Identity-based Cryptosystem Research Articles

Heterogeneous and plaintext checkable signcryption for integrating IoT in healthcare system

Preserving the confidentiality and integrity of data transmission is paramount in the Internet of Things (IoT)-based healthcare systems. Current encryption techniques that allow plaintext checks primarily serve a specific cryptosystem, lacking the adaptability to work with a diverse system incorporating various cryptographic methods. To address this, we present a unique online/offline heterogeneous signcryption scheme with plaintext checkable encryption (HOOSC-PCE). This approach enables the transition of signcrypted messages from an identity-based cryptosystem (IBC) to a public key infrastructure (PKI) system, improving information interoperability. A key aspect of our scheme is its capacity to allow cloud servers to perform plaintext queries, facilitating efficient data searches using plaintext keywords over encrypted data. Furthermore, the signcryption process is divided into online and offline phases. The online phase handles tasks that require fewer resources, while the offline phase carries out more resource-intensive preparatory tasks. We rigorously tested the HOOSC-PCE scheme’s security by proving it secure under the Random Oracle Model (ROM). Meanwhile, compared to similar work, it effectively reduces computation costs by 46.39%, 19.45%, 18.73%, and 13.25% across offline encryption, online encryption, decryption, and search algorithms. The results indicate that the HOOSC-PCE is secure and efficient, confirming its feasibility for IoT-based healthcare systems.

An efficient online/offline heterogeneous proxy signcryption for secure communication in UAV networks

The rapid growth of the Internet of Things (IoT) has led to an increased deployment of unmanned aerial vehicles (UAVs) across various sectors. However, efficiency and security issues are persistently among the primary challenges in UAV networks. In addition, significant communication delays can occur when UAVs perform remote tasks far from a command center (CC); in some cases, they may be unable to communicate with the CC. To address these challenges, in this paper, an efficient online/offline heterogeneous proxy signcryption scheme for secure communication in UAV networks (HOOPSC) is proposed. This scheme enables the CC in a certificateless cryptosystem (CLC) environment to delegate a nearby ground control station (GCS) to act as an agent, and directly send commands to the UAV within an identity-based cryptosystem (IBC) when the UAV undertakes remote tasks far from the CC. The UAV then decrypts and verifies commands for authenticity and confidentiality. In the proposed scheme, the signcryption process is split into offline and online phases, with most of the heavy computations conducted without the availability of the messages during the offline phase. Only light computations are performed in the online phase when a message is available. Moreover, a formal security proof is given in a random oracle model. Finally, a performance analysis reveals that HOOPSC outperforms existing relevant schemes, making it ideal for long-range operations in UAV networks.

A heterogeneous signcryption scheme with Cryptographic Reverse Firewalls for IoT and its application

The Snowden leaks exposed the truth that skilled attackers can access users’ devices and steal their private information. Although public key encryption is widely used and theoretically secure, it has hidden vulnerabilities when implemented in practice. This is especially problematic when employing communication channels among heterogeneous protocols within the Internet of Things (IoT), it becomes apparent that these channels lack adequate protection to address the diverse nature of IoT systems. This work proposes a novel Heterogeneous Online/Offline Signcryption with Cryptographic Reverse Firewalls (HOOS-CRF). The scheme enables a secure communication channel between the sender in an Identity-based cryptosystem (IBC) and the receiver in the Public Key Infrastructure (PKI) cryptosystem with CRF deployed. To reduce computational costs, we split the signcryption algorithm into two stages: online and offline. Most resource-intensive operations are performed during the offline stage, which operates without any knowledge of the message being processed. The HOOS-CRF scheme provides confidentiality, authentication, and defense against insider security attacks. Meanwhile, we prove the security of the HOOS-CRF using the random oracle model and demonstrate its high efficiency and practicality through experiments. Lastly, the scheme’s relevance to IoT-driven healthcare applications is demonstrated.

Designing a Block Chain Based Network for the Secure Exchange of Medical Data in Healthcare Systems

ABSTRACT An identity-based cryptosystem called signcryption is investigated in this study in order to efficiently and securely exchange healthcare information inside a data-sharing network, utilizing the idea of bilinear pairings. A distributed tamperproof database protects all health records and is uploaded to it and replicated over a group of nodes that are linked to form a peer-to-peer network. As a result, each health record is treated as an individual event that is time stamped and assigned a cryptographic hash. On a similar note, transaction blocks include all the record events. Every node in the network has a copy of the ledger of hashed records and events. Additional information such as user permission lists are also included in this health care blockchain network, which serve as instructions for the network. To guarantee the data integrity of EHRs, this article provides security for exchanging EHRs across medical institutions and inside the organization, and ultimately safe exchange of EHRs by removing a third-party trustworthy third-party provider. Various cryptographic methods are being utilized on the blockchain in order to ensure security for the exchange of health care data. Signcryption is utilized in the suggested design approach for secure health care data exchange.

A lattice-based efficient heterogeneous signcryption scheme for secure network communications

Ensuring the security of transmitted content is an important task in network communication. Signcryption technology combines signature and encryption operations in a single step to achieve message authentication and confidentiality. In practical applications, users are usually in different cryptographic systems, the ordinary signcryption technology cannot realize communication between two different cryptographic systems. And the ciphertext structure of the existing signcryption schemes is relatively complex, signcryption is not efficient. Therefore, in order to solve the problem of efficient communication between different cryptosystems and ensure quantum security, this paper proposes a lattice-based efficient heterogeneous signcryption scheme for secure network communications. This signcryption scheme accomplishes signcryption through matrix operations and hash functions, which avoids complex signcryption structures, efficiently realizes bidirectional message communication between identity-based cryptosystems and certificateless cryptosystems.

Improving the detection of intrusion in vehicular ad-hoc networks with modified identity-based cryptosystem

Improving the detection of intrusion in vehicular ad-hoc networks with modified identity-based cryptosystem

Multi-party anonymous authentication scheme in heterogeneous network slicing

Network slicing is a logical network function that supports communication service requirements for specific usage scenarios or business models. It has become an essential factor in solving future network architecture. In recent years, heterogeneous network slicing between multiple autonomous domains has emerged, with significant limitations compared to single-domain networks. Data sharing in heterogeneous network slices challenge the confidentiality of sensitive data significantly. Preventing sensitive data from leaking and protecting core data have become urgent problems to be solved. Therefore, we propose a multi-party (multi-sender to multi-receiver) anonymous authentication scheme on certificateless cryptography(CLC) and identity-based cryptosystem(IBC) institutional domain Internet of Vehicles(IoV) to smart healthcare. Our scheme realizes heterogeneous communication between multiple senders and multiple receivers, and uses different system parameters for heterogeneous cryptographic systems. In this work, the limitation of one-to-many or many-to-one communication in existing heterogeneous networks is broken through. The proposed work utilizes the pseudo-identity generated by the trusted authority to communicate in IoV slices, ensuring the anonymity of the sender; The authorization Center TA can uniquely determine the true identity of the vehicle through pseudo-random values for traceability. What is more, the Lagrange interpolation formula is employed to prevent the leakage of the identities of smart healthcare slices, ensuring the anonymity of the receiver. Under the random oracle model, the proposed scheme has proved to satisfy unforgeability, confidentiality, and anonymity under the computational Diffie–Hellman problem. Experimental results indicate that our proposal achieves better performance than existing schemes.

An efficient heterogeneous authenticated key agreement scheme for unmanned aerial vehicles

Unmanned aerial vehicle (UAV) technology is becoming more and more popular recently due to the rapid development of Internet of things (IoT) and network technology. It has gradually expanded from military field to civil field because of the convenience brought by UAVs. However, the communication of UAV is based on open wireless network, which makes it vulnerable to varieties of attacks. Besides, UAVs are generally considered as mobile devices with limited resources. It is necessary to ensure the security of UAV communication and reduce the computation overhead and communication cost on UAV’s side as much as possible. Authenticated key agreement (AKA) scheme is a proper way to meet the above requirements. It enables an UAV and a ground station (GS) to share a session key. Then they can use the session key as a symmetric key and communicate securely through symmetric encryption, which is much less expensive than asymmetric encryption. In this paper, we propose a heterogeneous authenticated key agreement (HAKA) scheme for an UAV to communicate with a GS, in which the UAV belongs to identity-based cryptosystem (IBC) and the GS belongs to public key infrastructure (PKI). Through rigorous security analysis, we show that the proposed scheme is provably secure. Moreover, the comparative experimental results show that our scheme is the most efficient and suitable for UAVs with limited resources.

Secure Battery Swapping: A Reservation Scheme with Conditional Privacy-Preserving Bidirectional Heterogeneous Aggregate Signcryption and Incentive Mechanism

For large-scale battery-swapping demands, reserva- tions are utilized to effectively manage battery swapping. To achieve data security, one promising solution is heterogeneous signcryption (i.e. signature + encryption). However, existing heterogeneous signcryption cannot simultaneously support aggre- gation, batch verification, conditional privacy-preserving, bidirec- tional heterogeneous communication, and availability. Besides, to reduce the end-to-end delays, mobile edge computing (MEC) is introduced to reservations, so other challenge is to design an incentive mechanism to encourage mobile edge nodes (MENs) to transmit reservation messages. Seeking to address these chal- lenges, we propose a reservation scheme with conditional privacy- preserving bidirectional heterogeneous aggregate signcryption and incentive mechanism, namely SecBS. More precisely, in status publication (i.e. SecBS-SP), electric vehicles (EVs) obtain status messages released by battery swapping stations (BSSs) via MENs, which is realized via heterogeneous signcryption from certificateless cryptosystem (CLC) to identity-based cryptosystem (IBC). In the reservation (i.e. SecBS-R), under the incentive, MENs transmit reservations sent by EVs to BSSs, which is realized via heterogeneous signcryption from IBC to CLC. Finally, formally security proof and extensive simulations are carried out to manifest the security and feasibility of our SecBS.

A heterogeneous signcryption scheme for smart grid with trusted multi-ciphertext equality test.

Energy utilization rates have been largely improved thanks to the wide application of smart grids, thereby realizing the reliable, economic and efficient operation of the grids. However, such an application is also accompanied by many security issues. In response to the many problems within existing security schemes, such as not supporting the communication between heterogeneous cryptosystems, low security levels and a low data retrieval efficiency, a heterogeneous signcryption (HSC) scheme that supports a trusted multi-ciphertext equality test (MET) is proposed. The adoption of the HSC helps to identify secure communications from identity-based cryptosystems to certificateless cryptosystem, eliminates the certificate management problems in the traditional public key cryptography scheme, and ensures the confidentiality and authentication of power data. The introduction of the MET technology can avoid the high cost of equality test calculations after grouping ciphertexts in pairs. Using blockchain and smart contract technologies ensure the credibility of test results and eliminates the reliance on trusted cloud servers. Under the random oracle model, on the basis of the bilinear Diffie-Hellman, the computational Diffie-Hellman and the q-strong Diffie-Hellman problems, this paper proves that the scheme proposed herein meets the requirements of indistinguishability and one-way security under adaptive choice ciphertext attacks, and the unforgeability under the adaptive choice message attack. From the findings of the analysis, it has been shown that the proposed scheme satisfies more security attributes and requires lower computational overhead compared to similar schemes.

Generic Construction of Forward-Secure Revocable Identity-Based Signature and Lattice-Based Instantiations

Forward-secure revocation is a powerful cryptographic technique to alleviate key exposure attacks on identity-based cryptosystems. In recent years, quantum computers have made some breakthroughs, so in the foreseeable future, existing cryptographic systems will be subject to quantum attacks. However, known forward-secure revocable identity-based signature (FS-RIBS) schemes were designed over bilinear pairing groups and may suffer from quantum computing attacks. To address this issue, this paper proposes a generic method to construct FS-RIBS schemes, taking (hierarchical) IBS schemes as a basic component. By instantiating it with some post-quantum (hierarchical) IBS schemes, e.g., lattice-based (hierarchical) IBS, we immediately obtain six FS-RIBS schemes under the hardness of the small integer solution problem, which is secure against quantum computing attacks.

A Conditional Privacy Preserving Generalized Ring Signcryption Scheme for Micro Aerial Vehicles.

Micro Aerial Vehicles (MAVs) are a type of UAV that are both small and fully autonomous, making them ideal for both civilian and military applications. Modern MAVs can hover and navigate while carrying several sensors, operate over long distances, and send data to a portable base station. Despite their many benefits, MAVs often encounter obstacles due to limitations in the embedded system (such as memory, processing power, energy, etc.). Due to these obstacles and the use of open wireless communication channels, MAVs are vulnerable to a variety of cyber-physical attacks. Consequently, MAVs cannot execute complex cryptographic algorithms due to their limited computing power. In light of these considerations, this article proposes a conditional privacy-preserving generalized ring signcryption scheme for MAVs using an identity-based cryptosystem. Elliptic Curve Cryptography (ECC), with a key size of 160 bits, is used in the proposed scheme. The proposed scheme's security robustness has been analyzed using the Random Oracle Model (ROM), a formal security evaluation method. The proposed scheme is also compared in terms of computation cost, communication cost and memory overhead against relevant existing schemes. The total computation cost of the proposed scheme is 7.76 ms, which is 8.14%, 5.20%, and 11.40% schemes. The results show that the proposed scheme is both efficient and secure, proving its viability.

Authentication methods for internet of vehicles based on trusted connection architecture

This paper proposes an authentication protocol based on a trusted connection architecture to manage the security and reliability of the cloud service environment during the communication process, improve the trust of the cloud service platform toward vehicles, and ensure that vehicle terminals have reliable access to cloud services. Compared with prior Internet of Vehicle (IoV) authentication schemes, our scheme is the first to include platform identification in the authentication process. Based on the characteristics of the trusted connection architecture, the components that constitute the platform can be assessed for security by verifying the vehicle platform identity and platform integrity metrics, thereby eliminating internal threats. In addition, the protocol proposes an authentication scheme for the IoV environment, in which the trusted authority only needs to generate the user's partial key based on the identity, thereby avoiding the key escrow problem common to identity-based cryptosystems. Finally, the scheme is proven to be highly secure using various approaches, such as Syverson-Van Oorschot (SVO) logical analysis, simulated authentication via automated validation of internet security protocols and applications (AVISPA), and informal security analysis. In the identity authentication step, our method has low computation and communication overhead when compared with other schemes according to the performance analysis results.

Quantum-safe Anonymous Hierarchical Identity-Based Encryption with Traceable Identities

Anonymous Identity Based Encryption (AIBET) scheme allows a tracer to use the tracing key to reveal the recipient’s identity from the ciphertext while keeping other data anonymous. This special feature makes AIBET a promising solution to distributed IoT data security since it can preserve both the privacy and the anonymity of a communication network but still give the server the ability to revoke the anonymity of some specific users in necessary situations (such as when their illegal behavior are detected). In this paper, we construct an efficient quantum-safe Hierarchical Identity-Based cryptosystem with Traceable Identities (AHIBET) with fully anonymous ciphertexts. We prove the security of our AHIBET scheme under the Learning with Errors (LWE) problem in the standard model.

Heterogeneous online/offline signcryption for secure communication in Internet of Things

Internet of things (IoT) is a promising network that combines various information sensing devices with the Internet to realize the interconnection of pervasive things. Security is a pivotal issue to ensure widespread adoption of the IoT. To ensure the security of data transmission, in this paper, we construct a heterogeneous online and offline signcryption from a wireless sensor network (WSN) to an Internet server. In our construction, the WSN is in certificateless cryptosystem (CLC) which does not involve public key certificate management problem in public key infrastructure (PKI) and key escrow problem in identity based cryptosystem (IBC), while the server is in IBC which avoids public key certificate management problem. For signcryption process, the proposed scheme is split into two steps: offline step and online step. In the former step, a lot of time-consuming calculations are completed, but do not involve the message to be transmitted. In the latter step, only some lightweight calculations are involved, but message must be available. Confidentiality, authentication, non-repudiation, and integrity can be achieved in a logical single step. Meanwhile, a formal security proof is given in the random oracle model. In addition, an elaborate performance analysis demonstrates that our proposed scheme has advantages in terms of computational cost and private key size, offline storage, as well as communication overhead. Therefore, our construction can be well applied to the IoT.

A Secure User Authentication Protocol for Heterogeneous Mobile Environments

Mobile devices have become very important for our daily needs. The user authentication protocols with the key agreement are required to deal with the security issues that arise from the use of mobile devices through Internet applications. However, existing user authentication protocols are only suitable if the client and the server use a similar cryptographic approach. Therefore, it is important to develop an authentication protocol for mobile environments with heterogeneous cryptographic approaches. In this paper, an efficient user authentication and key agreement protocol is proposed for a heterogeneous client-server mobile environment. The security of the proposed scheme is formally proved under the <inline-formula> <tex-math notation="LaTeX">${q}$ </tex-math></inline-formula>-strong Diffie-Hellman problem (<inline-formula> <tex-math notation="LaTeX">${q}$ </tex-math></inline-formula>-SDH), the <inline-formula> <tex-math notation="LaTeX">${q}$ </tex-math></inline-formula>-bilinear Diffie-Hellman inversion problem (<inline-formula> <tex-math notation="LaTeX">${q}$ </tex-math></inline-formula>-BDHI), and the modified bilinear Diffie-Hellman inversion problem (mBDHI), respectively. Our scheme has reasonable processing costs and communication costs on the client and server sides. Moreover, our scheme is suitable for applications that use different cryptographic approaches. In particular, the proposed protocol can work when the client applies the identity-based cryptosystem and the server applies the certificateless cryptosystem.

Security analysis of uppercaseSM9 digital signature and key encapsulation

Security analysis provides strong guarantees and evidence for security cryptosystems. SM9 is an identity-based cryptosystem designed by China and has become a Chinese standard. The SM9 digital signature and encryption algorithm also became ISO/IEC International standards. However, there are few published research results on the security of SM9 cryptosystems. Based on Gap-$q$-BCAA1 assumption, Cheng gave the security analysis of SM9 key exchange protocol, key encapsulation and encryption algorithm in Inscrypt 2018. In this paper, we first give the formal security analysis for SM9 digital signature. Based on the $q$-SDH assumption, we prove that SM9 signature algorithm is EUF-CMIA secure. To eliminate the Gap assumption, we then use the technique of Twin-Hash-ElGamal to modify SM9 key encapsulation slightly without compromising its security and propose a new identity-based key encapsulation mechanism called Twin-SM9. Compared to SM9 key encapsulation, both the system public key and user private key contain one additional group element only and the ciphertext size remains the same. We prove that Twin-SM9 achieves IND-CCA security in the random oracle model based on the $q$-BDHI assumption. Our results clarify the security of SM9 and are useful for the design of SM9-based cryptosystems.

A secure and efficient certificateless signature scheme for Internet of Things

The Internet of Things (IoT) is a new technological innovation, which makes things intelligent and our life more convenient. To ensure secure communication between smart objects in the IoT, certificateless signature is a feasible cryptographic tool to provide data integrity and identity authentication, which eliminates the cumbersome certificate management in the certificate-based signature system, as well as the key escrow problem in the identity-based cryptosystem. However, most of the existing certificateless signature schemes are not all secure to resist various attacks, such as public key replacement attacks or malicious-but-passive key-generation-center attacks. Besides, due to the limited storage and processing capabilities of these smart things, they are unable to meet the real-time demands of the IoT completely. This paper first analyzes Jia’s scheme. We prove that the claimed solution is not resistant to the Type II strong adversaries. Then, we propose a novel certificateless signature scheme and prove its existentially unforgeable under the elliptic curve discrete logarithm problem assumption. Finally, the comprehensive performance evaluations indicate that, at the same security level, our scheme is more efficient than other certificateless signature schemes and is well suitable for the resource-constrained IoT environment.

A Certificate-Based Provable Data Possession Scheme in the Standard Model

Certificate-based cryptosystem can not only resolve the private key escrow problem inherent in the identity-based cryptosystem but also reduce the cost of public key certificate management in the public key infrastructure-(PKI-) based cryptosystem. Provable data possession (PDP) can ensure the integrity of users’ data stored in the cloud at a very high probability. By combining these two concepts, we propose a certificate-based PDP scheme. We prove that our scheme is secure in the standard model assuming that the Squ-CDH problem is hard. Based on the index logic table, our scheme can be extended to support dynamic operations easily. Efficiency analysis shows that our scheme has high efficiency.

Research on Role Access Control Model Based on Identity Authentication

Cryptography and access control are the core technologies for a secure operating system. Cryptography can guarantee the confidentiality, integrity, availability and unforgeability of information in the access control system. In the identity-based cryptosystem, the user’s private key is centrally generated by the key distribution center, and key escrow is a major security risk. In view of this problem, it is proposed that multiple trusted entities participate in the key distribution scheme in a serial manner. At the same time, this paper adds a separate blind factor to each user to increase security of the scheme; it also introduces the concept of virtual key, which uses additivity of the key space in the pair-based encryption scheme. In key generation, a timestamp T is added, which enables one-time pad of the system, enhances security of the system, and eliminates collusion attacks by KGC and multiple KPA. Finally, the improved signcryption scheme is combined with the RBAC model, and the I_RBAC model is proposed, which enables identity authentication and information confidentiality of users in simple communication in the RBAC model. Finally, the efficiency and safety of this scheme are analyzed.