# New Certificateless Aggregate Signature Scheme for Healthcare Multimedia Social Network on Cloud Environment

Authors: Libing Wu; Zhiyan Xu; Debiao He; Xianmin Wang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

With the application of sensor technology in the field of healthcare, online data sharing in healthcare industry attracts more and more attention since it has many advantages, such as high efficiency, low latency, breaking the geographical location, and time constraints. However, due to the direct involvement of patient health information, the privacy and integrity of medical data have become a matter of much concern to the healthcare industry. To retain data privacy and integrity, a number of digital signature schemes have been introduced in recent years. Unfortunately, most of them suffer serious security attacks and do not perform well in terms of computation overhead and communication overhead. Very recently, Pankaj Kumaret al. proposed a certificateless aggregate signature scheme for healthcare wireless sensor network. They claimed that their signature scheme was able to withstand a variety of attacks. However, in this paper, we find that their scheme fails to achieve its purpose since it is vulnerable to signature forgery attack and give the detailed attack process. Then, we propose a new certificateless aggregate signature scheme to fix the security flaws and formally prove that our proposed scheme is secure under the computationally hard Diffie-Hellman assumption. Security analysis and performance evaluation demonstrate that the security of our proposal is improved while reducing the computation cost. Compared with Pankaj Kumaret al.'s scheme, our proposed scheme is more efficient and suitable for the healthcare wireless sensor networks (HWSNs) to maintain security at various levels.


---

## Body

## 1. Introduction

Wireless sensor network (WSN) has been widely used in many fields such as retail, entertainment, medicine, tourism, industry, and emergency management [1], and it provides many new opportunities for traditional applications, of which healthcare is one of them. Researchers have invented many sensor-based miniature medical devices to replace the traditional thousands of wires connected to hospital equipment and to increase the mobility of devices. The combination of computer network technology and medical field makes the healthcare industry have more broad prospects for development [2].The application of wireless sensor network technology is mainly divided into two categories: medical applications and nonmedical applications [3]. There are two main types of devices used in medical applications: wearable devices and implanted devices. The first category refers to medical devices that are used on or near the surface of a human body, and the human body can move with the wearable devices. The second category refers to medical devices injected in/with the human body.As shown in Figure1, there is a general healthcare wireless sensor network (HWSN) architecture, which consists of the following five components [4]: sensor, central control unit, patient, cloud based network, and healthcare professional. The medical sensor node implanted on the patient’s body, using air as a transmission medium, can transmit patient’s health data to a remote central control unit (CCU) for further processing, then the health data is sent to the healthcare professional by CCU via Internet, and the patient’s medical report is further generated.Figure 1
A general healthcare wireless sensor network architecture.In the HWSN, information is transmitted from medical sensor devices to the healthcare professional who analyzes the medical information and further provides a suitable solution. If the attacker modifies the medical message halfway, the healthcare professional could make a wrong diagnosis based on the modified message, which can be very dangerous to human life. Because of the direct involvement of patient health information, it is of crucial importance to address the issue of privacy and integrity of personal health data [5–7].Motivated with the above scenario, many digital signature schemes are proposed for healthcare wireless sensor network (HWSN) to protect the privacy and integrity of patient medical information. In this paper, we first review Pankaj Kumaret al.'s certificateless aggregate signature (CL-AS) scheme [8] and point out a previously undiscovered security flaw in the scheme; that is, we reveal that their proposed scheme suffers the signature forgery attack. We then propose a new CL-AS scheme for the issues of security and privacy in HWSN.


### 1.1. Our Research Contributions

In this paper, we propose a new CL-AS scheme which could better protect the integrity and privacy of data in HMSN. The main contributions of this paper are summarized as below:(i)
Firstly, we identify a security weakness against Pankaj Kumaret al.'s CL-AS scheme for HWSN.(ii)
Secondly, we redefine the architecture of a HWSN, which is more close to the actual application environment.(iii)
Thirdly, we propose a CL-AS scheme for HWSN to mend this security flaw, and our new scheme can satisfy the security requirements.(iv)
Finally, we prove the security of our proposed CL-AS scheme and show that it can improve the security while reducing the computation cost compared with Pankaj Kumaret al.'s CL-AS scheme.


### 1.2. Organization of the Paper

The remainder of this paper is organized as below. Section2 introduces the related work. Section 3 presents the problem statements associated with this paper and then briefly reviews the CL-AS scheme for HWSN in Section 4. In Section 5, we demonstrate an attack against Pankaj Kumaret al.'s CL-AS scheme for the HWSN. Furthermore, we present details of the proposed CL-AS scheme in Section 6. In Sections 7 and 8, the security proof and performance analysis of our scheme are described later. Finally, we give a summary of this paper in the last section.


## 1.1. Our Research Contributions

In this paper, we propose a new CL-AS scheme which could better protect the integrity and privacy of data in HMSN. The main contributions of this paper are summarized as below:(i)
Firstly, we identify a security weakness against Pankaj Kumaret al.'s CL-AS scheme for HWSN.(ii)
Secondly, we redefine the architecture of a HWSN, which is more close to the actual application environment.(iii)
Thirdly, we propose a CL-AS scheme for HWSN to mend this security flaw, and our new scheme can satisfy the security requirements.(iv)
Finally, we prove the security of our proposed CL-AS scheme and show that it can improve the security while reducing the computation cost compared with Pankaj Kumaret al.'s CL-AS scheme.


## 1.2. Organization of the Paper

The remainder of this paper is organized as below. Section2 introduces the related work. Section 3 presents the problem statements associated with this paper and then briefly reviews the CL-AS scheme for HWSN in Section 4. In Section 5, we demonstrate an attack against Pankaj Kumaret al.'s CL-AS scheme for the HWSN. Furthermore, we present details of the proposed CL-AS scheme in Section 6. In Sections 7 and 8, the security proof and performance analysis of our scheme are described later. Finally, we give a summary of this paper in the last section.


## 2. Related Work

In the traditional PKI-based public key cryptography (PKC), as the number of users increases, PKC will face a variety of certificate management issues such as certificate distribution, storage, revocation, and high computational cost [11].Although identity-based public key cryptography (IBC) [12, 13] can solve the problem of certificate management existing in PKC, it has inherent key escrow issue. This is because the user’s private key is generated by the key generation center (KGC) based on the user’s identity; that is, KGC can access any user’s private key in IBC.To solve the above problems, Al-Riyamiet al. proposed certificateless public key cryptosystem (CL-PKC) [14]. Because it does not use certificates and the private key is generated both by KGC and by the user himself, it can solve certificate management issue in PKC and the key escrow issue in IBC. Since Al-Riyamiet al. introduced the notion of CL-PKC [14], it has attracted more and more research attention, and many certificateless signature (CLS) schemes [15–21] have been introduced by researchers.Huanget al. [15] proved that the CLS scheme proposed in [14] is vulnerable to the public key replacement attack and further proposed an improved certificateless signature scheme to solve this weakness. Similarly, Liet al. [16] also proposed a new CLS scheme to improve the security of the scheme proposed in [17], which is subject to the public key replacement attack as well. For a malicious KGC attack that exists in some certificateless signature schemes, Auet al. [18] proposed an enhanced security model that allows malicious KGC to generate key pairs in any way. Nevertheless, the certificateless encryption and signature schemes proposed in [19–21] have been found to be insecure against malicious KGC attack.Bonehet al. proposed the concept of aggregate signature [22] in Eurocrypt 2003. The aggregator can aggregate n different signatures with respect to n messages from n users into a single short signature, which can reduce the bandwidth and computational effort of tiny devices used in HWSN. Therefore, the aggregate signature is a more suitable choice in resource-constrained HWSN.Combining certificateless public key cryptography with aggregate signature, Gonget al. [9] proposed the first CL-AS scheme, but they did not give a formal security proof to the scheme. After pioneer work [9], many CL-AS schemes [10, 23–28] have been proposed for various practical applications. Zhang and Zhang [23] redefined the concept and security model for CL-AS. Furthermore, they put forward a new CL-AS scheme, but their scheme need clock synchronized while generating the aggregate signature, and, more seriously, the scheme has been proved that it cannot resist malicious KGC attack. Xionget al. [24] presented a CL-AS scheme, but Heet al. [25] showed that their scheme was forgeable and further proposed a new CL-AS scheme. The CL-AS scheme proposed in [10] has been found to be insecure against the malicious-but-passive KGC attack by the researchers in [26–28].Recently, He and Zeadally [29] present an authentication scheme for the Ambient Assisted Living (AAL) system, which provides technical support for medical monitoring and telehealth services. Heet al. [30] put forward an efficient certificateless public auditing scheme for cloud-assisted wireless body area networks. Very recently, Pankaj Kumaret al. proposed a CL-AS scheme for secure communication in HWSN [8], which is claimed to be able to achieve the message authentication and integrity audit functions while also achieving nonrepudiation and confidentiality. Unfortunately, we find that their CL-AS scheme is insecure and vulnerable to signature forgery attack from a malicious-but-passive KGC.


## 3. Problem Statement

Bilinear map and related hard problems are first described and then system model of our proposed CL-AS scheme is presented in this section. After that, system components of CL-AS scheme are also described.


### 3.1. Bilinear Map

Suppose thatG1 and G2 are two cyclic groups with the same prime order q, where G1 is an additive cyclic group with a generator P and G2 is a multiplicative cyclic group. e:G1×G1→G2 is a bilinear map. For all P,Q,T∈G1, a,b∈Zq∗, and e should satisfy the properties as follows:(1)
Bilinearity:e(P,Q+T)=e(P,Q)e(P,T) and e(aP,bQ)=e(abP,Q)=e(P,abQ).(2)
Nondegeneracy: there existsP∈G1 such that e(P,P)≠1.(3)
Computability: there exists efficient algorithm to calculatee(P,Q).


### 3.2. Complexity Assumption

(1)
Computational Diffie-Hellman (CDH) Problem: Given a generator P of an additive cyclic group G1 with the order q and a random instance (aP,bP), it is difficult to compute abP, where a and b are unknown. (2)
Computational Diffie-Hellman (CDH) Assumption: There does not exist adversary A, can solve the CDH problem in probabilistic polynomial time with a nonnegligible probability ϵ, where ϵ>0 is a very small number.


### 3.3. System Model

The architecture of our healthcare wireless sensor network is shown in Figure2. There are five entities in the framework of a healthcare wireless sensor network: medical sensor node (MSN), medical server (MS), authorized healthcare professional (AHP), signature aggregator (SA), and aggregate signature verifier (ASV). Each entity is specifically defined as follows:(1)
Medical sensor node. Medical sensor node is a resource-limited medical small device on patient’s body belonging to the Care-District. Let IDi denote the identity and (ski,pki) denote the key pair of the sensor node. Each sensor node can use its private key to generate a signature for the relevant message and send the signature to the signature aggregator.(2)
Medical server. Medical server is a device with strong computing power and plenty of storage space, which can handle a large amount of data received from sensors. It transmits the processed patient’s medical information to the AHP. In addition, it is responsible for generating system parameters params, its own key pair (s,MSpub), and the partial private key ppki for each sensor node corresponding to its identity and then secretly sends ppki to the sensor node.(3)
Healthcare professional. Healthcare professional refers to an authorized medical personnel who provides patients with appropriate prescriptions by analyzing the data information sensed by the sensors.(4)
Aggregator. Aggregator refers to a certain computing power of device. It is responsible for collecting a single signature from Care-District and then generating an aggregate signature and sending it to the MS. Suppose that each Care-District contains one aggregator and many sensors.(5)
Aggregate signature verifier. Aggregate signature verifier refers to a certain computing power of equipment. It is responsible for verifying an aggregate signature from different Care-District and then outputting a verification result.Figure 2
The architecture of our healthcare wireless sensor network.


### 3.4. System Components

Our CL-AS scheme is a collection of the following seven polynomial time algorithms as below:(1)
Setup(1k)→(params,s,MSpub) is a probabilistic algorithm executed by the MS, where k is a security parameter, params is the system parameters, (s,MSpub) is the key pair of MS, that is, s is the master secret key, and MSpub is the master public key.(2)
Partial-Private-Key-Gen(params,s,MSpubIDi)→ppki is a probabilistic algorithm executed by the MS, where params is the system parameters, (s,MSpub) is the key pair of MS, IDi∈0,1∗ is a MSN’s identity, and ppki is the partial private key corresponding to the identity IDi of the MSN.(3)
User-Key-pair-Genparams,ppki→(ski,pki) is a randomized algorithm executed by the MSN with identity IDi, where params is the system parameters, (s,MSpub) is the key pair of MS, and (ski,pki) is the key pair of the MSN with the identity IDi.(4)
Sign(params,(ski,pki),Δ,IDi,mi)→σi is a randomized algorithm executed by the signer, where params is the system parameters, (ski,pki) is the key pair of the signer, Δ is the state information, IDi is the signer’s identity, mi is the message, and σi is the signature on the message mi.(5)
Verify(params,Δ,IDi,mi,pki,σi)→{“0”,“1”} is a probabilistic algorithm executed by the verifier, where params is the system parameters, IDi is the signer’s identity, pki is the public key of the signer, mi is the message, and σi is the signature on the message mi, 1 or 0 as outputs to indicate whether the signature σi is validated.(6)
Aggregateparams,IDi,mi,pki,σi1≤i≤n→σ is a deterministic algorithm executed by the aggregator, where params is the system parameters, IDi is the signer’s identity, pki is the public key of the signer, mi is the message, σi is the signature on the message mi, and σi is the signature on the message mi.(7)
Aggregate-Verifyparams,Δ,IDi,mi,pki,σ1≤i≤n→{“0”,“1”} is a deterministic algorithm executed by the aggregate verifier, where params is the system parameters and σ is the aggregate signature of the message mi on the identity IDi with public key pki. 1 or 0 act as outputs to indicate whether aggregate signature σ is validated.


### 3.5. Attack Model

In the attack model, we introduce an adversaryA∈A1,A2 in our model. A’s ultimate goal is to successfully forge the user’s signature on the message. A possesses with the following capabilities:(1)
A can access any hash oracle and corresponding queries in the security model.(2)
A1 simulates an outsider attacker, who cannot obtain the master key but can replace any user’s public key with a value of his choice.(3)
A2 simulates an honest-but-curious MS, who is an insider attacker and has no power to replace any user’s public key but can access the system master key.


## 3.1. Bilinear Map

Suppose thatG1 and G2 are two cyclic groups with the same prime order q, where G1 is an additive cyclic group with a generator P and G2 is a multiplicative cyclic group. e:G1×G1→G2 is a bilinear map. For all P,Q,T∈G1, a,b∈Zq∗, and e should satisfy the properties as follows:(1)
Bilinearity:e(P,Q+T)=e(P,Q)e(P,T) and e(aP,bQ)=e(abP,Q)=e(P,abQ).(2)
Nondegeneracy: there existsP∈G1 such that e(P,P)≠1.(3)
Computability: there exists efficient algorithm to calculatee(P,Q).


## 3.2. Complexity Assumption

(1)
Computational Diffie-Hellman (CDH) Problem: Given a generator P of an additive cyclic group G1 with the order q and a random instance (aP,bP), it is difficult to compute abP, where a and b are unknown. (2)
Computational Diffie-Hellman (CDH) Assumption: There does not exist adversary A, can solve the CDH problem in probabilistic polynomial time with a nonnegligible probability ϵ, where ϵ>0 is a very small number.


## 3.3. System Model

The architecture of our healthcare wireless sensor network is shown in Figure2. There are five entities in the framework of a healthcare wireless sensor network: medical sensor node (MSN), medical server (MS), authorized healthcare professional (AHP), signature aggregator (SA), and aggregate signature verifier (ASV). Each entity is specifically defined as follows:(1)
Medical sensor node. Medical sensor node is a resource-limited medical small device on patient’s body belonging to the Care-District. Let IDi denote the identity and (ski,pki) denote the key pair of the sensor node. Each sensor node can use its private key to generate a signature for the relevant message and send the signature to the signature aggregator.(2)
Medical server. Medical server is a device with strong computing power and plenty of storage space, which can handle a large amount of data received from sensors. It transmits the processed patient’s medical information to the AHP. In addition, it is responsible for generating system parameters params, its own key pair (s,MSpub), and the partial private key ppki for each sensor node corresponding to its identity and then secretly sends ppki to the sensor node.(3)
Healthcare professional. Healthcare professional refers to an authorized medical personnel who provides patients with appropriate prescriptions by analyzing the data information sensed by the sensors.(4)
Aggregator. Aggregator refers to a certain computing power of device. It is responsible for collecting a single signature from Care-District and then generating an aggregate signature and sending it to the MS. Suppose that each Care-District contains one aggregator and many sensors.(5)
Aggregate signature verifier. Aggregate signature verifier refers to a certain computing power of equipment. It is responsible for verifying an aggregate signature from different Care-District and then outputting a verification result.Figure 2
The architecture of our healthcare wireless sensor network.


## 3.4. System Components

Our CL-AS scheme is a collection of the following seven polynomial time algorithms as below:(1)
Setup(1k)→(params,s,MSpub) is a probabilistic algorithm executed by the MS, where k is a security parameter, params is the system parameters, (s,MSpub) is the key pair of MS, that is, s is the master secret key, and MSpub is the master public key.(2)
Partial-Private-Key-Gen(params,s,MSpubIDi)→ppki is a probabilistic algorithm executed by the MS, where params is the system parameters, (s,MSpub) is the key pair of MS, IDi∈0,1∗ is a MSN’s identity, and ppki is the partial private key corresponding to the identity IDi of the MSN.(3)
User-Key-pair-Genparams,ppki→(ski,pki) is a randomized algorithm executed by the MSN with identity IDi, where params is the system parameters, (s,MSpub) is the key pair of MS, and (ski,pki) is the key pair of the MSN with the identity IDi.(4)
Sign(params,(ski,pki),Δ,IDi,mi)→σi is a randomized algorithm executed by the signer, where params is the system parameters, (ski,pki) is the key pair of the signer, Δ is the state information, IDi is the signer’s identity, mi is the message, and σi is the signature on the message mi.(5)
Verify(params,Δ,IDi,mi,pki,σi)→{“0”,“1”} is a probabilistic algorithm executed by the verifier, where params is the system parameters, IDi is the signer’s identity, pki is the public key of the signer, mi is the message, and σi is the signature on the message mi, 1 or 0 as outputs to indicate whether the signature σi is validated.(6)
Aggregateparams,IDi,mi,pki,σi1≤i≤n→σ is a deterministic algorithm executed by the aggregator, where params is the system parameters, IDi is the signer’s identity, pki is the public key of the signer, mi is the message, σi is the signature on the message mi, and σi is the signature on the message mi.(7)
Aggregate-Verifyparams,Δ,IDi,mi,pki,σ1≤i≤n→{“0”,“1”} is a deterministic algorithm executed by the aggregate verifier, where params is the system parameters and σ is the aggregate signature of the message mi on the identity IDi with public key pki. 1 or 0 act as outputs to indicate whether aggregate signature σ is validated.


## 3.5. Attack Model

In the attack model, we introduce an adversaryA∈A1,A2 in our model. A’s ultimate goal is to successfully forge the user’s signature on the message. A possesses with the following capabilities:(1)
A can access any hash oracle and corresponding queries in the security model.(2)
A1 simulates an outsider attacker, who cannot obtain the master key but can replace any user’s public key with a value of his choice.(3)
A2 simulates an honest-but-curious MS, who is an insider attacker and has no power to replace any user’s public key but can access the system master key.


## 4. Review of Pankaj Kumaret al.'s Scheme

Pankaj Kumaret al.'s CL-AS scheme is composed of seven algorithms, i.e., Setup, Partial-Private-Key-Gen, Private-Key-Gen, Sign, Verify, Aggregate, and Aggregate-Verify. The scheme details are described as below.


### 4.1. Setup

By executing the following operations, after entering the security parameterk, the MS generates the system parameter params.(1)
Generates two cyclic groupsG1 and G2 with the same order q, where q is a prime. P being a generator of G1. e:G1×G1→G2 being a bilinear pairing.(2)
Randomly selects a numberα∈Zq∗, computes MSpub=αP, and sets α as the master key and MSpub as the public key of MS(3)
Defines three hash functions:H1:{0,1}→G1, H2:{0,1}→G1, H3:{0,1}→Zq∗(4)
Keepsα secret and params=(G1,G2,P,q,e,MSpub,H1,H2,H3) public.


### 4.2. Partial-Private-Key-Gen

By executing the following operations, MS generates the user’s partial private key:(1)
GivenIDi as the identity of a MS, it computes QIDi=H(IDi) and ppkIDi=α.QIDi and sets ppkIDi as the user’s partial private key.(2)
It secretly sendsppkIDi to the corresponding MSN.


### 4.3. Private-Key-Gen

By executing the following operations, a sensor with the identityIDi generates its private key and public key:(1)
Selects a random numberxi as the secret value.(2)
SetsppkIDi,xi as its private key.(3)
ComputesPKIDi=xiP as its public key.


### 4.4. Sign

By executing the following operations, a signer with the identityIDi generates a signature σi on the message mi:(1)
Inputs system parametersparams, private key ppkIDi, secret key xi, state information Δ, and private-public key pair (xi,PKIDi)(2)
Selectsri∈Zq∗ randomly and then computes Ri=riP(3)
ComputesW=H2(Δ) and hi=H3(mi,IDi,PKIDi,Ri)(4)
ComputesVi=ppkIDi+riW+hixiMSpub(5)
Outputs(Ri,Vi) as the signature of message mi.


### 4.5. Verify

By executing the following operations, the verifier verifies the signatureσi=(Ri,Vi) of message mi on identity IDi:(1)
Inputs the state informationΔ(2)
ComputesQIDi=H1(IDi), W=H2(Δ) and hi=H3(mi,IDi,PKIDi,Ri)(3)
Verifies(1)eVi,P=eQIDi+hiPKIDi,MSpubeRi,W.(4)
If (1) holds, emits 1 and the verifier accepts the signature σi; otherwise emits 0 and rejects.


### 4.6. Aggregate

By executing the following operations, an aggregator generates the aggregate signatureσ from user-message-public key-signature pairs IDi,mi,PKi,σi1≤i≤n:(1)
Inputsn tuples (IDi,mi,PKi,σi), where 1≤i≤n(2)
ComputesV=∑i=1nVi(3)
Outputsσ=(R,V) as the aggregate signature, where R={R1,R1,…,Rn}.


### 4.7. Aggregate-Verify

By executing the following operations, the aggregate verifier verifies the validity of the aggregate signatureσ=(R,V):(1)
Inputs the state informationΔ, the tuples (IDi,mi,PKi,σi)1≤i≤n, and the aggregate signature σ=(R,V)(2)
For1≤i≤n, computes QIDi=H1(IDi), W=H2(Δ), and hi=H3(mi,IDi,PKIDi,Ri)(3)
Verifies(2)eV,P=e∑i=1nQIDi+hiPKIDi,MSpube∑i=1nRi,W.(4)
If (2) holds, emits 1 and the verifier accepts the aggregate signature σ; otherwise emits 0 and rejects.


## 4.1. Setup

By executing the following operations, after entering the security parameterk, the MS generates the system parameter params.(1)
Generates two cyclic groupsG1 and G2 with the same order q, where q is a prime. P being a generator of G1. e:G1×G1→G2 being a bilinear pairing.(2)
Randomly selects a numberα∈Zq∗, computes MSpub=αP, and sets α as the master key and MSpub as the public key of MS(3)
Defines three hash functions:H1:{0,1}→G1, H2:{0,1}→G1, H3:{0,1}→Zq∗(4)
Keepsα secret and params=(G1,G2,P,q,e,MSpub,H1,H2,H3) public.


## 4.2. Partial-Private-Key-Gen

By executing the following operations, MS generates the user’s partial private key:(1)
GivenIDi as the identity of a MS, it computes QIDi=H(IDi) and ppkIDi=α.QIDi and sets ppkIDi as the user’s partial private key.(2)
It secretly sendsppkIDi to the corresponding MSN.


## 4.3. Private-Key-Gen

By executing the following operations, a sensor with the identityIDi generates its private key and public key:(1)
Selects a random numberxi as the secret value.(2)
SetsppkIDi,xi as its private key.(3)
ComputesPKIDi=xiP as its public key.


## 4.4. Sign

By executing the following operations, a signer with the identityIDi generates a signature σi on the message mi:(1)
Inputs system parametersparams, private key ppkIDi, secret key xi, state information Δ, and private-public key pair (xi,PKIDi)(2)
Selectsri∈Zq∗ randomly and then computes Ri=riP(3)
ComputesW=H2(Δ) and hi=H3(mi,IDi,PKIDi,Ri)(4)
ComputesVi=ppkIDi+riW+hixiMSpub(5)
Outputs(Ri,Vi) as the signature of message mi.


## 4.5. Verify

By executing the following operations, the verifier verifies the signatureσi=(Ri,Vi) of message mi on identity IDi:(1)
Inputs the state informationΔ(2)
ComputesQIDi=H1(IDi), W=H2(Δ) and hi=H3(mi,IDi,PKIDi,Ri)(3)
Verifies(1)eVi,P=eQIDi+hiPKIDi,MSpubeRi,W.(4)
If (1) holds, emits 1 and the verifier accepts the signature σi; otherwise emits 0 and rejects.


## 4.6. Aggregate

By executing the following operations, an aggregator generates the aggregate signatureσ from user-message-public key-signature pairs IDi,mi,PKi,σi1≤i≤n:(1)
Inputsn tuples (IDi,mi,PKi,σi), where 1≤i≤n(2)
ComputesV=∑i=1nVi(3)
Outputsσ=(R,V) as the aggregate signature, where R={R1,R1,…,Rn}.


## 4.7. Aggregate-Verify

By executing the following operations, the aggregate verifier verifies the validity of the aggregate signatureσ=(R,V):(1)
Inputs the state informationΔ, the tuples (IDi,mi,PKi,σi)1≤i≤n, and the aggregate signature σ=(R,V)(2)
For1≤i≤n, computes QIDi=H1(IDi), W=H2(Δ), and hi=H3(mi,IDi,PKIDi,Ri)(3)
Verifies(2)eV,P=e∑i=1nQIDi+hiPKIDi,MSpube∑i=1nRi,W.(4)
If (2) holds, emits 1 and the verifier accepts the aggregate signature σ; otherwise emits 0 and rejects.


## 5. Attack on Pankaj Kumaret al.'s CL-AS Scheme

As we know that the signature ofσi=(Ri,Vi) of message mi on identity IDi should be unforgeable. However, a malicious MS or an outside attacker may try to forge the signature. Once the MS or the outside attacker successfully forges the signature directly or indirectly, he/she finishes the signature forgery attack.In this section, we mainly consider the type 2 adversaryA2 and first make a security analysis for Pankaj Kumaret al.'s CL-AS scheme, and then we demonstrate that it is vulnerable to the signature forgery attack, the attack details are described as follows.Setup.The challenger executes the Setup algorithm to generate system parameters params and master key α. Then it returns params and α to the adversary A2.Queries.The adversary A2 could get the signature σj on the message mj signed by Si with the identity IDi via signature queries, where(3)σj=Rj=rjPVj=ppkIDi+rjW+hjxiMSpubForgery.In order to forge the signature σk∗ on mk signed by Si with the identity IDi, the adversary A2 implements its attack as follows:(1)
LetsRk∗=rk∗P=Rj=rjP(2)
Computeshk∗=H3(mk,IDi,PKIDi,Rk∗)Verify.It is easy to verify the validity of the forged signature σk∗. The verifier calculates QIDi=H1(IDi) and W=H2(Δ). Furthermore, the verifier calculates hk∗=H3(mk,IDi,PKIDi,Rk∗). Then we use the forged signature σk∗ to verify (1) and the concrete process is as follows:(4)eVk∗,P=eppkIDi+rjW+hk∗αPKIDi,P=eαQIDi,PerjW,Pehk∗αPKIDi,P=eQIDi,MSpuberjP,Wehk∗PKIDi,MSpub=eQIDi+hk∗PKIDi,MSpubeRk∗,WAggregate-Verify.It is easy to verify the validity of the forged signature σ∗. For 1≤i≤n, the verifier calculates QIDi=H1(IDi) and hk∗=H3(mk,IDi,PKIDi,Rk∗). Furthermore, the verifier calculates W=H2(Δ). Then we use the forged signature to verify (2); the concrete process is as follows: (5)eV∗,P=e∑k=1nppkIDi+rk∗W+hk∗αPKIDi,P=e∑k=1nαQIDi+hk∗αPKIDi,Pe∑k=1nrjW,P=e∑k=1n(IDi+hk∗PKIDi),MSpube∑k=1nrjW,P=e∑k=1nQIDi+hk∗PKIDi,MSpube∑k=1nRk∗,WWe can find that the signature verifications (1) and (2) hold. That is, the forged signature pass verification and the malicious KGC can forge the signature successfully; Pankaj Kumaret al.'s CL-AS scheme is insecure.


## 6. Our Proposed CL-AS Scheme

To overcome the security flaw of the original scheme, we propose a new CL-AS scheme. Our CL-AS scheme includes seven phases:Setup, Partial-Private-Key-Gen, Private-Key-Gen, Sign, Verify, Aggregate, and Aggregate-Verify. The scheme details are described as below.


### 6.1. Setup

By executing the following operations, MS generates the system parameters after taking a security parameterk:(1)
Generates two cyclic groupsG1 and G2 with the same order q, where q is a prime. P being a generator of G1. e:G1×G1→G2 being a bilinear pairing.(2)
Randomly selects a numbers∈Zq∗ as the master key of MS and calculates MSpub=sP as the public key of MS(3)
Chooses four hash functions:H1:{0,1}→G1, H2:0,1→G1, h1:{0,1}→Zq∗, and h2:{0,1}→Zq∗(4)
Keeps the master keys secret and the system parameters params=(G1,G2,P,e,q,MSpub,H1,H2,h1,h2) public.


### 6.2. Partial-Private-Key-Gen

By executing the following operations, MS generates the MSN’s partial private key:(1)
GivenIDi as a MSN’s identity, MS first computes Qi=H1(IDi) and then computes the MSN’s partial private key ppki=s.Qi.(2)
It secretly sendsppki to the corresponding MSN.


### 6.3. Private-Key-Gen

By executing the following operations, a MSN with the identityIDi generates its private key and public key:(1)
Selects a random numberxi as the secret value.(2)
Setsski={ppki,xi} as its private key.(3)
Computespki=xiP as its public key.


### 6.4. Sign

By executing the following operations, a signer with the identityIDi generates a signature σi on the message mi:(1)
Inputs system parametersparams, state information Δ, and private-public key pair (ski,pki)(2)
Selectsri∈Zq∗ randomly and then calculates Ri=riP(3)
Computesαi=h1(IDi,pki,Ri), βi=h2(mi,IDi,pki,Ri), and U=H2(Δ)(4)
ComputesVi=αippki+riMSpub+βixiU(5)
Outputsσi=(Ri,Vi) as the signature of message mi.


### 6.5. Verify

By executing the following operations, the verifier verifies the signatureσi=(Ri,Vi) of message mi on identity IDi:(1)
Inputs the state informationΔ.(2)
Computesαi=h1(IDi,pki,Ri), βi=h2(mi,IDi,pki,Ri), Qi=H1(IDi), and U=H2(Δ)(3)
Verifies(6)eVi,P=eαiQi+Ri,MSpubeβipki,U(4)
If (6) holds, emits 1 and the verifier accepts the signature σi; otherwise emits 0 and rejects.


### 6.6. Aggregate

By executing the following operations, an aggregator generates the aggregate signatureσ from user-message-public key-signature pairs (IDi,mi,pki,σi)1≤i≤n:(1)
Inputsn tuples (IDi,mi,pki,σi), where 1≤i≤n(2)
ComputesV=∑i=1nVi(3)
Outputsσ=(R,V) as the aggregate signature, where R={R1,R1,…,Rn}.


### 6.7. Aggregate-Verify

By executing the following operations, the aggregate verifier verifies the validity of the aggregate signatureσ=(R,V):(1)
Inputs the state informationΔ, the tuples (IDi,mi,pki,σi)1≤i≤n, and the aggregate signature σ=(R,V)(2)
ComputesU=H2(Δ), furthermore, for 1≤i≤n, computes Qi=H1(IDi), αi=h1(IDi,pki,Ri) and βi=h2(mi,IDi,pki,Ri)(3)
Verifies(7)eV,P=e∑i=1nαiQi+Ri,MSpube∑i=1nβipki,U.(4)
If (7) holds, emits 1 and the verifier accepts the aggregate signature σ; otherwise emits 0 and rejects.


## 6.1. Setup

By executing the following operations, MS generates the system parameters after taking a security parameterk:(1)
Generates two cyclic groupsG1 and G2 with the same order q, where q is a prime. P being a generator of G1. e:G1×G1→G2 being a bilinear pairing.(2)
Randomly selects a numbers∈Zq∗ as the master key of MS and calculates MSpub=sP as the public key of MS(3)
Chooses four hash functions:H1:{0,1}→G1, H2:0,1→G1, h1:{0,1}→Zq∗, and h2:{0,1}→Zq∗(4)
Keeps the master keys secret and the system parameters params=(G1,G2,P,e,q,MSpub,H1,H2,h1,h2) public.


## 6.2. Partial-Private-Key-Gen

By executing the following operations, MS generates the MSN’s partial private key:(1)
GivenIDi as a MSN’s identity, MS first computes Qi=H1(IDi) and then computes the MSN’s partial private key ppki=s.Qi.(2)
It secretly sendsppki to the corresponding MSN.


## 6.3. Private-Key-Gen

By executing the following operations, a MSN with the identityIDi generates its private key and public key:(1)
Selects a random numberxi as the secret value.(2)
Setsski={ppki,xi} as its private key.(3)
Computespki=xiP as its public key.


## 6.4. Sign

By executing the following operations, a signer with the identityIDi generates a signature σi on the message mi:(1)
Inputs system parametersparams, state information Δ, and private-public key pair (ski,pki)(2)
Selectsri∈Zq∗ randomly and then calculates Ri=riP(3)
Computesαi=h1(IDi,pki,Ri), βi=h2(mi,IDi,pki,Ri), and U=H2(Δ)(4)
ComputesVi=αippki+riMSpub+βixiU(5)
Outputsσi=(Ri,Vi) as the signature of message mi.


## 6.5. Verify

By executing the following operations, the verifier verifies the signatureσi=(Ri,Vi) of message mi on identity IDi:(1)
Inputs the state informationΔ.(2)
Computesαi=h1(IDi,pki,Ri), βi=h2(mi,IDi,pki,Ri), Qi=H1(IDi), and U=H2(Δ)(3)
Verifies(6)eVi,P=eαiQi+Ri,MSpubeβipki,U(4)
If (6) holds, emits 1 and the verifier accepts the signature σi; otherwise emits 0 and rejects.


## 6.6. Aggregate

By executing the following operations, an aggregator generates the aggregate signatureσ from user-message-public key-signature pairs (IDi,mi,pki,σi)1≤i≤n:(1)
Inputsn tuples (IDi,mi,pki,σi), where 1≤i≤n(2)
ComputesV=∑i=1nVi(3)
Outputsσ=(R,V) as the aggregate signature, where R={R1,R1,…,Rn}.


## 6.7. Aggregate-Verify

By executing the following operations, the aggregate verifier verifies the validity of the aggregate signatureσ=(R,V):(1)
Inputs the state informationΔ, the tuples (IDi,mi,pki,σi)1≤i≤n, and the aggregate signature σ=(R,V)(2)
ComputesU=H2(Δ), furthermore, for 1≤i≤n, computes Qi=H1(IDi), αi=h1(IDi,pki,Ri) and βi=h2(mi,IDi,pki,Ri)(3)
Verifies(7)eV,P=e∑i=1nαiQi+Ri,MSpube∑i=1nβipki,U.(4)
If (7) holds, emits 1 and the verifier accepts the aggregate signature σ; otherwise emits 0 and rejects.


## 7. Security Analysis

A certificateless aggregate signature scheme should satisfy the following requirements: correctness and unforgeability.


### 7.1. Correctness

Theorem 1.
The proposed certificateless aggregate scheme is correct, if and only if the single signature and aggregate signature generated by our scheme make (1) and (2) hold. The correctness of the protocol is elaborated as follows: (8)eVi,P=eαippki+riMSpub+βixiU,P=eαippki,PeriMSpub,PeβixiU,P=eαiQi,sPeriP,MSpubeβixiP,U=eαiQi,MSpuberiP,MSpubeβixiP,U=eαiQi+Ri,MSpubeβipki,Uand(9)eV,P=e∑i=1nαippki+riMSpub+βixiU,P=e∑i=1nαippki,Pe∑i=1nriMSpub,Pe∑i=1nβixiU,P=e∑i=1nαiQi,sPe∑i=1nriP,MSpube∑i=1nβixiP,U=e∑i=1nαiQi,MSpube∑i=1nriP,MSpube∑i=1nβixiP,U=e∑i=1nαiQi+Ri,MSpube∑i=1nβipki,U


### 7.2. Unforgeability

In this subsection, we first give the security model of CL-AS scheme and then give the security proof to show that the proposal is secure under the security model.Security Model.There are two types of adversaries in the CL-AS security model: A1 and A2. A1 simulates an outsider attacker, who cannot obtain the master key but can replace any user’s public key with a value of his choice, while A2 simulates an honest-but-curious KGC, who is an insider attacker and has no power to replace any user’s public key but can access the system master key.Definition 2.
The security model of a CL-AS scheme is defined by two games (denoted byGame1 andGame2) played between an adversary A∈{A1,A2} and a challenger C; more details are defined below.The adversaryA can access the following random oracle machines in the scheme:Hash queries: A can access any hash oracle in the scheme, including H1, H2, h1, and h2.Setup: C performs the Setup algorithm to generate the master key s and the system parameter list params. Then C gives the corresponding response for different types of adversary.Reveal-Partial-private-key: While A submits a partial private key query on the identity IDi to challenger C, it checks if there is a record that corresponds to the identity IDi in the Lppk list and, if found, sends ppki to A; otherwise, if IDi=IDts it aborts; otherwise, it generates the partial private key ppki, sends it to A, and stores it in the list Lppk.Reveal-Secret-key: While A submits a secret value query on the identity IDi to challenger C, it checks if there is a record that corresponds to the identity IDi in the list Lx and, if found, sends xi to A; otherwise, if IDi=IDts it aborts; otherwise, it generates the secret value xi and sends it to A and stores it in the list Lx.Reveal-Public-Key: When adversary A submits a public key query on the identity IDi to challenger C, it checks if there is a record that corresponds to the identity IDi in the list Lpk, if found, sends pki to A; otherwise it generates the public key pki, sends it to A and stores it in the list Lpk.Replace-Public-key: While A submits a query that replaces the public key on the identity IDi with A′s choice of public key pki∗ to challenger C, C checks if there is a record that corresponds to the identity IDi in the list Lpk and, if found, then it updates the corresponding item (IDi,xi,pki,ppki) to (IDi,xi,pki∗,ppki) in the list Lpk; otherwise it aborts.Sign: While A submits a signature query on the message mi with the signer’s identity IDi to challenger C, C executes one of the following operations:(1)
If the target userIDi has not been created, it aborts.(2)
If the target userIDi has been created and the related user public key pki has not been replaced, then it returns a valid signature σi.(3)
If the target userIDi has been created and the corresponding user public key pki has been replaced with pki∗, then it returns a signature σi∗.™We, respectively, define two games to describe two different types of attackers in the CLS, as shown below.Game1: The challenger C interacts with adversary A1 as follows:(1)
Inputtingk as a security parameter, C performs the Setup algorithm to generate the master key s and the system parameter list params. Then C sends params to A1 and keeps s secret.(2)
A1 is capable of accessing any hash oracle in the scheme and Reveal-Partial-Private-Key, Reveal-Secret-Key, Reveal-Public-Key, Replace-Public-Key, and Sign queries at any stage during the simulation in polynomial bound.Forgery: A 1 outputs an aggregate signature σ∗ with respect to n user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n. We say that A1 wins Game1 if and only if the following conditions are met:(1)
σ∗ is a valid aggregate signature with respect to user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n.(2)
The targeted identityIDi∗ has not been submitted during the Reveal-Partial-Private-Key query.(3)
(IDi∗,mi∗) has not been submitted during the Sign query.Game2: The challenger C interacts with adversary A2 as follows:(1)
Inputtingk as a security parameter, C performs the Setup algorithm to generate the master key s and the system parameter list params. Then C sends params and s to A2.(2)
A2 is capable of accessing any hash oracle in the scheme and Reveal-Partial-Private-Key, Reveal-Public-Key, and Sign queries at any stage during the simulation in polynomial bound.Forgery: A 2 outputs an aggregate signature σ∗ with respect to n user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n. We say that A2 wins Game2 if and only if the following conditions are met:(1)
σ∗ is a valid aggregate signature with respect to user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n.(2)
The targeted identityIDi∗ has not been submitted during the Reveal-Secret-Key query.(3)
(IDi∗,mi∗) has not been submitted during the Sign query.Provable Security.In this section, we demonstrate that the new CL-AS scheme is secure under the security model described in the previous subsection. Our security proof consists of two parts.In this section, we prove that our proposed CL-AS scheme is secure under the security model present in the previous section, and the specific process is described in the following two parts:(1) the CL-AS is unforgeable to type 1 adversary A1 and (2) the CL-AS scheme is unforgeable to type 2 adversary A2.Theorem 3.
The proposed CL-AS scheme is existentially unforgeable against type 1 adversaryA1, if the CDH problem is difficult to solve in G1.Proof.
We can prove the unforgeability of our CL-AS scheme against type 1 adversary withGame1 that involves A1 and an algorithm called simulator C.Given a random instance of the CDH problem(P,Q1=aP,Q2=bP), where P is a generator of G1, our ultimate goal is to find the result of abP by solving the CDH problem.(i)
Setup:C randomly chooses IDts as the target identity of sensor challenged, sets MSpub=Q1=aP, and generates and returns system parameter params={G1,G2,P,e,q,MSpub,H1,H2,h1,h2} to A1. A1 performs the inquiries as follows:(ii)
H1query:C maintains a list denoted LH1, and the structure of LH1 is (IDi,δi,εi,Qi); all the elements in LH1 are initialized to null. When A1 performs the query with the identity IDi, C checks whether a tuple (IDi,δi,εi,Qi) exists in LH1; if it exists, it returns Qi to A1; otherwise, C randomly selects εi∈{0,1} and δi∈Zq∗. If εi=0, set Qi=δiP; otherwise, if εi=1, set Qi=δiQ2=δibP. It returns Qi to A1 and stores (IDi,δi,εi,Qi) to LH1.(iii)
H2query:C maintains a list denoted LH2, and the structure of LH2 is (MSpub,ϑ,U), all the elements in LH2 are initialized to null. When A1 executes the query with MSpub, C checks if a tuple (MSpub,ϑ,U) exists in LH2; if it exists, it returns U to A1; otherwise, C randomly selects ϑ∈Zq∗ and computes U=ϑP. It returns U to A1 and stores (MSpub,ϑ,U) to LH2.(iv)
h1query:C maintains a list denoted Lh1, and the structure of Lh1 is (IDi,pki,Ri,αi), all the elements in Lh1 are initialized to null. When A1 executes the query with the tuple (IDi,pki,Ri), C check whether a tuple (IDi,pki,Ri,αi) exists in Lh1; if it exists, it returns αi to A1; otherwise, C randomly selects αi. It returns αi to A1 and stores (IDi,pki,Ri,αi) to Lh1.(v)
h2query:C maintains a list denoted Lh2, and the structure of Lh2 is (mi,IDi,pki,Ri,βi), all the elements in Lh2 are initialized to null. When A1 executes the query with the tuple (mi,IDi,pki,Ri), C checks if a tuple (mi,IDi,pki,Ri,βi) exists in Lh2; if it exists, it returns βi to A1; otherwise, C randomly selects βi. It returns βi to A1 and stores (mi,IDi,pki,Ri,βi) to Lh2.(vi)
Reveal-Partial-Private-Key queries:C maintains a list denoted Lppk, and the structure of Lppk is (IDi,ppki), all the elements in Lppk are initialized to null. When A1 executes the query with IDi, C first checks whether IDi=IDts; if it holds, output ⊥; otherwise, C checks whether a tuple (IDi,ppki) exists in Lppk; if it exists, it returns ppki to A1; otherwise, C recalls the corresponding tuple (IDi,δi,εi,Qi) from the list LH1 and computes ppki=δiMSpub=aδiP. It returns ppki to A1 and stores (IDi,ppki) to Lppk.(vii)
Reveal-Secret-Key-queries:C maintains a list denoted Lx, and the structure of Lx is (IDi,xi), all the elements in Lx are initialized to null. When A1 performs the query with the identity IDi, C first checks if IDi=IDts; if it holds, output ⊥; otherwise, C checks whether a tuple exists in (IDi,xi); if it exists, it returns xi to A1; otherwise, C randomly selects xi. It returns xi to A1 and stores xi to (IDi,xi).(viii)
Reveal-Public-Key queries:C maintains a list denoted Lpk, and the structure of Lpk is (IDi,pki), all the elements in Lpk are initialized to null. When A1 performs the query with the identity IDi, C checks whether a tuple (IDi,pki) exists in Lpk; if it exists pki, it returns pki to A1; otherwise, it accesses Lx to get xi and computes pki=xiP. It returns pki to A1 and stores (IDi,pki) to Lpk.(ix)
Replace-Public-Key queries: When A1 executes the query with the identity (IDi,pki∗), in response, C replaces the real public key pki of IDi with pki∗ chosen by A1 in the list Lpk.(x)
Sign queries: When A1 performs the query with the user identity IDi and public key pki, message mi, C accesses LH1, LH2, Lh1, and Lh2 to get εi, Qi, U, αi, and βi, respectively. Furthermore, C randomly selects ri and computes Ri=riP; if εi=0, C computes Vi=δiαiMSpub+riMSpub+βiϑpki; otherwise, if εi=1, C computes Vi=δiαibMSpub+riMSpub+βiϑpki. It returns σi=(Ri,Vi) to A1 as the signature of the message mi on the user identity IDi with the public key pki.(xi)
Forgery: Finally, A1 outputs a forged aggregate signature σ∗=(R∗,V∗) from message-identity-public key pairs (mi∗,IDi∗,pki∗), where 1≤i≤n. If all εi=0 hold, A1 aborts; otherwise, without loss of generality, let IDts=ID1; that is, ε1=1, εi=0(2≤i≤n), and then the forged signature should make the following hold:(10)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,UwhereQi∗=δi∗P(2≤i≤n), Q1∗=δ1∗bP, U=ϑP, V∗=∑i=1nVi∗, and R∗={R1∗,R2∗,…,Rn∗}.Furthermore, the derivation process is shown as follows:(11)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,U⟹eV∗,P=eR1∗+∑i=2nαi∗Qi∗+Ri∗,MSpubeα1∗Q1∗,MSpube∑i=1nβi∗pki∗,ϑP⟹eα1∗Q1∗,MSpub=eV∗,PeR1∗+∑i=2nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,ϑP-1⟹eδ1∗α1∗abP,P=eV∗,PeR1∗+∑i=2nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,ϑP-1⟹δ1∗α1∗abP=V∗-r1∗+∑i=2nδi∗+ri∗MSpub+∑i=1nβi∗xi∗ϑ⟹abP=V∗-r1∗+∑i=2nδi∗+ri∗MSpub-∑i=1nβi∗xi∗ϑδ1∗α1∗-1However, this contradicts the CDH assumption; thus the single signature and aggregate signature generated by the new scheme are unforgeable.Theorem 4.
The proposed certificateless aggregate scheme is existentially unforgeable against type 2 adversaryA2, if the CDH problem is difficult to solve in G1.Proof.
We can prove the unforgeability of our CL-AS scheme against type 2 adversary withGame2 that involves A2 and an algorithm called simulator C.Given a random instance of the CDH problem(P,Q1=aP,Q2=bP), where P is a generator of G1, our ultimate goal is to find the result of abP by solving the CDH problem.(i)
Setup:C randomly chooses IDts as the target identity of sensor challenged, sets MSpub=λP, and returns master key λ and system parameter params={G1,G2,P,e,q,MSpub,H1,H2,h1,h2} to A2. A2 performs the inquiries as follows.(ii)
h1, h2, andReveal-Secret-Value queries are the same as the corresponding queries in Theorem 3. Since A2 can access the master key, there is no need to theReveal-Partial-Private-Key queries andReplace-Public-Key queries.(iii)
H1query:C maintains a list denoted LH1, and the structure of LH1 is (IDi,δi,Qi), all the elements in LH1 are initialized to null. When A2 performs the query with the identity IDi, C checks whether a tuple LH1 is (IDi,δi,Qi) exists in LH1; if it exists, it returns Qi to A2; otherwise, C randomly selects δi and computes Qi=δiP. It returns Qi to A2 and stores (IDi,δi,Qi) to LH1.(iv)
H2query:C maintains a list denoted LH2, and the structure of LH2 is (MSpub,ϑ,Z), all the elements in LH2 are initialized to null. When A2 executes the query with MSpub, C checks whether a tuple (MSpub,ϑ,Z) exists in LH2; if it exists, it returns U to A2; otherwise, C randomly selects ϑ∈Zq∗ and computes U=ϑQ1=ϑaP. It returns U to A2 and stores (MSpub,ϑ,U) to LH2.(v)
Reveal-Public-Key queries:C maintains a list denoted Lpk, and the structure of Lpk is (IDi,ωi,pki), all the elements in Lpk are initialized to null. When A2 performs the query with the identity IDi, C checks whether a tuple (IDi,ωi,pki) exists in Lpk; if it exists pki, it returns pki to A2; otherwise, C randomly selects ωi∈{0,1}; if ωi=0, C accesses Lx to get xi and computes pki=xiP; otherwise, if ωi=1, C randomly selects xi∈Zq∗ and computes pki=xiQ2=xibP. It returns pki to A2 and stores (IDi,ωi,pki) to Lpk.(vi)
Sign queries: When A2 performs the query with user’s identity IDi and public key pki, message mi, C accesses LH1, LH2, Lh1, Lh2, and Lpk to get Qi, U, αi, βi, and ωi, respectively. Furthermore, C randomly selects ri and computes Ri=riP; if ωi=0, C computes Vi=δiαiMSpub+riMSpub+βiϑpki; otherwise, if ωi=1, C computes Vi=δiαiMSpub+riMSpub+βiϑapki. It returns σi=(Ri,Vi) to A2 as the signature of the message mi on user’s identity IDi with the public key pki.(vii)
Forgery: Finally, A2 outputs a forged aggregate signature σ∗=(R∗,V∗) from message-identity-public key pairs (mi∗,IDi∗,pki∗), where 1≤i≤n. If all ωi=0 hold, A2 aborts; otherwise, without loss of generality, let IDts=ID1; that is, ω1=1, ωi=0(2≤i≤n), and then the forged aggregate signature should satisfy:(12)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpub)e∑i=1nβi∗pki∗,UwhereQi∗=δi∗P, pk1∗=x1∗bP, pki∗=xi∗P(2≤i≤n), U=ϑaP, V∗=∑i=1nVi∗, and R∗={R1∗,R2∗,…,Rn∗}.Furthermore, the derivation process is shown as below:(13)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,U⟹eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpubeα1∗pk1∗,Ue∑i=2nβi∗pki∗,U⟹eβ1∗pk1∗,U=eV∗,Pe∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=2nβi∗pki∗,U-1⟹eβ1∗ϑabP,P=eV∗,Pe∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=2nβi∗pki∗,U-1(14)⟹β1∗ϑabP=V∗-∑i=1nδi∗αi∗+ri∗MSpub+∑i=1nβi∗xi∗ϑ⟹abP=V∗-∑i=1nδi∗αi∗+ri∗MSpub-∑i=1nβi∗xi∗ϑβ1∗ϑ-1However, this contradicts the CDH assumption; thus the single signature and aggregate signature generated by the new scheme are unforgeable.


## 7.1. Correctness

Theorem 1.
The proposed certificateless aggregate scheme is correct, if and only if the single signature and aggregate signature generated by our scheme make (1) and (2) hold. The correctness of the protocol is elaborated as follows: (8)eVi,P=eαippki+riMSpub+βixiU,P=eαippki,PeriMSpub,PeβixiU,P=eαiQi,sPeriP,MSpubeβixiP,U=eαiQi,MSpuberiP,MSpubeβixiP,U=eαiQi+Ri,MSpubeβipki,Uand(9)eV,P=e∑i=1nαippki+riMSpub+βixiU,P=e∑i=1nαippki,Pe∑i=1nriMSpub,Pe∑i=1nβixiU,P=e∑i=1nαiQi,sPe∑i=1nriP,MSpube∑i=1nβixiP,U=e∑i=1nαiQi,MSpube∑i=1nriP,MSpube∑i=1nβixiP,U=e∑i=1nαiQi+Ri,MSpube∑i=1nβipki,U


## 7.2. Unforgeability

In this subsection, we first give the security model of CL-AS scheme and then give the security proof to show that the proposal is secure under the security model.Security Model.There are two types of adversaries in the CL-AS security model: A1 and A2. A1 simulates an outsider attacker, who cannot obtain the master key but can replace any user’s public key with a value of his choice, while A2 simulates an honest-but-curious KGC, who is an insider attacker and has no power to replace any user’s public key but can access the system master key.Definition 2.
The security model of a CL-AS scheme is defined by two games (denoted byGame1 andGame2) played between an adversary A∈{A1,A2} and a challenger C; more details are defined below.The adversaryA can access the following random oracle machines in the scheme:Hash queries: A can access any hash oracle in the scheme, including H1, H2, h1, and h2.Setup: C performs the Setup algorithm to generate the master key s and the system parameter list params. Then C gives the corresponding response for different types of adversary.Reveal-Partial-private-key: While A submits a partial private key query on the identity IDi to challenger C, it checks if there is a record that corresponds to the identity IDi in the Lppk list and, if found, sends ppki to A; otherwise, if IDi=IDts it aborts; otherwise, it generates the partial private key ppki, sends it to A, and stores it in the list Lppk.Reveal-Secret-key: While A submits a secret value query on the identity IDi to challenger C, it checks if there is a record that corresponds to the identity IDi in the list Lx and, if found, sends xi to A; otherwise, if IDi=IDts it aborts; otherwise, it generates the secret value xi and sends it to A and stores it in the list Lx.Reveal-Public-Key: When adversary A submits a public key query on the identity IDi to challenger C, it checks if there is a record that corresponds to the identity IDi in the list Lpk, if found, sends pki to A; otherwise it generates the public key pki, sends it to A and stores it in the list Lpk.Replace-Public-key: While A submits a query that replaces the public key on the identity IDi with A′s choice of public key pki∗ to challenger C, C checks if there is a record that corresponds to the identity IDi in the list Lpk and, if found, then it updates the corresponding item (IDi,xi,pki,ppki) to (IDi,xi,pki∗,ppki) in the list Lpk; otherwise it aborts.Sign: While A submits a signature query on the message mi with the signer’s identity IDi to challenger C, C executes one of the following operations:(1)
If the target userIDi has not been created, it aborts.(2)
If the target userIDi has been created and the related user public key pki has not been replaced, then it returns a valid signature σi.(3)
If the target userIDi has been created and the corresponding user public key pki has been replaced with pki∗, then it returns a signature σi∗.™We, respectively, define two games to describe two different types of attackers in the CLS, as shown below.Game1: The challenger C interacts with adversary A1 as follows:(1)
Inputtingk as a security parameter, C performs the Setup algorithm to generate the master key s and the system parameter list params. Then C sends params to A1 and keeps s secret.(2)
A1 is capable of accessing any hash oracle in the scheme and Reveal-Partial-Private-Key, Reveal-Secret-Key, Reveal-Public-Key, Replace-Public-Key, and Sign queries at any stage during the simulation in polynomial bound.Forgery: A 1 outputs an aggregate signature σ∗ with respect to n user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n. We say that A1 wins Game1 if and only if the following conditions are met:(1)
σ∗ is a valid aggregate signature with respect to user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n.(2)
The targeted identityIDi∗ has not been submitted during the Reveal-Partial-Private-Key query.(3)
(IDi∗,mi∗) has not been submitted during the Sign query.Game2: The challenger C interacts with adversary A2 as follows:(1)
Inputtingk as a security parameter, C performs the Setup algorithm to generate the master key s and the system parameter list params. Then C sends params and s to A2.(2)
A2 is capable of accessing any hash oracle in the scheme and Reveal-Partial-Private-Key, Reveal-Public-Key, and Sign queries at any stage during the simulation in polynomial bound.Forgery: A 2 outputs an aggregate signature σ∗ with respect to n user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n. We say that A2 wins Game2 if and only if the following conditions are met:(1)
σ∗ is a valid aggregate signature with respect to user-message-public key-signature pairs (IDi∗,mi∗,pki∗,σi∗), where 1≤i≤n.(2)
The targeted identityIDi∗ has not been submitted during the Reveal-Secret-Key query.(3)
(IDi∗,mi∗) has not been submitted during the Sign query.Provable Security.In this section, we demonstrate that the new CL-AS scheme is secure under the security model described in the previous subsection. Our security proof consists of two parts.In this section, we prove that our proposed CL-AS scheme is secure under the security model present in the previous section, and the specific process is described in the following two parts:(1) the CL-AS is unforgeable to type 1 adversary A1 and (2) the CL-AS scheme is unforgeable to type 2 adversary A2.Theorem 3.
The proposed CL-AS scheme is existentially unforgeable against type 1 adversaryA1, if the CDH problem is difficult to solve in G1.Proof.
We can prove the unforgeability of our CL-AS scheme against type 1 adversary withGame1 that involves A1 and an algorithm called simulator C.Given a random instance of the CDH problem(P,Q1=aP,Q2=bP), where P is a generator of G1, our ultimate goal is to find the result of abP by solving the CDH problem.(i)
Setup:C randomly chooses IDts as the target identity of sensor challenged, sets MSpub=Q1=aP, and generates and returns system parameter params={G1,G2,P,e,q,MSpub,H1,H2,h1,h2} to A1. A1 performs the inquiries as follows:(ii)
H1query:C maintains a list denoted LH1, and the structure of LH1 is (IDi,δi,εi,Qi); all the elements in LH1 are initialized to null. When A1 performs the query with the identity IDi, C checks whether a tuple (IDi,δi,εi,Qi) exists in LH1; if it exists, it returns Qi to A1; otherwise, C randomly selects εi∈{0,1} and δi∈Zq∗. If εi=0, set Qi=δiP; otherwise, if εi=1, set Qi=δiQ2=δibP. It returns Qi to A1 and stores (IDi,δi,εi,Qi) to LH1.(iii)
H2query:C maintains a list denoted LH2, and the structure of LH2 is (MSpub,ϑ,U), all the elements in LH2 are initialized to null. When A1 executes the query with MSpub, C checks if a tuple (MSpub,ϑ,U) exists in LH2; if it exists, it returns U to A1; otherwise, C randomly selects ϑ∈Zq∗ and computes U=ϑP. It returns U to A1 and stores (MSpub,ϑ,U) to LH2.(iv)
h1query:C maintains a list denoted Lh1, and the structure of Lh1 is (IDi,pki,Ri,αi), all the elements in Lh1 are initialized to null. When A1 executes the query with the tuple (IDi,pki,Ri), C check whether a tuple (IDi,pki,Ri,αi) exists in Lh1; if it exists, it returns αi to A1; otherwise, C randomly selects αi. It returns αi to A1 and stores (IDi,pki,Ri,αi) to Lh1.(v)
h2query:C maintains a list denoted Lh2, and the structure of Lh2 is (mi,IDi,pki,Ri,βi), all the elements in Lh2 are initialized to null. When A1 executes the query with the tuple (mi,IDi,pki,Ri), C checks if a tuple (mi,IDi,pki,Ri,βi) exists in Lh2; if it exists, it returns βi to A1; otherwise, C randomly selects βi. It returns βi to A1 and stores (mi,IDi,pki,Ri,βi) to Lh2.(vi)
Reveal-Partial-Private-Key queries:C maintains a list denoted Lppk, and the structure of Lppk is (IDi,ppki), all the elements in Lppk are initialized to null. When A1 executes the query with IDi, C first checks whether IDi=IDts; if it holds, output ⊥; otherwise, C checks whether a tuple (IDi,ppki) exists in Lppk; if it exists, it returns ppki to A1; otherwise, C recalls the corresponding tuple (IDi,δi,εi,Qi) from the list LH1 and computes ppki=δiMSpub=aδiP. It returns ppki to A1 and stores (IDi,ppki) to Lppk.(vii)
Reveal-Secret-Key-queries:C maintains a list denoted Lx, and the structure of Lx is (IDi,xi), all the elements in Lx are initialized to null. When A1 performs the query with the identity IDi, C first checks if IDi=IDts; if it holds, output ⊥; otherwise, C checks whether a tuple exists in (IDi,xi); if it exists, it returns xi to A1; otherwise, C randomly selects xi. It returns xi to A1 and stores xi to (IDi,xi).(viii)
Reveal-Public-Key queries:C maintains a list denoted Lpk, and the structure of Lpk is (IDi,pki), all the elements in Lpk are initialized to null. When A1 performs the query with the identity IDi, C checks whether a tuple (IDi,pki) exists in Lpk; if it exists pki, it returns pki to A1; otherwise, it accesses Lx to get xi and computes pki=xiP. It returns pki to A1 and stores (IDi,pki) to Lpk.(ix)
Replace-Public-Key queries: When A1 executes the query with the identity (IDi,pki∗), in response, C replaces the real public key pki of IDi with pki∗ chosen by A1 in the list Lpk.(x)
Sign queries: When A1 performs the query with the user identity IDi and public key pki, message mi, C accesses LH1, LH2, Lh1, and Lh2 to get εi, Qi, U, αi, and βi, respectively. Furthermore, C randomly selects ri and computes Ri=riP; if εi=0, C computes Vi=δiαiMSpub+riMSpub+βiϑpki; otherwise, if εi=1, C computes Vi=δiαibMSpub+riMSpub+βiϑpki. It returns σi=(Ri,Vi) to A1 as the signature of the message mi on the user identity IDi with the public key pki.(xi)
Forgery: Finally, A1 outputs a forged aggregate signature σ∗=(R∗,V∗) from message-identity-public key pairs (mi∗,IDi∗,pki∗), where 1≤i≤n. If all εi=0 hold, A1 aborts; otherwise, without loss of generality, let IDts=ID1; that is, ε1=1, εi=0(2≤i≤n), and then the forged signature should make the following hold:(10)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,UwhereQi∗=δi∗P(2≤i≤n), Q1∗=δ1∗bP, U=ϑP, V∗=∑i=1nVi∗, and R∗={R1∗,R2∗,…,Rn∗}.Furthermore, the derivation process is shown as follows:(11)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,U⟹eV∗,P=eR1∗+∑i=2nαi∗Qi∗+Ri∗,MSpubeα1∗Q1∗,MSpube∑i=1nβi∗pki∗,ϑP⟹eα1∗Q1∗,MSpub=eV∗,PeR1∗+∑i=2nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,ϑP-1⟹eδ1∗α1∗abP,P=eV∗,PeR1∗+∑i=2nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,ϑP-1⟹δ1∗α1∗abP=V∗-r1∗+∑i=2nδi∗+ri∗MSpub+∑i=1nβi∗xi∗ϑ⟹abP=V∗-r1∗+∑i=2nδi∗+ri∗MSpub-∑i=1nβi∗xi∗ϑδ1∗α1∗-1However, this contradicts the CDH assumption; thus the single signature and aggregate signature generated by the new scheme are unforgeable.Theorem 4.
The proposed certificateless aggregate scheme is existentially unforgeable against type 2 adversaryA2, if the CDH problem is difficult to solve in G1.Proof.
We can prove the unforgeability of our CL-AS scheme against type 2 adversary withGame2 that involves A2 and an algorithm called simulator C.Given a random instance of the CDH problem(P,Q1=aP,Q2=bP), where P is a generator of G1, our ultimate goal is to find the result of abP by solving the CDH problem.(i)
Setup:C randomly chooses IDts as the target identity of sensor challenged, sets MSpub=λP, and returns master key λ and system parameter params={G1,G2,P,e,q,MSpub,H1,H2,h1,h2} to A2. A2 performs the inquiries as follows.(ii)
h1, h2, andReveal-Secret-Value queries are the same as the corresponding queries in Theorem 3. Since A2 can access the master key, there is no need to theReveal-Partial-Private-Key queries andReplace-Public-Key queries.(iii)
H1query:C maintains a list denoted LH1, and the structure of LH1 is (IDi,δi,Qi), all the elements in LH1 are initialized to null. When A2 performs the query with the identity IDi, C checks whether a tuple LH1 is (IDi,δi,Qi) exists in LH1; if it exists, it returns Qi to A2; otherwise, C randomly selects δi and computes Qi=δiP. It returns Qi to A2 and stores (IDi,δi,Qi) to LH1.(iv)
H2query:C maintains a list denoted LH2, and the structure of LH2 is (MSpub,ϑ,Z), all the elements in LH2 are initialized to null. When A2 executes the query with MSpub, C checks whether a tuple (MSpub,ϑ,Z) exists in LH2; if it exists, it returns U to A2; otherwise, C randomly selects ϑ∈Zq∗ and computes U=ϑQ1=ϑaP. It returns U to A2 and stores (MSpub,ϑ,U) to LH2.(v)
Reveal-Public-Key queries:C maintains a list denoted Lpk, and the structure of Lpk is (IDi,ωi,pki), all the elements in Lpk are initialized to null. When A2 performs the query with the identity IDi, C checks whether a tuple (IDi,ωi,pki) exists in Lpk; if it exists pki, it returns pki to A2; otherwise, C randomly selects ωi∈{0,1}; if ωi=0, C accesses Lx to get xi and computes pki=xiP; otherwise, if ωi=1, C randomly selects xi∈Zq∗ and computes pki=xiQ2=xibP. It returns pki to A2 and stores (IDi,ωi,pki) to Lpk.(vi)
Sign queries: When A2 performs the query with user’s identity IDi and public key pki, message mi, C accesses LH1, LH2, Lh1, Lh2, and Lpk to get Qi, U, αi, βi, and ωi, respectively. Furthermore, C randomly selects ri and computes Ri=riP; if ωi=0, C computes Vi=δiαiMSpub+riMSpub+βiϑpki; otherwise, if ωi=1, C computes Vi=δiαiMSpub+riMSpub+βiϑapki. It returns σi=(Ri,Vi) to A2 as the signature of the message mi on user’s identity IDi with the public key pki.(vii)
Forgery: Finally, A2 outputs a forged aggregate signature σ∗=(R∗,V∗) from message-identity-public key pairs (mi∗,IDi∗,pki∗), where 1≤i≤n. If all ωi=0 hold, A2 aborts; otherwise, without loss of generality, let IDts=ID1; that is, ω1=1, ωi=0(2≤i≤n), and then the forged aggregate signature should satisfy:(12)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpub)e∑i=1nβi∗pki∗,UwhereQi∗=δi∗P, pk1∗=x1∗bP, pki∗=xi∗P(2≤i≤n), U=ϑaP, V∗=∑i=1nVi∗, and R∗={R1∗,R2∗,…,Rn∗}.Furthermore, the derivation process is shown as below:(13)eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=1nβi∗pki∗,U⟹eV∗,P=e∑i=1nαi∗Qi∗+Ri∗,MSpubeα1∗pk1∗,Ue∑i=2nβi∗pki∗,U⟹eβ1∗pk1∗,U=eV∗,Pe∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=2nβi∗pki∗,U-1⟹eβ1∗ϑabP,P=eV∗,Pe∑i=1nαi∗Qi∗+Ri∗,MSpube∑i=2nβi∗pki∗,U-1(14)⟹β1∗ϑabP=V∗-∑i=1nδi∗αi∗+ri∗MSpub+∑i=1nβi∗xi∗ϑ⟹abP=V∗-∑i=1nδi∗αi∗+ri∗MSpub-∑i=1nβi∗xi∗ϑβ1∗ϑ-1However, this contradicts the CDH assumption; thus the single signature and aggregate signature generated by the new scheme are unforgeable.


## 8. Security Comparisons and Performance Analysis

In this section, we first compare the security of the newly proposed CL-AS scheme with the other three CL-AS schemes and further analyze the performance of the new CL-AS scheme by evaluating the computation overhead.


### 8.1. Security Comparisons

In this subsection, we compare the security of the newly proposed CL-AS scheme with the other three CL-AS schemes [8–10]. For the convenience of description, let A1 and A2 denote the type1 and the type2 adversaries, respectively. Furthermore, the two types of adversaries are divided into three levels [31], where Bi1 denotes general adversary, Bi2 denotes strong adversary, Bi3 denotes super adversary, respectively, and i∈{1,2}; the value of i corresponds to the type i adversary. Yes denotes that it can satisfy the corresponding security requirement and No denotes that it cannot satisfy the corresponding security requirement. L denotes the weaker security and H denotes the stronger security under the corresponding attack types. SP denotes the security performance. The security comparisons of the various schemes are listed in Table 1.Table 1
Security comparisons.
B 11 B 12 B 13 S P B 21 B 22 B 23 S P Gong’s Scheme [9] N o Y e s N o L Y e s N o N o L  liu’s Scheme [10] Y e s Y e s Y e s H N o N o N o L  kumar’s Scheme [8] Y e s Y e s Y e s H N o N o N o L  OurproposedScheme Y e s Y e s Y e s H Y e s Y e s Y e s HAs shown in Table1, we can find that the first three schemes (i.e., Gong’s scheme [9], liu’s scheme [10], and kumar’s scheme [8]) cannot satisfy all the security requirements. Especially for Gong’s two CL-AS schemes [9], under the attacks of the type1 and the type2 adversaries, none of them can meet the security levels of B3. liu and kumar’s schemes cannot resist the malicious KGC attack (B3 level). In contrast, our CL-AS scheme can meet all the security requirements. Hence, our proposed CL-AS scheme has better security than that of the other three schemes.


### 8.2. Performance Analysis

In this section, we analyze the performance of our CL-AS scheme by evaluating the computation overhead. Compared with that of kumaret al.'s scheme, our implementation shows that the new proposal can satisfy the security requirement and provide an improved security while reducing the computation cost.In order to achieve a credible security level, we chooseq and p as 160-bits prime number and 512-bits prime number, respectively. A ate pairing e:G1×G1→G2 is used in our experiments, where G1 and G2 are cyclic groups with the same order q, defined on the super singular elliptic curve E(Fp):y2=x3+1.We have implemented kumaret al.'s scheme and the newly proposed scheme with the MIRACL library [32] on a personal computer (Lenovo with Intel I5-3470 3.20G Hz processor, 4G bytes memory and Window 7 operating system). For the sake of simplicity, we firstly define the corresponding relations related symbol-operation-execution time as shown in Table 2.Table 2
symbol-operation-execution time.
Symbol Operation Time(ms) Tmts The time of performing a general hash operation inZq∗ 0.0002  Tmtp The time of performing a map-to-point operation inG1 9.773  Tecc-pa The time of performing a point addition operation inG1 0.022  Tecc-pm The time of performing a point multiplication operation inG1 3.740  Tbp The time of performing a bilinear pairing operation 11.515BecauseSetup,Partial-Private-Key-Gen, andPrivate-Key-Gen phases are executed by MS or user and all of them are one-time operation, we laid stress on the comparisons of the computation cost inSign,Verify,Aggregate, andAggregate-Verify phases.InSign phase, the user in kumaret al.'s scheme needs to perform one general hash operation in Zq∗, one map-to-point hash operation in G1, two-point addition operations in G1 and three-point multiplication operations in G1. Therefore, the running time of the Sign phase is Tmts+Tmtp+2Tecc-pa+3Tecc-pm, whereas the user in the new proposal needs to perform two general hash operations in Zq∗, one map-to-point hash operation in G1, two-point addition operations in G1, and four-point multiplication operations in G1. Therefore, the running time of the Sign phase in our proposed scheme is 2Tmts+Tmtp+2Tecc-pa+4Tecc-pm milliseconds.InVerify phase, the verifier in kumaret al.'s scheme needs to perform one general hash operation in Zq∗, one map-to-point hash operation in G1, one-point addition operation in G1, one-point multiplication operation in G1, and three-bilinear pairing operations. Therefore, the running time of the Verify phase is Tmts+Tmtp+Tecc-pa+Tecc-pm+3Tbp, whereas the verifier in the new proposal needs to perform two general hash operations in Zq∗, one map-to-point hash operation in G1, one-point addition operation in G1, two-point multiplication operation in G1, and three-bilinear pairing operations. Therefore, the running time of the Verify phase in our proposed scheme is 2Tmts+Tmtp+Tecc-pa+2Tecc-pm+3Tbp milliseconds.InAggregate phase, the aggregator in kumaret al.'s scheme needs to perform n-1 point addition operations in G1, whereas the aggregator in the new proposal needs to perform n-1 point addition operations in G1. We can find that the running time of the Aggregate phase in the two schemes is equal to (n-1)Tecc-pa milliseconds.InAggregate-Verify phase, the aggregate verifier in kumaret al.'s scheme needs to perform n general hash operations in Zq∗, 2n map-to-point hash operations in G1, 3n-2 point addition operations in G1, n point multiplication operations in G1, and three-bilinear pairing operations. Therefore, the running time of the Aggregate-Verify phase is nTmts+2nTmtp+(3n-2)Tecc-pa+nTecc-pm+3Tbp milliseconds, whereas the verifier in the new proposal needs to perform 2n general hash operations in Zq∗, n+1 map-to-point hash operations in G1, 3n-2 point addition operations in G1, 2n point multiplication operations in G1, and three-bilinear pairing operations. Therefore, the running time of the Aggregate-Verify phase in our proposed scheme is 2nTmts+(n+1)Tmtp+(3n-2)Tecc-pa+2nTecc-pm+3Tbp milliseconds.Assuming thatn=100 in the Aggregate and Aggregate-Verify phases, the computation overhead comparisons are shown in Table 3 and Figure 3. As can be seen from the results in Table 3 and Figure 3, the computation overhead of our proposed CL-AS scheme is slightly higher than that of kumaret al.'s scheme for Sign and Verify phases. In Aggregate phase, the computation overheads of the two schemes are equal, whereas in the Agrregate-Verify phase, the computation overhead of our scheme is much lower than that of kumaret al.'s scheme. However, compared with the total computation overheads of these four phases, our scheme’s computation overhead is reduced by 24 percentage points compared with the that of kumaret al.'s scheme [8]. That is, we enforce the security in a large extent with the efficiency increased by 24 in computation overhead.Table 3
Computation cost comparisons (millisecond).
kumar’s Scheme [8] O u r  P r o p o s e d  S c h e m e Sign T m t s + T m t p + 2 T e c c - p a + 3 T e c c - p m ≈ 21.0372 2 T m t s + T m t p + 2 T e c c - p a + 4 T e c c - p m ≈ 24.7774  Verify Tmts+Tmtp+Tecc-pa+Tecc-pm+3Tbp≈48.0802 2Tmts+Tmtp+Tecc-pa+2Tecc-pm+3Tbp≈51.8204  Agrregate 99 T e c c - p a ≈ 2.178 99 T e c c - p a ≈ 2.178  A g g r e g a t e - V e r i f y 100 T m t s + 200 T m t p + 298 T e c c - p a + 100 T e c c - p m + 3 T b p ≈ 2369.721 200 T m t s + 101 T m t p + 298 T e c c - p a + 200 T e c c - p m + 3 T b p ≈ 1776.214Figure 3
Computation cost comparisons.


## 8.1. Security Comparisons

In this subsection, we compare the security of the newly proposed CL-AS scheme with the other three CL-AS schemes [8–10]. For the convenience of description, let A1 and A2 denote the type1 and the type2 adversaries, respectively. Furthermore, the two types of adversaries are divided into three levels [31], where Bi1 denotes general adversary, Bi2 denotes strong adversary, Bi3 denotes super adversary, respectively, and i∈{1,2}; the value of i corresponds to the type i adversary. Yes denotes that it can satisfy the corresponding security requirement and No denotes that it cannot satisfy the corresponding security requirement. L denotes the weaker security and H denotes the stronger security under the corresponding attack types. SP denotes the security performance. The security comparisons of the various schemes are listed in Table 1.Table 1
Security comparisons.
B 11 B 12 B 13 S P B 21 B 22 B 23 S P Gong’s Scheme [9] N o Y e s N o L Y e s N o N o L  liu’s Scheme [10] Y e s Y e s Y e s H N o N o N o L  kumar’s Scheme [8] Y e s Y e s Y e s H N o N o N o L  OurproposedScheme Y e s Y e s Y e s H Y e s Y e s Y e s HAs shown in Table1, we can find that the first three schemes (i.e., Gong’s scheme [9], liu’s scheme [10], and kumar’s scheme [8]) cannot satisfy all the security requirements. Especially for Gong’s two CL-AS schemes [9], under the attacks of the type1 and the type2 adversaries, none of them can meet the security levels of B3. liu and kumar’s schemes cannot resist the malicious KGC attack (B3 level). In contrast, our CL-AS scheme can meet all the security requirements. Hence, our proposed CL-AS scheme has better security than that of the other three schemes.


## 8.2. Performance Analysis

In this section, we analyze the performance of our CL-AS scheme by evaluating the computation overhead. Compared with that of kumaret al.'s scheme, our implementation shows that the new proposal can satisfy the security requirement and provide an improved security while reducing the computation cost.In order to achieve a credible security level, we chooseq and p as 160-bits prime number and 512-bits prime number, respectively. A ate pairing e:G1×G1→G2 is used in our experiments, where G1 and G2 are cyclic groups with the same order q, defined on the super singular elliptic curve E(Fp):y2=x3+1.We have implemented kumaret al.'s scheme and the newly proposed scheme with the MIRACL library [32] on a personal computer (Lenovo with Intel I5-3470 3.20G Hz processor, 4G bytes memory and Window 7 operating system). For the sake of simplicity, we firstly define the corresponding relations related symbol-operation-execution time as shown in Table 2.Table 2
symbol-operation-execution time.
Symbol Operation Time(ms) Tmts The time of performing a general hash operation inZq∗ 0.0002  Tmtp The time of performing a map-to-point operation inG1 9.773  Tecc-pa The time of performing a point addition operation inG1 0.022  Tecc-pm The time of performing a point multiplication operation inG1 3.740  Tbp The time of performing a bilinear pairing operation 11.515BecauseSetup,Partial-Private-Key-Gen, andPrivate-Key-Gen phases are executed by MS or user and all of them are one-time operation, we laid stress on the comparisons of the computation cost inSign,Verify,Aggregate, andAggregate-Verify phases.InSign phase, the user in kumaret al.'s scheme needs to perform one general hash operation in Zq∗, one map-to-point hash operation in G1, two-point addition operations in G1 and three-point multiplication operations in G1. Therefore, the running time of the Sign phase is Tmts+Tmtp+2Tecc-pa+3Tecc-pm, whereas the user in the new proposal needs to perform two general hash operations in Zq∗, one map-to-point hash operation in G1, two-point addition operations in G1, and four-point multiplication operations in G1. Therefore, the running time of the Sign phase in our proposed scheme is 2Tmts+Tmtp+2Tecc-pa+4Tecc-pm milliseconds.InVerify phase, the verifier in kumaret al.'s scheme needs to perform one general hash operation in Zq∗, one map-to-point hash operation in G1, one-point addition operation in G1, one-point multiplication operation in G1, and three-bilinear pairing operations. Therefore, the running time of the Verify phase is Tmts+Tmtp+Tecc-pa+Tecc-pm+3Tbp, whereas the verifier in the new proposal needs to perform two general hash operations in Zq∗, one map-to-point hash operation in G1, one-point addition operation in G1, two-point multiplication operation in G1, and three-bilinear pairing operations. Therefore, the running time of the Verify phase in our proposed scheme is 2Tmts+Tmtp+Tecc-pa+2Tecc-pm+3Tbp milliseconds.InAggregate phase, the aggregator in kumaret al.'s scheme needs to perform n-1 point addition operations in G1, whereas the aggregator in the new proposal needs to perform n-1 point addition operations in G1. We can find that the running time of the Aggregate phase in the two schemes is equal to (n-1)Tecc-pa milliseconds.InAggregate-Verify phase, the aggregate verifier in kumaret al.'s scheme needs to perform n general hash operations in Zq∗, 2n map-to-point hash operations in G1, 3n-2 point addition operations in G1, n point multiplication operations in G1, and three-bilinear pairing operations. Therefore, the running time of the Aggregate-Verify phase is nTmts+2nTmtp+(3n-2)Tecc-pa+nTecc-pm+3Tbp milliseconds, whereas the verifier in the new proposal needs to perform 2n general hash operations in Zq∗, n+1 map-to-point hash operations in G1, 3n-2 point addition operations in G1, 2n point multiplication operations in G1, and three-bilinear pairing operations. Therefore, the running time of the Aggregate-Verify phase in our proposed scheme is 2nTmts+(n+1)Tmtp+(3n-2)Tecc-pa+2nTecc-pm+3Tbp milliseconds.Assuming thatn=100 in the Aggregate and Aggregate-Verify phases, the computation overhead comparisons are shown in Table 3 and Figure 3. As can be seen from the results in Table 3 and Figure 3, the computation overhead of our proposed CL-AS scheme is slightly higher than that of kumaret al.'s scheme for Sign and Verify phases. In Aggregate phase, the computation overheads of the two schemes are equal, whereas in the Agrregate-Verify phase, the computation overhead of our scheme is much lower than that of kumaret al.'s scheme. However, compared with the total computation overheads of these four phases, our scheme’s computation overhead is reduced by 24 percentage points compared with the that of kumaret al.'s scheme [8]. That is, we enforce the security in a large extent with the efficiency increased by 24 in computation overhead.Table 3
Computation cost comparisons (millisecond).
kumar’s Scheme [8] O u r  P r o p o s e d  S c h e m e Sign T m t s + T m t p + 2 T e c c - p a + 3 T e c c - p m ≈ 21.0372 2 T m t s + T m t p + 2 T e c c - p a + 4 T e c c - p m ≈ 24.7774  Verify Tmts+Tmtp+Tecc-pa+Tecc-pm+3Tbp≈48.0802 2Tmts+Tmtp+Tecc-pa+2Tecc-pm+3Tbp≈51.8204  Agrregate 99 T e c c - p a ≈ 2.178 99 T e c c - p a ≈ 2.178  A g g r e g a t e - V e r i f y 100 T m t s + 200 T m t p + 298 T e c c - p a + 100 T e c c - p m + 3 T b p ≈ 2369.721 200 T m t s + 101 T m t p + 298 T e c c - p a + 200 T e c c - p m + 3 T b p ≈ 1776.214Figure 3
Computation cost comparisons.


## 9. Conclusion

To ensure the privacy and integrity of patients medical information, several CL-AS schemes have been put forward recently. In this paper, we first investigate the techniques of the data signature. Then we show that Pankaj Kumaret al.'s scheme is vulnerable against the malicious attack. This attack is a serious threat from the inside attacker acting as a MS, because it allows the adversary to forge a signature of message mj using the signature of the message mi on signer IDi.To overcome this security flaw, we put forward a new CL-AS scheme for the issues of integrity and privacy in HMSN. The security analysis shows that our proposed CL-AS scheme is provably secure and can meet the security requirements in HMSN. In addition, the detailed performance analysis and evaluation demonstrate that our CL-AS scheme can achieve a novel security level while reducing the computation cost. Our CL-AS scheme is robust against all types of attacks, making it more useful for protecting the integrity and privacy of patients medical information.



---

*Source: 2595273-2018-06-13.xml*