# An Efficient Online/Offline Signcryption Scheme for Internet of Things in Smart Home

Authors: Nayab; Saddam Hussain; Amerah Alabrah; Syed Sajid Ullah; Hizbullah Khattak; Taha M. Alfakih; Insaf Ullah
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The delivery of unified intelligent services is accomplished through a networked environment comprised of a wide array of electronic devices. Through the use of Internet of Things (IoT) technology, smart homes collect data from their surroundings and use it to improve their tenants’ lives. Remote control, real-time monitoring, and a fire alarm are all characteristics of smart home security. Since smart homes hold personally identifying information about their residents, security is critical to ensure their reliability and prevent data breaches. In this paper, a certificateless online/offline signcryption (COOS) technique for IoT-enabled smart homes is proposed. The proposed solution takes advantage of a resource-constrained smart home device–friendly algorithm known as the Hyperelliptic Curve Cryptosystem (HCC). The suggested approach satisfies the security requirements of unforgeability, confidentiality, resistance to replay attacks, and non-repudiation. The complexity analysis in terms of communicational and computational costs demonstrates the efficiency of the proposed scheme. Finally, we validate the security against Man-In-The-Middle-Attack (MITM) and anti-reply attacks using Automated Validation of Internet Security Protocols and Applications (AVISPA). The data imply that the recommended course of action is safe.


---

## Body

## 1. Introduction

An essential part of the IoT, smart homes rely on IoT to effectively serve customers by communicating with a variety of digital devices. IoT-based smart home technology has transformed human lives by providing connectivity to everyone irrespective of place and time [1–3]. In recent years, home automation systems have become more sophisticated. These systems provide basic facilities and methods for transferring all types of device information and services.The Internet of Things is a world of actuators and sensors embedded in the material that is connected to a wireless and wired network that is permanent and interactive. The theme of the Internet of Things is to access and control these smart devices. The use of the Internet of Things by smart homes has made users’ lives more creative and comfortable [4, 5]. Figure 1 shows a typical smart home model, which includes appliances, actuators, sensors, and controllers. The controller monitors the sensor data and sends signals to the other linked sensors or electronic equipment, instructing them on how to operate appropriately. Apart from intelligence, security is a major issue in smart homes, as devices are connected to the internet, requiring more secure communication [6].Figure 1
Generic illustration of smart home.The significant ingredients of the smart home include entrance security, remote control, real-time monitoring, and fire alarm. As the sensitive data of the user is stored in smart homes, so security needs to be considered to ensure reliability to protect customers’ data from the breach. Authenticity and security of data are essential for data because of public access. Authenticity can be gained using digital signatures [7, 8], while data confidentiality can be obtained using encryption [9].Unfortunately, the higher computational and communicational cost of the signature and encryption opens up the way to signcryption. In 1997, Zheng [10] presents the concept of signcryption, which integrates the functionality of digital signature and encryption simultaneously. As the collected data from the Internet of Things can be accessible to a number of people, therefore, sensitive personal information in smart homes rises some dangerous security questions. In this regard, a number of cryptographic techniques have been present in literature, i.e., PKI, IBC and CLC [11]. The revocation and distribution of certificates are two challenges that have an impact on PKI. In addition, IBC is plagued by a crippling issue with key escrow. Therefore, CLC is the most appropriate solution available for smart home communication systems [12]. In addition, a few CLC solutions for the smart home have been found in the past, but the proposed schemes suffer from the use of heavy computational and communicational needs. Therefore, in this paper, we are suggesting a new solution for securing smart home communication at the expense of minimal resources. The major contributions of our research are given below:
(i)
We propose an online/offline certificateless signcryption scheme for smart home communication using a lightweight HCC(ii)
The proposed scheme is capable of achieving security necessities such as integrity, confidentiality, anti-replay attack, and non-repudiation(iii)
We perform a detailed comparison in terms of communicational and computational costs. The comparison result reveals that the suggested technique is more efficient and secure than previous online/offline signcryption schemes(iv)
Finally, we validate the security of the designed scheme using AVISPA. The results show that the intended scheme is secure against security attacks


### 1.1. Road Map of the Article

The rest of the paper is organized as follows: Section2 presents the related work. The essential prerequisites for the proposed scheme are discussed in Section 3. The proposed network model is described in Section 4. In Section 5, we compared the proposed scheme to other schemes that have already been implemented. Conclusions are presented in Section 6. The simulation data and code is placed in the appendix section.


## 1.1. Road Map of the Article

The rest of the paper is organized as follows: Section2 presents the related work. The essential prerequisites for the proposed scheme are discussed in Section 3. The proposed network model is described in Section 4. In Section 5, we compared the proposed scheme to other schemes that have already been implemented. Conclusions are presented in Section 6. The simulation data and code is placed in the appendix section.


## 2. Related Work

A smart home brings a very comfortable and intelligent life to its customers. Recently, smart home communication gains too much popularity due to a large number of data connections. Replay and mobile theft, for example, can expose user privacy and information to a range of attacks. Furthermore, the authenticity and security of communication in smart homes is critical. Additionally, smart home devices require a smart home server to undertake heavy activities for them due to resource constraints. Therefore, in order to meet the above requirement, you may need an online/offline technique. Thus, Luo et al. [13] present the first CLC-based online/offline signcryption for IoT. The authors claim that the designed scheme is provable secure under the computational model of Random Oracle (ROM). However, Luo et al.’s technique was determined to be insecure against private key compromise [14]. In addition, the authors use bilinear pairing for security hardness which makes the given scheme inefficient due to heavy pairing operations. Later, Li et al. [15] propose a new certificateless online/offline approach utilizing bilinear pairing under the computational model of Random Oracle, though the authors did not propose application deployment of the suggested scheme. In addition, the complexity design scheme is entirely based on bilinear pairing. In 2017, Li et al. [16] threw a certificateless online/offline approach utilizing bilinear pairing for the Internet of Things under computational model of Random Oracle. However, the complexity of Li et al. is entirely based on bilinear pairing. Rao [17] introduces an attribute-based online/offline signcryption (AOOS) technique utilizing bilinear pairing under the computational model of Random Oracle. Nonetheless, they did not present an application deployment of the design scheme. In addition, the complexity of [17] is entirely based on bilinear pairing. Saeed et al. [18] presented a heterogeneous online/offline signcryption scheme for wireless sensor networks that operates on ROM. However, the given scheme is constructed based on bilinear pairing. In 2019, Iqbal et al. [19] propose a blockchain-based AOOS strategy for wireless sensor networks. Unfortunately, the proposed strategy is based on bilinear pairing.Using the complexity of bilinear pairing, Yosef and Mahmoud [20] proposed an identity-based signcryption approach to secure end-user connections in smart home communication. Unfortunately, because of the use of identity-based signcryption, the design scheme suffers from a key escrow problem. Furthermore, the proposed system is built using bilinear pairing, that make it inefficient for smart homes devices.In 2018, Sai et al. [21] introduce an effective certificateless online/offline signcryption scheme that can offer biometric authentication for user identity. Regrettably, the proposed approach is based on bilinear pairing.


## 3. Preliminaries

### 3.1. Hyperelliptic Curve Cryptosystem (HCC)

HCC is an extension of elliptic curve cryptography (ECC), a public key cryptography approach that is comparable to ECC and bilinear pairing. In comparison to other approaches such as ECC, RSA, and digital signature algorithm (DSA), the HCC gives the same level of security. HCC is a suitable solution for resource-constrained applications due to its small key size. The HCDLP contributes to the security of HCC by preventing an adversary from cracking the keys even if the P and Q are publicly available.


#### 3.1.1. Hyperelliptic Curve Discrete Logarithm Problem (HCDLP)

The following complexity assumptions have been made in reference to the HCDLP:(i)
LetθE1,2,3,⋯,y−1 and X=θ.D; then, finding θ from X is called HCDLP


### 3.2. Threat Model

A threat in computing infrastructure is an incident that has the potential to harm or destroy the system. Threats are mostly events that aim to compromise a computing infrastructure’s integrity, confidentiality, and availability. Some system flaws, such as configuration design errors and security vulnerabilities, might lead to such dangers. Thus, anyone with evil purpose and technical competence can use these vulnerabilities to attack them, exposing the risks.Typically, cryptographic techniques are designed to work in an open environment where attackers can retrieve information shared between peers. The Doley-Yao threat model is frequently used in the development of such security solutions [22]. This model posits an insecure public channel (making information entities untrustworthy) and powerful adversaries, participants, and other organizations capable of receiving network messages. Despite the adversaries’ skills, there is knowledge that is off-limits. This information could be used to decrypt the message, encrypt the plaintext, or generate the same HMAC value without the right key by guessing random integers from some sample space. As a result, the Doley-Yao threat model is used in the design of the proposed approach in this paper, and the sole KGC is regarded entirely dependable.


## 3.1. Hyperelliptic Curve Cryptosystem (HCC)

HCC is an extension of elliptic curve cryptography (ECC), a public key cryptography approach that is comparable to ECC and bilinear pairing. In comparison to other approaches such as ECC, RSA, and digital signature algorithm (DSA), the HCC gives the same level of security. HCC is a suitable solution for resource-constrained applications due to its small key size. The HCDLP contributes to the security of HCC by preventing an adversary from cracking the keys even if the P and Q are publicly available.


### 3.1.1. Hyperelliptic Curve Discrete Logarithm Problem (HCDLP)

The following complexity assumptions have been made in reference to the HCDLP:(i)
LetθE1,2,3,⋯,y−1 and X=θ.D; then, finding θ from X is called HCDLP


## 3.1.1. Hyperelliptic Curve Discrete Logarithm Problem (HCDLP)

The following complexity assumptions have been made in reference to the HCDLP:(i)
LetθE1,2,3,⋯,y−1 and X=θ.D; then, finding θ from X is called HCDLP


## 3.2. Threat Model

A threat in computing infrastructure is an incident that has the potential to harm or destroy the system. Threats are mostly events that aim to compromise a computing infrastructure’s integrity, confidentiality, and availability. Some system flaws, such as configuration design errors and security vulnerabilities, might lead to such dangers. Thus, anyone with evil purpose and technical competence can use these vulnerabilities to attack them, exposing the risks.Typically, cryptographic techniques are designed to work in an open environment where attackers can retrieve information shared between peers. The Doley-Yao threat model is frequently used in the development of such security solutions [22]. This model posits an insecure public channel (making information entities untrustworthy) and powerful adversaries, participants, and other organizations capable of receiving network messages. Despite the adversaries’ skills, there is knowledge that is off-limits. This information could be used to decrypt the message, encrypt the plaintext, or generate the same HMAC value without the right key by guessing random integers from some sample space. As a result, the Doley-Yao threat model is used in the design of the proposed approach in this paper, and the sole KGC is regarded entirely dependable.


## 4. Proposed Scheme

In this section, we will discuss the proposed network model its mathematical construction.


### 4.1. Design Network Model

In Figure2, we demonstrated the designed network model for smart home communication using certificateless online/offline signcryption scheme with the complexity based on HCC. The designed network model has the following entities:
(ii)
Key generation center: It is a reliable party that is responsible for establishing secure communication between sender, controller, and receiver(iii)
Sender: The sender can be any smart device that can sense/collect data such as Lamp, smartphone, TV, AC, and CCTV(iv)
Receiver: The receiver can be any smart device that can receive data/messages such as smartphone, server, and PC(v)
Controller: The controller is a home gateway device that is able to connect and control the smart communication homeFigure 2
Designed network model.It is necessary to connect the smart home devices to the KGC in order to create secure communication. In the proposed network paradigm, the KGC is in charge of creating a partial private key, master keys, and a set of public parameters, respectively. The KGC then retained possession of the master secret key and distributes the remaining data throughout the network. This can be used by both the sender and the recipient to produce their own public and private keys for use in secure communication.


### 4.2. Construction of the Designed Scheme

In this section, we will construct a certificateless online/offline signcryption for smart home communication by using the following steps [23]. Furthermore, the notations used in the designed algorithm are added in Table 1.Table 1
Symbols used in the designed algorithm.
S/NSymbolExplanation1KGCKey generation center2kSecurity parameter3lPrivate key of KGC4Ho,Hp,HqHash functions5DDivisor of HCC6WMaster public key of KGC7ϑpUser partial private key8IDpIdentity of both users (sender and receiver)9QpUser public key10VpUser private key11ψSigncrypted text


### 4.3. Setup

Firstly, a security parameter (k) is given to the key generation center (KGC). After that, the KGC choose three hash functions Ho,Hp,andHq. Furthermore, the KGC pick lϵ1,2,⋯..,n−1 as a master secret key and compute the corresponding master public key as W=l.D. Finally, the KGC announce σ=W,D,Ho,Hp,andHqpublically as open parameter set.


### 4.4. Key Generation

Here in this phase, the participant registers themselves with KGC by sending their identity (IDp). Upon receiving the IDp, the KGC then picks ηpϵ1,2,⋯..,n−1, computes Γp=ηp.D, calculatesZp=ηp+l.HoIDp,Γp, and sends μ=Γp,Zp to the participant with IDp. So, after reception, a participant ϑpϵ1,2,⋯..,n−1 as a secret parameter and makes Χp=ϑp.D . The participant then sets Vp=(ϑp,Zp) as the private key and as Qp=Γp,Χp as a public key.


### 4.5. Signcryption

The signcryption phase is divided into two parts; the online part and the online part:(i)
Offline part: The signer selectsaϵ1,2,⋯..,n−1, computes S=a.D, calculates r1=HoIDr,Γr, computesr2=HpIDs,IDr,Xs,Χr,S,m, and K=r1+Γr+Χp, respectively(ii)
Online part: It computesw=m,Ns⊕HqK and N=ϑs+a/r2+ϑs+Zs and finally sends ψ=N,w,S,r2 to the intended receiver


### 4.6. Unsigncryption

After receiving the signcrypted textψ, the receiver performs the following computations:
(i)
ComputeK=Sϑr+Zr, and uncover the plaintext as m,Ns=w⊕HqK(ii)
Computer2/=HpIDs,IDr,Xs,Χr,S,m, and if r2/=r2, accept the signcrypted text ψ; otherwise, reject


### 4.7. Correctness

The recipient of the message can verify and decrypt the receivedψ=N,r2 by doing the following steps.It first uncovers the secret key by performing the computations as follows:K=ϑr+Zr=a.Dϑr+ηr+l.HoIDr,Γr=a,ϑr.D+ηr.D+l.DHoIDr,Γr=a, and Γr+Χr+W.r1=K; then, it recovers the plaintext as follows: m,Ns=w⊕HqK, and compute r2/=HpIDs,IDr,Xs,Χr,S,m, and if r2/=r2, then accept ψ; otherwise, reject it.


## 4.1. Design Network Model

In Figure2, we demonstrated the designed network model for smart home communication using certificateless online/offline signcryption scheme with the complexity based on HCC. The designed network model has the following entities:
(ii)
Key generation center: It is a reliable party that is responsible for establishing secure communication between sender, controller, and receiver(iii)
Sender: The sender can be any smart device that can sense/collect data such as Lamp, smartphone, TV, AC, and CCTV(iv)
Receiver: The receiver can be any smart device that can receive data/messages such as smartphone, server, and PC(v)
Controller: The controller is a home gateway device that is able to connect and control the smart communication homeFigure 2
Designed network model.It is necessary to connect the smart home devices to the KGC in order to create secure communication. In the proposed network paradigm, the KGC is in charge of creating a partial private key, master keys, and a set of public parameters, respectively. The KGC then retained possession of the master secret key and distributes the remaining data throughout the network. This can be used by both the sender and the recipient to produce their own public and private keys for use in secure communication.


## 4.2. Construction of the Designed Scheme

In this section, we will construct a certificateless online/offline signcryption for smart home communication by using the following steps [23]. Furthermore, the notations used in the designed algorithm are added in Table 1.Table 1
Symbols used in the designed algorithm.
S/NSymbolExplanation1KGCKey generation center2kSecurity parameter3lPrivate key of KGC4Ho,Hp,HqHash functions5DDivisor of HCC6WMaster public key of KGC7ϑpUser partial private key8IDpIdentity of both users (sender and receiver)9QpUser public key10VpUser private key11ψSigncrypted text


## 4.3. Setup

Firstly, a security parameter (k) is given to the key generation center (KGC). After that, the KGC choose three hash functions Ho,Hp,andHq. Furthermore, the KGC pick lϵ1,2,⋯..,n−1 as a master secret key and compute the corresponding master public key as W=l.D. Finally, the KGC announce σ=W,D,Ho,Hp,andHqpublically as open parameter set.


## 4.4. Key Generation

Here in this phase, the participant registers themselves with KGC by sending their identity (IDp). Upon receiving the IDp, the KGC then picks ηpϵ1,2,⋯..,n−1, computes Γp=ηp.D, calculatesZp=ηp+l.HoIDp,Γp, and sends μ=Γp,Zp to the participant with IDp. So, after reception, a participant ϑpϵ1,2,⋯..,n−1 as a secret parameter and makes Χp=ϑp.D . The participant then sets Vp=(ϑp,Zp) as the private key and as Qp=Γp,Χp as a public key.


## 4.5. Signcryption

The signcryption phase is divided into two parts; the online part and the online part:(i)
Offline part: The signer selectsaϵ1,2,⋯..,n−1, computes S=a.D, calculates r1=HoIDr,Γr, computesr2=HpIDs,IDr,Xs,Χr,S,m, and K=r1+Γr+Χp, respectively(ii)
Online part: It computesw=m,Ns⊕HqK and N=ϑs+a/r2+ϑs+Zs and finally sends ψ=N,w,S,r2 to the intended receiver


## 4.6. Unsigncryption

After receiving the signcrypted textψ, the receiver performs the following computations:
(i)
ComputeK=Sϑr+Zr, and uncover the plaintext as m,Ns=w⊕HqK(ii)
Computer2/=HpIDs,IDr,Xs,Χr,S,m, and if r2/=r2, accept the signcrypted text ψ; otherwise, reject


## 4.7. Correctness

The recipient of the message can verify and decrypt the receivedψ=N,r2 by doing the following steps.It first uncovers the secret key by performing the computations as follows:K=ϑr+Zr=a.Dϑr+ηr+l.HoIDr,Γr=a,ϑr.D+ηr.D+l.DHoIDr,Γr=a, and Γr+Χr+W.r1=K; then, it recovers the plaintext as follows: m,Ns=w⊕HqK, and compute r2/=HpIDs,IDr,Xs,Χr,S,m, and if r2/=r2, then accept ψ; otherwise, reject it.


## 5. Security Analysis

In this section, we present the security analysis of the designed scheme.


### 5.1. Confidentiality

When the attacker is unable to extract the original message from the ciphertext, then the phenomenon is known confidentiality. In the designed scheme the sender of the message first generates an encryption keyK=W.r1+Γr+Χrby utilizing private information such as a; then using the secret K, it simply encrypts the message asw=m,Ns⊕HqK. Thus, when the attacker wants to uncover m,Ns fromw, then the attacker needs to find K either from K=W.r1+Γr+ΧrorK=ϑr+Zr. Here, if the attacker wants to compute K=W.r1+Γr+Χr, then it first needs to extractafromS=a.D, which infeasible for the attacker to solve the HCDLP. Also, if the attacker wants to calculateK=Sϑr+Zr, then it uncovers a from Χr=ϑr.D which is infeasible for an attacker to solve the solution equals HCDLP. Furthermore, it computes Zr from Zr=ηr+l.HoIDr,Γr which require ηr from Γr=ηr.D and l on W=l.D which is equal to solving two times computations of HCDLP. Hence, from the aforementioned discussion, we conclude that the designed scheme achieves the security services of confidentiality.


### 5.2. Integrity

When the attacker is unable to alter the signcryption tuple, the phenomenon is known as integrity. In our designed scheme, the signer first creates a hash of the message:r2=HpIDs,IDr,Xs,Χr,S,m; then, it forwards the signcrypted tuples as ψ=N,w,S,r2 to the intended receiver. When the attacker wants to make changes in message m to m/, then the attacker needs to change r2 to r2/=HpIDs,IDr,Xs,Χr,S,m/ which is hard for the attacker due to nature of hash used (one way). Thus, the aforementioned discussion confirms that the designed framework provides the security services of integrity.


### 5.3. Non-repudiation

When the signer of the message is unable to decline from his transmitted signcrypted tuple, the phenomenon is known as non-repudiation. In the proposed scheme, the signer first produces a signatureN=ϑs+a/r2+ϑs+Zs using his key pair of the private key ϑs,Zs which is directly linked with public key pair Γs,Χs.Therefore, the KGC can simply guess by means of this information whether the signed tuple is sent by the sender or not.Thus, the above discussion indicates that the proposed technique provides non-repudiation security services.


### 5.4. Unforgeability

When the attacker is not able to produce actual digital signature produce by the sender of the message, the phenomenon is known as unforgeability. In the proposed scheme, the sender of the message generates a signatureN=ϑs+a/r2+ϑs+Zs using three private parameters (ϑ_s, Z_s, and a). Therefore, when the attacker wants to make the same digital signature, then it needs to ϑs and a from Χs=ϑs.D, and compute S=a.D which is equal to solving two times computation of HCDLP and therefore infeasible for the attacker. On the other hand, the attacker also needs to compute Zs from Zs=ηs+l.HoIDs,Γs, which further need ηs from Γs=ηs.D and l from W=l.D which is also equivalent to twice the computation of HCDLP. Hence, in this way, the aforementioned discussion confirms that the newly proposed scheme provides the security services of unforgeability.


### 5.5. Anti-replay Attack

When the attacker is unable to relay the old captured messages, the phenomenon is known as an anti-replay attack. In the proposed scheme, the signer of the message attaches a new fresh nonceNs that is encrypted with the message w=m,Ns⊕HqK using the secret keyK. When the attacker wants to uncover the fresh nonce Ns from w, then the attacker needs to recover K as K=aW.r1+Γr+Χr. here, if the attacker wants to compute K=aW.r1+Γr+Χr, then it first needs to obtain a fromS=a.D, which is equal to solving an HCDLP. Thus, in this way, the aforementioned discussion confirms that the newly proposed scheme provides the security services of anti-replay attacks.


## 5.1. Confidentiality

When the attacker is unable to extract the original message from the ciphertext, then the phenomenon is known confidentiality. In the designed scheme the sender of the message first generates an encryption keyK=W.r1+Γr+Χrby utilizing private information such as a; then using the secret K, it simply encrypts the message asw=m,Ns⊕HqK. Thus, when the attacker wants to uncover m,Ns fromw, then the attacker needs to find K either from K=W.r1+Γr+ΧrorK=ϑr+Zr. Here, if the attacker wants to compute K=W.r1+Γr+Χr, then it first needs to extractafromS=a.D, which infeasible for the attacker to solve the HCDLP. Also, if the attacker wants to calculateK=Sϑr+Zr, then it uncovers a from Χr=ϑr.D which is infeasible for an attacker to solve the solution equals HCDLP. Furthermore, it computes Zr from Zr=ηr+l.HoIDr,Γr which require ηr from Γr=ηr.D and l on W=l.D which is equal to solving two times computations of HCDLP. Hence, from the aforementioned discussion, we conclude that the designed scheme achieves the security services of confidentiality.


## 5.2. Integrity

When the attacker is unable to alter the signcryption tuple, the phenomenon is known as integrity. In our designed scheme, the signer first creates a hash of the message:r2=HpIDs,IDr,Xs,Χr,S,m; then, it forwards the signcrypted tuples as ψ=N,w,S,r2 to the intended receiver. When the attacker wants to make changes in message m to m/, then the attacker needs to change r2 to r2/=HpIDs,IDr,Xs,Χr,S,m/ which is hard for the attacker due to nature of hash used (one way). Thus, the aforementioned discussion confirms that the designed framework provides the security services of integrity.


## 5.3. Non-repudiation

When the signer of the message is unable to decline from his transmitted signcrypted tuple, the phenomenon is known as non-repudiation. In the proposed scheme, the signer first produces a signatureN=ϑs+a/r2+ϑs+Zs using his key pair of the private key ϑs,Zs which is directly linked with public key pair Γs,Χs.Therefore, the KGC can simply guess by means of this information whether the signed tuple is sent by the sender or not.Thus, the above discussion indicates that the proposed technique provides non-repudiation security services.


## 5.4. Unforgeability

When the attacker is not able to produce actual digital signature produce by the sender of the message, the phenomenon is known as unforgeability. In the proposed scheme, the sender of the message generates a signatureN=ϑs+a/r2+ϑs+Zs using three private parameters (ϑ_s, Z_s, and a). Therefore, when the attacker wants to make the same digital signature, then it needs to ϑs and a from Χs=ϑs.D, and compute S=a.D which is equal to solving two times computation of HCDLP and therefore infeasible for the attacker. On the other hand, the attacker also needs to compute Zs from Zs=ηs+l.HoIDs,Γs, which further need ηs from Γs=ηs.D and l from W=l.D which is also equivalent to twice the computation of HCDLP. Hence, in this way, the aforementioned discussion confirms that the newly proposed scheme provides the security services of unforgeability.


## 5.5. Anti-replay Attack

When the attacker is unable to relay the old captured messages, the phenomenon is known as an anti-replay attack. In the proposed scheme, the signer of the message attaches a new fresh nonceNs that is encrypted with the message w=m,Ns⊕HqK using the secret keyK. When the attacker wants to uncover the fresh nonce Ns from w, then the attacker needs to recover K as K=aW.r1+Γr+Χr. here, if the attacker wants to compute K=aW.r1+Γr+Χr, then it first needs to obtain a fromS=a.D, which is equal to solving an HCDLP. Thus, in this way, the aforementioned discussion confirms that the newly proposed scheme provides the security services of anti-replay attacks.


## 6. Performance Analysis

Based on computation time and communication overhead, we compared our proposed scheme to the existing schemes.


### 6.1. Computation Time

This section presents the comparison of the proposed framework with some relevant online/offline signcryption approaches cited [18–21] in terms of computational time with including parameters Bilinear Pairing Operations (BPO), Bilinear Pairing Multiplication (BPM), EXxponentiations (EX), and Hyperelliptic Curve Devisor Multiplication (HCDM). The running operational time of the given parameters is taken from [23–25].
(i)
Running time of Hyperelliptic Curve Devisor MultiplicationHCDM=0.48ms(ii)
Running time of Bilinear Pairing MultiplicationBPM=4.31ms(iii)
Running time of EXponentiationsEX=1.25ms(iv)
Running time of Bilinear Pairing OperationsBPO=14.90msTable2 shows the computational time of the aforementioned parameters used in the proposed framework and the relevant online/offline signcryption schemes cited [18–21]. Lastly, Figure 3 and Table 3 clearly demonstrate the efficiency of the proposed framework in terms of computational time.Table 2
Computational time analysis of the proposed scheme with relevant schemes in terms of costly mathematical operations used.
Ref. no.SigncryptionUn-SigncryptionTotal mathematical operationsSaeed et al. [18]1 EX+4 BPM1 EX+1 BPM+2 BPO2 EX+5 BPM+2 BPOIqbal et al. [19]1 EX+2 BPM1 EX+1 BPM+2 BPO2 EX+3 BPM+2 BPOAshibani and Mahmoud [20]3 BPM+1 BPO4 BPO3 BPM+5 BPOSai et al. [21]1 EX+2 BPM3 BPM+2 BPO2 EX+5 BPM+2 BPODesigned framework2HCDM1HCDM3HCDMFigure 3
Computational time analysis of the proposed scheme with relevant schemes in terms of milliseconds.Table 3
Total computational time analysis of the proposed scheme with relevant schemes in terms of milliseconds (ms).
Ref. no.SigncryptionUn-signcryptionTotal computation timeSaeed et al. [18]18.49 ms35.36 ms53.85 msIqbal et al. [19]9.87 ms35.36 ms45.23 msAshibani and Mahmoud [20]27.83 ms59.6 ms87.43 msSai et al. [21]11.12 ms42.73 ms53.85 msDesigned framework0.96 ms0.48 ms1.44 ms


#### 6.1.1. Percentage Improvement

The percentage computational time improvement can be calculated using the given formula:(1)Costofpreviousscheme−CostofproposedschemeCostofpreviousscheme∗100.(i)
Percentage computational time improvement from Saeed et al. [18] is(2)=53.85−1.4453.85∗100=97.32%(ii)
Percentage computational time improvement from Iqbal et al. [19] is(3)=45.23−1.4445.23∗100=96.81%(iii)
Percentage computational time improvement from Ashibani and Mahmoud [20] is(4)=87.43−1.4487.43∗100=98.35%(iv)
Percentage computational time improvement from Sai et al. [21] is(5)=53.85−1.4453.85∗100=97.32%


### 6.2. Communication Overhead

In this section, we compare the proposed framework with some relevant online/offline signcryption approaches cited [18–21] in terms of communication overhead with the including parameters bilinear pairing and Hyperelliptic Curve Cryptosystem. The bits size of the given parameters is taken from [24, 25].
(i)
Bits utilized by Bilinear PairingG=1024(ii)
Bits utilized by Hyperelliptic Curve CryptosystemN=80(iii)
Bits utilized by plaintextm=512Table4 shows the communication overhead of the aforementioned parameters in the proposed framework and the relevant online/offline signcryption schemes cited [18–21]. Lastly, Figure 4 clearly demonstrates the efficiency of the proposed framework in terms of communication overhead.Table 4
Communication overhead analysis of the designed framework with relevant schemes.
Ref. no.Ciphertext sizeSaeed et al. [18]m+5G=5632bitsIqbal et al. [19]m+5G=5632bitsAshibani and Mahmoud [20]m+2G=2560bitsSai et al. [21]m+4G=4608bitsDesigned frameworkm+3N=752bitsFigure 4
Communication cost analysis.


#### 6.2.1. Percentage Improvement

The percentage of communication overhead improvement can be calculated using the given formula:(6)Costofpreviousscheme−CostofproposedschemeCostofpreviousscheme∗100.(i)
Percentage communication overhead improvement from Saeed et al. [18] is(7)=5632−7525632∗100=86.64%(ii)
Percentage communication overhead improvement from Iqbal et al. [19] is(8)=5632−7525632∗100=86.64%(iii)
Percentage communication overhead improvement from Ashibani and Mahmoud et al. [20] is(9)=2560−7522560∗100=70.62%(iv)
Percentage communication overhead improvement from Sai et al. [19] is(10)=4608−7524608∗100=83.68%


## 6.1. Computation Time

This section presents the comparison of the proposed framework with some relevant online/offline signcryption approaches cited [18–21] in terms of computational time with including parameters Bilinear Pairing Operations (BPO), Bilinear Pairing Multiplication (BPM), EXxponentiations (EX), and Hyperelliptic Curve Devisor Multiplication (HCDM). The running operational time of the given parameters is taken from [23–25].
(i)
Running time of Hyperelliptic Curve Devisor MultiplicationHCDM=0.48ms(ii)
Running time of Bilinear Pairing MultiplicationBPM=4.31ms(iii)
Running time of EXponentiationsEX=1.25ms(iv)
Running time of Bilinear Pairing OperationsBPO=14.90msTable2 shows the computational time of the aforementioned parameters used in the proposed framework and the relevant online/offline signcryption schemes cited [18–21]. Lastly, Figure 3 and Table 3 clearly demonstrate the efficiency of the proposed framework in terms of computational time.Table 2
Computational time analysis of the proposed scheme with relevant schemes in terms of costly mathematical operations used.
Ref. no.SigncryptionUn-SigncryptionTotal mathematical operationsSaeed et al. [18]1 EX+4 BPM1 EX+1 BPM+2 BPO2 EX+5 BPM+2 BPOIqbal et al. [19]1 EX+2 BPM1 EX+1 BPM+2 BPO2 EX+3 BPM+2 BPOAshibani and Mahmoud [20]3 BPM+1 BPO4 BPO3 BPM+5 BPOSai et al. [21]1 EX+2 BPM3 BPM+2 BPO2 EX+5 BPM+2 BPODesigned framework2HCDM1HCDM3HCDMFigure 3
Computational time analysis of the proposed scheme with relevant schemes in terms of milliseconds.Table 3
Total computational time analysis of the proposed scheme with relevant schemes in terms of milliseconds (ms).
Ref. no.SigncryptionUn-signcryptionTotal computation timeSaeed et al. [18]18.49 ms35.36 ms53.85 msIqbal et al. [19]9.87 ms35.36 ms45.23 msAshibani and Mahmoud [20]27.83 ms59.6 ms87.43 msSai et al. [21]11.12 ms42.73 ms53.85 msDesigned framework0.96 ms0.48 ms1.44 ms


### 6.1.1. Percentage Improvement

The percentage computational time improvement can be calculated using the given formula:(1)Costofpreviousscheme−CostofproposedschemeCostofpreviousscheme∗100.(i)
Percentage computational time improvement from Saeed et al. [18] is(2)=53.85−1.4453.85∗100=97.32%(ii)
Percentage computational time improvement from Iqbal et al. [19] is(3)=45.23−1.4445.23∗100=96.81%(iii)
Percentage computational time improvement from Ashibani and Mahmoud [20] is(4)=87.43−1.4487.43∗100=98.35%(iv)
Percentage computational time improvement from Sai et al. [21] is(5)=53.85−1.4453.85∗100=97.32%


## 6.1.1. Percentage Improvement

The percentage computational time improvement can be calculated using the given formula:(1)Costofpreviousscheme−CostofproposedschemeCostofpreviousscheme∗100.(i)
Percentage computational time improvement from Saeed et al. [18] is(2)=53.85−1.4453.85∗100=97.32%(ii)
Percentage computational time improvement from Iqbal et al. [19] is(3)=45.23−1.4445.23∗100=96.81%(iii)
Percentage computational time improvement from Ashibani and Mahmoud [20] is(4)=87.43−1.4487.43∗100=98.35%(iv)
Percentage computational time improvement from Sai et al. [21] is(5)=53.85−1.4453.85∗100=97.32%


## 6.2. Communication Overhead

In this section, we compare the proposed framework with some relevant online/offline signcryption approaches cited [18–21] in terms of communication overhead with the including parameters bilinear pairing and Hyperelliptic Curve Cryptosystem. The bits size of the given parameters is taken from [24, 25].
(i)
Bits utilized by Bilinear PairingG=1024(ii)
Bits utilized by Hyperelliptic Curve CryptosystemN=80(iii)
Bits utilized by plaintextm=512Table4 shows the communication overhead of the aforementioned parameters in the proposed framework and the relevant online/offline signcryption schemes cited [18–21]. Lastly, Figure 4 clearly demonstrates the efficiency of the proposed framework in terms of communication overhead.Table 4
Communication overhead analysis of the designed framework with relevant schemes.
Ref. no.Ciphertext sizeSaeed et al. [18]m+5G=5632bitsIqbal et al. [19]m+5G=5632bitsAshibani and Mahmoud [20]m+2G=2560bitsSai et al. [21]m+4G=4608bitsDesigned frameworkm+3N=752bitsFigure 4
Communication cost analysis.


### 6.2.1. Percentage Improvement

The percentage of communication overhead improvement can be calculated using the given formula:(6)Costofpreviousscheme−CostofproposedschemeCostofpreviousscheme∗100.(i)
Percentage communication overhead improvement from Saeed et al. [18] is(7)=5632−7525632∗100=86.64%(ii)
Percentage communication overhead improvement from Iqbal et al. [19] is(8)=5632−7525632∗100=86.64%(iii)
Percentage communication overhead improvement from Ashibani and Mahmoud et al. [20] is(9)=2560−7522560∗100=70.62%(iv)
Percentage communication overhead improvement from Sai et al. [19] is(10)=4608−7524608∗100=83.68%


## 6.2.1. Percentage Improvement

The percentage of communication overhead improvement can be calculated using the given formula:(6)Costofpreviousscheme−CostofproposedschemeCostofpreviousscheme∗100.(i)
Percentage communication overhead improvement from Saeed et al. [18] is(7)=5632−7525632∗100=86.64%(ii)
Percentage communication overhead improvement from Iqbal et al. [19] is(8)=5632−7525632∗100=86.64%(iii)
Percentage communication overhead improvement from Ashibani and Mahmoud et al. [20] is(9)=2560−7522560∗100=70.62%(iv)
Percentage communication overhead improvement from Sai et al. [19] is(10)=4608−7524608∗100=83.68%


## 7. Conclusion

In this paper, we proposed an online/offline signcryption approach for IoT-enabled smart homes in a certificateless environment. The proposed approach is based on the Hyperelliptic Curve Cryptosystem (HCC), a lightweight complexity algorithm that is well-suited to resource-constrained smart home devices. According to security analysis, the designed framework meets the security requirements of integrity, unforgeability, secrecy, anti-replay attack, and non-repudiation. The proposed scheme’s efficiency and effectiveness are demonstrated by the complexity analysis of computation and communication costs. Finally, we used the AVISPA tool to verify our proposed framework. The output findings show that the framework is secure against malicious threats.



---

*Source: 4215441-2022-04-29.xml*