# Secure Encapsulation Schemes Using Key Recovery System in IoMT Environments
## 6 Analysis of the Proposed Schemes
### Proposed Scheme-II (Key Recovery System Using Proxy Re-Encryption)  
* KRF integrity: In this proposed scheme-II, \(KRF\) is encrypted with the public keys of \(Med\) and \(KRA\). Therefore, during the key recovery process, \(Med\), \(KRC\) and \(KRA\) cannot be forged or modified \(KRF\) by alone. \[KRF=(KRF_{1},KRF_{2},KRF_{3},KRF_{4})\] (64) \[\pi_{Med}=X_{Med}\cdot S^{H_{1}(1D_{Mat},X_{Med})}\] (65) \[V_{Med}=\pi_{Med}^{H_{6}(V_{Med})}\cdot Y_{Med}\] (66) \[KRF_{4}=(\alpha\cdot\beta)^{H_{4}(V_{KRA}^{\tau})\cdot H_{4}(V_{Med}^{\tau})}\] (67)
* Data confidentiality: As the \(KRF\) generated in the communication process contains the public key of the Med and the secret values of \(KRC\) and \(KRA\), third-party besides the \(Med\), \(KRC\), and \(KRA\) cannot know the contents of the corresponding \(KRF\). In addition, even if all three of the \(Med\), \(KRC\), and \(KRA\) do not participate, each \(Med\), \(KRC\), and \(KRA\) cannot know the contents of the \(KRF\). * Med applied for support: \(Med\) can perform recovery of \(SK\) as needed. \(KRF\) is created using the public key of \(Med\). \(Med\) can perform the key recovery process when it is determined that the key recovery is necessary for \(Dev\) that it manages. For this, \(Med\) can create \(RK_{Med\to KRC}\) and request and execute the key recovery process through \(KRC\) and \(KRA\). * Collusion attack resistance: Fewer than three participants among the \(Med\), \(KRC\), and \(KRA\) must be prevented from maliciously acting together, thus preventing recovery of the key, and unauthorized entities must be prevented from obtaining the key. Therefore, the \(Med\) requires the cooperation of the \(KRC\) and \(KRA\) to decrypt \(KRF\). Thus, even if the \(Med\) has colluded with a single participant among the \(KRC\) and \(KRA\), the completed key recovery cannot be achieved without the assistance of the third participant as follows: \[KRF=(KRF_{1},KRF_{2},KRF_{3},KRF_{4})\] (68) \[KRF_{3}=(SK\parallel\sigma)\oplus H_{2}(g^{c})\] (69) In order to obtain \(SK\) from the above \(KRF=(KRF_{1},KRF_{2},KRF_{3},KRF_{4})\), \(KRF_{3}\) must be decrypted. In order to decrypt \(KRF_{3}\), \(Med,KRC\) and \(KRA\) need to know \(c\) or \(g^{c}\). However, \(c\) and \(g^{c}\) know only \(Dev\). Therefore, it is necessary to obtain \(g^{c}\) by decrypting \(KRF_{4}\). \[KRF_{4}=(\alpha\cdot\beta)^{H_{4}(V_{KRA}^{\tau})\cdot H_{4}(V_{Med}^{\tau})}\] (70) Here, \(KRF_{4}\) contains \(\alpha\cdot\beta=Y_{Med}^{\tau}\cdot Z_{Med}^{\tau}\), so the attackers are \(H_{4}(V_{KRA}^{\tau})\) and \(H_{4}(V_{Med}^{\tau})\) should be computed. \[\pi_{i}=X_{i}\cdot S^{H_{1}(ID_{i},X_{i})}\] (71) \[V_{i}=\pi_{i}^{H_{6}(V_{i})}\cdot Y_{i}\] (72) Since \(V_{i}\) can be created using a public key, anyone can create it. However, since \(\tau\) only knows \(Dev\), attackers must use \(KRF_{2}\) to calculate \(H_{4}(V_{KRA}^{\tau})\) and \(H_{4}(V_{Med}^{\tau})\). \[KRF_{2}=Y_{KRC}^{\tau}=g^{\tau\cdot y_{KRC}}\] (73) Here, a \(KRC\)'s private key \(y_{KRC}\) is required to obtain \(g^{\tau}\) from \(KRF_{2}\). Therefore, KRC is required in the key recovery process. \[\pi_{Med}=X_{Med}\cdot S^{H_{1}(1D_{Mat},X_{Med})}\]0  
Next, since the attacker does not know \(\tau\), he has to perform the following operation to calculate \(H_{4}(V_{KRA}^{\tau})\). In the end, the \(KRA\)'s private keys \(d_{K}RA\) and \(y_{K}RA\) are required, so \(KRA\) is also required. \[ \begin{split} KRF_{4}^{{}^{\prime}}&=KRF_{4}^{1/H_{4 }(KRF_{2}^{s}d_{KRA}\cdot H_{4}(V_{KRA})+y_{KRA})}\\ &=(\alpha\cdot\beta)^{H_{4}(V_{KRA}^{\tau})\cdot H_{4}(V_{Mbd}^{ \tau})/H_{4}(c_{2}^{{}^{\prime}d_{KRA}H_{4}(V_{KRA})+y_{KRA})}\\ &=(\alpha\cdot\beta)^{H_{4}(V_{Mcd}^{\tau})}\end{split}  \tag{75}\]  
Furthermore, an attacker who acquires \((\alpha\cdot\beta)\) must compute \(g^{c}\) to obtain \((SK\parallel\sigma)\) from \(KRF_{3}=(SK\parallel\sigma)\oplus H_{2}(g^{c})\). \[