Key Escrow Research Articles

BPRT: A blockchain‐based privacy‐preserving transaction scheme based on an efficient broadcast encryption with personalized messages

AbstractAs blockchain has drawn more and more attention, much research has developed different transaction schemes with privacy preserving specialized in various fields. The nature of blockchain makes the transaction information public, which presents much risk about the leakage of user privacy. It is quite necessary to design a flexible scheme to provide privacy preserving of transaction contents with reliable audit in blockchain that is lacked in the previous works. In this paper, we propose a blockchain‐based privacy‐preserving transaction scheme based on an efficient broadcast encryption with personalized messages called BPRT. First, we propose a fully anonymous broadcast encryption with personalized messages (BEPM). Compared with existing works, it is fully anonymous, and it has lower computation cost without pairing operations. It also avoids the key escrow problem existing in other BEPM schemes. Then, we construct the BPRT based on our BEPM. Our BPRT ensures the privacy preserving of transaction contents in group transmissions, and the encrypted transaction contents avoid exposing user identity information at the same time. It enables auditor to moderately and reliably make audit of transaction contents. Furthermore, we present formal security analysis of the proposed scheme. It has been proved that our scheme satisfies transaction confidentiality, receiver anonymity and audit reliability. Subsequently, experimental results indicate that the proposed BEPM enables fast encryption and decryption, and the computation of our BPRT is in milliseconds.

Pairing-free certificateless blind signature scheme for smart grid

The smart grid is an emerging power system that can realize the information exchange between users and power companies in two-way communication and adjust power companies’ power supply according to the real-time power requests from smart meters on the users’ side. However, since malicious attackers can eavesdrop on two-way communication to collect and transmit information, they may leak users’ information. Therefore, this paper proposes a new certificateless blind signature (CLBS) scheme with batch verification function and improves a power request system model for the smart grid to protect users’ privacy. In addition, the proposed CLBS scheme simplifies the certificate management process in the traditional public key cryptosystem and eliminates the hidden key escrow in the identity-based public key cryptosystem. The unforgeability of the scheme is proved through the random oracle model, and the scheme’s security can be reduced to the intractability of the elliptic curve discrete logarithm problem (ECDLP). The analysis results show that our scheme does not use the time-consuming bilinear pairing operation, and has obvious advantages in computing performance compared with the existing signature schemes.

A Certificateless-Based Authentication and Key Agreement Scheme for IIoT Cross-Domain

The Industrial Internet of Things (IIoT) improves productivity and intelligent manufacturing process through revolutionary technology. Due to the complexity of the manufacturing process, cross-domain access is inevitable. Recently, Meng et al. proposed a secure and efficient blockchain-assisted entity authentication mechanism BASA for IIoT cross-domain. In the BASA scheme, the authors utilized identity-based signature (IBS) to realize mutual authentication and the Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) exchange mechanism to negotiate the session key. Due to the inherent key escrow problem of identity-based cryptography (IBC), the key generation center (KGC) can obtain the session key negotiated between two entities distributed in different domains. When KGC is threatened, the security of the session key is worrying. Considering this security concern, based on the BASA scheme, in this article, we first show a secure and efficient certificateless public-key signature (CL-PKS) scheme with anonymity. Then, combined with the ECDHE key exchange mechanism, we give an efficient cross-domain authentication and key agreement scheme CL-BASA with the aid of consortium blockchain. After that, we make security verification by the formal analysis tool, Tamarin, which shows that our CL-BASA is secure. The evaluation demonstrates that our CL-BASA may have a slight disadvantage in storage overhead, but it has obvious advantages than competitor schemes in terms of communication overhead and computational overhead.

Certificateless public auditing scheme with designated verifier and privacy-preserving property in cloud storage

In recent years, cloud storage has become an attractive service for data owners to store their personal data. Since they lose physical control of their data, it is necessary to regularly audit its integrity. The public auditing technique is very popular because it is suitable to outsource the auditing task to any third-party auditor, who has professional knowledge on auditing. However in many practical scenarios, the data owner may expect some designated verifier (instead of any) to audit its data. Thus, the public auditing scheme with designated verifier was proposed. In order to further reduce the cost of managing certificates, and to avoid the dependence on public key infrastructure , identity-based auditing scheme with designated verifier was recently proposed. Nevertheless, the proposed identity-based auditing scheme still suffers from the key escrow attack the risk of privacy leakage . In this paper, for the first time, we propose a certificateless public auditing protocol with designated verifier privacy-preserving property. More concretely, it can not only protect the privacy of the stored data against the designated verifier, but also resolve key escrow problem existed in identity-based technique. Its security is based on the Computational Diffie–Hellman and Weil Diffie–Hellman assumptions. Finally, the performance analysis experimental results of the proposed protocol show that our auditing scheme is efficient feasible to applications in real life.

A Lightweight and Verifiable Access Control Scheme With Constant Size Ciphertext in Edge-Computing-Assisted IoT

As an extension of cloud computing, edge computing has attracted the attention of academia and industry because of its characteristics of low latency, high bandwidth, and low energy consumption. However, due to limited terminal resources and insufficient security design, the edge computing environment still faces many challenges in terms of data security and privacy protection. Among them, how to effectively control access to outsourced data is one of the main issues. In this article, we propose a lightweight and verifiable ciphertext-policy attribute-based encryption (CP-ABE)-based multiauthority access control scheme for edge computing-assisted Internet of Things (IoT), which adopts the method of outsourcing decryption to mitigate the computational cost of data users with limited resources. In addition, our scheme realizes the feature of attribute revocation, and the design of the multiauthority mechanism enables our scheme to avoid the problem of key escrow. Therefore, our proposed scheme not only ensures data confidentiality but also can resist the collusion attack. Besides, our scheme is secure against the chosen plaintext attack in the random oracle model under the decision <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$q$ </tex-math></inline-formula> -BDHE assumption. Finally, we compared our scheme with some related work in performance, and the results demonstrate that our scheme is efficient in computation and communication. Because our scheme greatly mitigates the overhead of data users, it is very suitable for edge computing supported IoT applications with restricted computation resources.

A Practical and Efficient Blockchain-Assisted Attribute-Based Encryption Scheme for Access Control and Data Sharing

Attribute-based encryption (ABE) is a powerful encryption scheme with flexible access control over encrypted data that has been widely adopted in cloud computing scenarios to facilitate data sharing. However, despite convenience and efficiency provided by data sharing based on cloud, it is commonly vulnerable to issues like key abuse (namely, illegal key sharing by user or key distribution by authority) and key escrow (namely, illegal decryption by ABE authority). Hence, exploring a more secure ABE scheme that can be key abuse and key escrow resistant is crucial. Furthermore, data modification that happens in cloud storage and outsourced computation is also a challenge for the cloud-based data sharing schemes. To handle the above issues, in this paper, we propose a secure and efficient data sharing scheme based on attribute-based encryption (ABE) and blockchain equipped with InterPlanetary File System (IPFS). In particular, we show that the large-universe ABE with outsourced decryption (LU-ABE-OD) scheme proposed by Ning et al. is vulnerable to key escrow attack, which is not secure enough in the data sharing scenario. Therefore, based on their basic proposal, we construct an improved multi-authority LU-ABE-OD scheme to encrypt personal data, which are stored in the IPFS system while blockchain is applied to store the hash value returned by IPFS and be responsible for the outsourced decryption. As a result, our scheme greatly reduces the decryption overheads of the user while risks of key abuse and key escrow can be settled. Meanwhile, the introduction of IPFS significantly reduces the storage burden on chain without data tampering problem. Through theoretical analysis and experimental simulation, we prove the feasibility, security, and efficiency of our scheme.

TCA-PEKS: Trusted certificateless authentication public-key encryption with keyword search scheme in cloud storage

Public key encryption with keyword search (PEKS) technology is capable of achieving accurate ciphertext retrieval while protecting data privacy. However, curious or malicious semi-trusted cloud servers can cause privacy breaches, which then creates a trust problem for ciphertext management and searching. To address this problem, we propose a trusted certificateless authentication public-key encryption with a keyword search scheme in cloud storage (TCA-PEKS), which ensuring trusted retrieval, simultaneously resolves the problems of key escrow and certificate management that exist in PEKS. In the scheme, the security of the ciphertext storage and verifications are strengthened based on blockchain non-tampering features, which assists users in verifying the correctness of a file. In particular, we construct an open and transparent smart contract to limit the malicious behaviour of cloud servers, in which the user’s complete private key splits the secret value and the partial private key, further guaranteeing the correctness of the retrieval process. Finally, the scheme is proven to satisfy ciphertext and trapdoor indistinguishability under the random oracle model, and the performance evaluation results show that the scheme is highly efficient.

Certificateless Aggregated Signcryption Scheme (CLASS) for Cloud-Fog Centric Industry 4.0

Over recent years, the Industrial Internet of Things and connectivity of the various sensors on the industrial and automaton front have played a crucial role in the manufacturing process. Production ventures are predominantly represented by Industry 4.0 so produce colossal information. Data outsourcing is one of the ways to manage the overhead of the massive data generated from the various resource-constrained devices utilized in the industrial environment. Therefore, the crowdsourced data from many organizations are outsourced to the cloud system. However, privacy and security challenges such as illegal admittance, data leakage are raised by the outsourced storage. Data authentication is an optimistic approach to establishing the integrity, confidentiality, and authenticity of the data. The certificateless signcryption scheme is most appropriate for lightweight devices established in the industrial ecosystem. In this article, we propose a privacy-conserving, lightweight data aggregation scheme to attain security in an industrial network. In the proposed model, the data owner collects the industrial data from various resource-constrained devices and sends this data to the data aggregator and proficiently data obtained by the industrial data user securely. Particularly, in this article, we propose a proficient certificateless aggregated signcryption scheme, which provides a data aggregation element in comparison to existing schemes. Our proposed scheme includes mutual authentication, public viability, integrity and confidentiality of data, volatile to key escrow, and privacy-preserving aspects for the industrial data. Performance evaluation and result analysis demonstrate that the proposed protocol performs better than other schemes significantly.

Improved Efficient Privacy-Preserving Certificateless Provable Data Possession Scheme for Cloud Storage

Cloud storage technology is evolving at a high speed; effectively auditing the cloud data’s integrity has become a focal point. Recently, Ming and Shi proposed a certificateless integrity auditing scheme with a privacy protection function. The scheme used the certificateless cryptosystem to solve the certificate management problem of the auditing schemes based on public key infrastructure and the key escrow problem of the identity-based auditing schemes. Although their scheme is novel and efficient, we found that their scheme was not secure and could not achieve integrity auditing of cloud data. The malicious cloud server can generate the proof through the blocks and tags sent by the user. On the basis of the original scheme, we propose an improved auditing scheme; our new scheme is more secure and effective. In addition, for the problem of idle tags in the existing cloud data integrity auditing scheme, we propose the idea of intermediate tags and we applied the idea to the improved scheme to improve audit efficiency.

Design a sturdy and secure authentication scheme capable of early detection of COVID-19 patients using WBANs

&lt;p&gt;COVID-19 was first reported in China Wuhan and rapidly grown up to more than 58 countries based on the World Health Organization (WHO). Well ahead of any health emergency, the health care server has the ability to access these data via authorization and then s/he performs necessary actions. In order to protect medical data from malicious activities, authentication is the starting point for this. Authentication systems represent a network support factor to reduce ineffective users and radically eliminate phishing because authentication determines the identity of the real user. Many schemes and technologies have been suggested for authentication in wireless body area networks (WBANs). In this paper, we suggest a strong dynamic password authentication system for WBANs. We adopt a (different/new) way to calculate a password and make it coherent and dynamic for each login session. Our work also provides additional security properties to get rid of hub node impersonation attacks and resolve key escrow issues. Our scheme resist fishing attach which keep patient from any illegal change of drugs. By comparison, the proposed scheme is considered active and has strong security based on formal security analysis tools such as AVISPA.&lt;/p&gt;

Security-Enhanced Certificate-Based Remote Data Integrity Batch Auditing for Cloud-IoT

The Internet of Things (IoT) plays a crucial role in the generation of new, intelligent information technologies. Generally, the IoT facilities are composed of lightweight devices, and they expand computing and storage resources primarily through the cloud. Massive data collected by intelligent devices will be stored in cloud servers, but the vulnerabilities of cloud servers will directly threaten the security and reliability of the IoT. To ensure the integrity of data in the cloud, data owners need to audit the integrity of their outsourced data. Recently, several remote data integrity batch auditing protocols have been proposed to reduce transmission loss and time cost in the auditing process. However, most of them cannot resist collusion attacks. Meanwhile, certificate management problem exists in their system, which brings an enormous burden on the system. In this paper, we construct a certificate-based remote data integrity batch auditing protocol which can issue batch auditing and resist the highest level of collusion attacks—the fully chosen-key attacks for cloud-IoT . Our protocol makes use of a certificate-based cryptosystem which gets rid of the certificate management problem and key escrow problem, with no need for secret channels. Our protocol is proved to be secure in the random oracle model and implemented to show its efficiency. The simulation results illustrate that, in the case of enhanced security, our batch auditing protocol still has computational efficiency and practicability.

A Multivariate-Based Provably Secure Certificateless Signature Scheme With Applications To The Internet Of Medical Things

Abstract Over the last few years, Internet of Medical Things (IoMT) has completely transformed the healthcare industry. It is bringing out the most notable, and unprecedented impacts on human health, and has totally changed the way we look at the healthcare industry. The healthcare sector all around the globe are leapfrogging, and adopting the technology, helping in transforming drastically in a very short span of time. However, as more and more number of medical devices are being connected to IoMT, security issues like ensuring authenticity and integrity of the transmitted data are also on the rise. In view of the context, there is a need of an efficient cryptographic primitive that can address these issues in a viable manner. A signature scheme seems to be the natural choice to mitigate the security concerns. But, traditional signature schemes, both public-key-infrastructure-based and Identity-based, have their own disadvantages, which makes them unsuitable for IoMT networks. Thus, to address the security issues and problems like certificate management and key escrow, herein, we put forward the first multivariate-based certificateless signature scheme, namely, Multivariate Certificateless Signature (Mul-CLS), which is built on top of the intractability of multivariate-quadratic (MQ) problem. The fact that multivariate public key cryptosystem provides fast, post-quantum safe and efficient primitives makes it a front-runner candidate among the other post-quantum cryptography candidates. Our scheme Mul-CLS provides existential unforgeability against chosen message and chosen identity Super Type I and Super Type II adversary if solving the MQ problem is NP-hard. In addition to that, our proposed Mul-CLS presents itself as a robust and cost-friendly cryptographic building block for building IoMT networks.

ECDSA-based certificateless conditional privacy-preserving authentication scheme in Vehicular Ad Hoc Network

A Certificateless Public Key Cryptography (CL-PKC) aims to avoid the drawback of both traditional public key cryptography which requires a Public Key Infrastructure (PKI), and Identity-Based Public Key Cryptography (ID-PKC) which suffers from the inherent key escrow problem. In Vehicular Ad Hoc Network (VANET), a Certificateless Conditional Privacy Preserving Authentication (CCPPA) fulfills all known VANET security requirements in order to resolve challenges related to security and privacy. However, the existing certificateless schemes only achieve a trust level 2 according to the hierarchy defined by Girault. In case the partial private key is leaked, a malicious node can replace the public key since the public key is not bound to an identity. As a result, the trusted authority can only identify malicious nodes by using their pseudo identities. Al-Riyami and Paterson introduced a binding technique that allows to lift the trust level of a normal certificateless scheme to a trust level 3 by using a binding technique. This paper proposes new CCPPA schemes that use Al-Riyami and Paterson's technique, can achieve a stronger security and achieve a trust level 3. In case the partial private key is leaked, only the legitimate node can use the corresponding public key which has been certified by the trusted authority. As a result, the proposed CCPPA schemes address the vulnerability related to the public key replacement attack which is present in several CCPPA schemes. Our schemes also offer a tracing technique which consists of allowing the trusted authority to identify a malicious node using both its pseudo identity and public key. The proposed schemes use ECC cryptography and avoid Map-to-Hash function and bilinear pairing. Also, we called our schemes ECDSA-CCPPA and ECDSA*-CCPPA since they allow to respectively implement Elliptic Curve Digital Signature Algorithm (ECDSA) and the modified ECDSA* during authentication process in VANET. A security analysis is performed and proves that the ECDSA-CCPPA and ECDSA*-CCPPA schemes are secure in the random oracle. Actually, the ECDSA*-CCPPA scheme has an advantage over ECDSA-CCPPA in that it allows to perform a batch verification of signatures, where RSUs can support vehicles by collecting vehicle's signatures and verifying their messages in congested areas in order to reduce verification time. Additionally, a performance analysis is carried out to compare ECDSA*-CCPPA with several existing schemes. The simulation results show that ECDSA*-CCPPA outperforms the studied schemes with regard to the signature and verification process of one message. Moreover, it has the less overhead when compared to the studied certificateless schemes.

Efficient Certificateless Conditional Privacy-Preserving Authentication for VANETs

Vehicular Ad-hoc Network (VANET) is vital for supporting intelligent transport systems, such as traffic data sharing and cooperative processing in the modern city. However, data security and privacy are the critical factors restricting the development. To address these challenges, several certificateless conditional privacy-preserving authentication (CPPA) schemes with anonymity and traceability have been proposed. These schemes avoid complicated certificate management in the PKI framework and key escrow in the ID-based protocol. However, there still exist drawbacks such as computational complexity, high communication cost or security vulnerability. Recently, Ali <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> proposed an efficient certificateless CPPA (CLCPPA) scheme for VANETs, but we have found that this scheme fails to resist a signature forgery attack. To achieve a trade-off between security and efficiency, we first demonstrate the insecurity of Ali <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.’s</i> protocol and then introduce a security-enhanced solution. To show the feasibility and utility of our proposal, we perform a security analysis in the security model. Moreover, we evaluate the performance via comparing it with other existing schemes. From the comparison results, we can find that our scheme is more efficient than prior state-of-art solutions, in terms of signing (improving 66.75%), the verification (improving 33.19%) and bandwidth requirement (reducing 14.75%). Therefore, our proposal is more suitable to be applied in VANETs.

An Efficient Certificate-Based Data Integrity Auditing Protocol for Cloud-Assisted WBANs

With the evolution of wireless body area networks (WBANs), wearable equipment will improve the human healthcare service. However, the medical data generated in WBANs increase dramatically with time, and the massive data cause the storage burden. With the help of cloud computing, the cloud service provider (CSP) can assist data owners in storing these data collected by sensors. By keeping their data in the CSP, the data integrity and authenticity is a big concern of data owners. To date, many data integrity auditing protocols have been proposed to address this issue. Most of them rely on traditional public-key mechanism, or identity-based cryptography (IBC), or certificateless cryptography (CLC). However, they suffer from the heavy cost of certificate management, key escrow, or the requirement of a secret channel for each user, respectively. To solve these drawbacks, we propose an efficient certificate-based data integrity auditing protocol for cloud-assisted WBANs. In our protocol, the computation cost in tag generation for a data block is fixed, and is independent of the size of the data block. We prove our protocol is secure in the random oracle model (ROM) and use the Java pairing-based cryptography library (JPBC) to implement the protocol. The experimental results show that our protocol is computationally efficient and practical.

Certificateless Homomorphism Network Coding Signature Scheme

As an information transmission technology, network coding can reduce the transmission delay and improve the transmission efficiency with network performance. However, the nodes in network are vulnerable to the pollution and forgery attacks. Until now, most of network coding schemes are from pairing. Under the requirement of low computation complexity, we construct certificateless homomorphism network coding signature scheme (CL-HNCSS). In CL-HNCSS, certificateless technology avoids key management and key escrow for multi-source nodes, the homomorphism and scalar multiplication are used to reduce the computation cost. CL-HNCSS satisfies the unforgeability under the adaptive chosen-message attacks and can resist the pollution attacks. In addition, CL-HNCSS has very high communication and computation efficiency.

Revocable and Privacy-Preserving Decentralized Data Sharing Framework for Fog-Assisted Internet of Things

Fog-assisted Internet of Things (IoT) can outsource the massive data of resource-constraint IoT devices to cloud and fog nodes (FNs). Meanwhile, it enables convenient and low time-delay data-sharing services, which relies heavily on high security of data confidentiality and fine-grained access control. Many efforts have been focused on this urgent requirement by leveraging ciphertext-policy attribute-based encryption (CP-ABE). However, when deployed in fog-assisted IoT systems for secure data sharing, it remains a challenging problem of how to preserve attribute privacy of access policy, and trace-then-revoke traitors (i.e., malicious users intending to leak decryption keys for illegal profits) efficiently and securely in such a large scale and decentralized environment with resource-constraint user devices, especially in consideration of misbehaving cloud and FNs. Therefore, in this article, we propose a revocable and privacy-preserving decentralized data-sharing framework (RPDDSF) by designing a large universe and multiauthority CP-ABE scheme with fully hidden access policy for secure data sharing in IoT systems to achieve user attribute privacy preserving with unbounded attribute universe and key escrow resistance suitable for large scale and decentralized environment. Based on this, with RPDDSF, anyone can efficiently expose the traitors and punish them by forward/backward secure revocation. Besides, RPDDSF is able to guarantee data integrity for both data owners (DOs) and users to resist misbehaving cloud and FNs, alongwith low computation overhead for resource-constraint devices. Finally, RPDDSF is proven to be secure with detailed security proofs, and its high efficiency and feasibility are demonstrated by extensive performance evaluations.

IIBES: a proposed framework to improve the identity-based encryption system for securing federated learning

Purpose In the field of cryptography, authentication, secrecy and identification can be accomplished by use of secret keys for any computer-based system. The need to acquire certificates endorsed through CA to substantiate users for the barter of encoded communications is one of the most significant constraints for the extensive recognition of PKC, as the technique takes too much time and susceptible to error. PKC’s certificate and key management operating costs are reduced with IBC. IBE is a crucial primeval in IBC. The thought behind presenting the IBE scheme was to diminish the complexity of certificate and key management, but it also gives rise to key escrow and key revocation problem, which provides access to unauthorised users for the encrypted information. Design/methodology/approach This paper aims to compare the result of IIBES with the existing system and to provide security analysis for the same and the proposed system can be used for the security in federated learning. Findings Furthermore, it can be implemented using other encryption/decryption algorithms like elliptic curve cryptography (ECC) to compare the execution efficiency. The proposed system can be used for the security in federated learning. Originality/value As a result, a novel enhanced IBE scheme: IIBES is suggested and implemented in JAVA programming language using RSA algorithm, which eradicates the key escrow problem through eliminating the need for a KGC and key revocation problem by sing sub-KGC (SKGC) and a shared secret with nonce. IIBES also provides authentication through IBS as well as it can be used for securing the data in federated learning.

An SKP-ABE Scheme for Secure and Efficient Data Sharing in Cloud Environments

Security threats such as data forgery and leakage may occur when sharing data in cloud environments. Therefore, it is important to encrypt your data and securely access it when sharing it with other users via a cloud server. Of the various security technologies, research on secure data sharing commonly employs Key Policy Attribute-Based Encryption (KP-ABE). However, existing KP-ABE schemes generally lack ciphertext search features. Furthermore, even if a KP-ABE scheme incorporates it, the number of searches required increases markedly by the number of attributes used in the search. It in turn proportionally increases the ciphertext size. In addition, the attribute authority (AA) could be attacked, which can result in the leakage of users’ decryption keys. AA is a server that manages user attributes and decryption keys when using attribute-based encryption in a cloud environment. If the AA is curious, it can cause problems with the key escrow with the attributes and decryption (secret) key information of the users it knows. In this paper, to solve all these problems, we present a new scheme called Searchable Key-Policy Attribute-Based Encryption (SKP-ABE) for secure and efficient data sharing in the cloud. This proposed SKP-ABE scheme allows fast ciphertext search and keeps the ciphertext of constant size. The key escrow problem is solved via user key generation.

Certificateless Elliptic Curve Aggregate Signcryption Scheme

Driven by new situation of “Internet +,” Internet has achieved the integrated development with all walks of life. Among them, the fifth generation is a key technology to promote the deep integration of Internet-of-Things equipment, cloud computing, blockchain and other trades. Hence, it is necessary for IoTs to consider the cost and efficiency of authentication and confidentiality of the communication. For effectively solving the above problems, we devise certificateless elliptic curve aggregate signcryption (CL-ECASC) scheme for IoTs that can improve the authentication efficiency, realize data confidentiality, and avoid the problems of complex certificate management and key escrow. Under the hardness of discrete logarithm and computational DiffieHellman problems on elliptic curve, CL-ECASC is proved to has the IND-CCA2 security (indistinguishability under the adaptive chosen-ciphertext attacks) and UF-CMA security (existentially unforgeable under the adaptive chosen-message attacks). CL-ECASC has relatively faster computation efficiency and lower communication cost, and so it is suitable for secure transmission of the information in the previously mentioned environments.