# Secure and Efficient Access Control Scheme for Wireless Sensor Networks in the Cross-Domain Context of the IoT

Authors: Ming Luo; Yi Luo; Yuwei Wan; Ze Wang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Nowadays wireless sensor network (WSN) is increasingly being used in the Internet of Things (IoT) for data collection, and design of an access control scheme that allows an Internet user as part of IoT to access the WSN becomes a hot topic. A lot of access control schemes have been proposed for the WSNs in the context of the IoT. Nevertheless, almost all of these schemes assume that communication nodes in different network domains share common system parameters, which is not suitable for cross-domain IoT environment in practical situations. To solve this shortcoming, we propose a more secure and efficient access control scheme for wireless sensor networks in the cross-domain context of the Internet of Things, which allows an Internet user in a certificateless cryptography (CLC) environment to communicate with a sensor node in an identity-based cryptography (IBC) environment with different system parameters. Moreover, our proposed scheme achieves known session-specific temporary information security (KSSTIS) that most of access control schemes cannot satisfy. Performance analysis is given to show that our scheme is well suited for wireless sensor networks in the cross-domain context of the IoT.


---

## Body

## 1. Introduction

Wireless sensor network (WSN) is a distributed network which contains a large number of sensor nodes. We can collect the target data through the sensor nodes to obtain valuable information. Due to the flexibility and convenience of data capture, WSN has been integrated into the IoT. The integration of WSN applications and low-power sensing nodes with the Internet may be accomplished with various approaches and strategies [1], and the popular integration solutions include cloud-based integration approaches [2, 3], front-end proxy integration approaches [4], architecture frameworks [5], and the integration via standard Internet communication protocols [6, 7]. In the cloud-based integration solution, some important security requirements including privacy, trust, and anonymity cannot be addressed. This approach also does not support the secure integration with data sources from other sensing devices or heterogeneous WSN domains. For the front-end proxy integration solution, the wireless sensor nodes communicate with the Internet hosts through a proxy server; thus this integration approach does not support direct communications between WSN nodes and Internet hosts, and the shortcoming of this approach is that the proxy server is vulnerable to cyberattacks and may become the bottleneck. In the integration solution via standard Internet communication protocols, most of approaches employ specialized middleware layers instead of supporting generic Internet communication mechanisms that can implement heterogeneous applications. However, these proposed solutions developed in the context of the architecture frameworks currently do not support Internet communications in WSN environments. For the integration via standard Internet communication protocols, a large number of access control schemes using public key infrastructure (PKI) are proposed. PKI, however, has a serious problem of certificate management. Subsequently, a series of access control schemes using identity-based cryptography (IBC) or certificateless cryptography (CLC) are designed, and even a new idea of integrating IBC with CLC into an access control scheme is introduced. In particular some access control schemes using heterogeneous signcryption schemes are generated, in which an Internet sender as part of IoT belongs to the CLC environment and a wireless sensor receiver is in the IBC environment. However, almost all of these access control schemes assume that communication nodes share common system parameters in different network domains, which are not suitable for cross-domain IoT environment in practical situations. Moreover, we find that most of these schemes cannot satisfy known session-specific temporary information security (KSSTIS, which means that the attacker cannot obtain the plaintext message when the ephemeral key and the access request message are leaked). Thus, it is necessary to design a more secure and efficient access control scheme and make it more suitable for wireless sensor networks in the cross-domain context of the IoT.


### 1.1. Related Work

Zhou et al. proposed an access control scheme for WSNs using elliptic curve (EC) cryptography [8], which is more efficient than the PKI-based schemes. However, to authenticate a sensor node, the scheme of Zhou et al. needed high computational and communicational costs. Next, Huang [9] proposed an efficient access control protocol (EACP) based on the EC, which is quite adequate for low-powered sensor nodes. Consequently, Kim and Lee [10] pointed out that EACP scheme is susceptible to a message replay attack, and they proposed an enhanced access control protocol (ENCP). However, Lee et al. [11] showed that ENCP is subjected to a new node masquerade attack and message forgery attack, and then they proposed a practical access control protocol (PACP). In 2015, Chen et al. [12] claimed that the PACP is susceptible to the adversary attacks and needs huge key storage resources. Recently, Kumar et al. [13] proposed a more secure and efficient scheme for WSNs, which provides robust security and achieves the access control while taking care of the identity privacy. However, these schemes above cannot provide message confidentiality and unforgeability at the same time. In order to simultaneously authenticate the sensor node and protect the confidentiality of messages with a low cost, Yu et al. [14] and Ma et al. [15] proposed the access control schemes using signcryption approach (ACSC). Signcryption performs the signature and the encryption in one logical step. Compared with the signature-then-encryption method, signcryption has less cost. But these above ACSC schemes are based on the public key infrastructure (PKI). In PKI, the certificate authority (CA) generates a digital certificate for each user, which triggers the PKI’s certificate management problem. In order to avoid this problem and reduce the burden on traditional PKI, identity-based public key cryptography (IBC) and certificateless public key cryptography (CLC) were proposed, where certificate used in PKI is not needed. Recently, many security mechanisms for WSNs using IBC [16, 17] or CLC [18, 19] have been generated. All the above schemes are homogeneous means that sender and receiver must belong to the same security domain (PKI or IBC or CLC environment). Heterogeneous signcryption allows the sender to send a message to the receiver in different security domain. Huang et al. [20] proposed a heterogeneous signcryption scheme that the sender is in the IBC environment and the receiver belongs to the PKI environment. In 2016, Li et al. [21] proposed a novel access control scheme (NACS) for sensor networks in the context of the IoT. The NACS uses heterogeneous signcryption (HSC) in which an Internet sender as part of IoT belongs to the CLC environment and a wireless sensor receiver is in the IBC environment, which conforms the characteristics of the WSNs in the context of the IoT.


### 1.2. Our Contribution

In this paper, we propose an access control scheme for WSNs in the cross-domain context of the IoT using heterogeneous signcryption. We define the generic model and security model of the cross-domain heterogeneous signcryption (CDHSC) and then propose a CDHSC scheme that proves to be safe under the Bilinear Inverse Diffie-Hellman Problem (BIDH) and Computational Diffie-Hellman Problem (CDHP) assumptions in the random oracle model. Compared with NACS scheme [21] through performance analysis, our scheme has the following merits: (1) our scheme allows an Internet user in a certificateless cryptography (CLC) environment to communicate a sensor node in an identity-based cryptography (IBC) environment with different system parameters so that it can be used for WSNs in the cross-domain context of the IoT; (2) our scheme has less computation cost (not including precomputation cost). For the Signcryption algorithm, our scheme has the same computation cost as the NACS scheme. But for the Unsigncryption algorithm, our scheme only needs three bilinear pairings computations, while the NACS scheme requires four. As we all know, bilinear pairing computation is the most expensive operation in a signcryption scheme from bilinear pairing; (3) our scheme satisfies the known session-specific temporary information security attribute.


### 1.3. Organization

The remainder of our paper is organized as follows. The preliminaries for network model, bilinear pairings, and difficult mathematical problems are given in the next section. The third section elaborates on the definition of the cross-domain heterogeneous signcryption (CDHSC), proposes a specific CDHSC scheme, and gives the security analysis of the proposed scheme. In the fourth section we propose a secure and efficient access control scheme for wireless sensor networks in the cross-domain context of the IoT and perform an efficiency analysis on it. In the last section, we make a summary.


## 1.1. Related Work

Zhou et al. proposed an access control scheme for WSNs using elliptic curve (EC) cryptography [8], which is more efficient than the PKI-based schemes. However, to authenticate a sensor node, the scheme of Zhou et al. needed high computational and communicational costs. Next, Huang [9] proposed an efficient access control protocol (EACP) based on the EC, which is quite adequate for low-powered sensor nodes. Consequently, Kim and Lee [10] pointed out that EACP scheme is susceptible to a message replay attack, and they proposed an enhanced access control protocol (ENCP). However, Lee et al. [11] showed that ENCP is subjected to a new node masquerade attack and message forgery attack, and then they proposed a practical access control protocol (PACP). In 2015, Chen et al. [12] claimed that the PACP is susceptible to the adversary attacks and needs huge key storage resources. Recently, Kumar et al. [13] proposed a more secure and efficient scheme for WSNs, which provides robust security and achieves the access control while taking care of the identity privacy. However, these schemes above cannot provide message confidentiality and unforgeability at the same time. In order to simultaneously authenticate the sensor node and protect the confidentiality of messages with a low cost, Yu et al. [14] and Ma et al. [15] proposed the access control schemes using signcryption approach (ACSC). Signcryption performs the signature and the encryption in one logical step. Compared with the signature-then-encryption method, signcryption has less cost. But these above ACSC schemes are based on the public key infrastructure (PKI). In PKI, the certificate authority (CA) generates a digital certificate for each user, which triggers the PKI’s certificate management problem. In order to avoid this problem and reduce the burden on traditional PKI, identity-based public key cryptography (IBC) and certificateless public key cryptography (CLC) were proposed, where certificate used in PKI is not needed. Recently, many security mechanisms for WSNs using IBC [16, 17] or CLC [18, 19] have been generated. All the above schemes are homogeneous means that sender and receiver must belong to the same security domain (PKI or IBC or CLC environment). Heterogeneous signcryption allows the sender to send a message to the receiver in different security domain. Huang et al. [20] proposed a heterogeneous signcryption scheme that the sender is in the IBC environment and the receiver belongs to the PKI environment. In 2016, Li et al. [21] proposed a novel access control scheme (NACS) for sensor networks in the context of the IoT. The NACS uses heterogeneous signcryption (HSC) in which an Internet sender as part of IoT belongs to the CLC environment and a wireless sensor receiver is in the IBC environment, which conforms the characteristics of the WSNs in the context of the IoT.


## 1.2. Our Contribution

In this paper, we propose an access control scheme for WSNs in the cross-domain context of the IoT using heterogeneous signcryption. We define the generic model and security model of the cross-domain heterogeneous signcryption (CDHSC) and then propose a CDHSC scheme that proves to be safe under the Bilinear Inverse Diffie-Hellman Problem (BIDH) and Computational Diffie-Hellman Problem (CDHP) assumptions in the random oracle model. Compared with NACS scheme [21] through performance analysis, our scheme has the following merits: (1) our scheme allows an Internet user in a certificateless cryptography (CLC) environment to communicate a sensor node in an identity-based cryptography (IBC) environment with different system parameters so that it can be used for WSNs in the cross-domain context of the IoT; (2) our scheme has less computation cost (not including precomputation cost). For the Signcryption algorithm, our scheme has the same computation cost as the NACS scheme. But for the Unsigncryption algorithm, our scheme only needs three bilinear pairings computations, while the NACS scheme requires four. As we all know, bilinear pairing computation is the most expensive operation in a signcryption scheme from bilinear pairing; (3) our scheme satisfies the known session-specific temporary information security attribute.


## 1.3. Organization

The remainder of our paper is organized as follows. The preliminaries for network model, bilinear pairings, and difficult mathematical problems are given in the next section. The third section elaborates on the definition of the cross-domain heterogeneous signcryption (CDHSC), proposes a specific CDHSC scheme, and gives the security analysis of the proposed scheme. In the fourth section we propose a secure and efficient access control scheme for wireless sensor networks in the cross-domain context of the IoT and perform an efficiency analysis on it. In the last section, we make a summary.


## 2. Preliminaries

In this part, we give the basic network model of access control scheme, some prior knowledge of bilinear pairings, and difficult mathematical problems.


### 2.1. Network Model

In the network model of access control for wireless sensor networks in the cross-domain context of the IoT, there are five types of communication entities including Internet user, a trusted third party called key generation center (KGC) in the CLC environment, WSN node, the other trusted third party named private key generator (PKG) in the IBC environment, and a gateway used to connect the CLC domain with the IBC domain. PKG and KGC are used to complete the registration of WSN nodes and Internet users, respectively. The PKG calculates the public key and a private key for each WSN node. The KGC is responsible for producing a part of the private key of Internet users, and the other part of the private key is generated by the users themselves. In the network model, each PKG and KGC has different system parameters. In the KGC environment, when an Internet user wants to access the information collected by the sensor nodes from WSN, he needs to signcrypt and submit the query message to the gateway. The gateway belonging to this WSN will first authenticate the access request message from the Internet user. If the verification is passed, the gateway will forward the query message to the WSN. Then the WSN transmits the collected data to the Internet user with unsigncryption key. Otherwise, gateway refuses to provide the service.In the network model of access control, the access request message generated by the Internet user should satisfy confidentiality, integrity, authentication, nonrepudiation, and known session-specific temporary information security (KSSTIS) simultaneously when it is transmitted to the gateway. Figure1 shows the overview of the network model.Figure 1
Network model.


### 2.2. Bilinear Pairings

LetG1 and G2 be two cyclic groups, which have the same prime order q. G1 is an additive group and G2 is a multiplicative group. Let P be a generator of G1. A bilinear pairing is a map e^:G1×G1→G2 that meets the following properties:(1)
Bilinearity:e^(aP,bQ)=e^(P,Q)ab, for all P,Q∈G1 and a,b∈Zq∗.(2)
Nondegeneracy: there existsP∈G1, such that e^(P,P)≠1, where 1 is the identity element of G2.(3)
Computability:e^(P,Q) can be successfully computed for all P,Q∈G1.The security of our scheme relies on the following two hard mathematical problems.Definition 1.
Bilinear Inverse Diffie-Hellman (BIDH) Problem is to computee^(P,P)ab-1 given (P,aP,bP), where a,b∈Zq∗.Definition 2.
Computational Diffie-Hellman (CDH) Problem is to computeabP given (P,aP,bP), where a,b∈Zq∗.


## 2.1. Network Model

In the network model of access control for wireless sensor networks in the cross-domain context of the IoT, there are five types of communication entities including Internet user, a trusted third party called key generation center (KGC) in the CLC environment, WSN node, the other trusted third party named private key generator (PKG) in the IBC environment, and a gateway used to connect the CLC domain with the IBC domain. PKG and KGC are used to complete the registration of WSN nodes and Internet users, respectively. The PKG calculates the public key and a private key for each WSN node. The KGC is responsible for producing a part of the private key of Internet users, and the other part of the private key is generated by the users themselves. In the network model, each PKG and KGC has different system parameters. In the KGC environment, when an Internet user wants to access the information collected by the sensor nodes from WSN, he needs to signcrypt and submit the query message to the gateway. The gateway belonging to this WSN will first authenticate the access request message from the Internet user. If the verification is passed, the gateway will forward the query message to the WSN. Then the WSN transmits the collected data to the Internet user with unsigncryption key. Otherwise, gateway refuses to provide the service.In the network model of access control, the access request message generated by the Internet user should satisfy confidentiality, integrity, authentication, nonrepudiation, and known session-specific temporary information security (KSSTIS) simultaneously when it is transmitted to the gateway. Figure1 shows the overview of the network model.Figure 1
Network model.


## 2.2. Bilinear Pairings

LetG1 and G2 be two cyclic groups, which have the same prime order q. G1 is an additive group and G2 is a multiplicative group. Let P be a generator of G1. A bilinear pairing is a map e^:G1×G1→G2 that meets the following properties:(1)
Bilinearity:e^(aP,bQ)=e^(P,Q)ab, for all P,Q∈G1 and a,b∈Zq∗.(2)
Nondegeneracy: there existsP∈G1, such that e^(P,P)≠1, where 1 is the identity element of G2.(3)
Computability:e^(P,Q) can be successfully computed for all P,Q∈G1.The security of our scheme relies on the following two hard mathematical problems.Definition 1.
Bilinear Inverse Diffie-Hellman (BIDH) Problem is to computee^(P,P)ab-1 given (P,aP,bP), where a,b∈Zq∗.Definition 2.
Computational Diffie-Hellman (CDH) Problem is to computeabP given (P,aP,bP), where a,b∈Zq∗.


## 3. Cross-Domain Heterogeneous Signcryption

For the cross-domain heterogeneous signcryption (CDHSC) which can be used in access control for WSNs in the context of the IoT, we first define the generic model and security model. Then we present the specific CDHSC scheme. Finally we show the correctness analysis and the security proof of the proposed scheme.


### 3.1. Generic Model

Our CDHSC scheme consists of nine algorithms as follows.Setup. The trusted third party PKG and KGC execute this probabilistic algorithm to produce a series of system parameters. Firstly they input a security parameter ki then output their master secret key si and corresponding system parameters. Different PKG and KGC use different ki and output different si.CL-PPUKE. The partial public key extraction algorithm is executed by the KGC in CLC environment, which takes as input a KGC’s master secret key si and an Internet user’s identity ID, and outputs the user’s partial public key QID.CL-PPKE. The partial private key extraction algorithm is executed by the KGC in CLC environment, which takes as input a KGC’s master secret key si and an Internet user’s identity ID, and generates the user’s partial private key DID.CL-SVS. The secret value setup algorithm is performed by the Internet users in CLC environment. Taking as inputs a user’s identity ID, the algorithm outputs the user’s secret value xID.CL-PKG. The main public key generation algorithm is executed by the users in the context of CLC, which takes as input the secret value xID, and outputs the user’s main public key PKID.IB-PKE. The public key extraction algorithm is performed by the PKG in IBC circumstance. Taking as inputs a PKG’s master secret key sj and the user’s identity ID, the algorithm outputs the user’s public key QID.IB-KE. The key extraction algorithm is performed by the PKG in IBC environment. Taking as inputs a PKG’s master secret key sj and the user’s identity ID, the algorithm outputs the user’s private key DID.SC. The signcryption algorithm is performed by an Internet user under the circumstance of CLC. Taking as inputs the plaintext message m, sender’s partial private key DIDs, sender’s secret value xIDs, sender’s identity IDs, and the receiver’s identity IDr, the algorithm outputs the ciphertext σ.USC. The unsigncryption algorithm is performed by the receiver in IBC environment. Taking as inputs the ciphertext σ, the sender’s identity IDs and the main public key PKIDs, sender’s partial public key QIDs, and the receiver’s private key DIDr and identity IDr, the algorithm outputs the plaintext m if σ is a valid ciphertext. Otherwise the output is the symbol ⊥.Note that the ciphertextσ should meet the need of the public verifiability with confidentiality. That is to say, ciphertext verification process of the unsigncryption algorithm can be performed by any verifier (generally the WSN gateway) without the knowledge of the plaintext message m.


### 3.2. Security Model

The standard security notion for a CDHSC scheme is confidentiality and unforgeability. In the following definitions, Definition3 describes the confidentiality and the unforgeability is depicted in Definition 5.Definition 3 (confidentiality).
A CDHSC scheme is semantically secure against adaptive chosen ciphertext attacks property (IND-CDHSC-CCA2) if no probabilistic polynomially time adversaryA has a nonnegligible advantage in the following Game 1.Game 4.
Initial. The challenger C runs Setup algorithm with a parameter k, then he returns the system parameters to A.
Phase 1. A executes a polynomially bounded number of queries.
Partial Public Key Extraction (PPUKE) Queries. A chooses an identity ID and forwards it to C. Then C executes CL-PPUKE algorithm and forwards the corresponding partial public key QID to A.
Public Key (PK) Queries. On a new public key query for identity ID, C executes CL-SVS and CL-PKG algorithm to compute the user’s secret value xID and main public key PKID then adds (ID,xID,PKID) to the list Lk. Finally, C returns PKID to A.
Public Key Replacement (PKR) Queries. A can replace a main public key PKID with a value selected by himself.
Corruption Query. On a corruption query, C checks the list Lk and returns the secret value xID.
Partial Private Key Extraction (PPKE) Queries. A chooses an identity ID and forwards it to C. Then C executes CL-PPKE algorithm and forwards the corresponding partial private key DID to A.
Public Key Extraction (PKE) Queries. When receiving an identity ID from A, C executes IB-PKE algorithm and forwards the corresponding public key QID to A.
Key Extraction (KE) Queries. When receiving an identity ID from A, C executes IB-KE algorithm and forwards the corresponding private key DID to A.
Signcryption Queries. A submits a plaintext m, a sender’s identity IDi, and a receiver’s identity IDj. Firstly, C performsCorruption query and PPKE query with IDi to obtain xIDi and DIDi, performs PKE query with IDj to obtain QIDj, and then executes SC algorithm to get the signcryption σ=SC(m,xIDi,DIDi,IDi,QIDj). If the sender’s public key PKIDi has been replaced, the sender’s secret value xIDi is provided by A. Finally C returns ciphertext σ to A.
Unsigncryption Queries. A submits a signcryption σ, a sender’s identity IDi, and a receiver’s identity IDj. Firstly, C performs PPUKE query and PK query with IDi to obtain QIDi and PKIDi, performs KE query with IDj to obtain DIDj, and then executes USC algorithm to check the validity of ciphertext σ. If the ciphertext is valid, C sends plaintext m=USC(σ,PKIDi,QIDi,DIDj,IDj) to A; otherwise it outputs character ⊥.
Challenge. After Phase 1, A outputs two plaintexts (m0,m1) which are of the same length, a sender’s identity IDs and a receiver’s identity IDr on which he wants to be challenged. Note that IDr cannot be the identity that has been used for KE query in Phase 1. C randomly takes a bit of β∈0,1 and calculates σ∗=SC(mβ,xIDs,DIDs,IDs,QIDr) and forwards it to A.
Phase 2. A can make a polynomially bounded number of queries just like in Phase 1, whereas, it cannot make a KE query on IDr and cannot perform anUnsigncryption query on ciphertext σ∗ under IDs and IDr to obtain the plaintext m unless the sender’s public key PKIDs is replaced after the challenge phase.
Guess. A outputs a bit of β′∈0,1. If β′=β, he wins the game.We define the advantage ofA to be Adv(A)=2Prβ′=β-1.For unforgeability, there are two types of adversaries namedAI and AII since the signcryption is generated in the CLC environment. Type I adversary AI does not know the KGC’s master key, but he is able to replace public keys of arbitrary identities with other public keys of his choice. In contrast, Type II adversary possesses the KGC’s master secret key, while he cannot replace public key of any user during the game.Definition 5 (unforgeability).
A CDHSC scheme is existentially unforgeable against an adaptive chosen-message attacker (EUF-CDHSC-CMA) if no probabilistic polynomially time adversaryAi(i=I,II) has a nonnegligible advantage in the following Game 2.Game 6.
Initial. The challenger C runs theSetup algorithm defined in generic model and gives the resulting system parameters to the adversary Ai. For Type II adversary, C sends him the master secret keys of PKG and KGC in addition to the system parameters.
Probing. The challenger is probed by the adversary Ai who executes a polynomially bounded number of queries just like Phase 1 of the confidentiality game. Note that AII does not need to perform PKR, PPKE, and KE queries.
Forge. The adversary Ai returns a ciphertext σ∗, a sender’s identity IDs, and a receiver’s identity IDr. Let the tuple (m∗,IDs,σ∗) be the result of unsigncrypt algorithm under the private key corresponding to IDr. Ai wins the game if the tuple (m∗,IDs,σ∗) satisfies the following requirements: (1)
This ciphertext is a valid one, when the result of unsigncrypt algorithm is not character⊥ but m∗.(2)
Ai has never asked the secret value of the user with identity IDs.(3)
Ai has never asked theSigncryption query on (m∗,IDs,IDr).


### 3.3. CDHSC Scheme

In this section, we propose a CDHSC scheme based on bilinear pairings. We follow the generic model of a general CDHSC scheme that we presented in Section3.1, and we add KSSTIS property to it. The scheme is described below.Setup. Given a parameter k0, the KGC chooses an additive group G1-0 and a multiplicative group G2-0 which have the same prime order q0, a generator P0 of G1-0, a bilinear map e^0:G1-0×G1-0→G2-0, and three hash functions H1-0:{0,1}∗→Zq0∗, H2-0:G1-0×G2-0×{0,1}∗→{0,1}n, and H3-0:{0,1}n×G1-02×{0,1}∗→Zq0∗. Similarly, given a security parameter k1, the PKG chooses an additive group G1-1 and a multiplicative group G2-1 which have the same prime order q1, a generator P1 of G1-1, a bilinear map e^1:G1-1×G1-1→G2-1, and one hash function H1-1:{0,1}∗→Zq1∗. The KGC randomly chooses a master secret key s0∈Zq0∗ and calculates the master public key Ppub0=s0P0. Then KGC outputs the system parameters {G1-0,G2-0,q0,e^,n,P0,Ppub0,H1-0,H2-0,H3-0} and keeps s0 secret. Similarly, the PKG outputs the system parameters {G1-1,G2-1,q1,e^1,P1,Ppub1=s1P1,H1-1} and keeps s1 secret.CL-PPUKE. This algorithm accepts an identity IDA of an Internet user and generates the partial public key QA=(a+s0)P0 for the user, where a=H1-0(IDA). Then the KGC runs the CL-PPKE algorithm.CL-PPKE. After executing the CL-PPUKE algorithm, the KGC calculates the partial private key DA=(a+s0)-1P0 for the user. Finally, the KGC sends (QA,DA) securely to the user.CL-SVS. This algorithm accepts an identity IDA of an Internet user and randomly chooses a secret value xA∈Zq0∗ for the user. Then the user runs the CL-PKG algorithm.CL-PKG. After executing the CL-SVS algorithm, the user calculates his public key PKA=xAQA.IB-PKE. This algorithm accepts an identity IDB of a WSN node and generates the public key QB=(b+s1)P1 for the node, where b=H1-1(IDB). Then the PKG runs the IB-KE algorithm.IB-KE. After executing the IB-PKE algorithm, the PKG calculates the private key DB=(b+s1)-1P1 for the node. Finally, the PKG sends (QB,DB) securely to the WSN node.SC. To signcrypt a message m using the partial private key DA, secret value xA, and the receiver’s identity IDB, a sender with identity IDA performs the following steps:(1)
Selectingr∈Zq0∗ randomly.(2)
CalculatingU=(r+xA)QB and T=e^(P1,P1)r+xA.(3)
CalculatingZ=H2-0(U,T,IDB).(4)
CalculatingC=m⊕Z.(5)
Calculatingt=H3-0(C,U,PKA, IDA).(6)
CalculatingV=tDA+xAU.(7)
Outputting the ciphertextσ=(C,U,V).USC. To unsigncrypt the ciphertext σ=(C,U,V) using the private key DB, sender’s partial public key QA, and the main public key PKA, the receiver with identity IDB performs the following steps:(1)
Calculatingt=H3-0(C,U,PKA,IDA).(2)
Checking ife^(V,QA)=e^(P0,P0)te^(PKA,U) holds. If the equation holds, the receiver executes the following step. Otherwise, he rejects this ciphertext and outputs the symbol ⊥.(3)
CalculatingT=e^(U,DB).(4)
CalculatingZ=H2-0(U,T,IDB).(5)
Recovering the messagem=C⊕Z.Note that any user can verify the ciphertextσ=(C,U,V) by computing t=H3-0(C,U,PKA,IDA) and verifying whether e^(V,QA)=e^(P0,P0)te^(PKA,U), where nothing about the plaintext message m will be lost. Thus, we can shift the computational cost of signcryption verification to the WSN gateway (he just needs to obtain the public parameters and the ciphertext σ) in the cross-domain context of the IoT.


### 3.4. Correctness

The consistency of the CDHSC scheme is easy to verify.(1)
In the signcryption verification stage,(1)e^V,QA=e^tDA+xAU,QA=e^tDA,QAe^xAU,QA=e^ta+s0-1P0,a+s0P0e^U,xAQA=e^P0,P0te^PKA,U.(2)
In the signcryption decryption stage,(2)T=e^U,DB=e^r+xAb+s1P1,b+s1-1P1=e^P1,P1r+xA.


### 3.5. Security Proof

In this section, we use some mathematical difficult problems to prove the confidentiality and unforgeability of the CDHSC scheme in the random oracle model. In addition, we demonstrate that our scheme satisfies the known session-specific temporary information security (KSSTIS). In our scheme, the generation algorithms of public keyQB and private key DB for the node IDB in the IBC environment are the same as the generation algorithms of partial public key QA and partial private key DA for the user IDA in the CLC environment, so the KGC can act as the roles of KGC and PKG simultaneously in a small wireless sensor networks in a single domain context of the IoT. Moreover, in the following security proofs of our proposed scheme, for reasons of proof brevity, we assume that the KGC plays the roles of the KGC and PKG at the same time in a single domain.(1) ConfidentialityTheorem 7.
Our CDHSC scheme is indistinguishable against any IND-CDHSC-CCA2 adversaryA in the random oracle model assuming that the BIDH problem in G2 is intractable.Proof.
LetC be a BIDH problem attacker. Then A is an adversary who interacts with C following Game 1. C is given (P,aP,bP) as an input to the BIDH problem and aims to compute e^(P,P)ab-1, where a,b∈Zq∗ and P∈G1.
Initial. C sets Ppub=sP. The value s is the master key of the KGC, which is unknown to C, and C gives system parameters to A.
Phase 1. We show that C can use A to solve the BIDH problem. C needs to maintain three lists L1, L2, and L3 that are initially empty and are used to keep track of answers to queries asked by A to oracles H1, H2, and H3, respectively. What is more, C maintains two lists: Lk and Lp of the queries made by A to oracles PK and PPUKE (or PKE), respectively. Subsequently, C simulates the challenger and plays the game described in Definition 3 with the adversary A as follows.
Partial Public Key Extraction (PPUKE) or Public Key Extraction (PKE) Queries. Suppose that A makes at most qp queries to this oracle. First, C chooses γ∈{1,2,…,qp} randomly. When A makes this query on IDi(i∈{1,2,…,qp}), if i=γ (we let IDi=IDγ at this point), C returns QIDγ=bP and adds (IDγ,QIDγ=bP,DIDγ=b-1P,⊥) to Lp (C cannot compute DIDγ=b-1P; he just considers DIDγ to be b-1P). Otherwise C picks a random wi∈Zq∗, returns QIDi=wiP, and adds (IDi,QIDi=wiP,DIDi=wi-1P,wi) to Lp.
H 1 Queries. When A makes this query on IDi, C forwards ei to A if L1 has the entry (IDi,ei). If the list L1 does not contain (IDi,ei), C randomly picks ei∈Zq∗, returns ei, and adds (IDi,ei) to L1.
H 2 Queries. When A makes H2 query on (Ui,Ti,IDi), if the list L2 has the entry (Ui,Ti,IDi,Zi), C answers Zi to A. Otherwise, C randomly picks Zi∈{0,1}n as the output and inserts (Ui,Ti,IDi,Zi) into the list L2.
H 3 Queries. For H3 query on (Ci,Ui,PKIDi,IDi), if the list L3 has the entry (Ci,Ui,PKIDi,IDi,ti), C answers ti to A. Otherwise, C randomly picks ti∈Zq∗ as the output and inserts (Ci,Ui,PKIDi,IDi,ti) into the list L3.
Partial Private Key Extraction (PPKE) or Key Extraction (KE) Queries. When A makes this query on IDi, if IDi=IDγ, C aborts the simulation and returns ⊥. Otherwise, the list Lp should have the entry (IDi,QIDi=wiP,DIDi=wi-1P,wi). C returns DIDi to A.
Public Key (PK) Queries. When A makes this query on IDi, if the list Lk has the entry (IDi,PKIDi,xIDi), then C answers PKIDi to A. Otherwise, C selects xIDi∈Zq∗ randomly, computes PKIDi=xIDiQIDi, and then returns PKIDi and adds (IDi,PKIDi,xIDi) to Lk.
Corruption Queries. We assume that C has made PK query on IDi before this query. The list Lk should have the entry (IDi,PKIDi,xIDi). C returns xIDi to A.
Public Key Replacement (PKR) Queries. A can replace the main public key PKIDi of user IDi with a value he selects. When A executes apublic key replacement query with the entry (IDi,PKIDi′), C updates the list Lk with entry (IDi, PKIDi′,⊥).
Signcryption Queries. When A asks for a Signcryption query on a message m with a sender’s identity IDi and a receiver’s identity IDj, if IDi=IDγ, C aborts the simulation and returns ⊥. Otherwise, C first executesCorruption query and PPKE query with IDi to obtain xIDi and DIDi, performs PPUKE query with IDj to obtain QIDj, and then executes SC(m,xIDi,DIDi,IDi,QIDj) algorithm to return the signcryption σ=(C,U,V). If the sender’s public key PKIDi has been replaced, the sender’s secret value xIDi is provided by A. Finally C returns ciphertext σ back to A.
Unsigncryption Queries. When A asks for this query on a signcryption σ=(C,U,V) with a sender’s identity IDi and a receiver’s identity IDj, if IDj=IDγ, C aborts the simulation and returns ⊥. Otherwise, C computes t=H3-0(C,U,PKIDi,IDi) and checks if e^(V,QIDi)=e^(P0,P0)te^(PKIDi,U) holds. If not, C aborts the simulation and returns ⊥. Otherwise, C executes the KE query to get DIDj and calculates T=e^(U,DIDj). Then C executes H2 query to obtain Z=H2(U,T,IDj) and finally calculates and returns m=C⊕Z.
Challenge. A outputs two plaintexts (m0,m1) which have the same length and picks a sender’s identity IDs and a receiver’s identity IDr on which he wishes to be challenged. Note that C fails if A has asked a KE query on IDr during the first stage. If IDr≠IDγ, C aborts the simulation and returns ⊥. Otherwise C selects a random number β∈{0,1} and generates the challenge ciphertext σ∗=(C∗,U∗,V∗) as follows. At first, C chooses the value V∗∈G1. Then he sets U∗=aP and computes Z∗=H2(U∗,μ∗,IDγ) and C∗=mβ⊕Z∗, in which μ∗=e^(U∗,Dγ)=e^(aP,b-1P)=e^(P,P)ab-1 (μ∗ is the candidate answer for the BIDH problem). Finally C forwards the ciphertext σ∗=(C∗,U∗,V∗) to A.
Phase 2. A then performs a second series of queries, and C can handle these queries as in the first stage. Whereas, it cannot make a KE query on IDr and cannot perform anUnsigncryption query on ciphertext σ∗ under IDs and IDr to obtain the plaintext unless the sender’s public key PKIDs is replaced after thechallenge phase.
Guess. A produces a bit of β′. If β′=β, C then answers 1 as the result to the BIDH problem since he has generated a valid signcrypted message of mβ using the knowledge of μ∗. Otherwise, C answers 0.
So, the adversaryA can defeat the signcryption by means of analyzing the ciphertext, and at the same time he can solve the BIDH problem with nonnegligible advantage. But we all know that there is no algorithm that can be used to work out the BIDH problem in the probabilistic polynomial time; hence our scheme has the indistinguishability against adaptive chosen ciphertext attack.(2) UnforgeabilityTheorem 8.
Our CDHSC scheme is existentially unforgeable against any EUF-CDHSC-CMA adversaryAi(i=I,II) in the random oracle model assuming that the CDH problem in G1 is intractable.Proof.
LetC be an CDH problem attacker. Then Ai is the adversary who interacts with C following Game 2. C is given (P,aP,bP) as an input to the CDH problem and aims to compute abP, where a,b∈Zq∗ and P∈G1.
Initial. The challenger C runs theSetup algorithm defined in generic model and gives the resulting system parameters to the adversary Ai. For the Type II adversary, C sends him the master secret keys of KGC in addition to the system parameters.
Probing. We show that C can use Ai to solve the CDH problem. C needs to maintain three lists L1, L2, and L3 that are initially empty and are used to keep track of answers to queries asked by Ai to oracles H1, H2, and H3, respectively. What is more, C maintains two lists: Lk and Lp of the queries made by Ai to oracles PK and PPUKE (or PKE), respectively. Subsequently, C simulates the challenger and plays the game described in Definition 5 with the adversary Ai. The Ai performs a polynomially bounded number of the following queries, and AII does not need to perform PKR, PPKE, and KE queries.
Partial Public Key Extraction (PPUKE) or Public Key Extraction (PKE) Queries. When Ai makes this query on IDi, if the list Lp has the entry (IDi,QIDi=wiP,DIDi=wi-1P,wi), then C answers QIDi to Ai. Otherwise, C selects wi∈Zq∗ randomly, computes QIDi=wiP and DIDi=wi-1P, then returns QIDi, and adds (IDi,QIDi=wiP,DIDi=wi-1P,wi) to Lp.
Partial Private Key Extraction (PPKE) or Key Extraction (KE) Queries. We assume that C has made PPUKE (or PKE) query on IDi before this query. The list Lp should have the entry (IDi,QIDi=wiP,DIDi=wi-1P,wi). C returns DIDi to A.
Public Key (PK) Queries. We assume that Ai makes at most qk queries to this oracle and C has made PPUKE (or PKE) query on IDi before this query. First, C chooses γ∈{1,2,…,qk} randomly. When Ai makes this query on IDi(i∈{1,2,…,qk}), if i=γ (we let IDi=IDγ at this point), C returns PKIDγ=wγbP and adds (IDγ,PKIDγ,⊥) to Lk. Otherwise C selects xIDi∈Zq∗ randomly, computes PKIDi=xIDiQIDi, then returns PKIDi, and adds (IDi,PKIDi,xIDi) to Lk.
Corruption Queries. When Ai makes this query on IDi, if IDi=IDγ, C aborts the simulation and returns ⊥. Otherwise, the list Lk should have the entry (IDi,PKIDi,xIDi). C returns xIDi to Ai.
H 1 , H 2 , H 3 , PKR, and Signcryption Queries. This proof is the same as the proof of Theorem 7.
Unsigncryption Queries. When A asks for this query on a signcryption σ=(C,U,V) with a senders identity IDi and a receivers identity IDj, C computes t=H3-0(C,U,PKIDi,IDi) and checks if e^(V,QIDi)=e^(P0,P0)te^(PKIDi,U) holds. If not, C aborts the simulation and returns ⊥. Otherwise, C executes the KE query to get DIDj and calculates T=e^(U,DIDj). Then C executes H2 query to obtain Z=H2(U,T,IDj) and finally calculates and returns m=c⊕Z.
Forgery. Ai outputs a ciphertext σ∗=(C∗,U∗=aP,V∗) and picks a sender’s identity IDs and a receiver’s identity IDr on which he wishes to be challenged. If IDs≠IDγ, C aborts the simulation and returns ⊥. Otherwise, he runs the H3 simulation algorithm to obtain t∗=H3(C∗,U∗,PKIDγ,IDγ); we can have V∗=t∗DIDγ+ω and ω=V∗-t∗DIDγ (ω is a candidate for the CDH problem). Finally, C checks if e^(V∗,QIDγ)=e^(P0,P0)t∗e^(PKIDγ,U∗), if the condition is not satisfied, C fails and outputs 0; otherwise, C answers 1.
So, the adversaryAi can forge a valid signcryption by means of analyzing ciphertext, and he can solve the CDH problem with nonnegligible advantage at the same time. But we all know that there is no algorithm that can be used to work out the CDH problem in the probabilistic polynomial time; hence our scheme is existentially unforgeable against adaptive chosen-message attacker Ai.(3) Known Session-Specific Temporary Information Security (KSSTIS). Assume that at the ith communication, session-specific temporary key r and signcryption σ=(C,U,V) are leaked. In our CDHSC scheme, the encryption key is Z=H2(U,T,IDB). An external adversary can get U through the ciphertext σ and the identity IDB of the receiver, but he cannot acquire the secret value xA of the sender or the private key DB of the receiver. So, the external adversary is hard to obtain the plaintext m since he cannot compute T=e^(P2,P2)r+xA=e^(U,DB). Hence, our scheme can achieve the KSSTIS attribute. But in NACS [21], when the external adversary obtains the temporary key r of ith communication, he can compute T=e^(Ppub,QIDr)r easily, and it is easy for the adversary to obtain the message m=C⊕H2(U,T,IDr) with the ciphertext σ=(U,C,V).


## 3.1. Generic Model

Our CDHSC scheme consists of nine algorithms as follows.Setup. The trusted third party PKG and KGC execute this probabilistic algorithm to produce a series of system parameters. Firstly they input a security parameter ki then output their master secret key si and corresponding system parameters. Different PKG and KGC use different ki and output different si.CL-PPUKE. The partial public key extraction algorithm is executed by the KGC in CLC environment, which takes as input a KGC’s master secret key si and an Internet user’s identity ID, and outputs the user’s partial public key QID.CL-PPKE. The partial private key extraction algorithm is executed by the KGC in CLC environment, which takes as input a KGC’s master secret key si and an Internet user’s identity ID, and generates the user’s partial private key DID.CL-SVS. The secret value setup algorithm is performed by the Internet users in CLC environment. Taking as inputs a user’s identity ID, the algorithm outputs the user’s secret value xID.CL-PKG. The main public key generation algorithm is executed by the users in the context of CLC, which takes as input the secret value xID, and outputs the user’s main public key PKID.IB-PKE. The public key extraction algorithm is performed by the PKG in IBC circumstance. Taking as inputs a PKG’s master secret key sj and the user’s identity ID, the algorithm outputs the user’s public key QID.IB-KE. The key extraction algorithm is performed by the PKG in IBC environment. Taking as inputs a PKG’s master secret key sj and the user’s identity ID, the algorithm outputs the user’s private key DID.SC. The signcryption algorithm is performed by an Internet user under the circumstance of CLC. Taking as inputs the plaintext message m, sender’s partial private key DIDs, sender’s secret value xIDs, sender’s identity IDs, and the receiver’s identity IDr, the algorithm outputs the ciphertext σ.USC. The unsigncryption algorithm is performed by the receiver in IBC environment. Taking as inputs the ciphertext σ, the sender’s identity IDs and the main public key PKIDs, sender’s partial public key QIDs, and the receiver’s private key DIDr and identity IDr, the algorithm outputs the plaintext m if σ is a valid ciphertext. Otherwise the output is the symbol ⊥.Note that the ciphertextσ should meet the need of the public verifiability with confidentiality. That is to say, ciphertext verification process of the unsigncryption algorithm can be performed by any verifier (generally the WSN gateway) without the knowledge of the plaintext message m.


## 3.2. Security Model

The standard security notion for a CDHSC scheme is confidentiality and unforgeability. In the following definitions, Definition3 describes the confidentiality and the unforgeability is depicted in Definition 5.Definition 3 (confidentiality).
A CDHSC scheme is semantically secure against adaptive chosen ciphertext attacks property (IND-CDHSC-CCA2) if no probabilistic polynomially time adversaryA has a nonnegligible advantage in the following Game 1.Game 4.
Initial. The challenger C runs Setup algorithm with a parameter k, then he returns the system parameters to A.
Phase 1. A executes a polynomially bounded number of queries.
Partial Public Key Extraction (PPUKE) Queries. A chooses an identity ID and forwards it to C. Then C executes CL-PPUKE algorithm and forwards the corresponding partial public key QID to A.
Public Key (PK) Queries. On a new public key query for identity ID, C executes CL-SVS and CL-PKG algorithm to compute the user’s secret value xID and main public key PKID then adds (ID,xID,PKID) to the list Lk. Finally, C returns PKID to A.
Public Key Replacement (PKR) Queries. A can replace a main public key PKID with a value selected by himself.
Corruption Query. On a corruption query, C checks the list Lk and returns the secret value xID.
Partial Private Key Extraction (PPKE) Queries. A chooses an identity ID and forwards it to C. Then C executes CL-PPKE algorithm and forwards the corresponding partial private key DID to A.
Public Key Extraction (PKE) Queries. When receiving an identity ID from A, C executes IB-PKE algorithm and forwards the corresponding public key QID to A.
Key Extraction (KE) Queries. When receiving an identity ID from A, C executes IB-KE algorithm and forwards the corresponding private key DID to A.
Signcryption Queries. A submits a plaintext m, a sender’s identity IDi, and a receiver’s identity IDj. Firstly, C performsCorruption query and PPKE query with IDi to obtain xIDi and DIDi, performs PKE query with IDj to obtain QIDj, and then executes SC algorithm to get the signcryption σ=SC(m,xIDi,DIDi,IDi,QIDj). If the sender’s public key PKIDi has been replaced, the sender’s secret value xIDi is provided by A. Finally C returns ciphertext σ to A.
Unsigncryption Queries. A submits a signcryption σ, a sender’s identity IDi, and a receiver’s identity IDj. Firstly, C performs PPUKE query and PK query with IDi to obtain QIDi and PKIDi, performs KE query with IDj to obtain DIDj, and then executes USC algorithm to check the validity of ciphertext σ. If the ciphertext is valid, C sends plaintext m=USC(σ,PKIDi,QIDi,DIDj,IDj) to A; otherwise it outputs character ⊥.
Challenge. After Phase 1, A outputs two plaintexts (m0,m1) which are of the same length, a sender’s identity IDs and a receiver’s identity IDr on which he wants to be challenged. Note that IDr cannot be the identity that has been used for KE query in Phase 1. C randomly takes a bit of β∈0,1 and calculates σ∗=SC(mβ,xIDs,DIDs,IDs,QIDr) and forwards it to A.
Phase 2. A can make a polynomially bounded number of queries just like in Phase 1, whereas, it cannot make a KE query on IDr and cannot perform anUnsigncryption query on ciphertext σ∗ under IDs and IDr to obtain the plaintext m unless the sender’s public key PKIDs is replaced after the challenge phase.
Guess. A outputs a bit of β′∈0,1. If β′=β, he wins the game.We define the advantage ofA to be Adv(A)=2Prβ′=β-1.For unforgeability, there are two types of adversaries namedAI and AII since the signcryption is generated in the CLC environment. Type I adversary AI does not know the KGC’s master key, but he is able to replace public keys of arbitrary identities with other public keys of his choice. In contrast, Type II adversary possesses the KGC’s master secret key, while he cannot replace public key of any user during the game.Definition 5 (unforgeability).
A CDHSC scheme is existentially unforgeable against an adaptive chosen-message attacker (EUF-CDHSC-CMA) if no probabilistic polynomially time adversaryAi(i=I,II) has a nonnegligible advantage in the following Game 2.Game 6.
Initial. The challenger C runs theSetup algorithm defined in generic model and gives the resulting system parameters to the adversary Ai. For Type II adversary, C sends him the master secret keys of PKG and KGC in addition to the system parameters.
Probing. The challenger is probed by the adversary Ai who executes a polynomially bounded number of queries just like Phase 1 of the confidentiality game. Note that AII does not need to perform PKR, PPKE, and KE queries.
Forge. The adversary Ai returns a ciphertext σ∗, a sender’s identity IDs, and a receiver’s identity IDr. Let the tuple (m∗,IDs,σ∗) be the result of unsigncrypt algorithm under the private key corresponding to IDr. Ai wins the game if the tuple (m∗,IDs,σ∗) satisfies the following requirements: (1)
This ciphertext is a valid one, when the result of unsigncrypt algorithm is not character⊥ but m∗.(2)
Ai has never asked the secret value of the user with identity IDs.(3)
Ai has never asked theSigncryption query on (m∗,IDs,IDr).


## 3.3. CDHSC Scheme

In this section, we propose a CDHSC scheme based on bilinear pairings. We follow the generic model of a general CDHSC scheme that we presented in Section3.1, and we add KSSTIS property to it. The scheme is described below.Setup. Given a parameter k0, the KGC chooses an additive group G1-0 and a multiplicative group G2-0 which have the same prime order q0, a generator P0 of G1-0, a bilinear map e^0:G1-0×G1-0→G2-0, and three hash functions H1-0:{0,1}∗→Zq0∗, H2-0:G1-0×G2-0×{0,1}∗→{0,1}n, and H3-0:{0,1}n×G1-02×{0,1}∗→Zq0∗. Similarly, given a security parameter k1, the PKG chooses an additive group G1-1 and a multiplicative group G2-1 which have the same prime order q1, a generator P1 of G1-1, a bilinear map e^1:G1-1×G1-1→G2-1, and one hash function H1-1:{0,1}∗→Zq1∗. The KGC randomly chooses a master secret key s0∈Zq0∗ and calculates the master public key Ppub0=s0P0. Then KGC outputs the system parameters {G1-0,G2-0,q0,e^,n,P0,Ppub0,H1-0,H2-0,H3-0} and keeps s0 secret. Similarly, the PKG outputs the system parameters {G1-1,G2-1,q1,e^1,P1,Ppub1=s1P1,H1-1} and keeps s1 secret.CL-PPUKE. This algorithm accepts an identity IDA of an Internet user and generates the partial public key QA=(a+s0)P0 for the user, where a=H1-0(IDA). Then the KGC runs the CL-PPKE algorithm.CL-PPKE. After executing the CL-PPUKE algorithm, the KGC calculates the partial private key DA=(a+s0)-1P0 for the user. Finally, the KGC sends (QA,DA) securely to the user.CL-SVS. This algorithm accepts an identity IDA of an Internet user and randomly chooses a secret value xA∈Zq0∗ for the user. Then the user runs the CL-PKG algorithm.CL-PKG. After executing the CL-SVS algorithm, the user calculates his public key PKA=xAQA.IB-PKE. This algorithm accepts an identity IDB of a WSN node and generates the public key QB=(b+s1)P1 for the node, where b=H1-1(IDB). Then the PKG runs the IB-KE algorithm.IB-KE. After executing the IB-PKE algorithm, the PKG calculates the private key DB=(b+s1)-1P1 for the node. Finally, the PKG sends (QB,DB) securely to the WSN node.SC. To signcrypt a message m using the partial private key DA, secret value xA, and the receiver’s identity IDB, a sender with identity IDA performs the following steps:(1)
Selectingr∈Zq0∗ randomly.(2)
CalculatingU=(r+xA)QB and T=e^(P1,P1)r+xA.(3)
CalculatingZ=H2-0(U,T,IDB).(4)
CalculatingC=m⊕Z.(5)
Calculatingt=H3-0(C,U,PKA, IDA).(6)
CalculatingV=tDA+xAU.(7)
Outputting the ciphertextσ=(C,U,V).USC. To unsigncrypt the ciphertext σ=(C,U,V) using the private key DB, sender’s partial public key QA, and the main public key PKA, the receiver with identity IDB performs the following steps:(1)
Calculatingt=H3-0(C,U,PKA,IDA).(2)
Checking ife^(V,QA)=e^(P0,P0)te^(PKA,U) holds. If the equation holds, the receiver executes the following step. Otherwise, he rejects this ciphertext and outputs the symbol ⊥.(3)
CalculatingT=e^(U,DB).(4)
CalculatingZ=H2-0(U,T,IDB).(5)
Recovering the messagem=C⊕Z.Note that any user can verify the ciphertextσ=(C,U,V) by computing t=H3-0(C,U,PKA,IDA) and verifying whether e^(V,QA)=e^(P0,P0)te^(PKA,U), where nothing about the plaintext message m will be lost. Thus, we can shift the computational cost of signcryption verification to the WSN gateway (he just needs to obtain the public parameters and the ciphertext σ) in the cross-domain context of the IoT.


## 3.4. Correctness

The consistency of the CDHSC scheme is easy to verify.(1)
In the signcryption verification stage,(1)e^V,QA=e^tDA+xAU,QA=e^tDA,QAe^xAU,QA=e^ta+s0-1P0,a+s0P0e^U,xAQA=e^P0,P0te^PKA,U.(2)
In the signcryption decryption stage,(2)T=e^U,DB=e^r+xAb+s1P1,b+s1-1P1=e^P1,P1r+xA.


## 3.5. Security Proof

In this section, we use some mathematical difficult problems to prove the confidentiality and unforgeability of the CDHSC scheme in the random oracle model. In addition, we demonstrate that our scheme satisfies the known session-specific temporary information security (KSSTIS). In our scheme, the generation algorithms of public keyQB and private key DB for the node IDB in the IBC environment are the same as the generation algorithms of partial public key QA and partial private key DA for the user IDA in the CLC environment, so the KGC can act as the roles of KGC and PKG simultaneously in a small wireless sensor networks in a single domain context of the IoT. Moreover, in the following security proofs of our proposed scheme, for reasons of proof brevity, we assume that the KGC plays the roles of the KGC and PKG at the same time in a single domain.(1) ConfidentialityTheorem 7.
Our CDHSC scheme is indistinguishable against any IND-CDHSC-CCA2 adversaryA in the random oracle model assuming that the BIDH problem in G2 is intractable.Proof.
LetC be a BIDH problem attacker. Then A is an adversary who interacts with C following Game 1. C is given (P,aP,bP) as an input to the BIDH problem and aims to compute e^(P,P)ab-1, where a,b∈Zq∗ and P∈G1.
Initial. C sets Ppub=sP. The value s is the master key of the KGC, which is unknown to C, and C gives system parameters to A.
Phase 1. We show that C can use A to solve the BIDH problem. C needs to maintain three lists L1, L2, and L3 that are initially empty and are used to keep track of answers to queries asked by A to oracles H1, H2, and H3, respectively. What is more, C maintains two lists: Lk and Lp of the queries made by A to oracles PK and PPUKE (or PKE), respectively. Subsequently, C simulates the challenger and plays the game described in Definition 3 with the adversary A as follows.
Partial Public Key Extraction (PPUKE) or Public Key Extraction (PKE) Queries. Suppose that A makes at most qp queries to this oracle. First, C chooses γ∈{1,2,…,qp} randomly. When A makes this query on IDi(i∈{1,2,…,qp}), if i=γ (we let IDi=IDγ at this point), C returns QIDγ=bP and adds (IDγ,QIDγ=bP,DIDγ=b-1P,⊥) to Lp (C cannot compute DIDγ=b-1P; he just considers DIDγ to be b-1P). Otherwise C picks a random wi∈Zq∗, returns QIDi=wiP, and adds (IDi,QIDi=wiP,DIDi=wi-1P,wi) to Lp.
H 1 Queries. When A makes this query on IDi, C forwards ei to A if L1 has the entry (IDi,ei). If the list L1 does not contain (IDi,ei), C randomly picks ei∈Zq∗, returns ei, and adds (IDi,ei) to L1.
H 2 Queries. When A makes H2 query on (Ui,Ti,IDi), if the list L2 has the entry (Ui,Ti,IDi,Zi), C answers Zi to A. Otherwise, C randomly picks Zi∈{0,1}n as the output and inserts (Ui,Ti,IDi,Zi) into the list L2.
H 3 Queries. For H3 query on (Ci,Ui,PKIDi,IDi), if the list L3 has the entry (Ci,Ui,PKIDi,IDi,ti), C answers ti to A. Otherwise, C randomly picks ti∈Zq∗ as the output and inserts (Ci,Ui,PKIDi,IDi,ti) into the list L3.
Partial Private Key Extraction (PPKE) or Key Extraction (KE) Queries. When A makes this query on IDi, if IDi=IDγ, C aborts the simulation and returns ⊥. Otherwise, the list Lp should have the entry (IDi,QIDi=wiP,DIDi=wi-1P,wi). C returns DIDi to A.
Public Key (PK) Queries. When A makes this query on IDi, if the list Lk has the entry (IDi,PKIDi,xIDi), then C answers PKIDi to A. Otherwise, C selects xIDi∈Zq∗ randomly, computes PKIDi=xIDiQIDi, and then returns PKIDi and adds (IDi,PKIDi,xIDi) to Lk.
Corruption Queries. We assume that C has made PK query on IDi before this query. The list Lk should have the entry (IDi,PKIDi,xIDi). C returns xIDi to A.
Public Key Replacement (PKR) Queries. A can replace the main public key PKIDi of user IDi with a value he selects. When A executes apublic key replacement query with the entry (IDi,PKIDi′), C updates the list Lk with entry (IDi, PKIDi′,⊥).
Signcryption Queries. When A asks for a Signcryption query on a message m with a sender’s identity IDi and a receiver’s identity IDj, if IDi=IDγ, C aborts the simulation and returns ⊥. Otherwise, C first executesCorruption query and PPKE query with IDi to obtain xIDi and DIDi, performs PPUKE query with IDj to obtain QIDj, and then executes SC(m,xIDi,DIDi,IDi,QIDj) algorithm to return the signcryption σ=(C,U,V). If the sender’s public key PKIDi has been replaced, the sender’s secret value xIDi is provided by A. Finally C returns ciphertext σ back to A.
Unsigncryption Queries. When A asks for this query on a signcryption σ=(C,U,V) with a sender’s identity IDi and a receiver’s identity IDj, if IDj=IDγ, C aborts the simulation and returns ⊥. Otherwise, C computes t=H3-0(C,U,PKIDi,IDi) and checks if e^(V,QIDi)=e^(P0,P0)te^(PKIDi,U) holds. If not, C aborts the simulation and returns ⊥. Otherwise, C executes the KE query to get DIDj and calculates T=e^(U,DIDj). Then C executes H2 query to obtain Z=H2(U,T,IDj) and finally calculates and returns m=C⊕Z.
Challenge. A outputs two plaintexts (m0,m1) which have the same length and picks a sender’s identity IDs and a receiver’s identity IDr on which he wishes to be challenged. Note that C fails if A has asked a KE query on IDr during the first stage. If IDr≠IDγ, C aborts the simulation and returns ⊥. Otherwise C selects a random number β∈{0,1} and generates the challenge ciphertext σ∗=(C∗,U∗,V∗) as follows. At first, C chooses the value V∗∈G1. Then he sets U∗=aP and computes Z∗=H2(U∗,μ∗,IDγ) and C∗=mβ⊕Z∗, in which μ∗=e^(U∗,Dγ)=e^(aP,b-1P)=e^(P,P)ab-1 (μ∗ is the candidate answer for the BIDH problem). Finally C forwards the ciphertext σ∗=(C∗,U∗,V∗) to A.
Phase 2. A then performs a second series of queries, and C can handle these queries as in the first stage. Whereas, it cannot make a KE query on IDr and cannot perform anUnsigncryption query on ciphertext σ∗ under IDs and IDr to obtain the plaintext unless the sender’s public key PKIDs is replaced after thechallenge phase.
Guess. A produces a bit of β′. If β′=β, C then answers 1 as the result to the BIDH problem since he has generated a valid signcrypted message of mβ using the knowledge of μ∗. Otherwise, C answers 0.
So, the adversaryA can defeat the signcryption by means of analyzing the ciphertext, and at the same time he can solve the BIDH problem with nonnegligible advantage. But we all know that there is no algorithm that can be used to work out the BIDH problem in the probabilistic polynomial time; hence our scheme has the indistinguishability against adaptive chosen ciphertext attack.(2) UnforgeabilityTheorem 8.
Our CDHSC scheme is existentially unforgeable against any EUF-CDHSC-CMA adversaryAi(i=I,II) in the random oracle model assuming that the CDH problem in G1 is intractable.Proof.
LetC be an CDH problem attacker. Then Ai is the adversary who interacts with C following Game 2. C is given (P,aP,bP) as an input to the CDH problem and aims to compute abP, where a,b∈Zq∗ and P∈G1.
Initial. The challenger C runs theSetup algorithm defined in generic model and gives the resulting system parameters to the adversary Ai. For the Type II adversary, C sends him the master secret keys of KGC in addition to the system parameters.
Probing. We show that C can use Ai to solve the CDH problem. C needs to maintain three lists L1, L2, and L3 that are initially empty and are used to keep track of answers to queries asked by Ai to oracles H1, H2, and H3, respectively. What is more, C maintains two lists: Lk and Lp of the queries made by Ai to oracles PK and PPUKE (or PKE), respectively. Subsequently, C simulates the challenger and plays the game described in Definition 5 with the adversary Ai. The Ai performs a polynomially bounded number of the following queries, and AII does not need to perform PKR, PPKE, and KE queries.
Partial Public Key Extraction (PPUKE) or Public Key Extraction (PKE) Queries. When Ai makes this query on IDi, if the list Lp has the entry (IDi,QIDi=wiP,DIDi=wi-1P,wi), then C answers QIDi to Ai. Otherwise, C selects wi∈Zq∗ randomly, computes QIDi=wiP and DIDi=wi-1P, then returns QIDi, and adds (IDi,QIDi=wiP,DIDi=wi-1P,wi) to Lp.
Partial Private Key Extraction (PPKE) or Key Extraction (KE) Queries. We assume that C has made PPUKE (or PKE) query on IDi before this query. The list Lp should have the entry (IDi,QIDi=wiP,DIDi=wi-1P,wi). C returns DIDi to A.
Public Key (PK) Queries. We assume that Ai makes at most qk queries to this oracle and C has made PPUKE (or PKE) query on IDi before this query. First, C chooses γ∈{1,2,…,qk} randomly. When Ai makes this query on IDi(i∈{1,2,…,qk}), if i=γ (we let IDi=IDγ at this point), C returns PKIDγ=wγbP and adds (IDγ,PKIDγ,⊥) to Lk. Otherwise C selects xIDi∈Zq∗ randomly, computes PKIDi=xIDiQIDi, then returns PKIDi, and adds (IDi,PKIDi,xIDi) to Lk.
Corruption Queries. When Ai makes this query on IDi, if IDi=IDγ, C aborts the simulation and returns ⊥. Otherwise, the list Lk should have the entry (IDi,PKIDi,xIDi). C returns xIDi to Ai.
H 1 , H 2 , H 3 , PKR, and Signcryption Queries. This proof is the same as the proof of Theorem 7.
Unsigncryption Queries. When A asks for this query on a signcryption σ=(C,U,V) with a senders identity IDi and a receivers identity IDj, C computes t=H3-0(C,U,PKIDi,IDi) and checks if e^(V,QIDi)=e^(P0,P0)te^(PKIDi,U) holds. If not, C aborts the simulation and returns ⊥. Otherwise, C executes the KE query to get DIDj and calculates T=e^(U,DIDj). Then C executes H2 query to obtain Z=H2(U,T,IDj) and finally calculates and returns m=c⊕Z.
Forgery. Ai outputs a ciphertext σ∗=(C∗,U∗=aP,V∗) and picks a sender’s identity IDs and a receiver’s identity IDr on which he wishes to be challenged. If IDs≠IDγ, C aborts the simulation and returns ⊥. Otherwise, he runs the H3 simulation algorithm to obtain t∗=H3(C∗,U∗,PKIDγ,IDγ); we can have V∗=t∗DIDγ+ω and ω=V∗-t∗DIDγ (ω is a candidate for the CDH problem). Finally, C checks if e^(V∗,QIDγ)=e^(P0,P0)t∗e^(PKIDγ,U∗), if the condition is not satisfied, C fails and outputs 0; otherwise, C answers 1.
So, the adversaryAi can forge a valid signcryption by means of analyzing ciphertext, and he can solve the CDH problem with nonnegligible advantage at the same time. But we all know that there is no algorithm that can be used to work out the CDH problem in the probabilistic polynomial time; hence our scheme is existentially unforgeable against adaptive chosen-message attacker Ai.(3) Known Session-Specific Temporary Information Security (KSSTIS). Assume that at the ith communication, session-specific temporary key r and signcryption σ=(C,U,V) are leaked. In our CDHSC scheme, the encryption key is Z=H2(U,T,IDB). An external adversary can get U through the ciphertext σ and the identity IDB of the receiver, but he cannot acquire the secret value xA of the sender or the private key DB of the receiver. So, the external adversary is hard to obtain the plaintext m since he cannot compute T=e^(P2,P2)r+xA=e^(U,DB). Hence, our scheme can achieve the KSSTIS attribute. But in NACS [21], when the external adversary obtains the temporary key r of ith communication, he can compute T=e^(Ppub,QIDr)r easily, and it is easy for the adversary to obtain the message m=C⊕H2(U,T,IDr) with the ciphertext σ=(U,C,V).


## 4. An Efficient Access Control Scheme

We come up with a secure and efficient access control scheme for wireless sensor networks in the cross-domain context of the IoT using our CDHSC scheme. The proposed scheme includes four phases: system initialization, user registration, authentication with key establishment, and leaked key revocation phase. The workflow of access control scheme is shown in Figure2.Figure 2
The proposed access control scheme.


### 4.1. System Initialization Phase

Without loss of generality, we select two domains and assume that the KGC and PKG are in different communication domains and they generate different system parameters. The KGC outputs the system parameters{G1-0,G2-0,q0,e^,n,P0,Ppub0,H1-0,H2,H3} and obtains his master secret key s0 and the master public key Ppub0=s0P0. The PKG gets his master secret key s1 and the master public key Ppub1=s1P1, and he runs the IB-PKE and IB-KE algorithms to generate the users public key QU and private key DU for each WSN node in the IBC environment. The PKG loads the system parameters, QU, DU, and IDU, into a smart card and issues this card to the WSN node.


### 4.2. User Registration Phase

At this stage, an Internet user with identityIDA in the context of CLC wants to register for his partial public/private key pair; he submits his identity IDA to the KGC. KGC examines if the user’s information (e.g., the user’s IP address) is reasonable. If the information is incorrect, the KGC will reject the user’s request. Otherwise, the KGC executes CL-PPUKE and CL-PPKE algorithms to get partial public key QA=(a+s0+χA)P0 and partial private key DA=(a+s0+χA)-1P0, where a=H1-0(IDA) and χA∈Zq∗ selected by the KGC randomly. The KGC returns (QA,DA) to user. After receiving (QA,DA), the Internet user executes the CL-SVS and CL-PKG algorithms to obtain his secret value xA and public key PKA. The user can store the public parameters in a plaintext file and (xA, DA) in a ciphertext file.


### 4.3. Authentication with Key Establishment Phase

When an Internet userIDA wants to access the information collected by a sensor node IDB from WSN, the user firstly acquires the current time stamp T1 in order to detect the replay attack, then generates the query request message, and performs a signcryption operation on it. The ciphertext is σ=(C,U,V,T1), where V=tDA+xAU and t=H3-0(C,U,PKA,IDA⊕T1). Then he sends the ciphertext to the gateway belonging to the destination WSN. The gateway first calculates t=H3-0(C,U,PKA,IDA⊕T1) and examines whether e^(V,QA)=e^(P0,P0)te^(PKA,U) and T1 is fresh or not. If not, the gateway denies the access to the WSN. Otherwise, the user passes the authentication, and the gateway sends (C,U) to the WSN node. The WSN node calculates T=e^(U,DB), Z=H2(U,T,IDB) and gets query request message m=C⊕Z. After that, the WSN node can encrypt the response data using symmetric encryption algorithm with the session key Z. In this process, confidentiality, nonrepudiation, and KSSTIS are all achieved according to the security proof of Section 3.5. The message integrity is ensured by using the hash value t. The functions of authentication and session key establishment are implemented by verifying the signature (U,V) and calculating the session key Z, respectively.


### 4.4. Leaked Key Revocation Phase

Assume that the partial private keyDA of an Internet user with identity IDA is leaked; then the user should send a key revocation request message to the KGC for a new key. The user submits his identity IDA to the KGC. KGC randomly chooses another value χA′∈Zq∗ to compute the new partial public key QA=(a+s0+χA′)P0 and partial private key DA=(a+s0+χA′)-1P0 with the same identity IDA. Then the KGC returns (QA,DA) to user.


### 4.5. Performance Evaluation

We compare the performance of our method with the NACS [21]. The comparative result is shown in Table 1. In the table, we use M, E, and P as abbreviations for point multiplications in G1, exponentiations in G2, and pairing operations, respectively. Moreover, we use notations KSSTIS as abbreviations for whether the scheme achieves known session-specific temporary information security.Table 1
Comparisons of performance.
Scheme KISSTIS Cross-domain Computational cost Sensor communication cost Signcryption Unsigncryption Energy cost Received data Energy cost NACS [21] N N 3 M + 1 E 4 P 260.16 mJ m + G 1 1.03 mJ Ours Y Y 3 M + 1 E 3 P + 1 E 234 mJ m + G 1 1.03 mJFrom the computational point of view, the signcryption operation of our CDHSC scheme needs three point multiplications inG1 and one exponentiation in G2 which is the same as NACS [21]. The unsigncryption operation of our CDHSC scheme needs one exponentiation and three pairings, but NACS requires four pairings. As we all know, the pairing operation is several times more expensive than the exponentiation. So the computational cost of our CDHSC scheme is more efficient than the NACS. In addition to efficiency improvement, our CDHSC scheme also enhances the security, since it achieves KSSTIS attribute. Most importantly, our scheme allows an Internet user under the circumstance of CLC to communicate a sensor node in IBC environment with different system parameters.For energy consumption, according to [21], a point multiplication in G1 (or an exponentiation in G2) operation and a pairing operation consume 19.44mJ and 45.6mJ, respectively. Therefore, the computational energy cost of NACS and our scheme are 4∗(19.44+45.6)=260.16mJ and 5∗19.44+3∗45.6=234mJ, respectively, and the communication energy cost of NACS and our scheme are the same for the sensor node (the cost is 1.03mJ [21]).Hence, consider the wireless sensor networks in the single-domain or cross-domain context of the IoT; it may be that our access control scheme is more applicable.


## 4.1. System Initialization Phase

Without loss of generality, we select two domains and assume that the KGC and PKG are in different communication domains and they generate different system parameters. The KGC outputs the system parameters{G1-0,G2-0,q0,e^,n,P0,Ppub0,H1-0,H2,H3} and obtains his master secret key s0 and the master public key Ppub0=s0P0. The PKG gets his master secret key s1 and the master public key Ppub1=s1P1, and he runs the IB-PKE and IB-KE algorithms to generate the users public key QU and private key DU for each WSN node in the IBC environment. The PKG loads the system parameters, QU, DU, and IDU, into a smart card and issues this card to the WSN node.


## 4.2. User Registration Phase

At this stage, an Internet user with identityIDA in the context of CLC wants to register for his partial public/private key pair; he submits his identity IDA to the KGC. KGC examines if the user’s information (e.g., the user’s IP address) is reasonable. If the information is incorrect, the KGC will reject the user’s request. Otherwise, the KGC executes CL-PPUKE and CL-PPKE algorithms to get partial public key QA=(a+s0+χA)P0 and partial private key DA=(a+s0+χA)-1P0, where a=H1-0(IDA) and χA∈Zq∗ selected by the KGC randomly. The KGC returns (QA,DA) to user. After receiving (QA,DA), the Internet user executes the CL-SVS and CL-PKG algorithms to obtain his secret value xA and public key PKA. The user can store the public parameters in a plaintext file and (xA, DA) in a ciphertext file.


## 4.3. Authentication with Key Establishment Phase

When an Internet userIDA wants to access the information collected by a sensor node IDB from WSN, the user firstly acquires the current time stamp T1 in order to detect the replay attack, then generates the query request message, and performs a signcryption operation on it. The ciphertext is σ=(C,U,V,T1), where V=tDA+xAU and t=H3-0(C,U,PKA,IDA⊕T1). Then he sends the ciphertext to the gateway belonging to the destination WSN. The gateway first calculates t=H3-0(C,U,PKA,IDA⊕T1) and examines whether e^(V,QA)=e^(P0,P0)te^(PKA,U) and T1 is fresh or not. If not, the gateway denies the access to the WSN. Otherwise, the user passes the authentication, and the gateway sends (C,U) to the WSN node. The WSN node calculates T=e^(U,DB), Z=H2(U,T,IDB) and gets query request message m=C⊕Z. After that, the WSN node can encrypt the response data using symmetric encryption algorithm with the session key Z. In this process, confidentiality, nonrepudiation, and KSSTIS are all achieved according to the security proof of Section 3.5. The message integrity is ensured by using the hash value t. The functions of authentication and session key establishment are implemented by verifying the signature (U,V) and calculating the session key Z, respectively.


## 4.4. Leaked Key Revocation Phase

Assume that the partial private keyDA of an Internet user with identity IDA is leaked; then the user should send a key revocation request message to the KGC for a new key. The user submits his identity IDA to the KGC. KGC randomly chooses another value χA′∈Zq∗ to compute the new partial public key QA=(a+s0+χA′)P0 and partial private key DA=(a+s0+χA′)-1P0 with the same identity IDA. Then the KGC returns (QA,DA) to user.


## 4.5. Performance Evaluation

We compare the performance of our method with the NACS [21]. The comparative result is shown in Table 1. In the table, we use M, E, and P as abbreviations for point multiplications in G1, exponentiations in G2, and pairing operations, respectively. Moreover, we use notations KSSTIS as abbreviations for whether the scheme achieves known session-specific temporary information security.Table 1
Comparisons of performance.
Scheme KISSTIS Cross-domain Computational cost Sensor communication cost Signcryption Unsigncryption Energy cost Received data Energy cost NACS [21] N N 3 M + 1 E 4 P 260.16 mJ m + G 1 1.03 mJ Ours Y Y 3 M + 1 E 3 P + 1 E 234 mJ m + G 1 1.03 mJFrom the computational point of view, the signcryption operation of our CDHSC scheme needs three point multiplications inG1 and one exponentiation in G2 which is the same as NACS [21]. The unsigncryption operation of our CDHSC scheme needs one exponentiation and three pairings, but NACS requires four pairings. As we all know, the pairing operation is several times more expensive than the exponentiation. So the computational cost of our CDHSC scheme is more efficient than the NACS. In addition to efficiency improvement, our CDHSC scheme also enhances the security, since it achieves KSSTIS attribute. Most importantly, our scheme allows an Internet user under the circumstance of CLC to communicate a sensor node in IBC environment with different system parameters.For energy consumption, according to [21], a point multiplication in G1 (or an exponentiation in G2) operation and a pairing operation consume 19.44mJ and 45.6mJ, respectively. Therefore, the computational energy cost of NACS and our scheme are 4∗(19.44+45.6)=260.16mJ and 5∗19.44+3∗45.6=234mJ, respectively, and the communication energy cost of NACS and our scheme are the same for the sensor node (the cost is 1.03mJ [21]).Hence, consider the wireless sensor networks in the single-domain or cross-domain context of the IoT; it may be that our access control scheme is more applicable.


## 5. Conclusion

In this paper, we proposed a cross-domain heterogeneous signcryption scheme that allows a sender in the CLC environment to send the request signcryption message to a recipient in the IBC environment with different system parameters, and we proved that it has the confidentiality under the BIDH problem and unforgeability under the CDH problem in the random oracle model. Based on the CDHSC scheme, we designed a secure and efficient access control scheme for wireless sensor networks in the cross-domain context of the IoT.Compared with NACS, our scheme not only needs less computation costs but also has stronger security since it achieves KSSTIS attribute. We believe that the proposed access control scheme can be feasible in many practical single-domain or cross-domain WSN applications.



---

*Source: 6140978-2018-02-26.xml*