# A Source Hiding Identity-Based Proxy Reencryption Scheme for Wireless Sensor Network

Authors: Chunpeng Ge; Jinyue Xia; Aaron Wu; Hongwei Li; Yao Wang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Wireless sensor network (WSN), which extends the typical Internet environment to Internet of Things, has been deployed in various environments such as safety monitoring, intelligent transportation, and smart home. In a WSN, encryption is typically used to protect data that are stored in wireless devices. However some features like data sharing can be affected if the traditional encryption is used. A secure mechanism should support a gateway of the network to directly convert a user’s encrypted data (encrypted pollution data) to a new user’s encryption without exposing the underlying plaintext data during the whole sharing phase. In this work, a new source hiding identity-based proxy reencryption scheme (SHIB-PRE) is proposed to deal with the issue. The proposed SHIB-PRE scheme supports a proxy (gateway or cloud server) to transform a user’s encrypted date to a new user’s ciphertext as long as the proxy has the proxy reencryption key. In SHIB-PRE, the encrypted pollution data is kept secure from the proxy and the relationship between a source ciphertext and a reencrypted ciphertext is concealed from the outside eavesdropper. In this paper, we give an introduction to the definition of a source hiding identity-based proxy reencryption and its chosen plaintext security model. Further, a concrete construction will be presented and proven chosen plaintext secure under theq-DDHE assumption in the standard model.


---

## Body

## 1. Introduction

With the growth of wireless sensor devices, people are facing a formidable problem of huge sensor data management and maintenance [1, 2]. One cost-effective and convenient approach to resolve this issue is to deploy the sensor data on the cloud, for example, IBM cloud [3] and Amazon AWS [4]. People can adopt data encryption as an intuitive defense to ensure data confidentiality on the cloud [5]. By encrypting the sensor data and saving on the cloud, however, sharing sensor data within the wireless sensor network is limited. As a result, traditional public key encryption only guarantees the confidentiality of wireless sensor data, yet it is frustrating with the data sharing functionality.Considering the following scenario, we will need a secure mechanism that supports a gateway of the network to directly convert a user’s encrypted data (encrypted pollution data) to a new user’s encrypted data without revealing the underlying plaintext data. Suppose many wireless sensor nodes are deployed in a wireless pollution sensor network to monitor the campus air quality. All sensor nodes send their monitoring data to the sink node and then send to the cloud through the gateway. For the purpose of confidentiality, we could encrypt the monitoring data before sending it to the sink node. In some situations, the campus administrator Alice may want to cooperate with the government institute researcher Bob to analyze the environment. As the data is encrypted by Alice’s public key, Bob cannot decrypt the encryption to get the underlying plaintext due to the fact that he does not access to Alice’s private key. What we can do in this case is that let the campus administrator Alice fetch the secret data off the cloud and then reencrypt the data with Bob’s public key. However, it can significantly increase Alice workload and violates the original intention of cloud computing, leaving heavy workload to the cloud. What is worse is that Alice should be online all time during each sharing phase. Another native solution is that Alice can store the private key in cloud. Thus the cloud can perform the download-decrypt-reencrypt work instead of Alice. But, it may be a disaster if the cloud is disclosed as the attacker can use Alice’s private key.In addition to secure data sharing, another security requirement for above scenario is privacy preservation. If the government system is disclosed, the campus’ identity should not be revealed. This privacy-preserving property enables that, even if the government system is assailed by an adversary, the adversary can not know who is sharing the data with the government system. This requires the relationship between the campus and the government system can not be revealed by an attacker.Therefore, a new public key encryption mechanism is desired to support data sharing and privacy preservation at the same time. Enabling the confidentiality of data and preserving the privacy without losing efficiency [6] are an important problem to be issued. In this work, we focus on solving these elusive problems by presenting a novel notion of source hiding identity-based proxy reencryption. In our proposed source hiding identity-based proxy reencryption scheme, a proxy (gateway or cloud server) with a proxy reencryption key can convert a delegator’s (campus) ciphertext to a delegate’s (government institute researcher) ciphertext without exposing the plaintext. At the meanwhile, an outsider eavesdropper can not gain the relationship between the original ciphertext and the reencrypted ciphertext.In related work, proxy reencryption (PRE) was proposed to enable a semitrusted proxy to convert Alice’s ciphertext to Bob’s ciphertext by a reencryption key [7]. Proxy reencryption has been applied into several places, such as secure email forwarding [7, 8] and cloud computing [9]. Green et al. [10] introduced identity-based proxy reencryption in which a user’s public key is viewed as his identity. After their work, a great number of identity-based proxy reencryptions have came out [11–13] to deal with the efficiency and security property. An AB-PRE scheme was presented to apply attribute-based setting to proxy reencryption [14]. Luo, Hu, and Chen [15] revealed another scheme to provide “AND” gates on both positive and negative attributes. Later on, a ciphertext-policy attribute-based proxy reencryption (CPAB-PRE) [16, 17] was presented to support a monotonic access formula in the selective model. Further, they enhanced its security in the adaptive model [18]. Meanwhile, Ge et al. [19, 20] presented two key-policy attribute-based proxy reencryption (KPAB-PRE) schemes in both the selective and adaptive model, respectively. Recently, a DFA-based proxy reencryption scheme [21] allows the access to be described as a DFA. Unfortunately, none of these schemes support the functionality of privacy-preserving keyword search.To capture the source hiding property, Emura, Miyaji, and Omote [22] introduced the notion of source hiding and they presented the first source hiding IB-PRE scheme in the random oracle model. However, their proof is only a heuristic argument and might lead to the scheme insecure [23]. Furthermore, the previous source hiding scheme [22] is found not collusion resistant. As a result, if a proxy colludes a set of delegates, the delegator’s message is revealed as well as the delegator’s private key.


### 1.1. Our Contribution

To address above problems [22], this work presents a CPA secure collusion resistant source hiding identity-based proxy scheme. Additionally, we prove the security without random oracles. More specifically, a proxy and a set of delegates can only collude to reveal the plaintext but not the delegator’s private key. The paper organizes as follows: first we describe our scheme, second we prove our scheme secure in the standard model, and finally we show it is collusion resistant.


## 1.1. Our Contribution

To address above problems [22], this work presents a CPA secure collusion resistant source hiding identity-based proxy scheme. Additionally, we prove the security without random oracles. More specifically, a proxy and a set of delegates can only collude to reveal the plaintext but not the delegator’s private key. The paper organizes as follows: first we describe our scheme, second we prove our scheme secure in the standard model, and finally we show it is collusion resistant.


## 2. Preliminaries

### 2.1. Bilinear Map

G and GT denote two multiplicative cyclic groups with the same prime order p. g is a generator of group G. A bilinear pairing is a bilinear map e:G×G→GT with the following properties [24]:(1)
e(g1a,g2b)=e(g1,g2)ab for all a,b←RZp∗ and g1,g2∈G.(2)
e(g,g)≠1.(3)
There is an efficient algorithm to computee(g1,g2) for all g1,g2∈G.


### 2.2. Complexity Assumption

Our proposed system security relies on the truncatedq decisional Diffie-Hellman exponent (q-DDHE) assumption. Here is the assumption: given a vector of q+2 elements(1)g,gα,gα2,…,gαq,T∈Gq+2it is difficult to distinguish T=g(αq+1) from a random value in G. Formally speaking, for all probability polynomial time adversaries A, the following probability is negligible:(2)Prα,r←RZp∗;T0=gαq+1;T1=gr;z∈0,1;z′←Ag,gα,gα2,…,gαq,Tz:z=z′-12.


### 2.3. Identity-Based Proxy Reencryption

The encryption level in our paper is defined as follows: A “level1” ciphertext is a ciphertext generated directly by the Encrypt algorithm. A “level l+1” ciphertext is a reencryption result of a “level l” ciphertext by using the Reencryption algorithm. MaxLevel is the highest-possible ciphertext level. It is obvious that, for a single-hop IB-PRE scheme, MaxLevel=2. In this paper, we deal with single-hop IB-PRE scheme, as the max level equals 2. In our scheme, the first and second level ciphertext denote the original and reencrypted ciphertext, respectively.Definition 1 (identity-based proxy reencryption).
The following algorithms describe a single-hop identity-based proxy reencryption scheme [10]: (i)
Setup(λ): the private key generator (PKG) runs setup with a security parameter λ input. This step generates the global public parameters PP and a master secret key msk.(ii)
KeyGen(msk,ID): in this step, KeyGen takes the master secret key msk and an identity ID as the input; it returns a private key skID for identity ID.(iii)
Encrypt(ID,m): the input for this algorithm is an identity ID and a message m∈M (M: message space); it generates the ciphertext CID.(iv)
RKeyGen(skIDi,IDi,IDj): RKeyGen takes identities IDi,IDj and skIDi and outputs the reencryption key rkIDi→IDj.(v)
ReEncrypt(CIDi,rkIDi→IDj): a reencryption key rkIDi→IDj and a ciphertext CIDi corresponding to identity IDi are the input; it returns the reencrypted ciphertext CIDj.(vi)
Decrypt(CID,skID): given a private key skID and a ciphertext CID, it outputs the plaintext m or it aborts with an error symbol ⊥.Correctness.Suppose (PP,msk)←Setup(λ), skIDi←KeyGen(msk,IDi), skIDj←KeyGen(msk,IDj), and rkIDi→IDj←RKeyGen(skIDi,IDi,IDj). The correctness of IB-PRE means that (3)Pr⁡DecryptCIDi,skIDi=m=1,Pr⁡DecryptskIDj,ReEncryptCIDi,rkIDi→IDj=m=1.


### 2.4. Security Notion for Key-Private IB-PRE

We describe game-based security definition of source hiding IB-PRE in this section. Compared to the work presented in [22], our security model considers the indistinguishability of message against chosen-plaintext attack (IND-CPA) and the source hiding property of IB-PRE against chosen-plaintext attack (IND-SH-CPA).Definition 2 (IND-CPA).
A (single-use) source hiding IB-PRE scheme is IND-CPA secure if no probabilistic polynomial time (PPT) adversaryA can win the game below with nonnegligible advantage. Next in the game, we assume λ is the security parameter and B is the game challenger.(1)
Setup:B runs the Setup(λ) algorithm to obtain the (PP, msk) and assigns PP to A.(2)
Query phase 1:
(a)
Extract(ID): run the KeyGen(msk,ID) algorithm to get skID and return skID to A.(b)
RKExtract(IDi,IDj): run the RKeyGen(skIDi,IDi,IDj) algorithm to get rkIDi→IDj and return rkIDi→IDj to A.(3)
Challenge. Once A decides that phase 1 is finished, it outputs two equal length messages (m0,m1) and two challenge identities ID∗. The challenger C chooses a random bit b∈{0,1} and sends the challenge ciphertext C∗=Encrypt(ID∗,mb) to A. The restrictions are that A has never made the following queries:
(i)
Extract(ID∗);(ii)
RKExtract(ID∗,IDj) and Extract(IDj).(4)
Query phase 2:A continues making queries. The queries are same as phase 1, except the followings:
(i)
Extract(ID∗);(ii)
RKExtract(ID∗,IDj) and Extract(IDj);(5)
Guess:A makes the guess b′ and wins the game if b′=b.We claim IB-PRE is IND-CPA secure, if the probability(4)AdvAIND-CPAλ=Prb′=b-12 is negligible for all probabilistic polynomial time adversary A.Next, we present the source hiding property of IB-PRE (IND-SH-CPA) and we follow the security model of [22]. IND-SH-CPA guarantees that even if an adversary knows a mailing-list address and a mailing-list member address included in the mailing-list system, the adversary cannot identify whether a source ciphertext is the source of a destination ciphertext or not. We allow an adversary to select the challenge source identities ID0∗, ID1∗ and the challenge ciphertext ID∗. An adversary A is provided the Extract and RKExtract queries as in the IND-CPA game.(1)
Setup: run the Setup(λ) algorithm to get the (PP, msk) and then assign PP to A.(2)
Query phase 1:
(a)
Extract(ID): A runs the KeyGen(msk,ID) algorithm to get skID and obtain skID.(b)
RKExtract(IDi,IDj): A runs the RKeyGen(skIDi,IDi,IDj) algorithm to get rkIDi→IDj and obtain rkIDi→IDj.(3)
Challenge: as soon asA considers phase 1 is over, it outputs two identities (ID0,ID1), a challenge plaintext m∗ and a challenge identity ID, ID not in {ID0,ID1}. The challenger C chooses a random bit b∈{0,1} and computes CIDb∗=Encrypt(IDb∗,m∗). Next, C computes CID∗=ReEncrypt(CIDb∗,rkIDb∗→ID) and sends the challenge ciphertext CID∗ to A.(4)
Query phase 2:A continues making queries as in the query phase 1.(5)
Guess:A outputs the guess b′. The adversary wins if b′=b.We say that a source hiding IB-PRE scheme is IND-SH-CPA secure, if the following probability is negligible for all probabilistic polynomial time adversaryA: (5)AdvAIND-SH-CPAλ=Prb′=b-12.Note that, unlike the IND-CPA security game, in the IND-SH-CPA security game, the adversaryA is allowed to get the private key of the target ciphertext. The IND-SH-CPA guarantees that even if A can decrypt the challenge ciphertext CID∗, A only can obtain the following: (1) CID∗ is encrypted under identity ID; (2) m∗ is the plaintext, all of which however have been already known by A.


## 2.1. Bilinear Map

G and GT denote two multiplicative cyclic groups with the same prime order p. g is a generator of group G. A bilinear pairing is a bilinear map e:G×G→GT with the following properties [24]:(1)
e(g1a,g2b)=e(g1,g2)ab for all a,b←RZp∗ and g1,g2∈G.(2)
e(g,g)≠1.(3)
There is an efficient algorithm to computee(g1,g2) for all g1,g2∈G.


## 2.2. Complexity Assumption

Our proposed system security relies on the truncatedq decisional Diffie-Hellman exponent (q-DDHE) assumption. Here is the assumption: given a vector of q+2 elements(1)g,gα,gα2,…,gαq,T∈Gq+2it is difficult to distinguish T=g(αq+1) from a random value in G. Formally speaking, for all probability polynomial time adversaries A, the following probability is negligible:(2)Prα,r←RZp∗;T0=gαq+1;T1=gr;z∈0,1;z′←Ag,gα,gα2,…,gαq,Tz:z=z′-12.


## 2.3. Identity-Based Proxy Reencryption

The encryption level in our paper is defined as follows: A “level1” ciphertext is a ciphertext generated directly by the Encrypt algorithm. A “level l+1” ciphertext is a reencryption result of a “level l” ciphertext by using the Reencryption algorithm. MaxLevel is the highest-possible ciphertext level. It is obvious that, for a single-hop IB-PRE scheme, MaxLevel=2. In this paper, we deal with single-hop IB-PRE scheme, as the max level equals 2. In our scheme, the first and second level ciphertext denote the original and reencrypted ciphertext, respectively.Definition 1 (identity-based proxy reencryption).
The following algorithms describe a single-hop identity-based proxy reencryption scheme [10]: (i)
Setup(λ): the private key generator (PKG) runs setup with a security parameter λ input. This step generates the global public parameters PP and a master secret key msk.(ii)
KeyGen(msk,ID): in this step, KeyGen takes the master secret key msk and an identity ID as the input; it returns a private key skID for identity ID.(iii)
Encrypt(ID,m): the input for this algorithm is an identity ID and a message m∈M (M: message space); it generates the ciphertext CID.(iv)
RKeyGen(skIDi,IDi,IDj): RKeyGen takes identities IDi,IDj and skIDi and outputs the reencryption key rkIDi→IDj.(v)
ReEncrypt(CIDi,rkIDi→IDj): a reencryption key rkIDi→IDj and a ciphertext CIDi corresponding to identity IDi are the input; it returns the reencrypted ciphertext CIDj.(vi)
Decrypt(CID,skID): given a private key skID and a ciphertext CID, it outputs the plaintext m or it aborts with an error symbol ⊥.Correctness.Suppose (PP,msk)←Setup(λ), skIDi←KeyGen(msk,IDi), skIDj←KeyGen(msk,IDj), and rkIDi→IDj←RKeyGen(skIDi,IDi,IDj). The correctness of IB-PRE means that (3)Pr⁡DecryptCIDi,skIDi=m=1,Pr⁡DecryptskIDj,ReEncryptCIDi,rkIDi→IDj=m=1.


## 2.4. Security Notion for Key-Private IB-PRE

We describe game-based security definition of source hiding IB-PRE in this section. Compared to the work presented in [22], our security model considers the indistinguishability of message against chosen-plaintext attack (IND-CPA) and the source hiding property of IB-PRE against chosen-plaintext attack (IND-SH-CPA).Definition 2 (IND-CPA).
A (single-use) source hiding IB-PRE scheme is IND-CPA secure if no probabilistic polynomial time (PPT) adversaryA can win the game below with nonnegligible advantage. Next in the game, we assume λ is the security parameter and B is the game challenger.(1)
Setup:B runs the Setup(λ) algorithm to obtain the (PP, msk) and assigns PP to A.(2)
Query phase 1:
(a)
Extract(ID): run the KeyGen(msk,ID) algorithm to get skID and return skID to A.(b)
RKExtract(IDi,IDj): run the RKeyGen(skIDi,IDi,IDj) algorithm to get rkIDi→IDj and return rkIDi→IDj to A.(3)
Challenge. Once A decides that phase 1 is finished, it outputs two equal length messages (m0,m1) and two challenge identities ID∗. The challenger C chooses a random bit b∈{0,1} and sends the challenge ciphertext C∗=Encrypt(ID∗,mb) to A. The restrictions are that A has never made the following queries:
(i)
Extract(ID∗);(ii)
RKExtract(ID∗,IDj) and Extract(IDj).(4)
Query phase 2:A continues making queries. The queries are same as phase 1, except the followings:
(i)
Extract(ID∗);(ii)
RKExtract(ID∗,IDj) and Extract(IDj);(5)
Guess:A makes the guess b′ and wins the game if b′=b.We claim IB-PRE is IND-CPA secure, if the probability(4)AdvAIND-CPAλ=Prb′=b-12 is negligible for all probabilistic polynomial time adversary A.Next, we present the source hiding property of IB-PRE (IND-SH-CPA) and we follow the security model of [22]. IND-SH-CPA guarantees that even if an adversary knows a mailing-list address and a mailing-list member address included in the mailing-list system, the adversary cannot identify whether a source ciphertext is the source of a destination ciphertext or not. We allow an adversary to select the challenge source identities ID0∗, ID1∗ and the challenge ciphertext ID∗. An adversary A is provided the Extract and RKExtract queries as in the IND-CPA game.(1)
Setup: run the Setup(λ) algorithm to get the (PP, msk) and then assign PP to A.(2)
Query phase 1:
(a)
Extract(ID): A runs the KeyGen(msk,ID) algorithm to get skID and obtain skID.(b)
RKExtract(IDi,IDj): A runs the RKeyGen(skIDi,IDi,IDj) algorithm to get rkIDi→IDj and obtain rkIDi→IDj.(3)
Challenge: as soon asA considers phase 1 is over, it outputs two identities (ID0,ID1), a challenge plaintext m∗ and a challenge identity ID, ID not in {ID0,ID1}. The challenger C chooses a random bit b∈{0,1} and computes CIDb∗=Encrypt(IDb∗,m∗). Next, C computes CID∗=ReEncrypt(CIDb∗,rkIDb∗→ID) and sends the challenge ciphertext CID∗ to A.(4)
Query phase 2:A continues making queries as in the query phase 1.(5)
Guess:A outputs the guess b′. The adversary wins if b′=b.We say that a source hiding IB-PRE scheme is IND-SH-CPA secure, if the following probability is negligible for all probabilistic polynomial time adversaryA: (5)AdvAIND-SH-CPAλ=Prb′=b-12.Note that, unlike the IND-CPA security game, in the IND-SH-CPA security game, the adversaryA is allowed to get the private key of the target ciphertext. The IND-SH-CPA guarantees that even if A can decrypt the challenge ciphertext CID∗, A only can obtain the following: (1) CID∗ is encrypted under identity ID; (2) m∗ is the plaintext, all of which however have been already known by A.


## 3. Our Proposed Source Hiding IB-PRE

First, we analyze what conditions IB-PRE scheme should meet such that it has the source hiding property. Second, we describe our source hiding IB-PRE scheme and prove its IND-CPA and IND-SH-CPA security.


### 3.1. Impossibility Result for Source Hiding IB-PRE

Before presenting our scheme, we introduce several necessary yet not sufficient conditions that are satisfying the source hiding property.Lemma 3.
As proven in [22], the adversary breaks the IND-SH-CPA security if he can learn to determine if destination ciphertexts are derived from the same source ciphertext or not.Lemma 4.
Any IB-PRE scheme, in which theReEncrypt algorithm is deterministic, cannot satisfy source hiding.Proof.
Suppose theReEncrypt algorithm is deterministic, an adversary A can win the IND-SH-CPA game as below. Suppose the source ciphertext is CID0∗ and CID1∗ and the challenge ciphertext is CID∗. The adversary works as follows:(1)
Makes aRKExtract(ID1,ID) query and get the reencryption key rkID1→ID.(2)
Using the reencryption keyrkID1→ID, run the deterministic algorithm ReEncrypt(CID1∗,rkID1→ID)→C′.(3)
IfC′=CID∗, it outputs 1, else returns 0.
It is not difficult to see thatA can succeed with an overwhelming probability.


### 3.2. Our Construction

LetG and GT be bilinear group of prime order p, and g be a generator of G. Additionally, let e:G×G→GT denote the bilinear map. The proposed scheme contains the following steps:(i)
Setup(λ): λ is the security parameter, and (p,g,G,GT,e) are the bilinear map parameters. The PKG chooses random generators g,h∈G, random value α∈Zp, and a collusion resistant hash function H:GT→Zp∗. It sets g1=gα∈G. The PKG keeps h secret and outputs the public parameters PP. So master secrets are set as(6)PP=g,g1,eg,h,Hmsk=α.(ii)
KeyGen(msk,ID): in this step, the PKG picks a random value rID∈Zp to compute a private key for ID∈Zp. It calculates hID=(hg-rID)1/(α-ID) and the private key(7)skID=rID,hID.Ifα=ID, the PKG aborts.(iii)
Encrypt(ID,m): the input are an identity ID and a message m∈GT. In this step, the sender picks a random value s∈Zp and sets(8)C1=g1sg-s·ID,C2=gs,C3=m·eg,h-s.Outputs the ciphertextC=(C1,C2,C3).(iv)
RKeyGen(skIDi,IDi,IDj): on input identities IDi,IDj and the secret key skIDi, the reencryption key rkIDi→IDj is generated as follows:
(1)
Choose random valuesθ∈GT and s′∈Zp, and compute rk1=(g1s′g-s′·IDj),rk2=gs′,rk3=θ·e(g,h)-s′.(2)
Choose a random valueρ∈Zp, and set rk4=rIDi·H(θ)+ρ, rk5=hIDiH(θ), rk6=gρ, and rk7=e(g,h)H(θ).(3)
Output the reencryption keyrkIDi→IDj=(rk1,rk2,rk3,rk4,rk5,rk6,rk7).(v)
ReEncrypt(CIDi,rkIDi→IDj): on input a reencryption key rkIDi→IDj=(rk1,rk2,rk3,rk4,rk5,rk6,rk7) and a ciphertext CIDi=(C1,C2,C3) under identity IDi, the proxy proceeds as follows:
(1)
ComputeC3′=e(C1,rk5)·e(g,C2)rk4/e(C2,rk6).(2)
Choose a random valuet∈Zp and compute(9)C3′~=C3′·rk7t,C3~=C3·eg,h-t.(3)
Choose a random valuet′∈Zp and compute(10)R1=rk1·g1t′g-t′·IDj,R2=rk2·gt′,R3=rk3·eg,h-t′.(4)
Output the reencrypted ciphertextCIDi→DIj=(R1,R2,R3,C3′~,C3~).(vi)
Decrypt(CID,skID):
(a)
IfCID is an original ciphetext, let skID=(rID,hID) and CID=(C1,C2,C3). Compute(11)m=C3·eC1,hID·eg,C2rID.(b)
IfCID is a reencrypted ciphetext, let CID=(R1,R2,R3,C3′~,C3~). Compute(12)θ=R3·eR1,hID·eg,R2rID,m=C3~·C3′~1/Hθ.Correctness. The correctness of the proposed scheme is defined as follows:(1)
For an original ciphertextC=(C1,C2,C3), we have(13)C3·eC1,hID·eg,C2rID=C3·eg1sg-s·ID,hg-rID1/α-ID·eg,gsrID=C3·egsα-ID,hg-rID1/α-ID·eg,gsrID=C3·egs,hg-rID·eg,gsrID=m.(2)
For a reencrypted ciphertextCid=(C3,C3~,rk(4)), we have (14)R1=rk1·g1t′g-t′·IDj=g1s′g-s′·IDj·g1t′g-t′·IDj=g1s′+t′g-s′+t′·IDj≜g1Δt′g-Δt′·IDj,R2=rk2·gt′=gs′·gt′=gΔt′,R3=rk3·eg,h-t′=θ·eg,h-s′·eg,h-t′=θ·eg,h-Δt′,C3′=eC1,rk5·eg,C2rk4eC2,rk6=egsα-ID,hg-rIDHθ/α-ID·eC2,rk6egs,gρ=egs,hg-rIDHθ·eg,gsrID·Hθ+ρegs,gρ=eg,hsHθ,C3′~=C3′·rk7t=eg,hsHθ·eg,htHθ=eg,hs+tHθ≜eg,hΔt·HθC3~=C3·eg,h-t=m·eg,h-s·eg,h-t=m·eg,h-Δt.Finally, we haveC3~·(C3′~)1/H(θ)=m·e(g,h)-Δt·e(g,h)Δt·H(θ)/H(θ)=m.


### 3.3. Security of Our Source Hiding IB-PRE Scheme

Theorem 5.
Our scheme is IND-CPA secure without random oracles under the q-DDHE assumption.Proof.
Assuming there exists an adversaryA that can break our scheme’s IND-CPA security with the probability ε, we can construct an algorithm B that can solve the q-DDHE problem with probability ε′, where(15)ε′≥εe˙1+qe.
B inputs a q-DDHE instance (g,A1=gα,A2=gα2,…,Aq=gαq,T) and has to distinguish T=Aq+1=gαq+1 from a random element in G.
The approach to prove Theorem5 follows the steps of the security proof of Gentry’s scheme [25]. Note B maintains a list of tables that are empty initialized. Here is the list:(i)
KList: it keeps the secret keys tuples (β,ID,skID).(ii)
RKList: it maintains the result of the queries to RKExtract(IDi,IDj) which are the tuples (IDi,IDj,rkIDi→IDj,flag). In the tuples, flag=1 represents the reencryption key which is a valid one, while flag=0 represents the reencryption key which is a random value.(1)
Setup: B generates a random polynomial f(x)∈Zp[x] of degree q. It sets h=gf(α), computing h from (g,A1,…,Aq). B also picks a collusion resistant hash function H:GT→Zp∗. It sends the public key (g,A1,e(g,h),H) to A. With this assignment, the master secret key msk is α. This assignment has a distribution identical to that in the actual construction since g,α, f(x), and h are uniformly random.(2)
Query phase 1: A sends a bunch of queries to B, and B responds as follows:
(a)
Extract(ID): B searches KList, if (1,ID,skID) exists in KList, then B obtains skID. Otherwise, B generates a biased coin β so that Pr[β=1]=δ for some δ that can be determined later.(i)
Ifβ=0, B aborts and returns a random bit.(ii)
Ifβ=1, if ID=α, we have that Pr[ID=α]=1/p, B uses α to solve the q-DDHE problem. Else, let FID(x) denote the q-1 degree polynomial (f(x)-f(ID))/(x-ID). B returns the private key skID=(rID,hID)=(f(ID),gFID(α)) to the adversary and adds (1,ID,skID) to KList. Note that gFID(α)=g(f(α)-f(ID))/(α-ID)=(hg-f(ID))1/(α-ID), which is identical to the actual construction.(b)
RKExtract(IDi,IDj): B first searches whether there is a tuple (IDi,IDj,rkIDi→IDj,∗) in RKList. If yes, B returns rkIDi→IDj (∗ denotes the wildcard). Otherwise, B proceeds as follows:(i)
If(1,IDi,skIDi) exists in KList, B uses skIDi to compute the reencryption key rkIDi→IDj by running RKeyGen. B returns rkIDi→IDj to A and adds (IDi,IDj,rkIDi→IDj,1) to RKList.(ii)
Otherwise,B flips a biased coin β. If β=1, B queries the Extract(IDi) oracle to obtain skIDi and then computes rkIDi→IDj from RKeyGen algorithm. B returns rkIDi→IDj to A and adds (1,IDi,skIDi) and (IDi,IDj,rkIDi→IDj,1) to KList and RKList, respectively. If β=0, B first selects a random θ∈GT and computes rk1,rk2,rk3 as the Encrypt algorithm. Next B computes rk4=σ,rk5=ϕ1,rk6=ϕ2,rk7=e(g,h)H(θ) for randomly chosen σ∈Zp,ϕ1,ϕ2∈G. B forwards the reencryption key to A and adds (IDi,IDj,rkIDi→IDj,0) to RKList.(3)
Challenge: once A has decided that query phase 1 is over, it outputs two equal length plaintexts (m0,m1) and a challenge identity ID∗. If (1,ID∗) exists in KList, B outputs a random bit and aborts. Else if α=ID∗, B uses α to solve the q-DDHE problem. Else B generates a random bit b∈{0,1} and computes a private key (rID∗,hID∗) as in phase 1. Let f2(x)=xq+2 and F2,ID∗(x)=(f2(x)-f2(ID∗))/(x-ID∗); B sets (16)C1∗=gf2α-f2ID∗,C2∗=T·∏i=0qgF2,ID∗,i·αi,C3∗=mbeC1∗,hID∗·eg,C2∗rID∗,whereF2,ID∗,i is the coefficient of xi in F2,ID∗(x). It sends the challenge ciphertext (C1∗,C2∗,C3∗) to A.Note that, lets∗=F2,ID∗(α). If T=Aq+1=gαq+1, we have (17)C1∗=gf2α-f2ID∗=gF2,ID∗α·α-ID∗=g1s∗g-s∗·ID∗,C2∗=T·∏i=0qgF2,ID∗,i·αi=gαq+1·∏i=0qgF2,ID∗,i·αi=gf2α-f2ID∗/α-ID∗=gF2,ID∗α=gs∗C3∗=mbeC1∗,hID∗·eg,C2∗rID∗=mbeg1s∗g-s∗·ID∗,hID∗·eg,gs∗rID∗=mb·eg,h-s∗.Thus,(C1∗,C2∗,C3∗) is a valid ciphertext for (ID∗,mb).(4)
Query phase 2: A continues querying as in the query phase 1 except for the restrictions described in the IND-CPA game.(5)
Guess: A outputs the guesse b′∈{0,1}. If b′=b, B outputs 1 meaning T=gαq+1; else output 0 meaning T is a random value in G.
Probability Analysis. If B does not abort, A’s view is identical to the actual scheme. Abort is defined to be the event of B′s aborting during the simulation of Extract query. Let qe denote the total number of Extract queries; we have Pr[¬Abort]≥δqe·(p-1/p)qe≜ξqe≥ξqe(1-ξ), which is maximized at δopt=qe/(1+qe). Using δopt, the probability Pr[¬Abort] is at least 1/e˙(1+qe), where e˙ is the base of the nature logarithm. Therefor, we have ε′≥ε/e˙(1+qe).
This completes the proof of Theorem5.Theorem 6.
Our proposed scheme is IND-SH-CPA secure in the information theoretic sense.Proof.
Since a source identityIDi is not included in a destination ciphertext, Theorem 6 is clearly satisfied. (R1,R2,R3,C3′~,C3~) as R1=g1Δt′g-Δt′·IDj, R2=gΔt′, R3=θ·e(g,h)-Δt′, C3′~=e(g,h)Δt·H(θ), and C3~=m·e(g,h)-Δt, where IDj is a destination ciphertext, namely, a part of source ciphertext C3 is randomized using a random value t. More precisely, for CIDj=(R1,R2,R3,C3′~,C3~) and all identity ID, there exists a ciphertext CID=(g1sg-s·ID,gs,m·e(g,h)-s) which can be a source ciphertext of CIDj.
This completes the proof of Theorem6.


## 3.1. Impossibility Result for Source Hiding IB-PRE

Before presenting our scheme, we introduce several necessary yet not sufficient conditions that are satisfying the source hiding property.Lemma 3.
As proven in [22], the adversary breaks the IND-SH-CPA security if he can learn to determine if destination ciphertexts are derived from the same source ciphertext or not.Lemma 4.
Any IB-PRE scheme, in which theReEncrypt algorithm is deterministic, cannot satisfy source hiding.Proof.
Suppose theReEncrypt algorithm is deterministic, an adversary A can win the IND-SH-CPA game as below. Suppose the source ciphertext is CID0∗ and CID1∗ and the challenge ciphertext is CID∗. The adversary works as follows:(1)
Makes aRKExtract(ID1,ID) query and get the reencryption key rkID1→ID.(2)
Using the reencryption keyrkID1→ID, run the deterministic algorithm ReEncrypt(CID1∗,rkID1→ID)→C′.(3)
IfC′=CID∗, it outputs 1, else returns 0.
It is not difficult to see thatA can succeed with an overwhelming probability.


## 3.2. Our Construction

LetG and GT be bilinear group of prime order p, and g be a generator of G. Additionally, let e:G×G→GT denote the bilinear map. The proposed scheme contains the following steps:(i)
Setup(λ): λ is the security parameter, and (p,g,G,GT,e) are the bilinear map parameters. The PKG chooses random generators g,h∈G, random value α∈Zp, and a collusion resistant hash function H:GT→Zp∗. It sets g1=gα∈G. The PKG keeps h secret and outputs the public parameters PP. So master secrets are set as(6)PP=g,g1,eg,h,Hmsk=α.(ii)
KeyGen(msk,ID): in this step, the PKG picks a random value rID∈Zp to compute a private key for ID∈Zp. It calculates hID=(hg-rID)1/(α-ID) and the private key(7)skID=rID,hID.Ifα=ID, the PKG aborts.(iii)
Encrypt(ID,m): the input are an identity ID and a message m∈GT. In this step, the sender picks a random value s∈Zp and sets(8)C1=g1sg-s·ID,C2=gs,C3=m·eg,h-s.Outputs the ciphertextC=(C1,C2,C3).(iv)
RKeyGen(skIDi,IDi,IDj): on input identities IDi,IDj and the secret key skIDi, the reencryption key rkIDi→IDj is generated as follows:
(1)
Choose random valuesθ∈GT and s′∈Zp, and compute rk1=(g1s′g-s′·IDj),rk2=gs′,rk3=θ·e(g,h)-s′.(2)
Choose a random valueρ∈Zp, and set rk4=rIDi·H(θ)+ρ, rk5=hIDiH(θ), rk6=gρ, and rk7=e(g,h)H(θ).(3)
Output the reencryption keyrkIDi→IDj=(rk1,rk2,rk3,rk4,rk5,rk6,rk7).(v)
ReEncrypt(CIDi,rkIDi→IDj): on input a reencryption key rkIDi→IDj=(rk1,rk2,rk3,rk4,rk5,rk6,rk7) and a ciphertext CIDi=(C1,C2,C3) under identity IDi, the proxy proceeds as follows:
(1)
ComputeC3′=e(C1,rk5)·e(g,C2)rk4/e(C2,rk6).(2)
Choose a random valuet∈Zp and compute(9)C3′~=C3′·rk7t,C3~=C3·eg,h-t.(3)
Choose a random valuet′∈Zp and compute(10)R1=rk1·g1t′g-t′·IDj,R2=rk2·gt′,R3=rk3·eg,h-t′.(4)
Output the reencrypted ciphertextCIDi→DIj=(R1,R2,R3,C3′~,C3~).(vi)
Decrypt(CID,skID):
(a)
IfCID is an original ciphetext, let skID=(rID,hID) and CID=(C1,C2,C3). Compute(11)m=C3·eC1,hID·eg,C2rID.(b)
IfCID is a reencrypted ciphetext, let CID=(R1,R2,R3,C3′~,C3~). Compute(12)θ=R3·eR1,hID·eg,R2rID,m=C3~·C3′~1/Hθ.Correctness. The correctness of the proposed scheme is defined as follows:(1)
For an original ciphertextC=(C1,C2,C3), we have(13)C3·eC1,hID·eg,C2rID=C3·eg1sg-s·ID,hg-rID1/α-ID·eg,gsrID=C3·egsα-ID,hg-rID1/α-ID·eg,gsrID=C3·egs,hg-rID·eg,gsrID=m.(2)
For a reencrypted ciphertextCid=(C3,C3~,rk(4)), we have (14)R1=rk1·g1t′g-t′·IDj=g1s′g-s′·IDj·g1t′g-t′·IDj=g1s′+t′g-s′+t′·IDj≜g1Δt′g-Δt′·IDj,R2=rk2·gt′=gs′·gt′=gΔt′,R3=rk3·eg,h-t′=θ·eg,h-s′·eg,h-t′=θ·eg,h-Δt′,C3′=eC1,rk5·eg,C2rk4eC2,rk6=egsα-ID,hg-rIDHθ/α-ID·eC2,rk6egs,gρ=egs,hg-rIDHθ·eg,gsrID·Hθ+ρegs,gρ=eg,hsHθ,C3′~=C3′·rk7t=eg,hsHθ·eg,htHθ=eg,hs+tHθ≜eg,hΔt·HθC3~=C3·eg,h-t=m·eg,h-s·eg,h-t=m·eg,h-Δt.Finally, we haveC3~·(C3′~)1/H(θ)=m·e(g,h)-Δt·e(g,h)Δt·H(θ)/H(θ)=m.


## 3.3. Security of Our Source Hiding IB-PRE Scheme

Theorem 5.
Our scheme is IND-CPA secure without random oracles under the q-DDHE assumption.Proof.
Assuming there exists an adversaryA that can break our scheme’s IND-CPA security with the probability ε, we can construct an algorithm B that can solve the q-DDHE problem with probability ε′, where(15)ε′≥εe˙1+qe.
B inputs a q-DDHE instance (g,A1=gα,A2=gα2,…,Aq=gαq,T) and has to distinguish T=Aq+1=gαq+1 from a random element in G.
The approach to prove Theorem5 follows the steps of the security proof of Gentry’s scheme [25]. Note B maintains a list of tables that are empty initialized. Here is the list:(i)
KList: it keeps the secret keys tuples (β,ID,skID).(ii)
RKList: it maintains the result of the queries to RKExtract(IDi,IDj) which are the tuples (IDi,IDj,rkIDi→IDj,flag). In the tuples, flag=1 represents the reencryption key which is a valid one, while flag=0 represents the reencryption key which is a random value.(1)
Setup: B generates a random polynomial f(x)∈Zp[x] of degree q. It sets h=gf(α), computing h from (g,A1,…,Aq). B also picks a collusion resistant hash function H:GT→Zp∗. It sends the public key (g,A1,e(g,h),H) to A. With this assignment, the master secret key msk is α. This assignment has a distribution identical to that in the actual construction since g,α, f(x), and h are uniformly random.(2)
Query phase 1: A sends a bunch of queries to B, and B responds as follows:
(a)
Extract(ID): B searches KList, if (1,ID,skID) exists in KList, then B obtains skID. Otherwise, B generates a biased coin β so that Pr[β=1]=δ for some δ that can be determined later.(i)
Ifβ=0, B aborts and returns a random bit.(ii)
Ifβ=1, if ID=α, we have that Pr[ID=α]=1/p, B uses α to solve the q-DDHE problem. Else, let FID(x) denote the q-1 degree polynomial (f(x)-f(ID))/(x-ID). B returns the private key skID=(rID,hID)=(f(ID),gFID(α)) to the adversary and adds (1,ID,skID) to KList. Note that gFID(α)=g(f(α)-f(ID))/(α-ID)=(hg-f(ID))1/(α-ID), which is identical to the actual construction.(b)
RKExtract(IDi,IDj): B first searches whether there is a tuple (IDi,IDj,rkIDi→IDj,∗) in RKList. If yes, B returns rkIDi→IDj (∗ denotes the wildcard). Otherwise, B proceeds as follows:(i)
If(1,IDi,skIDi) exists in KList, B uses skIDi to compute the reencryption key rkIDi→IDj by running RKeyGen. B returns rkIDi→IDj to A and adds (IDi,IDj,rkIDi→IDj,1) to RKList.(ii)
Otherwise,B flips a biased coin β. If β=1, B queries the Extract(IDi) oracle to obtain skIDi and then computes rkIDi→IDj from RKeyGen algorithm. B returns rkIDi→IDj to A and adds (1,IDi,skIDi) and (IDi,IDj,rkIDi→IDj,1) to KList and RKList, respectively. If β=0, B first selects a random θ∈GT and computes rk1,rk2,rk3 as the Encrypt algorithm. Next B computes rk4=σ,rk5=ϕ1,rk6=ϕ2,rk7=e(g,h)H(θ) for randomly chosen σ∈Zp,ϕ1,ϕ2∈G. B forwards the reencryption key to A and adds (IDi,IDj,rkIDi→IDj,0) to RKList.(3)
Challenge: once A has decided that query phase 1 is over, it outputs two equal length plaintexts (m0,m1) and a challenge identity ID∗. If (1,ID∗) exists in KList, B outputs a random bit and aborts. Else if α=ID∗, B uses α to solve the q-DDHE problem. Else B generates a random bit b∈{0,1} and computes a private key (rID∗,hID∗) as in phase 1. Let f2(x)=xq+2 and F2,ID∗(x)=(f2(x)-f2(ID∗))/(x-ID∗); B sets (16)C1∗=gf2α-f2ID∗,C2∗=T·∏i=0qgF2,ID∗,i·αi,C3∗=mbeC1∗,hID∗·eg,C2∗rID∗,whereF2,ID∗,i is the coefficient of xi in F2,ID∗(x). It sends the challenge ciphertext (C1∗,C2∗,C3∗) to A.Note that, lets∗=F2,ID∗(α). If T=Aq+1=gαq+1, we have (17)C1∗=gf2α-f2ID∗=gF2,ID∗α·α-ID∗=g1s∗g-s∗·ID∗,C2∗=T·∏i=0qgF2,ID∗,i·αi=gαq+1·∏i=0qgF2,ID∗,i·αi=gf2α-f2ID∗/α-ID∗=gF2,ID∗α=gs∗C3∗=mbeC1∗,hID∗·eg,C2∗rID∗=mbeg1s∗g-s∗·ID∗,hID∗·eg,gs∗rID∗=mb·eg,h-s∗.Thus,(C1∗,C2∗,C3∗) is a valid ciphertext for (ID∗,mb).(4)
Query phase 2: A continues querying as in the query phase 1 except for the restrictions described in the IND-CPA game.(5)
Guess: A outputs the guesse b′∈{0,1}. If b′=b, B outputs 1 meaning T=gαq+1; else output 0 meaning T is a random value in G.
Probability Analysis. If B does not abort, A’s view is identical to the actual scheme. Abort is defined to be the event of B′s aborting during the simulation of Extract query. Let qe denote the total number of Extract queries; we have Pr[¬Abort]≥δqe·(p-1/p)qe≜ξqe≥ξqe(1-ξ), which is maximized at δopt=qe/(1+qe). Using δopt, the probability Pr[¬Abort] is at least 1/e˙(1+qe), where e˙ is the base of the nature logarithm. Therefor, we have ε′≥ε/e˙(1+qe).
This completes the proof of Theorem5.Theorem 6.
Our proposed scheme is IND-SH-CPA secure in the information theoretic sense.Proof.
Since a source identityIDi is not included in a destination ciphertext, Theorem 6 is clearly satisfied. (R1,R2,R3,C3′~,C3~) as R1=g1Δt′g-Δt′·IDj, R2=gΔt′, R3=θ·e(g,h)-Δt′, C3′~=e(g,h)Δt·H(θ), and C3~=m·e(g,h)-Δt, where IDj is a destination ciphertext, namely, a part of source ciphertext C3 is randomized using a random value t. More precisely, for CIDj=(R1,R2,R3,C3′~,C3~) and all identity ID, there exists a ciphertext CID=(g1sg-s·ID,gs,m·e(g,h)-s) which can be a source ciphertext of CIDj.
This completes the proof of Theorem6.


## 4. Performance and Comparison

### 4.1. Efficiency Theoretical Analysis

To compare the performance of our scheme, we choose the existing source hiding IB-PRE scheme [22] as the base. We make the comparison in the aspect of the public/private key size, reencryption key size, level 1/level 2 ciphertext size, reencryption key generation cost, reencryption cost, and security model. Table 1 illustrates the detailed comparison. To construct a fair comparison, we choose Emura, Miyaji, and Omote’s first scheme denotes EMO 1 scheme [22], which is also CPA secure with source hiding. Let ce, cp represent the computational cost of an exponentiation and a pairing cost, respectively, Zp,G,GT denote the bit-length of an element in Zp,G,GT, respectively, and |H| denotes the size of a hash function.Table 1
Efficiency and security comparison.
Schemes EMO scheme [22] Our IB-PRE scheme Public/Private 2 G + 2 H 2 G + G T + H key size /Zp /Zp  Re-encryption key size 2 G + G T 4 G + 2 G T + Z p  Level 1/Level 2 G + G T 2 G + G T ciphertext size /2G+2GT /2G+3GT  Rekey generation/ 3 c e + c p 7 c e Re-encryption cost /4ce+3cp /7ce+3cp  Without RO? × ✓  Collusion resistant × ✓From Table1, we found that, although the ciphertext size of our scheme is a little larger than the scheme of [22] in terms of the computational cost. However, the computational cost is the same order of magnitude. Most of important, our scheme is collusion resistant and without relying on random oracle.


### 4.2. Execute Time

Now we compare the proposed scheme with the existing source hiding IB-PRE scheme [22] regarding the execute time. For the scheme implementation, we use the Pairing Based Cryptography Library [26] to calculate the implementation time. Our Hardware is Intel(R) Core(TM) i5-8250U CPU @ 1.60GHZ 8GB RAM. The operation system is Linux Mint 18.1 Serena and programming language is GO 1.9. The elliptic curve Y2=X3+X and the group order is 160 bits which are selected for the experiment. In our experiment we run each experiment for 20 times to obtain the average execution time.From Table2, it is observable that the execution time of KeyGen, Enc, RKeyGen, ReEnc, Dec(Or), and Dec(Or) of our scheme is a little more than scheme [22]. This coincides with the theoretical analysis.Table 2
Execute time comparison.
Algorithms KeyGen Enc RKenGen ReEnc Dec(Or) Dec(Re) (ms) (ms) (ms) (ms) (ms) (ms) scheme [22] 3.279 4.662 6.441 4.971 5.082 6.506  Our scheme 3.795 5.103 6.061 9.017 5.602 7.032


## 4.1. Efficiency Theoretical Analysis

To compare the performance of our scheme, we choose the existing source hiding IB-PRE scheme [22] as the base. We make the comparison in the aspect of the public/private key size, reencryption key size, level 1/level 2 ciphertext size, reencryption key generation cost, reencryption cost, and security model. Table 1 illustrates the detailed comparison. To construct a fair comparison, we choose Emura, Miyaji, and Omote’s first scheme denotes EMO 1 scheme [22], which is also CPA secure with source hiding. Let ce, cp represent the computational cost of an exponentiation and a pairing cost, respectively, Zp,G,GT denote the bit-length of an element in Zp,G,GT, respectively, and |H| denotes the size of a hash function.Table 1
Efficiency and security comparison.
Schemes EMO scheme [22] Our IB-PRE scheme Public/Private 2 G + 2 H 2 G + G T + H key size /Zp /Zp  Re-encryption key size 2 G + G T 4 G + 2 G T + Z p  Level 1/Level 2 G + G T 2 G + G T ciphertext size /2G+2GT /2G+3GT  Rekey generation/ 3 c e + c p 7 c e Re-encryption cost /4ce+3cp /7ce+3cp  Without RO? × ✓  Collusion resistant × ✓From Table1, we found that, although the ciphertext size of our scheme is a little larger than the scheme of [22] in terms of the computational cost. However, the computational cost is the same order of magnitude. Most of important, our scheme is collusion resistant and without relying on random oracle.


## 4.2. Execute Time

Now we compare the proposed scheme with the existing source hiding IB-PRE scheme [22] regarding the execute time. For the scheme implementation, we use the Pairing Based Cryptography Library [26] to calculate the implementation time. Our Hardware is Intel(R) Core(TM) i5-8250U CPU @ 1.60GHZ 8GB RAM. The operation system is Linux Mint 18.1 Serena and programming language is GO 1.9. The elliptic curve Y2=X3+X and the group order is 160 bits which are selected for the experiment. In our experiment we run each experiment for 20 times to obtain the average execution time.From Table2, it is observable that the execution time of KeyGen, Enc, RKeyGen, ReEnc, Dec(Or), and Dec(Or) of our scheme is a little more than scheme [22]. This coincides with the theoretical analysis.Table 2
Execute time comparison.
Algorithms KeyGen Enc RKenGen ReEnc Dec(Or) Dec(Re) (ms) (ms) (ms) (ms) (ms) (ms) scheme [22] 3.279 4.662 6.441 4.971 5.082 6.506  Our scheme 3.795 5.103 6.061 9.017 5.602 7.032


## 5. Conclusions

In this paper, we introduced a new source hiding identity-based proxy reencryption scheme (SHIB-PRE) which is proposed to support a gateway of the wireless network to directly convert a user’s encrypted data (encrypted pollution data) to a new user’s encrypted data without exposing the underlying plaintext data during the whole sharing phase. Additionally, our SHIB-PRE scheme addresses the open problems left by Emura, Miyaji, and Omote [22] by presenting collusion resistant, source hiding, and against chosen ciphertext-plaintext attack secure in the standard model. Still, interesting questions are remained to be resolved and can be our future work, such as the following:CCA-Secure.Designing a source hiding IB-PRE scheme that is chosen ciphertext secure is necessary. The technique described in [27] might be the potential approach to achieve CCA-secure.Key-Private IB-PRE.The property of source hiding protects the source identity from a destination ciphertext. It will be challenging to design a key-private IB-PRE, in which a source identity and a destination identity are not disclosed from a reencryption key. The technique presented in [28] could be the potential approach to achieve a key-private IB-PRE scheme.



---

*Source: 6395362-2018-10-17.xml*