A Gateway-Assisted Fine-Grained Data Sharing Scheme for Cross-Domain IIoT

Cross-domain data sharing is essential for industrial 4.0, envisioning for intelligent manufacturing, equipment collaboration and industrial automation. Inherently, gearing by the interconnection of devices and systems across heterogeneous domains, how to ensure efficient and secure multi-party data sharing remains a critical challenge in the Industrial Internet of Things (IIoT). Many broadcast encryption and signature encryption schemes have been proposed to ensure the privacy and rapid sharing of cross-domain data in recent years . However, existing schemes still have shortcomings in supporting fine-grained access control and adapting to resource-constrained edge node deployments. To address this issue, this paper proposes a ciphertext policy attribute-based broadcast matching encryption scheme (CP-ABBME). This scheme integrates a ciphertext policy attribute-based encryption (CP-ABE) mechanism to achieve one-to-many secure ciphertext transmission in a fine-grained manner. Furthermore, considering the limited computation and storage resources of terminal devices, the proposed scheme builds an encapsulation–decapsulation chain architecture. It introduces bidirectional access control for mutual authentication between the sender and receiver, while offloading deployment and partial decryption to the receiving gateway. This design effectively reduces terminal-side computation and storage overhead during decryption and authentication. Formal security analysis shows that the proposed scheme meets stringent security requirements. Experimental results show that CP-ABBME improves the decryption performance by 39.3% to 99.6%, and reduces the terminal storage resource consumption by up to 9.35 KB.