# Post-Quantum Secure Identity-Based Encryption Scheme using Random Integer Lattices for IoT-enabled AI Applications

Authors: Dharminder Dharminder; Ashok Kumar Das; Sourav Saha; Basudeb Bera; Athanasios V. Vasilakos
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Identity-based encryption is an important cryptographic system that is employed to ensure confidentiality of a message in communication. This article presents a provably secure identity based encryption based on post quantum security assumption. The security of the proposed encryption is based on the hard problem, namely Learning with Errors on integer lattices. This construction is anonymous and produces pseudo random ciphers. Both public-key size and ciphertext-size have been reduced in the proposed encryption as compared to those for other relevant schemes without compromising the security. Next, we incorporate the constructed identity based encryption (IBE) for Internet of Things (IoT) applications, where the IoT smart devices send securely the sensing data to their nearby gateway nodes(s) with the help of IBE and the gateway node(s) secure aggregate the data from the smart devices by decrypting the messages using the proposed IBE decryption. Later, the gateway nodes will securely send the aggregated data to the cloud server(s) and the Big data analytics is performed on the authenticated data using the Artificial Intelligence (AI)/Machine Learning (ML) algorithms for accurate and better predictions.


---

## Body

## 1. Introduction

According to [1], it is projected by 2027 the market of Internet of Things (IoT) industry will grow by $2 trillion annually, which has already a market of $520 billion in 2022. In the connected world, the IoT makes an environment where various smart devices are interconnected with each other. The advancement of information and communications technology (ICT) makes the IoT technologies and their solutions rich that have great impact to the society for improving the human life advanced and easy. There are enormous applications of IoT, such as Industrial IoT (IIoT), smart cities, healthcare monitoring, smart home, and so on. In an IIoT, various IoT smart devices are connected in an industry to collect manufacturing data in order to predict the failure rates to increase productivity and efficiency [2]. In healthcare application, various smart devices like smartwatches and medical sensors are connected in the body of a patient to collect vital information and provide appropriate health condition of that person. Furthermore, in recent days, smart home application is in limelight where the smart devices like smart locks and home appliances are connected with each other via the internet and they can be also controlled via the mobile devices. Though IoT has transformed the human life easier, there are various serious threats associated with IoT applications. For instance, it was found by HP that 70% of the devices connected IoT devices are vulnerable to various attacks [3].In IoT applications, the smart devices exchange the sensitive data among each other and also with various other entities. In such a scenario, an unauthorized user or an attacker may take the advantage to compromise the data by eavesdropping, modifying, updating and deleting the information during the communication [4]. According to broadcom [5] in the year 2017, it was found that there was an approximately 600% hike in attacks against IoT devices in various applications. Therefore, there is a great need to design a secure IoT system to protect the data from the attackers [6].Once the sensing information from the deployed smart devices in an IoT environment is aggregated by the nearby gateway node or access point, the gathered data needs to be also stored in semi-trusted cloud servers. Now, the stored data at the cloud is huge in volume and it needs data analytics. As a result, it is preferable to used some Big data analytics using traditional Artificial Intelligence (AI)/Machine Learning (ML) algorithms for accurate and better predictions [7, 8].Ahanger et al. [9] provided various Machine Learning (ML) and Deep Learning (DL) based mechanisms for IoT paradigm. They also provided a taxonomy based on several IoT vulnerabilities, respective attackers and effects, as well as various threats. Iwendi et al. [10] pointed out the important of deep learning (DL) for detecting attacks in IoT paradigm. They suggested DL based mechanism to detect cyber-attacks on IoT using a long short term networks classifier.Omolara et al. [11] gave an IoT concept and then provided the deep insights into possible solutions to the IoT security challenges due to the heterogeneous nature of IoT, and the respective emerging issues, opportunities, gaps as well as recommendations. Mukhopadhyay et al. [12] pointed out that IoT sensors need to be reliable, safety as well as privacy-aware for the users interacting with them. Thus, they discussed that IoT sensors having advanced AI capabilities will have the potential for identifying, detecting, and avoiding performance degradation as well as discovering new patterns.Public-key cryptosystem works under a pair of keys (public key and private key), whereas the public key is made public that is accessible by everyone during communication, and the private key is kept secret and only known to the owner (sender/signer). The notion of the “Identity-Based Encryption (IBE)” due to Shamir [13], solves the certificate management problem. The existing Shor’s algorithm [14] is a big threat to the existing number-theoretic identity-based encryptions. The main difference of IBE from certificate based public-key encryption schemes lies in the way how the public and secret keys pair generated for a user. A private key generator, say PKG handles the process of secret key generation, but it executes user authentication process to confirm the validity of a legitimate user. In IBE process, a public key may be an information such as the user’s email address or mobile number. The corresponding secret key is generated by embedding the user’s identity with the PKG’s master secret. This process removes the need of certificate that is required for verification of a legitimate recipient’s public key. The IBE process also solves the problems related to key generations and distributions in a multi-user settings. In case of limited resources, it can also offer the potential solution to make the process resource efficient.In the literature, we have three important classes of identity-based encryptions (IBE) (see in Figure1): 1) IBE based on bilinear pairings [15–18], 2) IBE based on quadratic residue [19, 20], and 3) IBE based on lattices [21]. To the best of our knowledge, most of the constructions proposed in the standard model relies on bilinear pairings.Figure 1
A communication model for IBE.Chamola et al. [22] reviewed that the disruption which the quantum computers have caused in the cryptographic field. They pointed out that the existing public key encryption schemes can be broken by the quantum computers, and as a result, there is a requirement for hunting the new cryptographic mechanisms that need to be secure in the post-quantum era. Hassija et al. [23] provided a review on several quantum computing applications that can be applied in different computer science areas, including “cryptography”, “machine learning”, “deep learning” as well as “quantum simulations”. They also provided several real-life case studies on “risk analysis”, “logistics”, and “satellite communication”. Hassija et al. [24] also discussed that with the help of online cloud services, the first generation of quantum computers can be programmed and accessed using the available software development kits. Moreover, they presented a growing trend in both the investments as well as patents in the quantum computing field. In recent years, the lattice-based cryptography has played a very important role in the post-quantum era for various real-life applications, such as “Vehicular Ad Hoc Network (VANET)” [25], “ medical Cyber-Physical Systems (CPS)” [26] and “mobile communications” [27].


### 1.1. Research Contributions

There are two reasons to move towards post quantum secure lattice based cryptography: a) simple algebraic operations that are based on matrix multiplication and b) secure against existing quantum assisted algorithms. The main contributions of the work are listed below:•
This article presents a new identity-based encryption based on lattices without using the random oracles. The proposed encryption is anonymous in nature [28], which means that the cipher does not reveal the recipient’s identity.•
Our proposed encryption is selective-ID secure [29], and can be converted to an adaptive-ID secure [15, 16, 30] by taking the bit-wise decomposition of the corresponding identities.•
The proposed encryption is inspired from the Water’s [18] encryption and signature that use only non-zero positions of bits in the decomposition of the corresponding identity. The encryption is secure under “learning with errors” assumption without the random oracles.•
Ifκ is an appropriate security parameter and Oκ2 is the size of a public key, we can relate the computation time in terms of security parameter complexity as Oκ2, and it can be compared with the size of classic public key (such as RSA [31] and ElGamal [32] cryptosystems) as Oκ and computation time in terms of security parameter as Oκ3, respectively [33].•
We then incorporate the constructed identity based encryption (IBE) for IoT applications, where the smart devices send securely the sensing data to their nearby gateway nodes(s) with the help of IBE and the gateway node(s) secure aggregate the data from the smart devices by decrypting the messages using the proposed IBE decryption. Later, the authenticated data stored at the cloud server(s) will be used for accurate and better predictions with the help of AI/ML algorithms.


### 1.2. Paper Outline

In Section2, the security of an Identity-Based Encryption (IBE) is discussed. Section 3 provides a discussion of basic preliminaries that are needed to analyze the proposed scheme in Section 4. In Section 5, we incorporating our proposed IBE scheme for IoT-enabled AI applications. Next, the security analysis of the proposed scheme under standard models is discussed in Section 6. A comparative study among the proposed scheme and other relevant schemes is given in Section 7. Some concluding remarks are then provided in Section 8.


## 1.1. Research Contributions

There are two reasons to move towards post quantum secure lattice based cryptography: a) simple algebraic operations that are based on matrix multiplication and b) secure against existing quantum assisted algorithms. The main contributions of the work are listed below:•
This article presents a new identity-based encryption based on lattices without using the random oracles. The proposed encryption is anonymous in nature [28], which means that the cipher does not reveal the recipient’s identity.•
Our proposed encryption is selective-ID secure [29], and can be converted to an adaptive-ID secure [15, 16, 30] by taking the bit-wise decomposition of the corresponding identities.•
The proposed encryption is inspired from the Water’s [18] encryption and signature that use only non-zero positions of bits in the decomposition of the corresponding identity. The encryption is secure under “learning with errors” assumption without the random oracles.•
Ifκ is an appropriate security parameter and Oκ2 is the size of a public key, we can relate the computation time in terms of security parameter complexity as Oκ2, and it can be compared with the size of classic public key (such as RSA [31] and ElGamal [32] cryptosystems) as Oκ and computation time in terms of security parameter as Oκ3, respectively [33].•
We then incorporate the constructed identity based encryption (IBE) for IoT applications, where the smart devices send securely the sensing data to their nearby gateway nodes(s) with the help of IBE and the gateway node(s) secure aggregate the data from the smart devices by decrypting the messages using the proposed IBE decryption. Later, the authenticated data stored at the cloud server(s) will be used for accurate and better predictions with the help of AI/ML algorithms.


## 1.2. Paper Outline

In Section2, the security of an Identity-Based Encryption (IBE) is discussed. Section 3 provides a discussion of basic preliminaries that are needed to analyze the proposed scheme in Section 4. In Section 5, we incorporating our proposed IBE scheme for IoT-enabled AI applications. Next, the security analysis of the proposed scheme under standard models is discussed in Section 6. A comparative study among the proposed scheme and other relevant schemes is given in Section 7. Some concluding remarks are then provided in Section 8.


## 2. Security of an Identity-Based Encryption

An identity-based encryption (IBE) [15] comprises of four phases (algorithms): a) Set-up, b) Extraction, c) Encrypts, and d) Decrypts. The Set-up algorithm is run under the public parameters and a secret master key. The Extraction algorithm makes use of the master key to create a secret key respective to the given identity. The Encrypts algorithm encrypts a message using the identity. Finally, the Decrypts algorithm decrypts a ciphertext with the help of the corresponding private key.


### 2.1. Both Selective and Adaptive Encryption

The security model of an IBE [15] defines the “indistinguishable adaptive chosen cipher and chosen identity (IND-ID-CCA2)” security. It allows a probabilistic polynomial time-adversary, say A to pick an identity on which it wants to target. A weaker version of an IBE security [34] restricts the adversary A to announce the target or identity at advance, that is known as the “indistinguishable adaptive chosen cipher and selective identity (IND-sID-CCA2)” security. We have described this system as a selective identity and chosen cipher secure identity-based encryption. In this version of encryption, we will not allow the adversary A to process decryption queries on the target identity, which implies a weaker notion of the “indistinguishable against adaptive chosen cipher and chosen identity (IND-ID-CCA2) and indistinguishable adaptive chosen cipher and selective identity (IND-sID-CCA2)”, respectively. Another important notion is the “indistinguishable cipher against chosen plaintext attack (IND-CPA)”, which is also called semantic security.


### 2.2. Security Model

We now define an IBE semantic security under theIND-sID-CCA2 with the help of a game that is played between a challenger, say C and an adversary A. The description of the game is given below.1.
Target-phase:A declares the target identity ID∗ in advance.2.
Set-up-phase:C executes the Set-up-phase, generates the public parameters for A, and keeps the master key as secret.Phase-1.
A submits queries q1, q2, …, qm corresponding to the identities ID1, ID2, …, IDm, respectively, where IDi≠ID∗ for 1≤i≤m. Now, C runs an algorithm, called ExtractionMk,IDi with the master key Mk and identity IDi to obtain the private key Di corresponding to the identity IDi, IDi, which is the public key. Then, it sends Di to A, where all the queries are processed adaptively meaning that A can make queries with the knowledge of the previous queries.3.
Challenge-phase: After completion of Phase-1, A submits two messages m0 and m1 from the message space on which it executes the challenge. The challenger C then picks b∈0,1 randomly, and outputs c=Encrypts(paramts, ID∗, mb) and sends it to A, where paramts, paramts are the parameters relevant to encryption.Phase-2.
A submits the adaptive extraction queries qm+1, qm+2, …, qn corresponding to IDm+1, IDm+2, …, IDn, where IDi≠ID∗, respectively. Next, C replies as in Phase-1.4.
Guess-phase: Finally, A requires to guess a bit b′∈0,1. The game is won by A if b′=b; otherwise, A looses the game.
We call such an adversaryA as an IND-sID-CPA-adversary, and define the advantage of A attacking the identity-based encryption, say P as(1)ADVAP=Prb=b′−12.
We can also describe an adaptive phase to the above notion by excluding the target phase, and permittingA to wait for the challenge phase to declare ID∗ as challenge identity. A can submit the arbitrary key extraction queries as in Phase-1, and then select an identity ID∗, ID∗ as a target. But, the only condition imposed here is that A cannot submit extraction query on ID∗, ID∗ in Phase-1, and the resulting notion is called as IND-ID-CPA security. In Cipher-Anonymity along with semantic security, we have another important notion of cipher anonymity under chosen plaintext attack.


## 2.1. Both Selective and Adaptive Encryption

The security model of an IBE [15] defines the “indistinguishable adaptive chosen cipher and chosen identity (IND-ID-CCA2)” security. It allows a probabilistic polynomial time-adversary, say A to pick an identity on which it wants to target. A weaker version of an IBE security [34] restricts the adversary A to announce the target or identity at advance, that is known as the “indistinguishable adaptive chosen cipher and selective identity (IND-sID-CCA2)” security. We have described this system as a selective identity and chosen cipher secure identity-based encryption. In this version of encryption, we will not allow the adversary A to process decryption queries on the target identity, which implies a weaker notion of the “indistinguishable against adaptive chosen cipher and chosen identity (IND-ID-CCA2) and indistinguishable adaptive chosen cipher and selective identity (IND-sID-CCA2)”, respectively. Another important notion is the “indistinguishable cipher against chosen plaintext attack (IND-CPA)”, which is also called semantic security.


## 2.2. Security Model

We now define an IBE semantic security under theIND-sID-CCA2 with the help of a game that is played between a challenger, say C and an adversary A. The description of the game is given below.1.
Target-phase:A declares the target identity ID∗ in advance.2.
Set-up-phase:C executes the Set-up-phase, generates the public parameters for A, and keeps the master key as secret.Phase-1.
A submits queries q1, q2, …, qm corresponding to the identities ID1, ID2, …, IDm, respectively, where IDi≠ID∗ for 1≤i≤m. Now, C runs an algorithm, called ExtractionMk,IDi with the master key Mk and identity IDi to obtain the private key Di corresponding to the identity IDi, IDi, which is the public key. Then, it sends Di to A, where all the queries are processed adaptively meaning that A can make queries with the knowledge of the previous queries.3.
Challenge-phase: After completion of Phase-1, A submits two messages m0 and m1 from the message space on which it executes the challenge. The challenger C then picks b∈0,1 randomly, and outputs c=Encrypts(paramts, ID∗, mb) and sends it to A, where paramts, paramts are the parameters relevant to encryption.Phase-2.
A submits the adaptive extraction queries qm+1, qm+2, …, qn corresponding to IDm+1, IDm+2, …, IDn, where IDi≠ID∗, respectively. Next, C replies as in Phase-1.4.
Guess-phase: Finally, A requires to guess a bit b′∈0,1. The game is won by A if b′=b; otherwise, A looses the game.
We call such an adversaryA as an IND-sID-CPA-adversary, and define the advantage of A attacking the identity-based encryption, say P as(1)ADVAP=Prb=b′−12.
We can also describe an adaptive phase to the above notion by excluding the target phase, and permittingA to wait for the challenge phase to declare ID∗ as challenge identity. A can submit the arbitrary key extraction queries as in Phase-1, and then select an identity ID∗, ID∗ as a target. But, the only condition imposed here is that A cannot submit extraction query on ID∗, ID∗ in Phase-1, and the resulting notion is called as IND-ID-CPA security. In Cipher-Anonymity along with semantic security, we have another important notion of cipher anonymity under chosen plaintext attack.


## 3. Preliminaries

Letℝ be a set of real numbers and x∈ℝ be a real number. We denote ⌊x⌋ as the largest integer, but not greater than x, whereas ⌞x⌝=⌞x+1/2⌝ denotes the integer closest to x, with ties broken upward. We apply a bold big letter A to denote a matrix and a bold small letter x to denote a column vector of the matrix A, where A|x denotes concatenation of the matrix A with a vector x. Let ℤ denote the set of all integers and ℤq=ℤ/qℤ be a quotient ring under integers modulo a prime q, that is, a collection of the (left or right) cosets a+qℤ with addition and multiplication operations in the quotient ring ℤq. It is worth noticing that y=zmodq if and only if y+qℤ=z+qℤ, which is an obvious fact about the equality of cosets.


### 3.1. Lattice

A latticeΔ is defined with the following two properties: 1) it is an additive subgroup which implies 0∈Δ, and −x, x+y∈Δ for all x,y∈Δ, and 2) it is discrete that implies every x∈Δ possesses a neighborhood in ℝn in which x is the only lattice point in the neighborhood. More specifically, the ith successive minima λiΔ is the smallest Euclidean norm ℓ such that Δ possesses i number of linearly independent vectors of norm less than or equal to ℓ. Due to properties of a discrete group, one can observe that the quotient group ℝn/Δ of cosets c+Δ=c+v: v∈Δ, c∈ℝn, under the usual addition: c1+Δ+c2+Δ=c1+c2+Δ in the quotient group. A fundamental domain of Δ is a set F⊂ℝn that contains exactly one representative c^∈c+Δ∩F of each coset c+Δ.


### 3.2. Bases and Fundamental Parallelepiped

A lattice (see Fig.2) is generated by a basis B=b1, b2, …, bm and the integer linear combination of the linearly independent vectors b1, b2, …, bm in the basis as Δ=ΔB=∑i=1mzibi:zi∈ℤ. The positive integer m is the rank of the basis and n represents the dimension of the space under consideration. We can consider m=n to represent a full rank lattice. A lattice possesses infinitely many bases, because if B is a basis then BU is also a basis for a unimodular matrix. If B is a basis of the lattice Δ, the fundamental domain is the parallelepiped ℙB=B−1/2,1/2 centered at the origin. Note that parallelepiped is formed by “six parallelogram sides to result in a three-dimensional figure” or a “Prism”, which contains a parallelogram base.Figure 2
A two-dimensional lattice with bad basis.Definition 1.
Letb1,b2,…,bm∈ℝnbe linearly independent tuples, a latticeΔgenerated by a basisB=b1,b2,…,bmis denotedΔb1,b2,…,bm=Σizibi:zi∈ℤ. The integersmandndenote the rank of the concerned matrix and the dimension of given lattice, respectively.Definition 2.
Letb1,b2,…,bm∈ℝnbe linearly independent tuples that generate a latticeΔb1,b2,…,bm=Σizibi:zi∈ℤ, its dual lattice beΔ∗=z∈ℤ|∀y∈Δ,z,y∈ℤ, whereΔcan be represented as(2)Δ=A⋅z=||.|b1b2…bm||.|⋅z1z2⋮zm.


### 3.3. q-ary Lattice

Theq-ary lattice satisfying ℤqm⊆Δ⊆ℤqn, for some integer q, is called q-ary lattice because q times vectors of lattice also belongs to it. Given a matrix modulo q=polyn (depends only dimension of lattice), denoted A∈ℤqn×m, there are n-dimensional q-ary lattice Δq⊥=z∈ℤn: Az=0modq and a coset of the lattice as Δqu=z∈ℤn: u=Azmodq|z∈ℤm, where m,n and q are integers and m>n. Here, A⋅z=0 implies that:(3)||.|b1b2…bm||.|⋅z1z2⋮zm=00⋮0,and A⋅z=u implies that:(4)||.|b1b2…bm||.|⋅z1z2⋮zm=u1u2⋮um.Theseq-ary lattices are applied in the construction of cryptographic techniques. Now, if the matrix A is chosen randomly, solving the short vector problem on Δ⊥A is equivalent to solve a hard problem in random lattice.


### 3.4. Gaussian Measures

Letx,c∈ℝn and σ>0 be arbitrary. Then, ρσ,cx=e−πx−c2/σ2 defines a Gaussian distribution function (see Fig. 3) with center c and scaling σ, where the total measure corresponding to ρσ,c is given by ∫x∈ℝnρσ,cxdx=σn. We can define the discrete Gaussian distribution as DΔ,σ,cz=ρσ,cz/ρσ,cΔ, where z∈Δ is an arbitrary lattice point. Note that DΔ,σ,cz=Dσ,cz/Dσ,cΔ=ρσ,cz/ρσ,cΔ.Figure 3
Gaussian distribution in multi dimensions.We now introduce an advanced lattice parameter (called the smoothing parameter [35]) related to the Gaussian measures on random lattices as follows.Definition 3.
LetΔbe a lattice of dimensionnandε>0be an arbitrary small real number. The smoothing parameter is defined byξεΔto be the smallestσ>0such that∑z≠0∈Δ∗ρ1/σ,0z≤εholds.


### 3.5. Hard Assumptions Based on Learning with Errors

The “learning with errors” was introduced by Regev [36], which is secure against quantum computing. In the following, we state the assumption with respect to the Gaussian error distribution [35] and its parameterizations.Definition 4 (see [36]).
Letn∈ℕ,q=qn>2, ands∈ℤqnbe a secret. Then,LWEs,ξis a distribution ofb,bts+zoverℤqn×ℤqwithb∈ℤqnis an arbitrary random andz∈ℤqis chosen fromξ, whereξis the Gaussian distribution.Definition 5 (see [37]).
The “Learning with Errors” decision problem is to distinguish betweenLWEs,ξwhich is the distribution ofb,bts+zoverℤqn×ℤqwith randoms∈ℤqnand the uniform random distribution overℤqn×ℤq, given access to the random samples from the given distribution.Regev [37] proved that the decision problem (learning with errors) under a suitable prime modulus q and Gaussian distribution ξ is as hard as solving the worst-case lattice problem, known as “short independent vector problem” and “decision short vector problem” in Euclidean norm, using quantum algorithms. Suppose ℝ/ℤ=0,1 is a group with respect to modulo one operation. Let Φα be the Gaussian distribution on ℝ/ℤ with mean 0 and standard deviation α/2π, under modulo one, where α>0 is a real number.Theorem 1 (see [37]).
Letα=αn∈0,1be a real number, andq=qn>0be a prime such thatαq>2nholds. If there exists a quantum algorithm that can solveLWEq,Φα, there also exists a quantum algorithm to solve “short independent vectors problem” and approximate “decision short vector problem”, in Euclidean norm, under the worst-case with inOn/αfactors.


### 3.6. Regev’s Dual Cryptosystem

IfΔ is a lattice, its dual is the set Δ∗ consisting of tuples z∈LΔ, that is, a linear span of Δ such that inner product z,y is an integer for all y∈Δ. Following the definition, one can easily observe that the dual of ℤn is ℤn. The inner product between two n-tuples x and y is defined as x,y=xty=∑i=1nxiyi, where x=x1, x2, …, xn and y=y1, y2, …, yn are tuples with the real entries.The dual spaceΔ∗ has the same dimension as its primal space Δ, and both are essentially isomorphic to each other. Therefore, a dual space Δ∗ lies in the same space as the primal Δ, and not necessarily be a sub-lattice of Δ. The lattice Δ∗ contains non-integers even Δ contains only integers entries. The dual space is necessarily defined as follows in abstract vector space. If V⊆ℝn is a vector space, a function Ψ: V⟶R is called a linear function if it satisfies the following conditions: 1) Ψϑ1+ϑ2=Ψϑ1+Ψϑ2, and 2) Ψaϑ1=aΨϑ1, where a,b∈ℝ and ϑ1,ϑ2∈V. The dual space of an abstract vector space V is then the set of all linear functions, where a function Ψ is represented as a tuple ϑ∈V such that Ψx=ϑ,x, whereas the dual lattice is considered on the set of integers ℤ instead set of reals one ℝ. The dual of lattice Δ is the collection of linear functions of the forms: Ψ:V⟶ℤ represented as tuples in span Δ. Each vector ϑ∈Δ∗ generates a linear function Ψϑx=ϑ,x satisfying ΨϑΔ⊆ℤ and partitions Δ into the layers as Δ=∪i∈ℤϱ∈ℤ: Ψϑϱ=i, where each layer Ψϑ−1i=ϱ∈Δ: Ψϑϱ=i is necessarily a shifted copy of Δ∩ϑ⊥=ϱ∈Δ: ϑ,ϱ=0, that is, a lower dimensional sub-lattice orthogonal to ϑ with distance between layers 1/ϑ implies that the sparser lattice has denser dual and vice-versa. Therefore, the dual of cΔ is 1/cΔ, where c>0 is an arbitrary real.Under the hard assumption “learning with errors”, one can construct a public key cryptosystem under indistinguishable property of pseudo-random tupleb,bts+z from a random sample. The pseudo-random bts+z∈ℤq is used to mask a bit of the message in Regev’s cryptosystem [37]. Furthermore, the dual Regev’s cryptosystem consists of three phases: a) D-key-Gen, b) D-Encrypt, and c) D-Decrypt, which are discussed below.1.
D−key−Gen: Let A∈ℤqn×m be a random matrix, where m≥2nlogq, fA:ℤm⟶ℤn:e↦Aemodq. Choose an error e←Dℤm,σ. It then computes its syndrome as u=fAe, where the secret vector e∈ℤqm and the public key is u∈ℤqn.2.
D−Encrypt: Let b∈0,1 be a bit to be encrypted. Choose a random s∈ℤqn with an error scalar x∈ξ and an error vector y∈ξm. It then outputs c=c0,c1, where c0=uts+x+b⋅⌊q/2⌋ and c1=Ats+y.3.
D−Decrypt: To perform the decryption on c=c0,c1 using the secret e under the matrix A, this phase computes b=c0−etc1∈ℤq and outputs 1 if b is closer to ⌊q/2⌋; else, it is 0.


### 3.7. Pre-image Samplable Family of Functions

Gentryet al. [21] defined a family of pre-image samplable functions that plays a very important role in the construction of the proposed encryption described in Section 4.Definition 6.
A family of pre-image samplable functions [21] consists of three phases: a)Trap-Gen, b)Sample-Dom, and c)Sample-Pre, which are given below.•
Trap-Gen1κ: Trap-Gentakes input as the parameterκ, and outputs a pairA,T, whereAis utilized in the functionfA:Dκ⟶Rκwith recognizable domainDκand rangeRκ, andTis a trapdoor for the functionfA.•
Sample-DomA:Under function descriptionA, it will samplex←ξover the domainDκin such a way the distribution offAxis uniform overRκ, and outputsxaccordingly.•
Sample-PreT,y:Under a trapdoorTand a valuey∈Rκ, it will sample an elementx∈Dκfrom the distributionξunder the criteria thatfAx=y, and it then outputsx.


#### 3.7.1. Correctness

It is worth noticing thatSample-Dom samples x←ξ over the domain Dκ such that fAx follows a uniform distribution over the range Rκ, and Sample-Pre samples x∈Dκ←ξ as in Sample-Dom under condition fAx=y.


#### 3.7.2. Security

The security of the pre-image samplable functions [21] is discussed below. The samplable functions [21] must satisfy the following properties:1.
One-way without trapdoor: If A is a probabilistic polynomial time adversary, the advantage A1κ,A,y←fA−1y⊂Dκ is negligible, where the advantage is considered over all the possible choices of A, the value y←Rκ is random, and A tosses the coin randomly.2.
Pre-image minimum entropy: If y←Rκ, the conditioned minimum entropy of x←Sample−DomA is least under the condition fAx=y.3.
Collision-free without trapdoor: If A is a probabilistic polynomial time adversary, the advantage A1κ,A results in the distinct x,x′←Dκ with fAx=fAx′ is negligible.Theorem 2 (see [37]).
Ifq=polynis an arbitrary large prime andm≥5nlogq, there exists a probabilistic polynomial time algorithm [38] that takes input as1n, and outputs a matrixA∈ℤqn×mand a full rank setS⊂Δ⊥A, where the distribution corresponding toAis statistically close to a uniform distribution overℤqn×munder the lengthS≤m2.5.Another algorithm is known as the sampling Gaussian, denoted by Sample-Gauss, discussed by Gentryet al. [21], plays a very important role in cryptographic construction. The Sample-Gauss B,σ,c uses a random basis B in sampling from the Gaussian distribution centered at c with the standard deviation σ over the lattice ΔB.Theorem 3 (see [37]).
The probabilistic polynomial time algorithm provided in [21] with inputs as a basisB, a latticeΔB, an appropriate parameterσ≥B∗⋅ωlogmand arbitraryc∈ℝm, results in a sample distribution that is statistically close toDΔ,σ,c.The function defined in [21] is a sample pre-image consisting of three phases: a) Trap-Gen, b) Sample-Dom and c) Sample-Pre. Let κ be a security parameter, n=Θκ, q=polyn be a large prime, m≥5nlogq, L=m2.5 and Gaussian parameter σ≥Lωlogm, respectively. Then,•
Trap-Gen1κ,σ: Under the algorithm in Theorem 3, choose a matrix A∈ℤqn×m and a trapdoor T∈Δ⊥A. Consider Dκ=e∈Aℤqm: e≤σm and Rκ=ℤqn and fA: Dκ⟶Rκ such that fAe=Aemodq. This phase then results A,T.•
Sample-DomA,σ: Assuming B′ as a standard basis for ℤm, use Sample-GaussB′,σ,0 to get sample from Dℤm,σ.•
Sample-PreT,σ,y: Let k∈ℤm be an arbitrary number under condition Ak=ymodq. Then, use Sample-GaussT,σ−k [21] to sample v from DΔ⊥A,σ,−k.Theorem 4 (see [37]).
Assume that the columns ofA∈ℤqn×mspanℤqn,ε∈0,1/2, andσ≥ηεΔ⊥A. Then, the syndrome’s distributionu=Aemodqdiffers by a statistically distance equal to at most2εfrom the uniform distribution overℤqn.To prove the correctness of the distributionξ=Dℤm,σ, for a given u←ℤqn and k←ℤm is a solution to Ak=umodq, the conditional probability distribution of e←Dℤm,σ under Ae=umodq matches perfectly with k+DΔ⊥A,σ,−k. The correctness of the distribution is as follows. It can be observed that fAe=Aemodq is indistinguishable from the uniform distribution over Rκ=ℤqn, assuming the columns of A∈ℤqn×m spans ℤqn [21] with the probability 1−q−n. Since σ≥Lωlogm, and T≤L, the result in [21] implies σ≥ηεΔ⊥A. Thus, as a result, Sample-Prev+k is distributed under Dℤm,σ under the condition Av+k=ymodq.In the proof of security, we use the functions described in [21], which are one-way and collision resistant functions. A brief discussion of these two properties are given below.•
One-way without trapdoor: The process of inversion of fA under a uniform random u←Rn is equivalent to solving “in-homogeneous short integer solution” problem, say ISISq,m,σm [21].•
Pre-image minimum entropy: Since all the pre-images follow the discrete Gaussian, it has minimum entropy [21].•
Collision-free without trapdoor: Let z,z′←Dκ. Then, a collision implies Az−z′=0modq, which actually solves the “short integer solution” problem, say SISq,m,2σm.


## 3.1. Lattice

A latticeΔ is defined with the following two properties: 1) it is an additive subgroup which implies 0∈Δ, and −x, x+y∈Δ for all x,y∈Δ, and 2) it is discrete that implies every x∈Δ possesses a neighborhood in ℝn in which x is the only lattice point in the neighborhood. More specifically, the ith successive minima λiΔ is the smallest Euclidean norm ℓ such that Δ possesses i number of linearly independent vectors of norm less than or equal to ℓ. Due to properties of a discrete group, one can observe that the quotient group ℝn/Δ of cosets c+Δ=c+v: v∈Δ, c∈ℝn, under the usual addition: c1+Δ+c2+Δ=c1+c2+Δ in the quotient group. A fundamental domain of Δ is a set F⊂ℝn that contains exactly one representative c^∈c+Δ∩F of each coset c+Δ.


## 3.2. Bases and Fundamental Parallelepiped

A lattice (see Fig.2) is generated by a basis B=b1, b2, …, bm and the integer linear combination of the linearly independent vectors b1, b2, …, bm in the basis as Δ=ΔB=∑i=1mzibi:zi∈ℤ. The positive integer m is the rank of the basis and n represents the dimension of the space under consideration. We can consider m=n to represent a full rank lattice. A lattice possesses infinitely many bases, because if B is a basis then BU is also a basis for a unimodular matrix. If B is a basis of the lattice Δ, the fundamental domain is the parallelepiped ℙB=B−1/2,1/2 centered at the origin. Note that parallelepiped is formed by “six parallelogram sides to result in a three-dimensional figure” or a “Prism”, which contains a parallelogram base.Figure 2
A two-dimensional lattice with bad basis.Definition 1.
Letb1,b2,…,bm∈ℝnbe linearly independent tuples, a latticeΔgenerated by a basisB=b1,b2,…,bmis denotedΔb1,b2,…,bm=Σizibi:zi∈ℤ. The integersmandndenote the rank of the concerned matrix and the dimension of given lattice, respectively.Definition 2.
Letb1,b2,…,bm∈ℝnbe linearly independent tuples that generate a latticeΔb1,b2,…,bm=Σizibi:zi∈ℤ, its dual lattice beΔ∗=z∈ℤ|∀y∈Δ,z,y∈ℤ, whereΔcan be represented as(2)Δ=A⋅z=||.|b1b2…bm||.|⋅z1z2⋮zm.


## 3.3. q-ary Lattice

Theq-ary lattice satisfying ℤqm⊆Δ⊆ℤqn, for some integer q, is called q-ary lattice because q times vectors of lattice also belongs to it. Given a matrix modulo q=polyn (depends only dimension of lattice), denoted A∈ℤqn×m, there are n-dimensional q-ary lattice Δq⊥=z∈ℤn: Az=0modq and a coset of the lattice as Δqu=z∈ℤn: u=Azmodq|z∈ℤm, where m,n and q are integers and m>n. Here, A⋅z=0 implies that:(3)||.|b1b2…bm||.|⋅z1z2⋮zm=00⋮0,and A⋅z=u implies that:(4)||.|b1b2…bm||.|⋅z1z2⋮zm=u1u2⋮um.Theseq-ary lattices are applied in the construction of cryptographic techniques. Now, if the matrix A is chosen randomly, solving the short vector problem on Δ⊥A is equivalent to solve a hard problem in random lattice.


## 3.4. Gaussian Measures

Letx,c∈ℝn and σ>0 be arbitrary. Then, ρσ,cx=e−πx−c2/σ2 defines a Gaussian distribution function (see Fig. 3) with center c and scaling σ, where the total measure corresponding to ρσ,c is given by ∫x∈ℝnρσ,cxdx=σn. We can define the discrete Gaussian distribution as DΔ,σ,cz=ρσ,cz/ρσ,cΔ, where z∈Δ is an arbitrary lattice point. Note that DΔ,σ,cz=Dσ,cz/Dσ,cΔ=ρσ,cz/ρσ,cΔ.Figure 3
Gaussian distribution in multi dimensions.We now introduce an advanced lattice parameter (called the smoothing parameter [35]) related to the Gaussian measures on random lattices as follows.Definition 3.
LetΔbe a lattice of dimensionnandε>0be an arbitrary small real number. The smoothing parameter is defined byξεΔto be the smallestσ>0such that∑z≠0∈Δ∗ρ1/σ,0z≤εholds.


## 3.5. Hard Assumptions Based on Learning with Errors

The “learning with errors” was introduced by Regev [36], which is secure against quantum computing. In the following, we state the assumption with respect to the Gaussian error distribution [35] and its parameterizations.Definition 4 (see [36]).
Letn∈ℕ,q=qn>2, ands∈ℤqnbe a secret. Then,LWEs,ξis a distribution ofb,bts+zoverℤqn×ℤqwithb∈ℤqnis an arbitrary random andz∈ℤqis chosen fromξ, whereξis the Gaussian distribution.Definition 5 (see [37]).
The “Learning with Errors” decision problem is to distinguish betweenLWEs,ξwhich is the distribution ofb,bts+zoverℤqn×ℤqwith randoms∈ℤqnand the uniform random distribution overℤqn×ℤq, given access to the random samples from the given distribution.Regev [37] proved that the decision problem (learning with errors) under a suitable prime modulus q and Gaussian distribution ξ is as hard as solving the worst-case lattice problem, known as “short independent vector problem” and “decision short vector problem” in Euclidean norm, using quantum algorithms. Suppose ℝ/ℤ=0,1 is a group with respect to modulo one operation. Let Φα be the Gaussian distribution on ℝ/ℤ with mean 0 and standard deviation α/2π, under modulo one, where α>0 is a real number.Theorem 1 (see [37]).
Letα=αn∈0,1be a real number, andq=qn>0be a prime such thatαq>2nholds. If there exists a quantum algorithm that can solveLWEq,Φα, there also exists a quantum algorithm to solve “short independent vectors problem” and approximate “decision short vector problem”, in Euclidean norm, under the worst-case with inOn/αfactors.


## 3.6. Regev’s Dual Cryptosystem

IfΔ is a lattice, its dual is the set Δ∗ consisting of tuples z∈LΔ, that is, a linear span of Δ such that inner product z,y is an integer for all y∈Δ. Following the definition, one can easily observe that the dual of ℤn is ℤn. The inner product between two n-tuples x and y is defined as x,y=xty=∑i=1nxiyi, where x=x1, x2, …, xn and y=y1, y2, …, yn are tuples with the real entries.The dual spaceΔ∗ has the same dimension as its primal space Δ, and both are essentially isomorphic to each other. Therefore, a dual space Δ∗ lies in the same space as the primal Δ, and not necessarily be a sub-lattice of Δ. The lattice Δ∗ contains non-integers even Δ contains only integers entries. The dual space is necessarily defined as follows in abstract vector space. If V⊆ℝn is a vector space, a function Ψ: V⟶R is called a linear function if it satisfies the following conditions: 1) Ψϑ1+ϑ2=Ψϑ1+Ψϑ2, and 2) Ψaϑ1=aΨϑ1, where a,b∈ℝ and ϑ1,ϑ2∈V. The dual space of an abstract vector space V is then the set of all linear functions, where a function Ψ is represented as a tuple ϑ∈V such that Ψx=ϑ,x, whereas the dual lattice is considered on the set of integers ℤ instead set of reals one ℝ. The dual of lattice Δ is the collection of linear functions of the forms: Ψ:V⟶ℤ represented as tuples in span Δ. Each vector ϑ∈Δ∗ generates a linear function Ψϑx=ϑ,x satisfying ΨϑΔ⊆ℤ and partitions Δ into the layers as Δ=∪i∈ℤϱ∈ℤ: Ψϑϱ=i, where each layer Ψϑ−1i=ϱ∈Δ: Ψϑϱ=i is necessarily a shifted copy of Δ∩ϑ⊥=ϱ∈Δ: ϑ,ϱ=0, that is, a lower dimensional sub-lattice orthogonal to ϑ with distance between layers 1/ϑ implies that the sparser lattice has denser dual and vice-versa. Therefore, the dual of cΔ is 1/cΔ, where c>0 is an arbitrary real.Under the hard assumption “learning with errors”, one can construct a public key cryptosystem under indistinguishable property of pseudo-random tupleb,bts+z from a random sample. The pseudo-random bts+z∈ℤq is used to mask a bit of the message in Regev’s cryptosystem [37]. Furthermore, the dual Regev’s cryptosystem consists of three phases: a) D-key-Gen, b) D-Encrypt, and c) D-Decrypt, which are discussed below.1.
D−key−Gen: Let A∈ℤqn×m be a random matrix, where m≥2nlogq, fA:ℤm⟶ℤn:e↦Aemodq. Choose an error e←Dℤm,σ. It then computes its syndrome as u=fAe, where the secret vector e∈ℤqm and the public key is u∈ℤqn.2.
D−Encrypt: Let b∈0,1 be a bit to be encrypted. Choose a random s∈ℤqn with an error scalar x∈ξ and an error vector y∈ξm. It then outputs c=c0,c1, where c0=uts+x+b⋅⌊q/2⌋ and c1=Ats+y.3.
D−Decrypt: To perform the decryption on c=c0,c1 using the secret e under the matrix A, this phase computes b=c0−etc1∈ℤq and outputs 1 if b is closer to ⌊q/2⌋; else, it is 0.


## 3.7. Pre-image Samplable Family of Functions

Gentryet al. [21] defined a family of pre-image samplable functions that plays a very important role in the construction of the proposed encryption described in Section 4.Definition 6.
A family of pre-image samplable functions [21] consists of three phases: a)Trap-Gen, b)Sample-Dom, and c)Sample-Pre, which are given below.•
Trap-Gen1κ: Trap-Gentakes input as the parameterκ, and outputs a pairA,T, whereAis utilized in the functionfA:Dκ⟶Rκwith recognizable domainDκand rangeRκ, andTis a trapdoor for the functionfA.•
Sample-DomA:Under function descriptionA, it will samplex←ξover the domainDκin such a way the distribution offAxis uniform overRκ, and outputsxaccordingly.•
Sample-PreT,y:Under a trapdoorTand a valuey∈Rκ, it will sample an elementx∈Dκfrom the distributionξunder the criteria thatfAx=y, and it then outputsx.


### 3.7.1. Correctness

It is worth noticing thatSample-Dom samples x←ξ over the domain Dκ such that fAx follows a uniform distribution over the range Rκ, and Sample-Pre samples x∈Dκ←ξ as in Sample-Dom under condition fAx=y.


### 3.7.2. Security

The security of the pre-image samplable functions [21] is discussed below. The samplable functions [21] must satisfy the following properties:1.
One-way without trapdoor: If A is a probabilistic polynomial time adversary, the advantage A1κ,A,y←fA−1y⊂Dκ is negligible, where the advantage is considered over all the possible choices of A, the value y←Rκ is random, and A tosses the coin randomly.2.
Pre-image minimum entropy: If y←Rκ, the conditioned minimum entropy of x←Sample−DomA is least under the condition fAx=y.3.
Collision-free without trapdoor: If A is a probabilistic polynomial time adversary, the advantage A1κ,A results in the distinct x,x′←Dκ with fAx=fAx′ is negligible.Theorem 2 (see [37]).
Ifq=polynis an arbitrary large prime andm≥5nlogq, there exists a probabilistic polynomial time algorithm [38] that takes input as1n, and outputs a matrixA∈ℤqn×mand a full rank setS⊂Δ⊥A, where the distribution corresponding toAis statistically close to a uniform distribution overℤqn×munder the lengthS≤m2.5.Another algorithm is known as the sampling Gaussian, denoted by Sample-Gauss, discussed by Gentryet al. [21], plays a very important role in cryptographic construction. The Sample-Gauss B,σ,c uses a random basis B in sampling from the Gaussian distribution centered at c with the standard deviation σ over the lattice ΔB.Theorem 3 (see [37]).
The probabilistic polynomial time algorithm provided in [21] with inputs as a basisB, a latticeΔB, an appropriate parameterσ≥B∗⋅ωlogmand arbitraryc∈ℝm, results in a sample distribution that is statistically close toDΔ,σ,c.The function defined in [21] is a sample pre-image consisting of three phases: a) Trap-Gen, b) Sample-Dom and c) Sample-Pre. Let κ be a security parameter, n=Θκ, q=polyn be a large prime, m≥5nlogq, L=m2.5 and Gaussian parameter σ≥Lωlogm, respectively. Then,•
Trap-Gen1κ,σ: Under the algorithm in Theorem 3, choose a matrix A∈ℤqn×m and a trapdoor T∈Δ⊥A. Consider Dκ=e∈Aℤqm: e≤σm and Rκ=ℤqn and fA: Dκ⟶Rκ such that fAe=Aemodq. This phase then results A,T.•
Sample-DomA,σ: Assuming B′ as a standard basis for ℤm, use Sample-GaussB′,σ,0 to get sample from Dℤm,σ.•
Sample-PreT,σ,y: Let k∈ℤm be an arbitrary number under condition Ak=ymodq. Then, use Sample-GaussT,σ−k [21] to sample v from DΔ⊥A,σ,−k.Theorem 4 (see [37]).
Assume that the columns ofA∈ℤqn×mspanℤqn,ε∈0,1/2, andσ≥ηεΔ⊥A. Then, the syndrome’s distributionu=Aemodqdiffers by a statistically distance equal to at most2εfrom the uniform distribution overℤqn.To prove the correctness of the distributionξ=Dℤm,σ, for a given u←ℤqn and k←ℤm is a solution to Ak=umodq, the conditional probability distribution of e←Dℤm,σ under Ae=umodq matches perfectly with k+DΔ⊥A,σ,−k. The correctness of the distribution is as follows. It can be observed that fAe=Aemodq is indistinguishable from the uniform distribution over Rκ=ℤqn, assuming the columns of A∈ℤqn×m spans ℤqn [21] with the probability 1−q−n. Since σ≥Lωlogm, and T≤L, the result in [21] implies σ≥ηεΔ⊥A. Thus, as a result, Sample-Prev+k is distributed under Dℤm,σ under the condition Av+k=ymodq.In the proof of security, we use the functions described in [21], which are one-way and collision resistant functions. A brief discussion of these two properties are given below.•
One-way without trapdoor: The process of inversion of fA under a uniform random u←Rn is equivalent to solving “in-homogeneous short integer solution” problem, say ISISq,m,σm [21].•
Pre-image minimum entropy: Since all the pre-images follow the discrete Gaussian, it has minimum entropy [21].•
Collision-free without trapdoor: Let z,z′←Dκ. Then, a collision implies Az−z′=0modq, which actually solves the “short integer solution” problem, say SISq,m,2σm.


## 3.7.1. Correctness

It is worth noticing thatSample-Dom samples x←ξ over the domain Dκ such that fAx follows a uniform distribution over the range Rκ, and Sample-Pre samples x∈Dκ←ξ as in Sample-Dom under condition fAx=y.


## 3.7.2. Security

The security of the pre-image samplable functions [21] is discussed below. The samplable functions [21] must satisfy the following properties:1.
One-way without trapdoor: If A is a probabilistic polynomial time adversary, the advantage A1κ,A,y←fA−1y⊂Dκ is negligible, where the advantage is considered over all the possible choices of A, the value y←Rκ is random, and A tosses the coin randomly.2.
Pre-image minimum entropy: If y←Rκ, the conditioned minimum entropy of x←Sample−DomA is least under the condition fAx=y.3.
Collision-free without trapdoor: If A is a probabilistic polynomial time adversary, the advantage A1κ,A results in the distinct x,x′←Dκ with fAx=fAx′ is negligible.Theorem 2 (see [37]).
Ifq=polynis an arbitrary large prime andm≥5nlogq, there exists a probabilistic polynomial time algorithm [38] that takes input as1n, and outputs a matrixA∈ℤqn×mand a full rank setS⊂Δ⊥A, where the distribution corresponding toAis statistically close to a uniform distribution overℤqn×munder the lengthS≤m2.5.Another algorithm is known as the sampling Gaussian, denoted by Sample-Gauss, discussed by Gentryet al. [21], plays a very important role in cryptographic construction. The Sample-Gauss B,σ,c uses a random basis B in sampling from the Gaussian distribution centered at c with the standard deviation σ over the lattice ΔB.Theorem 3 (see [37]).
The probabilistic polynomial time algorithm provided in [21] with inputs as a basisB, a latticeΔB, an appropriate parameterσ≥B∗⋅ωlogmand arbitraryc∈ℝm, results in a sample distribution that is statistically close toDΔ,σ,c.The function defined in [21] is a sample pre-image consisting of three phases: a) Trap-Gen, b) Sample-Dom and c) Sample-Pre. Let κ be a security parameter, n=Θκ, q=polyn be a large prime, m≥5nlogq, L=m2.5 and Gaussian parameter σ≥Lωlogm, respectively. Then,•
Trap-Gen1κ,σ: Under the algorithm in Theorem 3, choose a matrix A∈ℤqn×m and a trapdoor T∈Δ⊥A. Consider Dκ=e∈Aℤqm: e≤σm and Rκ=ℤqn and fA: Dκ⟶Rκ such that fAe=Aemodq. This phase then results A,T.•
Sample-DomA,σ: Assuming B′ as a standard basis for ℤm, use Sample-GaussB′,σ,0 to get sample from Dℤm,σ.•
Sample-PreT,σ,y: Let k∈ℤm be an arbitrary number under condition Ak=ymodq. Then, use Sample-GaussT,σ−k [21] to sample v from DΔ⊥A,σ,−k.Theorem 4 (see [37]).
Assume that the columns ofA∈ℤqn×mspanℤqn,ε∈0,1/2, andσ≥ηεΔ⊥A. Then, the syndrome’s distributionu=Aemodqdiffers by a statistically distance equal to at most2εfrom the uniform distribution overℤqn.To prove the correctness of the distributionξ=Dℤm,σ, for a given u←ℤqn and k←ℤm is a solution to Ak=umodq, the conditional probability distribution of e←Dℤm,σ under Ae=umodq matches perfectly with k+DΔ⊥A,σ,−k. The correctness of the distribution is as follows. It can be observed that fAe=Aemodq is indistinguishable from the uniform distribution over Rκ=ℤqn, assuming the columns of A∈ℤqn×m spans ℤqn [21] with the probability 1−q−n. Since σ≥Lωlogm, and T≤L, the result in [21] implies σ≥ηεΔ⊥A. Thus, as a result, Sample-Prev+k is distributed under Dℤm,σ under the condition Av+k=ymodq.In the proof of security, we use the functions described in [21], which are one-way and collision resistant functions. A brief discussion of these two properties are given below.•
One-way without trapdoor: The process of inversion of fA under a uniform random u←Rn is equivalent to solving “in-homogeneous short integer solution” problem, say ISISq,m,σm [21].•
Pre-image minimum entropy: Since all the pre-images follow the discrete Gaussian, it has minimum entropy [21].•
Collision-free without trapdoor: Let z,z′←Dκ. Then, a collision implies Az−z′=0modq, which actually solves the “short integer solution” problem, say SISq,m,2σm.


## 4. Proposed Identity-Based Encryption (IBE) Scheme in Standard Model

In this section, we propose a new provably secure identity-based encryption scheme. Note that such a scheme has acompact public key and also achieves adaptive security in the standard model [39].Our proposed identity-based encryption scheme consists of four phases: a)Set-up, b) Extraction, c) Encrypts and d) Decrypts. We take an identity ID as an arbitrary k-bits string 0,1k, where k=Θκ for a given security parameter κ. In the following, we now discuss the details of these four phases.


### 4.1. Set-up Phase

It includes the functionSet-up1κ. First, choose a suitable large prime q, a smoothing parameter σ depending on the security parameter κ and an arbitrary random matrix A∈ℤqn×m, under a short basis for Δ⊥A, that is, TA with the help of Ajtai’s construction [38]. Let fA: ℤqm⟶ℤqn be a function defined as fAe=Aemodq. Next, pick a tuple u0∈ℤqn and a random matrix Hi,b∈ℤqn×ℓ, where ℓ=m and H^=i,b,Hi,b: 1≤i≤2,0≤b≤1 is the ordered set. The public parameters are A,u0,H^, whereas TA is considered as the master secret.


### 4.2. Extraction Phase

This phase is accomplished by the functionExtractionA,u0,H^,ID,TA. A decryption key is extracted related to the identity ID∈0,1k under the master secret TA as the trapdoor. The following steps need to be executed:•
LetS=HID and U be the set of non-zero positions in the string S. After that, assemble an n×ℓ matrix HID= [Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈ℤqn×ℓ, where Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈H^ as Hi1,b1 or Hi1,b0 is according to either i1mod2=0 or i1mod2=1, respectively.•
Now, sampleri←ℤqℓ under Sample−DomHi,bimod2,σ, where 1≤i≤k, and consider r←ℤqℓ such that rt=r1t|r2t⋯−rℓt.•
Letu=u0+HIDr∈ℤqn. It can be observed as u=u0+∑i=1ℓ′Himod2,bimod2ri, where i is the non-zero position in the string S.•
Next, apply theSample-PreTA,σ,u under the trapdoor TA to find the pre-image e of u satisfying u=Aemodq, and outputs the private key e,r.


### 4.3. Encrypts Phase

In this phase, we involve the functionEncryptsA,u0,H^,ID,b. In order to process the encryption on a bit b∈0,1 under the identity ID∈0,1k using the master key TA, the following steps are necessary:•
LetHID= [Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈ℤqn×ℓ, where Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈H^ because Hi1mod2,b1 or Hi1mod2,b0 is based on either i1mod2=0 or i1mod2=1.•
Choose an arbitrarys∈ℤqn.•
Pickx∈ℤq, y=〈y1, y2, …, ym〉∈ℤqm and z=〈z1, z2, …, zℓ〉∈ℤqℓ which are sampled from the distributions ξ, ξm, and ξℓ, respectively, based on the Regev’s cryptosystem.•
Now, calculatec0=u0ts+x+b⌊q/2⌋∈ℤq, c1=Ats+y∈ℤqm and c2=HIDts+z∈ℤqℓ.•
Finally, the initiator sends the output as the cipherc=c0,c1,c2 to the responder.


### 4.4. Decrypts Phase

This phase is implemented by the functionDecrypts(A,u0,H^,ID,k,c). After receiving the cipher c=c0,c1,c2, with the private key e,r∈ℤqm+ℓ, the responder executes the following steps:•
Computev=c0−etc1+rtc2∈ℤq, and then compare v with ⌊q/2⌋ in ℤ.•
Ifv−q/2≤q/4, it results bit b=1; else, it outputs the bit b=0.


## 4.1. Set-up Phase

It includes the functionSet-up1κ. First, choose a suitable large prime q, a smoothing parameter σ depending on the security parameter κ and an arbitrary random matrix A∈ℤqn×m, under a short basis for Δ⊥A, that is, TA with the help of Ajtai’s construction [38]. Let fA: ℤqm⟶ℤqn be a function defined as fAe=Aemodq. Next, pick a tuple u0∈ℤqn and a random matrix Hi,b∈ℤqn×ℓ, where ℓ=m and H^=i,b,Hi,b: 1≤i≤2,0≤b≤1 is the ordered set. The public parameters are A,u0,H^, whereas TA is considered as the master secret.


## 4.2. Extraction Phase

This phase is accomplished by the functionExtractionA,u0,H^,ID,TA. A decryption key is extracted related to the identity ID∈0,1k under the master secret TA as the trapdoor. The following steps need to be executed:•
LetS=HID and U be the set of non-zero positions in the string S. After that, assemble an n×ℓ matrix HID= [Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈ℤqn×ℓ, where Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈H^ as Hi1,b1 or Hi1,b0 is according to either i1mod2=0 or i1mod2=1, respectively.•
Now, sampleri←ℤqℓ under Sample−DomHi,bimod2,σ, where 1≤i≤k, and consider r←ℤqℓ such that rt=r1t|r2t⋯−rℓt.•
Letu=u0+HIDr∈ℤqn. It can be observed as u=u0+∑i=1ℓ′Himod2,bimod2ri, where i is the non-zero position in the string S.•
Next, apply theSample-PreTA,σ,u under the trapdoor TA to find the pre-image e of u satisfying u=Aemodq, and outputs the private key e,r.


## 4.3. Encrypts Phase

In this phase, we involve the functionEncryptsA,u0,H^,ID,b. In order to process the encryption on a bit b∈0,1 under the identity ID∈0,1k using the master key TA, the following steps are necessary:•
LetHID= [Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈ℤqn×ℓ, where Hi1mod2,bi1mod2Hi2mod2,bi2mod2⋯|Hiℓmod2,biℓmod2∈H^ because Hi1mod2,b1 or Hi1mod2,b0 is based on either i1mod2=0 or i1mod2=1.•
Choose an arbitrarys∈ℤqn.•
Pickx∈ℤq, y=〈y1, y2, …, ym〉∈ℤqm and z=〈z1, z2, …, zℓ〉∈ℤqℓ which are sampled from the distributions ξ, ξm, and ξℓ, respectively, based on the Regev’s cryptosystem.•
Now, calculatec0=u0ts+x+b⌊q/2⌋∈ℤq, c1=Ats+y∈ℤqm and c2=HIDts+z∈ℤqℓ.•
Finally, the initiator sends the output as the cipherc=c0,c1,c2 to the responder.


## 4.4. Decrypts Phase

This phase is implemented by the functionDecrypts(A,u0,H^,ID,k,c). After receiving the cipher c=c0,c1,c2, with the private key e,r∈ℤqm+ℓ, the responder executes the following steps:•
Computev=c0−etc1+rtc2∈ℤq, and then compare v with ⌊q/2⌋ in ℤ.•
Ifv−q/2≤q/4, it results bit b=1; else, it outputs the bit b=0.


## 5. Incorporating Proposed IBE Scheme for IoT-Enabled AI Applications

In this section, we first discuss the network model for IoT-enabled AI applications, which is used for incorporating our proposed IBE scheme described in Section4. Next, we describe the various phases where the proposed IBE scheme has been applied for IoT.


### 5.1. Network Model

The network model considered for IoT-enabled AI applications using our proposed IBE scheme is presented in Figure4. The model expresses various applications of IoT, such as traffic monitoring, smart home, and IIoT. In this model, different types of smart sensors, say SSi|i=1,2,3,…,nss are connected with each other via the nearby gateway node(s) GWNj|j=1,2,3,…,ngwn, where nss and ngwn denote the number of smart sensors and gateway nodes to be deployed for each IoT application, respectively. Note that there might be multiple nodes that are connected with a particular application and the gateways GWNj are further connected with the cloud server(s), say CLSk|k=1,2,3,…,ncls, where ncls is the number of cloud servers. Before initiating any secure communications between GWNj and CLSk, they need to complete their registration process which is performed by a fully-trusted registration authority RA. Similarly, the RA also performs the registration of each smart sensor node to be deployed in various IoT applications. Next, a gateway node needs to perform the secure data aggregation where the data is collected through secure communication among the smart sensors and the gateway node. In this case, we apply the proposed IBE scheme for encryption/decryption of the data. After that the gateway nodes send the data securely to the cloud server(s) for secure data storage purpose. Finally, the cloud servers CLSk can perform the Big data analytics using AI/ML techniques with the data stored at CLSk.Figure 4
Network model for IoT-enabled AI applications.


### 5.2. Description of Various Phases

We have the following phases:•
In thepre-deployment of IoT devices phase, the trusted RA will perform the registration of each IoT smart device prior to their deployment in respective application. After deployment of the IoT devices, they need to communicate with their nearby gateway node(s). For avoiding various attacks by an adversary, we use the proposed IBE scheme for secure data transfer among the sensor nodes and their gateway node(s).•
In theregistration of gateway nodes and cloud servers phase, the RA, RA also performs the registration of the deployed gateway nodes and cloud servers. For secure communication, we again use the proposed IBE scheme for secure data transfer among the gateway nodes and the cloud servers.•
Thesecure data aggregation at gateway phase allows a gateway node to collect the data from its associated IoT smart devices securely using the proposed IBE scheme.•
Thesecure data storage at cloud servers phase permits storage of data at the cloud servers securely from the gateway nodes with the help of the proposed IBE scheme.•
Finally, theBig data analytics using AI phase is needed because the cloud servers store a huge volume of data from various IoT applications. Since the Big data analytics provides numerous advantages, such as better decision making and preventing fraudulent activities, it is preferable to do the Big data analytics on the data stored at the cloud servers.A high-level description of various phases related to IoT-enabled AI applications is given in Figure5.Figure 5
High-level overview of various phases.


#### 5.2.1. Pre-deployment of IoT Devices

Before deploying the IoT smart devices (smart sensors)SSi in their respective application, the trusted RA, RA executes the Set-up phase described in Section 4.1 in order to select the system parameters. The steps are as follows:•
Step 1. The selected public parameters areA,u0,H^, whereas TA is as the master secret.•
Step 2. For eachSSi, the RA, RA assigns a unique identity IDSSi.•
Step 3. Next, for eachSSi, the RA, RA executes the Extraction phase described in Section 4.2 to extract a decryption key related to IDSSi under the trapdoor master secret TA. The private key for SSi is considered as eSSi,rSSi.


#### 5.2.2. Registration of Gateway Nodes and Cloud Servers

The registration process for the deployed gateway nodesGWNj and cloud servers CLSk is also based on the execution of the Set-up phase, where the public parameters are A,u0,H^, and TA is the trapdoor master secret. This phase involves the following steps:•
Step 1. For eachGWNj, the RA, RA assigns a unique identity IDGWNj. In a similar way, for each CLSk, the RA, RA also assigns a unique identity IDCLSk.•
Step 2. For eachGWNj and CLSk, the RA, RA executes the Extraction phase. After executing this process, the private keys for GWNj and CLSk are selected as eGWNj,rGWNj and eCLSk,rCLSk, respectively.


#### 5.2.3. Secure Data Aggregation at Gateway

In this phase, the following steps are involved:•
Step 1. Suppose the IoT smart sensorsSSi are deployed in their respective IoT applications as shown in Figure 4. The gateway nodes GWNj and cloud servers CLSk are also placed accordingly in the network. Let a smart sensor SSi sense the information (data), say DataSSi from its deployment area and want to communicate it securely with its gateway node GWNj, GWNj. For this purpose, the SSi, SSi generates a current timestamp, say TSSSi, prepares a message of the type MsgSSi=IDSSi,TSSSi,DataSSi and encrypts MsgSSi bit wise using the public parameters, identity of GWNj, GWNj and trapdoor master key TA to create the ciphertext CSSi=C0,C1,C2 as done in the Encrypts phase described in Section 4.3, where C0, C1 and C2 are the encrypted bit strings corresponding to the bit strings of the MsgSSi. Next, SSi sends the encrypted message {CSSi, TSSSi} to its destination GWNj, GWNj via a public channel.


#### 5.2.4. Secure Data Storage at Cloud Servers

In this phase, a cloud serverCLSk, CLSk receives the encrypted data from the respective gateway nodes GWNj residing in an IoT application, and stores the encrypted data in its database for further processing. In order to do this, the following steps are executed by the CLSk, CLSk:•
Step 1. Once the messageCGWNj,TSGWNj, is received at time TSGWNj∗, for checking replaying attacks, CLSk, CLSk checks the validity of the received timestamp by the condition: TSGWNj−TSGWNj∗<ΔT. If the condition fails, the process is immediately terminated.•
If the timestamp validation is satisfied, the encrypted dataCGWNj is then stored in the database of CLSk, CLSk.


#### 5.2.5. Big Data Analytics using AI

It is worth noticing that a cloud serverCLSk, CLSk receives the encrypted data generated by the IoT smart sensors residing in various applications via the aggregator nodes (gateway nodes). CLSk, CLSk can then decrypt the stored data bit wise using its own private key eCLSk,rCLSk and performs the Big Data analytics steps using AI/ML techniques, such as “data acquisition and filtering”, “data extraction”, “data aggregation and representation”, “data analysis” as well as “data visualization”. The results of this phase will provide some useful conclusions and predictions on the stored data.The overall mechanism of the proposed IBE scheme for IoT-based AI applications is also illustrated in Figure6. The pre-deployment and registration phases are performed through the steps 1, 2 and 3. Step 4 explains about the data aggregation phase. While the steps 5 and 6 are about secure data storage, Step 7 explains the Big data analytics using the AI techniques.Figure 6
Overall mechanism of the proposed IBE scheme for IoT-based AI applications.•
Step 2. After receiving the message fromSSi, GWNj, GWNj first checks the validity of the received timestamp by the condition: TSSSi−TSSSi∗<ΔT, where TSSSi∗ and ΔT represent the time when the message was received and the maximum transmission delay, respectively. If the condition is satisfied, GWNj, GWNj proceeds to decrypt CSSi bit wise using its private (secret) key eGWNj,rGWNj with the help of the Decrypts phase described in Section 4.4 to obtain IDSSi,TSSSi′,DataSSi. After that if the checking condition: TSSSi′=TSSSi is valid, GWNj, GWNj considers the data is fresh. Thus, no replay attack has been there during this process with the timestamping mechanism. Of course, for this purpose, it is reasonable to assume that the network entities are synchronized with their clocks [8].•
Step 3. Now,GWNj, GWNj generates a current timestamp TSGWNj, encrypts the prepared message MsgGWNj=MsgSSi,IDGWNj,TSGWNj=IDSSi,TSSSi,DataSSi,IDGWNj,TSGWNj bit wise using the public key of its corresponding cloud server CLSk to obtain the ciphertext CGWNj=C0′,C1′,C2′ as done in the Encrypts phase, and sends the encrypted message {CGWNj, TSGWNj} to its respective CLSk, CLSk via a public channel, where C0′, C1′ and C2′ are the encrypted bit strings corresponding to the bit strings of the MsgGWNj.


## 5.1. Network Model

The network model considered for IoT-enabled AI applications using our proposed IBE scheme is presented in Figure4. The model expresses various applications of IoT, such as traffic monitoring, smart home, and IIoT. In this model, different types of smart sensors, say SSi|i=1,2,3,…,nss are connected with each other via the nearby gateway node(s) GWNj|j=1,2,3,…,ngwn, where nss and ngwn denote the number of smart sensors and gateway nodes to be deployed for each IoT application, respectively. Note that there might be multiple nodes that are connected with a particular application and the gateways GWNj are further connected with the cloud server(s), say CLSk|k=1,2,3,…,ncls, where ncls is the number of cloud servers. Before initiating any secure communications between GWNj and CLSk, they need to complete their registration process which is performed by a fully-trusted registration authority RA. Similarly, the RA also performs the registration of each smart sensor node to be deployed in various IoT applications. Next, a gateway node needs to perform the secure data aggregation where the data is collected through secure communication among the smart sensors and the gateway node. In this case, we apply the proposed IBE scheme for encryption/decryption of the data. After that the gateway nodes send the data securely to the cloud server(s) for secure data storage purpose. Finally, the cloud servers CLSk can perform the Big data analytics using AI/ML techniques with the data stored at CLSk.Figure 4
Network model for IoT-enabled AI applications.


## 5.2. Description of Various Phases

We have the following phases:•
In thepre-deployment of IoT devices phase, the trusted RA will perform the registration of each IoT smart device prior to their deployment in respective application. After deployment of the IoT devices, they need to communicate with their nearby gateway node(s). For avoiding various attacks by an adversary, we use the proposed IBE scheme for secure data transfer among the sensor nodes and their gateway node(s).•
In theregistration of gateway nodes and cloud servers phase, the RA, RA also performs the registration of the deployed gateway nodes and cloud servers. For secure communication, we again use the proposed IBE scheme for secure data transfer among the gateway nodes and the cloud servers.•
Thesecure data aggregation at gateway phase allows a gateway node to collect the data from its associated IoT smart devices securely using the proposed IBE scheme.•
Thesecure data storage at cloud servers phase permits storage of data at the cloud servers securely from the gateway nodes with the help of the proposed IBE scheme.•
Finally, theBig data analytics using AI phase is needed because the cloud servers store a huge volume of data from various IoT applications. Since the Big data analytics provides numerous advantages, such as better decision making and preventing fraudulent activities, it is preferable to do the Big data analytics on the data stored at the cloud servers.A high-level description of various phases related to IoT-enabled AI applications is given in Figure5.Figure 5
High-level overview of various phases.


### 5.2.1. Pre-deployment of IoT Devices

Before deploying the IoT smart devices (smart sensors)SSi in their respective application, the trusted RA, RA executes the Set-up phase described in Section 4.1 in order to select the system parameters. The steps are as follows:•
Step 1. The selected public parameters areA,u0,H^, whereas TA is as the master secret.•
Step 2. For eachSSi, the RA, RA assigns a unique identity IDSSi.•
Step 3. Next, for eachSSi, the RA, RA executes the Extraction phase described in Section 4.2 to extract a decryption key related to IDSSi under the trapdoor master secret TA. The private key for SSi is considered as eSSi,rSSi.


### 5.2.2. Registration of Gateway Nodes and Cloud Servers

The registration process for the deployed gateway nodesGWNj and cloud servers CLSk is also based on the execution of the Set-up phase, where the public parameters are A,u0,H^, and TA is the trapdoor master secret. This phase involves the following steps:•
Step 1. For eachGWNj, the RA, RA assigns a unique identity IDGWNj. In a similar way, for each CLSk, the RA, RA also assigns a unique identity IDCLSk.•
Step 2. For eachGWNj and CLSk, the RA, RA executes the Extraction phase. After executing this process, the private keys for GWNj and CLSk are selected as eGWNj,rGWNj and eCLSk,rCLSk, respectively.


### 5.2.3. Secure Data Aggregation at Gateway

In this phase, the following steps are involved:•
Step 1. Suppose the IoT smart sensorsSSi are deployed in their respective IoT applications as shown in Figure 4. The gateway nodes GWNj and cloud servers CLSk are also placed accordingly in the network. Let a smart sensor SSi sense the information (data), say DataSSi from its deployment area and want to communicate it securely with its gateway node GWNj, GWNj. For this purpose, the SSi, SSi generates a current timestamp, say TSSSi, prepares a message of the type MsgSSi=IDSSi,TSSSi,DataSSi and encrypts MsgSSi bit wise using the public parameters, identity of GWNj, GWNj and trapdoor master key TA to create the ciphertext CSSi=C0,C1,C2 as done in the Encrypts phase described in Section 4.3, where C0, C1 and C2 are the encrypted bit strings corresponding to the bit strings of the MsgSSi. Next, SSi sends the encrypted message {CSSi, TSSSi} to its destination GWNj, GWNj via a public channel.


### 5.2.4. Secure Data Storage at Cloud Servers

In this phase, a cloud serverCLSk, CLSk receives the encrypted data from the respective gateway nodes GWNj residing in an IoT application, and stores the encrypted data in its database for further processing. In order to do this, the following steps are executed by the CLSk, CLSk:•
Step 1. Once the messageCGWNj,TSGWNj, is received at time TSGWNj∗, for checking replaying attacks, CLSk, CLSk checks the validity of the received timestamp by the condition: TSGWNj−TSGWNj∗<ΔT. If the condition fails, the process is immediately terminated.•
If the timestamp validation is satisfied, the encrypted dataCGWNj is then stored in the database of CLSk, CLSk.


### 5.2.5. Big Data Analytics using AI

It is worth noticing that a cloud serverCLSk, CLSk receives the encrypted data generated by the IoT smart sensors residing in various applications via the aggregator nodes (gateway nodes). CLSk, CLSk can then decrypt the stored data bit wise using its own private key eCLSk,rCLSk and performs the Big Data analytics steps using AI/ML techniques, such as “data acquisition and filtering”, “data extraction”, “data aggregation and representation”, “data analysis” as well as “data visualization”. The results of this phase will provide some useful conclusions and predictions on the stored data.The overall mechanism of the proposed IBE scheme for IoT-based AI applications is also illustrated in Figure6. The pre-deployment and registration phases are performed through the steps 1, 2 and 3. Step 4 explains about the data aggregation phase. While the steps 5 and 6 are about secure data storage, Step 7 explains the Big data analytics using the AI techniques.Figure 6
Overall mechanism of the proposed IBE scheme for IoT-based AI applications.•
Step 2. After receiving the message fromSSi, GWNj, GWNj first checks the validity of the received timestamp by the condition: TSSSi−TSSSi∗<ΔT, where TSSSi∗ and ΔT represent the time when the message was received and the maximum transmission delay, respectively. If the condition is satisfied, GWNj, GWNj proceeds to decrypt CSSi bit wise using its private (secret) key eGWNj,rGWNj with the help of the Decrypts phase described in Section 4.4 to obtain IDSSi,TSSSi′,DataSSi. After that if the checking condition: TSSSi′=TSSSi is valid, GWNj, GWNj considers the data is fresh. Thus, no replay attack has been there during this process with the timestamping mechanism. Of course, for this purpose, it is reasonable to assume that the network entities are synchronized with their clocks [8].•
Step 3. Now,GWNj, GWNj generates a current timestamp TSGWNj, encrypts the prepared message MsgGWNj=MsgSSi,IDGWNj,TSGWNj=IDSSi,TSSSi,DataSSi,IDGWNj,TSGWNj bit wise using the public key of its corresponding cloud server CLSk to obtain the ciphertext CGWNj=C0′,C1′,C2′ as done in the Encrypts phase, and sends the encrypted message {CGWNj, TSGWNj} to its respective CLSk, CLSk via a public channel, where C0′, C1′ and C2′ are the encrypted bit strings corresponding to the bit strings of the MsgGWNj.


## 5.2.1. Pre-deployment of IoT Devices

Before deploying the IoT smart devices (smart sensors)SSi in their respective application, the trusted RA, RA executes the Set-up phase described in Section 4.1 in order to select the system parameters. The steps are as follows:•
Step 1. The selected public parameters areA,u0,H^, whereas TA is as the master secret.•
Step 2. For eachSSi, the RA, RA assigns a unique identity IDSSi.•
Step 3. Next, for eachSSi, the RA, RA executes the Extraction phase described in Section 4.2 to extract a decryption key related to IDSSi under the trapdoor master secret TA. The private key for SSi is considered as eSSi,rSSi.


## 5.2.2. Registration of Gateway Nodes and Cloud Servers

The registration process for the deployed gateway nodesGWNj and cloud servers CLSk is also based on the execution of the Set-up phase, where the public parameters are A,u0,H^, and TA is the trapdoor master secret. This phase involves the following steps:•
Step 1. For eachGWNj, the RA, RA assigns a unique identity IDGWNj. In a similar way, for each CLSk, the RA, RA also assigns a unique identity IDCLSk.•
Step 2. For eachGWNj and CLSk, the RA, RA executes the Extraction phase. After executing this process, the private keys for GWNj and CLSk are selected as eGWNj,rGWNj and eCLSk,rCLSk, respectively.


## 5.2.3. Secure Data Aggregation at Gateway

In this phase, the following steps are involved:•
Step 1. Suppose the IoT smart sensorsSSi are deployed in their respective IoT applications as shown in Figure 4. The gateway nodes GWNj and cloud servers CLSk are also placed accordingly in the network. Let a smart sensor SSi sense the information (data), say DataSSi from its deployment area and want to communicate it securely with its gateway node GWNj, GWNj. For this purpose, the SSi, SSi generates a current timestamp, say TSSSi, prepares a message of the type MsgSSi=IDSSi,TSSSi,DataSSi and encrypts MsgSSi bit wise using the public parameters, identity of GWNj, GWNj and trapdoor master key TA to create the ciphertext CSSi=C0,C1,C2 as done in the Encrypts phase described in Section 4.3, where C0, C1 and C2 are the encrypted bit strings corresponding to the bit strings of the MsgSSi. Next, SSi sends the encrypted message {CSSi, TSSSi} to its destination GWNj, GWNj via a public channel.


## 5.2.4. Secure Data Storage at Cloud Servers

In this phase, a cloud serverCLSk, CLSk receives the encrypted data from the respective gateway nodes GWNj residing in an IoT application, and stores the encrypted data in its database for further processing. In order to do this, the following steps are executed by the CLSk, CLSk:•
Step 1. Once the messageCGWNj,TSGWNj, is received at time TSGWNj∗, for checking replaying attacks, CLSk, CLSk checks the validity of the received timestamp by the condition: TSGWNj−TSGWNj∗<ΔT. If the condition fails, the process is immediately terminated.•
If the timestamp validation is satisfied, the encrypted dataCGWNj is then stored in the database of CLSk, CLSk.


## 5.2.5. Big Data Analytics using AI

It is worth noticing that a cloud serverCLSk, CLSk receives the encrypted data generated by the IoT smart sensors residing in various applications via the aggregator nodes (gateway nodes). CLSk, CLSk can then decrypt the stored data bit wise using its own private key eCLSk,rCLSk and performs the Big Data analytics steps using AI/ML techniques, such as “data acquisition and filtering”, “data extraction”, “data aggregation and representation”, “data analysis” as well as “data visualization”. The results of this phase will provide some useful conclusions and predictions on the stored data.The overall mechanism of the proposed IBE scheme for IoT-based AI applications is also illustrated in Figure6. The pre-deployment and registration phases are performed through the steps 1, 2 and 3. Step 4 explains about the data aggregation phase. While the steps 5 and 6 are about secure data storage, Step 7 explains the Big data analytics using the AI techniques.Figure 6
Overall mechanism of the proposed IBE scheme for IoT-based AI applications.•
Step 2. After receiving the message fromSSi, GWNj, GWNj first checks the validity of the received timestamp by the condition: TSSSi−TSSSi∗<ΔT, where TSSSi∗ and ΔT represent the time when the message was received and the maximum transmission delay, respectively. If the condition is satisfied, GWNj, GWNj proceeds to decrypt CSSi bit wise using its private (secret) key eGWNj,rGWNj with the help of the Decrypts phase described in Section 4.4 to obtain IDSSi,TSSSi′,DataSSi. After that if the checking condition: TSSSi′=TSSSi is valid, GWNj, GWNj considers the data is fresh. Thus, no replay attack has been there during this process with the timestamping mechanism. Of course, for this purpose, it is reasonable to assume that the network entities are synchronized with their clocks [8].•
Step 3. Now,GWNj, GWNj generates a current timestamp TSGWNj, encrypts the prepared message MsgGWNj=MsgSSi,IDGWNj,TSGWNj=IDSSi,TSSSi,DataSSi,IDGWNj,TSGWNj bit wise using the public key of its corresponding cloud server CLSk to obtain the ciphertext CGWNj=C0′,C1′,C2′ as done in the Encrypts phase, and sends the encrypted message {CGWNj, TSGWNj} to its respective CLSk, CLSk via a public channel, where C0′, C1′ and C2′ are the encrypted bit strings corresponding to the bit strings of the MsgGWNj.


## 6. Security Analysis

In this section, we analyze the security of the proposed encryption scheme by using a sequence of games played between an adversary, sayA and a challenger, say ℬ, namely the games Gl, for l=0,1,2,3,4. The initial game G0 is considered as the real attack, whereas the final game G4 is the game that cannot be cracked by the adversary A. Each transition from a game Gi to another game Gi+1 is indistinguishable with a negligible advantage under some hard assumption. If there are polynomial time games, each of the transitions is also indistinguishable with the negligible advantage meaning that the advantage of A in real attack is negligible. We now define the games in order to ensure the indistinguishable transitions.


### 6.1. Games Descriptions

The following games are discussed below.•
GameG0: This game is played between the adversary A and the challenger ℬ with both honest and indistinguishable properties under the IND-sID-CPA property. We have defined as earlier that, under “selective identity chosen plaintext attack IND-sID-CPA” property, A needs to submit target identity at advance to the ℬ, before ℬ runs the Set-up algorithm.•
GameG1: This game is same as G0 except in the Set-up phase, ℬ computes the matrices Hi,b, for 1≤i≤k and b∈0,1 not directly, but as an arbitrary public key of random GPV trapdoors [21] corresponding to the trapdoor Ti,b.•
GameG2: This game is same as G1, except ℬ neither uses the master secret TA nor the Extraction phase to answer the queries to private keys, but it uses another Trapdoor-Extraction phase and trapdoors Ti,b for 1≤i≤k and b∈0,1. The trapdoors are represented as T^=〈i, b, Ti,b〉: 1≤i≤k, 0≤b≤1.Trapdoor-ExtractionA,u0,H^,ID,i∗,Ti∗,b∗: A key that corresponds to decryption is extracted for the identity ID, with the help of the trapdoor:1.
Letbi=bitimod2ID be the position of non zero bit for 1≤i≤k and b∈0,1. Assemble an n×ℓ matrix HID=Hi1,bi1mod2Hi2,bi2mod2⋯, |Hiℓ,biℓmod2∈ℤqn×ℓ, where Hi1,bi1mod2Hi2,bi2mod2⋯, |Hiℓ,biℓmod2∈H^ because Hi1,b1 or Hi1,b0 is according to either i1mod2=0 or i1mod2=1.2.
Sampleri←ℤqℓ under Sample-DomHi,bimod2,σ, where i∈1, 2, …, k−i∗, that is, from the set ℤqℓ.3.
Letu^=u0+HIDr^∈ℤqn. It can be then observed as u^=u0+∑i∈1,2,…,k−i∗ℓ′Hi,bimod2ri, where i is the non zero position in the string S=HID, and r^ is the concatenation of all ri s, except 0, which follows the distribution ri∗.4.
Using the distributionDℤm,σ, sample e←ℤqm under the Sample-DomA,σ algorithm.5.
Computeu=Ae∈ℤqn and u⟶=u−u^, and then use the Sample-Pre(Ti∗,b∗,σ,u^) to sample ri∗←ℤqℓ such that u^=Hi∗,b∗ri∗.6.
Letrt=r1tr2t⋯|rℓt including ri∗ such that u=u0+HIDr. Output a private key K=e,r.•
GameG3: This game is same as G2, except ℬ computes H˜ with the trapdoors T˜. It knows only the trapdoor of ith index, but not corresponding to ith, ith-bit of the target ID∗.1.
Letbitimod2ID∗ for i∈1, 2, …, k, be the modulo of non-zero ith, ith position declared by A to ℬ in the Set-up phase.2.
ℬ generates H˜ by taking b∈0,1, i∈1, 2, …, k such that b≠bitimod2ID∗, and executes GPV trapdoors [21] as in the G2 to obtain Hi,b corresponding to Ti,b. Furthermore, it takes b∈0,1, b∈0,1 such that b=bitimod2ID∗ for a random i∈1, i∈1, 2, …, k, k, and takes Hi,b∈ℤqn×ℓ with Ti,b=⊥.3.
To extract the private key forID≠ID∗, ℬ repeats the game G2, except i∗ is picked such that bitimod2ID≠bitimod2ID∗ and i∗ corresponding to a legal query. If b∗=biti∗mod2ID and Ti∗,b∗≠⊥, ℬ executes Trapdoor-Extraction〈A,u0,H^,ID,i∗,Ti∗,b∗〉 to generate the private key.The challenge cipher then is generated byEncrypts (A,H0,H⟶,ID∗,b∗) for an arbitrary b∗∈0,1, and outputs c=〈c0, c1, c2〉 as the challenge.•
GameG4: This game is also same as G3, except ℬ gives a challenge to A that is not computed honestly, but it is a random cipher, that is, c=〈c0, c1, c2〉 is chosen randomly from ℤq1+m+ℓ distribution.


### 6.2. Games Transitions

In the following, we now show that each of the transitions between the successive games (GameG0, GameG1, GameG2, GameG3, GameG4) is indistinguishable as follows.•
Transition: GameG0, G0⟶GameG1, G1: Both games are identical with respect to A, and ℬ possesses the information regarding trapdoor Ti,b corresponding to Hi,b which is not known to A.•
Transition: GameG1, G1⟶GameG2, G2: Both games are identical with respect to A, and ℬ possesses a different algorithm for key extraction and it is invisible to A.•
Transition: GameG2, G2⟶GameG3, G3: Both games are identical with respect to A, and ℬ knows only half of all the hash-trapdoors and answers if the extraction queries are known, and these are invisible to A.•
Transition: GameG3, G3⟶GameG4, G4: The views are not identical with respect to A, but are indistinguishable under “learning with errors” assumption.1.
In the beginning,ℬ receives 1+m+ℓ samples of “learning with errors” assumption aj,bj∈ℤqn+1, for 1≤j≤1+m+ℓ, with random aj∈ℤqn, and either bj for 1≤j≤1+m+ℓ are random or bj=ajts+xj for 1≤j≤1+m+ℓ with a random s∈ℤqn and Gaussian xj←ξ.2.
In the beginning,ℬ also receives ID∗ from A to be challenged. By applying the Set-up phase, ℬ computes H⟶. ℬ picks b∈0,1 such that b≠bitimod2ID∗ for 1≤i≤k, and executes GPV trapdoors [21] as in G2 to obtain random Hi,b and its trapdoor Ti,b as in another G3 and G4, respectively. Now, ℬ picks b∈0,1 such that b=bitimod2ID∗ for 1≤i≤k, random Hi,b and its jth-column “learning with errors” instance aj, and then sets Ti,b=⊥.3.
ℬ answers the private key queries as in the games G3 and G4 using the corresponding trapdoors. ℬ picks random b∈0,1 and computes a challenge cipher c0∗=b1+b⌊q/2⌋, c1∗=〈b1+i: 1≤i≤m〉∈ℤqm, c2∗=〈b1+m+i: 1≤i≤ℓ〉∈ℤqℓ.4.
Finally,A guesses a bit b∗∈0,1, and ℬ returns the correct b∗=b; else, returns a random bit as an answer to the “learning with errors” instances.It is thus worth noticing thatℬ is indistinguishable in both the games G3 and G4 with respect to view of A, excluding the challenge cipher. The “learning with errors” instance is random for the challenge cipher and components of c∗ has same distribution as in the game G3, and so they will be the components in G4.


### 6.3. Anonymous Cipher and Indistinguishablity

In this section, we discuss the notion of semantic security that is discussed in Section3. It is observed that the proposed identity-based encryption scheme provides indistinguishable property of the ciphers from random strings of equal lengths, although an adversary can presume the identity of the receiver. The challenge cipher is then pseudo-random under the “learning with errors” assumption, which implies indistinguishability.


## 6.1. Games Descriptions

The following games are discussed below.•
GameG0: This game is played between the adversary A and the challenger ℬ with both honest and indistinguishable properties under the IND-sID-CPA property. We have defined as earlier that, under “selective identity chosen plaintext attack IND-sID-CPA” property, A needs to submit target identity at advance to the ℬ, before ℬ runs the Set-up algorithm.•
GameG1: This game is same as G0 except in the Set-up phase, ℬ computes the matrices Hi,b, for 1≤i≤k and b∈0,1 not directly, but as an arbitrary public key of random GPV trapdoors [21] corresponding to the trapdoor Ti,b.•
GameG2: This game is same as G1, except ℬ neither uses the master secret TA nor the Extraction phase to answer the queries to private keys, but it uses another Trapdoor-Extraction phase and trapdoors Ti,b for 1≤i≤k and b∈0,1. The trapdoors are represented as T^=〈i, b, Ti,b〉: 1≤i≤k, 0≤b≤1.Trapdoor-ExtractionA,u0,H^,ID,i∗,Ti∗,b∗: A key that corresponds to decryption is extracted for the identity ID, with the help of the trapdoor:1.
Letbi=bitimod2ID be the position of non zero bit for 1≤i≤k and b∈0,1. Assemble an n×ℓ matrix HID=Hi1,bi1mod2Hi2,bi2mod2⋯, |Hiℓ,biℓmod2∈ℤqn×ℓ, where Hi1,bi1mod2Hi2,bi2mod2⋯, |Hiℓ,biℓmod2∈H^ because Hi1,b1 or Hi1,b0 is according to either i1mod2=0 or i1mod2=1.2.
Sampleri←ℤqℓ under Sample-DomHi,bimod2,σ, where i∈1, 2, …, k−i∗, that is, from the set ℤqℓ.3.
Letu^=u0+HIDr^∈ℤqn. It can be then observed as u^=u0+∑i∈1,2,…,k−i∗ℓ′Hi,bimod2ri, where i is the non zero position in the string S=HID, and r^ is the concatenation of all ri s, except 0, which follows the distribution ri∗.4.
Using the distributionDℤm,σ, sample e←ℤqm under the Sample-DomA,σ algorithm.5.
Computeu=Ae∈ℤqn and u⟶=u−u^, and then use the Sample-Pre(Ti∗,b∗,σ,u^) to sample ri∗←ℤqℓ such that u^=Hi∗,b∗ri∗.6.
Letrt=r1tr2t⋯|rℓt including ri∗ such that u=u0+HIDr. Output a private key K=e,r.•
GameG3: This game is same as G2, except ℬ computes H˜ with the trapdoors T˜. It knows only the trapdoor of ith index, but not corresponding to ith, ith-bit of the target ID∗.1.
Letbitimod2ID∗ for i∈1, 2, …, k, be the modulo of non-zero ith, ith position declared by A to ℬ in the Set-up phase.2.
ℬ generates H˜ by taking b∈0,1, i∈1, 2, …, k such that b≠bitimod2ID∗, and executes GPV trapdoors [21] as in the G2 to obtain Hi,b corresponding to Ti,b. Furthermore, it takes b∈0,1, b∈0,1 such that b=bitimod2ID∗ for a random i∈1, i∈1, 2, …, k, k, and takes Hi,b∈ℤqn×ℓ with Ti,b=⊥.3.
To extract the private key forID≠ID∗, ℬ repeats the game G2, except i∗ is picked such that bitimod2ID≠bitimod2ID∗ and i∗ corresponding to a legal query. If b∗=biti∗mod2ID and Ti∗,b∗≠⊥, ℬ executes Trapdoor-Extraction〈A,u0,H^,ID,i∗,Ti∗,b∗〉 to generate the private key.The challenge cipher then is generated byEncrypts (A,H0,H⟶,ID∗,b∗) for an arbitrary b∗∈0,1, and outputs c=〈c0, c1, c2〉 as the challenge.•
GameG4: This game is also same as G3, except ℬ gives a challenge to A that is not computed honestly, but it is a random cipher, that is, c=〈c0, c1, c2〉 is chosen randomly from ℤq1+m+ℓ distribution.


## 6.2. Games Transitions

In the following, we now show that each of the transitions between the successive games (GameG0, GameG1, GameG2, GameG3, GameG4) is indistinguishable as follows.•
Transition: GameG0, G0⟶GameG1, G1: Both games are identical with respect to A, and ℬ possesses the information regarding trapdoor Ti,b corresponding to Hi,b which is not known to A.•
Transition: GameG1, G1⟶GameG2, G2: Both games are identical with respect to A, and ℬ possesses a different algorithm for key extraction and it is invisible to A.•
Transition: GameG2, G2⟶GameG3, G3: Both games are identical with respect to A, and ℬ knows only half of all the hash-trapdoors and answers if the extraction queries are known, and these are invisible to A.•
Transition: GameG3, G3⟶GameG4, G4: The views are not identical with respect to A, but are indistinguishable under “learning with errors” assumption.1.
In the beginning,ℬ receives 1+m+ℓ samples of “learning with errors” assumption aj,bj∈ℤqn+1, for 1≤j≤1+m+ℓ, with random aj∈ℤqn, and either bj for 1≤j≤1+m+ℓ are random or bj=ajts+xj for 1≤j≤1+m+ℓ with a random s∈ℤqn and Gaussian xj←ξ.2.
In the beginning,ℬ also receives ID∗ from A to be challenged. By applying the Set-up phase, ℬ computes H⟶. ℬ picks b∈0,1 such that b≠bitimod2ID∗ for 1≤i≤k, and executes GPV trapdoors [21] as in G2 to obtain random Hi,b and its trapdoor Ti,b as in another G3 and G4, respectively. Now, ℬ picks b∈0,1 such that b=bitimod2ID∗ for 1≤i≤k, random Hi,b and its jth-column “learning with errors” instance aj, and then sets Ti,b=⊥.3.
ℬ answers the private key queries as in the games G3 and G4 using the corresponding trapdoors. ℬ picks random b∈0,1 and computes a challenge cipher c0∗=b1+b⌊q/2⌋, c1∗=〈b1+i: 1≤i≤m〉∈ℤqm, c2∗=〈b1+m+i: 1≤i≤ℓ〉∈ℤqℓ.4.
Finally,A guesses a bit b∗∈0,1, and ℬ returns the correct b∗=b; else, returns a random bit as an answer to the “learning with errors” instances.It is thus worth noticing thatℬ is indistinguishable in both the games G3 and G4 with respect to view of A, excluding the challenge cipher. The “learning with errors” instance is random for the challenge cipher and components of c∗ has same distribution as in the game G3, and so they will be the components in G4.


## 6.3. Anonymous Cipher and Indistinguishablity

In this section, we discuss the notion of semantic security that is discussed in Section3. It is observed that the proposed identity-based encryption scheme provides indistinguishable property of the ciphers from random strings of equal lengths, although an adversary can presume the identity of the receiver. The challenge cipher is then pseudo-random under the “learning with errors” assumption, which implies indistinguishability.


## 7. Performance Comparison

This section provides computation costs and recommended bit-size of the proposed identity-based encryption scheme and compares them with the other relevant approaches, such as discrete logarithm-based schemes, RSA public key cryptosystem [31] and ElGamal cryptosystem [32].


### 7.1. Comparison on Recommended Bit-size

Letκ be an appropriate security parameter and Oκ2 be the size of public key. We can then relate the computation time in terms of security parameter complexity Oκ2, Oκ2. It can be compared with the size of classic public key cryptosystems (RSA and ElGamal) which is Oκ and computation time in terms of security parameter as Oκ3 [33, 36].We takeq=Oκ2, m=Oκlogq and n=Oκlogq as the parameters, where κ is the security parameter. Furthermore, we consider q=κ2, m=κlogq and n=κlogq as the parameters to simplify the computation. The storage cost is mnlogq=16κ2log3q and the communication cost is 8κlog2κ in the proposed scheme. The cipher is computed as c0=u0ts+x+b⌊q/2⌋∈ℤq, c1=Ats+y∈ℤqm and c3=HIDts+z∈ℤqℓ, that is, in the form of triplet c=〈c0, c1, c2〉. The size of public keys involves the security parameters A∈ℤqm×n, H^, u0∈ℤqn, which is roughly 16κ2log3κ, that is, Om2logq=Oκ2logκ. In Table 1, a comparative study on recommended bit-size with respect to Lattice and classical discrete logarithm due to the “discrete logarithm problem (DLP)” intractability.Table 1
A comparative study on recommended bit-size: Latticeversus classical discrete logarithm.
ProtocolPrimitiveRecommended bit-sizeDLP storageg∈ℤp∗k′=logpLattice storageA∈ℤqm×n, H^,u0∈ℤqn16κ2log3κDLP communicationgr,Pgrx∈ℤp∗k′=logpLattice communicationu0ts+x+b⌊q/2⌋∈ℤq,8κlog2κAts+y∈ℤqm,HIDts+z∈ℤqℓ


### 7.2. Comparison on Computation Costs

In Table2, the relationship between the length of keys in bits and the key generation time in milliseconds has been shown. Based on the results reported in [40], in RSA-based public cryptosystem, the key lengths of 512, 1024 and 2048 bits take 360, 1280 and 4195 milliseconds, respectively. On the other hand, in the proposed lattice-based scheme, the key lengths of 1170, 1841 and 4024 bits require the generation time having 4, 7.5 and 17.5 milliseconds, respectively [40]. This clearly shows that the lattice-based IBE scheme requires less computational time for key generation part as compared to other public key cryptosystems, such as RSA.Table 2
Key length and key generation time comparative study: RSAversus Lattice based cryptosystem.
ApproachKey-lengthKey generation time(in bits)(in milliseconds)512360RSA102412802048419511694Lattice-based18417.5402417.5Table3 shows a comparative analysis on the key length in bits with the encryption and decryption speed in terms of blocks per second based on the results reported in [40]. It is noticed that when the key size is smaller, the encryption and decryption processing time for the blocks per second are less. However, the lattice-based cryptosystem performs better than RSA-based public key cryptosystem even if the key size is large.Table 3
Encryption and decryption costs comparative study: RSAversus Lattice based cryptosystem.
ApproachKey-length (in bits)Message encryptionMessage decryption(blocks per second)(blocks per second)5122440120RSA10249302020483103116959402820Lattice-based18413680162040241470610


### 7.3. Comparison on Security

A comparative study on the key length size and the security aspect between the RSA-based public key cryptosystem and lattice-based cryptosystem has been presented in Table4 based on the results reported in [40]. Million instructions per second (MIPS) is taken as an “approximate measure of a computer’s raw processing power”, which is considered in the comparative study. It is observed that in both the cases when the key size is large, the security of the system increases. Moreover, even for a smaller key size the lattice based cryptosystem provides significantly better security as compared to that for an RSA-based cryptosystem.Table 4
Key length and security comparative study: RSAversus Lattice based cryptosystem.
ApproachKey-lengthSecurity(in bits)(MIPS per year)RSA5124×10510243×101220483×102111692×106Lattice-based18414.6×101440243.4×1035In summary, the lattice-based cryptosystem has several advantages, such as: (a) “cryptographic resistance compared to RSA”, (b) “faster key generation”, and (c) “faster encryption and decryption of the messages”. In addition, the prime advantage of the lattice-based cryptosystem is its resistance to quantum computer attacks.


## 7.1. Comparison on Recommended Bit-size

Letκ be an appropriate security parameter and Oκ2 be the size of public key. We can then relate the computation time in terms of security parameter complexity Oκ2, Oκ2. It can be compared with the size of classic public key cryptosystems (RSA and ElGamal) which is Oκ and computation time in terms of security parameter as Oκ3 [33, 36].We takeq=Oκ2, m=Oκlogq and n=Oκlogq as the parameters, where κ is the security parameter. Furthermore, we consider q=κ2, m=κlogq and n=κlogq as the parameters to simplify the computation. The storage cost is mnlogq=16κ2log3q and the communication cost is 8κlog2κ in the proposed scheme. The cipher is computed as c0=u0ts+x+b⌊q/2⌋∈ℤq, c1=Ats+y∈ℤqm and c3=HIDts+z∈ℤqℓ, that is, in the form of triplet c=〈c0, c1, c2〉. The size of public keys involves the security parameters A∈ℤqm×n, H^, u0∈ℤqn, which is roughly 16κ2log3κ, that is, Om2logq=Oκ2logκ. In Table 1, a comparative study on recommended bit-size with respect to Lattice and classical discrete logarithm due to the “discrete logarithm problem (DLP)” intractability.Table 1
A comparative study on recommended bit-size: Latticeversus classical discrete logarithm.
ProtocolPrimitiveRecommended bit-sizeDLP storageg∈ℤp∗k′=logpLattice storageA∈ℤqm×n, H^,u0∈ℤqn16κ2log3κDLP communicationgr,Pgrx∈ℤp∗k′=logpLattice communicationu0ts+x+b⌊q/2⌋∈ℤq,8κlog2κAts+y∈ℤqm,HIDts+z∈ℤqℓ


## 7.2. Comparison on Computation Costs

In Table2, the relationship between the length of keys in bits and the key generation time in milliseconds has been shown. Based on the results reported in [40], in RSA-based public cryptosystem, the key lengths of 512, 1024 and 2048 bits take 360, 1280 and 4195 milliseconds, respectively. On the other hand, in the proposed lattice-based scheme, the key lengths of 1170, 1841 and 4024 bits require the generation time having 4, 7.5 and 17.5 milliseconds, respectively [40]. This clearly shows that the lattice-based IBE scheme requires less computational time for key generation part as compared to other public key cryptosystems, such as RSA.Table 2
Key length and key generation time comparative study: RSAversus Lattice based cryptosystem.
ApproachKey-lengthKey generation time(in bits)(in milliseconds)512360RSA102412802048419511694Lattice-based18417.5402417.5Table3 shows a comparative analysis on the key length in bits with the encryption and decryption speed in terms of blocks per second based on the results reported in [40]. It is noticed that when the key size is smaller, the encryption and decryption processing time for the blocks per second are less. However, the lattice-based cryptosystem performs better than RSA-based public key cryptosystem even if the key size is large.Table 3
Encryption and decryption costs comparative study: RSAversus Lattice based cryptosystem.
ApproachKey-length (in bits)Message encryptionMessage decryption(blocks per second)(blocks per second)5122440120RSA10249302020483103116959402820Lattice-based18413680162040241470610


## 7.3. Comparison on Security

A comparative study on the key length size and the security aspect between the RSA-based public key cryptosystem and lattice-based cryptosystem has been presented in Table4 based on the results reported in [40]. Million instructions per second (MIPS) is taken as an “approximate measure of a computer’s raw processing power”, which is considered in the comparative study. It is observed that in both the cases when the key size is large, the security of the system increases. Moreover, even for a smaller key size the lattice based cryptosystem provides significantly better security as compared to that for an RSA-based cryptosystem.Table 4
Key length and security comparative study: RSAversus Lattice based cryptosystem.
ApproachKey-lengthSecurity(in bits)(MIPS per year)RSA5124×10510243×101220483×102111692×106Lattice-based18414.6×101440243.4×1035In summary, the lattice-based cryptosystem has several advantages, such as: (a) “cryptographic resistance compared to RSA”, (b) “faster key generation”, and (c) “faster encryption and decryption of the messages”. In addition, the prime advantage of the lattice-based cryptosystem is its resistance to quantum computer attacks.


## 8. Concluding Remarks

In this work, we attempted to design an advanced identity-based encryption that is a very important cryptographic tool to ensure confidentiality in the current quantum era. The proposed encryption is a provably post-quantum secure without random oracles. Since lattices depends on algebraic operations that are typically matrix addition and multiplication, they make the encryption much efficient as compared to other public key cryptosystems, such as RSA. In addition, the proposed scheme is also anonymous and it produces the pseudo-random ciphers. Finally, we incorporated the constructed identity based encryption (IBE) scheme for IoT applications and described how the Big data analytics using the AI/ML techniques will be helpful in such applications.



---

*Source: 5498058-2022-07-06.xml*