# Secure Encapsulation Schemes Using Key Recovery System in IoMT Environments
## 6 Analysis of the Proposed Schemes
### Proposed Scheme-I (Key Recovery System Using Signcryption)  
* KRF integrity: The device, \(Med\), \(KRA\), and \(KRC\) participating in key recovery should not be able to transform a device key that generates a \(KRF\) maliciously. To solve this problem, this includes the session key hash in parameter \(r\) of the \(KRF\). Therefore, \(KRF\) data cannot be forged. Only the device can access the \(KRF\) session key generated by the device. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & [6] & [7] & [8] & [10] & [11] & [12] & [13] & \
\begin{tabular}{c} **Proposed** \\ **Scheme-I** \\ \end{tabular} &
\begin{tabular}{c} **Proposed** \\ **Scheme-II** \\ \end{tabular} \\ \hline KRF integrity & - & - & - & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\vee\) & \(\vee\) \\ \hline Non-repudiation & - & - & - & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\vee\) & \(\times\) \\ \hline Attack on group authentication & - & \(\vee\) & - & \(\vee\) & \(\times\) & \(\times\) & \(\vee\) & \(\vee\) & - \\ detection & - & \(\vee\) & - & \(\vee\) & \(\times\) & \(\times\) & \(\vee\) & \(\vee\) & - \\ \hline Single point of failure protection & \(\times\) & \(\times\) & \(\times\) & \(\vee\) & \(\vee\) & \(\times\) & \(\times\) & \(\vee\) & \(\times\) \\ \hline Data confidentiality & \(\vee\) & \(\vee\) & \(\vee\) & \(\vee\) & \(\vee\) & \(\vee\) & \(\vee\) & \(\vee\) & \(\vee\) \\ \hline Med applied for support & - & - & - & - & - & - & - & \(\vee\) & \(\vee\) \\ \hline Collusion attacks resistance & \(\vee\) & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\times\) & \(\vee\) \\ \hline Key escrow problem & \(\times\) & \(\times\) & \(\times\) & \(\vee\) & \(\times\) & \(\times\) & \(\times\) & \(\vee\) & \(\vee\) \\ \hline \hline \end{tabular} \(\vee:\) Provided / \(\times:\) Not provided / - : Not considered  
\end{table} 
Table 1: Comparison of proposed schemes. \[ \begin{split} r=&?\ r^{\prime}\\ H_{k_{2}}(g^{x}\ mod\ p,SK)=&?\ H_{k_{2}}(g^{x}\ mod\ p,SK^{ \prime})\end{split}  \tag{59}\]
* Data confidentiality: In the proposed scheme-I, communication between devices is performed through a session key. Therefore, if the session key for the corresponding communication is unknown, the malicious user will not be able to obtain the message. In addition, as the \(KRF\) generated in the communication process contains the public keys of \(KRC\) and \(M-KRA\), third-party besides \(KRC\) and \(KRA\) cannot know the contents of the corresponding \(KRF\). * Non-repudiation: If the device generates and uses the wrong \(KRF\), \(KRC\) cannot recover the key. To solve this problem, the device should not be able to reject the fact that it generated \(KRF\). Therefore, this includes the private key \(sk_{A}\) of the device in parameter \(s\) of the \(KRF\). The device cannot deny that it generated the \(KRF\). \[ \begin{split} k&=(pk_{A}\cdot g^{r})^{s\text{-} sk_{KRC}}\\ &=(g^{sk_{A}}\cdot g^{r})^{s\text{-}sk_{KRC}}\\ &=(g^{sk_{A}}\cdot g^{r})^{r/(r+sk_{A})\text{-}sk_{KRC}}\\ &=g^{sk_{KRC}x}=pk_{KRC}^{x}\end{split} \] (60)
* Attack on group authentication detection: Malicious key recovery by third-party \(KRA\)s should not be possible. Therefore, a lawful \(KRA\) group member applies an XOR operation on the values from \(R_{KRA_{1}}\) to \(R_{KRA_{n}}\) to generate a shared group value of \(SGN\) between groups. The device receives it from a lawful group member and hashes the \(SGN\) to include \(H(SGN)\) in the \(KRF\). When \(KRC\) recovers the complete key, it hashes and compares the \(SGN\) sent by the \(M-KRA\) with the \(SGN\) contained in the \(KRF\) to ensure it was received from a lawful \(KRA\). \[ \begin{split} H(SGN)=&?\ H(SGN^{\prime})\end{split} \] (61)
* Single point of failure protection: As both the \(KRC\) and all \(KRA\)s participate in session key recovery, it should be possible to recover the key even if some \(KRA\)s fail. Therefore, a special value \(TT\) is generated.