwise, 0 is given. The loss function of this network is described in Eq. (4).

Grasping Position Certainty Network
where: is an input object image, Φ( , ( ) ) is the estimated certainty for theth channel heatmap that is estimated by the grasping position certainty networkΦ(•), is the ground truth of the certainty, is the channel index, and is the number of channels of the multi-channel heatmap. This equation represents the average of the cross entropy loss for the estimated certainty. By minimizing this equation, this network learns the graspability at the input grasping position.

Experiment
To prove the usefulness of the proposed method, multiple grasping methods are recalled by using networks that learned the grasping methods as described in Section 2. In this experiment, we set the number of output channels of the grasping position network to three. Since it takes times to observe the human's motion and to collect the data of the grasping method, the artificial data of the various grasping methods are used for learning.

Dataset
The dataset consists of the object depth images as the input, and the grasping position heatmaps and the depth images of the grasping hand shape as the ground truth. When the training images are obtained by observing daily life scenes, only one grasping motion can be observed. If an object has multiple grasping methods, another type of grasping may be observed at the next opportunity for the same object; however, a new object image should be acquired in every observation. To simulate this scene observation, we defined each training sample as a triplet that consists of an input object image with only one grasping position heatmap and one hand shape image that is obtained by one observation. Since collecting many samples requires time-consuming efforts, we employed artificial training samples in which different grasping methods are associated with the same synthesized object images. In this study, we prepared objects with two grasping types: grasping from above and from the side. The object and hand shape regions are extracted from a 16-bit depth image that are taken by Kinect for Windows with a depth sensor. Then, the object images are augmented by overlaying them on random background images that are taken by Kinect for Windows. The background of the hand shape images are set so that all their pixel values are 5,000. The grasping position heatmaps have an 8-bit pixel depth which have a peak value at the pixel specified as the grasping position and profiles like the Gaussian function. The dataset is prepared by capturing 16 types of objects: eight types of cups with a handle and eight types of cups without a handle. These objects have different bottom depths, different sizes, and different shapes such as cylinders or inverted truncated cones, which were captured from eight different viewing angles. To increase the variety of object images, we randomly translated the objects by using 25 patterns. We rotated these objects in the range of -20 to 20 degrees and scaled them in the range of 0.94 to 1.06. A grasping position heatmap and a hand shape image are also processed by the same transformation as an object image for consistency. The dataset is divided into a training set, which includes 13 types of objects, and a test set of the three object types. We prepared 1.04 million training data and 1,200 test data in total. The examples of the dataset are illustrated in Fig. 4. Fig. 4 Examples of the dataset. Each row shows examples of the different grasping methods for the same object image. The object and hand shape image are displayed by a colormap for the visibility of the depth. Fig. 5 Results of recalling the grasping method with certainty for the training data. Each row in the second to rightmost columns corresponds to each typical grasping type that is clustered in the grasping position network. The third column displays the estimated grasping position and the ground truth are red and green, and the intersection pixels are yellow. The ground truth is displayed only on the image of the channel that is selected in Eq. (2). The pixel color of the object image and the hand shape image means that the depth values are converted by the colormap.   5 shows the results of recalling the grasping method and estimating its certainty for the training data, which includes five different object shapes. Although the hand shape image should be estimated only for the grasping position channel that is determined to be "graspable", namely with high certainty, the recalled hand shapes for any other grasping position candidates are presented here for analyzing the estimation process. Fig.6 shows the 3-D point cloud representation of the object and the recalled grasping hand shapes for the second object of Fig.5.

Results and discussion
As depicted in Fig.5, multiple different grasping methods are estimated for a variety of object shapes. It can be observed that the grasping positions were automatically clustered into each channel of the multi-channel heatmap through the training process. The second and third columns show that each estimated grasping position indicates each of the typical grasping positions that are observed in the training dataset. This includes the upper body, the handle, or the body's side from the input object. The grasping positions that are not seen in the dataset, such as an imaginary handle position of an object without a handle and the position of the handle's inside, are also recalled by the incorrect channels because their partial shape is similar to each other. It is determined that these impossible grasping positions have low grasping certainties and they can be rejected. The mean error and standard deviation of the estimated position for all the training data are 0.75 [pixel] and 0.76 [pixel]. The average object height for the training data is approximately 8 cm and the pixel size projected on the image is around 20 pixels. Since this error value corresponds to 0.3 cm in real space, it can be observed that the estimated positions are near the ground truth. The largest error in the training data is about 3.6 [pixel], which is shown as a result for the fifth object in Fig. 5. This error value corresponds to 1.4 cm in real space, which is comparable to the size of a fingertip.
As shown in the fourth column in Fig. 5, the estimated hand shapes for each grasping position that is seen in the dataset are close to the ground truth, such as the first and second rows of the first object. For the grasping positions that are not seen in the dataset, such as the third row of the first object and the first row of the third object, the recalled hand shapes are plausible for grasping. However, grasping is impossible because the hand is apart from the object or it interferes with the object. These impossible solutions can be appropriately rejected by evaluating the grasping position certainty as shown in the right-most column of Fig. 5.
The mean error and standard deviation of the recalled hand "depth" for all the training data are 13. 2 [mm], which is about the width of a finger, and 6.4 [mm]. An example of a poor result for the hand depth recall is shown in the second row of the second object in Fig. 5. The recalled grasping hand depth for that object has a 19 [mm] error on average for all the pixels in the image, but the pixels around the fingertip have a 10 [mm] error on average, which is more precise than the mean error for all the training samples. As shown in the point cloud in the second row of Fig. 6, the fingertips are precisely in contact with the object part to the handle. These results explain that the grasping hand shape network successfully learned the graspable hand shape at the grasping position for the various objects.
As shown at the right-most column in Fig. 5 which displays the grasping position certainty, the certainty value is close to 1 when grasping is possible at the input position; otherwise, it is close to 0. The grasping position certainty for all the training data is accurately predicted with a mean estimation error of 0.02 and its standard deviation of 0.13. In this study, we determined that the grasping type is possible for the input object if the certainty is over the threshold. We set the threshold as 0.8, which gives the highest accuracy of 98.3%, and a precision of 98.0% was achieved under that threshold setting. Fig.7 displays the results of recalling the grasping method and estimating its certainty for the test data in the same way as Fig. 5 for the training data. Fig. 8 shows the 3-D point clouds of the object and the recalled grasping hand shapes for the second object in Fig. 7. Fig. 7 Results of recalling the grasping methods with certainty for the test data Fig. 8 Point cloud of the object and recalled grasping hand for the second object in Fig. 7 As shown in the second column in Fig. 7, multiple grasping positions are estimated for the unknown object images. The mean error and its standard deviation of the estimated grasping position for all of the test data are 1.16 [pixel] and 0.79 [pixel]. The average object height for the test data is approximately 7.5 cm and the pixel size that is projected on the image is around 20 pixels. Since this error value corresponds to 0.44 cm in real space, which is smaller than the width of a finger, the estimated positions are considered to be near the ground truth.
The fourth column in Fig. 7 shows the grasping hand shapes that are estimated for each estimated grasping position. The mean error and standard deviation of the recalled hand depth for all the test data are 19.5 [mm], which is larger than the width of a finger, and 7.3 [mm]. As shown in Fig.8, since the fingertips are in contact with the object and it is precise with the training data, it can be observed that the grasping hand shape network successfully estimated the grasping hand shape for the unknown object images.
As shown in the right-most column in Fig. 7, which displays the grasping position certainty, the estimated certainty value is close to 1 when grasping is possible at the input position; otherwise, it is close to 0. The grasping position certainty for all the test data is accurately predicted with a mean estimation error of 0.03 and its standard deviation of 0.15. The grasping position certainty network estimates the grasping position certainty for the unknown object images with a high accuracy of 97.3% and a high precision of 97.1%. Fig. 9 The recall results of the multiple grasping methods for a real image. The region cropped by the white frame in the left image is the input object image. Each row of the right image corresponds to the recalled grasping method. Fig. 9 shows the recall results of the multiple grasping methods for a real image. The left image is captured by a depth camera. Each row of the right image is the input object image that is overlaid with the recalled grasping method. This includes a grasping position, a grasping hand shape, and a grasping position certainty. In the lowest row, since the estimated certainty value is exceedingly lower than the threshold of 0.8, grasping was determined to be impossible at that position and the grasping hand shape did not receive more estimations.

Conclusions
This study proposes a method to recall grasping methods for objects having multiple graspable positions and grasping hand shapes. This technique trains the CNN to recall multiple grasping methods by automatically clustering the object shapes and grasping types in the learning process without prior knowledge of the type and number of grasping methods for each object. The grasping positions common to each of the typical grasping methods are automatically clustered into one of the multi-channel heatmaps during learning. In addition, the CNN generates the grasping positions corresponding to the learned typical grasping methods. The plausible grasping methods for the input object are chosen by evaluating the estimated grasping position certainty as the graspability. The proposed method was applied to cups with and without a handle and the suitable grasping methods were successfully recalled with their certainties.
Future issues: 1. Extend the proposed method to objects that have grasping types not distinguished by the grasping position, such as holding a pen when writing and pinching it when the pen is being carried. 2. Develop a method to generate a motor command for grasping by the robot hand based on the recalled hand shape image. Fig. 10 The recalling results for a variety of real images. The results that are determined to be ungraspable are based on the estimated certainty, which are displayed by the dark images.

Declarations
Ethics approval and consent to participate Not applicable Consent for publication Not applicable Availability of data and material The dataset used used during the current study is available from the corresponding author on reasonable request.


PolyU CBS-Comp at SemEval-2021 Task 1: Lexical Complexity Prediction (LCP)

In this contribution, we describe the system presented by the PolyU CBS-Comp Team at the Task 1 of SemEval 2021, where the goal was the estimation of the complexity of words in a given sentence context. Our top system, based on a combination of lexical, syntactic, word embeddings and Transformers-derived features and on a Gradient Boosting Regressor, achieves a top correlation score of 0.754 on the subtask 1 for single words and 0.659 on the subtask 2 for multiword expressions.

Introduction
The notion of complexity has often been debated in linguistics and, depending from the disciplines, it might have different meanings.
In linguistic typology, for example, complexity is generally studied as a property of the language system as a whole, it is conceived as the number of (morphological, syntactic, semantic etc.) distinctions that a speaker has to master, and it is assessed by comparing different languages (McWhorter, 2001;Parkvall, 2008). On the other hand, in the perspective of psycholinguistics and cognitive science, the notion of complexity can be described as the difficulty encountered by language users while processing concrete linguistic realizations (sentences, utterances etc.) (Blache, 2011;Chersoni et al., 2016Chersoni et al., , 2017Chersoni et al., , 2021Iavarone et al., 2021;Sarti et al., 2021). Finally, in the Computational Linguistics community, the assessment of complexity at the lexical level is often related to readability applications (Shardlow et al., 2020), with the goal of determining if a word in a given text will be difficult to understand for the language users. Such applications are extremely useful for second language learners, for speakers with relatively low literacy and for people with reading disabilities, helping to tailor the difficult level of the texts to the needs of the target users.
Task 1 of SemEval 2021 (Shardlow et al., 2021) aims at the development of systems for the estimation of lexical complexity in context, both for single words and for multiword expressions. The organizers provided two datasets with the target words in a sentence context, with annotations consisting of a mean of the complexity ratings assigned by humans. In our paper, we present the system developed by the PolyU CBS-Comp team for the competition. Our top system achieves a Pearson correlation of, respectively, 0.754 on the single words dataset and 0.659 on the multiword expressions one.

Related Work
In the earliest shared task on the lexical complexity problem, organized in 2016 (Paetzold and Specia, 2016), complexity was defined as a binary variable: given a word in context, the word will be judged as complex or not. Of course, this was a simplifying assumption, since there might be many situations where the boundary is not a clear-cut one, and annotators would rather indicate a value in a continuous scale. Moreover, the "complex" words in the data only needed to be categorized as such by just one of the annotators. A further study by Zampieri et al. (2017) analyzed the output of the participating systems, showing that modeling complexity as binary actually hindered their performance.
A second iteration of the shared task was organized in 2018 (Yimam et al., 2018), this time features two separate subtasks: the traditional binary classification task, where systems had to predict whether one word was complex or not, and a regression task, where systems had to estimate the probability that an annotator would have considered a given word as complex.
Recently, Shardlow et al. (2020) have introduced CompLex, a new gold standard for the estimation of lexical complexity in context for English: the corpus, including sentences from different textual genres, is annotated with the mean complexity ratings for the target words. As a preliminary evaluation, the authors presented the results of a linear regression model trained on sets of features including word and sentence embeddings and some handcrafted features that are traditionally associated to complexity, such as frequency, word length and syllable count. The best scores, in terms of mean absolute error, were obtained when using only the latter set of features, while models based on the dimensions of the embeddings were lagging behind.

Datasets
The datasets for the shared task are part of the CompLex corpus, which has been published and described by Shardlow et al. (2020). The annotated sentences were collected using three different corpora: the Europarl corpus (Koehn, 2005), which includes the proceedings of the European Parliament; the CRAFT biomedical corpus (Bada et al., 2012); and the Bible, in the modern version of the World English Bible translation (Christodouloupoulos and Steedman, 2015).
The organizers selected targets as either single words (Sub-Task 1) or multiword expressions (Sub-Task 2), and the datasets include also multiple examples with the same target, as different contexts can determine different complexity values. As for the multiword expressions, they were identified via syntactic patterns, being either adjective-noun or noun-noun phrases. 20 annotations per data instance were collected, with annotators coming from different Englishspeaking countries (US, UK and Australia): the possible ratings ranged from 1 → Very Easy to 5 → Very Difficult. Mean scores were then normalized in the 0-1 range.
In a first phase, the organizers released a training data of 7661 samples for the single words track and 1517 samples for the multiword expressions track, together with a trial/validation dataset of 420 and 99 samples, respectively. Later, they released a test set of 917 samples for the single words track and 184 samples for the multiword expressions track.
Examples of the instances are shown in Table 1.

Evaluation
For both the single words and the multiword expressions track, we used the same set of features as input for a regression algorithm. In the multiword expressions track, we computed the value of the features for each of the two words in the target expression and then we took the average.

Features
As hand-crafted features, we adopted the same ones used by Shardlow et al. (2020) in the original evaluation of their dataset: Logarithmic Frequency, Word Length and Syllable Length. The latter two have been extracted using the Python textstat for each target word. As for the frequency feature, we extracted a general, out-of-domain frequency for each target word using the SUBTLEX database (Brysbaert and New, 2009) and the wordfreq Python package (Speer et al., 2018), and then we extracted the frequency of the word in each one of the three corpora composing CompLex. In total, we obtained 6 features (4 frequency + 2 length features) for each instance. We also added two Boolean features for Capitalization: the first was equal to 1 if the first letter of the target word was upper case and 0 otherwise; the second one was equal to 1 if all the letters of the target word were upper case and 0 otherwise. The latter feature was added because we noticed that some of the target words in the dataset are acronyms. Apart from the lexical information, Syntactic Features were explored for both single words and multiword expressions. The StanfordNLP tools (Manning et al., 2014) were first used to acquire both the part-of-speech (POS) tags and dependency trees. POS tags of target words were manipulated using one-hot encoding, for a total of 20 POS-based features. On the other hand, directed and path from the target word to the root were extracted as dependency features. We concatenated all dependency tags to the root, using one-hot encoding once again to encode every distinct path as a single feature. In total, we generated 267 dependency paths features with this mechanism.
Another feature was based on Word Embedding similarity: first, we computed the sum of the embeddings for all the words preceding the target, as a sort of general representation of the sentence context 1 , and then we measured the cosine similarity with the embedding of the target word. If the target was a multiword expression, we summed the embeddings of the words composing it. As word embeddings, we used the publicly available Fast-Text vectors, pre-trained on the Wikipedia corpus (Bojanowski et al., 2017). 2 We added one feature based on the BERT Transformer Model (Devlin et al., 2019) 3 by masking the target word in the original sentence and taking the probability value provided in output by the Softmax. For multiword expressions, we sequentially masked the words composing the target and took the average value.
Similarly, we used the GPT-2 Transformer Model (Radford et al., 2019) 4 to obtain a probability score for the full sentence, computed as the product of the probabilities of the single tokens.
The total number of extracted features is 300. Finally, we decided to generate polynomial features from our set, in order to exploit potential interactions. We used the PolynomialFeatures functionality of the scikit-learn Python package to generate interaction features of order 2, so that the final number of features that was fed to the regressors was 45151. 1 The use of vector sum as a compositional function has been used in Distributional Semantics since Mitchell and Lapata (2010).

Regressors
We tested several regression algorithms, using the implementations in the scikit-learn Python package. The adopted scikit-learn API and the main hyper-parameters are listed below: • RR Ridge: Ridge Regression solves a regression model where the loss function is the linear least squares function and regularization is given by the l2-norm. alpha=1.0, normalize=True.
• PLSR PLSRegression: PLS Regression implements the PLS2 blocks regression in case of one dimensional response. components=5.
• LR LinearRegression: Linear Regression is trained based on ordinary least squares function. normalize=True.
• RF RandomForestRegressor: a Random Forest is a meta estimator that fits a number of classifying decision trees on various sub-samples of the dataset and uses averaging to improve the predictive accuracy and control over-fitting. min samples split=2, min samples leaf=1.
• GBR GradientBoostingRegressor: Gradient Boosting builds an additive model in a forward stage-wise fashion which allows for the optimization of arbitrary differentiable loss functions. learning rate=0.1,min samples split=2, min samples leaf=1.

Metrics
The performance of the participating systems was evaluated in terms of Pearson correlation (r) between the outputs and the human mean ratings.
In the Results section, we also report the scores for Spearman correlation (ρ), Mean Absolute Error (M AE), Mean Squared Error (M SE) and R-Square (R2).

Results
We evaluated our system for two subtasks based on given trial datasets. For each regressor, we tuned hyper-parameters according to each subtask. Performance evaluation has been carried out in two aspects: the assessment of the overall correlation with human ratings and the analysis of the contribution of the features.

Complexity Prediction
Evaluation metrics are reported ranking by Pearson correlation in Table 2 and 3 for single words and multiword expressions, respectively.    It can be observed that predicting the complexity of single words is naturally less difficult than multiword expression. Concerning the regression algorithm, gradient boosting regression outperforms other investigated methods by a large gap, while PLS regression, Bayesian ridge regression, linear regression and random forest regression perform very similarly. Though PLSR has a worse Pearson correlation than BRR, its R2 and Spearman correlation are slightly better. Further studies about regressors brought some unexpected results for our feature based approaches: based on the features we selected, Ridge Regression performs worse than linear regression, suggesting that some features are not suitable for applying L2-norm.

Feature Study
As our proposed method heavily relies on feature selection, the acquired features are investigated in four groups: Hand-crafted (including Logarithmic Frequency, Word and Syllable Length and Capitalization), Syntactic (including the POS-and the Dependency-based features), Embedding and Transformer features. We adopted the features of the Hand-crafted group as baseline, and present a comparison between the performance of systems using the other features as add-on components. The scores in Table 4 refer to the performance on the single words dataset, by using GBR as a regressor.
According to Table 4, syntactic, embedding and transformer based features can all contribute to improve the prediction results. As expected, the combination of all feature type groups can achieve the best predicting capability.
Comparing with the baseline of hand-crafted features, syntactic and embedding features have very marginal contribution. Yet, it should not be neglected supplementing only transformer based features cannot achieve the maximum performance gain. This indicates that the interaction of the individual features can bring latent useful information to model, further revealing the complexity values of the target words.

Conclusion
In this paper, we presented the PolyU CBS-Comp system for lexical complexity prediction, which took part in the SemEval shared task 1. Our method, based on a combination of lexical, syntactic, embeddings and Transformers features, achieved a 0.754 correlation on single words and 0.659 on multiword expressions, when using Gradient Boosting as a regression algorithm.
Traditional hand-crafted features, followed by Transformer-based ones, seem to give the strongest contribution to the classification performance, which is further improved by adding feature in-teractions to the input for the regressor.
For future studies on lexical complexity, we plan to further exploit the text genre information, for example by adding domain-adapted language model features (Van Schijndel and Linzen, 2018) to the information available to our models.