Electronic medical records (EMRs) are the essential sensitive personal data that is shared between patients and doctors through the semi-trusted E-health cloud. In the real application, multiauthority ciphertext-policy attribute-based searchable encryption (MA-CP-ABSE) is suitable to protect the security of the EMR for it possesses fine-grained access permission, efficient key management, and retrieval function over the encrypted data. However, previously proposed MA-CP-ABSE schemes are commonly restricted by the central authority, which is required by all attribute authorities in some operations like generating users’ secret keys. To deal with this issue, we proposed a decentralized MA-CP-ABSE (DMA-CP-ABSE) scheme. In our scheme, any attribute authority can become an independent authority to generate a secret key, which is no longer controlled by the central authority. Furthermore, a single-keyword search will produce many disrelated search results. For this, we enhance the DMA-CP-ABMSE scheme by implementing a multikeyword search function to improve the search accuracy. Besides, to handle the dynamic changing of access permission, we have designed the attribute revocation methods. Finally, we process the formal security analysis to demonstrate our scheme is secure under the chosen-keyword attack (CKA) and implement experiments to show its efficiency and feasibility.

Cloud computing, which provides a brand-new service model, has become an important infrastructure in the information age, and has been widely used in numerous fields. The Key-Policy Attribute-Based Encryption (KP-ABE) scheme allows the encrypted data with fine-grained access control in the cloud environment. However, achieving large-scale user revocation in the application scenario of KP-ABE becomes one of the thorny problems. Furthermore, the computation and communication costs of the previous user revocation schemes were generally high, especially when a large number of users were revoked. To address these problems, an enhanced high-performance user-revocable KP-ABE scheme combined with the puncture method was proposed. In this article, the user could be revoked by the fine-grained restriction policy. When revoking the user, the cloud would run the puncture algorithm to embed the restriction policy defined by the data owner into the ciphertext. This method could effectively omit the re-encryption and key updating processes, by which the computation and communication overhead of the user revocation are efficiently reduced, and the user revocation becomes more flexible and efficient. Moreover, the Chosen-Plaintext Attack (CPA) security proof and extensive simulation results demonstrate the reliability and efficiency of the proposed scheme for user revocation in a cloud environment.