# A Remote Attestation Mechanism Using a Threshold Ring Signature for a Perception Layer of Distributed Networking

Authors: Jing Huang; Jia Chen; Hui-Juan Zhang; Zhe-Yuan Sun; Shen He
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Due to the emergence of various new technologies, Internet of things (IoT) is gradually becoming one of the most valued technologies at present. The IoT makes our life more and more convenient through the interconnection of everything, but the IoT brings many advantages and also raises some security issues, such as the IoT perception layer as the main means of sensing data delivery, due to the limited resources of sensing nodes and their vulnerability, the diversity of sensing data, and the heterogeneity of the sensing network, making the IoT perception layer more vulnerable to various malicious attacks. Therefore, guaranteeing the trustworthy source of sensing data is the cornerstone to guarantee the secure operation of the sensing layer. In this paper, we investigate the remote proof scheme applicable to the IoT perception layer and propose a remote attestation mechanism using a threshold ring signature for a perception layer of distributed networking, which realizes the trusted proof of a data source and thus can effectively discern the trusted status of the data source, and prove that the proposed scheme in this paper outperforms other remote proof schemes through efficiency analysis and verify the correctness as well as the effectiveness of the scheme in this paper.


---

## Body

## 1. Introduction

The Internet is the “bridge” between the real world and the information world [1]; in the age of interconnection, there are tens of thousands of equipment for information interaction moment-by-moment [2]. As the kernel of the IoT, the perception layer is mainly responsible for the acquisition and transmission of massive interaction information.An IoT sensing network is a wireless self-organized network formed by a large number of sensing nodes. The main function of the Internet of things perception network is to perceive and collect relevant information in a certain area and to distribute and transmit the collected information through collaborative transmission between nodes. The nodes in the perception network can be divided into ordinary perception nodes, data aggregation nodes, and management nodes according to their different functions [3]. Among them, ordinary sensing nodes are mainly responsible for collecting and transmitting environmental data in the area. The data aggregation node summarizes the data collected by the sensing node and performs certain calculation processing. The management node makes a unified judgment and identification on the data collected by the sink node through a certain strategy. Generally speaking, the data processing ability of the sensor node is weak, but it should have a certain information perception ability. The data aggregation node should have stronger data processing and storage capabilities. The management node is connected to the data aggregation node through an external network and performs application control on the sensing network.On the one hand, the Internet of things perception network is similar to traditional networks in terms of networking and communication methods. On the other hand, it also has many characteristics that traditional networks do not have. It can complete functions that traditional networks cannot do, but at the same time, these characteristics also bring many security problems to the perception network. The characteristics of the sensing network of the Internet of things are as follows: sensing network nodes being distributed in a wide area, sensing network dynamic adaptability needs, and sensing network node resources being limited. Because the communication of the sensing layer node is easily eavesdropped and the resources are limited, it is not suitable for some highly complex cryptographic algorithms; with the evolution of attack methods, the sensing node is facing a huge security risk. Once the sensing node is destroyed, being controlled by criminals will cause the loss and tampering of important data, resulting in irreparable losses. The security issues facing the perception layer of the Internet of things include the following: node malicious control, illegal information capture, network DoS attacks, and counterfeiting attacks; e.g., in October 2016, a massive network outage occurred on the East Coast of the U.S., which was caused by a DDoS attack launched by a camera acting as a broiler [4], so it is an urgent issue to ensure the reliability of the perception nodes [5]. Currently, to cope with the security problems of the perception layer network, the most important issues in the operation of IoT are the security of nodes and confidentiality and integrity of data, and usually we use password mechanisms, authentication, intrusion detection, etc. to secure the network.At present, remote attestation technology is an important technique for establishing trusted relationships between entities in distributed computing environments [6]. In the direction of proving the state of the perception node platform, the Trusted Computing Group (TCG) proposed a binary remote proof scheme by combining the characteristics of integrity metrics and trusted computing trust chains [7]. The binary remote attestation scheme mainly relies on trusted third parties and uses the trusted third parties to store the standard metric values of trusted platforms. However, how to ensure the reliability of the third party is the main bottleneck. International Business Machines (IBM) Corporation implemented a prototype system for direct attestation of a perception node state using the binary remote proof approach [8], which meets the remote attestation requirements of TCG specification. Nevertheless, this proposed prototype system by IBM suffers from platform configuration exposure.In summary, the simple remote proof scheme described above uses the metric as the state flag of the system; however, this mechanism has some problems, such as management difficulties due to the complexity and volatility of the system and security problems caused by the digital signature of the AIK as a metric. The TCG-based remote proof mechanism also suffers from the inability to perform dynamic proofs and the inability to resist the use of the AIK as the digital signature of the metric and to resist replay attacks.


## 2. Related Work

In order to solve these problems in the TCG remote proof mechanism, scholars at home and abroad have conducted further in-depth research on remote proofs, such as semantic-based remote proof schemes and attribute-based remote proof schemes, but attribute-based remote proofs still have some defects, such as coarse granularity of attributes, large complexity of attribute mapping, and difficulty of attribute revocation. The literature [9] proposes a trusted proof mechanism based on attribute certificates, with the help of abstracting the attributes commonly owned by computing platforms into certificates containing these attributes; thus, privacy exposure problems can be effectively avoided, and the efficiency of the whole proof process can be improved. Attribute-based proof (PBA) schemes are proposed in the literature [10], which are more manageable than the hash-based proofs proposed in the TCG specification and also provide platform-specific techniques for integrity and identity authentication; although these solutions propose remote authentication and auditing schemes, they are not yet perfect and are not fully applicable to the current state of the IoT perception layer. The literature [11] proposes a fine-grained attribute-based remote proof mechanism that can accurately portray the security attributes of a platform and is resistant to forgery attacks; however, it is slightly less computationally efficient in terms of the computational efficiency of component attribute proofs, especially for the presence of a large number of components. To overcome the drawbacks of TCG-based remote proof mechanisms, a large number of hybrid remote authentication models have been proposed [12]. The literature [13] proposes a semantic remote authentication model that combines remote proofs with virtual technologies and proposes a complex remote authentication model using language-based virtual machine technology with dynamicity as well as platform independence. The literature [14] proposes a ring signature-based remote proof scheme for attribute configuration that solves the problem of platform configuration leakage in binary proofs, but the scheme adds attribute configuration lists and the mapping of security attributes and configurations in attribute proofs is intractable; also, the update of configuration lists is not efficient. The literature [15] proposed a remote automatic anonymous proof scheme based on trusted computing technology, which achieves the purpose of anonymous proof and protection of its own privacy through ring signature and can effectively avoid the leakage of privacy, but the scheme does not accurately abstract the external platform attribute values from the external attribute certificates. The literature [16] proposed an efficient cluster remote proof mechanism applicable to IoT based on grouping of sensing nodes, by grouping IoT devices to set up management nodes for cluster remote proof represented by management nodes, which has high security against collusion attacks. The literature [17] proposes an automatic audit as well as proof mechanism (FoNAC) for fog nodes to secure the fog layer, FoNAC uses the Trusted Platform Module (TPM 2.0) feature to evaluate and audit the platform integrity of running fog nodes and grant certificates to each fog node after successful security audits, and this scheme can resist replay attacks, forgery attacks, and distributed denial-of-service attacks (DDoS).Therefore, in order to improve the self-adaptive capability and guarantee the anonymity of nodes, a remote attestation mechanism using a threshold ring signature (TRS-TRS) for the perception layer of distributed networking is proposed in this paper. The main contributions of this paper are as follows.(1)
A remote attestation mechanism (RAM), based on the ring signature of the computational Diffie-Hellman (CDH) problem, is established for the perception layer nodes in distributed networking(2)
A TRS strategy is proposed for the perception nodes in different logical groups to identify the trusted state of data sources and guarantee the privacy exposure of perception nodes(3)
The security properties of the proposed TRS-RAM, including the correctness, unconditional anonymity, and unforgeability, are tested to reveal its effectiveness


## 3. Preliminary

### 3.1. Ring Signature

A ring signature allows users to sign in the name of a self-organizing group of users (called a ring) without revealing the identity of the signer. The concept of the ring signature is similar to that of a group signature, which both hides the identity of the signer to a group. However, they are significant differences. The group administrator in the group signature scheme can revoke the anonymity of the group signature, while the group in the ring signature can select and hide the identity of the signer and does not need for any collaboration among users, due to no centralized authority in ring signatures. Therefore, ring signatures can provide higher anonymity and are more suitable for decentralized application scenarios [18].The ring signature consists of three processes: keygen, sign, and verify. Let the public key sequenceR=pk1,⋯,pkn be a ring and Ri=pki; the formal definition of the ring signature is as follows:
(1)
pk,sk⟵KeyGen1λ. The key generation algorithm takes the security parameter λ∈N as the input and the public-private key pair pk,sk of the user as the output(2)
σ⟵Signsk,s,M,R. The signature algorithm takes the user private key sk, location s, message M, and ring R as input and outputs the signature σ, where Rs,sk is a pair of keys output by the key generation algorithm, and R contains more than two public keys and two are different(3)
b⟵VerifyR,M,σ. The verification algorithm takes the ring R, the message M, and the signature σ as input and outputs the verification result of message M under the ring R


### 3.2. Bilinear Mapping

DefineG1=<g1> and G2=<g2> to be multiplicative cyclic groups of order p, p to be a prime number, g1 and g2 to be generators of G1 and G2, respectively, and e:G1×G1⟶G2 to be a computable mapping that is a bilinear mapping if it satisfies the following properties.
(1)
Bilinear: there is a mappinge:G1×G1⟶G2 making all α∈G1,β∈G2,∀x,y∈Z and exists eαx,βy=eα,βxy(2)
Nondegeneracy: there existg1∈G1, g2∈G2, and eg1,g2≠1(3)
Computability: for∀α∈G1,∀β∈G2, there exists an efficient algorithm to compute eg1,g2


### 3.3. CDH Problem

Given the group ofG=<g>, known g, ga, gb, and a,b∈Zp, it is difficult to compute gab, when a,b are unknown.


## 3.1. Ring Signature

A ring signature allows users to sign in the name of a self-organizing group of users (called a ring) without revealing the identity of the signer. The concept of the ring signature is similar to that of a group signature, which both hides the identity of the signer to a group. However, they are significant differences. The group administrator in the group signature scheme can revoke the anonymity of the group signature, while the group in the ring signature can select and hide the identity of the signer and does not need for any collaboration among users, due to no centralized authority in ring signatures. Therefore, ring signatures can provide higher anonymity and are more suitable for decentralized application scenarios [18].The ring signature consists of three processes: keygen, sign, and verify. Let the public key sequenceR=pk1,⋯,pkn be a ring and Ri=pki; the formal definition of the ring signature is as follows:
(1)
pk,sk⟵KeyGen1λ. The key generation algorithm takes the security parameter λ∈N as the input and the public-private key pair pk,sk of the user as the output(2)
σ⟵Signsk,s,M,R. The signature algorithm takes the user private key sk, location s, message M, and ring R as input and outputs the signature σ, where Rs,sk is a pair of keys output by the key generation algorithm, and R contains more than two public keys and two are different(3)
b⟵VerifyR,M,σ. The verification algorithm takes the ring R, the message M, and the signature σ as input and outputs the verification result of message M under the ring R


## 3.2. Bilinear Mapping

DefineG1=<g1> and G2=<g2> to be multiplicative cyclic groups of order p, p to be a prime number, g1 and g2 to be generators of G1 and G2, respectively, and e:G1×G1⟶G2 to be a computable mapping that is a bilinear mapping if it satisfies the following properties.
(1)
Bilinear: there is a mappinge:G1×G1⟶G2 making all α∈G1,β∈G2,∀x,y∈Z and exists eαx,βy=eα,βxy(2)
Nondegeneracy: there existg1∈G1, g2∈G2, and eg1,g2≠1(3)
Computability: for∀α∈G1,∀β∈G2, there exists an efficient algorithm to compute eg1,g2


## 3.3. CDH Problem

Given the group ofG=<g>, known g, ga, gb, and a,b∈Zp, it is difficult to compute gab, when a,b are unknown.


## 4. A Remote Attestation Mechanism Using the Threshold Ring Signature

In this proposed TRS-RAM, first, the perception node can be divided into several logical groups to eliminate the untrustworthy nodes by the trusted metric model and logic grouping. Then, when the perception node needs remote attestation to the external environment, the remote node can be informed of the logical group to which the perception node belongs and cannot trace the real node itself, due to the different logical groups each having different trustworthiness. Based on the above analysis, the proposed TRS-RAM consists of three parts: credibility metric of perception node, trusted logic grouping, and RAM. The specific process is shown in Figure1.
(1)
Credibility metric of perception node: the aggregation node at the regional boundary performs the credit metrics on the perception nodes within the comprehensive metrics, combining the static credibility metrics, dynamic credibility metrics, subjective direct trust, and objective recommendation trust of the perception node(2)
Trusted logic grouping: some perception nodes with similar characteristics can be divided into a trusted group through the trustworthiness logic grouping mechanism. Then, when a node needs to prove to the outside world, it only proves that the perception node belongs to a trusted group, so that its identity and location privacy are not exposed(3)
RAM: the perception nodes are usually managed by the aggregation nodes. Therefore, the perception nodes in different logical groups can sign their trustworthiness information using the TRS strategy. Then, the remote nodes can analyze and judge whether the data source is trustworthy based on the signature verification results. If the data source is abnormal, the remote nodes can refuse interaction to achieve unconditional anonymity and unforgeabilityRemark 1.
Compared with some security mechanisms, the proposed TRS-RAM can efficiently evaluate the credibility of the data source node to ensure that interaction information is more secure and meanwhile guarantee the anonymity of node identity.Figure 1
The scheme of the proposed TRS-RAM.


### 4.1. Construction of TRS-RAM

This part describes the signature parameter establishment, signature, and verification of the TRS-RAM scheme. Choose the large prime cyclic groupG of order P with GT,e:G×G⟶GT as a bilinear mapping. Specify that Hu:0,1∗⟶0,1nu and Hm:0,1∗⟶0,1nm are both secure hash functions in which the bit number of the node unique identification ID and information m is the bit vector of nu and nm. The construction of TRS-RAM is as follows:


#### 4.1.1. The Signature Parameter Establishment of TRS-RAM

Choose arbitrarilyα∈Zp, g2, u′, m′∈G1, nu, and nm, Zp is an integer domain, g is a generating element of G, and ui and mi are the number of bit vectors. g1=ga, U⌢=ui, and M⌢=mi; U⌢ is the bit vector of ui, and M⌢ is the bit vector of mi. For arbitrarily choosing ui,mi∈G, the system master key is ga2 and the relevant parameters are G,Gr,e,g,g1,g2,u′,U⌢,m′,M⌢,Hu,Hm.The perception node is identified as ID, letu=HuID be the bit vector of nu, and Φu⊆1,2,3,⋯,nu is the ith list with ui=1. For randomly selecting random number ru∈Zp, the private key of the node identifier corresponding to ID is
(1)dID=d1,d2=g2au′∏i∈Φuui,gru.


#### 4.1.2. The Signature Process of TRS-RAM

When the system parameters are established, the signature node will sign for the messagem (message m is the credibility of the perception node). For the n perception nodes ID1,ID2,ID3,⋯,IDn in a certain perception layer, the signature identification list of the tt<n nodes is ID1,ID2,ID3,⋯,IDt and the signature identification list of remaining nodes is IDt+1,IDt+2,⋯,IDn; the signature process is as follows:
(1)
The signature nodeIDi arbitrarily chooses si∈Z∗p and sets si as the secret parameter. Then, the signature node IDii=1,2,⋯,t chooses the polynomial fix:
(2)fix=ai,0+ai,1x+⋯+ai,t−1xt−1.LetSi=ai,0, and each IDi gets
(3)Ci,d=gai,dd=0,1,⋯,t−1,where Ci,d can be shared with other signature nodes and si,j=fij. Then, si,j is shared with all nodes except itself (all other members in the signature subset), and record si,i=fii for itself.
(2)
The nodeIDj gets the si,j broadcasted by IDi, and if the left and right sides of equation (4) are equal:
(4)gsi,j=∏d=0t−1Ci,djd,the verification is successful.
(3)
The secret of every nodeIDi is
(5)xi=∑j=1tsj,i.(4)
In the set of signature nodesID1,ID2,⋯,IDt, the private key of the signature node IDi is di,1,di,2. M=HmL,m,t and M⊆1,2,⋯,nm are the list of the bit vectors Mm=1 of m:
(6)σi=di,1m′∏k∈Mmkxiηi,di,2,gxiηi=g2αu′∏k∈ΦIDiukrIDim′∏l∈Mmlxiηi,grIDi,gxiηi=σi1,σi2,σi3,ηi=∏j=1,j≠itjj−imodp,where ηi is the Lagrangian coefficient.
(5)
At each node in the set, for arbitrarily choosingr1,r2,⋯,rn∈Zp, let
(7)Ui=u′∏j∈ΦIDiuj,i=1,2,3,⋯,n.Thus,σ can obtain
(8)σ=∏i=1tσi1∏i=1nUiri,σ12gr1,⋯,σt2grt,grt+1,⋯,grn,∏i=1tσi3,∑i=1tfix.(6)
The final TRS of messagem and the list of nodes ID1,ID2,ID3,⋯,IDn is σ=V,R1,⋯,Rn,Rm,f


#### 4.1.3. Verification of TRS-RAM

The remote node can checkσ=V,R1,⋯,Rn,Rm,f to determine the exception. There are no less than t signed nodes to jointly verify that the generation process of σ=V,R1,⋯,Rn,Rm,f is in the list of nodes ID1,ID2,ID3,⋯,IDn.
(1)
The remote node verifies the error number off and then checks whether Rm is equal to gf0. If it is equal, the remote node continues the following verification process and vice versa; otherwise, it means that the verification is not successful(2)
Then, the remote node judges(9)eV,g=eg1,g2eU1,R1⋯eUn,Rnem′∏l∈Mml,Rm.If the equation is satisfied, it means thatσ=V,R1,⋯,Rn,Rm,f is legitimate and the signature can be accepted; otherwise, the signature is rejected.


### 4.2. Security Analysis of TRS-RAM

To ensure the security of the proposed TRS-RAM, the correctness, anonymity, and unforgeability can be verified.(1)
CorrectnessTheorem 1.
Assuming that all the perception nodes in the setID1,ID2,ID3,⋯,IDn can faithfully execute the signature protocol, the signer can correctly generate a signature for message m. Accordingly, the verifier must also be able to verify it successfully.Proof.
In the proposed TRS-RAM, considering that(10)∑i=1txiηi=f0=∑i=1tfi0=∑i=1tsi,
thus(11)Rm=∏i=1tσi3=g∑i=1txiηi=gf0.☐The signatureσ is calculated:
(12)eV,g=e∏i=1tσi1∏i=1Uiri,g=eg1,g2taeU1rID1+r1⋯UtrIDi+riUt+1rt+1⋯Unrnm′∏l∈Mml∑i=1txiηi,g=eg1,g2teU1,grID1+r1⋯eUn,grnem′∏l∈Mml,g∑i=1txiηi=eg1,g2teU1,R1⋯eUn,Rnem′∏l∈Mml,Rm.From equation (12), it is clear from the above proof process that as long as the signer generates the signature correctly according to the signature protocol, the signer can get a legitimate signature; Theorem 1 is proven.
(2)
AnonymityTheorem 2.
The proposed TRS-RAM has unconditional anonymity; i.e., for the TRS generated by the set of nodesID1,ID2,ID3,⋯,IDn, the probability that an attacker can successfully guess is less than 1/d and thus has unconditional anonymity.Proof.
Considering that(13)fx=∑i=1tfix,where fx is obtained randomly by the set of nodes ID1,ID2,⋯,IDi,⋯,IDt, thus the private secret xi of the signature node is irregular. Moreover, Rt+1,⋯,Rn,Rm in the signature σ are also irregular and cannot expose the relevant features of the real signature node. For Ri and V:
(14)Ri=grIDi+ri,V=g2taU1rID1+r1⋯UtrIDi+riUt+1rt+1⋯Unrnm′∏l∈Mmtf0,where g2a represents the master key, Rii=1,2,⋯,t is irregular and the selection of rID1+r1,⋯,rIDt+rt,⋯,rt+1,⋯,rn,f0 is also chosen irregularly; thus, they are not associated with the real signature node.☐Therefore, assuming that the attacker has unlimited computational power and can intercept the private keys of all signature nodes inID1,ID2,ID3,⋯,IDn at the same time, the probability that the attacker can successfully guess the actual subset of signatures is no more than 1/d in terms of probability; i.e., the attacker cannot trace the subset of signatures in ID1,ID2,ID3,⋯,IDn for a subset of signatures. Therefore, the proposed TRS-RAM satisfies unconditional anonymity. Theorem 2 is proven.
(3)
UnforgeabilityTheorem 3.
By taking the CDH hard problem as a premise, this signature process is unforgeable. Only the specified nodes can produce a correct signature, and the exceptional node or a subset of group node cannot produce a correct signature.Proof.
If attackerA can forge the legitimate signature subset with nonnegligible probability, an algorithm B which is a probabilistic polynomial can be constructed. A can solve the CDH hard problem by invoking B with ζ probability in time t.☐B is the A certain CDH instance g,ga,gb of the presupposed, and it is desired to solve the CDH hard problem by A and subsequently obtain gab, so that B impersonates the challenger of A. It can be divided into various steps as follows.
(1)
System initialization. Letlu+=2qe+qs and lm=2qs, qe represents the number of queries of the private key, and qs represents the number of signature key queries which is queried by A. The ku(0≤ku≤nu) and km0≤km≤nm are arbitrarily selected. lunu+1 and lmnm+1 are less than p. x′∈Zlu is randomly picked and X=xi whose bit number is nu, and xi belongs to Zlu; z′∈Zlm is randomly picked by B and Z=zk whose bit number is nm, and xi belongs to Zlu; x′∈Zluis randomly picked byB and X=xi whose bit number is nu, and zk belongs to Zlm; y′ is randomly picked by B and Y=yi whose bit number is nu, and yi belongs to Zp; and w′ is randomly picked by B and W=wi whose bit number is nm, and wi belongs to ZpFor the bit vectoru=HuID and M=HmL,m,t which are the bit vector of unique identification ID in the perception node list L and signature message, it is specified as follows:
(15)FID=x′+∑i∈Φxi−luku,JID=y′+∑i∈Φyi,KM=z′+∑i∈Mzi−lmkm,LM=w′+∑i∈Mwi.For the proposed TRS-RAM,B can use the parameters:
(16)g1=ga,g2=gb,u′=g2−luku+x′gy′,m′=g2−lmkm+z′gw′,ui=g2xigyi1≤i≤nu,mi=g2zigwi1≤i≤nm.There is no difference between the parameters in equation (16) and the public parameters derived by the attacker. Therefore, ga2=gab and
(17)u′∏i∈Φuui=g2FIDgJID,m′∏i∈Mmk=g2KmgLm,where B can transfer these parameters to A.
(2)
Query. IfA makes a query, B will make a reply. The query can be divided into private key query and signature queryPrivate key query: whenA interrogates the private key of node IDu, even though B cannot know its master key, B can also compute that the private key of node IDu is dIDu, assuming that FIDi≠0modp. B randomly selects ru∈Zp and then yields
(18)dIDu=du1,du2=g1−JID/FIDu′∏i∈Φuuiru,g1−1/FIDgru,r~u=ru−αFID.Thus, it can know thatdIDu is the legal private key of the node identification IDu.
(19)du1=g1−JIDFIDu′∏i∈Φuuiru=g2ag2FIDgJID−a/FIDg2FIDgJIDru=g2ag2FIDgJIDru−a/FID=g2au′∏i∈Φuuiru,du2=g1−1/FIDgru=gru−a/FID=gr̄u.ForA, the private key constructed by B is exactly the same as the private key generated by the real challenger. If Fu=0modp, the above process cannot continue and B cannot succeed.Signature query: first,B needs to compute M=HmL,m,t and then obtains the TRSt,n by the following procedure:
(a)
B arbitrarily selects s,a0,a1,⋯,at−1∈Zp and sets the (t−1)th polynomial fx=a0+a1x+⋯+at−1xt−1,s=a0(b)
The listL=ID1,ID2,⋯,IDn has no less than tIDi,i∈1,2,⋯,n to make that FIDi≠0modp. Assume γ is the set which makes the FIDi≠0modp hold. Then, γ=1,2,⋯,t. B can calculate the private key based on the process of private key query, and then, the private secret xi=fi of all nodes IDi=1,2,⋯,t that perform TRS can be derived. The corresponding gated-ring signature is constructed by the proposed TRS-RAM based on the signature generation processIf the number of nodes in listL which makes FIDi≠0modp is less than t, B can construct a TRS. Let KM≠0modp. Then, B arbitrarily picks r1,⋯,rn,rm∈Zp and can obtain
(20)σ=∏i=1nUirig1−tLM/KMm′∏k∈Mmkrm,gr1⋯,grn,g1−t/KM,grm,fx=g2ta∏i=1nUirim′∏k∈Mmkr̄m,gr1⋯,grn,gr̄m,fx,r̄m=rm−taKM.Thus,σ is valid. If K`M=0modp, then the above process will stop and B fails.
(3)
Forgery. ForL∗=ID∗1,⋯,ID∗n, A can forge the signature σ∗ of TRS for m∗ and threshold value t. B can verify(21)FIDi∗=0modp,i∈1,⋯,n,(22)KMi∗=0modp,Mi∗=HmL,m∗,t,where equations (21) and (22) are not satisfied; B cannot be successful. If both equations are satisfied, B yields
(23)VR1JID1∗⋯RnJIDn∗RmLM∗1/t=g2tau′∏i∈Φ1uir1⋯u′∏i∈Φnuir1m′∏k∈MmjrmgJID1∗r1⋯gJIDn∗rngLM∗rm1/t=g2ta1/t=g2a=gab,where the result is the answer to the difficult question. Therefore, if the probability of an attacker succeeding in forging a legitimate gated-ring signature is nonnegligible, there must be a corresponding algorithm to solve the hard problem. However, this contradicts the assumptions of the discrete logarithm problem. Theorem 3 is proven that the proposed TRS-RAM in this paper is known to be unforgeable.In summary, for the perception layer distributed networking model, thet,n threshold ring signature scheme based on node trusted logical grouping designed in this section under the standard model realizes the trusted proof of the data source, and by analyzing and proving the security of the scheme, it is known that the scheme can effectively protect the privacy information of the proof nodes, has unconditional anonymity, and satisfies the unforgeability, while the signature of the scheme length is short; therefore, the proposed scheme in this paper is secure, efficient, and suitable for perceptive nodes with limited computational resources.Remark 2.
Based on the above analysis, for the distributed networking model of the perception layer, the proposed TRS-RAM can realize the credibility attestation of perception nodes. Moreover, it can be seen that this proposed TRS-RAM can effectively protect the privacy information and has the correctness, unforgeability, and anonymity by analyzing the security of TRS-RAM.Meanwhile, the group signature length of TRS-RAM is short. Therefore, the proposed TRS-RAM in this paper is secure and efficient and more suitable for perception nodes with limited computational resources.


## 4.1. Construction of TRS-RAM

This part describes the signature parameter establishment, signature, and verification of the TRS-RAM scheme. Choose the large prime cyclic groupG of order P with GT,e:G×G⟶GT as a bilinear mapping. Specify that Hu:0,1∗⟶0,1nu and Hm:0,1∗⟶0,1nm are both secure hash functions in which the bit number of the node unique identification ID and information m is the bit vector of nu and nm. The construction of TRS-RAM is as follows:


### 4.1.1. The Signature Parameter Establishment of TRS-RAM

Choose arbitrarilyα∈Zp, g2, u′, m′∈G1, nu, and nm, Zp is an integer domain, g is a generating element of G, and ui and mi are the number of bit vectors. g1=ga, U⌢=ui, and M⌢=mi; U⌢ is the bit vector of ui, and M⌢ is the bit vector of mi. For arbitrarily choosing ui,mi∈G, the system master key is ga2 and the relevant parameters are G,Gr,e,g,g1,g2,u′,U⌢,m′,M⌢,Hu,Hm.The perception node is identified as ID, letu=HuID be the bit vector of nu, and Φu⊆1,2,3,⋯,nu is the ith list with ui=1. For randomly selecting random number ru∈Zp, the private key of the node identifier corresponding to ID is
(1)dID=d1,d2=g2au′∏i∈Φuui,gru.


### 4.1.2. The Signature Process of TRS-RAM

When the system parameters are established, the signature node will sign for the messagem (message m is the credibility of the perception node). For the n perception nodes ID1,ID2,ID3,⋯,IDn in a certain perception layer, the signature identification list of the tt<n nodes is ID1,ID2,ID3,⋯,IDt and the signature identification list of remaining nodes is IDt+1,IDt+2,⋯,IDn; the signature process is as follows:
(1)
The signature nodeIDi arbitrarily chooses si∈Z∗p and sets si as the secret parameter. Then, the signature node IDii=1,2,⋯,t chooses the polynomial fix:
(2)fix=ai,0+ai,1x+⋯+ai,t−1xt−1.LetSi=ai,0, and each IDi gets
(3)Ci,d=gai,dd=0,1,⋯,t−1,where Ci,d can be shared with other signature nodes and si,j=fij. Then, si,j is shared with all nodes except itself (all other members in the signature subset), and record si,i=fii for itself.
(2)
The nodeIDj gets the si,j broadcasted by IDi, and if the left and right sides of equation (4) are equal:
(4)gsi,j=∏d=0t−1Ci,djd,the verification is successful.
(3)
The secret of every nodeIDi is
(5)xi=∑j=1tsj,i.(4)
In the set of signature nodesID1,ID2,⋯,IDt, the private key of the signature node IDi is di,1,di,2. M=HmL,m,t and M⊆1,2,⋯,nm are the list of the bit vectors Mm=1 of m:
(6)σi=di,1m′∏k∈Mmkxiηi,di,2,gxiηi=g2αu′∏k∈ΦIDiukrIDim′∏l∈Mmlxiηi,grIDi,gxiηi=σi1,σi2,σi3,ηi=∏j=1,j≠itjj−imodp,where ηi is the Lagrangian coefficient.
(5)
At each node in the set, for arbitrarily choosingr1,r2,⋯,rn∈Zp, let
(7)Ui=u′∏j∈ΦIDiuj,i=1,2,3,⋯,n.Thus,σ can obtain
(8)σ=∏i=1tσi1∏i=1nUiri,σ12gr1,⋯,σt2grt,grt+1,⋯,grn,∏i=1tσi3,∑i=1tfix.(6)
The final TRS of messagem and the list of nodes ID1,ID2,ID3,⋯,IDn is σ=V,R1,⋯,Rn,Rm,f


### 4.1.3. Verification of TRS-RAM

The remote node can checkσ=V,R1,⋯,Rn,Rm,f to determine the exception. There are no less than t signed nodes to jointly verify that the generation process of σ=V,R1,⋯,Rn,Rm,f is in the list of nodes ID1,ID2,ID3,⋯,IDn.
(1)
The remote node verifies the error number off and then checks whether Rm is equal to gf0. If it is equal, the remote node continues the following verification process and vice versa; otherwise, it means that the verification is not successful(2)
Then, the remote node judges(9)eV,g=eg1,g2eU1,R1⋯eUn,Rnem′∏l∈Mml,Rm.If the equation is satisfied, it means thatσ=V,R1,⋯,Rn,Rm,f is legitimate and the signature can be accepted; otherwise, the signature is rejected.


## 4.1.1. The Signature Parameter Establishment of TRS-RAM

Choose arbitrarilyα∈Zp, g2, u′, m′∈G1, nu, and nm, Zp is an integer domain, g is a generating element of G, and ui and mi are the number of bit vectors. g1=ga, U⌢=ui, and M⌢=mi; U⌢ is the bit vector of ui, and M⌢ is the bit vector of mi. For arbitrarily choosing ui,mi∈G, the system master key is ga2 and the relevant parameters are G,Gr,e,g,g1,g2,u′,U⌢,m′,M⌢,Hu,Hm.The perception node is identified as ID, letu=HuID be the bit vector of nu, and Φu⊆1,2,3,⋯,nu is the ith list with ui=1. For randomly selecting random number ru∈Zp, the private key of the node identifier corresponding to ID is
(1)dID=d1,d2=g2au′∏i∈Φuui,gru.


## 4.1.2. The Signature Process of TRS-RAM

When the system parameters are established, the signature node will sign for the messagem (message m is the credibility of the perception node). For the n perception nodes ID1,ID2,ID3,⋯,IDn in a certain perception layer, the signature identification list of the tt<n nodes is ID1,ID2,ID3,⋯,IDt and the signature identification list of remaining nodes is IDt+1,IDt+2,⋯,IDn; the signature process is as follows:
(1)
The signature nodeIDi arbitrarily chooses si∈Z∗p and sets si as the secret parameter. Then, the signature node IDii=1,2,⋯,t chooses the polynomial fix:
(2)fix=ai,0+ai,1x+⋯+ai,t−1xt−1.LetSi=ai,0, and each IDi gets
(3)Ci,d=gai,dd=0,1,⋯,t−1,where Ci,d can be shared with other signature nodes and si,j=fij. Then, si,j is shared with all nodes except itself (all other members in the signature subset), and record si,i=fii for itself.
(2)
The nodeIDj gets the si,j broadcasted by IDi, and if the left and right sides of equation (4) are equal:
(4)gsi,j=∏d=0t−1Ci,djd,the verification is successful.
(3)
The secret of every nodeIDi is
(5)xi=∑j=1tsj,i.(4)
In the set of signature nodesID1,ID2,⋯,IDt, the private key of the signature node IDi is di,1,di,2. M=HmL,m,t and M⊆1,2,⋯,nm are the list of the bit vectors Mm=1 of m:
(6)σi=di,1m′∏k∈Mmkxiηi,di,2,gxiηi=g2αu′∏k∈ΦIDiukrIDim′∏l∈Mmlxiηi,grIDi,gxiηi=σi1,σi2,σi3,ηi=∏j=1,j≠itjj−imodp,where ηi is the Lagrangian coefficient.
(5)
At each node in the set, for arbitrarily choosingr1,r2,⋯,rn∈Zp, let
(7)Ui=u′∏j∈ΦIDiuj,i=1,2,3,⋯,n.Thus,σ can obtain
(8)σ=∏i=1tσi1∏i=1nUiri,σ12gr1,⋯,σt2grt,grt+1,⋯,grn,∏i=1tσi3,∑i=1tfix.(6)
The final TRS of messagem and the list of nodes ID1,ID2,ID3,⋯,IDn is σ=V,R1,⋯,Rn,Rm,f


## 4.1.3. Verification of TRS-RAM

The remote node can checkσ=V,R1,⋯,Rn,Rm,f to determine the exception. There are no less than t signed nodes to jointly verify that the generation process of σ=V,R1,⋯,Rn,Rm,f is in the list of nodes ID1,ID2,ID3,⋯,IDn.
(1)
The remote node verifies the error number off and then checks whether Rm is equal to gf0. If it is equal, the remote node continues the following verification process and vice versa; otherwise, it means that the verification is not successful(2)
Then, the remote node judges(9)eV,g=eg1,g2eU1,R1⋯eUn,Rnem′∏l∈Mml,Rm.If the equation is satisfied, it means thatσ=V,R1,⋯,Rn,Rm,f is legitimate and the signature can be accepted; otherwise, the signature is rejected.


## 4.2. Security Analysis of TRS-RAM

To ensure the security of the proposed TRS-RAM, the correctness, anonymity, and unforgeability can be verified.(1)
CorrectnessTheorem 1.
Assuming that all the perception nodes in the setID1,ID2,ID3,⋯,IDn can faithfully execute the signature protocol, the signer can correctly generate a signature for message m. Accordingly, the verifier must also be able to verify it successfully.Proof.
In the proposed TRS-RAM, considering that(10)∑i=1txiηi=f0=∑i=1tfi0=∑i=1tsi,
thus(11)Rm=∏i=1tσi3=g∑i=1txiηi=gf0.☐The signatureσ is calculated:
(12)eV,g=e∏i=1tσi1∏i=1Uiri,g=eg1,g2taeU1rID1+r1⋯UtrIDi+riUt+1rt+1⋯Unrnm′∏l∈Mml∑i=1txiηi,g=eg1,g2teU1,grID1+r1⋯eUn,grnem′∏l∈Mml,g∑i=1txiηi=eg1,g2teU1,R1⋯eUn,Rnem′∏l∈Mml,Rm.From equation (12), it is clear from the above proof process that as long as the signer generates the signature correctly according to the signature protocol, the signer can get a legitimate signature; Theorem 1 is proven.
(2)
AnonymityTheorem 2.
The proposed TRS-RAM has unconditional anonymity; i.e., for the TRS generated by the set of nodesID1,ID2,ID3,⋯,IDn, the probability that an attacker can successfully guess is less than 1/d and thus has unconditional anonymity.Proof.
Considering that(13)fx=∑i=1tfix,where fx is obtained randomly by the set of nodes ID1,ID2,⋯,IDi,⋯,IDt, thus the private secret xi of the signature node is irregular. Moreover, Rt+1,⋯,Rn,Rm in the signature σ are also irregular and cannot expose the relevant features of the real signature node. For Ri and V:
(14)Ri=grIDi+ri,V=g2taU1rID1+r1⋯UtrIDi+riUt+1rt+1⋯Unrnm′∏l∈Mmtf0,where g2a represents the master key, Rii=1,2,⋯,t is irregular and the selection of rID1+r1,⋯,rIDt+rt,⋯,rt+1,⋯,rn,f0 is also chosen irregularly; thus, they are not associated with the real signature node.☐Therefore, assuming that the attacker has unlimited computational power and can intercept the private keys of all signature nodes inID1,ID2,ID3,⋯,IDn at the same time, the probability that the attacker can successfully guess the actual subset of signatures is no more than 1/d in terms of probability; i.e., the attacker cannot trace the subset of signatures in ID1,ID2,ID3,⋯,IDn for a subset of signatures. Therefore, the proposed TRS-RAM satisfies unconditional anonymity. Theorem 2 is proven.
(3)
UnforgeabilityTheorem 3.
By taking the CDH hard problem as a premise, this signature process is unforgeable. Only the specified nodes can produce a correct signature, and the exceptional node or a subset of group node cannot produce a correct signature.Proof.
If attackerA can forge the legitimate signature subset with nonnegligible probability, an algorithm B which is a probabilistic polynomial can be constructed. A can solve the CDH hard problem by invoking B with ζ probability in time t.☐B is the A certain CDH instance g,ga,gb of the presupposed, and it is desired to solve the CDH hard problem by A and subsequently obtain gab, so that B impersonates the challenger of A. It can be divided into various steps as follows.
(1)
System initialization. Letlu+=2qe+qs and lm=2qs, qe represents the number of queries of the private key, and qs represents the number of signature key queries which is queried by A. The ku(0≤ku≤nu) and km0≤km≤nm are arbitrarily selected. lunu+1 and lmnm+1 are less than p. x′∈Zlu is randomly picked and X=xi whose bit number is nu, and xi belongs to Zlu; z′∈Zlm is randomly picked by B and Z=zk whose bit number is nm, and xi belongs to Zlu; x′∈Zluis randomly picked byB and X=xi whose bit number is nu, and zk belongs to Zlm; y′ is randomly picked by B and Y=yi whose bit number is nu, and yi belongs to Zp; and w′ is randomly picked by B and W=wi whose bit number is nm, and wi belongs to ZpFor the bit vectoru=HuID and M=HmL,m,t which are the bit vector of unique identification ID in the perception node list L and signature message, it is specified as follows:
(15)FID=x′+∑i∈Φxi−luku,JID=y′+∑i∈Φyi,KM=z′+∑i∈Mzi−lmkm,LM=w′+∑i∈Mwi.For the proposed TRS-RAM,B can use the parameters:
(16)g1=ga,g2=gb,u′=g2−luku+x′gy′,m′=g2−lmkm+z′gw′,ui=g2xigyi1≤i≤nu,mi=g2zigwi1≤i≤nm.There is no difference between the parameters in equation (16) and the public parameters derived by the attacker. Therefore, ga2=gab and
(17)u′∏i∈Φuui=g2FIDgJID,m′∏i∈Mmk=g2KmgLm,where B can transfer these parameters to A.
(2)
Query. IfA makes a query, B will make a reply. The query can be divided into private key query and signature queryPrivate key query: whenA interrogates the private key of node IDu, even though B cannot know its master key, B can also compute that the private key of node IDu is dIDu, assuming that FIDi≠0modp. B randomly selects ru∈Zp and then yields
(18)dIDu=du1,du2=g1−JID/FIDu′∏i∈Φuuiru,g1−1/FIDgru,r~u=ru−αFID.Thus, it can know thatdIDu is the legal private key of the node identification IDu.
(19)du1=g1−JIDFIDu′∏i∈Φuuiru=g2ag2FIDgJID−a/FIDg2FIDgJIDru=g2ag2FIDgJIDru−a/FID=g2au′∏i∈Φuuiru,du2=g1−1/FIDgru=gru−a/FID=gr̄u.ForA, the private key constructed by B is exactly the same as the private key generated by the real challenger. If Fu=0modp, the above process cannot continue and B cannot succeed.Signature query: first,B needs to compute M=HmL,m,t and then obtains the TRSt,n by the following procedure:
(a)
B arbitrarily selects s,a0,a1,⋯,at−1∈Zp and sets the (t−1)th polynomial fx=a0+a1x+⋯+at−1xt−1,s=a0(b)
The listL=ID1,ID2,⋯,IDn has no less than tIDi,i∈1,2,⋯,n to make that FIDi≠0modp. Assume γ is the set which makes the FIDi≠0modp hold. Then, γ=1,2,⋯,t. B can calculate the private key based on the process of private key query, and then, the private secret xi=fi of all nodes IDi=1,2,⋯,t that perform TRS can be derived. The corresponding gated-ring signature is constructed by the proposed TRS-RAM based on the signature generation processIf the number of nodes in listL which makes FIDi≠0modp is less than t, B can construct a TRS. Let KM≠0modp. Then, B arbitrarily picks r1,⋯,rn,rm∈Zp and can obtain
(20)σ=∏i=1nUirig1−tLM/KMm′∏k∈Mmkrm,gr1⋯,grn,g1−t/KM,grm,fx=g2ta∏i=1nUirim′∏k∈Mmkr̄m,gr1⋯,grn,gr̄m,fx,r̄m=rm−taKM.Thus,σ is valid. If K`M=0modp, then the above process will stop and B fails.
(3)
Forgery. ForL∗=ID∗1,⋯,ID∗n, A can forge the signature σ∗ of TRS for m∗ and threshold value t. B can verify(21)FIDi∗=0modp,i∈1,⋯,n,(22)KMi∗=0modp,Mi∗=HmL,m∗,t,where equations (21) and (22) are not satisfied; B cannot be successful. If both equations are satisfied, B yields
(23)VR1JID1∗⋯RnJIDn∗RmLM∗1/t=g2tau′∏i∈Φ1uir1⋯u′∏i∈Φnuir1m′∏k∈MmjrmgJID1∗r1⋯gJIDn∗rngLM∗rm1/t=g2ta1/t=g2a=gab,where the result is the answer to the difficult question. Therefore, if the probability of an attacker succeeding in forging a legitimate gated-ring signature is nonnegligible, there must be a corresponding algorithm to solve the hard problem. However, this contradicts the assumptions of the discrete logarithm problem. Theorem 3 is proven that the proposed TRS-RAM in this paper is known to be unforgeable.In summary, for the perception layer distributed networking model, thet,n threshold ring signature scheme based on node trusted logical grouping designed in this section under the standard model realizes the trusted proof of the data source, and by analyzing and proving the security of the scheme, it is known that the scheme can effectively protect the privacy information of the proof nodes, has unconditional anonymity, and satisfies the unforgeability, while the signature of the scheme length is short; therefore, the proposed scheme in this paper is secure, efficient, and suitable for perceptive nodes with limited computational resources.Remark 2.
Based on the above analysis, for the distributed networking model of the perception layer, the proposed TRS-RAM can realize the credibility attestation of perception nodes. Moreover, it can be seen that this proposed TRS-RAM can effectively protect the privacy information and has the correctness, unforgeability, and anonymity by analyzing the security of TRS-RAM.Meanwhile, the group signature length of TRS-RAM is short. Therefore, the proposed TRS-RAM in this paper is secure and efficient and more suitable for perception nodes with limited computational resources.


## 5. Efficiency Analysis

Table1 shows the time complexity of each operation, comparing the data with the literature reference [19]. Considering the smart terminal with the latest CortexA9 1.2 GHz microprocessor, the time of the quantitative multiplication operation on the elliptic curve is about 0.00195 s. Combining Table 1 with Table 2, it can be seen that the scheme in this section is more efficient than all the existing comparison schemes.Table 1
Comparison of time complexity of various operations.
ComputationalTime complexityScalar multiplication operationS1S≈29MThe addition of pointsA1A≈0.11MThe bilinear pair operationP1P≈87MExponential operationE1E≈21MOrdinary hashing operationhNeglectTable 2
Calculation of the impact of offloading on the signature scheme.
OptionsComputational complexityTotal time spentTimesSolution [20]1S+1E1S+1E≈50M0.0975 sSolution [21]2S+1E2S+1E≈79M0.15405 sOur solution3S+1H3S+1H≈87M0.16965 s


## 6. Conclusions

In this paper, a TRS-RAM was designed to evaluate the credibility of the perception node and protect the autologous identity privacy. The remote attestation process can be accomplished by introducing TRS, which can avoid exposing the privacy of the node. The verifying node can inquire the credibility of the perception node from the management node based on the received signature and can also trace the node when the data is disputed to achieve the dynamic tracking of the node. Moreover, the proposed TRS-RAM has the correctness, unforgeability, and anonymity to effectively guarantee the security of the perception node, and our solution has higher efficiency compared to others. In our future work, some improved TRS mechanisms will be studied for perception nodes to further improve the certification performance.



---

*Source: 6603754-2022-01-22.xml*