# Anonymous Communication via Anonymous Identity-Based Encryption and Its Application in IoT

Authors: Liaoliang Jiang; Tong Li; Xuan Li; Mohammed Atiquzzaman; Haseeb Ahmad; Xianmin Wang
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

Under the environment of the big data, the correlation between the data makes people have a greater demand for privacy. Moreover, the world has become more diversified and democratic than ever before. Freedom of speech is considered to be very important; thus, anonymity is also a very important security demand. The research of our paper proposes a scheme which can ensure both the privacy and the anonymity of a communication system, that is, the protection of message privacy while ensuring the users’ anonymity. It is based on anonymous identity-based encryption (IBE), by which the users’metadata are protected. We implement our scheme in JAVA with Java pairing-based cryptography library (JPBC); the experiment shows that our scheme has significant advantage in efficiency compared with other anonymous communication system. Internet-of-Things (IoT) involves many devices, and privacy of devices is very significant. Anonymous communication system provides a secure environment without leaking metadata, which has many application scenarios in IoT.


---

## Body

## 1. Introduction

In the era of big data, data privacy has become significant as more personal and organizational information is involved. Moreover, the world has become more diversified and democratic than ever before. Following this trend, researchers have unveiled various ways through which adversaries can access private or otherwise sensitive information by network breach such as a called telephone number [1] or the IP address [2]. Therefore, the ultimate objective of privacy is to protect not only the contents of the messages but also the identities of communication parties, the actual time of a communication, and specific user participation during communication. For the above reasons, the research on privacy protection protocols such as anonymous communication system is imperative. In an anonymous communication system, the adversary must not know participant’s identity at any time. Further, the adversary should not know the sending and receiving entities and whether a message is valuable. Overall, such pieces of information are called metadata. The metadata involves crucial private data in the anonymous communication system and it is also a critical parameter of the monitoring for the government and other stakeholders [3]. Anonymous communication system is very practical, and it can be applied to many realistic scenarios. Cloud computing has received more and more attention in recent years, and privacy-preserving and security under cloud environment have become critical issues [4–7], so high-level anonymity is required. In the neural network [8, 9] and secure deduplication [10], the anonymity is also critical.Some private messaging systems are built on previous work [11–14]. However, such schemes do not provide efficient protocols without leaking metadata, which breaches the purpose of anonymous communication systems. There exist two categories of anonymous communication protocols. The first one is called Tor [15], which achieves the anonymity by encrypting the messages in layers under the public key cryptography. Several servers are employed in Tor, and the message is encrypted into a data packet by all servers’ public key in turns (the construction of an onion). The encrypted data package is transmitted by the chain comprised of all servers. As a server receives a data package, it decrypts the data package through its private key and sends the decrypted data package to the next server; each server carries out the decryption operation until the data package is sent to the recipient. Tor is secure as each server knows only its predecessor and successor rather than other servers’ position in the chain; therefore, the servers do not know the specific path of a message’s transmission, which guarantees the anonymity of both the sender and recipient. That is how it offers a practical scheme of identity protection. However, some researchers showed that this scheme cannot defend against the traffic analysis attacks [16–18]. Tor’s hidden service requires that every server must be honest; for instance, the security will be breached if the "first-server" and the "last-server" make a collusion. The second category is based on the DC-net [19, 20], for instance, verdict [21] and dissent [22]. Those schemes work on an N-member group, who can communicate anonymously, and only one group member is allowed to send a valid message in a given round. Each member shares a value secretly with the other N-1 members, which means that each member has N-1 secret values that are shared with the other N-1 members. Then, each member performs XORs operations with the N-1 shared secret values, but the legitimate sender performs the XORs with the N-1 shared secret values along with an additional message to generate ciphertexts that are later broadcast to the other members. Subsequently, each member receives all the ciphertexts and performs XORs operation on the N ciphertexts together to reveal the message. Because all the shared secret values had been XORed twice, they are cancelled out; thus, the message is extracted but without leaking the identity of the sender. In this way, the DC-net can prevent the traffic attack, as the DC-net is built on anytrust model that remains secure until at least one participating server remains honest. However, the recovery of messages must be computed by all the users, which is unrealistic scenario as none of the users could be off-line during underlying process. Hence, the existing methods are vulnerable to the internal dishonest member attacks which can easily break the security. Although, the systems may trace the dishonest member, they cannot exclude the influence of dishonest member during the communication. In summary, these two schemes above are of low-efficiency and the cost of communication is high.In this paper, we propose an efficient anonymous communication scheme that offers higher security while disposing the aforementioned attack. The proposed scheme incorporates anonymous identity-based encryption (IBE) to achieve anonymous communication. In our scenario, more than one message can be sent simultaneously in each round. Meanwhile, each user uses its ID as the public key; we assume that the ID of each user is unique and it must be well known to other users. We set up a bulletin board from where every user could upload or download the ciphertexts directly at specific time during each round. The recovery of the message is based on the decryption by the recipient rather than the cooperations of all the users, so the system does not need the users to be on-line all the time during the communication, which is a remarkable advantage compared with the verdict and dissent. Since every user has to perform the same operation at the same time, the adversary cannot analyze who is the sender and who is the recipient in a given round. This characteristic ensures strong anonymity of the users.The primary contributions of the paper are listed as follows:( 1 ) The user can send and receive the ciphertext during the same round, which means a user can be both a sender and a recipient at the same time. This can improve the efficiency of anonymous communication system.( 2 ) Our scheme allows the users to send or receive more than one valid “ciphertext” (because the message is extracted after decrypting the ciphertext) in each round. There is no limit to the number of communication ciphertexts. It is a huge advantage compared with other anonymous communication systems which are based on DC-net; this characteristic greatly improves the efficiency of anonymous communication system and reduces the cost of communication.( 3 ) In the proposed scheme, some dishonest users are tolerable in the communication, because a single user can successfully recover the message by himself instead of through the cooperation of all the other users.Section3 introduces the basic concepts of bilinear pairing, IBE and anonymous IBE. Section 4 outlines the system architecture and our security goals, and Section 5 describes the specific scheme and its two protocols. Section 6 presents a security analysis of the proposed system.


## 2. Related Work

Anonymous communication system has a high-level demand for security; we may consider a mechanism for entering into the anonymous communication system before starting communication. Users can do anonymous authentication before joining the system [23]; only a legal user can be a member of the system. Anonymous authentication can apply to many areas [24–27]. Besides, we can make an improvement of the storage pattern for users’ messages. We may combine oblivious RAM [28, 29] with our anonymous communication system; oblivious RAM hides the access patterns of data, and it can prevent adversary from speculating sensitive information through users’ access patterns. In the end, we may use other cryptographical techniques [30–33] to enhance the security of our anonymous communication system.


## 3. Preliminaries

This section outlines the anonymous IBE scheme [34], the difference between ordinary IBE and anonymous IBE. Although the identity-based encryption was firstly proposed by Shamir [35], a practical IBE scheme was constructed by Boneh and Franklin in 2001 [36], and after that, many IBE schemes were proposed [37–40]. The conception of anonymous identity-based encryption was firstly proposed in [41]. This section also introduces the basic knowledge of bilinear pairings, which are used to construct the scheme in the following sections.


### 3.1. Bilinear Map

LetG1 be the additive cycle group generated by g and G2 be multiplicative cyclic group. Prime p is the order of G1 and G2. The map e:G1×G1→G2 is called bilinear map, if it satisfies the following properties:( 1 ) Bilinearity: For any P,Q∈G1,a,b∈Z, the following formula holds: e(Pa,Qb)=e(P,Q)ab.(2) Nondegeneracy: The mape does not map all the pairs in the G1×G1 to the generator in G2. If P is the generator of G1, then e(P,P) is the generator of G2.( 3 ) Computability: For any P and Q, there is an algorithm that can compute e(P,Q) efficiently.


### 3.2. IBE

In the IBE scheme, the participating parties include the users and the private key generator (PKG). The identity of the user is considered as the public key that makes IBE different from the traditional public key cryptography. The PKG, which is a trusted third party, generates the private key based on its master key and the user’s identity. Subsequently, the private key is distributed to the corresponding user by the PKG. IBE is advantageous and is widely used for information security protection. Firstly, the key management is easy and efficient, because it does not require distributing public key or revoking the key. Secondly, IBE removes the certificate requirement for the public key of user who participates in the communication. For instance, when Alice wants to send a message to Bob, she uses Bob’s public keyIDBob that is known to each user. Alice encrypts the message with Bob’s identity IDBob rather than querying Bob’s public key from the PKI. This characteristic highlights the purpose of anonymous communication. Suppose that Alice queries Bob’s public key from the PKI; the adversary can easily get information about sender/recipient through the operation of querying, so the security goals are breached. After Bob gets the encrypted message, he decrypts the message with his private key that he gets from the PKG. IBE consists of the following four functions [42]:Setup: inputting security parameter k, returning the public parameter params and the master key msk of the system. The limited plaintext space M, the limited ciphertext space C, and the params are public, and the master key msk is secretly kept by the PKG.Extract: inputting the master key msk and a user’s identity id, generating the corresponding private key skid for id.Encryption: inputting the message m∈M and id, returning the ciphertext c∈C.Decryption: inputting the ciphertext c and the corresponding private key skid for id, returning the plaintext m.


### 3.3. Anonymous IBE

In traditional IBE, since the recipient’s identity is used as the public key, this property may leak the recipient’s identity through the adversary’s analysis of the ciphertexts. In other words, if the user’s identity is leaked, the anonymous communication system is no longer secure. An anonymous IBE scheme must obey two properties:( 1 ) The adversary cannot get any information about the communication parties.( 2 ) The user’s identity cannot be unveiled by the ciphertexts.In this paper, we use the anonymous IBE scheme which is based on bilinear map [34]. Let G1 and G2 be the group of order p; the map e:G1×G1→G2 is the bilinear map, and g is the generator of group G1. σ∈Zp∗, g2∈G1 are randomly selected, and let g1=gσ. The scheme includes four functions as follows:Initialization: choose the public parameters g,g1,g2 and the master key of PKG denoted as σ.Private key generation: the PKG randomly selects r∈Zp∗ and computes the private key for the corresponding recipient; here ID is the recipient’s ID and ID∈Zp∗. (1)d=d1,d2,d3=g2σg1ID·r,gr,gID·rEncryption: suppose a message m∈G2 needs to be encrypted. The sender randomly selects t,s∈Zp∗ and computes the ciphertext. (2)c=c1,c2,c3,c4=eg1,g2t·m,g1IDt+s,g1s,gtDecryption: the recipient uses his own private key d=(d1,d2,d3) to decrypt the ciphertext to obtain the plaintext as follows. (3)m=c1·ed2,c2ed1,c4ed3,c3Suppose that an adversary wants to extract the recipient’s identity ID from the ciphertext, it is obvious from the structure of the ciphertext that the ID can only be extracted through c2=g1ID(t+s) by using c=(c1,c2,c3,c4). Although g1 is a public parameter, but the t,s are randomly selected from the Zp∗ and it is impossible for the adversary to obtain these parameters. Meanwhile, ID(t+s) is the exponent of c2; the computation is complicated.


## 3.1. Bilinear Map

LetG1 be the additive cycle group generated by g and G2 be multiplicative cyclic group. Prime p is the order of G1 and G2. The map e:G1×G1→G2 is called bilinear map, if it satisfies the following properties:( 1 ) Bilinearity: For any P,Q∈G1,a,b∈Z, the following formula holds: e(Pa,Qb)=e(P,Q)ab.(2) Nondegeneracy: The mape does not map all the pairs in the G1×G1 to the generator in G2. If P is the generator of G1, then e(P,P) is the generator of G2.( 3 ) Computability: For any P and Q, there is an algorithm that can compute e(P,Q) efficiently.


## 3.2. IBE

In the IBE scheme, the participating parties include the users and the private key generator (PKG). The identity of the user is considered as the public key that makes IBE different from the traditional public key cryptography. The PKG, which is a trusted third party, generates the private key based on its master key and the user’s identity. Subsequently, the private key is distributed to the corresponding user by the PKG. IBE is advantageous and is widely used for information security protection. Firstly, the key management is easy and efficient, because it does not require distributing public key or revoking the key. Secondly, IBE removes the certificate requirement for the public key of user who participates in the communication. For instance, when Alice wants to send a message to Bob, she uses Bob’s public keyIDBob that is known to each user. Alice encrypts the message with Bob’s identity IDBob rather than querying Bob’s public key from the PKI. This characteristic highlights the purpose of anonymous communication. Suppose that Alice queries Bob’s public key from the PKI; the adversary can easily get information about sender/recipient through the operation of querying, so the security goals are breached. After Bob gets the encrypted message, he decrypts the message with his private key that he gets from the PKG. IBE consists of the following four functions [42]:Setup: inputting security parameter k, returning the public parameter params and the master key msk of the system. The limited plaintext space M, the limited ciphertext space C, and the params are public, and the master key msk is secretly kept by the PKG.Extract: inputting the master key msk and a user’s identity id, generating the corresponding private key skid for id.Encryption: inputting the message m∈M and id, returning the ciphertext c∈C.Decryption: inputting the ciphertext c and the corresponding private key skid for id, returning the plaintext m.


## 3.3. Anonymous IBE

In traditional IBE, since the recipient’s identity is used as the public key, this property may leak the recipient’s identity through the adversary’s analysis of the ciphertexts. In other words, if the user’s identity is leaked, the anonymous communication system is no longer secure. An anonymous IBE scheme must obey two properties:( 1 ) The adversary cannot get any information about the communication parties.( 2 ) The user’s identity cannot be unveiled by the ciphertexts.In this paper, we use the anonymous IBE scheme which is based on bilinear map [34]. Let G1 and G2 be the group of order p; the map e:G1×G1→G2 is the bilinear map, and g is the generator of group G1. σ∈Zp∗, g2∈G1 are randomly selected, and let g1=gσ. The scheme includes four functions as follows:Initialization: choose the public parameters g,g1,g2 and the master key of PKG denoted as σ.Private key generation: the PKG randomly selects r∈Zp∗ and computes the private key for the corresponding recipient; here ID is the recipient’s ID and ID∈Zp∗. (1)d=d1,d2,d3=g2σg1ID·r,gr,gID·rEncryption: suppose a message m∈G2 needs to be encrypted. The sender randomly selects t,s∈Zp∗ and computes the ciphertext. (2)c=c1,c2,c3,c4=eg1,g2t·m,g1IDt+s,g1s,gtDecryption: the recipient uses his own private key d=(d1,d2,d3) to decrypt the ciphertext to obtain the plaintext as follows. (3)m=c1·ed2,c2ed1,c4ed3,c3Suppose that an adversary wants to extract the recipient’s identity ID from the ciphertext, it is obvious from the structure of the ciphertext that the ID can only be extracted through c2=g1ID(t+s) by using c=(c1,c2,c3,c4). Although g1 is a public parameter, but the t,s are randomly selected from the Zp∗ and it is impossible for the adversary to obtain these parameters. Meanwhile, ID(t+s) is the exponent of c2; the computation is complicated.


## 4. Architecture of the System

We describe the details of system entities and system architecture in this section; furthermore, we present the security goals of anonymous communication.


### 4.1. Entities

(i)The users. The users are an imperative part of the system whose privacy must be assured, while the users can communicate with any user in the system. The system can satisfy two kinds of users. The first kind is those who just want to disclose some message anonymously; however, the users of this kind do not want to disclose the identity of the sender even to the recipient, for instance, a journalist wants to disclose a scandal about a politician who has participated in the presidential campaign. The second kind of users want to communicate with someone secretly; the users of this kind do not want anyone to know who is communicating with them, or whether he is involved in this communication. For instance, two executives from a tendering company want to negotiate about the final bidding price though geographical differences.(ii)Bulletin board. The bulletin is provided to the users for uploading and downloading ciphertexts. More precisely, the sender uploads the encrypted message to the bulletin board, and the recipient downloads the message from the bulletin board. But as we mentioned above, the bulletin board is an intermediate source for communication, and there is no need for an interaction between users. Because there is no interaction between users, the adversary cannot know the identities of the communicating parties.(iii)Private key generator (PKG). In the system, the role of PKG is to generate private keys of users against their IDs and we assume that PKG is honest.


### 4.2. Architecture

This section describes the architecture of the system. Each user has a unique identity. The system consist of two components.(1) The Private Key Protocol. This is a protocol for distributing the private keys among the users according to their identity; this part works between the users and PKG. In order to carry out the decryption operation later, the user should obtain its private key before initiating a communication. The PKG generates the private key through users’ identity and its master key for the corresponding users. For instance, Alice’s identity is IDAlice and Bob’s identity is IDBob; the PKG generates private key skAlice for Alice and skBob for Bob. Only by obtaining the private key, the later protocol can proceed. All the users should get their private key in specific time t1.(2) Communicating Protocol. It is the most important part of the system and it contains four operations. The user uses the recipient’s identity as the public key to encrypt the message. For instance, Alice wants to send a message to Bob; Alice uses Bob’s identity IDBob to encrypt the message. The encryption operation should be done in specific time t2. For consideration of senders’ anonymity, every user is required to send at least one message whether the user wants to have a communication or not. After the encryption operation, all the ciphertexts should be uploaded to the bulletin board. The uploading operation should be done in specific time t3. In specific time t4, each user downloads all the ciphertexts on the bulletin board. Since the users did not interact before and also the users do not know whether there is any message belonging to them in this round, all the messages in the bulletin board must be downloaded by each user in order not to miss the message.All the users decrypt all the ciphertexts through its private key in specific timet5. After time t5, one round of communication during all the users is finished, and then the next round of communication can start. The subsequent communication rounds are scheduled as shown in Figure 1. In this paper, we have distinct advantage over the previous works. The advantage is that there is no limit to the number of messages sent by the user in each round, which means that one user can communicate with one or more users at a given round.Figure 1
Scheduling of n rounds of communication.


### 4.3. Security Goal

The system ensures anonymous communication in three aspects.( 1 ) The message’s security: The contents of users’ message need to be protected, it is the basic requirement of a secure system.( 2 ) The sender’s anonymity: Unauthorized users could not determine the identity of sender, so the adversary cannot judge which user sent a message in a given round. In other words, the identity of sender should not be leaked.( 3 ) The recipient’s anonymity: The recipient’s anonymity is to ensure that others cannot judge whether the message is received by a definite recipient. Furthermore, the system is required to guarantee that the adversary cannot extract the recipient’s ID which is used during the process of encryption. Similar to sender’s anonymity, the identity of recipient should not be leaked.The sender’s anonymity and the recipient’s anonymity are the key security goals which are different from the traditional communication system, as the system should not reveal anymetadata about users.


## 4.1. Entities

(i)The users. The users are an imperative part of the system whose privacy must be assured, while the users can communicate with any user in the system. The system can satisfy two kinds of users. The first kind is those who just want to disclose some message anonymously; however, the users of this kind do not want to disclose the identity of the sender even to the recipient, for instance, a journalist wants to disclose a scandal about a politician who has participated in the presidential campaign. The second kind of users want to communicate with someone secretly; the users of this kind do not want anyone to know who is communicating with them, or whether he is involved in this communication. For instance, two executives from a tendering company want to negotiate about the final bidding price though geographical differences.(ii)Bulletin board. The bulletin is provided to the users for uploading and downloading ciphertexts. More precisely, the sender uploads the encrypted message to the bulletin board, and the recipient downloads the message from the bulletin board. But as we mentioned above, the bulletin board is an intermediate source for communication, and there is no need for an interaction between users. Because there is no interaction between users, the adversary cannot know the identities of the communicating parties.(iii)Private key generator (PKG). In the system, the role of PKG is to generate private keys of users against their IDs and we assume that PKG is honest.


## 4.2. Architecture

This section describes the architecture of the system. Each user has a unique identity. The system consist of two components.(1) The Private Key Protocol. This is a protocol for distributing the private keys among the users according to their identity; this part works between the users and PKG. In order to carry out the decryption operation later, the user should obtain its private key before initiating a communication. The PKG generates the private key through users’ identity and its master key for the corresponding users. For instance, Alice’s identity is IDAlice and Bob’s identity is IDBob; the PKG generates private key skAlice for Alice and skBob for Bob. Only by obtaining the private key, the later protocol can proceed. All the users should get their private key in specific time t1.(2) Communicating Protocol. It is the most important part of the system and it contains four operations. The user uses the recipient’s identity as the public key to encrypt the message. For instance, Alice wants to send a message to Bob; Alice uses Bob’s identity IDBob to encrypt the message. The encryption operation should be done in specific time t2. For consideration of senders’ anonymity, every user is required to send at least one message whether the user wants to have a communication or not. After the encryption operation, all the ciphertexts should be uploaded to the bulletin board. The uploading operation should be done in specific time t3. In specific time t4, each user downloads all the ciphertexts on the bulletin board. Since the users did not interact before and also the users do not know whether there is any message belonging to them in this round, all the messages in the bulletin board must be downloaded by each user in order not to miss the message.All the users decrypt all the ciphertexts through its private key in specific timet5. After time t5, one round of communication during all the users is finished, and then the next round of communication can start. The subsequent communication rounds are scheduled as shown in Figure 1. In this paper, we have distinct advantage over the previous works. The advantage is that there is no limit to the number of messages sent by the user in each round, which means that one user can communicate with one or more users at a given round.Figure 1
Scheduling of n rounds of communication.


## 4.3. Security Goal

The system ensures anonymous communication in three aspects.( 1 ) The message’s security: The contents of users’ message need to be protected, it is the basic requirement of a secure system.( 2 ) The sender’s anonymity: Unauthorized users could not determine the identity of sender, so the adversary cannot judge which user sent a message in a given round. In other words, the identity of sender should not be leaked.( 3 ) The recipient’s anonymity: The recipient’s anonymity is to ensure that others cannot judge whether the message is received by a definite recipient. Furthermore, the system is required to guarantee that the adversary cannot extract the recipient’s ID which is used during the process of encryption. Similar to sender’s anonymity, the identity of recipient should not be leaked.The sender’s anonymity and the recipient’s anonymity are the key security goals which are different from the traditional communication system, as the system should not reveal anymetadata about users.


## 5. Anonymous Communication via Anonymous IBE

The scheme consists of two major components: private key generation and anonymous communication. In the presented solution, we construct a general scheme based on anonymous IBE which is provided in Section3.3. G1 and G2 are the groups of order p, and g is the generator of group G1. The map e is bilinear map which satisfies G1×G1→G2. σ∈Zp∗ is the master key of PKG, g2∈G1 are randomly selected, and let g1=gσ. This section describes the construction of these two protocols.


### 5.1. Private Key Generation Protocol

The private keys are generated through the users’ ID by PKG, then PKG distributes those private keys to corresponding users.The details of private key generation protocol are described in Algorithm1, where PKG randomly chooses an integer r∈Zp∗ and uses r to compute the private key k. After the computation, the PKG distributes the private key to the corresponding users.Algorithm 1:Private key protocol.
Input: A user’s identity id, the public parameters g,g1,g2, and the master key σ. Output: The user’s private key k=(k1,k2,k3). The PKG performs the followings: randomly choosesr∈Zp∗; computes the private keyk=(k1,k2,k3)=(g2σg1id⋅r,gr,gid⋅r); sends the private key to the corresponding users at specific timet1;


### 5.2. Anonymous Communication Protocol

In our scheme, the anonymous communication protocol contains four steps as presented in Figure2. The steps include encryption, uploading, downloading, and decryption. The protocol is performed collaboratively by the users and the bulletin board.Figure 2
The four steps of anonymous communication protocol: ① Encryption, ② Upload, ③ Download, ④ Decryption.In the anonymous communication protocol, each useru needs to encrypt his message to generate the ciphertext c=(c1,c2,c3,c4). He first randomly selects t,s∈Zp∗. Here, m is the message which needs to be encrypted, id is the recipient’s ID, SignSenderid is the signature of sender’s identity. As we mentioned in Section 4.1, our system can satisfy two kinds of users. If the sender wants the recipient to know where the message is from, the signature can be attached together with the message m. Otherwise, the signature is not necessary to be transmitted. Subsequently, the encrypted message c can be uploaded to the bulletin board. At this step, each user is required to upload at least one encrypted message whether he wants to initiate a communication or not. However, if a user wants to communicate with more than one user, it is permitted to upload more than one ciphertext at the same time. When a user wants to get a message, he needs to download all the ciphertexts from the bulletin board without any interaction with the uploaders. Then, the user just needs to use his private key to decrypt the ciphertexts one by one. If the decryption is successfully performed, it means that the message belongs to the user. It should be noted that each user is required to download all the messages on the bulletin board. Since there are no interactions between the users and the bulletin board before the communication, each user has no idea whether the message belongs to him in the process of a communication. In this way, all the users have to participate in the uploading and downloading operations, while the adversary does not know which parties are really involved in a given round. The details of anonymous communication protocol are shown in Algorithm 2.Algorithm 2:Anonymous communication protocol.
( 1 ) Encryption. If the sender just wants to disclose the message anonymously rather than anyone knows where is message from even the recipient, he computes the ciphertextc=(c1,c2,c3,c4)=(e(g1,g2)t⋅m,g1id(t+s),g1s,gt); If the sender wants the recipient to know about its identity, the signatureSignSenderid should be attached with the message m, compute the ciphertext c = ( c 1 , c 2 , c 3 , c 4 ) = ( e ( g 1 , g 2 ) t ⋅ m | | S i g n S e n d e r i d , g 1 i d ( t + s ) , g 1 s , g t ). The Encryption operation should done in specific time t2. ( 2 ) Upload. All the users uploads their ciphertexts c to the bulletin board at the specific time t3. Each user’s ciphertexts c are stored in the bulletin board after this operation. ( 3 ) Download. Each involved users are required to download all the ciphertexts which stored in the bulletin board, each user does theDownload operation at the specific time t4. ( 4 ) Decryption. The user decrypts the ciphertexts c which obtained from the bulletin board in Download operation, one by one through the private keyk in specific time t5. The plaintext is computed as m=c1⋅e(d2,c2)/e(d1,c4)e(d3,c3). If there is a signatureSignSenderid attached with the message m, then the user can get m||SignSenderid.


## 5.1. Private Key Generation Protocol

The private keys are generated through the users’ ID by PKG, then PKG distributes those private keys to corresponding users.The details of private key generation protocol are described in Algorithm1, where PKG randomly chooses an integer r∈Zp∗ and uses r to compute the private key k. After the computation, the PKG distributes the private key to the corresponding users.Algorithm 1:Private key protocol.
Input: A user’s identity id, the public parameters g,g1,g2, and the master key σ. Output: The user’s private key k=(k1,k2,k3). The PKG performs the followings: randomly choosesr∈Zp∗; computes the private keyk=(k1,k2,k3)=(g2σg1id⋅r,gr,gid⋅r); sends the private key to the corresponding users at specific timet1;


## 5.2. Anonymous Communication Protocol

In our scheme, the anonymous communication protocol contains four steps as presented in Figure2. The steps include encryption, uploading, downloading, and decryption. The protocol is performed collaboratively by the users and the bulletin board.Figure 2
The four steps of anonymous communication protocol: ① Encryption, ② Upload, ③ Download, ④ Decryption.In the anonymous communication protocol, each useru needs to encrypt his message to generate the ciphertext c=(c1,c2,c3,c4). He first randomly selects t,s∈Zp∗. Here, m is the message which needs to be encrypted, id is the recipient’s ID, SignSenderid is the signature of sender’s identity. As we mentioned in Section 4.1, our system can satisfy two kinds of users. If the sender wants the recipient to know where the message is from, the signature can be attached together with the message m. Otherwise, the signature is not necessary to be transmitted. Subsequently, the encrypted message c can be uploaded to the bulletin board. At this step, each user is required to upload at least one encrypted message whether he wants to initiate a communication or not. However, if a user wants to communicate with more than one user, it is permitted to upload more than one ciphertext at the same time. When a user wants to get a message, he needs to download all the ciphertexts from the bulletin board without any interaction with the uploaders. Then, the user just needs to use his private key to decrypt the ciphertexts one by one. If the decryption is successfully performed, it means that the message belongs to the user. It should be noted that each user is required to download all the messages on the bulletin board. Since there are no interactions between the users and the bulletin board before the communication, each user has no idea whether the message belongs to him in the process of a communication. In this way, all the users have to participate in the uploading and downloading operations, while the adversary does not know which parties are really involved in a given round. The details of anonymous communication protocol are shown in Algorithm 2.Algorithm 2:Anonymous communication protocol.
( 1 ) Encryption. If the sender just wants to disclose the message anonymously rather than anyone knows where is message from even the recipient, he computes the ciphertextc=(c1,c2,c3,c4)=(e(g1,g2)t⋅m,g1id(t+s),g1s,gt); If the sender wants the recipient to know about its identity, the signatureSignSenderid should be attached with the message m, compute the ciphertext c = ( c 1 , c 2 , c 3 , c 4 ) = ( e ( g 1 , g 2 ) t ⋅ m | | S i g n S e n d e r i d , g 1 i d ( t + s ) , g 1 s , g t ). The Encryption operation should done in specific time t2. ( 2 ) Upload. All the users uploads their ciphertexts c to the bulletin board at the specific time t3. Each user’s ciphertexts c are stored in the bulletin board after this operation. ( 3 ) Download. Each involved users are required to download all the ciphertexts which stored in the bulletin board, each user does theDownload operation at the specific time t4. ( 4 ) Decryption. The user decrypts the ciphertexts c which obtained from the bulletin board in Download operation, one by one through the private keyk in specific time t5. The plaintext is computed as m=c1⋅e(d2,c2)/e(d1,c4)e(d3,c3). If there is a signatureSignSenderid attached with the message m, then the user can get m||SignSenderid.


## 6. Security Analysis

As we mentioned in Section4.3, there are three aspects of security goals needed to be achieved: the message’s security, the sender’s anonymity, and the recipient’s anonymity, and we will analyze the system security as follows.Every message is encrypted before uploading and the encryption scheme we used can ensure the message’s security. The security of encryption scheme we used in our construction had been proved in [34], this encryption scheme can defend against an arbitrary CPA adversary while maintaining anonymity.In traditional public key cryptography, there is usually a public key infrastructure (PKI), and the sender needs to query the recipient’s public key before initiating a communication. In this process, the user who does the operation of querying is likely to be the sender who wants to initiate a communication, and the public key to be queried likely belongs to the recipient. In our scheme, the sender no more needs to query the recipient’s public key (because the public key is recipient’s identity which is known to each user). On the other hand, although the recipient’s identity is used as the public key, the anonymous IBE ensures that the adversary cannot extract the recipient’s identity from the ciphertext. Since all the users perform the operation of uploading at timet3 and download the same amount of ciphertexts at time t4, the adversary cannot know which user has the intention to participate in a communication through the operations of uploading and downloading. Obviously, our scheme can guarantee the anonymity of both the sender and recipient.


## 7. Evaluation

In this section, we evaluate the performance of our scheme, which has been implemented in JAVA with Java pairing-based cryptography library (JPBC). All experiments were conducted on a PC with a CPU 2.13 GHz, 6 GB of RAM. In our implementation, a message’s length was set as 128 bytes, and the time consumption of uploading and downloading was ignored.


### 7.1. Computational Consumption

We implemented our scheme in one message and executed 1000 rounds. The computational consumption includes three operations: private key generation, encryption, and decryption. Under the fiber configuration of 100 Mpbs, the cost of uploading and downloading is negligible. We calculate the time cost as in Figure3. It takes approximately 3.6×104 ms to perform the private key generation operation for 1000 rounds, 1.12×105 ms to perform the encryption operation for 1000 rounds, and 1.62×102 ms to perform the decryption operation for 1000 rounds.Figure 3
Computational consumption.


### 7.2. Communication Consumption

Our scheme has no limit for the number of messages in a round, it is a significant advantage compared with other anonymous communication systems which can send only one message in a round. There are common scenarios; for example, a user wants to communicate with more than one person, or more than one user wants to send message. In the anonymous communication system which limits the number of messages, users have to wait for several rounds. But, in our scheme, all users can send an arbitrary number of messages in a round. This property enhances the efficiency of communication and reduces the cost of communication. Figure4 shows the communication consumption of our scheme and the anonymous communication system which limits the number of messages.Figure 4
Communication consumption.


## 7.1. Computational Consumption

We implemented our scheme in one message and executed 1000 rounds. The computational consumption includes three operations: private key generation, encryption, and decryption. Under the fiber configuration of 100 Mpbs, the cost of uploading and downloading is negligible. We calculate the time cost as in Figure3. It takes approximately 3.6×104 ms to perform the private key generation operation for 1000 rounds, 1.12×105 ms to perform the encryption operation for 1000 rounds, and 1.62×102 ms to perform the decryption operation for 1000 rounds.Figure 3
Computational consumption.


## 7.2. Communication Consumption

Our scheme has no limit for the number of messages in a round, it is a significant advantage compared with other anonymous communication systems which can send only one message in a round. There are common scenarios; for example, a user wants to communicate with more than one person, or more than one user wants to send message. In the anonymous communication system which limits the number of messages, users have to wait for several rounds. But, in our scheme, all users can send an arbitrary number of messages in a round. This property enhances the efficiency of communication and reduces the cost of communication. Figure4 shows the communication consumption of our scheme and the anonymous communication system which limits the number of messages.Figure 4
Communication consumption.


## 8. Conclusions

In this paper, we address a communication system which aims to protect the users’metadata. To solve this problem, we propose an anonymous communication system based on anonymous IBE. Our scheme has significant advantage in efficiency compared with previous work and can also offer strong anonymity. In the future, we will consider the user authentication and the application scenario in the smart environment.



---

*Source: 6809796-2018-11-21.xml*