Efficient Authenticated Fine-Grained Access Engine for Encrypted Data in Mobile Edge Cloud

Abstract

Fine-grained, authenticated, traceable, and efficient encrypted access control is indispensable for secure data sharing in mobile edge cloud networks, especially for resource-constrained data requesters. Despite the prevalence of outsourced ciphertext-policy attribute-based encryption (CP-ABE) solutions, existing schemes still suffer from critical practical limitations. First, requester-side transformation keys are typically unverified prior to computationally expensive outsourced decryption operations. Second, commitment-based verification mechanisms fail to validate the identity of data publishers. Third, the online computational overhead scales linearly with either the requester attribute set or the policy-matching set, severely degrading practical efficiency. To address these issues, this paper proposes ePoFSC, a novel policy-oriented functional signcryption scheme for authenticated encrypted data sharing in mobile edge cloud scenarios. The proposed ePoFSC scheme integrates pre-auditing and caching mechanisms for requester trapdoors before online access requests, enabling constant-time operations for request generation, request verification, and request header construction independent of requester attribute scale. In the outsourced decryption phase, ePoFSC offloads all costly pairing and exponentiation operations with constant computational complexity, leaving only lightweight policy-dependent group multiplications for terminal requesters. Furthermore, ePoFSC tightly couples decryption verification with publisher authentication and requester traceability to realize comprehensive access accountability. Rigorous security analysis formally validates the confidentiality, publisher-side unforgeability, and requester traceability of the proposed scheme. Extensive experimental evaluations on the BLS12-381 curve verify that ePoFSC achieves prominent performance superiority over existing state-of-the-art schemes in both the encryption and data recovery phases.