Identity-based Signature Research Articles

Protecting unauthenticated messages in LTE/5G mobile networks: A two-level Hierarchical Identity-Based Signature (HIBS) solution

As an essential public infrastructure, the security and reliability of mobile networks have a profound impact on people’s production and life. Although the security of LTE/5G networks has been improved a lot with the evolution of standards, there are still some unprotected messages being transmitted between the cellular network and device due to the symmetric key-based security architecture and the trade-off between security and other criteria like network availability. By exploiting these messages, various security attacks have been proposed and demonstrated against commercial mobile networks and devices in existing literature, such as user location tracking, bidding-down, and DoS attacks. To address this security issue, in this paper, we aim to protect these unauthenticated messages in mobile networks using digital signatures. Based on the idea of Hierarchical Identity-Based Signature (HIBS) in existing work, we analyse and design a two-level HIBS solution in detail in terms of different aspects such as keys generation and provisioning procedures, replay mitigation, and cell selection. Unlike previous work, our proposed solution also supports the protection of individual vulnerable RRC and NAS layer signalling in addition to authenticating the base station. We evaluated the efficiency and feasibility of several existing HIBS schemes and implemented the most efficient one in the 5G standalone network setup using open-source software. The implementation results further proved the feasibility of the solution in practice.

Cryptanalysis of a quantum identity-based signature and its improvement

Cryptanalysis of a quantum identity-based signature and its improvement

A Secure and Effective Hierarchical Identity-Based Signature Scheme for ADS-B Systems

A Secure and Effective Hierarchical Identity-Based Signature Scheme for ADS-B Systems

Post-Quantum Secure Identity-Based Signature Scheme with Lattice Assumption for Internet of Things Networks.

The Internet of Things (IoT) plays an essential role in people's daily lives, such as healthcare, home, traffic, industry, and so on. With the increase in IoT devices, there emerge many security issues of data loss, privacy leakage, and information temper in IoT network applications. Even with the development of quantum computing, most current information systems are weak to quantum attacks with traditional cryptographic algorithms. This paper first establishes a general security model for these IoT network applications, which comprises the blockchain and a post-quantum secure identity-based signature (PQ-IDS) scheme. This model divides these IoT networks into three layers: perceptual, network, and application, which can protect data security and user privacy in the whole data-sharing process. The proposed PQ-IDS scheme is based on lattice cryptography. Bimodal Gaussian distribution and the discrete Gaussian sample algorithm are applied to construct the fundamental difficulty problem of lattice assumption. This assumption can help resist the quantum attack for information exchange among IoT devices. Meanwhile, the signature mechanism with IoT devices' identity can guarantee non-repudiation of information signatures. Then, the security proof shows that the proposed PQ-IDS can obtain the security properties of unforgeability, non-repudiation, and non-transferability. The efficiency comparisons and performance evaluations show that the proposed PQ-IDS has good efficiency and practice in IoT network applications.

Identity-based chameleon hash from lattices

Identity-based chameleon hash (IBCH) is a cryptographic primitive with nice properties. IBCH equips each user with a trapdoor and the hash values can be publicly evaluated w.r.t. the identity of any user. On the one hand, it is hard to find collisions for the hash values without the user’s trapdoor. On the other hand, with the help of the user’s trapdoor, finding collisions becomes easy. An important application of IBCH is to upgrade an identity-based signature (IBS) scheme to an on-line/off-line identity-based signature (OO-IBS) scheme. OO-IBS is a useful tool to provide authenticity in lightweight smart devices, since it only involves light on-line computations and does not need key certificate. Up to now, there are many IBCH constructions from traditional number-theoretic assumptions like RSA, CDH, etc. However, none of the existing IBCH schemes achieve the post-quantum security in the standard model. In this paper, we propose a new IBCH scheme from lattices. The security of our IBCH is reduced to a well-accepted lattice-based assumption – the Short Integer Solution (SIS) assumption in the standard model. Our work provides the first post-quantum solution to IBCH in the standard model.

Multidimensional Epidemiological Survey Data Aggregation Scheme Based on Personalized Local Differential Privacy

In recent years, with the rapid development of intelligent technology, information security and privacy issues have become increasingly prominent. Epidemiological survey data (ESD) research plays a vital role in understanding the laws and trends of disease transmission. However, epidemiological investigations (EI) involve a large amount of privacy-sensitive data which, once leaked, will cause serious harm to individuals and society. Collecting EI data is also a huge task. To solve these problems and meet personalized privacy protection requirements in EIs, we improve the uOUE protocol based on utility-optimized local differential privacy to improve the efficiency and accuracy of data coding. At the same time, aiming at the collection and processing of ESD, a multidimensional epidemiological survey data aggregation scheme based on uOUE is designed. By using Paillier homomorphic encryption and an identity-based signature scheme to further prevent differential attacks and achieve multidimensional data aggregation, the safe, efficient, and accurate aggregation processing of ESD is executed. Through security proof and performance comparison, it is verified that our algorithm meets the requirements of local differential privacy and unbiased estimation. The experimental evaluation results on two data sets show that the algorithm has good practicability and accuracy in ESD collection and provides reliable and effective privacy protection.

Efficient Blockchain-Assisted Distributed Identity-Based Signature Scheme for Integrating Consumer Electronics in Metaverse

Efficient Blockchain-Assisted Distributed Identity-Based Signature Scheme for Integrating Consumer Electronics in Metaverse

Comment on “An efficient identity-based signature scheme with provable security”

In this comment paper, we reveal a security issue in an efficient identity-based signature (IBS) scheme that has been proven secure in the standard model. More specifically, we perform a key-only attack on the IBS scheme to break its universal unforgeability. Since the security notion of universal unforgeability under key-only attack (uuf-koa) is a weaker notion than the existential unforgeability under chosen message attack (euf-cma), this invalidates the euf-cma security claimed by the IBS scheme. Subsequently, we propose a fix to achieve a stronger seuf-cma security without a random oracle.

System-widely and fine-grained forward secure identity-based signature scheme

In an identity-based signature (IBS) system, each user uses individual information as his/her public key, and also holds a private key issued by a fully trusted key generation center (KGC) with a master secret key. This avoids the mandatory requirement of public key infrastructure, and thus motivates the wide deployment of IBS in various fields. In practical scenarios, the premise that IBS can provide the intended security guarantee is to remain secret keys unrevealed. That is, on the one hand, after a user’s secret key is leaked, then an adversary can use it to create correct signatures for any messages, which invalidates all signatures produced by this user him/herself. On the other hand, what is worse, after the master secret key is disclosed, then all users’ signatures become useless, since the adversary can produce any user’s private key with it. In this paper, to reduce the damage of secret key leakage in IBS system, we introduce system-widely and fine-grained forward-secure IBS (SWFG-fs-IBS). In this primitive, the master secret key is immediately punctured after issuing a secret key for a new user, such that it would fail to issue a secret key for the same user again. Similarly, we also perform puncture operations on each user’s private key after signing messages, which prevents the exposed private key from creating signatures for previously signed messages. Concretely, we first define the syntax and security notions of SWFG-fs-IBS, and then propose its concrete construction with provable security. The theoretical analysis indicates that our proposal provides stronger and more practical forward security than previous fs-IBS schemes. We also provide an implementation of our proposal, and present extensive experiments to demonstrate its feasibility.

Lightweight and Verifiable Secure Aggregation for Multi-dimensional Data in Edge-enhanced IoT

The development of IoT applications promotes the generation of large-scale data. In this situation, more and more organizations or institutions are interested in collecting and analyzing these data to obtain high-quality information to serve people’s lives. Nevertheless, existing secure aggregation solutions are mostly proposed under the honest-but-curious threat model, without considering malicious aggregators. Actually, the aggregation node may return tampered or forged aggregation results for vulnerabilities or ulterior motives. It is more challenging to devise efficient verifiable data aggregation due to the characteristics of IoT devices. In this paper, we propose a Lightweight and Verifiable Secure Aggregation Scheme for Multi-dimensional Data in Edge-enhanced IoT (LVSA-MD), which allows the secure aggregation of multi-dimensional data, and the requester can verify the correctness and integrity of the aggregation results. In LVSA-MD, we combine Chinese remainder theorem with secret sharing technique to protect the individual data privacy, as well as reducing the communication overhead. Moreover, by involving homomorphic MAC, we achieve a lightweight verifiable mechanism to ensure the integrity of result. We additionally employ identity-based signature to achieve the source authentication. Detailed security analysis demonstrates that the proposed LVSA-MD achieves the goal of protecting privacy, integrity and authentication. Moreover, extensive theoretical analyses and experimental evaluations show that our LVSA-MD performs efficiently with respect to computation and communication while retaining more desired properties.

An efficient identity-based signature protocol over lattices for the smart grid

As the promising next-generation power grid, the smart grid has developed rapidly in recent years. The smart grid enables energy to be stored and delivered more efficiently and safely, but user data’s integrity protection has been an important security issue in the smart grid. Although lots of digital signature protocols for the smart grid have been proposed to resolve this problem, they are vulnerable to quantum attacks. To deal with this problem, an efficient identity-based signature protocol on lattices is proposed in this paper. To improve our protocol’s efficiency, the tree of commitments is utilized. Moreover, a detailed performance evaluation of the proposed protocol is made. The performance analysis demonstrates that the potential utility of our protocol in the smart grid is huge.

IdenMultiSig: Identity-Based Decentralized Multi-Signature in Internet of Things

Most devices in the Internet of Things (IoT) work on unsafe networks and are constrained by limited computing, power, and storage resources. Since the existing centralized signature schemes cannot address the challenges to security and efficiency in IoT identification, this article proposes IdenMultiSig, a decentralized multi-signature protocol that combines identity-based signature (IBS) with Schnorr scheme under discrete logarithms on elliptic curves. First, to solve the problem of offline or faulty devices under unstable networks, we introduce a novel improvement of the existing Schnorr scheme by introducing a threshold Merkle tree for the verification with only <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$m$</tex-math> </inline-formula> valid signatures among <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n$</tex-math> </inline-formula> participants ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$m$</tex-math> </inline-formula> – <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n$</tex-math> </inline-formula> tree), while hiding the real identity to protect the data security and privacy of IoT nodes. Furthermore, to prevent dishonest or malicious behavior of the private key generator (PKG), a consortium blockchain is innovatively applied to replace the traditional PKG as a decentralized and trusted private key issuer. Finally, the proposed scheme is proven to be unforgeable against forgery signature attacks in the random oracle model (ROM) under the elliptic curve discrete logarithm (ECDL) assumption. Theoretical analysis and experimental results show that our scheme matches or outperforms existing research studies in privacy protection, offline device support, decentralized PKG, and provable security.

BTAA: Blockchain and TEE-Assisted Authentication for IoT Systems

In recent years, Internet of Things (IoT) technology has gained a lot of attention. With the development of IoT technology, it comes the need for devices with different trust domains to interact and collaborate. In order to protect the security and reliability of the communication between devices in different trust domains, it raises the concerns about the the technology of cross-domain authentication. Traditional cross-domain authentication methods may lead to heavy key management overhead or depend on trusted third parties, while existing blockchain-based cross-domain authentication schemes do not prevent the possibility of mischief by malicious domain managers. In this paper, we design an efficient Blockchain and TEE assisted secure device authentication scheme for cross-domain IoT system, called BTAA. Our solution solves the problem that managers are not fully trusted, which in turns protect the security and reliability in the blockchain-based cross-domain communication. Specifically, blockchain is introduced to build trust between different domains, the identity-based signatures are used to verify the identity information of devices and the TEE is introduced to prevent the possibility of mischief by domain managers. Finally, our experiments show that the introduction of TEE has greatly improved system security with a low efficiency reduction, which proves that our scheme can achieve highly secure distributed IoT authentication..

Ensemble-based cryptography for soldiers’ health monitoring using mobile ad hoc networks

Information technology acts an important role in gathering, transmitting with executing data from areas of disaster-prone such as the battlefield and international borders. In addition to the country’s security, the soldier needs protection by defending himself with advanced weapons such as a bomb detector. This paper provides the capability to track the whereabouts and health of soldiers who have been lost or injured on the battlefield. It assists in reducing the time, searching and rescuing operation efforts of the military control room. This paper implements a system for health-condition monitoring that sends soldiers’ health parameters, such as the electrocardiogram (ECG), blood oxygen level, pulse rate, and temperature, to the control room via a Mobile Ad hoc Network (MANET). Body parameters are sensed utilizing various body sensors fixed to the bodies of soldiers. The body parameters are broadcasted to the control room via MANET devices at the path. To preserve the health parameters data of soldiers from enemies while data transmission, this paper also proposes a cryptographic ensemble approach. This approach combines Symmetric Key Encryption, and Identity Based Encryption (IBE) with Identity Based Signature (IBS). The experimental result shows proposed cryptographic ensemble provides high security compared with existing MANET security algorithms.

HIBEChain: A Hierarchical Identity-Based Blockchain System for Large-Scale IoT

Internet-of-Things enables interconnection of billions of devices, which perform autonomous operations and collect various types of data. These things, along with their generated huge amount of data, need to be handled efficiently and securely. Centralized solutions are not desired due to security concerns and scalability issue. In this article, we propose HIBEChain, a hierarchical blockchain system that realizes scalable and accountable management of IoT devices and data. HIBEChain consists of multiple permissioned blockchains that form a hierarchical tree structure. To support the hierarchical structure of HIBEChain, we design a decentralized hierarchical identity-based signature (DHIBS) scheme, which enables IoT devices to use their identities as public keys. Consequently, HIBEChain achieves high scalability through parallel processing as blockchain sharding schemes, and it also implements accountability by use of identity-based keys. Identity-based keys not only make HIBEChain more user-friendly, they also allow private key recovery by validators when necessary. We provide detailed analysis of its security and performance, and implement HIBEChain based on Ethereum source code. Experiment results show that a 6-ary, (7,10)-threshold, 4-level HIBEChain can achieve 32,000 TPS, and it needs only 9 seconds to confirm a transaction.

High-Performance Implementation of the Identity-Based Signature Scheme in IEEE P1363 on GPU

Identity-based cryptography is proposed to solve the complicated certificate management of traditional public-key cryptography. The pairing computation and high-level tower extension field arithmetic turn out to be the performance bottleneck of pairing-based signature schemes. Graphics processing units have been increasingly popular for general-purpose computing in recent years. They have shown a lot of promise in speeding up cryptographic schemes such as AES, RSA, and ECDSA. However, to our knowledge, the research on parallel implementation of pairings and identity-based cryptographic schemes on graphics processing units is somewhat outdated. Therefore, in this article, we implement the identity-based signature scheme in the IEEE P1363 Standard on a modern NVIDIA RTX 3060 card. We convert the pairing computation in signature verification into a product of pairings with fixed arguments and therefore avoid the scalar multiplication in 𝔾 2 . Then we employ the precomputation technique to improve the elliptic curve scalar multiplication, exponentiation in \(\mathbb {F}_{p^{12}}\) and the pairing computation. We also apply PTX ISA to multiple-precision arithmetic. Experiments demonstrate that our implementation can perform 43,856/46,753/39,798 pairings/sec for the Optimal Ate pairing, the pairing with a fixed argument, and two pairings with fixed arguments, respectively. Peak throughputs of signature generation and verification can achieve 322.6 and 40.6 kops/sec over the BN254 curve.

Homomorphic cryptosystem-based secure data processing model for edge-assisted IoT healthcare systems

The substantial acceptance of Internet-of-Things (IoT) in digital healthcare systems necessitates secure data processing before storing it on a cloud server. Since resource-limited IoT devices engender complexity in secure processing, edge computing technology is adopted. Edge-assisted IoT locates edge nodes in proximity to user devices enabling computation offloading and seamless interaction between IoT applications and cloud servers. Integration of these entities results in severe security and privacy issues due to large amount of sensitive information transmitted over vulnerable communication channels. As such, information protection and data integrity in edge-assisted IoT have become critical factors for improvement. Several data processing models have been proposed regarding the above-stated concerns. However, under a powerful adversarial scenario, traditional solutions lack in preserving robust security and privacy. This motivates us to address critical challenges of communication security and privacy-preserving computation offloading in edge-assisted IoT systems. In this article, we design a homomorphic cryptosystem-based secure data processing model (HC-SDPM), enabling secure data collection and aggregation offloading on edge nodes for our hypothesized edge-assisted IoT healthcare system. Paillier homomorphic encryption and certificateless linear homomorphic ID-based signatures are utilized to achieve end-to-end confidentiality and data integrity during transmission and aggregation. Moreover, HC-SDPM involves a semi-trusted authority to enable key-escrow resilience. The security analysis of HC-SDPM assures signatures unforgeability in the random oracle model under computational Diffie–Hellman assumptions. Compared with similar modeled schemes, HC-SDPM demonstrates a relative advantage in computational overhead, communication overhead, and storage complexity.

Mul-IBS: a multivariate identity-based signature scheme compatible with IoT-based NDN architecture

Mul-IBS: a multivariate identity-based signature scheme compatible with IoT-based NDN architecture

Message sharing scheme based on edge computing in IoV.

With the rapid development of 5G wireless communication and sensing technology, the Internet of Vehicles (IoV) will establish a widespread network between vehicles and roadside infrastructure. The collected road information is transferred to the cloud server with the assistance of roadside infrastructure, where it is stored and made available to other vehicles as a resource. However, in an open cloud environment, message confidentiality and vehicle identity privacy are severely compromised, and current attribute-based encryption algorithms still burden vehicles with large computational costs. In order to resolve these issues, we propose a message-sharing scheme in IoV based on edge computing. To start, we utilize attribute-based encryption techniques to protect the communications being delivered. We introduce edge computing, in which the vehicle outsources some operations in encryption and decryption to roadside units to reduce the vehicle's computational load. Second, to guarantee the integrity of the message and the security of the vehicle identity, we utilize anonymous identity-based signature technology. At the same time, we can batch verify the message, which further reduces the time and transmission of verifying a large number of message signatures. Based on the computational Diffie-Hellman problem, it is demonstrated that the proposed scheme is secure under the random oracle model. Finally, the performance analysis results show that our work is more computationally efficient compared to existing schemes and is more suitable for actual vehicle networking.

Toward Tight Security of the Galindo–Garcia Identity-based Signature

Toward Tight Security of the Galindo–Garcia Identity-based Signature