H_{3}(sP+R)$. The user sends the signature $<v,R,A>$ to the verifier.

  4. 4.

Verification: For given signature pair $<v,R,A>$, the user computes u and
recovers M’, given in Equations (5.8)-(5.9).

$u=v\oplus H_{3}(H_{2}(R)(A+H_{1}(A,ID_{S})P_{0}))$ (5.8)

$m^{\prime}=F_{2}({{}_{l_{1}}}^{l}|u|)\oplus|u|_{l_{2}}^{R}$ (5.9)

The user accepts the signature and message $m^{\prime}$ if and only if
${{}_{l_{1}}}^{l}|u|=F_{1}(m^{\prime})$. This completes the implementation of
the proposed IDBS-MR scheme.

###  5.3 Data Outsourcing with Integrity Auditing on Cloud

Here, we discuss the implementation of privacy-preserving with integrity
auditing on the cloud using the proposed IDBS-MR scheme.

Since the user (data owner) has the limited-resources in terms of computation
power and storage space, the signature generation is delegated to TPA in order
to reduce the computation cost on the user side. The user blinds the data
blocks and requests TPA to sign on his blinded data. TPA generates a blind
signature on the blinded data blocks without knowing the original content and
responds to it to the user. The correctness of the signature determines the
user’s judgment of data integrity in the cloud, which is essential for CSP and
the user. Hence, the user receives the corresponding blind signature and
verifies its correctness and outsources it to the cloud. Since CSP may respond
to an incomplete or invalid output against the user query in order to save its
computation overhead, the user needs to check the integrity of the returned
output. Therefore, the user requests TPA for integrity auditing of given
blocks stored in the cloud. TPA generates an auditing challenge for given
blocks and sends it to the cloud for auditing proof generation. Then, the
cloud computes the auditing proof and sends it to TPA for integrity auditing.
Figure (5.2). shows the complete process of the proposed scheme.

The detail of the proposed scheme is given below.

  1. 1.

Systems Setup

Given a security parameter $k$, the PKG assumes an additive group
$\mathbb{G}_{1}$ of order $q$, where $q$ is a large prime number of $k$-bit
and $P$ be its generator. Suppose three hash functions
$H_{1}:\\{0,1\\}^{*}\times\mathbb{G}_{1}\rightarrow\mathbb{Z}_{q}$,
$H_{2}:\mathbb{G}_{1}\rightarrow\mathbb{Z}_{q}$,
$H_{3}:\mathbb{G}_{1}\rightarrow\\{0,1\\}^{|q|}$ and
$H_{4}:\\{0,1\\}^{*}\rightarrow\mathbb{G}_{1}$ and two functions
$F_{1}:\\{0,1\\}^{l_{2}}\rightarrow\\{0,1\\}^{l_{1}}$ and
$F_{2}:\\{0,1\\}^{l_{1}}\rightarrow\\{0,1\\}^{l_{2}}$, where $l_{1}$ and
$l_{2}$ are two positive integers such that $l_{1}+l_{2}=|q|$. Suppose
$absc(P)$ gives the $x$-coordinate of point $P$. The PKG chooses a random
element $s_{0}\in\mathbb{Z}_{q}$ (its master key) and computes the public key
$P_{0}=s_{0}P$. The PKG publishes the public parameter
$pp=<\mathbb{G}_{1},q,P,P_{0},H_{1},H_{2},F_{1},F_{2},l_{1},l_{2},k>$, and
keeps $s_{0}$ secret. Suppose the data file of user is denoted as
$DF={d_{i}}$, where $1\leq i\leq n$ with corresponding data index are denoted
as $I=\\{I_{1},I_{2},..,I_{n}\\}$.

  2. 2.

Key Generation Given $ID_{T}$ (TPA’s identity), $PP$ and master secret key
$s_{0}$, PKG generates private key $d_{T}=a_{T}+s_{0}Q_{T}$, where
$Q_{T}=H_{1}(A_{T},ID_{T})$ and $A_{T}=a_{T}P$ on random chosen integer
$a_{T}\in\mathbb{Z}_{q}$, and passes $<A_{T},d_{T}>$ to the TPA. Similarly,
PKG computes private key $<A_{U},d_{U}>$ and gives it to the user with
identity $ID_{U}$, where, $d_{U}=a_{U}+s_{0}Q_{U}$,
$Q_{U}=H_{1}(A_{U},ID_{U})$ and $A_{U}=a_{U}P$ on random chosen integer
$a_{U}\in\mathbb{Z}_{q}$.

  3. 3.

Blinded signature delegation The following phases executed between TPA and
user produce a blind signature on data block $d_{i}\in\\{0,1\\}^{l2}$, shown
in Figure (5.2). The TPA chooses elements $n_{1},n_{2}\in\mathbb{Z}_{q}$,
computes $Q_{1}=n_{1}P$ and $Q_{2}=n_{2}P$, and sends $<Q_{1},Q_{2},A>$ to the
user. The user receives the parameters $<Q_{1},Q_{2},A>$ and picks integers
$g,h,i,j,k,l\in\mathbb{Z}_{q}$, such that $gcd(i,j)=1$ and $ki+lj=gcd(i,j)$.
Given data block $d_{i}$ and file identity $F_{ID}$, the user first hides it
and generates the parameters $b_{1i}$ and $b_{2i}$ given in Eq. (5.11)-(5.17)
and requests TPA to sign on it.

$R_{1}=gQ_{1}+iP\hskip 14.22636ptand\hskip 14.22636ptr_{1}=absc(R_{1})$ (5.10)

$R_{2}=hQ_{2}+jP\hskip 14.22636ptand\hskip 14.22636ptr_{2}=absc(R_{2})$ (5.11)

$r=r_{1}r_{2}$ (5.12)

$u_{i}=F_{1}(d_{i})||F_{2}(F_{1}(d_{i}))\oplus d_{i}$ (5.13)
$R_{i}=R_{1}+R_{2}+ru_{i}(A+Q_{ID}P_{0})$ (5.14)

$b_{1i}=kg^{-1}i(H_{2}(R_{i}||F_{ID}||I_{i})-ru_{i})$ (5.15)

$b_{2i}=lh^{-1}j(H_{2}(R_{i}||F_{ID}||I_{i})-ru_{i})$ (5.16)

On received parameters $<b_{1i},b_{2i}>$ and its private key $d_{T}$, signer
computes the blind signature
$\sigma^{\prime}_{i}=<s^{\prime}_{1i},s^{\prime}_{2i}>$, where
$s^{\prime}_{1i}=(d_{T}b_{1i}-n_{1})$, $s^{\prime}_{2i}=(d_{T}b_{2i}-n_{2})$
and sends $\sigma^{\prime}_{i}$ to the user.

  4. 4.

Original signature extraction and verification

On given blinded signature $\sigma^{\prime}_{i}$ from the TPA, user extracts
the original signature $\sigma_{i}=<R_{i},u_{i},s_{i}>$ using his secret
values, i.e., $<g,h,i,j>$ (given in Equations (5.17)-(5.19)).

$s_{1i}=(s^{\prime}_{1i}g-i)$ (5.17)

$s_{2i}=(s^{\prime}_{2i}h-j)$ (5.18) $s_{i}=(s_{1i}+s_{2i})$ (5.19)

The user verifies the correctness of the signature using Equation (5.20).

$s_{i}P+R_{i}=H_{2}(R_{i}||F_{ID}||I_{i})(A+H_{1}(A,ID_{T})P_{0})$ (5.20)

If (5.20) holds, the user outsourced the signature $<\sigma_{i},tag>$ on the
cloud over a secure channel.

  5. 5.

Stored data integrity auditing

The user delegates the TPA and requests him to audit the stored data integrity
in the cloud. The user generates the tag for data file $F$ with its identity
be $F_{ID}$ as $tag=F_{ID}||Sig(F_{ID})||A_{U}$, where
$Sig(F_{ID})=d_{U}H_{4}(F_{ID})$, and it to the TPA. TPA receives the data
file tag and checks its correctness using
$e(Sig(F_{ID}),P)=e(H_{4}(F_{ID}),A_{U}+H_{1}(A_{U},ID_{U})P_{0})$. The
correctness of the equation is verified as follows.

$\displaystyle e(Sig(F_{ID}),P)$ $\displaystyle=e(d_{U}H_{4}(F_{ID}),P)$
$\displaystyle=e(H_{4}(F_{ID}),(a_{U}+s_{0}Q_{U})P)$
$\displaystyle=e(H_{4}(F_{ID}),A_{U}+H_{1}(A_{U},ID_{U})P_{0})$

If the tag is correct, TPA extracts the data file identifier name $F_{ID}$
from the tag. On given auditing request from the user, TPA picks a random
subset $S={s_{j}}\subset I$ with integer $x_{j}$ associated with corresponding
$s_{j}$, where $1\leq j\leq m$, such that $m<n$. TPA generates a challenge
$Chall={j,x_{j}}$ and sends it to the cloud for auditing proof. The challenge
$Chall$ determines the location of the blocks needed to be verified. On
receiving $Chall$ from TPA, the cloud computes the auditing proof using
Equation (5.21).

$v_{j}=u_{j}\oplus x_{j}H_{3}(s_{j}P+R_{j})$ (5.21)

Then, the cloud gives the proof $<v_{j},R_{j}>$ to the TPA for integrity
auditing of stored data block $d_{j}$. In order to check the correctness of
stored data block $d_{j}$, TPA checks whether Equations (5.22)-(5.23) hold.

$u^{\prime}_{j}=v_{j}\oplus
x_{j}H_{3}(H_{2}(R_{j}|(|F_{ID}|)|I_{j})(A+H_{1}(A,ID_{S})P_{0}))$ (5.22)

$d^{\prime}_{j}=F_{2}(({{}_{l_{1}}^{l}}|u^{\prime}_{j}|)\oplus|u^{\prime}_{j}|_{l_{2}}^{R}$
(5.23)

The TPA accepts the challenge associated with the data block
${d^{\prime}_{j}}$ if and only if
${{}_{l_{1}}^{l}}|u^{\prime}_{j}|=F_{1}(d^{\prime}_{j})$.

  6. 6.

Batch signature verification

Let the user request the TPA to sign p data blocks, where $1\leq p\leq n$.
Users can verify the correctness of p data blocks in a single equation, given
in Equation (5.24).

$\sum_{i=1}^{p}(s_{i})P+\sum_{i=1}^{p}R_{i}=\sum_{i=1}^{p}(H_{2}(R_{i}))(A+H_{1}(A,ID_{S})P_{0})$
(5.24)

###  5.4 Security Analysis

Here, we provide the security proof of the proposed IDBS-MR scheme secured
against the EF-ID-CMA and blindness.

######  Theorem 5.1.

(Consistency). The proposed IDBS-MR scheme is consistent.

###### Proof.

The consistency of the proposed IDBS-MR scheme is verified as follows.

we have $s=(s_{1}+s_{2})$ then,

$\displaystyle sP+R$ $\displaystyle=(s_{1}+s_{2})P+R$
$\displaystyle=(s^{\prime}_{1}g-i+s^{\prime}_{2}h-j)P+R$
$\displaystyle=((d_{IDS}b_{M1}-n_{1})g-i+(d_{IDS}b_{M2}-n_{2})h-j)P+R$
$\displaystyle=((d_{IDS}kg^{-1}i(H_{2}(R)-ru)-n_{1})g-i+(d_{IDS}lh^{-1}j(H_{2}(R)-ru)-n_{2})h-j)P+R$
$\displaystyle=(d_{IDS}ki(H_{2}(R)-ru)-n_{1}g-i+d_{IDS}lj(H_{2}(R)-ru)-n_{2}h-j)P+R$
$\displaystyle=d_{IDS}H_{2}(R)(ki+lj)P-(ki+lj)rud_{IDS}P-n_{1}gP-n_{2}hP-iP-
jP+R$ $\displaystyle=d_{IDS}H_{2}(R)P-(rud_{IDS}P+n_{1}gP+n_{2}hP+iP+jP)+R$
$\displaystyle=(a+s_{0}Q_{ID})H_{2}(R)P-(ru(a+s_{0}Q_{ID})P+gQ_{1}+hQ_{2}+iP+jP)+R$
$\displaystyle=(a+s_{0}Q_{ID})uH_{2}(R)P-(ru(A+Q_{ID}P_{0})+R_{1}+R_{2})+R$
$\displaystyle=(A+Q_{ID}P_{0})H_{2}(R)-R+R$
$\displaystyle=(A+Q_{ID}P_{0})H_{2}(R)$

This proves the consistency of the IDBS-MR scheme. Thus,
$sP+R=(A+Q_{ID}P_{0})H_{1}(R)$, and $u=v\oplus H_{3}(sP+R)$. Now,
$u=F_{1}(m)||F_{2}(F_{1}(m))\oplus m$ and hence
${{}_{l_{1}}^{l}}|u|=F_{1}(m)$, $|u|_{l_{2}}^{R}=m\oplus F_{2}(F_{1}(m))$ and
check if $(_{l}1^{l})|u|=F_{1}(m_{0})$. If this equality holds, the verifier
accepts the parameter $<A,v,R>$ as a correct signature on message $m$. ∎

######  Theorem 5.2.

(Un-forgeability). Suppose $H_{1}$ and $H_{2}$ are two random oracles models
and a forger $F$ wants to forge a signature on message $M$. Suppose forger $F$
executes at most $q_{E}$ extract oracles, $q_{B}$ blind signature oracles,
$q_{1}$ $H_{1}$ hash oracles, $q_{2}$ $H_{2}$ hash oracles, $q_{3}$ $H_{3}$
hash oracles runs at most $t$ times with advantage at most $k^{-n}$. Under the
assumption of ROM and intractable to solve the ECDLP, our proposed IDBS-MR
Scheme is existentially unforgeable under adaptive chosen message and identity
attacks. Forger $F(t,q_{1},q_{2}q_{E},q_{B},k^{-n})$ have the following
advantage to break the proposed IDBS-MR scheme.

$|Pr[F(t,q_{1},q_{2},q_{E},q_{B},k^{-n})]|\geq(1-q_{1}/k)^{q_{2}+q_{E}}$
(5.25)

###### Proof.

Consider a forger $F$ wants to forge any signature in our proposed IDBS-MR
scheme and let there exist an algorithm B which helps $F$. We design an
algorithm B that helps $F$ to solve the ECDLP.

Setup: B supposes two hash function
$H_{1}:\\{0,1\\}^{*}\times\mathbb{G}_{1}\rightarrow\mathbb{Z}_{q}$ and
$H_{2}:\mathbb{G}_{1}\rightarrow\\{0,1\\}^{|q|}$. Let two function are
$F_{1}:\\{0,1\\}^{l_{1}}\rightarrow\\{0,1\\}^{l_{2}}$ and
$F_{2}:\\{0,1\\}^{l_{2}}\rightarrow\\{0,1\\}^{l_{1}}$, where $l_{1}$ and
$l_{2}$ are two positive integers such that $l_{1}+l_{2}=|q|$. $B$ is
accountable for simulating these oracles. $B$ picks $a\in\mathbb{Z}_{q}$ and
set $P_{0}=aP$ and gives public parameter
$pp=<\mathbb{G}_{1},q,P,P_{0},H_{1},H_{2},F_{1},F_{2},l_{1},l_{2},k>$ to $F$.

Oracles: Forger $F$ can perform the following oracles.

  * •

$H_{1}$ oracle: $B$ prepares an empty list $H_{1}^{List}$ having tuple
$<A_{i},ID_{i},H_{1}(ID_{i},A_{i}),x_{i}>$. When $F$ queries to $H_{1}^{List}$
on Identity $ID_{i}$, $B$ responds $F$ in the following way.

    * –

$B$ gives $H_{1}(ID_{i},A_{i})$ to $F$, if $ID_{i}$ found in the
$H_{1}^{List}$ in the tuple of $<A_{i},ID_{i},H_{1}(ID_{i},A_{i}),x_{i}>$ or
$<A_{i},ID_{i},H_{1}(ID_{i},A_{i}),*>$.

    * –

$B$ sets $H_{1}(ID_{i},A_{i})=h$ and gives to $F$ and adds the tuple
$<A_{i},ID_{i},H_{1}(ID_{i}),*>$ to list $H_{1}^{List}$, if $ID_{i}=ID^{*}$.

    * –

Otherwise, $B$ chooses randomly $b_{i}\in\mathbb{Z}_{q}$ and gives
$H_{1}(ID_{i},A_{i})=-b_{i}$ to $F$ and adds tuple
$(ID_{i},H_{1}(ID_{i},A_{i}),x_{i})$ to list $H_{1}^{List}$.

Note, $H_{1}(ID,A)$ gives no information to $F$ until he queries the $H_{1}$
oracle on $ID$ because $H_{1}$ is the random oracle.

  * •

$H_{2}$ oracle: $B$ provides the $R_{i}\in\mathbb{G}_{1}$ on applying the
queries $M_{i}$ to $H_{2}(R_{i})$ and gives to $F$. $B$ maintains a list
$H_{2}^{List}$ for storing the responses to $F$. $B$ search an entry in the
list, and if found, gives it to the $F$; otherwise, select
$y_{i}\in\mathbb{Z}_{q}$ and sends $y_{i}=H_{2}(R_{i})$ to $F$ and adds an
entry in list $H_{2}^{List}$.

  * •

$H_{3}$ oracle: $B$ maintains a list $H_{3}^{List}$, initially empty for
storing responses to $F$. $B$ search an entry in list $H_{3}^{List}$, if found
response to the $F$. otherwise, picks $z_{i}\in\mathbb{Z}_{q}$ and sends
$z_{i}=H_{2}(s_{i}P+R_{i})$ to $F$ and adds an entry in list $H_{3}^{List}$.

  * •

$F_{1}$ and $F_{2}$ oracles: $B$ makes two lists $L_{F1}$ and $L_{F2}$ for
responding to $F$ against the requested message. $B$ check list $L_{F1}$, if
found then search in $L_{F2}$. Otherwise, $B$ picks
$e_{1i}\in\\{0,1\\}^{l_{1}}$ and $e_{2_{i}}\in\\{0,1\\}^{l_{2}}$ and set
$F_{1}(m_{i})=e_{1i}$, $F_{2}(e_{1i})=e_{2i}$. $B$ responds to $F$ and stores
them in $L_{F1}$ and $L_{F2}$.

  * •

Extract oracle: $B$ simulate the extract oracles on given identity $ID_{i}$ to
obtain a private key. $B$ maintains a list $L_{Ext}$, which is initially empty
and search an entry in $L_{Ext}$, If found, respond it to the $F$. otherwise
do the following:

    * –

For $ID_{i}=ID$, $B$ abort the process.

    * –

For $ID_{i}\neq ID$, $B$ abort the process. $B$ pick $c_{i}\in\mathbb{Z}_{q}$
and set $A_{i}=b_{i}P_{0}+c_{i}P$, such that $d_{IDi}=c_{i}$. We set these
parameters such that they satisfy Eq. (6.27). B responds the secret key as
$(d_{IDi},A_{i})$ and store the tuple
$<A_{i},ID_{i},H_{1}(ID_{i},A_{i}),d_{IDi})$ in list $L_{Ext}$.

$d_{IDi}P=A_{i}+H_{1}(ID_{i},A_{i})P_{0}$ (5.26)

  * •

Blind signature oracle: $F$ queries the Blind Signature algorithm to get a
signature on message $M_{i}$ with identity $ID_{i}$. Let $F$ gives the blinded
message $<b^{\prime}_{M}1,b^{\prime}_{M}2>$ to $B$. Then, $B$ responds to the
following oracles.

    * –

For $ID_{i}=ID$, $B$ abort the process.

    * –

For $ID_{i}\neq ID$, $B$ runs the $F_{1}$, $F_{2}$, $H_{2}$ and $H_{3}$
oracles and respond to the $F$. $B$ makes a list $L_{BS}$ to store the
responses coming from blind signature and responds to the $F$. $B$ first check
in list $L_{BS}$ if found then reply to the $F$ otherwise, set $v_{i}=u\oplus
z_{i}$ and sends it to $F$ and make an entry in list $L_{BS}$.

Forgery: $F$ responses the signature
$\sigma_{i}^{*}=<v_{i}^{*},R_{i}^{*},A_{i}^{*}>$ against message $M^{*}$ and
$ID^{*}$. In order to forge a signature, suppose forger $F$ creates three
distinct signature $<\sigma_{A}^{*},\sigma_{B}^{*},\sigma_{C}^{*}>$ on same
message $M$, where $\sigma_{A}^{*}=<v_{A}^{*},R^{*},A^{*}>$,
$\sigma_{B}^{*}=<v_{B}^{*},R^{*},A^{*}>$ and
$\sigma_{C}^{*}=<v_{C}^{*},R^{*},A^{*}>$.

We consider parameter $s_{0}$,$a$ and $z$ are the discret logarithm of
parameter $P_{0}$, $A$ and $R$ respectively, i.e., $P_{0}=s_{0}P$, $A=aP$ and
$R=zP$. From $sP=H_{2}(M,R)(A+H_{1}(A,ID_{S})P_{0})-R$, we can get

$\displaystyle s_{A}^{*}$ $\displaystyle=d_{A}(a+s_{0}H_{1}(ID,A))-z$
$\displaystyle s_{B}^{*}$ $\displaystyle=d_{B}(a+s_{0}H_{1}(ID,A))-z$
$\displaystyle s_{C}^{*}$ $\displaystyle=d_{C}(a+s_{0}H_{1}(ID,A))-z$

The parameter $s_{0}$,$a$ and $z$ from the above equations are unknown to $F$.
Thus, $F$ solves these values from the linear equations which are equivalent
to solving the ECDL problem.

Analysis. The probability that B does not abort the game is defined by two
events. $Pr[\neg E_{1}\wedge\neg E_{2}]$

  * •

$E_{1}$: The extract oracle fails if $H_{1}$ oracle gives the inconsistent
outputs with probability at most $q_{1}/k$. The simulation is completed
$q_{E}$ times which happens with probability at least $(1-q_{1}/k)^{q_{E}}$.

  * •

$E_{2}$: The execution of $H_{2}$ oracle fails if $H_{2}$ oracle gives the
inconsistent outputs with probability at most $q_{1}/k$. The simulation is
completed $q_{2}$ times which happens with probability at least
$(1-q)_{1}/k)^{q_{2}}$.

From the above two events, we obtain the probability that $Adv$ can break the
scheme.

$Pr[\neg E_{1}\wedge\neg
E_{2}]\geq\epsilon\left(1-\frac{q_{1}}{k}\right)^{q_{2}}\left(1-\frac{q_{1}}{k}\right)^{q_{E}}$

∎

######  Theorem 5.3.

(Blindness). The proposed IDBSMR scheme achieves the blindness property.

###### Proof.

Suppose an adversary $Adv$ that plays the role of signer and challenger $Ch$
that play a role of an honest user runs the blind signature algorithm. Suppose
$Adv$ obtains the parameters $<b_{M1},b_{M2},s^{\prime}_{1},s^{\prime}_{2}>$
by executing the blind signature oracles, identical to Theorem 5.2. Let the
corresponding signature be $<R,v,A>$. There exists a tuple of random values
$<g,h,i,j,k,l>$ that links the $<b_{M1},b_{M2},s^{\prime}_{1},s^{\prime}_{2}>$
to $<R,v,A>$. From the proposed IDBS-MR scheme, we have the following
(5.26)-(5.33).

$b_{M1}=kg^{-1}i(H_{2}(R)-ur)$ (5.27)

$b_{M2}=lh^{-1}j(H_{2}(R)-ur)modq$ (5.28)

$s^{\prime}_{1}=(d_{IDS}b_{M1}-n_{1})modq$ (5.29)

$s^{\prime}_{2}=(d_{IDS}b_{M2}-n_{2})modq$ (5.30)

$s_{1}=(s^{\prime}_{1}g-i)modq$ (5.31) $s_{2}=(s^{\prime}_{2}h-j)modq$ (5.32)

$R=(g+h)Q_{1}+(i+j)P+ru(A+Q_{ID}P_{0})$ (5.33)

From (5.28)-(5.33), we can get $g=kb_{M1}^{-1}i(H_{2}(R)-ur)$ and
$h=lb_{M2}^{-1}j(H_{2}(R)-ur)$ individually. Similarly, from Equations (5.32)
and (5.33), we can get $i=(s^{\prime}_{1}g-s_{1})$ and
$j=(s^{\prime}_{2}h-s_{2})$ individually. If we substitute these values in
(5.33), it seems that we must know the value of r to satisfy the (5.33).
However, the value of r depends on the elements $<g,h,i,j>$ whose estimation
is equivalent to solving the ECDLP problem. Thus, it is very difficult for any
adversary $Adv$ to compute the values $<g,h,i,j,k,l>$ from the (5.28)-(5.33).
∎

###  5.5 Performance Analysis

Here, we evaluate the performance of the proposed scheme in terms of
computation and communication overheads.

####  5.5.1 Implementation and Experiment Simulation

The implementation of all algorithms is run on Intel(R) Core(TM) i7-2600K CPU
@ 3.4 GHz, and 8 GB of RAM, under gcc 4.6 compiler and we call PBC library
[122] API in order to construct the elliptic curves. We utilize the Type-A
super-singular elliptic curve $E/\mathbb{F}_{p}:y^{2}=x^{2}+x$ built on two
prime $p$ and $q$, such that $|p|$ = 512 bit, $q=2^{159}+2^{17}+1$ is Solaris
prime ($|q|$ = 160 bit) satisfying $p+1=12pq$, and embedding degree is $2$,
which is identical to the 1024-bit RSA security level. We consider super-
singular curve over the binary field $\mathbb{F}_{2^{271}}$ with the order of
$\mathbb{G}_{1}$ is 252 bit prime and $\mathbb{G}_{2}$ is 1024 bit. Using
compression technique [152], we consider $|\mathbb{G}_{1}|$ = 34 bytes,
$|\mathbb{G}_{2}|$ = 128 bytes and $|\mathbb{Z}_{q}|$ = 32 bytes. Besides, we
suppose the block size $|d|$ = 20 bytes. We neglect the XOR operation and find
the left $l$-bit and right $l$-bit of a string since they have negligible
computation costs. Table 3.1 of chapter 3.6 illustrates the notations and
computation cost (in ms) of different cryptographic operations.

####  5.5.2 Computation Cost

Now, we will provide the implementation results by considering the following
aspect. We consider the block size 10 KB and the file consist of 10,000 blocks
to test the performance on cloud and TSP by taking the challenged blocks from
100 to 1000 with an increment of 100 for each step. We evaluate the
computation cost of the signature delegation algorithm, signature recovery and
verification algorithm, integrity auditing algorithm and batch signature
verification algorithm. We observe in Figure (5.3) that the computation cost
of signature delegation and signature verification depends on the side of data
blocks. It grows linearly with respect to the data blocks d. Figure (5.4)
illustrates the batch signature verification cost in which the cost grows very
slowly with the increment of data blocks. Figure (5.5) shows the cost of
integrity auditing on the cloud and TPA side that grows linearly with the size
of data blocks.

Figure 5.3: Computation consumption in signature delegation, and recovery and verification Figure 5.4: Computation consumption in batch signature recovery and verification Table 5.1: Computational cost comparison of proposed IDBS-MR scheme with existing schemes Schemes | Computation cost (in ms) | Signature Size
---|---|---
| BlindSig | Verify | Total | (in Bytes)
[58] | 126.73 | 80.04 | 206.77 | 122
[100] | 80.5 | 46.77 | 147.2 | 88
[41] | 40.02 | 26.68 | 66.70 | 154
[65] | 82.77 | 64.86 | 147.63 | 256
[70] | 53.6 | 46.7 | 100.3 | 156
[45] | 62.76 | 44.85 | 107.61 | 148
[72] | 62.7 | 46.7 | 109.4 | 168
[163] | 40.08 | 51.5 | 91.58 | 66
Our | 27.35 | 6.9 | 34.25 | 98

####  5.5.3 Comparative Performance

Here, we compare our proposed IDBS-MR scheme with the existing schemes [58],
[100], [41], [65], [70], [45], [72] and [163] in terms of the computation,
bandwidth cost and security.

Figure 5.5: Computation consumption in integrity auditing on Cloud and TPA

  * •

Computation cost. Here, we evaluate the computation of our proposed scheme
with related schemes [58], [100], [41], [65], [70], [45], [72] and [163], as
summarized in Table 5.1. In the blind signature algorithm, our proposed scheme
consumes $4T_{SM}+2T_{A}+7T_{M}$ = 4*6.67+2*0.23+7*0.03=27.35 ms, while the
schemes [58], [100], [41], [65], [70], [45], [72] and [163] consume 126.73 ms,
80.5 ms, 42 ms, 82.77 ms, 53.6 ms, 62.7 ms, 62.7 ms, and 40 ms, respectively,
of computation time. It is also shown graphically in Figure ((5.5)). In the
verification algorithm, our proposed IDBS-MR scheme needs $1T_{SM}+1T_{A}$ =
1*6.67+1*0.23 = 6.9 ms, while the schemes [58], [100], [41], [65], [70], [45],
[72] and [163] take 80 ms, 46.77 ms, 26.68 ms, 64.86 ms, 46.7 ms, 44.85 ms,
46.7 ms, and 51.5 ms respectively, of computation time. Thus, the total
computation cost for our proposed scheme is 34.25 ms while the schemes [58],
[100], [41], [65], [70], [45], [72] and [163] need 206.77 ms, 147.2 ms, 66.7
ms, 147.2 ms, 100.3 ms, 107.6 ms, 106.4 ms, and 91.58 ms, respectively, for
blind signature and verification algorithms, as shown in Figure (5.6). Thus,
our scheme needs 83%, 76%, 48%, 77%, 65%, 68%, 68% and 62% of computation cost
of the schemes [58], [100], [41], [65], [70], [45], [72] and [163],
respectively.

Table 5.2: Security comparison of proposed IDBS-MR scheme with existing
schemes

Schemes | Cryptographic | Security | Security | Data
---|---|---|---|---
Schemes | primitives | Problem | Model | Recovery
[58] | IBS & BS | 1-mBDHIP@ | ROM | No
[100] | Choon Cheon’s IBS & | GDHP## | ROM | No
| Boldyreva’s BS |  |  |
[41] | CLS & BS | ECDLP∗ | ROM | No
[65] | IBS & BS | IMWPP@@ | ROM | Yes
[70] | CLS & BS | k-CAA3# | ROM | No
[45] | IBS & BS | BDHP& | ROM | Yes
[72] | IBS & BS | ECDLP | ROM | Yes
[163] | IBS & BS | k-CAA | ROM | Yes
Our | IBS & BS | ECDLP | ROM | Yes

@One more bilinear Diffie-Hellman inversion problem, #3 Traitors collision
attacks assumption, ## Gap Diffie-Hellman Problem, @@ Inversion of Modified
Weil Pairings Problem, &Bilinear Diffie-Hellman Problem, ∗Discrete logarithm
problem on elliptic curve

  * •

Bandwidth cost. Here, we compare the signature size of our proposed scheme
with related schemes [58], [100], [41], [65], [70], [45], [72] and [163] to
evaluate the bandwidth consumption. Our proposed IDBS-MR scheme gives
$|\mathbb{G}_{1}|+2|\mathbb{Z}_{q}|\approx 98$ bytes of signature, whereas the
schemes [58], [100], [41], [65], [70], [45], [72] and [163] output 122 bytes,
88 bytes, 154 bytes, 256 bytes, 156 bytes, 148 bytes, 168 bytes and 66 bytes,
respectively, of signature, as shown in Table 5.1 and Figure (5.7). It can be
observed from Table 5.1 that our scheme saves around 20%, 36%, 62%, 37%, 34%
and 42% of bandwidth of the schemes [58], [100], [41], [65], [70], [45], [72]
and [163], respectively.

Figure 5.6: Computation cost of the proposed scheme with other related schemes
Figure 5.7: Signature size of the proposed scheme with related schemes

  * •

Security features. The proposed scheme is constructed on the Random Oracle
Model (ROM), and its security is equivalent to solving the elliptic curve
discrete logarithm problem (ECDLP). Table 5.2 summarizes the security features
of our scheme along with the schemes [58], [100], [41], [65], [70], [45], [72]
and [163], in which we found that our scheme achieved all security features.

###  5.6 Summary

This chapter proposes a privacy-preserving data integrity auditing protocol
for resource-limited devices. The protocol aims to delegate the signing and
auditing process of data owners to a third-party auditor (TPA), thereby
reducing the computational burden on resource-constrained devices. To achieve
this goal, we introduce the IDBS-MR scheme, which eliminates costly
operations, such as the map-to-hash function, modular exponentiation, and
pairing during integrity checking. We prove that the proposed scheme is EUF-
ID-CMA secured under ECDLP in ROM. Moreover, we demonstrate that the TPA can
verify more data blocks in the least amount of time, and the user can verify
multiple signatures simultaneously. Our evaluation of the proposed scheme
shows that it exhibits high efficiency and adaptability, making it suitable
for users with limited computational resources. Furthermore, we compare our
scheme with other related schemes and demonstrate its superiority in terms of
efficiency and adaptability.

[75mm] However difficult life may seem, there is always something you can do
and succeed at. Stephen Hawking - British Theoretical Physicist

##  Chapter 6 ID-Based (Aggregated) Signcryption for Secure Video Streaming
and Healthcare System

Signcryption is a cryptographic primitive that performs encryption and
signature simultaneously with the least computational overhead. The
traditional RSA-based signcryption schemes are inefficient due to the problems
of public key and certificate management which will later be overcome by
introducing an ID-Based Signcryption (IDSC) scheme. Since IDSC is based on an
ID-based setting, it suffers from an inherent issue, known as the key escrow
problem. Certificate-less based signcryption scheme addresses the key escrow
problem, but it loses the ID-based property. In this chapter, we present two
variations of IDSC schemes: Escrow-Free Identity-Based Signcryption (EF-IDSC)
and Escrow-Free Identity-Based Aggregated Signcryption (EF-IDASC) schemes.
Both schemes are secured against confidentiality and enforceability attacks.
Based on the proposed two schemes, we implement two secure emerging network
systems. First, we implement a Secure Peer-to-Peer Video-on-Demand Streaming
System, whose security is based on the proposed EF-IDSC scheme. Second, we
implement Secure Cloud-Assisted Health Care System that achieves public
verifiability based on IDASC scheme. Now, we discuss the related work.

Zheng et al. [187] were the first to propose the signcryption scheme, which
achieves confidentiality, integrity, and authenticity of the data in a single
step. Malone-Lee [123] proposed signcryption in an identity-based environment
that addresses the certificate maintenance problem associated with scheme
[187]. In order to further optimize the computation cost, Sun et al. [155,
154] proposed an Online/Offline Identity-Based Signcryption (OOIDSC) scheme
for resource constraints environment by aiding the online/offline feature, in
which the offline step executes the costly operations while online step
includes the lightweight operations.

Selvi et al. [148] pointed out that the scheme [155] has some security
weaknesses, and the scheme [154] is easily forgeable, and proposed a new
OOIDSC scheme. Lai et al. [106] presented an OOIDSC scheme with the short
ciphertext. For a low-power device, Li et al. [110] gave another OOIDSC scheme
whose offline phase is independent of message and recipient identity. Liu et
al. [118] proposed an OOIDSC scheme that needs only the message and
recipient’s identity during online signcryption. However, the scheme [118] is
not secure against the sender’s anonymity. Barbosa et al. [5] addressed the
key escrow problem and discussed the certificate-less signcryption scheme,
which is secure against insider attacks. Li et al. [112] presented an
Online/Offline Certificateless Signcryption (OOCLSC) scheme and prove its
security under the well-known assumption of Computational Diffie-Hellman
(CDH), q-Modified Bilinear Diffie-Hellman Inversion (q-mBDHI) and q-traitors
collision attack algorithm (q-CAA) problem in the ROM. In [120], a new OOCLSC
is implemented, however, Shi et al. [150] prove that it is not secure as an
adversary can obtain the user’s private key. Li et al. [111] discuss an OOCLSC
scheme for resource-constrained devices. Recently, Saeed et al. [143] present
a heterogeneous online/offline signcryption for the Internet of things.

Omala et al. [134] presented a lightweight Certificateless Signcryption (CLSC)
scheme for secure data transmission in the WBAN system. Yin et al. [178] gave
an efficient hybrid signcryption scheme in a certificateless setting for
secure communication for WSNs. Unlike OOIDSC, schemes [134] and [178] are
resistant to key escrow attacks. Zhang et al. [182] discuss a data
communication scheme for e-health systems using Certificateless Generalized
Signcryption (CLGSC) scheme. Caixue Zhou [188] points out that Zhang et al.’s
scheme [182] is susceptible to an insider attack. Recently, Zhou [189] has
presented an improvised CLGSC scheme for the mobile healthcare system.

In order to reduce the transmission and verification overhead, Selvi et al.
[147] discuss three aggregated signcryption schemes in the identity-based
setting, which achieve public verifiability. Wang et al. [168] propose a first
identity-based aggregated signcryption scheme using multi-linear mapping in
the standard model. Kar [82] propose a new identity-based aggregated
signcryption scheme for low-processor devices. However, schemes [147, 168, 82]
are susceptible to the key escrow problem, which is addressed by Eslami et al.
[46], followed by presenting an aggregate-signcryption scheme in the
certificateless setting. Niu et al. [133] propose a secure transmission scheme
for heterogeneous devices, which transmits k messages from k senders in
certificateless settings to m recipient in the IBC sets. Ullah et al. [160]
give a secure multi-sender/multi-receiver data transfer scheme for a smart
camera using an identity-based aggregated signcryption scheme.

###  6.1 Systems Models

Here, we discuss the two architectures: Secure Peer-to-Peer Video-on-Demand
Streaming (P2P-VoD), and secure cloud-assisted IoMT-enabled healthcare system.
We also define the escrow-free identity-based signcryption scheme and escrow-
free identity-based aggregated signcryption scheme. Besides, we discuss
security threats.

Figure 6.1: A mechanism of joining a new peer to the proposed P2P-VoD scheme

####  6.1.1 System Architecture of Video Streaming

Here, we design a video-on-demand streaming architecture in the mesh-based P2P
environment (P2P-VoD), which consists of three entities: service provider
(SP), multiple KPSs, and peer (subscriber).

  * •

Service Provider: It is a semi-trusted authority that follows the correct way
to compute the private key share for a peer but is still curious to know the
original private key. It initializes the system with the help of multiple
KPSs. It authenticates each peer in the network and provides a partial private
key.

  * •

Key Privacy Servers: KPSs protect the peer’s private key and issue the
protected private key shares to a peer without knowing it. Besides, they
offload the expensive computational on the cloud server.

  * •

Peer (Subscriber): Peer acts as a server as well as a client that can upload
and download video content simultaneously. Each peer communicates with another
peer using the session key in the network.

The proposed P2P-VoD system involves three phases: system initialization,
connection establishment, and secure video streaming. The detail description
of the proposed P2P-VoD system is demonstrated in Figure 6.1

  * •

System Initialization: It involves two algorithms: system setup and peer
registration. In the system setup algorithm, SP and KPSs set up the system,
where they compute their secret keys and public parameters, given in step A
and step B of Figure 6.1. In the peer’s registration algorithm, a new peer
requests the service provider for the subscription, shown in step 1. The SP
authenticates the new peer and provides a partial private key (partial
credential) against his identity, shown in step 2 of Figure 6.1 Now, the peer
request to the multiple KPSs for key protection, given in step 3 followed by
multiple Key Protection Servers (KPSs) protect the partial private key
(partial credential) and issues him the protected private key (protected
credential) shares, given in step 4. The new peer integrates the protected
private key (protected credential) shares in order to extract his private key
(credential), shown in step 5. Therefore, unlike generic IBC, the service
provider, in our scheme does not have any information about the peer’s private
key.

  * •

Connection establishment: It allows two peers to establish a shared session
key between them using their private keys and IDs.

  * •

Secure video streaming: It involves two algorithms: signcryption and
unsigncryption. In the signcryption algorithm, a (receiver) peer requests
another (sender) peer in the network, as shown in step 6. The (sender) peer
divides the video content into chunks and signcrypts each chunk by its session
key and private key, shown in Step 7. The signcrypted chunk is then
transmitted to the (receiver) peer. Each peer has a buffer space which
includes the information of desirable and available chunks. In order to upload
and download video chunks, peers exchange the cache space of their choice. In
unsigncryption algorithm, the (receiver) peer unsigncrypts the video chunk and
can access the video content if it has a session key, as given in step 8.

Since the proposed P2P-VoD system is dynamic and distributed in nature, it is
susceptible to pollution attacks, wherein a polluter peer injects the polluted
chunks into the P2P network, and so degrading the streaming quality at the
recipient side. Besides, the system is also vulnerable to the untrusted
service provider (SP), where SP can intentionally forge or alter the peer’s
data chunks or allows any malicious peer in the network to access the data
chunks. In order to overcome the pollution attack with the untrusted service
provider in the P2P-VoD system, we discuss the Escrow-Free Identity-based
Signcyrption (EF-IDSC) scheme.

####  6.1.2 Definition of Proposed EF-IDSC Scheme

The proposed EF-IDSC scheme includes four algorithms: Setup, Keygen, Signcrypt
and unsigncrypt, defined as follows.

  * •

Setup: NM and KPSs compute the system parameter pp and secret keys $\langle
s_{0},s_{1},s_{2},\ldots,s_{n}\rangle$, where the master key $s_{0}$ and
$\langle s_{1},s_{2},\ldots,s_{n}\rangle$ are kept secret, and $pp$ is
published.

  * •

KeyGen: On given entity’s identity $ID_{E}$, NM and KPSs compute the private
key using their master key $s_{0}$ and secret keys $\langle
s_{1},s_{2},\ldots,s_{n}\rangle$.

    * –

ParPriKey: Entity obtains a partial private key $D_{0}$ from NM.

    * –

SecPriKey: Entity obtains a protected private key shares $D_{i}$ from KPSs.

    * –

KeyExt: Entity computes its private key $d_{E}$.

  * •

Signcrypt: On a given pp and message $M$, signer signcrypts $M$ using his
private key $d_{S}$ and recipient $ID_{R}$ and outputs the signcryptext $CT$.

  * •

Unsigncrypt: On given $pp$, and aggregated signcryptext $CT$, recipient
decrypts it using his private key $d_{R}$ to obtain the messages and sender’s
$ID_{S}$, and validates the messages $M$.

The ID-based signcryption scheme is secure if it is indistinguishably secured
under chosen ciphertext and ID attack (IND-ID-CCA) and is existentially
unforgeable under chosen message attack (EUF-CMA).

######  Definition 6.1.

Definition 6.1 (IND-CCA). The proposed EF-IDSC scheme is secured against IND-
CCA, if no polynomially bounded adversaries $Adv$ has non-negligible advantage
$\epsilon$ in-game, defined as:

Setup. On given security parameter $k$, challenger$Ch$ outputs public
parameters $pp$, master key and sends $pp$ to $Adv$.

Phase1: $Adv$ runs the following queries.

  * •

ParKeyIss query. Given $ID$,$Ch$ responds the partial private key to $Adv$.

  * •

PriKeySec query. Given a partial private key,$Ch$ responds to private key
share to $Adv$.

  * •

KeyExt query. Given a private key share,$Ch$ responds to the full private key
to $Adv$.

  * •

Signcrypt query. Given the identities $ID_{S}$, $ID_{R}$, KeyExt’s output, and
a data content $chk$,$Ch$ returns the signcryption key and signcryptext $CT$
to $Adv$.

  * •

Unsigncrypt query. Given ciphertext $CT$, challenger$Ch$ extracts the full
private key $d_{R}$, outputs $chk$ to $Adv$.

Challenger phase. $Adv$ gives $<pkt_{0},pkt_{1},ID_{S}^{*},ID_{R}^{*}>$, where
$|chk_{0}|=|chk_{1}|$,$Ch$ picks a random $bitb\in\\{0,1\\}$ and computes
$p2p_{sk}^{*}$, $CT^{*}$ and returns $CT^{*}$ to $Adv$, where keyExt query
$ID_{R}$ has not been executed previously.

Phase 2. Similar to phase 1, $Adv$ adaptively runs more queries such that no
KeyExt query is allowed on $ID_{R}^{*}$ and unsigncrypt query on
$<CT^{*},ID_{S}^{*},ID_{R}^{*}>$ respectively.

Guess. At the end, $Adv$ guesses $b^{\prime}\in{0,1}$. If $b=b^{\prime}$,
adversary $Adv$ wins the game with advantage.

$A(Adv):=\lvert Pr[b=b^{\prime}]-\frac{1}{2}\rvert\geq\epsilon$ (6.1)

######  Definition 6.2.

(EUF-CMA). The proposed EF-IDSC scheme is secured against EUF-CMA, if no
polynomial bounded forger of $F$ has a non-negligible advantage $\epsilon$ in
the above game.

  * •

Setup. $F$ runs the query identical to the IND-CCA game.

  * •

Phase1. $F$ runs the query identical to the IND-CCA game. Forgery. $F$
responses the tuple $<chk^{ch},CT^{ch},ID_{S}^{ch},ID_{R}^{ch}>$, over which
$F$ is not allowed to extract the ParKeyIss query on $ID_{S}$ but extract the
KeyExt query on $ID_{R}$. $F$ wins the game if the output of unsigncrypt is
not $\perp$. Otherwise, $CT^{ch}$ is valid ciphertext under $ID_{S}^{ch}$ and
$ID_{R}^{ch}$ (challenged identities of peers A and B).

####  6.1.3 Security Requirements for Video-On-Demand

We adopt the security requirements, given in [167, 47]for the P2P-VoD system.

  * •

Peer’s authentication: It ensures that the claiming (receiver) peer is the
legitimate peer in the network for accessing the online requested services.

  * •

Access control: It ensures that only authorized peers can access the online
requested services.

  * •

Data integrity/privacy: The video data content should not be altered or
modified during transmission. That is, the content sent from the services
provider is the same as the content received from the peer.

  * •

Data confidentiality: The video data content remains confidential other than
the intended peer.

  * •

Replay attack: It is to ensure that the valid video content transmission is
not maliciously repeated or delayed.

  * •

Pollution attack: An attacker may intentionally modify the received video
chunks or forge video chunks and injects the polluted chunks into the video
content which degrades the quality of video content on the recipient side.

  * •

Flooding attack: It is a kind of denial of service attack. It occurs when the
burdens of the Service providers, KPSs, and peers are bottlenecked under the
condition that a flood of users may request key distribution and video
encryption at the same time.

####  6.1.4 System Architecture for Secure IoCAHC System

Here, we discuss the network architecture of the proposed IoMT-based cloud-
assisted healthcare (IoCAHC) system, illustrated in Figure (6.2).

######  Definition 6.3.

(IoMT-based healthcare system). The proposed cloud-assisted IoMT-based
healthcare system consists of six entities.

  * •

Network manager (NM). The NM is a semi-trusted authority that computes its
master and public key. It authenticates an entity and issues a partial private
key to it.

  * •

Key protection servers (KPSs). KPSs protect the private key of an entity using
their secret keys and issue a protected private key share to it. They perform
computations on the cloud to mitigate the computation overhead.

  * •

Bio-medical sensor (BMS). It is a tiny sensor that has limited storage space,
battery life, and computation power. It is installed either on/outside the
patient’s body (wearable sensors) or deployed in the patient’s tissues
(implanted sensors).

  * •

Personal assisted device (PAD). It is a data sink that has sufficient
computation and storage but is not trustworthy as it is effortless for an
attacker to retrieve the patient’s sensitive data by physically stealing the
phone or statistically attack on it.

  * •

Medical cloud server (MCS). It is a semi-trusted cloud server, which stores
the patient’s PHI. It also validates the PHI and provides the accessibility of
PHI to SD.

  * •

Server Device (SD). A device on the medical institution side, can access the
patient’s PHI on MCS and diagnoses the patient’s diseases based on their
resulting PHI.

The proposed system achieves secure communication in the following phases:
securing sensor devices within BAN, securing communication within BAN, and
outside the BAN, and using the EF-IDASC scheme for secure data transmission
between BMS and the server device.

Figure 6.2: Detailed architecture of proposed secure aggregated signcryption
system for cloud-centric IoMT-based healthcare system.

####  6.1.5 Definition of Proposed EF-IDASC Scheme

######  Definition 6.4.

(EF-IDASC). The proposed EF-IDASC scheme includes the following five
algorithms.

  * •

Setup: Identical to setup phase of P2P-VoD system.

  * •

KeyGen: Identical to the KeyGen phase of the P2P-VoD system, including three
sub-algorithms: ParPriKey, SecPriKey and KeyExt.

  * •

Signcrypt: Identical to signcrypt phase of P2P-VoD system and outputs the
signcryptext $CT$.

  * •

Aggregation: On given signcryptext $CT$ from different senders, it outputs the
aggregated signcryptext $CT_{agg}$.

  * •

Unsigncrypt: On given $pp$, and aggregated signcryptext $CT_{agg}$, recipient
decrypts it using his private key $d_{R}$ to obtain the messages and sender’s
$ID_{S}$, and validates the messages $M$.

The proposed IDASC is secure if it is IND-ID-CCA and EUF-CMA secure. The
definitions are identical to the definitions of IND-ID-CCA and EUF-CMA, given
in section 6.1.3.

####  6.1.6 Security Goals for IoCAHC System

According to security goals defined in [136], we consider the following
security attacks for the proposed systems.

  * •

Eavesdropping. An unauthorized party could not listen to sensitive data in the
WBAN communication.

  * •

Data modification. It ensures that data cannot be altered or modified by any
adversary.

  * •

Non-traceability: It ensures that an adversary cannot trace the patient’s
identity and any action on given encrypted data.

  * •

Mutual authentication. The BMS and SD are authenticated to each other, which
ensures that the PHI is coming from the intended BMS and arriving at the SD.

  * •

Contextual privacy. Any entity in the system cannot link the PHI’s source and
destination if they do not collude. Resilient to key escrow. The NM in the
system could not compute the BMS’s signcrypted key.

  * •

Public auditing. Anyone in the network can check the integrity of data stored
on the cloud without downloading and knowing the actual content of the data.

###  6.2 Peer-to-Peer Secure VoD Streaming System

Here, we discuss implementing a secure P2P-VoD system, which consists of the
following three phases: system initialization, connection establishment and
secure video streaming.

####  6.2.1 System Initialization

SP and KPSs are accountable for system initialization, which includes system
setup and peer registration.

  * •

System Setup: Given a security parameter $k$, let two group $\mathbb{G}_{1}$,
and $\mathbb{G}_{2}$ of same order $q$, where $q$ is large prime of $k$-bit,
and $P$ be the generator of $\mathbb{G}_{1}$. Suppose $e$ be a pairing
functions $e:\mathbb{G}_{1}\times\mathbb{G}_{1}\rightarrow\mathbb{G}_{2}$ and
three one-way cryptographic hash functions are,
$H_{1}:\\{0,1\\}^{*}\rightarrow\mathbb{G}_{1}$,
$H_{2}:\mathbb{G}_{2}\rightarrow\\{0,1\\}^{m}\times\mathbb{G}_{1}\times\\{0,1\\}^{t}$,
and
$H_{3}:\mathbb{G}_{1}\times\\{0,1\\}^{m}\times\\{0,1\\}^{t}\rightarrow\mathbb{Z}_{q}^{*}$.
SP picks a random number $s_{0}\in\mathbb{Z}_{q}^{*}$ known as a master secret
key, sets the public key as $P_{0}=s_{0}P$, and sends $P_{0}$ to all KPSs. On
a given $P_{0}$, each $KPS^{i}$ chooses an integer
$s_{i}\in\mathbb{Z}_{q}^{*}$, known as its secret key, sets public key
$P_{i}=s_{i}P_{0}$ and sends $P_{i}$ to the SP and keep safe $s_{i}$. The SP
combines to form the global public key $Y$,
$Y=\sum_{i=1}^{n}P_{i}=\sum_{i=1}^{n}s_{i}P_{0}=s_{0}(s_{1}+s_{2}+\dots+s_{n})P$.
The SP published the public parameter,
$pp=<q,e,P,P_{0},\mathbb{G}_{1},\mathbb{G}_{2},H_{1},H_{2},H_{3},Y,P_{0},..,P_{n}>$,
and keeps $s_{0}$ secret.

  * •

New Peer’s Registration: When a new peer wants to join the network, it
requests the SP and KPSs for its private key (credential), defined by the
following steps:

    * –

ParKeyIss: The peer (sender) chooses an element $x_{S}\in\mathbb{Z}_{q}^{*}$,
sets $X_{S}=x_{S}P$, and $D_{S}=x_{S}Q_{S}$, where $Q_{S}=H_{1}(ID_{S})$. The
peer sends parameters $<X_{S},ID_{S},D_{S}>$ and asks to the SP for its
partial private key. The SP validates the peer identification $ID_{S}$ and
received parameters using $e(Q_{S},X_{S})\overset{?}{=}e(D_{S},P)$. If the
above equation satisfied, SP sets $D_{S0}=s_{0}D_{S}$, $X_{S0}=s_{0}X_{S}$ and
responds to the peer with $<D_{S0},X_{S0}>$. The peer accepts the given
parameter $<D_{S0},X_{S0}>$, if the equation
$e(D_{S},P_{0})\overset{?}{=}e(D_{S}0,P)$ holds.

    * –

ParKeySec: The peer requests to $KPS^{i}$ for protection by sending the
parameters $<D_{S0},X_{S0}>$. $KPS^{i}$ accepts $<D_{S0},X_{S0}>$ if
$e(Q_{S},X_{S0})\overset{?}{=}e(D_{S0},P)$ holds. Computes the protected
private key share $D_{Si}=s_{i}D_{S0}$, and responses $D_{Si}$ to the peer.

    * –

KeyExt: The peer accepts private key share $D_{Si}$, if
$e(D_{S},P_{i})\overset{?}{=}e(D_{Si},P)$ holds. Peer then extracts its
private key $d_{S}$,
$d_{S}=x_{S}^{-1}\sum_{i=1}^{n}D_{Si}=s_{0}(s_{1}+s_{1}+\dots+s_{n})Q_{S}$.
Similarly (receiver) peer computes its private key $d_{R}$.

####  6.2.2 Connection Establishment

This phase establishes a shared secret key between two peers in the network.
This algorithm makes a connection between a (sender) peer and (receiver) peer
and establishes a shared session key $p2p_{sk}$ between them as follows:

  * •

From his private key $d_{S}$, identity $ID_{S}$, receiver’s identity $ID_{R}$
and pp, the (sender) peer chooses a random element as
$a\in\mathbb{Z}_{q}^{*}$, and computes $A=aQ_{S}$, where
$Q_{S}=H_{1}(ID_{S})$.

  * •

Compute session key as $p2p_{sk}=e(d_{S},Q_{R})^{a}$, where
$Q_{R}=H_{1}(ID_{R})$.

  * •

Send parameter $A$ to (receiver) peer.

  * •

On given parameter $A$, and its private key $d_{R}$, (receiver) peer computes
a shared session key as $p2p_{sk}=e(d_{R},A)$.

It is noted that the P2PKeyExt algorithm is similar to the offline
signcryption of a generic offline/online identity-based signcryption scheme
with some additional properties. In related existing schemes, the offline
signcryption algorithm computes expensive operations independent of the video
chunks. It stores the pre-computed parameters for online signcryption whenever
any peer requests the video chunk in the network. On the other hand, the
P2PKeyExt algorithm in our proposed scheme also computes the expensive
operations and stores the computed parameters for signcrypting the chunks.
Besides, it establishes a shared session key between the network’s two peers
that will help signcrypting video chunks during signcrption algorithm. Thus,
the P2PKeyExt algorithm performs the offline signcryption and establishes a
shared secret key between two peers. Because of this reason, the offline
computation cost is high.

####  6.2.3 Secure Video-On Demanding Streaming

The proposed P2P-VoD system consists of three sub-algorithms: P2PKeyExt,
signcrypt, and unsigncrypt, in which a (sender) peer divides the video content
into chunks, signcrypts each chunk with the shared key $p2p_{sk}$ and
transmits the signcrypted chunks to (receiver) peer where (receiver) peer
unsigncryptes the signcrypted chunk with its shared key $p2p_{sk}$.

  * •

Signcrypt: The (sender) peer signcrypts the video chunks $chk\in\\{0,1\\}^{m}$
using its private key $d_{S}$ and session key $p2p_{s}k$. It set
$h=H_{3}(chk,A,T)$, $C=(a+h)d_{S}$ and $D=H_{2}(p2p_{s}k)\oplus chk||T||C$,
where $T\in\\{0,1\\}^{t}$ denotes timestamp. It sends $CT=<D,A>$ to the
(receiver) peer. Unsigncrypt: The (receiver) peer extract $chk||T||C=D\oplus
H_{2}(p2p_{sk})$, set $h=H_{3}(chk,A,T)$ and accepts $chk$, if Equation (6.2)
holds.

$e(C,P)=e(Y,A+hQ_{S})$ (6.2)

This completes the full implementation of our proposed secure P2P-VoD system.

###  6.3 System Analysis

####  6.3.1 Security Proof

######  Theorem 6.1.

(consistency). The proposed P2P-VoD scheme is consistent.

###### Proof.

Proof. In order to define the consistency of the P2P-VoD system, we discuss
the consistency of session key $p2p_{sk}$ in P2PKeyExt and unsigncryption
algorithm.

The consistency of session key $p2p_{sk}$ is verified as

$\displaystyle p2p_{sk}$ $\displaystyle=e(d_{S},Q_{R})^{a}=e(ad_{S},Q_{R})$
$\displaystyle=e(as_{0}(s_{1}+s_{2}+\dots+s_{n})Q_{S},Q_{R})$
$\displaystyle=e(aQ_{S},s_{0}(s_{1}+s_{2}+\dots+s_{n})Q_{R})$
$\displaystyle=e(A,d_{R})=p2p_{sk}$

The consistency of unsigncryption is verified as

$\displaystyle e(C,P)=$ $\displaystyle e((a+h)d_{S},P)$
$\displaystyle=e((a+h)s_{0}(s_{1}+s_{2}+\dots+s_{n})Q_{S},P)$
$\displaystyle=e((a+h)Q_{S},s_{0}(s_{1}+s_{2}+\dots+s_{n})P)$
$\displaystyle=e(A+hQ_{S},Y)$

This proves the consistency of our proposed scheme. ∎

######  Theorem 6.2.

The proposed EF-IDSC scheme is
$(q_{1},q_{2},q_{3},q_{pp},q_{p},q_{sc},q_{us},t,\epsilon)$-IND-CCA secure in
the ROM, assuming the $(\epsilon^{\prime},t^{\prime})$-BDHP assumption, where
$t^{\prime}=t+t_{B}+q_{1}+q_{2}+q_{3}+q_{pp}+q_{p}+q_{sc}+q_{us}$,
$\epsilon^{\prime}=\epsilon/((q_{1}+q_{pp}q_{P}^{n})q_{3})(1-q_{sc}(q_{2}+2q_{sc})/2^{k})$,
and $q_{1}$, $q_{2}$, $q_{3}$, $q_{pp}$, $q_{p}$, $q_{sc}$, $q_{us}$ are the
numbers of $H_{1}$, $H_{2}$, $H_{3}$, partial private key, private key,
signcrypt queries, and unsigncrypt queries, respectively.

###### Proof.

Suppose the generator of $\mathbb{G}_{1}$ be $P$, and the tuple $<P,aP,bP,cP>$
be a random instance of the BDH problem given to $B$. To break the IND-CCA
security of the proposed scheme, $B$ helps the adversary $Adv$ solve the BDH
problem, which is equivalent to computing $e(P,P)^{abc}$. Thus, $B$ responds
to the following queries from $Adv$ in the IND-CCA game.

Setup. Suppose three random oracle hash functions are $H_{1}$, $H_{2}$, and
$H_{3}$. Let $B$ maintain the following lists: $L_{i}$ for $H_{i}$ query,
$L_{pp}$ for partial private key query, $L_{p}$ for private key extraction
query, $L_{sc}$ for signcrypt query, and $L_{us}$ for unsigncrypt query. $B$
sets $Y=cP$ and sends it to $Adv$. $B$ randomly chooses a distinct number
$j\in{1,2,\ldots,q_{1}}$.

  * •

$H_{1}$ query: $Adv$ asks an $H_{1}$ query on $ID_{i}$. On a given $ID_{i}$,
$B$ sets $q_{i}=xP$ and $D_{0i}=xY$. If $ID_{i}\notin L_{1}$, $B$ adds the
tuple $<ID_{i},q_{i},D_{0i},x>$ to $L_{1}$. Otherwise, $B$ outputs
$q_{S}i=H_{1}(ID_{Si})=a^{\prime}P$ and $q_{R}i=H_{1}(ID_{U}i)=b^{\prime}P$ to
$Adv$, where $a^{\prime},b^{\prime}\in\mathbb{Z}_{q}$.

  * •

$H_{2}$ query: $Adv$ asks an $H_{2}$ query on $<A_{i},chk_{i},T_{i}>$. $B$
computes $H_{2}(A_{i},chk_{i},T_{i})=h_{i}$. If the tuple
$<A_{i},chk_{i},T_{i}>$ is not in $L_{2}$, $B$ adds the tuple
$<A_{i},chk_{i},T_{i},h_{i}>$ to $L_{2}$. Otherwise, $B$ outputs $h_{i}$ to
$Adv$.

  * •

$H_{3}$ query: $Adv$ asks an $H_{3}$ query on $<C_{i}>$. $B$ chooses
$\lambda_{i}\in\mathbb{Z}_{q}$ and sets $H_{3}(C_{i})=\lambda_{i}$. If the
tuple $<C_{i}>$ is in $L_{3}$, $B$ adds the tuple $<C_{i},\lambda_{i}>$ to
$L_{3}$. Otherwise, $B$ outputs $\lambda_{i}$ to $Adv$.

Phase 1. The following queries are asked by $Adv$:

  * •

ParKeyIss query: Given $q_{i}$, $B$ aborts the process if $q_{i}$ has been
previously asked; otherwise, $B$ outputs $D_{0i}$ to $Adv$.

  * •

PriKeySec query: Given $D_{0i}$, $B$ aborts the process if $D_{0i}$ has been
previously asked; otherwise, $B$ picks $s^{\prime}k\in\mathbb{Z}q$ and sets
$D{ki}=s^{\prime}{ki}D_{0}$, where $1\leq k\leq n$ denotes the $k$-th share of
the private key. $B$ responds with $D_{ki}$ to $Adv$.

  * •

KeyExt query: Given $D_{ki}$, $B$ aborts the process if $D_{ki}$ has been
previously asked. Otherwise, $B$ computes $d_{A}=aP$ and $d_{B}=bP$ and
responds with $d_{B}$ to $Adv$.

  * •

Signcrypt query: For given data chunks $chk$, $ID_{S}$, and $ID_{R}$, $Adv$
asks the signcrypt query as follows:

    * –

If $ID_{S}$ and $ID_{R}$ have not been previously queried, $B$ performs the
following steps:

      * *

Choose $r\in\mathbb{Z}_{q}^{*}$ and set $A=rQ_{S}$, $h=H_{2}(chk,B)$,
$C=(r+h)d_{S}$, and $D=H_{2}(B)\oplus(chk||C||ID_{S})$.

      * *

Respond with $<A,D>$ to $Adv$.

    * –

If $ID_{S}$ is queried but $ID_{R}$ has not been queried previously, $B$
already knows the receiver’s private key $d_{R}$ and responds as follows:

      * *

Pick numbers $r,h\in\mathbb{Z}_{q}^{*}$, set $A=rP-hQ_{S}$, $C=rQ_{S}$. Add
$<A,m,h>$ to list $L_{2}$.

      * *

Find the entry $<ID_{R},q_{R},D{0R},x>$ in $L_{1}$, set $B=e(A,d_{R})$,
$D=H_{2}(B)\oplus chk||C||T$.

      * *

Respond with $<A,D>$ to $Adv$.

    * –

If $ID_{S}$ and $ID_{R}$ have been queried previously, $B$ knows the
receiver’s private key $d_{R}$ and responds as follows:

      * *

Select the elements $r,h\in\mathbb{Z}q^{*}$ and set $A=rP-hQ_{S}$, $C=rY$. Add
$<A,pkt,h>$ to list $L_{2}$.

      * *

Choose $\lambda\in{0,1}^{m}\times\mathbb{G}1\times{0,1}^{n}$, set
$D=\lambda\oplus chk||C||T$, and add $<ID_{S},ID_{R},A,B,C,r,chk,h,\lambda>$
to list $L{sc}$.

      * *

Respond with $<A,D>$ to $Adv$.

  * •

Unsigncrypt query: For the given ciphertext $CT={A,D}$, $Adv$ asks the
unsigncrypt query and performs the following steps:

    * –

If $ID_{R}$ has not been previously queried, $B$ already knows $d_{R}$. $B$
may execute the unsigncrypt query to obtain $pkt$ and verify the signature. If
it does not satisfy the verification, the process is aborted; otherwise, $B$
sends $chk$ to $Adv$.

    * –

If $ID_{S}$ and $ID_{R}$ have not been queried previously, $B$ already knows
$d_{S}$ and responds as follows:

      * *

Find the entry $<ID_{R},q_{R},D{0R},x>\in L_{1}$, set $B=e(A,d_{R})$.

      * *

If $B\in L_{3}$, $ID_{S}\in L_{1}$, and $<A,chk>\in L_{2}$, compute
$C||T||chk\leftarrow y\oplus H_{3}(B)$, $q_{1}\leftarrow H_{1}(ID_{S})$, and
$h\leftarrow H_{2}(A,chk)$.

      * *

Check if $e(C,P)=e(Y,A+hq_{1})$, and respond with $chk$, $(A,C)$, and
$ID_{S}$.

      * *

Otherwise, find the entry $<ID_{S},ID_{R},A,B,C,r,h,chk,\lambda>\in L_{sc}$,
and compute $C||T||chk\leftarrow y\oplus h$, $q_{1}\leftarrow H_{1}(ID_{S})$,
and $h\leftarrow H_{2}(A,chk)$. Check if $e(C,P)=e(Y,A+hq_{1})$, and respond
with $chk$, $(A,C)$, and $ID_{S}$.

Challenge. $Adv$ responds with two chunks $chk_{0}$, $chk_{1}$, and identities
$ID_{S}^{ch}$, $ID_{R}^{ch}$ to be challenged.

  * •

If $ID_{R}^{ch}$ has not been previously queried, $B$ fails.

  * •

Otherwise, $B$ selects $b\in{0,1}$ to signcrypt $chk$ and responds to $Adv$.

Phase 2. Similar to Phase 1, $Adv$ extracts queries, but $Adv$ is not allowed
to extract the unsigncrypt query for $CT^{ch}={chk_{b},A^{ch},C^{ch}}$ under
identities $ID_{S}^{ch}$ and $ID_{R}^{ch}$.

Guess. Finally, $Adv$ guesses a bit $b^{\prime}\in{0,1}$. $Adv$ wins the game
if $b=b^{\prime}$. To solve the BDH problem, $B$ can retrieve the $L_{sc}$ for
the tuple $<ID_{S}^{ch},ID_{R}^{ch},A^{ch},B^{ch},C^{ch},h,chk_{b},\lambda>$,
and compute $Z=(B^{ch}/(e(C^{ch},Y)))^{-1/h}$, where

$\displaystyle Z=(B^{ch}/e(C^{ch},Y))^{-1/h}$ $\displaystyle=(e(rP-
hQ_{S}^{ch},d_{R}^{ch})/e(C^{ch},Y))^{-1/h}\ $
$\displaystyle=((e(rP,bcP)e(-hQ_{S}^{ch},d_{R}^{ch}))/e(rbP,cP))^{-1/h}\ $
$\displaystyle=e(-hQ_{S}^{ch},d_{R}^{ch})^{-1/h}\ $
$\displaystyle=e(aP,bcP)=e(P,P)^{abc}$

Thus, $B$ responds with $Z=e(P,P)^{abc}$ as the solution to the given BDH
problem.

Analysis. The probability that $B$ does not abort the game is defined by four
events:

  * •

$E_{1}$: $Adv$ has asked for the partial and private key on $ID_{i}$ with
probability $Pr[E_{1}]=(1/(q_{1}+q_{pp}q_{P}^{n}))$.

  * •

$E_{2}$: $Adv$ does not select $ID_{i}$ as the receiver during the challenge
phase, and from $E_{1}$ we can deduce $\neg E_{2}$.

  * •

$E_{3}$: $B$ stops responding to $Adv$’s signcrypt query when there is a
collision in $H_{2}$ or $H_{3}$ with probability $Pr[E_{3}]=1/q_{3}$.

  * •

$E_{4}$: $B$ aborts the valid ciphertext with probability
$Pr[E_{4}]=(q_{2}+2q_{sc})/2^{k}$.

The probability that $B$ solves the BDH problem is given by:

$A(Adv)\geq\frac{\epsilon}{(q_{1}+q_{pp}q_{P}^{n})q_{3}(1-q_{sc}(q_{2}+2q_{sc})/2^{k})}$
(6.3)

∎

######  Theorem 6.3.

The proposed EF-IDSC scheme is
$(q_{1},q_{2},q_{3},q_{pp},q_{p},q_{sc},q_{us},t,\epsilon)$-EUF-CMA secure in
the ROM, assuming the $(\epsilon^{\prime},t^{\prime})$-BDHP assumption, where
$t^{\prime}=t+t_{B}+q_{1}+q_{2}+q_{3}+q_{pp}+q_{p}+q_{sc}+q_{us}$,
$\epsilon^{\prime}=\frac{\epsilon}{(4(q_{1}+q_{pp}q_{P}^{n})^{2}(q_{2}+2q_{sc}))(1-q_{sc}(q_{2}+2q_{sc})/2^{k})^{2}}$,
and $q_{1}$, $q_{2}$, $q_{3}$, $q_{pp}$, $q_{p}$, $q_{sc}$, $q_{us}$ are the
numbers of $H_{1}$, $H_{2}$, $H_{3}$, partial private key, private key,
signcrypt queries, and unsigncrypt queries, respectively.

###### Proof.

Consider a forger $F$ against our proposed system. In order to forge a
signature in the proposed system, we construct a simulator B that helps $F$
for solving the BDH problem with the probability of the least $\epsilon$.
Identical to Theorem 6.1, $F$ runs $H_{1}$, $H_{2}$, $H_{3}$, partial private
key, private key, signcrypt and unsigncrypt queries. $F$ asks the simulator
$B$ in the same way as in Theorem 6.1. So, $B$ outputs the following queries
for $F$ in the IND-CCA game.

Setup. Suppose $H_{1}$, $H_{2}$ and $H_{3}$ are three random oracle models.
Let $B$ maintain the following lists: $L_{i}$ for $H_{i}$ query, $L_{pp}$ for
partial private key query, $L_{p}$ for private key extraction query, $L_{sc}$
for Signcrypt query and list $L_{us}$ for unsigncrypt query. $B$ set $Y=cP$
and sends it to $F$. $B$ randomly chooses a distinct number
$j\in\\{1,2,..,q_{1}\\}$.

  * •

$H_{1}$ query. $F$ asks $H_{1}$ query on $ID_{i}$. On given $ID_{i}$, $B$ set
$q_{i}=xP$, and $D_{0i}=xY$, if $ID_{i}\notin L_{1}$, then adds the tuples
$<ID_{i},q_{i},D_{0i},x>$ in $L_{1}$. Else, $B$ outputs
$q_{S}i=H_{1}(ID_{Si})=a^{\prime}P$ and $q_{R}i=H_{1}(ID_{Si})=b^{\prime}P$ to
$F$, where $a^{\prime},b^{\prime}\in\mathbb{Z}_{q}$.

  * •

$H_{2}$ query. $F$ asks $H_{2}$ query on $<A_{i},chk_{i},T_{i}>$. $B$ computes
$H_{2}(A_{i},chk_{i},T_{i})=h_{i}$, if the tuple $<A_{i},chk_{i},T_{i}>\notin
L_{2}$ then adds the tuples $<A_{i},chk_{i},T_{i},h_{i}>$ in list $L_{2}$.
Else, $B$ outputs $h_{i}$ to $F$.

  * •

$H_{3}$ query. $F$ asks $H_{3}$ query on $<C_{i}>$. $B$ chooses
$\lambda_{i}\in\mathbb{Z}_{q}$ and set $H_{3}(C_{i})=\lambda_{i}$, if the
tuple $<C_{i}>\in L_{3}$ and adds the tuples $<C_{i},\lambda_{i}>$ in list
$L_{3}$. Otherwise, $B$ outputs $\lambda_{i}$ to $F$.

Phase 1. The following queries are asked by the $F$.

  * •

ParKeyIss qyery: On given $q_{i}$, $B$ abort the process, if $q_{i}$ is
previously asked, otherwise, outputs $D_{0i}$ to $F$.

  * •

PriKeySec query. On given $D_{0i}$, $B$ abort the process, if $D_{0i}$ is
previously asked. Otherwise, $B$ picks $s^{\prime}_{k}\in\mathbb{Z}_{q}$ and
set $D_{ki}=s^{\prime}_{ki}D_{0}$, where $1\leq k\leq n$, denotes the $k$-th
share of private key. $B$ responds $D_{ki}$ to the $F$.

  * •

KeyExt query. On given $D_{ki}$, $B$ aborts the process, if $D_{ki}$ is
previously asked. Otherwise, $B$ computes $d_{S}=aP$ and $d_{R}=bP$, and
responds $d_{R}$ to the $F$.

  * •

Signcrypt query. For given data chunks $chk$, $ID_{S}$ and $ID_{R}$, $F$ asks
the signcrypt query as follows.

    * –

If $ID_{S}$ and $ID_{R}$ are not previously queried, $B$ performs the steps.

      * *

Choose $r\in\mathbb{Z}_{q}^{*}$, set $A=rQ_{S}$, $h=H_{2}(chk,B)$,
$C=(r+h)d_{S}$ and $D=H_{2}(B)\oplus chk||C||ID_{S}$.

      * *

Responds $<A,D>$ to the $F$.

    * –

If $ID_{S}$ is queried but $ID_{R}$ is not queried previously, $B$ already
knows the receiver’s private key $d_{R}$ and responds as follows.

      * *

Selects random numbers $r,h\in\mathbb{Z}_{q}^{*}$, set $A=rP-hQ_{S}$,
$C=rQ_{S}$. Add $<A,m,h>$ in list $L_{2}$.

      * *

find the entry $<ID_{R},q_{R},D_{0R},x>$ in $L_{1}$, set $B=e(A,d_{R})$, set
$D=H_{2}(B)\oplus chk||C||T$.

      * *

Responds $<A,D>$ to $F$.

    * –

If $ID_{S}$ and $ID_{R}$ are queried previously, $B$ knows the receiver’s
private key $d_{R}$ and responds as follows.

      * *

Select the elements $r,h\in\mathbb{Z}_{q}^{*}$, and set $A=rP-hQ_{S}$, $C=rY$.
Add $<A,pkt,h>$ in the list $L_{2}$.

      * *

Chooses $\lambda\in\\{0,1\\}^{m}\times\mathbb{G}_{1}\times\\{0,1\\}^{n}$, set
$D=\lambda\oplus chk||C||T$, add $<ID_{S},ID_{R},\\\ A,B,C,r,chk,h,\lambda>$
to the list $L_{Sc}$.

      * *

Responds $<A,D>$ to $Adv$.

  * •

Unsigncrypt query. For given ciphertext $CT=<A,D>$, $F$ asks the unsigncrypt
query and performs the following steps.

    * –

If $ID_{R}$ is not previously queried, $B$ already knows $d_{R}$. $B$ may
execute the unsigncrypt query to obtain the $pkt$ and verify the signature. If
it does not satisfied the verification is aborted, otherwise, sends $chk$ to
$F$.

    * –

If $ID_{S}$ and $ID_{R}$ is not queried previously, $B$ already knows the
$d_{S}$ and responds as follows:

      * *

Find the entry $<ID_{R},q_{R},D_{0R},x>\in L_{1}$, set $B=e(A,d_{R})$.

      * *

If $B\in L_{3}$, $ID_{S}\in L_{1}$ and $<A,chk>\in L_{2}$, compute
$C||T||chk\leftarrow y\oplus H_{3}(B)$, $q_{1}\leftarrow H_{1}(ID_{S})$, and
$h\leftarrow H_{2}(A,chk)$.

      * *

check if $e(C,P)=e(Y,A+hq_{1})$, and responds $m$, $<A,C>$ and $ID_{S}$,

      * *

Else, find the entry $<ID_{S},ID_{R},A,B,C,r,h,chk,\lambda>\in L_{sc}$, and
compute $C||T||chk\leftarrow y\oplus h$, $q_{1}\leftarrow H_{1}(ID_{S})$ and
$h\leftarrow H_{2}(A,chk)$.

      * *

check if $e(C,P)=e(Y,A+hq_{1})$, and responds $chk$, $<A,C>$ and $ID_{S}$,

Forgery. Forger $F$ responds the ciphertext $CT^{ch}=<A^{ch},C^{ch}$ as valid
signcryption under identities $ID_{S}^{ch}$ and $ID_{R}^{ch}$. If
$ID_{S}^{ch}$ is not previously queried, the simulation is aborted. Otherwise,
$B$ set $A=rP-hQ_{S}$ and $C=rQ_{S}$ by running the $H_{1}$ and $H_{2}$ query.

Then, we have $Z=(B^{ch}/(e(C^{ch},Y)))^{-1/h}=e(P,P)^{abc}$ as the solution
of the given BDH problem. It can be noticed that if a valid tuple does not
found in $L_{2}$, then $F$ will not have any advantage.

Thus, the probability that $B$ solve the BDH problem is:

$A(F)\geq\frac{\epsilon}{(4(q_{1}+q_{pp}q_{P}^{n})^{2}(q_{2}+2q_{sc}))(1-q_{sc}(q_{2}+2q_{s}c)/2^{k})^{2}}$
(6.4)

∎

####  6.3.2 Security Requirements

This section discusses the security requirements that our proposed P2P-VoD
scheme has achieved.

  * •

Peer authentication: In our proposed scheme, a peer requests to the SP for the
subscription, in which SP authenticates the peer against his $ID$ and gives a
partial private key to him. Followed by multiple KPSs providing the protected
private keys to him. Thus, SP and multiple KPSs authenticate/register the
peer.

  * •

Access control: A (sender) peer, in the proposed P2P-VoD system, signcrypts
the video chunk using a pair of the session key $p2p_{sk}$, private key
$d_{S}$ and recipient’ peer $ID_{R}$. It broadcasts the signcrypted chunk in
the network which could be unsigncrypted by that peer in the network who has
pre-established session key $p2p_{sk}$. The intended (receiver) peer who has
previously established a session key $p2p_{sk}$ can access the chunks by
unsigncrypting the unsigncrypted chunks. Suppose an adversary or a malicious
peer in the network wish to access the video content. He must first guess the
private key $d_{R}$ of the (receiver) peer to compute the session key
$p2p_{s}k$, which is equivalent to solving the BDH problem, as given in
Theorem 7.10. Thus, the proposed P2P-VoD system provides access control only
to the intended peer in the network.

  * •

Data integrity: On the (sender) peer side, the video content chunk is
encrypted with the session key $p2p_{sk}$, computed from his private key
$d_{S}$ and (receiver) peer $ID_{R}$. The encrypted content is decrypted by
the intended peer who has the session key $p2p_{sk}$ corresponding private key
$d_{R}$. Suppose an adversary alters or modifies the encrypted video content
over the internet which will be caught by the (receiver) peer during
unsigncryption process. Thus, the proposed P2P-VoD system provides the
integrity of video content.

  * •

Data confidentiality: The encrypted video data chunk is only intended for the
peer whose private key $d_{R}$ is corresponding to the encrypted key $ID_{R}$.
Suppose an adversary who wishes to alter or modify the video data chunk, he
requires to guess the peer’s decryption key, which is equivalent to solving
the BDH problem, as given in Theorem 7.10.

  * •

Replay attack: The signcryption process of the P2P-VoD scheme uses the
timestamp $T$, which ensures that video data chunk transmission is not
maliciously repeated or delayed. Thus, the proposed P2P-VoD system is
resilient to replay attacks.

  * •

Pollution attacks. Theorems 7.10 and 7.11 prove that under the assumption of
the BDH problem adversary can alter and forge the video chunks respectively
with negligible advantage. Therefore, the proposed P2P-VoD system defends
polluted data chunks available to other peers.

  * •

Flood attack. In the proposed EF-IDSC scheme, the system initialization and
secure key mechanism are two independent algorithms. When a new peer wishes to
request a video from a neighbour peer, it must be pre-registered with the
service provider and KPSs during the system initialization phase and gets a
private key (credential) against his identity ID. After obtaining a private
key from the service provider, the new peers now can push or pull the video
content using the proposed EF-IDSC scheme.

####  6.3.3 Performance Evaluation

This section simulates an experiment on the proposed IF-IDSC scheme of the
P2P-VoD system, which includes the storage, communication, and computation
cost. The experiment is performed on the same machine as discussed in Chapter
3.6. Besides, we consider the cryptographic operations and their computation
costs, as mentioned in Table 3.1. In order to analyze the bandwidth and
storage cost, we consider $|\mathbb{G}_{1}|$ as the size of multiplication
group $\mathbb{G}_{1}$, $|\mathbb{G}_{2}|$ as the size of multiplication group
$\mathbb{G}_{2}$, $|\mathbb{Z}_{q}|$ as the size of $\mathbb{Z}_{q}$, $|id|$
as the size of identity, and $|chk|$ as the size of the video data chunk.

Table 6.1: Computational, storage and communication cost comparison of our scheme with other related schemes Schemes | Computation cost (in ms) | Size (in bytes)
---|---|---
| Offline | Online | Unsigncrpt | Offline | Signcryptext
[106] | 33.35 | 0.23 | 60.03 | 198 | 108
[112] | 38.18 | 6.67 | 104.88 | 298 | 252
[111] | 31.51 | 0.23 | 64.84 | 166 | 110
[143] | 31.51 | 0.23 | 51.52 | 234 | 178
[134] | — | 26.63 | 26.68 | — | 86
Our | 45.08 | 6.67 | 46.67 | 100 | 76
Table 6.2: General comparison of our scheme with related schemes

Schemes | Cryptographic | Security | Analysis | Preserve | Resilient to
---|---|---|---|---|---
| Primitives | Assumption. | model | ID-based | Key Escrow
|  |  |  | Feature | problem
[106] | OOIDSC | k-CAA1, q-BDHI@, q-SDH# | ROM | Yes | No
[112] | OOCLSC | UF-CMA-I, q-CAA | ROM | No | yes
[111] | OOCLSC | q-BDHI, q-SDH, mBDHIP## | ROM | No | Yes
[143] | HOOCLSC | q-BDHIP, q-SDHP, ECDLP | ROM | No | Yes
[134] | CLSC | CDH, GDHP | ROM | No | Yes
Our | EF-IDSC | BDH | ROM | Yes | Yes

@q-Bilinear-Diffie Inverse Problem, #q-strong Diffie-Hellman problem, ##
modified Bilinear Diffie-Hellman inverse problem,

We assume three metrics for the performance evaluation to examine the
experimental result: computational cost (in msec), storage cost (in Bytes) and
communication cost (in Bytes). For the performance analysis, we compare the
proposed IDSC scheme with Lai et al. [106], Li et al. [112], Li et al. [111],
Saeed et al. [143] and Omala et al. [134] schemes.

Figure 6.3: Offline, online and unsigncryption (in ms) comparison of proposed
EF-IDSC scheme with other related schemes Figure 6.4: Storage and signcryptext
size (in Bytes) comparison of proposed EF-IDSC scheme with other related
schemes

Computation cost. The proposed scheme takes 2*20.01 + 1*0.23 + 1*4.83 = 45.08
ms for offline signcryption, while Lai et al. [106], Li et al. [112], Li et
al. [111] and Saeed et al. [143] take 33.35 ms, 38.18 ms, 31.51 ms and 31.51
ms, respectively. In online signcryption, the proposed scheme consumes 1*6.67
= 6.67 ms while Lai et al. [106], Li et al. [112], Li et al. [111], Saeed et
al. [143] and Omala et al. [134] schemes consume 0.23 ms, 0.23 ms, 0.23 ms,
26.68 ms and 6.67 ms, respectively. Similarly, the computational cost of our
scheme with Lai et al. [106], Li et al. [112], Li et al. [111], Saeed et al.
[143] and Omala et al. [134] schemes are 2*20.01 + 1*6.67 = 46.7 ms, 60.03 ms,
104.88 ms, 64.84 ms, 51.52 ms, and, 26.68 ms, respectively, illustrated in
Figure (6.3).

For evaluating storage and communication cost, we assume $|id|$ = 80 bits. For
super-singular curve over the binary field $\mathbb{F}_{(}2^{271})$ with the
order of $\mathbb{G}_{1}$ is 252 bit prime and using compression technique
[35], we consider $|\mathbb{G}_{1}|$ = 34 bytes, $|\mathbb{G}_{2}|$ = 34 bytes
and $|\mathbb{Z}_{q}|$ = 32 bytes.

Storage size (in Bytes). Figure (6.4) demonstrates the storage cost (in Bytes)
and signcryptext size (in Bytes) of our proposed scheme with other schemes.
For offline storage, Lai et al. [106] needs 198 bytes, Li et al. [112] needs
298 bytes, Li et al. [111] needs 166 bytes and Saeed et al. [143] needs 234
bytes while our scheme needs 100 bytes, summarize in Table 6.1.

Signcryptext size (in Bytes). Figure (6.4) illustrates the signcryptext size
of the proposed scheme with other related schemes. It requires transmitting
108 bytes of messages in Lai et al. [106], 252 bytes of messages in Li et al.
[112], 110 bytes of messages in Li et al. [111], 178 bytes of messages in
Saeed et al. [143] and 86 bytes Omala et al. [134] scheme, while 76 bytes
messages in our scheme, summarize in Table 66.1. For transmitting a video
chunk of 10 bytes, our proposed scheme saves 28%, 69%, 29%, 56% and 10% of
communication cost as compared to Lai et al. [106], Li et al. [112], Li et al.
[111], Saeed et al. [143] and Omala et al. [134] schemes.

From Table 6.2, it can be seen that the proposed EF-IDSC scheme is the only
scheme that achieves identity-based features and is resilient to the key
escrow attacks whose security is based on the well-known BDH problem under the
random oracle model. The proposed scheme is more suitable for secure video
streaming in the P2P-VoD system.

###  6.4 Cloud-Centric Secure IoMT-Enabled Smart Healthcare System

Here, we discuss implementing the proposed smart healthcare system, which
consists of the following four phases.

####  6.4.1 System Initializations

This section discusses the system setup and the entity’s registration. In
Algorithm 6.1, NM and KPSs set up the proposed system, in which they generate
the secret keys and system parameters. The secret keys are secret to them, and
public parameters are broadcasted in the network. Algorithm 6.2 registers the
new entity that wishes to add to the network. The NM authenticates the entity
against its identity ID and issues a partial private key to it. The multiple
KPSs protect the partial private key and forward the protected private key
shares to the entity. Entity combines the shares and extracts its escrow-free
private key. Since BMS has limited computation power, so the expensive
computation can be outsourced on a powerful system.

Algorithm 6.1 System setup

1:Given a security parameter $k$, the NM picks an element $q$, a $k$-bit large
prime number. Let an additive group $\mathbb{G}_{1}$, multiplicative group
$\mathbb{G}_{2}$ of order of $q$, $P$ be the generator of $\mathbb{G}_{1}$ and
a pairing function
$e:\mathbb{G}_{1}\times\mathbb{G}_{1}\rightarrow\mathbb{G}_{2}$.

2:Suppose five one-way cryptographic hash functions are as follows.
$H_{1}:\\{0,1\\}^{l}\rightarrow\mathbb{G}_{1}$,
$H_{2}:\\{0,1\\}^{*}\rightarrow\\{0,1\\}^{m+l+t}\times\mathbb{G}_{1}$,
$H_{3}:\mathbb{G}_{2}\times\\{0,1\\}^{n}\times\mathbb{Z}_{q}^{*}$,
$H_{4}:\mathbb{G}_{1}^{m}\rightarrow\mathbb{Z}_{q}^{*}$, and
$H_{5}:\mathbb{G}_{1}^{n}\rightarrow\mathbb{Z}_{q}^{*}$, where $m$, $l$ and
$t$ denote the size message, identity and timestamp (in bits).

3:NM chooses an element $s_{0}\in\mathbb{Z}_{q}^{*}$ and sets pubic key
$P_{0}=s_{0}P$, and sends $P_{0}$ to $KPS^{i}$.

4:$KPS^{i}$ chooses an element $s_{i}\in\mathbb{Z}_{q}^{*}$ and sets
$P_{i}=s_{i}P_{0}$ and responses $P_{i}$ back to the NM.

5:NM combines all received parameters and computes the system public key
$Y=\sum_{i=1}^{n}P_{i}=s_{0}(s_{1}+s_{2}+\ldots+s_{n})P$

6:NM keeps $s_{0}$ secret and published the public parameter
$pp=<q,e,P,P_{0},\mathbb{G}_{1},\mathbb{G}_{2},H_{1},H_{2},H_{3},H_{4},H_{5},Y,P_{1},P_{2},..P_{n}>$.

Algorithm 6.2 Entity’s Authentication and registration

1:Entity $E\in\\{BMS,PAD,SD\\}$ with identity $ID_{E}$, picks an element
$x_{E}\in\mathbb{Z}_{q}^{*}$, set $X_{E}=x_{E}P$, $D_{E}=x_{E}Q_{E}$, where
$Q_{E}=H_{1}(ID_{E})$ and sends $<X_{E},ID_{E},D_{E}>$ to NM.

2:The NM validates the parameters using
$e(Q_{E},X_{E})\overset{?}{=}e(D_{E},P)$ compute the partial private key as
$D_{E0}=s_{D_{E}}$, $X_{E0}=s_{0}X_{E}$, and responds $D_{E0}$ back to $E$

3:E aborts the process if $e(D_{E},P_{0})\overset{?}{=}e(D_{E0},P)$ does not
hold.

4:Otherwise, $E$ accepts it and requests to $KPS^{i}$ for key protection.

5:$KPS^{i}$ aborts the process if above equation
$e(Q_{E},X_{E0})\overset{?}{=}e(D_{E0},P)$ does not hold

6:Otherwise, sends $D_{Ei}=s_{i}D_{E0}$ to $E$.

7:Entity E checks $D_{Ei}$ if equation $e(D_{E},P_{i})=e(D_{Ei},P)$ holds.

8:$E$ unblinds it and retrieves the private key
$d_{E}=x_{E}^{-1}\sum_{i=1}^{n}D_{Ei}=s_{0}(s_{1}+s_{2}+\dots s_{n})Q_{E}$.

9:Otherwise, abort the process.

####  6.4.2 Secure Data Communication from BMS to PAD

This subsection discusses secure data communication from the BMS to PAD.
Suppose a WBAN architecture consists of n bio-medical sensors (BMS) connected
with a PAD. Let $M_{i,j}$ denotes the personal health information (PHI)
collected by $j^{th}$ BMS at time $T_{i,j}$, where $1\leq i\leq m$ and $1\leq
j\leq n$. The secure data transmission mechanism from $j^{th}$ BMS to the PAD
is defined by Algorithm 6.3. In Algorithm 6.3, $j^{th}$ BMS collects the PHI
$M_{i,j}$ at time $T_{i,j}$, signcrypts it using its private key
$d_{BMS}^{j}$, and sends the PHI $C_{i,j}$ in encrypted form to the PAD. In
order to further improve the efficiency, $j^{th}$ BMS combines the
signcryptext $C_{i,j}$ collected on different timestamps, signs it with its
private key $d_{BMS}^{j}$ and stores it in the PAD. On receiving the PHI in
encrypted form from $j^{th}$ BMS, the PAD first verifies the authenticity of
data, using Eq. (7.5) defined in Algorithm 7.4 without accessing the original
PHI and accepts the parameters. Otherwise, reject it.

Algorithm 6.3 PHI Aggregate Signcryption

1:$j^{th}$ BMS chooses an element $a_{j}\in\mathbb{Z}_{q}^{*}$ and computes
$A_{j}=a_{j}Q_{BMS}^{j}$, and $B_{j}=a_{j}P$ where
$Q_{BMS}^{j}=H_{1}(ID_{BMS}^{j})$.

2:$j^{th}$ BMS sets $K_{j}=e(a_{j}d_{BMS}^{j},Q_{SD})$, where
$Q_{SD}=H_{1}(ID_{SD})$ and computes signcryption key as
$S_{j}^{k}=H_{2}(ID_{SD},A_{j},K_{j},S_{j}^{k-1})$. Here, $S_{j}^{k-1}$ is the
previous key.

3:On given time-stamp $T_{i,j}\in\\{0,1\\}^{t}$ and PHI
$M_{i,j}\in\\{0,1\\}^{m}$, $j^{th}$ BMS computes
$h_{i,j}=H_{3}(M_{i,j},A_{j},T_{i,j})$ and
$C_{i,j}=(a_{j}+h_{i,j})d_{BMS}^{j}$

4:Sets $D_{i,j}=M_{i,j}||C_{i,j}||ID_{BMS}^{j}||T_{i,j}\oplus S_{j}^{k}$,
where $1\leq i\leq m$ and $1\leq j\leq n$.

5:Aggregates the signcypted PHI as
$C_{aggr,j}=H_{4}(C_{1,j},C_{2,j},..C_{m,j})$ and
$E_{j}=C_{aggr,j}d_{BMS}^{j}$

6:Stores $CT_{j}=<A_{j},B_{j},C_{aggr,j},D_{i,j},E_{j}>$ in PAD.

7:Secure data communication from PAD to MCS

This section discusses the secure data communication from the PAD to SD/MCS
and the integrity of data on the MCS. PAD combines the aggregated
signcryptexts received from multiple BMS into a single compact re-aggregated
signcryptext, defined in Algorithm 6.4. In comparison with BMS, PAD, in our
proposed model, has sufficient memory and computational power, so we could not
bother about computation on PAD. It is to note that PAD is only allowed to
verify the aggregated signcryptext and re-aggregated signcryptext without
knowing the actual PHI data. Now, PAD offloads the re-aggregated data to the
MCS. Algorithm 6.5 defines public verifiability; wherein anyone can verify the
integrity of PHI without downloading the actual data from the MCS. Whenever
the doctor needs the patient’s current health status, he fetches the
encryption data from MCS. In Algorithm 6.6, SD decrypts the signcrypted data
using an aggregate unsigncryption scheme to access the original PHI data. It
can access the original PHI if the received parameters are successfully
verified.

Algorithm 6.4 PHI Re-aggregation

1:Now, PAD collects signcrypted data $CT_{j}=<A_{j},C_{aggr,j},D_{i,j},E_{j}>$
from $j^{th}$ BMS with $ID_{BMS}^{j}$, where $1\leq j\leq m$. PAD re-
aggregates them as

2:$C_{PAD}=H_{5}(C_{aggr,1},C_{aggr,2},..,C_{aggr,n})$

3:Computes the $F=C_{PAD}d_{PAD}$.

4:Re-aggregated signcryptext is
$CT_{PAD}=<A_{j},B_{j},C_{PAD},C_{aggr,j},D_{i,j},E_{j},F>$ and stores it on
the MCS.

Algorithm 6.5 Public Verifiability

1:On stored encrypted data
$CT_{PAD}=<A_{j},B_{j},C_{PAD},C_{aggr,j},D_{i,j},E_{j},F>$ on the MCS, user
can verify the integrity of data as follows.

2:Checks the equality

3: $e(F,P)=e(Q_{PAD},Y)^{C_{PAD}}$ (6.5)

4:If yes, checks the equality

5: $e(E_{j},B_{j})=e(A_{j},Y)^{C_{aggr,j}}$ (6.6)

6:Accepts it.

7:Otherwise, Abort it.

Algorithm 6.6 Aggregate Unsigncryption

1:On given signcryptext
$CT_{PAD}=<A_{j},B_{j},C_{PAD},C_{aggr,j},D_{i,j},E_{j},F>$ from MCS, SD
performs

2:Sets $K^{\prime}_{j}=e(d_{SD},A_{j})$ and
$S_{j}^{k}=H_{2}(ID_{SD},A_{j},K^{\prime}_{j},S_{j}^{k-1})$.

3:Decrypt PHI as $M_{i,j}||C_{i,j}||ID_{BMS}^{j}||T_{i,j}=D_{i,j}\oplus
S_{j}^{k}$.

4:Compute $h_{i,j}=H_{3}(M_{i,j},A_{j},T_{i,j})$

5:Accept the PHI $M_{i,j}$ if the following conditions holds,

6:
$e(\sum_{i=1}^{m}\sum_{j=1}^{n}C_{i,j},P)=e(\sum_{i=1}^{m}\sum_{j=1}^{n}(A_{j}+h_{i,j}Q_{BMS}^{j}),Y)$
(6.7)

The consistency of Equation (6.7) is verified as:

$\displaystyle e(\sum_{[}i=1]^{m}\sum_{j=1}^{n}C_{i,j},P)$
$\displaystyle=e(\sum_{i=1}^{m}\sum_{j=1}^{n}(a_{j}+h_{i,j})d_{BMS}^{j},P)$
$\displaystyle=e(\sum_{i=1}^{m}\sum_{j=1}^{n}(a_{j}+h_{i,j})Q_{BMS}^{j},s_{0}(s_{1}+s_{1}+\dots
s_{n})P)$
$\displaystyle=e(\sum_{i=1}^{m}\sum_{j=1}^{n}(A_{j}+h_{i,j}Q_{BMS}^{j}),Y)$

Also,

$\displaystyle K^{\prime}$
$\displaystyle=e(d_{SD},A)=e(s_{0}(s_{1}+s_{1}+\dots s_{n})Q_{SD},aQ_{BMS})$
$\displaystyle=e(Q_{SD},as_{0}(s_{1}+s_{1}+\dots s_{n})Q_{BMS})$
$\displaystyle=e(Q_{SD},ad_{BMS})=K$

####  6.4.3 Secure Data Communication from SD to BMS

After accessing the patient’s PHI from MCS, SD diagnoses the patient by
sending the prescription P to the BMS in a secure way. Due to the resource-
constrained behaviour of a BMS, we will leverage the PAD again, where SD
signcrypts the prescription P using Algorithm 6.3 and sends it to MCS. On a
particular time T, PAD fetches it and sends the signcrypted prescription to
the target BMS. BMS runs Algorithm 6.6 to unsigncrypts the signcrypted
prescription to obtain prescription P.

###  6.5 System Analysis

####  6.5.1 Security Proof

######  Theorem 6.4.

(IND-CCA). Under the assumption of random oracle model, assume a PPT adversary
$A(q_{i},q_{p},q_{sc},q_{us},t,\epsilon)$ asking at most $q_{i}$ queries to
oracles $H_{i}(i=1,2,3)$, $q_{p}$ private key extraction queries, $q_{sc}$
signcrypt queries, $q_{us}$ unsigncrypt queries and wins IND-CCA-I games with
non-negligible advantage $\epsilon$, then there is an algorithm $B$ that can
solve the BDH problem in polynomial time $t^{\prime}$ with advantage:

$Adv(A)\geq\frac{\epsilon}{((q_{1}+q_{P}^{n})q_{3})(1-q_{sc}(q_{2}+2q_{sc})/2^{k})}$

and, Time $t^{\prime}=t+t_{B}O(q_{1}+q_{2}+q_{3}+q_{p}+q_{sc}+q_{us})$

Where, $t_{B}$ is the running time for algorithm $B$.

###### Proof.

The proof is similar to Theorem 2 of [92]. ∎

######  Theorem 6.5.

(EUF-CMA). Suppose a forger
$F(q_{1},q_{2},q_{3},q_{p},q_{sc},q_{us},t,\epsilon)$ who can run no more than
time $t$, $H_{1}$ queries no more than $q_{1}$, $H_{2}$ queries no more than
$q_{2}$, $H_{3}$ queries no more than $q_{3}$, private key extraction queries
no more than $q_{P}$, signcryption queries no more than $q_{sc}$, and
unsigncryption queries no more than $q_{us}$, with an advantage more than
equal to $\epsilon$. Under the adaptive chosen message and ID attacks, the
proposed EF-IDASC scheme is secured against EUF-CMA-I attack, if no adversary
$F(q_{1},q_{2},q_{3},q_{p},q_{sc},q_{us},t,k^{-n})$-breaks the scheme.

$Adv(F)\leq\frac{\epsilon}{(4(q_{1}+q_{P}^{n})^{2}(q_{2}+2q_{sc}))(1-q_{sc}(q_{2}+2q_{sc})/2^{k})^{2}}$

###### Proof.

The proof is similar to Theorem 3 of [92]. ∎

####  6.5.2 Performance Evaluation

This section evaluates the performance of the proposed smart healthcare system
in terms of computational cost and communication cost. Our primary focus is to
compute the energy consumption employed on the BMS side during data
communication and computation since BMS is a resource-constrained device as
compared to the machine on medical institutions.

Experimental result: We perform the experiment on Acer E5-573-5108 laptop with
Intel(R) Core(TM) i5-5200U<EMAIL_ADDRESS>GHz and 8 GB RAM on Windows 10. With an
80-bit security level, all computations are estimated on a super-singular
curve $y^{2}+y=x^{3}+x$ having embedding degree 4 and used the eta pairing,
$\eta:E(\mathbb{F}_{(}2^{271}))\times E(\mathbb{F}_{(}2^{271}))\rightarrow
E(\mathbb{F}_{(}2^{4.271}))$. In order to scrutinize the performance, we
assume the following operations: elliptic curve (EC) based point scalar
multiplication, elliptic curve-based point addition, the pairing of two points
on an elliptic curve, exponentiation on pairing, map-to-point hash function,
modular inversion and modular-multiplication operations. The execution time of
such cryptographic operations is obtained by taking the average of 5
succeeding runs with different inputs using the PBC library. It is also
observed in [100] that $1T_{P}\approx 3T_{SM}\approx 87T_{M}$, $T_{E}\approx
21T_{M}$, $T_{H}\approx 23T_{M}$, $T_{I}\approx 11.6T_{M}$, and $T_{A}\approx
0.12T_{M}$. From [152, 17], we have seen that the electrical requirement for
the MICA2 sensor is as follows: the required voltage in active mode is 3.0V,
the current drawn in active mode, transmitting and receiving mode are 8.0,
27.0, and 10.0 mA respectively and data rate is 12.4 Kbps. As per the
calculation, is given in [151], we consider that the energy consumption for
operations is calculated as $W=V*I*T$. Table 6.3 summarizes the notations,
computation cost (in msec), and energy consumption (in mJ) of various
cryptographic operations. As per [151], a sensor needs 0.0522 mJ and 0.0193 mJ
energy for transmitting and receiving a 1 bytes message.

Table 6.3: Computation cost of cryptographic operations Operations | Notation | Execution time (ms) | Energy consume. (mJ)
---|---|---|---
Modular multiplication | $T_{M}$ | 0.027 | 0.65
Scalar multiplication (ECC) | $T_{SM}$ | 0.304 | 7.30
Point addition (ECC) | $T_{A}$ | 0.001 | 0.024
Exponentiation | $T_{E}$ | 0.297 | 7.1
Inversion | $T_{I}$ | 0.008 | 0.192
Map-to-point hash | $T_{H}$ | 0.319 | 7.7
Bilinear pairing | $T_{P}$ | 2.373 | 56.95

Message size. Here, we study the aggregated-message size overhead in one
transmission and m transmission. For communication overhead, we consider $|T|$
= $|M|$ = 4 bytes and $|ID|$ =1 byte. For 1024-bit RSA level of security,
$|\mathbb{G}_{1}|$ must be 64-bytes prime if $\mathbb{G}_{2}$ is a q-order of
a subgroup of the multiplicative group of the finite field
$\mathbb{F}_{p^{2}}$. According to [38], we assume $|\mathbb{G}_{1}|$ = 42.5
bytes for the finite field $\mathbb{F}_{p^{3}}$ and $|\mathbb{G}_{1}|$ =20
bytes for the finite field $\mathbb{F}_{p^{6}}$. The required aggregated-
message size for storing m data collected from a BMS in single transmission
and m transmission are $4|\mathbb{G}_{1}|+m*(|\mathbb{G}_{1}|+9)$ and
$m*(2|\mathbb{G}_{1}|+9)$ bytes respectively.

We also compute the storage cost of the re-aggregated message size of n*m PHI
data collected from $n$ BMS to MCS via PAD in one transmission and $n*m$ in
$n*m$ transmission, respectively. Thus, the required message size for storing
$n*m$ data collected from n BMS in one transmission in single transmission and
n*m transmission are $(n+3)|\mathbb{G}_{1}|+n*m*(|\mathbb{G}_{1}|+9)$ and
$m*n*(2|\mathbb{G}_{1}|+9)$ bytes respectively. It is obvious that PAD is a
storage-rich device so it will not bother storing the large message. The
required message size for storing a prescription at SD is $|\mathbb{G}_{1}|+9$
bytes.

Communication overhead. We consider the size of signcrypted PHI, in order to
evaluate the communication overhead. The proposed system stores the
signcrypted PHI in the PAD and transmits it to the SD via MCS. For
communicating m messages to PAD, BMS requires
$4|\mathbb{G}_{1}|+m*(|\mathbb{G}_{1}|+9)$ and $m*(2|\mathbb{G}_{1}|+9)$ bytes
of overhead in one transmission and $m$ transmissions respectively. For
communicating $m*n$ messages to MCS, PAD needs
$(n+3)|\mathbb{G}_{1}|+n*m*(|\mathbb{G}_{1}|+9)$ and
$m*n*(2|\mathbb{G}_{1}|+9)$ bytes of overhead a transmissions, and min $m*n$
transmissions respectively. And, SD requires ($|\mathbb{G}_{1}|+9$) bytes of
overhead for transmitting a prescription to BMS, as summarized in Table 6.4.

Energy consumption on communication. In our proposed system, BMS consumes
$(0.0715(4+m)|\mathbb{G}_{1}|+0.643m)$ mJ and
$m*(0.143|\mathbb{G}_{1}|+0.643)$ mJ of energy communicating m aggregated
messages collected from a BMS to PAD in one transmission and m transmission
respectively. Figure (6.5) shows the energy consumption for communication
between BMS and PAD on various security parameters. From PAD to SD/MCS, the
proposed scheme consumes $((0.214+0.0715*n*(m+1))|\mathbb{G}_{1}|+m*n*0.643)$
mJ and $m*n*(0.143|\mathbb{G}_{1}|+0.643)$ mJ of energy for transmitting $m*n$
re-aggregated messages in one transmission and $m$ transmission respectively.
Figure (6.6) shows the energy consumption for communication between SD and PAD
on various security parameters. Similarly, for transmitting a prescription
from SD to BMS, the proposed systems consume $(0.0715|\mathbb{G}_{1}|+0.643)$
mJ of energy.

####  6.5.3 Performance Comparison

Here, we compare our proposed EF-IDASC scheme with Selvi et al.’ scheme
[147]-I, scheme [147]-II, scheme [147]-III, Eslami et al. scheme [46], Kar et
al. scheme [82] and Niu et al. scheme [133], in terms of computation (in ms),
communication (in Bytes), energy consumption (in mJ) and security attack.

Figure 6.5: Total energy consumption between BMS and PAD of proposed health care system Figure 6.6: Total energy consumption between PAD and SD/MCS of proposed health care system Table 6.4: Communication overhead comparison of EF-IDASC scheme with related schemes Schemes | Storage cost (in bytes) | Computation cost (in mJ)
---|---|---
| Signcrypt. | Private key | Public key | Energy consumption
[147]-I | 5.5n+2.4 | $|G1|$ | $|ID|$ | $n(2|G1|+|ID|+|T|+|M|)+1|G1|$
[147]-II | 5.5n+4.9 | $|G1|$ | $|ID|$ | $n(2|G1|+|ID|+|T|+|M|)+2|G1|$
[147]-III | 5.5n+2.4 | $|G1|$ | $|ID|$ | $n(2|G1|+|ID|+|T|+|M|)+1|G1|$
[46] | 4.9n+2.4 | $|G1|+|Zq|$ | $|G1|+|ID|$ | $(2n+1)|\mathbb{G}_{1}|$
[82] | 7.6n+2.4 | $|G1|$ | $|ID|$ | $n(3|\mathbb{G}_{1}|+|M|)+1|\mathbb{G}_{1}|$
[133] | 5.1n+2.4 | $|\mathbb{G}_{1}|+|\mathbb{Z}_{q}|$ | $|\mathbb{G}_{1}|+|ID|$ | $n(2|\mathbb{G}_{1}|+|M|)+1|\mathbb{G}_{1}|$
Our | 3.1n+9.7 | $|\mathbb{G}_{1}|$ | $|ID|$ | $n(|\mathbb{G}_{1}|+|ID|+|T|+|M|)+4|\mathbb{G}_{1}|$
Table 6.5: Computation overhead comparison of EF-IDASC scheme with related schemes Schemes | computation cost (in mJ)
---|---
Schemes | Signcrypt | Unsigncrypt | Energy | Total Energy
| (A) | (B) | consumption | consumption
[147]-I | $n(3T_{SM}+1T_{P})$ | $(2n+2)T_{P}$ | 78.85n | 84.35n+2.4
[147]-II | $n(4T_{SM}+1T_{P})$ | $(2n+4)T_{P}+1T_{SM}$ | 86.15n | 91.65n+4.9
[147]-III | $n(3T_{SM}+1T_{P})$ | $2nT_{SM}+4T_{P}$ | 78.85n | 84.35n+2.4
[46] | $n(4T_{SM}+1T_{P})$ | $nT_{P}$ | 86.15n | 91.05n+2.4
[82] | $n(3T_{SM}+1T_{P})$ | $3nT_{SM}+nT_{P}$ | 78.85n | 86.45n+2.4
[133] | $n(4T_{SM}+1T_{P})$ | $nT_{SM}+3T_{P}$ | 86.15n | 91.25n+2.4
Our | $(n+4)T_{SM}+1T_{P}$ | $nT_{SM}+3T_{P}$ | 7.3n+86.1 | 10.4n+95.8

Computation cost. Due to the resource-constraint behaviour of BMS, we only
consider the computation cost on the patient side. In our proposed EF-IDASC
scheme, aggregate-signcryption needs $(n+3)T_{SM}+1T_{P}$ =0.304n+3.28 ms to
signcrypt and combine n messages, while aggregate-unsigncryption needs
$nT_{SM}+3T_{P}$ =0.304n+7.12 ms to unsigncrypts and verifies the aggregated
signcryptext, which is the least cost as compared to schemes [147]-I, scheme
[147]-II, scheme [147]-III, Eslami et al. scheme [46], Kar et al. scheme [82]
and Niu et al. scheme [133], shown in Table 6.5.

Table 6.6: Security comparison of EF-IDASC scheme with related schemes Schemes | computation cost (in mJ)
---|---
| $S_{1}$ | $S_{2}$ | $S_{3}$ | $S_{4}$ | $S_{5}$ | $S_{6}$ | $S_{7}$ | $S_{8}$ | $S_{9}$ | $S_{10}$ | $S_{11}$
[147]-I | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | $\checkmark$ | $\times$
[147]-II | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | $\checkmark$ | $\checkmark$
[147]-III | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | $\checkmark$ | $\checkmark$
[46]] | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\checkmark$
[82] | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | $\checkmark$ | $\checkmark$
[133] | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$
Our | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$

Communication Cost. To evaluate the communication cost, we consider $|M|$ = 4
bytes, $|tt|$ =4 bytes and $|ID|$ =1 bytes. For super-singular curve over the
binary field $\mathbb{F}_{(}2^{271})$ with the order of $\mathbb{G}_{1}$ is
252-bit prime and using compression technique [35], we assume
$|\mathbb{G}_{1}|$ =34 bytes. The proposed EF-IDASC scheme outputs
$4|\mathbb{G}_{1}|+n*(|\mathbb{G}_{1}|+9)$ = (136+43n) bytes of aggregated
signcryptext of n messages, which has the least communication cost as compared
to [147]-I, scheme [147]-II, scheme [147]-III, Eslami et al. scheme [46], Kar
et al. scheme [82] and Niu et al. scheme [133] schemes, shown in Table 6.5

Total Energy consumption. This section evaluates the total energy consumption
for aggregate-signcrypting ‘$n$’ messages and communicating (transmission and
receiving) them from the sender (BMS) to the receiver (SD). The proposed
system consumes (7.3n+86.1) mJ to aggregate-signcrypt and (3.07n+9.7) mJ to
communicate n messages from sender (BMS) to receiver (SD). Thus, it consumes
(10.4n+95.7) mJ of total energy, which has the least energy consumption as
compared to related schemes, such as [147]-I, scheme [147]-II, scheme
[147]-III, Eslami et al. scheme [46], Kar et al. scheme [82] and Niu et al.
scheme [133] for signcrypting and communicating n message. Table 6.5 compares
the total energy consumption of our scheme with other related schemes. Figure
(6.7) shows the total energy consumption comparison of our scheme with another
scheme.

Figure 6.7: Total energy consumption comparison of the proposed healthcare
system with other systems

Security comparison. Here, we use the following notations, $S_{1}$: mutual
authenticity, $S_{2}$: data confidentiality, $S_{3}$: data integrity, $S_{4}$:
Unlinkability $S_{5}$: contextual privacy, $S_{6}$: resilient to key escrow,
$S_{7}$: entity revocation, $S_{8}$: patient anonymity, $S_{9}$: non-
repudiation, $S_{10}$: forward secrecy and $S_{11}$: Public auditing. Table
6.6 illustrates that the proposed EF-IDASC scheme has better security on
comparing with related schemes.

###  6.6 Summary

This chapter presents two escrow-free identity-based signcryption (EF-IDSC)
schemes, namely, escrow-free identity-based signcryption (EF-IDSC) and escrow-
free identity-based aggregated signcryption (EF-IDASC). Both schemes are
designed to be secure against the IND-CCA and EUF-CMA attacks. We provide a
performance analysis of the proposed schemes, demonstrating that they have the
least communication, computation, and storage costs among similar schemes.
Moreover, we implement a secure peer-to-peer video-on-demand (P2P-VoD)
streaming system based on the proposed EF-IDSC scheme and evaluate its
performance. Furthermore, we implement a secure cloud-assisted healthcare
system that achieves public verifiability based on the EF-IDASC scheme. The
evaluation of the system shows that it can provide secure and efficient
healthcare services to patients while preserving their privacy.

[75mm] Science without religion is lame, religion without science is blind.
Albert Einstein

##  Chapter 7 Identity-Based (Anonymous) Authenticated Key Agreement Protocol
for Resource-Constrained Devices

Users have benefited greatly from the recent advancements in ubiquitous
technologies, particularly sensors, which have allowed for the creation of
smart homes, wearable devices, and healthcare monitoring systems, among other
applications and services. However, these technologies present significant
security challenges, particularly in environments with limited resources like
sensor networks. One of the main security concerns with sensor networks is
their wireless communication, which is susceptible to eavesdropping,
interception, and unauthorized access, allowing attackers to intercept and
alter transmitted data and potentially leading to security breaches like data
theft, tampering, and unauthorized access. Another major issue is the limited
security mechanisms available due to resource constraints like processing
power, memory, and battery life, leaving the sensors vulnerable to various
types of attacks, including denial-of-service attacks, data tampering, and
unauthorized access. Additionally, the resource-constrained nature of sensor
networks makes them more vulnerable to node compromise, where an attacker can
gain control of a sensor node and use it to launch attacks on the network,
leading to data theft, manipulation, and service disruption.

This chapter presents two kinds of key agreement protocols for energy-
constrained applications. First, we propose a one-round three-party
authenticated ID-based key agreement protocol (OR-3PID-KAP) whose security is
based on solving ECDLP and BDHP. The proposed system has the least
computational cost, bandwidth cost and message exchange as compared to the
related schemes. Second, we proposed an identity-based anonymous
authentication and key agreement (IBAAKA) protocol for WBAN in the cloud-
assisted environment, which achieves mutual authentication and user anonymity.
Recently, there have been discussed several identity-based key agreement
authentication protocols for lightweight devices. In 2009, Yang et al. [174]
presented an identity-based authentication and key agreement scheme using
elliptic curve cryptography. However, Yoon et al. [179] showed that the scheme
[174] was prone to impersonation attacks and did not provide perfect forward
secrecy. Similar to Yang et al. scheme [174], Cao et al. [18] discussed an
identity-based authenticated key agreement protocol with the least message
exchange. However, they did not achieve user anonymity and unlinkability.

In 2015, Tsai et al. [158] proposed a new identity-based authentication
protocol for mobile cloud computing services where the mobile user and service
provider need to register with a trusted third party that provides the long-
term secret key for them. This scheme was computationally inefficient as it is
based on bilinear pairing. Jiang et al. [76] proved that the scheme [158] is
not secure against the impersonation attack and did not provide MA. In 2016,
Yang et al. [176] presented a lightweight anonymous authentication scheme with
untraceability for mobile cloud computing. The scheme [176] provides a set of
pseudo-IDs and corresponding secret keys to each user. Although managing the
set of pseudo-IDs and secret keys is a challenge in a lightweight environment.
In 2018, Kumar et al. proposed a two-party identity-based authenticated key
agreement protocol [99] for resource constraint devices. However, it does not
achieve user anonymity. Recently, He et al. [66] present a new provably secure
authentication scheme using an elliptic curve. Wang et al. [166] demonstrate
that [66] does not provide MA and could not resist a reflection attack.
Recently, Islam et al. [69] improved the Yoon et al. scheme [179] and
presented a new authentication scheme, but it is not resilient to denial of
service attacks. Recently, Lui et al. [117] designed a new certificate-less
authentication scheme for the WBAN system, which uses the pairing on elliptic
curves. He et al. [67] proved that the scheme [117] is not suitable for a
secure e-health care system as it is susceptible to impersonation attacks.
Besides, they presented an AA scheme for the WBAN system and show that their
scheme is provably secure.

Zhao [186] found that the scheme [117] is insecure against the public verifier
table and does not achieve user anonymity followed by proposed an AA protocol
for the WBAN system using ECC. Wang et al. [164] proved that the scheme [186]
is incapable of achieving user unlinkability and put forward an improved
authentication protocol using the pairing for WBANs. Jiang et al. [75] show
that protocol [164] is susceptible to user impersonation attacks. Recently,
Jia et al. [74] proposed an identity-based AA and key agreement scheme for
mobile edge computing settings, which satisfies MA as well as user anonymity
and untraceability. Li et al. [114] proposed an efficient end-to-end
authenticated scheme for the healthcare system using ECC. Recently, in 2020,
Sowjanya et al. [153] proved that Li et al. [114] scheme has some security
loopholes followed by they address such issues and presented a new end-to-end
authenticated scheme for healthcare system using ECC. In the same year,
Nikooghadam et al. [132] presented a secure two-factor authenticated key
agreement protocol using ECC. However, the scheme satisfied security; it did
not preserve user anonymity.

In this direction, we observed that none of the AA schemes is suitable for the
e-health care system. Emerging technology like cloud computing, together with
the WBAN system, could be advantageous for the next-generation e-health care
system. Today, it remains a challenge to design an efficient cloud-enabled
anonymous authenticated key agreement protocol for the WBAN system.

Figure 7.1: Proposed cloud-enabled WBAN network model

###  7.1 System Model

This section gives a brief discussion of the network and security model of the
proposed WBAN cloud-enabled architecture.

####  7.1.1 Network Architecture

The proposed model consists of five entities: Network manager (NM), cloud
servers (CS), leaf node (LN), root node (RN) and target node (TN), as
illustrated in Figure (7.1).

  * •

NM: It is a trusted third party that registers the leaf node, root node,
target node, and cloud server and provides them with the secret keys
corresponding to their identities.

  * •

LN: LN is a resource-constraint wearable/implanted sensor that has limited
storage space, battery life, and computation power. It monitors and collects
the patient’s PHI and forwards it to the TN via RN.

  * •

TN: TN is a resource-rich remote system that provides medical services to the
patient.

  * •

RN: It is an intermediate node between the leaf node and the target node, for
example, a smartphone. Since LN has limited storage and power, the RN helps LN
with long-range data transmission and data storage. It collects the patient’s
PHI data from the multiple LNs without knowing any information about it and
forwards it to the TN.

  * •

CS: It is a computationally rich storage device that stores PHI data. Due to
the enormous amount of medical data, each target node/leaf node needs to
offload its data into the cloud server. Before providing any service to the
requested user, CS must be registered with the NM and preloaded with the
system’s public parameters.

####  7.1.2 Security Threat

Based on the security model of the key agreement protocol by Bellare et al.
[10], we discuss the security model of our proposed identity-based anonymous
authentication and key agreement (IBAAKA) protocol. It can be defined as a
game played between an adversary $A$ and challenger $C$. Suppose a scheme
denotes $\Gamma$ and two participants denote as P, where P can be a sensor LN
and cloud server CS. Let $O_{P}^{i}$ denote the random oracle of $i^{th}$
instant of participant $P$. An adversary adaptively communicates to the scheme
$\Gamma$ by asking some queries to the random oracle and obtains information
from responses. $A$ asks the following oracle queries:

  * •

h(m): On given message m, $Adv$ asks a query to the hash oracle, and the
oracle checks if m has been submitted previously. If not, randomly pick an
element x and return it to A. Otherwise, return the same value.

  * •

Extract(ID): On given identity ID, $Adv$ execute this oracle, and the oracle
gives the private key corresponding to the ID.

  * •

Send($P^{i}$, msg): On given message msg, when $Adv$ submits a query to random
oracle $O_{P}^{i}$, the oracle yields the real result output by the actual
scheme. $Adv$ will execute the Send($P^{i}$,start) query to begin the
protocol.

  * •

Reveal($P^{i}$): On a given query, A asks a query and obtains the session
shared key of participant $\Gamma_{P}^{i}$.

  * •

Execute($LN^{i}$,$CS^{i}$): When $Adv$ asks a query, this oracle gives all the
message exchange between the instance $O_{LN}^{i}$ and $O_{CS}^{j}$ during the
process.

  * •

Test($O_{P}^{i}$): $Adv$ can ask this query only once during the whole
process. The oracle randomly picks a bit $b\in\\{0,1\\}$ and outputs the
original session key SK if $b=1$; otherwise, outputs a random value.

Partnership: Two instances, says $O_{LN}^{i}$ and $O_{CS}^{j}$ are said to be
partner if:

  * •

they exchange messages directly to each other.

  * •

Share same session key.

  * •

Except $O_{LN}^{i}$ and $O_{CS}^{j}$, no other instance accepts session key.

Freshness: An instance is said to fresh if the session key SK has been
accepted without the Reveal and Extract queries executed on $O_{P}^{i}$ and
its partner.

Now, we give the brief on the two-security definition that would be concluded
from the above game playing between adversary $A$ and challenger $C$.

On the given output coming from the Test oracle, $A$ guesses a bit
$b^{\prime}$. If $b^{\prime}=b$, $A$ could break the security of the
authentication protocol. The advantage of choosing $b$ can be defined as
$Adv(A)=|Pr[b^{\prime}=b]-\frac{1}{2}|$.

######  Definition 7.1.

(Provable security). If any probabilistic polynomial time (PPT) bounded
adversary $Adv$ has negligible advantage $Adv(Adv)$ in the above game, we say
that the authenticated protocol is provably secure.

We say that if an adversary $A$ forges the parameters exchange during
transmission on behalf of the participant and forged parameters are received
by the partner; then $Adv$ successfully breaks the mutual authentication (MA)
protocol.

The advantage of breaking the MA is denoted as $Adv(A)=|Pr[E_{LN-
CS}]+Pr[E_{CS-LN}]|$, where $E_{LN-CS}$ and $E_{CS-LN}$ represent the event
that $A$ successfully impersonates the LN and produces an actual login
parameter and the event that $Adv$ produces a valid response, respectively.

######  Definition 7.2.

(MA security). If any PPT bounded adversary $Adv$ has negligible advantage
Adv(A) in the above events. We say that the authenticated protocol is MA
secure.

####  7.1.3 Security Requirement

Here, we discuss the following security requirements for considering secure
WBAN systems.

  * •

User Anonymity. It ensures that the identity of the legal user must be hidden
from the adversary during the authentication phase. The sensor collected data
refers to the user’s personal information, so he must be enjoyed the wireless
medical facilities, and at the same time, his privacy will not be revealed to
the unauthentic third person. Thus, a user’s identity should be hidden from
everyone except the network manager and CS.

  * •

Perfect forward secrecy. It ensures that the adversary cannot learn anything
about the session key of the previous session, even if he gets the current
private key of a user.

  * •

Mutual authentication. The MA ensures that LN and CS must be authenticated to
each other which means the PHI is coming from the intended LN and arriving at
the predetermined CS. Therefore, MA confirms the legitimacy of the user and
CS’s identities in the network.

  * •

Session key establishment. In order to achieve the integrity, authenticity,
and confidentiality of PHI data, it is necessary to establish a shared session
key between the LN and CS.

  * •

Non-traceability. In order to protect user privacy, only user anonymity is not
sufficient, but the scheme must achieve non-traceability. The non-traceability
ensures that the user’s action should not be traced by the network manager and
cloud server.

  * •

Key replacement attack. It is ensured that the adversary could not replace the
public key of CS/LN to forge a valid signature on any message.

###  7.2 Proposed Cloud-assisted ID-based AA Protocol

Here, we discuss the implementation of OR-3PID-KAP and IBAAKA schemes.

####  7.2.1 One round 3-Party ID-based Key Agreements Protocol

Suppose three leaf nodes, say A, B and C, are in the proposed network model,
as disused in section 7.1, and want to share secret PHI amongst themselves in
a secure way. Thus, they should be agreed on a shared secret key, $K_{ABC}$
using the OR-3PID-KAP scheme that consists of three algorithms: Setup, Key
Generation and Key agreement.

  * •

Setup: On given security parameter $k$, NM select a master key
$s\in\mathbb{Z}_{q}$ and set the public key as $P_{Pub}=sP$, where $P$ is the
generator of $\mathbb{G}_{1}$. Let two cryptographic hash functions are
$H_{1}:\\{0,1\\}^{n}\times\mathbb{G}_{1}\rightarrow\mathbb{Z}_{q}$ and
$H_{2}:\\{0,1\\}^{n}\rightarrow\\{0,1\\}^{n}$, and a bilinear map
$e:\mathbb{G}_{1}\times\mathbb{G}_{1}\rightarrow\mathbb{G}_{2}$. Now NM
published the public parameters
$pp=<P,P_{Pub},\mathbb{G}_{1},\mathbb{G}_{2},e,H_{1},H_{2}>$ and keeps master
key $s$ secret.

  * •

Extract: This phase takes system parameter pp, master key $s$, and node’s
identities $ID_{A}$, $ID_{B}$ and $ID_{C}$ as input and gives the identity-
based long term private key $S_{A}$, $S_{B}$ and $S_{C}$. NM performs the
following operations:

    * –

Pick three random number $r_{A}$, $r_{B}$ and $r_{C}\in\mathbb{Z}_{q}$, and
computes:

$\displaystyle R_{A}$ $\displaystyle=r_{A}P,Q_{A}=H_{1}(ID_{A}||R_{A})$
$\displaystyle R_{B}$ $\displaystyle=r_{B}P,Q_{B}=H_{1}(ID_{B}||R_{B})$
$\displaystyle R_{C}$ $\displaystyle=r_{C}P,Q_{C}=H_{1}(ID_{c}||R_{C})$

    * –

NM computes private key as $S_{A}=r_{A}sQ_{A}$, $S_{B}=r_{B}sQ_{B}$,
$S_{C}=r_{C}sQ_{C}$ and sends $<S_{A},R_{A}>$, $<S_{B},R_{B}>$ and
$<S_{C},R_{C}>$ to nodes $A$, $B$ and $C$ respectively, via a secure channel
or preloaded at the time of node installation.

    * –

Each LN can validate its private key with the following equation.

$\displaystyle e(S_{i}P,P)\overset{?}{=}e(H_{1}(ID_{i}||R_{i})P_{Pub},R_{i})$

Correctness is verified as:

$\displaystyle e(S_{i}P,P)$
$\displaystyle=e(r_{i}sQ_{i}P,P)=e(r_{i}sH_{1}(ID_{i}||R_{i})P,P)$
$\displaystyle=e(sH_{1}(ID_{i}||R_{i})P,r_{i}P)=e(H_{1}(ID_{i}||R_{i})P_{Pub},R_{i})$

  * •

Key Agreement: Shared session key $S_{k}$ is computed as follows:

$\displaystyle A\rightarrow B,C$
$\displaystyle:a\in\mathbb{Z}_{q},T_{A}=aR_{A}$ $\displaystyle B\rightarrow
A,C$ $\displaystyle:b\in\mathbb{Z}_{q},T_{B}=bR_{B}$ $\displaystyle
C\rightarrow B,A$ $\displaystyle:c\in\mathbb{Z}_{q},T_{C}=cR_{C}$

A: Given $T_{B}$ and $T_{C}$, LN A compute $K_{A|BC}$:

$\displaystyle K_{A|BC}$ $\displaystyle=e(Q_{B}T_{B},Q_{C}T_{C})^{aS_{A}}$
$\displaystyle S_{k}$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{A|BC})$

B: Given $T_{A}$ and $T_{C}$, LN $B$ compute $K_{B|AC}$:

$\displaystyle K_{B|AC}$ $\displaystyle=e(Q_{A}T_{A},Q_{C}T_{C})^{bS_{B}}$
$\displaystyle S_{k}$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{B|AC})$

C: Given $T_{A}$ and $T_{B}$, LN $C$ compute $K_{C|AB}$:

$\displaystyle K_{C|AB}$ $\displaystyle=e(Q_{A}T_{A},Q_{B}T_{B})^{cS_{C}}$
$\displaystyle S_{k}$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{C|AB})$

The common secret key $K_{ABC}$ are agreed because:

$\displaystyle K_{A|BC}$ $\displaystyle=e(Q_{B}T_{B},Q_{C}T_{C})^{aS_{A}}$
$\displaystyle=e(Q_{B}br_{B}P,Q_{C}cr_{C}P)^{ar_{A}sQ_{A}}$
$\displaystyle=e(P,P)^{sabcQ_{A}r_{A}Q_{B}r_{B}Q_{C}r_{C}}$

$\displaystyle K_{B|AC}$ $\displaystyle=e(Q_{A}T_{A},Q_{C}T_{C})^{bS_{B}}$
$\displaystyle=e(Q_{A}ar_{A}P,Q_{C}cr_{C}P)^{br_{B}sQ_{B}}$
$\displaystyle=e(P,P)^{sabcQ_{A}r_{A}Q_{B}r_{B}Q_{C}r_{C}}$

$\displaystyle K_{C|AB}$ $\displaystyle=e(Q_{A}T_{A},Q_{B}T_{B})^{cS_{C}}$
$\displaystyle=e(Q_{A}ar_{A}P,Q_{B}br_{B}P)^{cr_{c}sQ_{C}}$
$\displaystyle=e(P,P)^{sabcQ_{A}r_{A}Q_{B}r_{B}Q_{C}r_{C}}$

The above three equations verify the correctness of shared session key
$K_{ABC}=K_{A|BC}=K_{B|AC}=K_{C|AB}$.

####  7.2.2 ID-based Anonymous Authenticated Key Agreement Protocol

This section archives the anonymous authentication between the LN and the
cloud. The proposed IBAAKA protocol consists of three algorithms: Setup,
registration and authentication.

  * •

Setup: Given a security parameter $k$, the NM chooses a random $k$-bit large
prime number $q$, an additive group $\mathbb{G}_{1}$ and multiplicative group
$\mathbb{G}_{2}$ of order of $q$. Let $P$ be the generator of $\mathbb{G}_{1}$
and pairing function
$e:\mathbb{G}_{1}\times\mathbb{G}_{1}\rightarrow\mathbb{G}_{2}$. Suppose five
cryptographic hash functions,
$H_{1}:\\{0,1\\}^{I}\times\mathbb{G}_{1}\rightarrow\mathbb{Z}_{q}^{*}$,
$H_{2}:\\{0,1\\}^{2I}\times\mathbb{G}_{1}^{2}\rightarrow\mathbb{Z}_{q}^{*}$,
$H_{3}:\mathbb{G}_{2}\rightarrow\\{0,1\\}^{I+t}\times\mathbb{G}_{1}^{2}\times\mathbb{Z}_{q}^{*}$,
$H_{4}:{0,1}^{(}2I+t)\times\mathbb{G}_{1}^{2}\rightarrow\mathbb{Z}_{q}^{*}$,
and
$H_{5}:\\{0,1\\}^{2I}\times\mathbb{G}_{1}^{3}\rightarrow\mathbb{Z}_{q}^{*}$.
NM chooses an element $s_{0}\in\mathbb{Z}_{q}^{*}$ (master key) and set
$P_{0}=s_{0}P$ (pubic key). NM keeps $s_{0}$ secret and published the public
parameter
$pp=<k,q,e,P,P_{0},\mathbb{G}_{1},\mathbb{G}_{2},H_{1},H_{2},H_{3},H_{4},H_{5}>$.

  * •

Registration: This phase registers the leaf node and cloud server as follows:

    * –

Cloud server registration: Cloud server picks identity
$ID_{CS}\in\\{0,1\\}^{*}$ and requests to the NM for its private key. The NM
checks $ID_{CS}$, chooses a random integer $r_{CS}\in\mathbb{Z}_{q}^{*}$,
computes the private key $R_{CS}=r_{CS}P$,
$s_{CS}=r_{CS}+s_{0}H_{1}(ID_{CS}||R_{CS})$ and sends it to the CS. Now, CS’s
private and public keys are denoted as $s_{CS}$ and $<ID_{CS},R_{CS}>$
respectively.

    * –

Leaf Node registration: LN picks identity $ID_{LN}\in\\{0,1\\}^{*}$ and
requests to the NM for its private key. The NM checks $ID_{LN}$, chooses a
random integer $r_{LN}\in\mathbb{Z}_{q}^{*}$, computes the private key
$R_{LN}=r_{LN}P$, $s_{LN}=r_{LN}+s_{0}H_{1}(ID_{LN}||R_{LN})$ and sends it to
the LN. LN’s private key and public key are denoted as $s_{LN}$ and
$<ID_{LN},R_{LN}>$ respectively. Additionally, NM pre-stores the parameter
$R_{CS}$ in LN’s storage.

Figure 7.2: Authentication phase of proposed IBAAKA scheme

  * •

Authentication: After registration, this algorithm performs the MA between LN
and CS in an intervening way, also illustrated in Figure (7.2).

    * –

Leaf node (LN) chooses an element $x\in\mathbb{Z}q^{*}$, sets $X=xP$, and
computes the key $\mathbb{G}{LN}=x(R_{CS}+H_{1}(ID_{CS}||R_{CS})P_{0})$.

    * –

LN chooses a current time stamp $T_{LN}$ and compute
$h=H_{2}(ID_{LN}||R_{LN}||T_{LN}||X)$, $k=s_{LN}+xh$ and encrypts
$W=H_{3}(\mathbb{G}_{LN})\oplus(ID_{LN}||R_{LN}|||T_{LN}||X||k)$ and sends
$<W,X>$ to the CS.

    * –

On receiving the parameters, CS computes key $\mathbb{G}_{CS}=s_{CS}X$ and
extracts $ID_{LN}$ on decrypting $W$ using key $\mathbb{G}_{CS}$ as
$ID_{LN}R_{LN}||T_{LN}||X||k=H_{3}(\mathbb{G}_{CS})\oplus W$.

    * –

CS checks the timestamp $T_{LN}$ and checks whether the equation
$kP\overset{?}{=}R_{L}N+H_{1}(ID_{LN}||R_{LN})P_{0}+hX$ holds, where,
$h=H_{2}(ID_{LN}||R_{LN}||T_{LN}||X)$.

From the given equations, we have:

$\mathbb{G}{SN}=x(R{CS}+H_{1}(ID_{CS}||R_{CS})P_{0})$

$kP\overset{?}{=}R_{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}+H_{2}(ID_{LN}||R_{LN}||T_{LN}||X)X$

The consistency of the equations is verified as:

$\displaystyle\mathbb{G}{LN}$
$\displaystyle=x(R{CS}+H_{1}(ID_{CS}||R_{CS})P_{0})\ $
$\displaystyle=x(r_{CS}P+s_{0}H_{1}(ID_{CS}||R_{CS})P)\ $
$\displaystyle=x(r_{CS}+s_{0}H_{1}(ID_{CS}||R_{CS}))P\ $
$\displaystyle=s_{CS}X=\mathbb{G}{CS}\ \ kP$ $\displaystyle=(s{LN}+xh)P\ $
$\displaystyle=(s_{LN}P+xhP)\ $
$\displaystyle=(r_{LN}+s_{0}H_{1}(ID_{LN}||R_{LN}))P+xhP\ $
$\displaystyle=(r_{LN}P+s_{0}H_{1}(ID_{LN}||R_{LN})P+xhP)\ $
$\displaystyle=(R_{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}+hX)$

  * •

Now, CS chooses a current time stamp $T_{CS}$ and an element
$y\in\mathbb{Z}_{q}^{*}$, sets $Y=yP$ and
$t=H_{5}(ID_{LN}||ID_{CS}||T_{CS}||X||Y)$.

  * •

CS computes session key as $SK_{CS}=H_{6}(key_{CS}||ID_{LN}||ID_{CS}||Y||X)$,
where $key_{CS}=ytX$. Then sends $<t,T_{CS},Y>$ to the LN.

  * •

LN checks the timestamp $T_{CS}$ and check
$t\overset{?}{=}H_{5}(ID_{LN}||ID_{CS}||T_{CS}||X||Y)$.

  * •

LN computes the session key as $key_{LN}=xtY$ and
$SK_{LN}=H_{6}(key_{LN}||ID_{LN}||ID_{CS}||Y||X)$.

From the above equation, we have $key_{LN}=xtY=xtyP=tyX=key_{CS}$

###  7.3 System Analysis

Here, we discuss the security proof and performance evaluation of proposed
OR-3PID-KAP and IBAAKA schemes.

####  7.3.1 Security Analysis of OR-3PID-KAP Scheme

Here, we discuss the security analysis of the OR-3PID-KAP scheme.

######  Theorem 7.1.

The proposed OR-3PID-KAP scheme is provable and secure.

###### Proof.

Let two random oracle models be H1 and H2 and assume ECDLP and BDH problems
are difficult to compute, then our proposed one-round key agreement protocol
is provable and secures against the adversary. The security proof of our
proposal is proved similar to Theorem 2 in Wang et al. [168]. ∎

######  Theorem 7.2.

The proposed OR-3PID-KAP scheme is achieved the perfect forward secrecy.

###### Proof.

The use of pre-image and uniformly distributed hash function H2 guarantees
perfect forward secrecy. The output of hash function H2 gives the shared
session key:

$\displaystyle S_{k}$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{A|B})$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{B|AC})$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{C|BA})$

If the adversary wishes to compromise the long-term private key, he must need
to compute the user’s secret values a, b and c which is equivalent to solving
the ECDLP and CDHP problem. Thus, assuming the ECDLP and CDHP are hard, our
proposed scheme is resilient to perfect forward secrecy attacks.

∎

######  Theorem 7.3.

The proposed OR-3PID-KAP scheme achieved Mutual Authentication.

###### Proof.

In our proposed scheme, BS generates the user’s long-term private key using
master key s and a random variable $r_{i}$. Using the long-term private key,
identity and random integer, nodes A, B and C in the sensor network compute a
common session key $S_{k}$. Because session key $S_{k}$ includes the private
key and identification of all nodes thus only registered/authenticated nodes
can establish a session shared key. Therefore, the proposal provides mutual
authentication $S_{k}$. ∎

######  Theorem 7.4.

The proposed OR-3PID-KAP scheme is secured against Man-in-the-middle attacks.

###### Proof.

Suppose an adversary and his assistant $X$ impersonate two nodes, say $A$ and
$B$. Suppose the adversary attacks the public channel and obtains information
$<R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},ID_{1},\dots,ID_{n}>$.

Let the attacker choose some random numbers $a^{x}$, $b^{x}$, $c^{x}$,
$r_{A}^{x}$, $r_{B}^{x}$, and $r_{C}^{x}\in\mathbb{Z}_{q}$, and compute the
parameters $R_{A}^{x}=r_{A}^{x}P$, $R_{B}^{x}=r_{B}^{x}P$,
$R_{C}^{x}=r_{C}^{x}P$, $T_{A}^{x}=a^{x}R_{A}^{x}$,
$T_{B}^{x}=b^{x}R_{B}^{x}$, and $T_{C}^{x}=b^{x}R_{C}^{x}$, as defined below:

$\displaystyle A$ $\displaystyle\rightarrow B,C:\text{pick
}a\in\mathbb{Z}_{q},T_{A}=aR_{A}$ $\displaystyle X_{A}$
$\displaystyle\rightarrow B,C:\text{pick
}a_{x}\in\mathbb{Z}_{q},T_{A}^{x}=a^{x}R_{A}$ $\displaystyle B$
$\displaystyle\rightarrow A,C:\text{pick }b\in\mathbb{Z}_{q},T_{B}=bR_{B}$
$\displaystyle X_{B}$ $\displaystyle\rightarrow A,C:\text{pick
}b_{x}\in\mathbb{Z}_{q},T_{B}^{x}=b^{x}R_{B}$ $\displaystyle C$
$\displaystyle\rightarrow B,A:\text{pick }c\in\mathbb{Z}_{q},T_{C}=cR_{C}$
$\displaystyle X_{C}$ $\displaystyle\rightarrow B,A:\text{pick
}c_{x}\in\mathbb{Z}_{q},T_{C}^{x}=c^{x}R_{C}$

The nodes then compute as:

$\displaystyle A:K_{A|BC}$
$\displaystyle=e(Q_{B}T_{B}^{x},Q_{C}T_{C}^{x})^{aS_{A}}=e(P,P)^{sa^{x}b^{x}c^{x}Q_{A}r_{A}Q_{B}r_{B}Q_{C}r_{C}}$
$\displaystyle B:K_{B|AC}$
$\displaystyle=e(Q_{A}T_{A}^{x},Q_{C}T_{C}^{x})^{bS_{B}}=e(P,P)^{sa^{x}b^{x}c^{x}Q_{A}r_{A}Q_{B}r_{B}Q_{C}r_{C}}$
$\displaystyle C:K_{C|AB}$
$\displaystyle=e(Q_{A}T_{A}^{x},Q_{B}T_{B}^{x})^{cS_{C}}=e(P,P)^{sa^{x}b^{x}c^{x}Q_{A}r_{A}Q_{B}r_{B}Q_{C}r_{C}}$

From the given parameters, the attacker $X$ computes the following session
keys:

$\displaystyle X_{A}:K_{X|BC}$
$\displaystyle=e(Q_{B}T_{B},Q_{C}T_{C})^{a^{x}S_{A}^{x}}=e(P,P)^{a^{x}S_{A}^{x}bcQ_{B}r_{B}Q_{C}r_{C}}$
$\displaystyle X_{B}:K_{X|AC}$
$\displaystyle=e(Q_{A}T_{A},Q_{C}T_{C})^{b^{x}S_{B}^{x}}=e(P,P)^{aS_{B}^{x}b^{x}cQ_{A}r_{A}Q_{C}r_{C}}$
$\displaystyle X_{C}:K_{X|AB}$
$\displaystyle=e(Q_{A}T_{A},Q_{B}T_{B})^{cS_{C}}=e(P,P)^{acS_{C}^{x}c^{x}Q_{A}r_{A}Q_{B}r_{B}}$

For a successful attack, the attacker must compute the value of the node’s
long-term private key and random secret key, which is equivalent to solving
the ECDLP problem. In this sense, we say that our proposed scheme is secure
against man-in-the-middle attacks.

∎

######  Theorem 7.5.

The proposed OR-3PID-KAP scheme is secured against no key control.

###### Proof.

In our protocol, session Key $S_{k}$ is computed as:

$\displaystyle S_{K}$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{A|BC})$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{B|AC})$
$\displaystyle=H_{2}(ID_{A},ID_{B},ID_{C},R_{A},R_{B},R_{C},T_{A},T_{B},T_{C},K_{C|BA})$

where $K_{A|BC}$, $K_{B|AC}$,and $K_{C|AB}$ are defined in section 3, and $a$,
$b$ and $c$ are node’ random chosen secret number. It can be seen that any
node could not pre-compute the session key $S_{k}$ without knowing the
information of others’ secret keys. Therefore, it proves that our protocol
does not have control over the key. ∎

######  Theorem 7.6.

The proposed OR-3PID-KAP scheme is secured against known session key attacks.

###### Proof.

Each node evaluates the hash of the participant’s identities, public
parameters, and secret key of each node to compute the session key $S_{k}$.
Since the hash function’s response is uniformly distributed in
$\\{0,1\\}^{k}$, the probability that two session key has a relation is $1/2k$
which is negligible. Therefore, our protocol is resilient to the known session
key attacks under the assumption of pre-image and uniformly distributed
cryptographic hash function $H_{2}$. ∎

####  7.3.2 Security Analysis of IBAAKA Scheme

######  Theorem 7.7.

Suppose an adversary $Adv$ can compute the legal login parameters and break
the LN-to-CS authentication of the proposed IBAAKA scheme with non-negligible
probability. There could be a challenger$Ch$ that can solve the ECDL problem
with probability $\epsilon_{0}\geq\epsilon(1-1/q)/q_{H}1$, where $q_{H}1$
represents a query $H_{1}$ run by $A$.

###### Proof.

Consider an adversary $A$ that generates a valid login request tuple $<W,X>$,
which can be justifiable by the CS with a non-negligible probability
$\epsilon$. Here are the given equations:

$\displaystyle X$ $\displaystyle=xP\ \mathbb{G}{LN}$
$\displaystyle=x(R{CS}+H_{1}(ID_{CS}||R_{CS})P_{0})\ h$
$\displaystyle=H_{2}(ID_{LN}||R_{LN}||T_{LN}||X)\ k$ $\displaystyle=s_{LN}+xh\
W$ $\displaystyle=H_{3}(\mathbb{G}{LN})\oplus(ID{LN}||R_{LN}||T_{LN}||X||k)$

Using the forking lemma, given in [138], adversary $A$ will produce another
tuple $<W^{\prime},X>$ on a different choice of $H_{2}$ in the simulation,
where $X=xP$, $\mathbb{G}{LN}=x(R{CS}+H_{1}(ID_{CS}||R_{CS})P_{0})$,
$h^{\prime}=H^{\prime}2(ID{LN}||R_{LN}||T_{LN}||X)$,
$k^{\prime}=s_{LN}+xh^{\prime}$, and
$W^{\prime}=H_{3}(\mathbb{G}{LN})\oplus(ID{LN}||R_{LN}||T_{LN}||X||k)$.

As $<W,X>$ and $<W^{\prime},X>$ can provide satisfied verification on the CS
side, we have the following two equations:

$\displaystyle kP$ $\displaystyle=R_{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}+hP\
k^{\prime}P$ $\displaystyle=R_{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}+h^{\prime}P$

Suppose, $R_{LN}=aP_{0}+bP$, $s_{LN}=b$, and $H_{1}(ID_{LN}||R_{LN})=-a$. Then
we have,

$\displaystyle h^{\prime}kP-hk^{\prime}P$
$\displaystyle=h^{\prime}(R_{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}+hP)-h(R_{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}+h^{\prime}P)\
$
$\displaystyle=h^{\prime}R_{LN}+h^{\prime}H_{1}(ID_{LN}||R_{LN})P_{0}+h^{\prime}hP-
hR_{LN}-hH_{1}(ID_{LN}||R_{LN})P_{0}-hh^{\prime}P\ $
$\displaystyle=(h^{\prime}-h)R_{LN}+(h^{\prime}-h)H_{1}(ID_{LN}||R_{LN})P_{0}\
$ $\displaystyle=(h^{\prime}-h)(aP_{0}+bP)+(h^{\prime}-h)(-a)P_{0}\ $
$\displaystyle=(h^{\prime}-h)bP$

and,

$\displaystyle bP=(h^{\prime}-h)^{-1}(h^{\prime}k-hk^{\prime})P$

Thus, for any given tuple $(P,bP)$ of the ECDL problem, adversary $Adv$ solves
the problem with a non-negligible advantage $\epsilon_{0}\geq(1-1/q)/q_{H1}$.
Therefore, no adversary could break the LN-to-CS authentication. Thus, our
proposed AA scheme achieves LN-to-CS authentication.

∎

######  Theorem 7.8.

Suppose an adversary $Adv$ can compute legal login parameters and break the
CS-to-LN authentication of the proposed IBAAKA scheme with non-negligible
probability. There could be constructed a challenger$Ch$ that solves the ECDL
problem with probability $\epsilon_{0}\geq\epsilon(1-1/q)/q_{H}1$, where
$q_{H}1$ represents a query $H_{1}$ made by A.

###### Proof.

Suppose $E^{LN-to-CS}$ represents an event that can break the LN-to-CS
authentication, and $E^{CS-to-LN}$ represents an event that can break our
proposed protocol’s CS-to-LN authentication. From the proof in Lemma 1, we
suppose that the event $E^{LN-to-CS}$ does not occur. The event $E^{CS-to-LN}$
denotes that the adversary can forge a response $<t,T_{CS},Y>$ upon
intercepting the login tuple $<W,X>$. Now, one of three events will occur:

  * •

The adversary may pick the correct value of $t$, so the probability that this
event occurs is $1/q^{k}$, where $k$ is the size of the hash function.

  * •

The parameters $X$ and $k$ have been computed in another session. Let the
adversary $Adv$ make $q_{LN}$ queries to the oracle of LN. The probability
that this event occurs is
$(q_{LN}/q)\times(q_{LN}/q)\times(q_{LN}-2)\leq(q_{LN}^{3})/q^{2}$.

  * •

On the given parameters $<key_{CS},ID_{LN},ID_{CS},Y,X>$, the adversary $A$
runs queries on the $H_{6}$ oracle. Now we have $Pr[E^{CS-to-LN}|E^{CS-to-
LN}]\leq\epsilon_{0}+1/q^{k}+(q_{LN}^{3})/q^{2}$.

Suppose $X=cP$, $R_{LN}=aP_{0}+bP$, $s_{LN}=b$, and
$H_{1}(ID_{LN}||R_{LN})=-a$ for some values $a,b,c\in\mathbb{Z}q^{*}$. For an
instance $<X,R{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}>=(cP,aP_{0}+bP-aP_{0})=(cP,bP)$
of the Computational Diffie-Hellman (CDH) problem, $Adv$ can compute
$s_{CS}=bcP$. In this way, $Adv$ could solve the CDH problem with a non-
negligible probability $\epsilon_{0}\geq\epsilon-1/q^{k}-(q_{LN}^{3})/q^{2}$.

Therefore, our proposed AA scheme achieves the CS-to-LN authentication, and no
adversary could break the CS-to-LN authentication. ∎

######  Theorem 7.9.

Suppose the ECDL problem is hard. Our proposed IBAAKA is MA secure.

###### Proof.

From Lemma 8.7 and 8.8, we proved that no adversary could break our proposed
AA protocol’s LN-to-CS authentication or CS-to-LN authentication. Thus, it is
proved that the proposed AA protocol is MA secure. ∎

######  Theorem 7.10.

Under the assumption of the random oracle model and hardness of computation
Diffie–Hellman problem, our proposed IBAAKA scheme is AKA-secure.

###### Proof.

Let an adversary $Adv$ correctly guess the random bit $b$ value in a Test
query with a non-negligible advantage $\epsilon$. Suppose $E^{H_{SK}}$ is the
event that $Adv$ could guess the session key correctly, so we have
$Pr[E^{H_{SK}}]\geq\epsilon/2$. Suppose the event that shows $Adv$ runs the
Test query to the oracle LN in the $i$-th instance is $E^{Test(LN)}$, and the
event that shows $Adv$ runs the Test query to the oracle CS in the $j$-th
instance is $E^{Test(CS)}$. Also, the event that shows $Adv$ breaks the LN-to-