# Identity-Based Designated-Verifier Proxy Signature Scheme with Information Recovery in Telemedicine System

Authors: Yuping Zhou; Yu Hu; Jianneng Chen; Zengjie Huang; Hui Huang; Yi Fan Zhang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

With the promotion of Remote Medical Treatment, the sharing of big telemedicine data becomes more and more popular. Telemedicine based on wireless sensor networks collects blood pressure, pH value, pulse, and other medical information from the telemedicine healthcare terminal. The medical information is sent to the hospital or medical server for processing. The security protection of patient medical data, such as confidentiality and authenticity, has gradually become a critical problem to be solved in the development of cloud medical service platform. A provably secure identity-based designated-verifier proxy signature scheme with information recovery for cloud medical diagnosis network is proposed. The scheme is on the basis of computational Diffie-Hellman difficult problem and existential unforgeable against adaptive chosen message attacks in the random oracle model. The performance analysis shows that the scheme is appropriate to the remote medical diagnosis system.


---

## Body

## 1. Introduction

Cloud health care refers to that the supremacy of medical technology and equipment owned by only a few first-class hospitals or specialized hospitals has been brought into full play to perform remote diagnosis, treatment, and consultation for remote patients by relying on these technologies, such as computer technology, remote sensing, and remote-control technology [1, 2]. As the demand for telemedicine is expanding, electronic diagnosis and treatment systems based on wireless sensor networks develop rapidly [3]. In the electronic medical system, the medical data of a patient, like blood oxygen, pH value, pulse, and electrocardiogram (ECG), can be collected by the sensors embedded or worn on the remote patient and transmitted to the remote medical expert through the wireless networks. The confidentiality and authenticity of the medical data of patients often become the target of malicious attackers.Network attackers generally utilize active attacks or passive attacks [4]. Active attack refers to the attacker interfering with the data communication, such as modifying, replaying, discarding, or delaying data packets, to achieve more efficient analysis and extraction of traffic characteristics. The diagnosis errors can be caused by tampering with the content of the medical data in the electronic diagnosis and treatment system. The Denial of Service and the rejection of diagnosis request are caused because of physical interference. Passive attack is to obtain the effective data sent from departure to destination without affecting the regular data communication. If there is only a passive attack existing, the confidentiality of the transmitted data is destroyed, and the data information is divulged through monitoring effective data flow, but the integrity and availability are not affected, so the passive attack is not easy to be monitored [5]. Passive attack indirectly affects the network by way of listening to the useful data. The advantage lies in its strong concealment performance, and the remote medical data can be stolen by attackers. In short, the security issues caused by the attack should be added more focus.To solve these security problems, the wireless sensor network framework of cloud medical treatment based on some security technologies is proposed. Ng et al. [6] proposed a type of system framework; as shown in Figure 1, some terminal sensors are deployed on a patient. The server collects information by using a wireless internet connection, and it analyzes and transmits this information to a local or remote doctor. This framework has become a universal wireless sensor network framework of cloud medical treatment. To ensure secure communication, the collected medical data is transmitted to the hospital server after being digitally signed to ensure data integrity. In order to ensure authenticity confirmation, a method which that authorizes the designated recipient is proposed. According to this scheme of things, the hospital administrator or web developer acting as Deploying Authority (DA) authorizes its signing ability to the sensor. A trained doctor is designated as the recipient. In this way, the Deploying Authority acts as the original signer, the terminal sensor acts as the proxy signer, and the healthcare professional is designated as the recipient. Because of the restrictions of storage space and energy, the medical terminal needs a digital signature scheme satisfying storage space and energy efficiency, so an efficient designated-verifier proxy signature scheme is the highly urgent request of a telemedicine system.Figure 1
Telemedicine monitoring system.Mambo et al. [7] presented the proxy signature (PS); this method implements authorization of signing power. According to the idea, the proxy signer is licensed for signing an efficient proxy signature, and the verifier trusts this authorization protocol. The proxy signature scheme applying warrant is widely used in realistic communication systems. The warrant contains information about the identity of concerned people, including both principal and agent, and the validity of the agency agreement. The original signer encrypts the authorization with his private key and transmits it to the proxy signer. The proxy signer verifies the validity of the warrant with the original signer’s public key and then signs the file by using the warrant and his private key. A certificateless designated-verifier proxy signature (CLDVPS) scheme was proposed by He et al. [8]; the method can meet the requirement of certification management and key escrow and achieve high-speed operation of unmanned aerial vehicle executing commands. Only the designated verifier is able to validate the signature in the scheme. Zheng et al. [9] presented a scheme that can be deployed over the existing quantum key distribution networks without complex quantum operations. The correlated key strings are generated by the use of the scheme protecting the communication against potential eavesdroppers. A designated verifier proxy resignature (DVPRS) is proposed by Wei et al. [10]; the proxy can reappoint a new verifier in DVPRS, which is applicable to deniable and/or anonymous authentication. Shi et al. [11] proposed a real quantum designated verifier signature scheme on the basis of quantum deniable authentication protocol. One of the strengths of the scheme is the power of resisting impersonation attacks and entangle-measure attacks. Singh and Verma [12] utilized the advantages of information recovery signature and proxy signature to present an identity-based information recovery proxy signature scheme.In 2020, an aggregatable certificateless designated verifier signature scheme (ACLDVS) was presented by Thorncharoensri et al. to implement secure data access and sharing for cloud storage. ACLDVS is efficient for privacy protection system of the Internet of Things or VANET, the security of the scheme relies on Computational Diffie-Hellman (CDH) assumption [13]. In 2017, an identity-based aggregate signature (IBAS) scheme with designated verifier for WSNs was presented by Shen et al., and the scheme was shown to be secure and efficient; it can keep data integrity; at the same time, the bandwidth and the storage efficiency are high for WSNs [14]. This scheme is secure in the random oracle model under the CDH assumption. In 2011, Shim [15] presented a short designated verifier proxy signature scheme which is confirmed to be safe in the enhanced attacker model. Lin et al. [16] proposed a short DVPS scheme, which is existentially unforgeable against chosen message attack in the random oracle model, but the scheme does not consider the fully attack model. In 2018, a provably secure message recovery designated verifier proxy signature (MRDVPS) scheme was proposed by Verma et al. [17], which is applicable for healthcare wireless sensor networks (HWSN). The scheme satisfies the confidentiality and authentication of data. Hu et al. [18] presented a short provably secure DVPS based on linear pairs in random oracle. The scheme considers an enhanced attack model including six types of attackers with different abilities. In terms of the length of a tuple consisting of information and signature, the scheme produces a signature shorter than the existing information recovery DVPS scheme.The deployment of cloud medical care in wireless sensor networks makes secure communication more urgent. The authenticity of the receiver and sender and the authenticity and confidentiality of patient medical data are all key issues that need to be resolved, especially different security requirements, including integrity, authenticity, confidentiality, and timeliness. To deal with these problems, Verma et al. [19] presented an information recovery proxy signature scheme applied in electronic medical wireless sensor networks, but the scheme only satisfies authenticity and timeliness. In order to meet the four security requirements, at the same time, it is necessary to study the information recovery proxy signature with more features. In the designated-verifier proxy signature, only the verifier who is designated can verify the signature. Combining a message recovery signature, the designated-verifier signature can better solve the four security challenges. In the improved DVPS scheme, the information is permitted to be retrieved only by the designated verifier, so the security features of integrity and confidentiality are achieved. In the solution design, the hospital administrator or deployment authority authorizes their signing right to the sensor, and the sensor signs information on behalf of the hospital administrator or deployment authority. Only the designated recipient, that is a professional doctor, can verify the signature. Due to constraints of energy and bandwidth in wireless sensor networks, designing an authorization method meeting more requirements on security is one of the main considerations. For the required purpose, we present an effective authentication scheme based on identity information to recover the designated-verifier proxy signature. In the scheme, it is all signature and no information which is sent to the designated verifier. The information is recovered during the verification process. The shorter length of signature and the better confidentiality are guaranteed at the same time. The scheme is existentially unforgeable against chosen message attack in the random oracle model and has better performance on computing cost and length.


## 2. Preliminaries

### 2.1. Bilinear Pairing

LetG,+ and GT,⋅ be cyclic groups whose order is the large prime q; the Discrete Logarithm Problem (DLP) is held in G,+ and GT,⋅. A bilinear pairing map e^:G×G⟶GT possesses the following properties:
(1)
Bilinearity: for anyP,Q∈G and a,b∈Zq∗, it has e^aP,bQ=e^P,Qab.(2)
Nondegeneracy: there existsP,Q∈G to satisfy e^P,Q≠1GT.(3)
Computability: for anyP,Q∈G, there is an efficient algorithm to compute e^P,Q.That is,e^P,Q is bilinear groups. Generally, G contains point on elliptic curve. et can be Tate pairing or Weil pairing.


### 2.2. CDH Problem

∀α,β∈Zq∗ and P,αP,βP∈G, computeαβP∈G.


## 2.1. Bilinear Pairing

LetG,+ and GT,⋅ be cyclic groups whose order is the large prime q; the Discrete Logarithm Problem (DLP) is held in G,+ and GT,⋅. A bilinear pairing map e^:G×G⟶GT possesses the following properties:
(1)
Bilinearity: for anyP,Q∈G and a,b∈Zq∗, it has e^aP,bQ=e^P,Qab.(2)
Nondegeneracy: there existsP,Q∈G to satisfy e^P,Q≠1GT.(3)
Computability: for anyP,Q∈G, there is an efficient algorithm to compute e^P,Q.That is,e^P,Q is bilinear groups. Generally, G contains point on elliptic curve. et can be Tate pairing or Weil pairing.


## 2.2. CDH Problem

∀α,β∈Zq∗ and P,αP,βP∈G, computeαβP∈G.


## 3. System Framework

### 3.1. System Model

There are five entities existing in the telemedicine wireless sensor networks as shown in Figure2: Private Key Generator (PGK), Deploying Authority (DA), Sensor, Medical Server (MS), and medical professional. The main functions of each entity are as follows:
(1)
Private Key Generator (PKG): the PKG creates a private key for each participant and then sends it to the user through a secure channel. It is a trusted third party.(2)
Deploying Authority (DA): the DA is a network developer. It develops and maintenances the system and is responsible for solving related network problems. In some special scenarios, the hospital administrator takes on the role.(3)
Sensor: the sensors are embedded or wearable on patients to collect patient healthcare information and then send these data to the medical server through the wireless gateway. A short message is appropriate for the sensors with limited storage and energy.(4)
Medical Server (MS): Medical Server is the core unit of the system with powerful storage and computing capabilities. Medical information is acquired from the relevant wireless gateways and sent to doctors with the help of MS.(5)
Medical professional: medical professional is a trained professional. They receive medical data from the patients for diagnosis and then make clinical treatment strategies according to the medical data.Figure 2
The entities of telemedicine.In the system model, the Deploying Authority is the original signer who can authorize the signature rights to others; the sensor acts as a proxy signer, which accepts signature right from the Deploying Authority, signs the information, and then sends the signature to the designated recipient through the medical server. Receiving the signature from any sensor, the medical server sends the signatures to the relevant doctor; finally, the doctor uses his private key to recover the patient’s medical data in the process of signature verification, performs diagnosis, and then makes clinical treatment strategies according to the medical data.


### 3.2. The Algorithm Framework

The paradigm of the identity-based designated-verifier proxy signature scheme (IDDVPS) scheme includes three active entities: Alice (original signer), Bob (proxy signer), and Cindy (designated verifier). The scheme is on the basis of the schemes of Singh and Verma [12] and Hu et al. [18]. The program framework contains 8 polynomial-time algorithms: Setup, Extract, DeleGen, DeleVerify, DVProxySign, DBProxySVerify, DVPSimulation, and Correctness.
(1)
Setup: a Probabilistic Polynomial Time (PPT) algorithm Setup enters a security parameterλ and outputs system parameters.(2)
Extract: a PPT algorithm Extract takes input system parameters and outputs user’s key pairQu,Su, including the original signer Alice’s key pair QA,SA, the proxy signer Bob’s key pair QB,SB, and the designated verifier Cindy’s key pair QC,SC.(3)
DeleGen: PPT algorithm DeleGen enters the PKG’s master key and the warrantw. It outputs the delegation σ1 passed to Bob by a security tunnel.(4)
DeleVerify: PPT algorithm DeleVerify takes inputw,σ1 and the PKG’s master key; it outputs b∈0,1. If b=1, it accepts the validity of w,σ1; otherwise, it refuses the validity of w,σ1. If b=1, the proxy signer computes Sp=<σ1,SB> as the proxy signature key.(5)
DVProxySign: PPT algorithm DVProxySign takes input the proxy signer’s keySp, the warrant w, the designated verifier’s public key QC, and the message m∈0,1L2; it outputs proxy signature σ.(6)
DVProxySVerify: PPT algorithm DVProxySVerify enters verifier Cindy’s private keySC, Bob’s public key QB, and the proxy signature σ; it outputs m∈0,1L2 and b∈0,1. If b=1, the message m and the proxy signature σ are accepted; otherwise, the message m and the proxy signature σ are refused.(7)
DVPSimulation: by using PPT algorithm DVPSimulation, verifier Cindy can imitate a proxy signature which someone is unable to tell from the original signature.(8)
Correctness: PPT algorithm Correctness outputs the correctness proof of information recovery and validation process.


### 3.3. Security Model

Implementation of security in the IDDVPS scheme is mainly considered from several inspects, including unforgeability, nontransferability, and nonauthorization. A Universal Designated Verifier Signature (UDVS) scheme is derived on the basis of the Designated Verifier Signature (DVS) scheme proposed by Parvin et al. [20], and the signature holder can transform it into DVS. The UDVS is said to be the first nondelegatable UDVS scheme.In 2012, Singh and Verma [12] presented the first information recovery proxy signature scheme with a shorter signature length, and the unforgeability of the scheme is mainly considered. Hu et al. [18] put forward the security model with six types of the strongest adversaries. According to these previous studies, we take into account five types of adversaries and design a play-based method to check that the IDDVPS scheme is unforgeable, nontransferability, and identifiable under the random oracle model. The attackers are divided into five types of adversaries according to their attack ability:
(1)
Type 1 adversary (A1): A1 knows the public keys of Alice, Bob, and Cindy QA,QB,QC.(2)
Type 2 adversary (A2): A2 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private key of Bob SB.(3)
Type 3 adversary (A3): A3 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private key of Alice SA.(4)
Type 4 adversary (A4): A4 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private key of Cindy SC.(5)
Type 5 adversary (A5): A5 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private keys of Bob and Cindy (SB, SC).It can be clearly seen from the above classification that if the security model can resist type 5 adversary (A5), it will be sure to resist type 1 (A1), type 2 (A2), type 3 (A3), and type 4 (A4). The scheme can be proved to be provably secure against adaptive-chosen-plaintext attack in random oracle model by analyzing the type 5 adversary.


#### 3.3.1. Game 1 (Aimed at the Unforgeability of the Type 5 Adversary (A5))

Aimed at the type 5 adversary, the model is existentially unforgeable against adaptive chosen plaintext attacks in the random oracle model. The type 5 adversary gets the public keys of signer and verifierQA,QB,QC, the private key of the proxy signer, and designated verifier (SB,SC), so the proxy signature key can be obtained. To analyze EUF-ACMA, the general model of type 5 (A5) and challenger (CH) is as follows:
(1)
Setup(.): the challenger runs algorithm Setup(.),Params⟵Setup1k, where superscript k is security param; it outputs system params.(2)
Extract(.): the challenger runs algorithm Extract(.); it enters system params and generates the key pairQu,Su for all user u including the original signer Alice’s key pair QA,SA, the proxy signer Bob’s key pair QB,SB, and the designated verifier Cindy’s key pair QC,SC. And then CH provides the public keys of the original signer Alice, proxy signer Bob, designated signer Cindy QA,QB,QC, and the private keys of proxy signer Bob, designated signer Cindy SB,SC to the adversary A5.(3)
DeleGen(.): adversaryA5 queries the DeleGen(.) oracle, adaptively chooses input warrant w, and obtains delegation σ1 from CH.(4)
DvproxySign(.): adversaryA5 queries the DvproxySign(.) oracle and adaptively chooses to input message, warrant, and delegation m,w,σ1; the CH returns proxy signature σ.(5)
DVproxySVerify(.)σw∗,σ1∗A5w∗,σ1∗Output.: adversary A5queries the DVproxySVerify(.) oracle and adaptively inputs signature; if the output is valid, the return value of CH is the corresponding message strings; otherwise, the return value of CH is invalid.(6)
Output(.): it queries the oracle; it inputs to obtain a target message stringm∗∈0,1L2 and the corresponding proxy signature σ∗, where(i)
w∗,σ1∗ is not in the output list of DeleGen(.) oracle(ii)
w∗,σ1∗ is not in the output list of DVProxySign(.) oracle(iii)
w∗,σ1∗ and σ∗ are the valid delegation and proxy signatureThe success rate of an attack of AdversaryA5 is SuccA5,IDEMR−DVPSEUF−ACMA, which equals to the winning probability of Adversary A5 in game 1.Definition 1.
When a forgerA5t,qdel,qH,qps,qpsv,ε requests no more than qdel queries, no more than qH hash queries, no more than DVProxySign(.) queries, and no more than qpsv DVProxySVerify(.) queries, an attack is successfully achieved with probability SuccA5,IDEMR−DVPSEUF−ACMA≻εqps within at most t time. If the probability of success of a in-game forger A5t,qdel,qH,qps,qpsv,ε is negligible, then the IDEMR-DVPS scheme is robust against A5t,qdel,qH,qps,qpsv,ε under adaptive-chosen-plaintext attack. In other words, the IDEMR-DVPS scheme is A5t,qdel,qH,qps,qpsv,ε-existential unforgeability.


## 3.1. System Model

There are five entities existing in the telemedicine wireless sensor networks as shown in Figure2: Private Key Generator (PGK), Deploying Authority (DA), Sensor, Medical Server (MS), and medical professional. The main functions of each entity are as follows:
(1)
Private Key Generator (PKG): the PKG creates a private key for each participant and then sends it to the user through a secure channel. It is a trusted third party.(2)
Deploying Authority (DA): the DA is a network developer. It develops and maintenances the system and is responsible for solving related network problems. In some special scenarios, the hospital administrator takes on the role.(3)
Sensor: the sensors are embedded or wearable on patients to collect patient healthcare information and then send these data to the medical server through the wireless gateway. A short message is appropriate for the sensors with limited storage and energy.(4)
Medical Server (MS): Medical Server is the core unit of the system with powerful storage and computing capabilities. Medical information is acquired from the relevant wireless gateways and sent to doctors with the help of MS.(5)
Medical professional: medical professional is a trained professional. They receive medical data from the patients for diagnosis and then make clinical treatment strategies according to the medical data.Figure 2
The entities of telemedicine.In the system model, the Deploying Authority is the original signer who can authorize the signature rights to others; the sensor acts as a proxy signer, which accepts signature right from the Deploying Authority, signs the information, and then sends the signature to the designated recipient through the medical server. Receiving the signature from any sensor, the medical server sends the signatures to the relevant doctor; finally, the doctor uses his private key to recover the patient’s medical data in the process of signature verification, performs diagnosis, and then makes clinical treatment strategies according to the medical data.


## 3.2. The Algorithm Framework

The paradigm of the identity-based designated-verifier proxy signature scheme (IDDVPS) scheme includes three active entities: Alice (original signer), Bob (proxy signer), and Cindy (designated verifier). The scheme is on the basis of the schemes of Singh and Verma [12] and Hu et al. [18]. The program framework contains 8 polynomial-time algorithms: Setup, Extract, DeleGen, DeleVerify, DVProxySign, DBProxySVerify, DVPSimulation, and Correctness.
(1)
Setup: a Probabilistic Polynomial Time (PPT) algorithm Setup enters a security parameterλ and outputs system parameters.(2)
Extract: a PPT algorithm Extract takes input system parameters and outputs user’s key pairQu,Su, including the original signer Alice’s key pair QA,SA, the proxy signer Bob’s key pair QB,SB, and the designated verifier Cindy’s key pair QC,SC.(3)
DeleGen: PPT algorithm DeleGen enters the PKG’s master key and the warrantw. It outputs the delegation σ1 passed to Bob by a security tunnel.(4)
DeleVerify: PPT algorithm DeleVerify takes inputw,σ1 and the PKG’s master key; it outputs b∈0,1. If b=1, it accepts the validity of w,σ1; otherwise, it refuses the validity of w,σ1. If b=1, the proxy signer computes Sp=<σ1,SB> as the proxy signature key.(5)
DVProxySign: PPT algorithm DVProxySign takes input the proxy signer’s keySp, the warrant w, the designated verifier’s public key QC, and the message m∈0,1L2; it outputs proxy signature σ.(6)
DVProxySVerify: PPT algorithm DVProxySVerify enters verifier Cindy’s private keySC, Bob’s public key QB, and the proxy signature σ; it outputs m∈0,1L2 and b∈0,1. If b=1, the message m and the proxy signature σ are accepted; otherwise, the message m and the proxy signature σ are refused.(7)
DVPSimulation: by using PPT algorithm DVPSimulation, verifier Cindy can imitate a proxy signature which someone is unable to tell from the original signature.(8)
Correctness: PPT algorithm Correctness outputs the correctness proof of information recovery and validation process.


## 3.3. Security Model

Implementation of security in the IDDVPS scheme is mainly considered from several inspects, including unforgeability, nontransferability, and nonauthorization. A Universal Designated Verifier Signature (UDVS) scheme is derived on the basis of the Designated Verifier Signature (DVS) scheme proposed by Parvin et al. [20], and the signature holder can transform it into DVS. The UDVS is said to be the first nondelegatable UDVS scheme.In 2012, Singh and Verma [12] presented the first information recovery proxy signature scheme with a shorter signature length, and the unforgeability of the scheme is mainly considered. Hu et al. [18] put forward the security model with six types of the strongest adversaries. According to these previous studies, we take into account five types of adversaries and design a play-based method to check that the IDDVPS scheme is unforgeable, nontransferability, and identifiable under the random oracle model. The attackers are divided into five types of adversaries according to their attack ability:
(1)
Type 1 adversary (A1): A1 knows the public keys of Alice, Bob, and Cindy QA,QB,QC.(2)
Type 2 adversary (A2): A2 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private key of Bob SB.(3)
Type 3 adversary (A3): A3 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private key of Alice SA.(4)
Type 4 adversary (A4): A4 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private key of Cindy SC.(5)
Type 5 adversary (A5): A5 knows the public keys of Alice, Bob, and Cindy QA,QB,QC and the private keys of Bob and Cindy (SB, SC).It can be clearly seen from the above classification that if the security model can resist type 5 adversary (A5), it will be sure to resist type 1 (A1), type 2 (A2), type 3 (A3), and type 4 (A4). The scheme can be proved to be provably secure against adaptive-chosen-plaintext attack in random oracle model by analyzing the type 5 adversary.


### 3.3.1. Game 1 (Aimed at the Unforgeability of the Type 5 Adversary (A5))

Aimed at the type 5 adversary, the model is existentially unforgeable against adaptive chosen plaintext attacks in the random oracle model. The type 5 adversary gets the public keys of signer and verifierQA,QB,QC, the private key of the proxy signer, and designated verifier (SB,SC), so the proxy signature key can be obtained. To analyze EUF-ACMA, the general model of type 5 (A5) and challenger (CH) is as follows:
(1)
Setup(.): the challenger runs algorithm Setup(.),Params⟵Setup1k, where superscript k is security param; it outputs system params.(2)
Extract(.): the challenger runs algorithm Extract(.); it enters system params and generates the key pairQu,Su for all user u including the original signer Alice’s key pair QA,SA, the proxy signer Bob’s key pair QB,SB, and the designated verifier Cindy’s key pair QC,SC. And then CH provides the public keys of the original signer Alice, proxy signer Bob, designated signer Cindy QA,QB,QC, and the private keys of proxy signer Bob, designated signer Cindy SB,SC to the adversary A5.(3)
DeleGen(.): adversaryA5 queries the DeleGen(.) oracle, adaptively chooses input warrant w, and obtains delegation σ1 from CH.(4)
DvproxySign(.): adversaryA5 queries the DvproxySign(.) oracle and adaptively chooses to input message, warrant, and delegation m,w,σ1; the CH returns proxy signature σ.(5)
DVproxySVerify(.)σw∗,σ1∗A5w∗,σ1∗Output.: adversary A5queries the DVproxySVerify(.) oracle and adaptively inputs signature; if the output is valid, the return value of CH is the corresponding message strings; otherwise, the return value of CH is invalid.(6)
Output(.): it queries the oracle; it inputs to obtain a target message stringm∗∈0,1L2 and the corresponding proxy signature σ∗, where(i)
w∗,σ1∗ is not in the output list of DeleGen(.) oracle(ii)
w∗,σ1∗ is not in the output list of DVProxySign(.) oracle(iii)
w∗,σ1∗ and σ∗ are the valid delegation and proxy signatureThe success rate of an attack of AdversaryA5 is SuccA5,IDEMR−DVPSEUF−ACMA, which equals to the winning probability of Adversary A5 in game 1.Definition 1.
When a forgerA5t,qdel,qH,qps,qpsv,ε requests no more than qdel queries, no more than qH hash queries, no more than DVProxySign(.) queries, and no more than qpsv DVProxySVerify(.) queries, an attack is successfully achieved with probability SuccA5,IDEMR−DVPSEUF−ACMA≻εqps within at most t time. If the probability of success of a in-game forger A5t,qdel,qH,qps,qpsv,ε is negligible, then the IDEMR-DVPS scheme is robust against A5t,qdel,qH,qps,qpsv,ε under adaptive-chosen-plaintext attack. In other words, the IDEMR-DVPS scheme is A5t,qdel,qH,qps,qpsv,ε-existential unforgeability.


## 3.3.1. Game 1 (Aimed at the Unforgeability of the Type 5 Adversary (A5))

Aimed at the type 5 adversary, the model is existentially unforgeable against adaptive chosen plaintext attacks in the random oracle model. The type 5 adversary gets the public keys of signer and verifierQA,QB,QC, the private key of the proxy signer, and designated verifier (SB,SC), so the proxy signature key can be obtained. To analyze EUF-ACMA, the general model of type 5 (A5) and challenger (CH) is as follows:
(1)
Setup(.): the challenger runs algorithm Setup(.),Params⟵Setup1k, where superscript k is security param; it outputs system params.(2)
Extract(.): the challenger runs algorithm Extract(.); it enters system params and generates the key pairQu,Su for all user u including the original signer Alice’s key pair QA,SA, the proxy signer Bob’s key pair QB,SB, and the designated verifier Cindy’s key pair QC,SC. And then CH provides the public keys of the original signer Alice, proxy signer Bob, designated signer Cindy QA,QB,QC, and the private keys of proxy signer Bob, designated signer Cindy SB,SC to the adversary A5.(3)
DeleGen(.): adversaryA5 queries the DeleGen(.) oracle, adaptively chooses input warrant w, and obtains delegation σ1 from CH.(4)
DvproxySign(.): adversaryA5 queries the DvproxySign(.) oracle and adaptively chooses to input message, warrant, and delegation m,w,σ1; the CH returns proxy signature σ.(5)
DVproxySVerify(.)σw∗,σ1∗A5w∗,σ1∗Output.: adversary A5queries the DVproxySVerify(.) oracle and adaptively inputs signature; if the output is valid, the return value of CH is the corresponding message strings; otherwise, the return value of CH is invalid.(6)
Output(.): it queries the oracle; it inputs to obtain a target message stringm∗∈0,1L2 and the corresponding proxy signature σ∗, where(i)
w∗,σ1∗ is not in the output list of DeleGen(.) oracle(ii)
w∗,σ1∗ is not in the output list of DVProxySign(.) oracle(iii)
w∗,σ1∗ and σ∗ are the valid delegation and proxy signatureThe success rate of an attack of AdversaryA5 is SuccA5,IDEMR−DVPSEUF−ACMA, which equals to the winning probability of Adversary A5 in game 1.Definition 1.
When a forgerA5t,qdel,qH,qps,qpsv,ε requests no more than qdel queries, no more than qH hash queries, no more than DVProxySign(.) queries, and no more than qpsv DVProxySVerify(.) queries, an attack is successfully achieved with probability SuccA5,IDEMR−DVPSEUF−ACMA≻εqps within at most t time. If the probability of success of a in-game forger A5t,qdel,qH,qps,qpsv,ε is negligible, then the IDEMR-DVPS scheme is robust against A5t,qdel,qH,qps,qpsv,ε under adaptive-chosen-plaintext attack. In other words, the IDEMR-DVPS scheme is A5t,qdel,qH,qps,qpsv,ε-existential unforgeability.


## 4. Identity-Based Designated-Verifier Proxy Signature Scheme with Information Recovery in Telemedicine System

The medical data of telemedicine system is required to meet some security characteristics: integrity, authenticity, confidentiality, and freshness. The application of the Message Recovery Proxy Signature (MR-PS) scheme applied in telemedicine system can only satisfy authenticity and freshness.To meet more security characteristics, new features need to be added to the existing MR-PS scheme. In identity-based Message Recovery-Designated Verifiers Proxy Signature (IDMR-DVPS) scheme, the signature can only check the validity by the designated verifier and the message is recovered during the verification process, and thus, the confidentiality and integrity are provided; data flow of telemedicine system is shown in Figure3.Figure 3
Data flow of telemedicine system.There are eight steps in the scheme defined as follows:(1)
Setup: a probabilistic polynomial time algorithm (Setup) inputs1λ as security parameters. The PKG selects the main key S∈ℤq∗, calculates(1)Ppub=sP,keeps the main keyGTH:0,1∗×GT⟶0,1qH0:0,1∗⟶GS secret, and outputs system public parameters Params=G,GT,H,H0,H1,H2,H3,et,P,Ppub,q,L1,L2, where G is a plus cyclic group with prime order, q is a multiplicative cyclic group, et:G×G⟶GT is bilinear map, H1:0,1L2⟶0,1L1, H2:0,1L1⟶0,1L2, H3:0,1∗⟶ℤq∗, and L1+L2=q.
(2)
Extract: the userIDU calculates user’s public key(2)QIDU=H0IDU.The PKG calculates private key(3)SIDU=sH0IDU,to send to user. User verified whether this equation(4)etQIDU,Ppub=etSIDU,Pholds after receiving the private key. If it holds, the user will accept the private key. Thus, the initial signer Alice has a pair of keysQA,SA, the proxy signer Bob has a pair of keys QB,SB, and the designated signer Cindy has a pair of keys QC,SC.
(3)
DeleGen; the initial signer Alice calculates(5)w′=H3SA⋅H0w,according to the authorization informationw (authorization information includes the identity information of the initial signer and proxy signer, authorization validity period, the type of signature information string m, and other related information), and sends WCMC_1580444 to PKG; the PKG verified whether the equation
(6)w′=H3SA⋅H0wholds. If it holds, the PKG computes(7)σ1=S⋅H0wand then sendsw,σ1 to the proxy signer Bob secretly by secure channel.
(4)
DeleVerify: the proxy signer can validate the effect of warrant according to whether the equation(8)etσ1,P=etH0w,Ppubholds. If the equation holds, the proxy signer calculates the proxy signature key(9)Sp=σ1+SB.(5)
DVProxySign: the proxy signer performs the following calculations according to the input information stringm∈0,1L2the proxy signer calculates(10)u=H1m∥H2H1m⊕mchoosesr∈ℤq∗ randomly, calculates
(11)h=Hw,etSp,rQC,(12)v=h⊕u,(13)T=r−vSp,(14)σ=etΤ,QC,and returns proxy signatureσ,w,v. The schematic diagram in which the patient signs the information is shown in Figure 4.
(6)
DVProxySVerify: the designated verifier Cindy executes the following calculation during the verification process and calculates(15)u=v⊕Hw,σ·etvQB+H0w,SC,(16)m0=H2uL1⊕uL2,whereuL1means the first bits ofufrom the left side.uL2means the firstL2bits ofufrom the right sideL1. Cindy verified whether the equation
(17)uL1=H1m0Figure 4
Schematic diagram of the patient’s signature information.holds. If it holds, the signature and message are accepted. If it does not hold, the signature and message are rejected.(7)
DVPSimulation: receiving a stringm∈0,1L2, the designated verifier Cindy randomly selects r′∈ℤq∗ and then calculates(18)h′=Hw,etr′·H0w+QB,SC,(19)u=H1m∥H2H1m⊕m,(20)v′=h′⊕u,(21)T′=r′−v′SC,(22)σ′=etT′,H0w+QBand simulates proxy signatureσ′,w,v′. The distribution of the simulated proxy signature and the original proxy signature verification is consistent and indistinguishable.
(8)
Correctness: the process of DVProxySVerify is correct. Forσ=etΤ,QC, σ=etΤ,QC=etr−vSp,QC, thus,(23)h=Hw,σ·etvQB+H0w,SC=Hw,etr−vSp,QC⋅etvQB+H0w,SC=Hwetr−vSp,QC·etvSp,QC=Hwetr⋅Sp,QC=Hw,etr·H0w+QB,SC=Hw,etSp,rQC,(24)u=v⊕h,Foru=H1m∥H2H1m⊕m, thus,
(25)uL1=H1m,(26)uL2=H2H1m⊕mverified whether the equation
(27)H1m0=uL1is tenable. If it is tenable, the designated verifier Cindy recognizes the valid ofσ,w,v for the information m.


## 5. Security Analysis

The scheme has security characteristics of EUF-ACMA, nondelegation, nontransferability, and strong-identifiability.


### 5.1. Unforgeability

For example, in game 1, the scheme is EUF-ACMA against type 5 adversary.Theorem 1.
Leta adversary A5 be a PPT Adversary who plays ExpA5IDEMR−DVPSλ by using DeleGen., H0., H., H1., H3., and DVProxySign. oracles to produce recovery designated verifier’s signature σ based on the identity within t times, and the signature σ can be verified by DVProxySVerify. with a nonnegligible probability ε>0. A5 requests qd, qH0, qH, qH1, qH2, qH3, qdVPS, and qdVPSV time queries for DeleGen., H0., H., H1., H2., H3., DVProxySign., and DVProxySVerify. oracle, respectively. Then, the polynomial time algorithm B can be designed as a solution to the BDH problem with successful probability
(28)SuccB,G1CDHP≥1e21q+1qε,where q is the max value of qd,qH0,qH1,qH2,qH3,qH,qHdvps,qHdvpsv, e is the base of a natural logarithm, and B simulates a challenger as the following proof.Proof.
B chooses c1∈ℤq∗ randomly and sets the public key of the PKG Ppub=aP, the public key of original signer Alice QA=c1P, the public key of proxy signer Bob QB=bP, and the public key of designated verifier Cindy QC=cP. The PKG sends QA,QB,QC,c1 to A5. The goal of B is to compute eP,Pabc according to P,aP,bP,cP, and then the BDH problem is solved. Assume B controls DeleGen., H0., H., H1., H2., H3., DVProxySign., and Extract. oracles and holds all answer lists such as listD, listH0, listH, listH1, listH2, listH3, listDVPS, listK; all lists are empty initially.H0. query: B’s response outputs to all asked wi1≤i≤qH0 are saved as the records of listH0. B first inquires listH0 oracle according to the enquired warrant wi. If there is a corresponding record in the list, the record is output to the adversary A5. Otherwise, B chooses h0i∈Rℤp∗ randomly, sets Ki=h0iP⟵H0wi, and then updates listH0⟵listH0∪Ki,wi,h0i.H. query: the adversary A5 inquires H. oracle about Hash value by inputting wi,IDA,IDB,IDC. B’s response outputs for all Hash requests are saved as the records of listH. B first inquires listH, if there exists a corresponding record in the list; the record is output to the adversary A5. Otherwise, B selects ri∈Rℤq∗, hi∈0,1q, hi⟵Hwi,eri⋅a⋅H0wi+H0IDB,cP randomly, sends hi to the adversary A5, and then updates listH⟵listH∪hi,wi,ri,IDA,IDB,IDC.H1. query: if the adversary A5 queries mi∈0,1L2 from H1. oracle, when mi does not exist in the output list of DVProxySign., B saves the list of records listH1 responded from H1. query to adversary A5. B searches listH1 first, if there exists a corresponding record in the list, B sends it toA5. Otherwise, B chooses S1i∈0,1l1 randomly, sets
(29)F1mi=s1i,sends record toA5, and updates listH1⟵listH1∪mi,s1i.H2. query: B saves the list of records listH2 responded from query to A5. B searches listH2 according to S1i output from H1. query first. If there exists a corresponding record in the list, B sends it toA5. Otherwise, B chooses S2i∈0,1l2 randomly, sets
(30)F2s1i=s2i,sends it toA5, and updates listH2⟵listH2∪mi,s1i,s2i.DeleGen. query: B saves the list of records listD responded from DeleGen. query. B searches target in listH0 according to ki,wi,h0i,bi. If there exists a corresponding record in the list, B sends it to A5. Otherwise, B requests H0. to get the output and chooses bi∈0,1 randomly to make
(31)Prbi=0=1δ.Ifbi=0, B quits and output fails. If bi=1, B outputs
(32)σ1i=h0iPpub=a⋅h0i⋅P,toA5 as delegation updates listD⟵listD∪wi,σ1i,bi. If eσ1i,P=ePpub,H0wi holds, the output is a valid delegation.DVProxySign. query: supposing the adversary A5 inquires DVProxySign. according to mi∈0,1l2,wi1≤i≤qdvps. B saves the list of records listDVPSresponded from DVProxySign.. B inquires listDVPS according to input. If the corresponding item can be found, the output is sent to the adversary A5. Otherwise, B runs H0., Delegen., F1., F2., and H. to acquire wi,ki,h0i, σ1i,bi,wi, mi,s1i,s2i, and ri,hi,wi and calculates
(33)vi=hi⊕s1is2i⊕mi,Ifbi=0, B stops running and quits. If bi=1, B calculates
(34)σi=eri−viH0w+bP,cPand sendsσi,vi to A5. If eri−viH0w+H0IDB,SC=eri−viSp,QC holds, σi,vi is a valid signature.Output.: the adversary A5 generates a forged signature as follows:AdversaryA5 generates σ∗,w∗,v∗ as a valid proxy signature of m∗ and v∗,u∗∉listDVPS.If the adversary succeeds in forging,σ∗,w∗,v∗ is the valid proxy signature.Ifbi∗=1, B quits and output fails.Ifbi∗=0, then, H0w∗=h0iPT∗=r∗−v∗h0iP+bPa. B calculates
(35)σ∗=etT,Qc=etr∗−v∗h0iP+bPa,cP=eth0iPpubQcr∗−v∗etP,Pabcr∗−v∗.Then,(36)σ∗−r∗−v∗eth0iPpub,Qcr∗−v∗=etP,Pabcis the solution of BDH problem.Consider the probability ofB successfully solving the CDH problem in the following two situations.(E1): bi∗=0 in request.(E2): the adversary A5 forges a valid signature.Then,(37)SuccB,G1CDHP=PrE1∩E2=PrE1PrE2∣Ε1≥1−1lqdvps1−1lqdε.To achieve the optimal probability of success, setl=q+1, where q=qd,qH0,qH,qH1,qH2,qdvps,qdvpsv, then
(38)SuccB,G1BDHP=PrE1∩E2=PrE1PrE2∣Ε1≥1e2ε.


### 5.2. Nontransferability

The designated verifier Cindy cannot confirm to a third party whether the signature was signed by the proxy signer Bob or himself. In short, the proxy signature and the simulated signature have the same distribution. Through simulation, the distribution of probabilityPrσ,v=σ1,v1 and probability Prσ′,v′=σ1,v1 are the same, and the scheme is nontransferable.


### 5.3. Strong Identifiability

The program provides a warrant, and the proxy signer Bob can be identified by verifying the warrantw, so the scheme has strong identifiability.In the anti-misuse attack, the warrant contains the signed information string, so that the proxy signer Bob cannot sign proxy signature by using illegal information string, which can effectively prevent misuse attacks. At the same time, apart from the designated verifier, no third party can validate the proxy signature, which makes the scheme robust.


## 5.1. Unforgeability

For example, in game 1, the scheme is EUF-ACMA against type 5 adversary.Theorem 1.
Leta adversary A5 be a PPT Adversary who plays ExpA5IDEMR−DVPSλ by using DeleGen., H0., H., H1., H3., and DVProxySign. oracles to produce recovery designated verifier’s signature σ based on the identity within t times, and the signature σ can be verified by DVProxySVerify. with a nonnegligible probability ε>0. A5 requests qd, qH0, qH, qH1, qH2, qH3, qdVPS, and qdVPSV time queries for DeleGen., H0., H., H1., H2., H3., DVProxySign., and DVProxySVerify. oracle, respectively. Then, the polynomial time algorithm B can be designed as a solution to the BDH problem with successful probability
(28)SuccB,G1CDHP≥1e21q+1qε,where q is the max value of qd,qH0,qH1,qH2,qH3,qH,qHdvps,qHdvpsv, e is the base of a natural logarithm, and B simulates a challenger as the following proof.Proof.
B chooses c1∈ℤq∗ randomly and sets the public key of the PKG Ppub=aP, the public key of original signer Alice QA=c1P, the public key of proxy signer Bob QB=bP, and the public key of designated verifier Cindy QC=cP. The PKG sends QA,QB,QC,c1 to A5. The goal of B is to compute eP,Pabc according to P,aP,bP,cP, and then the BDH problem is solved. Assume B controls DeleGen., H0., H., H1., H2., H3., DVProxySign., and Extract. oracles and holds all answer lists such as listD, listH0, listH, listH1, listH2, listH3, listDVPS, listK; all lists are empty initially.H0. query: B’s response outputs to all asked wi1≤i≤qH0 are saved as the records of listH0. B first inquires listH0 oracle according to the enquired warrant wi. If there is a corresponding record in the list, the record is output to the adversary A5. Otherwise, B chooses h0i∈Rℤp∗ randomly, sets Ki=h0iP⟵H0wi, and then updates listH0⟵listH0∪Ki,wi,h0i.H. query: the adversary A5 inquires H. oracle about Hash value by inputting wi,IDA,IDB,IDC. B’s response outputs for all Hash requests are saved as the records of listH. B first inquires listH, if there exists a corresponding record in the list; the record is output to the adversary A5. Otherwise, B selects ri∈Rℤq∗, hi∈0,1q, hi⟵Hwi,eri⋅a⋅H0wi+H0IDB,cP randomly, sends hi to the adversary A5, and then updates listH⟵listH∪hi,wi,ri,IDA,IDB,IDC.H1. query: if the adversary A5 queries mi∈0,1L2 from H1. oracle, when mi does not exist in the output list of DVProxySign., B saves the list of records listH1 responded from H1. query to adversary A5. B searches listH1 first, if there exists a corresponding record in the list, B sends it toA5. Otherwise, B chooses S1i∈0,1l1 randomly, sets
(29)F1mi=s1i,sends record toA5, and updates listH1⟵listH1∪mi,s1i.H2. query: B saves the list of records listH2 responded from query to A5. B searches listH2 according to S1i output from H1. query first. If there exists a corresponding record in the list, B sends it toA5. Otherwise, B chooses S2i∈0,1l2 randomly, sets
(30)F2s1i=s2i,sends it toA5, and updates listH2⟵listH2∪mi,s1i,s2i.DeleGen. query: B saves the list of records listD responded from DeleGen. query. B searches target in listH0 according to ki,wi,h0i,bi. If there exists a corresponding record in the list, B sends it to A5. Otherwise, B requests H0. to get the output and chooses bi∈0,1 randomly to make
(31)Prbi=0=1δ.Ifbi=0, B quits and output fails. If bi=1, B outputs
(32)σ1i=h0iPpub=a⋅h0i⋅P,toA5 as delegation updates listD⟵listD∪wi,σ1i,bi. If eσ1i,P=ePpub,H0wi holds, the output is a valid delegation.DVProxySign. query: supposing the adversary A5 inquires DVProxySign. according to mi∈0,1l2,wi1≤i≤qdvps. B saves the list of records listDVPSresponded from DVProxySign.. B inquires listDVPS according to input. If the corresponding item can be found, the output is sent to the adversary A5. Otherwise, B runs H0., Delegen., F1., F2., and H. to acquire wi,ki,h0i, σ1i,bi,wi, mi,s1i,s2i, and ri,hi,wi and calculates
(33)vi=hi⊕s1is2i⊕mi,Ifbi=0, B stops running and quits. If bi=1, B calculates
(34)σi=eri−viH0w+bP,cPand sendsσi,vi to A5. If eri−viH0w+H0IDB,SC=eri−viSp,QC holds, σi,vi is a valid signature.Output.: the adversary A5 generates a forged signature as follows:AdversaryA5 generates σ∗,w∗,v∗ as a valid proxy signature of m∗ and v∗,u∗∉listDVPS.If the adversary succeeds in forging,σ∗,w∗,v∗ is the valid proxy signature.Ifbi∗=1, B quits and output fails.Ifbi∗=0, then, H0w∗=h0iPT∗=r∗−v∗h0iP+bPa. B calculates
(35)σ∗=etT,Qc=etr∗−v∗h0iP+bPa,cP=eth0iPpubQcr∗−v∗etP,Pabcr∗−v∗.Then,(36)σ∗−r∗−v∗eth0iPpub,Qcr∗−v∗=etP,Pabcis the solution of BDH problem.Consider the probability ofB successfully solving the CDH problem in the following two situations.(E1): bi∗=0 in request.(E2): the adversary A5 forges a valid signature.Then,(37)SuccB,G1CDHP=PrE1∩E2=PrE1PrE2∣Ε1≥1−1lqdvps1−1lqdε.To achieve the optimal probability of success, setl=q+1, where q=qd,qH0,qH,qH1,qH2,qdvps,qdvpsv, then
(38)SuccB,G1BDHP=PrE1∩E2=PrE1PrE2∣Ε1≥1e2ε.


## 5.2. Nontransferability

The designated verifier Cindy cannot confirm to a third party whether the signature was signed by the proxy signer Bob or himself. In short, the proxy signature and the simulated signature have the same distribution. Through simulation, the distribution of probabilityPrσ,v=σ1,v1 and probability Prσ′,v′=σ1,v1 are the same, and the scheme is nontransferable.


## 5.3. Strong Identifiability

The program provides a warrant, and the proxy signer Bob can be identified by verifying the warrantw, so the scheme has strong identifiability.In the anti-misuse attack, the warrant contains the signed information string, so that the proxy signer Bob cannot sign proxy signature by using illegal information string, which can effectively prevent misuse attacks. At the same time, apart from the designated verifier, no third party can validate the proxy signature, which makes the scheme robust.


## 6. Performance Analysis

In the wireless medical sensor networks, the collection of remote medical data is completed by the sensor embedded in or worn on the patient, and then the sensor transmits the medical data to the medical server, so the signature length and the computational cost of sensor become the main performance indicator of design scheme. Different steps of the scheme are completed by different entities. For example, proxy verification and proxy signature are performed on the sensor while some steps are performed on the authority or the medical server. Therefore, it is necessary to consider the signature length and overall consumption of transmission in different stages. Related notations are denoted in Table1.Table 1
Symbolic description of performance analysis.
SymbolDefinitionTimeSmMultiplication0.39 msetPair operation3.21 msHPoint hash operation0.09 msHere, elliptic curve point addition, XOR,H1, H2, modular addition, and other effective operations are ignored. In order to achieve the 3072-bit RSA security level, the element lengths of G,GT,ℤq∗ are considered to be 256 bits (G), 3072 bits GT, and 256 bits separately, and the length of the information string is m. Because the message is recovered during the signature verification process and no message string is attached to the signature, the signature length of the scheme is w+512.We evaluate the costs of the basic operations on a client machine with Intel i7-4600U 2.70GHz CPU and 4GB RAM. The operating system of the host is Ubutu 14.04 for 64 bit. As shown in Table2, the computing cost of IDEMR-DVPS is smaller than that of literature [15] and equal to that of the literature [21]. The computing cost of literature [18] is 0.3 ms less than that of IDEMR-DVPS scheme, but their signature length is m+256, m+2560, and m bits larger than that of IDEMR-DVPS, respectively. As far as computation cost and bandwidth are concerned, the performance of IDEMR-DVPS scheme is better. In the telemedicine wireless sensor networks, Deleverify. and DVProxySign. are executed on the sensor, but Deleverify. is not executed in every session of signing, which is executed more frequently than DVProxySign.. And its computing cost is Sm+2et (6.81 ms) affordable for the sensor.Table 2
Comparison of efficiency of different schemes.
SchemeComputing costSignature lengthLiterature [21]4H+4Sm+5et (17.97 ms)m+w+768Literature [15]7H+5Sm+5et (18.63 ms)w+m+3072Literature [18]5H+3Sm+5et (17.67 ms)m+w+512IDEMR-DVPS4H+4Sm+5et (17.97 ms)w+512In summary, the IDEMR-DVPS scheme consumes 17.97 ms overall and is highly efficient. Meanwhile, the scheme with several attributes such as the designated verifier and message recovery satisfies the four security requirements and short bandwidth, while other schemes have low bandwidth efficiency or can only meet part of the security requirements. The IDEMR-DVPS scheme is suitable for telemedicine wireless sensor networks.


## 7. Conclusion

Telemedicine wireless sensor networks have been gaining popularity in practice, and the authorized signature scheme of the designated verifier is adopted in most system development. A safe and bandwidth-available IDEMR-DVPS scheme applying elliptic curve bilinear pair mapping is proposed in our paper, and the message is not attached to the signature to be sent to the verifier in the scheme. During the verification process, the scheme satisfies security requirements of telemedicine wireless sensor networks such as data integrity, authenticity, and confidentiality for the verifier’s private key used. The scheme can resist replay attacks effectively due to the construction of warrant. The scheme based on random oracles is EUF-ACMA to be against a stronger adversary in the enhanced attack model. Further, the IDEMR-DVPS scheme has the advantage of being suitable for telemedicine wireless sensor networks applications.The IDEMR-DVPS scheme ignoring pair computing will be the next step because pair operation costs much more than scalar multiplication operation. Designing an MR-DVPS scheme in the standard model is also an open issue.



---

*Source: 1580444-2022-03-18.xml*