## 3 The Proposed Scheme
### Arbitration Phase  
In this phase, if the client doubts the legality of a security event, the client needs to provide his/her _ID_, _IMC ID_, and _event ID_ to the official agency (\(OA\)) to verify the validity of the event. The flowchart of the arbitration phase is shown in Figure 10.  
The detailed steps of this phase are as follows:  
1. \(AP\) send \((ID_{AP},ID_{IMC},ID_{Event},Sig_{AP_{9}},Sig_{AP_{4}})\) to the \(OA\). 2. The \(OA\) sends a request message with \((ID_{AP},ID_{IMC},ID_{Event},ID_{OA},Sig_{AP_{3}},Sig_{AP_{4}},\)\(Sig_{OA_{1}},Sig_{OA_{2}})\). 3. The \(BCC\) checks the signature from the \(OA\); if it is valid, the \(BCC\) sends the validation data of the specific _event ID_ to the \(OA\). In every phase, the \(SCC\) needs to send the validation data to the \(BCC\), and let the \(OA\) verify whether the event is legal or not. Every phase of the validation data is shown as follows: Event trigger phase: \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\] (87) \[(R_{SCC_{2}},h_{SCC_{2}},Sig_{SCC_{3}},Sig_{SCC_{4}},M_{Event_{2}})\] (88) Task allocating phase: \[(R_{SCC_{3}},h_{SCC_{3}},Sig_{SCC_{5}},Sig_{SCC_{6}},M_{Event_{3}})\] (89) \[(R_{SG_{1}},h_{SG_{1}},Sig_{SG_{1}},Sig_{SG_{2}},M_{Event_{4}})\] (90) \[(R_{SCC_{4}},h_{SCC_{4}},Sig_{SCC_{5}},Sig_{SCC_{8}},M_{Event_{3}})\] (91) Task accomplished phase: \[(R_{SG_{2}},h_{SG_{2}},Sig_{SG_{3}},Sig_{SG_{4}},M_{Event_{6}})\] (92) \[(R_{SCC_{5}},h_{SCC_{5}},Sig_{SCC_{9}},M_{Event_{7}})\] (93) \[(R_{C_{1}},h_{C_{1}},Sig_{C_{1}},Sig_{C_{2}},M_{Event_{8}})\] (94) \[(R_{SCC_{6}},h_{SCC_{6}},Sig_{SCC_{11}},Sig_{SCC_{12}},M_{Event_{9}})\] (95) Step 4. The \(OA\) verifies the legality of the hash parameter \(h_{C_{1}}\): \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\]0 (96)If the equation holds, we go to the next step. Otherwise, the event is illegal (hash value is not equal to the right, which means that the signature is not valid) when the \(C\) reads the event notification, so the \(C\) is illegal if the customer does not read the notification. 1. The \(OA\) verifies the legality of the hash parameter \(h_{SCC_{3}}\): \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\]1 (97) If the equation holds, go to the next step. Otherwise, the event is illegal when the \(SCC\) sends a notification to the \(C\), so the \(SCC\) is illegal. 1. The \(OA\) verifies the legality of the hash parameter \(h_{SG_{2}}\): \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\]2 (98) If the equation holds, we go to the next step. Otherwise, the event is illegal when the \(SG\) reports the tasks accomplished to the \(SCC\), so the \(SG\) is illegal. 1. The \(OA\) verifies the legality of the hash parameter \(h_{SCC_{4}}\): \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\]3 (99) If the equation holds, we go to the next step. Otherwise, the event is illegal when the \(SCC\) receives the accepted task message, so the \(SCC\) is illegal. 1. The \(OA\) verifies the legality of the hash parameter \(h_{SG_{1}}\): \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\]4 (100) If the equation holds, we go to the next step. Otherwise, the event is illegal when the \(SG\) accepts the task and replies to the \(SCC\), so the \(SG\) is illegal. 1. The \(OA\) verifies the legality of the hash parameter \(h_{SCC_{2}}\): \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\]5 (101) If the equation holds, we go to the next step. Otherwise, the event is illegal when the \(SCC\) allocates the task to the \(SG\), so the \(SCC\) is illegal. 1. The \(OA\) verifies the legality of the hash parameter \(h_{SCC_{1}}\): \[(R_{IMC_{1}},h_{IMC_{1}},Sig_{IMC_{1}},Sig_{IMC_{2}},M_{Event_{1}})\]6 (102) If the equation holds, we go to the next step. Otherwise, the event is illegal when the \(SCC\) receives the message from the \(IMC\), so the \(SCC\) is illegal. 1.