Bilinear Pairing Operations Research Articles

Anonymous data sharing scheme for resource-constrained internet of things environments

With the rapid development of Internet of Things (IoT) technology in industrial, agricultural, medical and other fields, IoT terminal devices face security and privacy challenges when sharing data. Among them, ensuring data confidentiality, achieving dual-side privacy protection, and performing reliable data integrity verification are basic requirements. Especially in resource-constrained environments, limitations in the storage, computing, and communication capabilities of devices increase the difficulty of implementing these security safeguards. To address this problem, this paper proposes a resource-constrained anonymous data-sharing scheme (ADS-RC) for the IoT. In ADS-RC, we use elliptic curve operations to replace computation-intensive bilinear pairing operations, thereby reducing the computational and communication burden on end devices. We combine an anonymous verifiable algorithm and an attribute encryption algorithm to ensure double anonymity and data confidentiality during the data-sharing process. To deal with potential dishonest behavior, this solution supports the revocation of malicious user permissions. In addition, we designed a batch data integrity verification algorithm and stored verification evidence on the blockchain to ensure the security and traceability of data during transmission and storage. Through experimental verification, the ADS-RC scheme achieves reasonable efficiency in correctness, security and efficiency, providing a new solution for data sharing in resource-constrained IoT environments.

Hierarchical Identity-Based Authenticated Encryption with Keyword Search over encrypted cloud data

With the rapid development of cloud computing technology, cloud storage services are becoming more and more mature. However, the storage of sensitive data on remote servers poses privacy risks and is presently a source of concern. Searchable Encryption (SE) is an effective method for protecting sensitive data while preserving server-side searchability. Hierarchical Public key Encryption with Keyword Search (HPEKS), a new variant of SE, allows users with higher access permission to search over encrypted data sent to lower-level users. To the best of our knowledge, there exist only four HPEKS schemes in the literature. Two of them are in traditional public-key setting, and the remaining ones are identity-based public key cryptosystems. Unfortunately, all of the four existing HPEKS schemes are vulnerable against inside Keyword Guessing Attacks (KGAs). Moreover, all of the existing HPEKS schemes are based on the computationally expensive bilinear pairing operation which dramatically increases the computational costs. To overcome these issues, in this paper, we introduce the notion of Hierarchical Identity-Based Authenticated Encryption with Keyword Search (HIBAEKS). We formulate a security model for HIBAEKS and propose an efficient pairing-free HIBAEKS scheme. We then prove that the proposed HIBAEKS scheme is secure under the defined security model and is resistant against KGAs. Finally, we compare our proposed scheme with related constructions regarding security requirements, computational and communication costs to indicate the overall superiority of our proposed scheme.

Improved RSA dynamic cryptographic accumulator-based anonymous batch authentication scheme for Internet of Vehicles

The Internet of Vehicles (IoV) provides various services to vehicles through information sharing to ensure road safety and improve traffic efficiency. However, malicious attackers can challenge the privacy and security systems of the IoV by conducting security attacks. Currently, many schemes use bilinear pairing or elliptic curves to construct authentication systems, ensuring anonymity of vehicle identities and message security. However, these schemes suffer drawbacks such as low computational efficiency and high communication overhead in highly dynamic IoV. Therefore, we propose a new efficient certificateless message authentication scheme. The proposed scheme constructs a lightweight security authentication protocol by improving the RSA dynamic accumulator and combining it with non-interactive discrete logarithm zero-knowledge proofs. In addition, our scheme eliminates the need for bilinear pairing operations, thereby reducing computational overhead. Simultaneously, it enables real-time tracking and revocation of malicious vehicle identities. Security analysis shows that our scheme can be reduced to a secure S-RSA assumption under the random oracle model, meeting various security requirements of the IoV. Performance analysis shows that our scheme diminishes not only the computational overhead but also the communication overhead.

A quantum-secure certificateless aggregate signature protocol for vehicular ad hoc networks

Vehicular ad hoc networks (VANETs) have revolutionized communication between vehicles and infrastructure, notably enhancing traffic management and passenger safety. However, VANETs are vulnerable to security threats, especially regarding data authenticity. Aggregate signature is a powerful technique that reduces computational and communication burdens by aggregating multiple signatures from different signers into a single signature. Traditional aggregate signature schemes, based on large prime number decomposition and the discrete logarithm problem, cannot effectively resist quantum attacks. This paper introduces a novel quantum secure certificateless aggregate signature (QSCLAS) scheme designed to enhance data security and privacy in VANETs. Our proposed scheme employs the number theory research unit (NTRU) algorithm. As a lattice-based cryptographic algorithm, NTRU is renowned for its security against quantum computer attacks, making it an essential component of our quantum-secure solution. By eliminating the need for expensive bilinear pairing operations, our proposed scheme achieves high efficiency and practicality in resource-limited VANETs environments. The security analysis demonstrates our scheme's resilience against both Type-I and Type-II adversaries in the random oracle model under the small integer solution (SIS) problem on the NTRU lattice. Furthermore, compared with existing approaches, the results illustrate that our proposed scheme offers significant advantages in signature generation and verification cost, as well as lower transmission overhead than other lattice-based schemes, thereby making it highly suitable for VANETs environments.

Cryptanalysis and improvement of “group public key encryption scheme supporting equality test without bilinear pairings”

Public key encryption with equality test (PKEET) is a novel primitive which supports equality comparisons on two encrypted messages. Currently, most of the existing PKEET schemes are based on bilinear pairing and require heavy computational overheads. To address this issue, Shen et al. recently proposed an efficient group public key encryption supporting equality test without bilinear pairings scheme. Compared with other schemes, their scheme reduces the usage of expensive bilinear pairing operations and enjoys higher computation efficiency. They claimed that their scheme achieved one-wayness security in the random oracle model and resisted offline message recovery attack. In this letter, we analyze Shen et al.'s scheme through two concrete attacks and demonstrate that their scheme can not support the above two security requirements. An improved scheme is provided to overcome the security vulnerabilities in their scheme. Performance analysis shows that our improved scheme has certain advantages in both computation overhead and storage overhead.

Cryptanalysis and Improvement of Several Identity-Based Authenticated and Pairing-Free Key Agreement Protocols for IoT Applications.

Internet of Things (IoT) applications have been increasingly developed. Authenticated key agreement (AKA) plays an essential role in secure communication in IoT applications. Without the PKI certificate and high time-complexity bilinear pairing operations, identity-based AKA (ID-AKA) protocols without pairings are more suitable for protecting the keys in IoT applications. In recent years, many pairing-free ID-AKA protocols have been proposed. Moreover, these protocols have some security flaws or relatively extensive computation and communication efficiency. Focusing on these problems, the security analyses of some recently proposed protocols have been provided first. We then proposed a family of eCK secure ID-AKA protocols without pairings to solve these security problems, which can be applied in IoT applications to guarantee communication security. Meanwhile, the security proofs of these proposed ID-AKA protocols are provided, which show they can hold provable eCK security. Some more efficient instantiations have been provided, which show the efficient performance of these proposed ID-AKA protocols. Moreover, comparisons with similar schemes have shown that these protocols have the least computation and communication efficiency at the same time.

LMCLAEKS: LWE-assisted multi-recipient certificateless authenticated encryption with keyword search

In Industrial Internet of Things (IIoT) environments, interconnected gadgets and sensors produce large-scale, dynamic, and private data by the arrival of the fourth industrial revolution. Such data must be stored by cloud service providers (CSP) and is capable of accessed by consumers. To guarantee data privacy, Public-key Encryption with Keyword Search (PEKS) is a cryptographic primitive designed to resolve this challenge, which is troubled by costly certificate management and key escrow problem. The majority of current PEKS schemes rely on expensive bilinear paring and single-receiver, which are highly vulnerable to keyword guessing attacks (KGA) and have low computational efficiency. Consequently, we propose an Multi-recipient Certificateless Authenticated Encryption with Keyword Search (MCLAEKS) scheme, which has the following advantages: 1) hiding search pattern; 2) data allows multiple consumers; 3) involving no costly bilinear pairing operations; 4) resisting Inside Keyword Guessing Attacks (IKGA). The comparison and analysis of performance indicate that the proposed scheme is more efficient than existing PEKS schemes and is suitable for the IIoT environment.

IoT-friendly, pre-computed and outsourced attribute based encryption

The Internet of Things (IoT) and its applications are growing at an unprecedented rate. In such a complex network with an enormous number of nodes, an important challenge is how to securely handle the access control problem. Attribute Based Encryption (ABE) is a powerful and flexible cryptographic primitive to address the challenge of realizing fine-grained access control in many systems. However, using ABE in IoT systems is often problematic due to the heavy computational overhead originating from the bilinear pairing operations and the relatively large key sizes of ABE schemes.This paper deals with this challenge by proposing some solutions to overcome the limitations of using ABE in IoT systems. The contributions of this paper are divided into three parts. In the first part, we propose modified fuzzy identity-based encryption (FIBE) schemes that use fewer optimal ate pairing operations compared to the original FIBE. FIBE is a special case of ABE, in which the access structure simplifies to a threshold gate. We also introduce a new security notion named the Conditional Chosen Ciphertext Attack-2 (Conditional CCA-2) selective security which is stronger than the CPA selective security notion. We prove that the proposed FIBE schemes have Conditional CCA-2 selective security, under the Asymmetric Decisional Modified Bilinear Diffie–Hellman (ADMBDH) assumption. In the second part, we proposed Key Policy Attribute Based Encryption (KP-ABE) schemes that use fewer pairing operations compared to the previous KP-ABE schemes. Our FIBE and KP-ABE schemes use elliptic curve groups which ensure shorter keys. In the third part of our contribution, we propose secure methods to outsource the heavy operations in FIBE and KP-ABE schemes (i.e. scalar multiplication by a curve point, exponentiation, and pairing) such that IoT devices can cope with the complexity.

Blockchain-assisted certificateless signcryption for vehicle-to-vehicle communication in VANETs

In vehicular ad-hoc networks (VANETs), real-time messages are used to guarantee transportation efficiency and passenger safety through the exchange among vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I). Therefore, the timely acceptance of safety messages is critical to establishing efficient and reliable communication in VANETs, which hinges on an efficient privacy-preserving authentication mechanism. However, these mechanisms face either security or performance problems. Although some state-of-the-art signcryption schemes meet the needs of security requirements of authentication, performance is not efficient in computational overhead for an increase of the bilinear pairing operations in batch unsigncryption verification. Therefore, we have designed an efficient and provably secure blockchain-assisted certificateless signcryption (BACLS) that provides a feasible security communication in theoretical analysis and experiments. The BACLS scheme ensures security against type-I and type-II attackers in regard to existential unforgeability against adaptively chosen message attacks (EUF-CMA) under the hardness assumption of the gap bilinear Diffie–Hellman problem and indistinguishability against adaptive chosen ciphertext attack (IND-CCA2) under the hardness assumption of the elliptic curve discrete logarithm problem in the random oracle model (ROM). The experiments demonstrate that the BACLS scheme significantly reduces unsigncryption computational costs and power consumption in contrast to state-of-the-art schemes, and promotes the development of a decentralized authentication system in VANETs.

User-Friendly Public-Key Authenticated Encryption With Keyword Search for Industrial Internet of Things

The Industrial Internet of Things (IIoT) incorporates massive physical devices to collect ambient data. Due to the limited types of equipment in IIoT, most of the data has to be saved on a cloud server before it can be processed and analyzed. The ciphertext generated by traditional encryption techniques is difficult to search in subsequent use. Public-key Encryption with Keyword Search (PEKS) can provide data encryption as well as confidential searching, but traditional PEKS schemes are susceptible to internal keyword guessing attacks (IKGA) caused by the limited space of commonly-used keywords. To address this issue, the cryptographic primitive of Public-key Authenticated Encryption with Keyword Search (PAEKS) was proposed, while most of the existing schemes are not appropriately applied to IIoT for involving time-consuming bilinear pairing operations. In this paper, we first propose a user-friendly PAEKS scheme that totally circumvents bilinear pairing operations during generating keyword ciphertext and trapdoor. Then we prove its multi-ciphertext indistinguishability and trapdoor privacy based on decisional q-ABDHE and CDH assumptions in the random oracle model together with conducting the theoretical and experimental comparisons. The results show that the computational overhead of our proposal is significantly reduced comparing with most existing classical PAEKS schemes without causing other communication costs or security loss. Due to its better performance and security, our scheme is better suited for lightweight devices in the IIoT.

Authentication and encryption protocol with revocation and reputation management for enhancing 5G-V2X security

This paper presents a novel robust solution for key management, message encryption, and authentication, offering enhanced security for 5G-V2X communication. By incorporating bilinear pairing, and AES encryption, the protocol achieves a high level of security. The protocol consists of two key phases: key management and distribution, and message authentication and encryption. In the key management phase, secret sharing and polynomial interpolation techniques are used to generate and distribute the master secret key. The message authentication and encryption utilize bilinear pairing for integrity and origin authentication and symmetric encryption for confidentiality. To address the real-time update limitations of traditional revoking approaches, a reputation-based vehicle revocation mechanism is proposed. This mechanism allows fair revoking based on reputation scores and authenticated feedback, ensuring effective resource management. The proposed protocol utilizes the MIRACL library to implement the bilinear pairing operations. Comparative analysis demonstrates the superior performance of the protocol compared to other bilinear pairing protocols. The results show that the proposed protocol enhances authentication and encryption while incurring short times for message signing and verification (1.925 ms and 7.115 ms, respectively). Furthermore, the protocol supports signature aggregation using bilinear properties, resulting in constant verification time regardless of the number of signatures.

A Lightweight CP-ABE Scheme with Direct Attribute Revocation for Vehicular Ad Hoc Network.

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) technology provides a new solution to address the security and fine-grained access control of traffic information in vehicular ad hoc networks (VANETs). However, in most CP-ABE schemes for VANETs, attribute revocation suffers from high system consumption and complex revocation operations, as well as from high computational overhead and low efficiency due to the use of bilinear pairwise operations. Based on this, this paper proposes a lightweight CP-ABE scheme that supports direct attribute revocation in VANETs. The scheme implements an agent-based direct attribute revocation mechanism by separating dynamic and static attributes of vehicle terminals, which reduces system consumption and simplifies the revocation operation process. The scheme uses scalar multiplication on elliptic curves instead of bilinear pairing operations and uses computational outsourcing techniques to reduce the terminal decryption cost and improve the efficiency of the scheme. The security and performance analysis shows that the overall efficiency of our scheme is better than the existing schemes under the premise of ensuring data confidentiality and integrity.

A Novel Multi-Party Authentication Scheme for FCN-based MIoT Systems in Natural Language Processing Environment

Natural language processing(NLP) assists to increase the efficiency of human andMultimedia Internet of Things(MIoT) interaction. Notably, large-scale NLP tasks can be offloaded from a cloud server to fog nodes closer to a mobile terminal device for lower response latency. But communication security is ongoing issues that need to be addressed. Effective mutual authentication among multiple entities is essential to ensure the security of MIoT systems based on a dynamicFog Computing Network(FCN). However, the existing schemes are unsuitable for the dynamic FCN due to the security vulnerabilities such as the linkable sessions. To solve this problem, anAnonymous Multi-Party Authentication(AMPA) scheme is proposed to address the challenges of secure FCN-based MIoT communications in this paper. The proposed scheme uses a bilinear pairing operation to realize the authentication between the fog nodes and cloud server and to establish the group key. Besides, the scheme allows cloud-authenticated terminal devices to be added to the FCN and reduces the need for the resource-limited terminal device to perform many authentication protocols. The security analysis is carried out to demonstrate that AMPA scheme can meet various safety requirements. Performance evaluations shown that the proposed AMPA scheme achieves satisfactory performance.

A Novel Identity-Based Privacy-Preserving Anonymous Authentication Scheme for Vehicle-to-Vehicle Communication

This paper proposes a novel bilinear pairing-free identity-based privacy-preserving anonymous authentication scheme for vehicle-to-vehicle (V2V) communication, called “NIBPA”. Today, vehicular ad hoc networks (VANETs) offer important solutions for traffic safety and efficiency. However, VANETs are vulnerable to cyberattacks due to their use of wireless communication. Therefore, authentication schemes are used to solve security and privacy issues in VANETs. The NIBPA satisfies the security and privacy requirements and is robust to cyberattacks. It is also a pairing-free elliptic curve cryptography (ECC)-based lightweight authentication scheme. The bilinear pairing operation and the map-to-point hash function in cryptography have not been used because of their high computational costs. Moreover, it provides batch message verification to improve VANETs performance. The NIBPA is compared to existing schemes in terms of computational cost and communication cost. It is also a test for security in the random oracle model (ROM). As a result of security and performance analysis, NIBPA gives better results compared to existing schemes.

A secure access control scheme with batch verification for VANETs

When an onboard unit (OBU) moves into the area of a roadside unit (RSU), authentication occurs. In areas with heavy traffic, e.g., intersections, an RSU may receive thousands of requests in a short period . Verifying each request separately can lead to wasted resources and cause RSU service bottlenecks. Because these requests have stringent real-time requirements, if they are not processed in time, vehicles may not be able to change their driving status and could encounter large-scale congestion or even dangerous areas. To improve efficiency, this study investigated a secure access control scheme with batch verification for vehicular ad hoc networks . The proposed method requires only two bilinear pairing operations to verify n requests, which is the same number for a single verification. Through a performance analysis, it was confirmed that the proposed scheme has a lower computation cost and the least communication overhead among existing schemes. Furthermore, extensive simulations demonstrated that the scheme has the lowest processing delay, and as the number of batch verifications increases, its processing delay growth range also diminishes. A detailed security analysis shows that the scheme achieves collusion resistance, signature unforgeability, and replaying resistance.

Multiauthority CP-ABE-based Access Control Model for IoT-enabled Healthcare Infrastructure

The exponential growth of the Internet of Things (IoT) technologies requires high data security. Here, data security is very critical as all IoT devices transfer data over the Internet. The fine-grained access control provided by the ciphertext policy attribute-based encryption (CP-ABE) technique can be considered as a potential solution to this issue. However, most of the CP-ABE schemes use bilinear pairing operations for its internal working, which is expensive for any resource constraint device. An elliptic curve cryptography (ECC) based CP-ABE scheme can be well suited for resource constraint IoT framework because ECC takes less computational time. This article proposes a novel CP-ABE technique based on ECC to achieve fine-grained access control over data or resources. The proposed technique includes multiple attribute authorities to manage attributes and key generation, which can reduce the work overhead of having a single authority in traditional CP-ABE systems. In addition, the proposed scheme outsources the decryption process to a user assistant entity to reduce the decryption overhead of the end-users. To prove the efficiency of the proposed scheme, both formal security analysis and performance comparisons are presented in this article. The result and findings prove the effectiveness of the proposed scheme over some well-known schemes.

Secure Edge Computing-Assisted Video Reporting Service in 5G-Enabled Vehicular Networks

Since traffic accidents occur frequently, a real-time video traffic reporting service is necessary in vehicular networks for a prompt response to accidents. Although the fifth-generation (5G) network provides a solution for real-time services in vehicular networks, the security and privacy of the services needs to be addressed first. The existing secure video reporting service schemes in 5G-enabled vehicular networks have significant computing, communication, and storage overheads, because of public key certificates, expensive bilinear pairing operations, and repeated video reporting to the cloud. To address these issues, we propose a secure edge computing-assisted video reporting service in 5G-enabled vehicular networks. In the proposed method, edge nodes complete the message verification and classification. Moreover, these nodes send the first received report message of the same accident to the designated official vehicles to realizes a local upload and download of video reports and to minimize the storage of repeated accident reports in the cloud. Security analysis indicates the proposed scheme is secure under the random oracle model and meets a series of vehicular networks requirements. In addition, performance evaluations show that the scheme achieves lower authentication overhead than existing signature schemes, and has lower total delay than other relevant video reporting service schemes.

Lightweight and Secure IoT-Based Payment Protocols from an Identity-Based Signature Scheme

After the great success of mobile wallets, the Internet of Things (IoT) leaves the door wide open for consumers to use their connected devices to access their bank accounts and perform routine banking activities from anywhere, anytime, and with any device. However, consumers need to feel safe when interacting with IoT-based payment systems, and their personal information should be protected as much as possible. Unlike what is usually found in the literature, in this paper, we introduce two lightweight and secure IoT-based payment protocols based on an identity-based signature scheme. We adopt a server-aided verification technique to construct the first scheme. This technique allows to outsource the heavy computation overhead on the sensor node to a cloud server while maintaining the user’s privacy. The second scheme is built upon a pairing-free ECC-based security protocol to avoid the heavy computational complexity of bilinear pairing operations. The security reduction results of both schemes are held in the Random Oracle Model (ROM) under the discrete logarithm and computational Diffie–Hellman assumptions. Finally, we experimentally compare the proposed schemes against each other and against the original scheme on the most commonly used IoT devices: a smartphone, a smartwatch, and the embedded device Raspberry Pi. Compared with existing schemes, our proposed schemes achieve significant efficiency in terms of communication, computational and storage overheads.

An efficient conditional privacy-preserving authentication scheme with scalable revocation for VANETs

In Vehicular Ad Hoc Networks (VANETs), secure information sharing between vehicles is critical for improving traffic efficiency and driving safety. However, existing identity-based communication protocols for VANETs face problems of over-reliance on ideal Tamper-Proof Devices (TPDs) and the efficiency of verifying multiple messages in areas of high traffic density. Besides, many existing authentication schemes suffer from the heavy workload of revoking malicious vehicles when they misbehave. For addressing these problems, we propose an efficient Identity-Based conditional privacy-preserving authentication protocol, which does not rely on the ideal TPD. In our scheme, the System Secret Key (SSK) is not directly preloaded with the TPD, thus avoiding a system crash when a vehicle is corrupted. To revoke malicious vehicles’ identity, we propose an efficient key updating method based on Shamir’s secret sharing algorithm, which improves key-update efficiency from linear to logarithmic in the number of unrevoked vehicles. Moreover, our scheme is based on Elliptic Curves Cryptosystem and avoids bilinear pairing operation while supporting batch verification, enabling faster verification even when the number of signatures is increasing. According to the results of exhaustive comparative analysis, our proposed scheme is secure against key leakage attack and efficient in overhead of computation and communication compared to related schemes.

Pairing-free certificateless blind signature scheme for smart grid

The smart grid is an emerging power system that can realize the information exchange between users and power companies in two-way communication and adjust power companies’ power supply according to the real-time power requests from smart meters on the users’ side. However, since malicious attackers can eavesdrop on two-way communication to collect and transmit information, they may leak users’ information. Therefore, this paper proposes a new certificateless blind signature (CLBS) scheme with batch verification function and improves a power request system model for the smart grid to protect users’ privacy. In addition, the proposed CLBS scheme simplifies the certificate management process in the traditional public key cryptosystem and eliminates the hidden key escrow in the identity-based public key cryptosystem. The unforgeability of the scheme is proved through the random oracle model, and the scheme’s security can be reduced to the intractability of the elliptic curve discrete logarithm problem (ECDLP). The analysis results show that our scheme does not use the time-consuming bilinear pairing operation, and has obvious advantages in computing performance compared with the existing signature schemes.