# Information Security Protection of Internet of Energy Using Ensemble Public Key Algorithm under Big Data

Authors: Baode Lin; Zhenwei Geng; Fengrong Yu
Journal: Journal of Electrical and Computer Engineering
 (2023)

---

## Abstract

This work aims to solve the specific problem in the Power Internet of Things (PIoT). PIoT is vulnerable to monitoring, tampering, forgery, and other attacks during frequent data interaction under the background of big data, leading to a severe threat to the power grid’s Information Security (ISEC). Cryptosystems can solve ISEC problems, such as confidentiality, data integrity, authentication, identity recognition, data control, and nonrepudiation. Thereupon, this work expounds on cryptography from public-key encryption and digital signature and puts forward the model of network information attack. Then, the security of the two cryptograms is certified against the two cyberattack modes. On this basis, an Identity-based Combined Encryption and Signature (IBCES) ensemble scheme is proposed by combining public-key encryption with the digital signature. Finally, the security of the proposed IBCES’s encryption and the signature schemes is verified, and the results prove their feasibility. The results show that the proposed IBCEs are effective and feasible, fully meeting the information confidentiality requirements. Additionally, smart grid against Information Security (ISEC) algorithms must comprehensively consider network resources and computing power. This work creatively combines the two cryptosystems. The proposal breaks the traditional key segmentation principle by applying the same key to different cryptosystems and ensures the independent security of the two cryptosystems. The conclusion provides technical support for future research on cryptography.


---

## Body

## 1. Introduction

The Power Internet of Things (PIoT) was born as a highly intelligent modern power system in the era of big data based on the Internet of Things (IoT). It uses the most advanced electronic technology, sensing technology, and modern information and communication technology to achieve credibility, effectiveness, safety, and environmental friendliness [1]. Unlike the traditional power grid, the PIoT features two-way communication between smart meters and traditional meters and data systems [2]. To this end, the PIoT system must monitor the power signal in real-time and ensure the Electrical Supply System’s (ESS) stability [3]. However, online message exchange also implants threats into the smart grid, such as monitoring, tampering, and counterfeiting [4, 5]. At the same time, with the wide application of new technologies follows more cybersecurity vulnerabilities [6]. Therefore, one of the main objectives of the smart grid is to collect users’ power consumption messages for the personal information management center [7]. The information transmission is susceptible to cyberattacks. For example, some malware uses users’ power consumption messages for intelligent theft and monitoring [8]. In order to ensure safe communication between the smart meter and Magnetic Domain Matrix Signal (MDMS), the confidentiality and authentication of communication messages in the smart grid have become a hot topic in recent discussion [9]. Indeed, a more secure key communication protocol is needed to address the above problems [10]. As a result, many terms have been coined in cybersecurity fields. As an illustration, the Combined Public Key (CPK) is an encryption algorithm to obtain large-scale encryption with minimal resources [11]. In particular, network resources and computing power must be given full consideration [12] alongside communication delays to realize instant messaging [13].Thereupon, against Information Security (ISEC), this work expounds on the Public Key Encryption (PKE) and digital signature systems and defines their importance in maintaining network ISEC. Then, it puts forward an Identity-based Combined Encryption and Signature (IBCES) ensemble scheme by combining encryption and signature. Finally, the security certification of IBCES is carried out from the encryption and signature schemes, respectively. The results clarify the proposed IBCES scheme’s feasibility and prove that the power grid ISEC has been protected. The proposed IBCES algorithm plays a positive role in the ISEC protection in PIoT. The innovation of this work on ISEC is to combine the two passwords, which changes the traditional principle of key segmentation. Even different cryptosystems can use the same key pair and ensure that the passwords of different systems are independent and secure. The finding has made a certain contribution to developing ISEC.This work first analyzes and summarizes the current situation of ISEC in and out of China and introduces the concepts of the PKE system and digital signature system. Then, it analyzes the security target and attack model of the PKE system, the security target, and attack model of the digital signature system and designs the IBCES scheme. Finally, the security and performance of the IBECS are proved and analyzed.


## 2. Literature Review

The integrity of information, user authentication, and privacy protection are the key issues to protecting the security of the smart grid. More scholars are committed to creating a secure communication environment. Ki-Aries et al. proposed an authentication system using tamper-proof equipment. The protocol had two main purposes: to protect user privacy and smart grid authentication and to detect illegal users [14] ultimately. This system adopted the message authentication code mode based on hash, and the authentication process was swift. However, the proposed protocol could only realize one-way authentication between smart appliances and smart meters and did not consider the authentication between smart meters and Meter Database Management System (MDMS). Shulha et al. proposed broadcast communication and broadcast authentication in a smart grid [15]. A one-time signature technology was used based on broadcast authentication in broadcast communication. The proposed signature technology had unique advantages, including short authentication time and low computing costs. Meanwhile, the existing method demanded high bandwidth and storage overhead. Therefore, a new one-time signature technology was proposed to address the limited environmental issues in the smart grid. Yang et al. designed an effective security protocol to simultaneously realize mutual authentication and confidentiality by using symmetric encryption [16]. The protocol adopted the traditional symmetric encryption system to process messages quickly, ensuring the real-time characteristics of the smart grid. However, in the proposed protocol, key exchange was required between smart meters and MDMS and between smart meters. Therefore, the proposed protocol had become a difficult problem for exchanging and distributing keys flexibly. On the other hand, the protocol used a chain topology to transmit data for the smart meter and reduced the communication delay. The proposed key had some disadvantages: using the smart meter as a node would increase the instability of the whole power grid. Inserting and deleting a node in the topology would regenerate the authentication key and session key, which would cause an excellent maintenance cost.The combination of the PKE system (key generation 1, encryption, and decryption) and public key signature system (key generation 2, signature, and verification) is the CPK cryptosystem (key generation, encryption, decryption, signature, and verification). Here, the encryption and decryption algorithms are the original algorithms of the PKE system before combination [17]. Similarly, the signature and verification algorithm is the original algorithm of the precombination public-key signature system. The key generation algorithm is obtained by combining the key generation algorithm of the encryption system and signature system. Regarding the CPK cryptosystem, Li et al. gave its security definition. Suppose that the signature part of a CPK cryptosystem could access the decryption Oracle. In that case, it could ensure the antiexistential forgery under the adaptive selection message attack. The encryption part of the CPK cryptosystem could ensure indistinguishability under the adaptive selection ciphertext attack. When the above two statements held true, the CPK cryptosystem was secure [18]. Ali et al. proposed the attribute-based CPK cryptosystem and gave the security model. Additionally, they also gave the construction method of using a key pair to realize the three cryptosystems of encryption, decryption, and signature by using the attribute-based CPK cryptosystem [19].At present, the security of the CPK cryptosystem has been proved, and the previous research generally has the defects of low computational efficiency and high communication cost. Therefore, based on the previous research, this work further analyzes the ISEC of the PIoT and tries to devise a new method based on the CPK cryptosystem, namely, the Identity-based Combined Encryption and Signature (IBCES) scheme.


## 3. Materials and Methods

### 3.1. Basic Concepts of the PKE System

In 1976, Diffie and Hellman first proposed the concept of the PKE system [20]. PKE system uses different keys to process messages: public keys and private keys [21]. The public key information is public and can be obtained by users, but the decryptor only owns the private key. PKE system is generally divided into encryption system and signature system. Now, the encryption system is first introduced. PKE schemes generally have three algorithms, as detailed below:(1)
Key generation algorithm generates public-private key pairs. The algorithm inputs the security parameterk and outputs a public key pk and a private key sk. The private key sk cannot be calculated from the public key pk.(2)
Encryption algorithm encrypts messages and generates ciphertext. The algorithm inputs public keypk and plaintext message m and outputs ciphertext c.(3)
Decryption algorithm decrypts the ciphertext and outputs messagem. The algorithm inputs ciphertext c and private key sk and outputs plaintext message m.These algorithms must meet the consistency requirements of the encryption system. Supposec=Encryptpk,m. In that case, m=Decryptsk,m. Encrypt and Decrypt represent the encryption and decryption algorithms, respectively [22]. The communication model of the PKE system is shown in Figure 1.Figure 1
Communication model of PKE system.In Figure1, user A is the sender, and user B is the receiver. The key generator will generate a (PKB, SKB) key pair for user B. PKB is the public key, which everyone can obtain. By comparison, the private key SKB is only known to user B. To send message m to user B, user A first encrypts message m with user B’s public key PKB using the encryption algorithm: c = Encrypt (PKB, m). Here, c is the ciphertext, and Encrypt represents the encryption algorithm. User A sends ciphertext c to user B. After receiving the ciphertext c, user B decrypts the ciphertext c with its private key SKB based on the decryption algorithm: m = Decrypt(SKB, c), where Decrypt stands for the decryption algorithm.


### 3.2. Security Target and Attack Model of PKE System

In order to prove its security, the security goal of the cryptosystem must be clarified first [23]. According to the opponent’s different capabilities and attack targets, the attack modes of the PKE system can include the following three categories: selective plaintext attack, selective ciphertext attack, and adaptive selective secret file attack [24]. Given the security goal and attack and defense modes of the PKE system, people can easily make sense of the security concept of the PKE system. Suppose that a PKE scheme has the Indistinguishability against Adaptive Chosen Ciphertext Attack (IND-CCA2) and meets the polynomial kernel function’s security. In that case, the PKE scheme is deemed secure [25]. Next, the specific proof idea of this definition is given. This is a game between opponent and challenger, which has four stages. Initial stage: challenger C runs the system-established algorithm to generate system parameters and a public/private key pair (pk, sk). C sends pk to opponent A and saves sk. Phase 1: opponent A performs a polynomially bounded decryption query. At this stage, opponent A submits a ciphertext c to challenger C. Challenger C runs the decryption algorithm. If the ciphertext is legal, it returns the message m to A; otherwise, it returns the rejection symbol ⊥. Challenge phase: opponent A decides when to end the decryption query of phase 1 and enter the challenge phase. A generates two plaintexts m0 and m1, of the same length and sends them to C. C randomly selects a bit b ∈ {0, 1} and calculates the ciphertext c∗ = E (pk, mb) of mb. C sends c∗ to A as challenge ciphertext. Stage 2: in this stage, opponent A can perform a polynomial-time decryption query like stage 1. However, opponent A cannot decrypt the ciphertext c∗ at this stage. Guess stage: opponent A obtains useful information by decrypting the query and outputs a bit B b’. If b’ = b, opponent A wins the game. Figure 2 shows a game between opponent A and challenger C.Figure 2
CCA2 security game of PKE system.Figure2 summarizes the whole process of the security game. Suppose that no opponent can win the above game with a nonnegligible advantage in polynomial bounded time. In that case, the PKE has polynomial security under CCA2.


### 3.3. Basic Concepts of the Digital Signature System

Because the signer signs through his own private key and the private key information are only known to the signer, the signature can ensure the signer’s data integrity, confirmation, and nonrepudiation. A digital signature system generally consists of key generation, signature, and verification. The above algorithm needs to meet the consistency requirements [26].The communication model of the digital signature system is illustrated in Figure3.Figure 3
Digital signature communication module.A and B are the sender and the receiver. The key generator generates a key pair: (PKB, SKB) for A, where PKB is the public key, and SKB is the private key. To send message m to B, A needs to encrypt m with the private key to obtain ciphertext c. Then, A sends ciphertext c to B. Upon reception, B decrypts c with the public key to obtain message m.


### 3.4. Security Target and Attack Model of a Digital Signature System

Similar to the PKE system, to verify the security of digital signature methods, there is a need to clarify the security objectives [27]. The digital signature system mainly includes four types of forgery: complete breach, universal forgery, selective forgery, and existential forgery [28].Different opponents have different attack capabilities. The digital signature system mainly includes three attack models: key only attack, known message attack, and adaptive Chosen Message Attack (CMA) [29]. Once the security target and attack model are determined, the security definition can be given to the digital signature system. A digital signature scheme with Existential Unforgeability Against Adaptive Chosen Messages Attack (EUF-CMA) is defined as secure. Figure 4 is the security game between opponent A and Challenger C [30]. The adaptive choice message-based attack game of the digital signature system consists of three stages similar to that in Figure 4.Figure 4
Adaptive CMA game of digital signature system.Figure4 summarizes the entire game process of the signature scheme under the adaptive CMA. Suppose that no opponent wins the game with a nonnegligible advantage in polynomially bounded time. In that case, this digital signature scheme is EUF-CMA [6].


### 3.5. Identity-Based CPK Scheme

Two or more encryption and signature schemes are combined such that they share the same key generation algorithm, while the existing encrypt/decrypt and sign/verify algorithms are reserved. This is called the CPK scheme [31]. The basic structure of the CPK scheme is demonstrated in Figure 5.Figure 5
CPK system.The CPK system has several advantages. Consider a scenario in which each party can only save one public/private key pair. In that case, in Public Key Infrastructure- (PKI-) based cryptosystem, the encryption and signature systems can significantly reduce the encryption space, public-key certificate space, and certification time. By comparison, the application only needs to retain one identity information in identity-based or certificate-less cryptosystems, thus reducing the storage space and encryption acquisition time.


### 3.6. Algorithm Composition of the Formal Model

(1)
System establishmentThe algorithm is completed by the Private Key Generator (PKG). It sets the initial basic parameters for the encryption method, including the system public parameter param and the master keys used to generate the user’s private key. PKG saves the master key s and makes other information public [32].(2)
Key extractionThe algorithm is completed by PKG. According to the initial system parameters and the user’s Identity Document (ID), PKG uses this method to obtain the corresponding public keyQID and private key SID.(3)
EncryptionThe algorithm is completed by the encryptor. The algorithm encrypts the messagem and outputs a ciphertext c according to the system public parameters and the receiver’s public key QID.(4)
DecryptionThe algorithm is completed by the decryptor. The decryptor decrypts the ciphertextc according to its own private key SID. If the decryption is successful, it outputs the plaintext message m or symbol × (indicates decryption failure).(5)
SignatureThe algorithm is completed by the signer. The algorithm signs the messagem according to the system public parameters and its own private key SID and outputs a signature σ.(6)
VerificationUpon receiving signatureσ, the receiver verifies whether the signature is legal according to the public system parameters and the sender’s public key QID. The algorithm outputs the symbol √ or ×. If the verification is successful, the receiver will receive the message m; otherwise, it will refuse to receive.


### 3.7. The Security Concept of the Identity-Based Combined Encryption and Signature (IBCES) Ensemble Scheme

An identity-based encryption system should meet IND-ID-CCA2, and an identity-based signature system should meet EUF-ID-CMA. Next, the security model of Identity-based Combined Encryption and Signature (IBCES) is proposed [33].


#### 3.7.1. IND-IBCES-CCA2

Suppose that (key generation, encryption, decryption, signature, and verification) is a combined encryption and signature method. In that case, the security definition of the IBCES encryption system is given as follows. This is a game between ChallengerC and opponent A. Figure 6 is a schematic diagram of the IBCES encryption system under CCA2. The whole process is divided into the initial stage, stage 1, the challenge stage, stage 2, and the guess stage.Figure 6
Schematic diagram of IBCES encryption system under CCA2.According to Figure6, IND-IBCES-CCA2 is defined as follows. Suppose that no opponent A can win the above game with a nonnegligible advantage after q key extraction, decryption, and signature queries in a polynomial bounded time. In that case, the IBCES encryption system is secure against CCA2, namely, IND-IBCES-CCA2.


#### 3.7.2. EUF-IBCES-CMA

Suppose that (key generation, encryption, decryption, signature, and verification) is a combined encryption-signature system. In that case, the security definition of existence forgery of its IBCES signature system is given as follows. This is a game between challengerC and opponent A. Figure 7 draws the certificate flow of the IBCES signature system.Figure 7
Schematic diagram of IBCES signature system under CMA.According to Figure7, EUF-IBCES-CMA is defined as follows. Suppose that no opponent can win the above games with a nonnegligible advantage after q key extraction, signature, and decryption queries in a polynomial bounded time. In that case, the IBCES signature system is secure against CMA, namely, EUF-IBCES-CMA.


### 3.8. Design of IBCES Ensemble Scheme

The main content here is to propose an IBCES scheme [13].


#### 3.8.1. System Establishment Stage

With a cyclic additive groupG1, the order is a prime number q. G2 is a cyclic multiplication group, and G and G2 have the same order. P is a generator in the group G11, and there is a bilinear mapping e:G1×G1⟶G. Define four secure hash functions: H1:0,1∗⟶Zq∗,H2:0,1∗×G2×G14⟶Zq∗,H3:0,1∗⟶0,1M,H4:0,1∗×G1×G2⟶Zq∗. M is the plaintext length, and Zq∗ means the multiplicative cyclic group modulo q (the elements in the group do not include 0). PKG randomly selects s∈Zq∗ as the master key and computes Ppub=sP,g=ep,p. PKG exposes system parameters (G1, G2, P, Ppub, g, e, H1, H2, H3, H4) and saves the master key s.


#### 3.8.2. Key Extraction

Given an identity ID, PKG generates a public-private key pair (QID, SID) according to the system parameters generated above and the master key s, the private key SID=QID+s−1P, and public key QID=H1ID. Finally, PKG transfers the private key through a secure channel to the corresponding user.


#### 3.8.3. Offline Encryption

Given the public system parameters, the offline encryption algorithm randomly selectsx,a∈Zq∗ and calculates according to equations (1)–(3):(1)R=gx,(2)T0=aP,(3)T1=xaP+Ppub.In equations (1)–(3), R is a new bit parameter generated about x. T0 and T1 are new time parameters, and the final generated offline ciphertext is ∅=a,x,R,T0,T1.


#### 3.8.4. Online Encryption

Givenm,ID,∅, the online encryption algorithm is calculated by equations (4)–(6).(4)u=xH1ID−amodq,(5)c1=H2m,R,T0,T1,ux−amodq,(6)c2=m⊗H3R.Equations (4)–(6), u is a new bit parameter generated by x. c1 and c2 are the new ciphertext. Finally, the generated online ciphertext is c=T0,T1,u,c1,c2.


#### 3.8.5. Decryption

Givenc,ID,SID, the decryption algorithm is counted by equations (7) and (8).(7)R=euP+T1,SID,(8)m=c2⊗H3R.Suppose thatRH2m,R,T0,T1,u=ec1P+T0,P holds. In that case, the message m is output; otherwise, the symbol × is output.


#### 3.8.6. Offline Signature

GivenID,SID, the offline signature algorithm randomly selects l,α∈Zq∗ and calculates according to equations (9) and (10):(9)r=gl,(10)S′=αSID.In equations (9) and (10), r is a new bit parameter generated by l. S′ denotes a randomly generated pseudokey. Finally, the offline signature is δ=l,α−1,r,S′.


#### 3.8.7. Online Signature

GivenID,δ, the online signature algorithm is calculated by equations (11) and (12):(11)h=H4m,r,S′,(12)θ=l+hα−1modq.In equations (11) and (12), h is the newly defined hash function. θ signifies the key factor to verify the master key and the pseudokey. Finally, the online signature is generated as σ=h,θ,S′.


#### 3.8.8. Verification

Givenm,ID,σ, the verification algorithm is specified in equations (13) and (14).(13)S=θS′,(14)r=eS,H1IDP+Ppubg−h.Suppose thath=H4m,r,S′ holds. In that case, the receiver accepts the signature; otherwise, it outputs symbol ×.


## 3.1. Basic Concepts of the PKE System

In 1976, Diffie and Hellman first proposed the concept of the PKE system [20]. PKE system uses different keys to process messages: public keys and private keys [21]. The public key information is public and can be obtained by users, but the decryptor only owns the private key. PKE system is generally divided into encryption system and signature system. Now, the encryption system is first introduced. PKE schemes generally have three algorithms, as detailed below:(1)
Key generation algorithm generates public-private key pairs. The algorithm inputs the security parameterk and outputs a public key pk and a private key sk. The private key sk cannot be calculated from the public key pk.(2)
Encryption algorithm encrypts messages and generates ciphertext. The algorithm inputs public keypk and plaintext message m and outputs ciphertext c.(3)
Decryption algorithm decrypts the ciphertext and outputs messagem. The algorithm inputs ciphertext c and private key sk and outputs plaintext message m.These algorithms must meet the consistency requirements of the encryption system. Supposec=Encryptpk,m. In that case, m=Decryptsk,m. Encrypt and Decrypt represent the encryption and decryption algorithms, respectively [22]. The communication model of the PKE system is shown in Figure 1.Figure 1
Communication model of PKE system.In Figure1, user A is the sender, and user B is the receiver. The key generator will generate a (PKB, SKB) key pair for user B. PKB is the public key, which everyone can obtain. By comparison, the private key SKB is only known to user B. To send message m to user B, user A first encrypts message m with user B’s public key PKB using the encryption algorithm: c = Encrypt (PKB, m). Here, c is the ciphertext, and Encrypt represents the encryption algorithm. User A sends ciphertext c to user B. After receiving the ciphertext c, user B decrypts the ciphertext c with its private key SKB based on the decryption algorithm: m = Decrypt(SKB, c), where Decrypt stands for the decryption algorithm.


## 3.2. Security Target and Attack Model of PKE System

In order to prove its security, the security goal of the cryptosystem must be clarified first [23]. According to the opponent’s different capabilities and attack targets, the attack modes of the PKE system can include the following three categories: selective plaintext attack, selective ciphertext attack, and adaptive selective secret file attack [24]. Given the security goal and attack and defense modes of the PKE system, people can easily make sense of the security concept of the PKE system. Suppose that a PKE scheme has the Indistinguishability against Adaptive Chosen Ciphertext Attack (IND-CCA2) and meets the polynomial kernel function’s security. In that case, the PKE scheme is deemed secure [25]. Next, the specific proof idea of this definition is given. This is a game between opponent and challenger, which has four stages. Initial stage: challenger C runs the system-established algorithm to generate system parameters and a public/private key pair (pk, sk). C sends pk to opponent A and saves sk. Phase 1: opponent A performs a polynomially bounded decryption query. At this stage, opponent A submits a ciphertext c to challenger C. Challenger C runs the decryption algorithm. If the ciphertext is legal, it returns the message m to A; otherwise, it returns the rejection symbol ⊥. Challenge phase: opponent A decides when to end the decryption query of phase 1 and enter the challenge phase. A generates two plaintexts m0 and m1, of the same length and sends them to C. C randomly selects a bit b ∈ {0, 1} and calculates the ciphertext c∗ = E (pk, mb) of mb. C sends c∗ to A as challenge ciphertext. Stage 2: in this stage, opponent A can perform a polynomial-time decryption query like stage 1. However, opponent A cannot decrypt the ciphertext c∗ at this stage. Guess stage: opponent A obtains useful information by decrypting the query and outputs a bit B b’. If b’ = b, opponent A wins the game. Figure 2 shows a game between opponent A and challenger C.Figure 2
CCA2 security game of PKE system.Figure2 summarizes the whole process of the security game. Suppose that no opponent can win the above game with a nonnegligible advantage in polynomial bounded time. In that case, the PKE has polynomial security under CCA2.


## 3.3. Basic Concepts of the Digital Signature System

Because the signer signs through his own private key and the private key information are only known to the signer, the signature can ensure the signer’s data integrity, confirmation, and nonrepudiation. A digital signature system generally consists of key generation, signature, and verification. The above algorithm needs to meet the consistency requirements [26].The communication model of the digital signature system is illustrated in Figure3.Figure 3
Digital signature communication module.A and B are the sender and the receiver. The key generator generates a key pair: (PKB, SKB) for A, where PKB is the public key, and SKB is the private key. To send message m to B, A needs to encrypt m with the private key to obtain ciphertext c. Then, A sends ciphertext c to B. Upon reception, B decrypts c with the public key to obtain message m.


## 3.4. Security Target and Attack Model of a Digital Signature System

Similar to the PKE system, to verify the security of digital signature methods, there is a need to clarify the security objectives [27]. The digital signature system mainly includes four types of forgery: complete breach, universal forgery, selective forgery, and existential forgery [28].Different opponents have different attack capabilities. The digital signature system mainly includes three attack models: key only attack, known message attack, and adaptive Chosen Message Attack (CMA) [29]. Once the security target and attack model are determined, the security definition can be given to the digital signature system. A digital signature scheme with Existential Unforgeability Against Adaptive Chosen Messages Attack (EUF-CMA) is defined as secure. Figure 4 is the security game between opponent A and Challenger C [30]. The adaptive choice message-based attack game of the digital signature system consists of three stages similar to that in Figure 4.Figure 4
Adaptive CMA game of digital signature system.Figure4 summarizes the entire game process of the signature scheme under the adaptive CMA. Suppose that no opponent wins the game with a nonnegligible advantage in polynomially bounded time. In that case, this digital signature scheme is EUF-CMA [6].


## 3.5. Identity-Based CPK Scheme

Two or more encryption and signature schemes are combined such that they share the same key generation algorithm, while the existing encrypt/decrypt and sign/verify algorithms are reserved. This is called the CPK scheme [31]. The basic structure of the CPK scheme is demonstrated in Figure 5.Figure 5
CPK system.The CPK system has several advantages. Consider a scenario in which each party can only save one public/private key pair. In that case, in Public Key Infrastructure- (PKI-) based cryptosystem, the encryption and signature systems can significantly reduce the encryption space, public-key certificate space, and certification time. By comparison, the application only needs to retain one identity information in identity-based or certificate-less cryptosystems, thus reducing the storage space and encryption acquisition time.


## 3.6. Algorithm Composition of the Formal Model

(1)
System establishmentThe algorithm is completed by the Private Key Generator (PKG). It sets the initial basic parameters for the encryption method, including the system public parameter param and the master keys used to generate the user’s private key. PKG saves the master key s and makes other information public [32].(2)
Key extractionThe algorithm is completed by PKG. According to the initial system parameters and the user’s Identity Document (ID), PKG uses this method to obtain the corresponding public keyQID and private key SID.(3)
EncryptionThe algorithm is completed by the encryptor. The algorithm encrypts the messagem and outputs a ciphertext c according to the system public parameters and the receiver’s public key QID.(4)
DecryptionThe algorithm is completed by the decryptor. The decryptor decrypts the ciphertextc according to its own private key SID. If the decryption is successful, it outputs the plaintext message m or symbol × (indicates decryption failure).(5)
SignatureThe algorithm is completed by the signer. The algorithm signs the messagem according to the system public parameters and its own private key SID and outputs a signature σ.(6)
VerificationUpon receiving signatureσ, the receiver verifies whether the signature is legal according to the public system parameters and the sender’s public key QID. The algorithm outputs the symbol √ or ×. If the verification is successful, the receiver will receive the message m; otherwise, it will refuse to receive.


## 3.7. The Security Concept of the Identity-Based Combined Encryption and Signature (IBCES) Ensemble Scheme

An identity-based encryption system should meet IND-ID-CCA2, and an identity-based signature system should meet EUF-ID-CMA. Next, the security model of Identity-based Combined Encryption and Signature (IBCES) is proposed [33].


### 3.7.1. IND-IBCES-CCA2

Suppose that (key generation, encryption, decryption, signature, and verification) is a combined encryption and signature method. In that case, the security definition of the IBCES encryption system is given as follows. This is a game between ChallengerC and opponent A. Figure 6 is a schematic diagram of the IBCES encryption system under CCA2. The whole process is divided into the initial stage, stage 1, the challenge stage, stage 2, and the guess stage.Figure 6
Schematic diagram of IBCES encryption system under CCA2.According to Figure6, IND-IBCES-CCA2 is defined as follows. Suppose that no opponent A can win the above game with a nonnegligible advantage after q key extraction, decryption, and signature queries in a polynomial bounded time. In that case, the IBCES encryption system is secure against CCA2, namely, IND-IBCES-CCA2.


### 3.7.2. EUF-IBCES-CMA

Suppose that (key generation, encryption, decryption, signature, and verification) is a combined encryption-signature system. In that case, the security definition of existence forgery of its IBCES signature system is given as follows. This is a game between challengerC and opponent A. Figure 7 draws the certificate flow of the IBCES signature system.Figure 7
Schematic diagram of IBCES signature system under CMA.According to Figure7, EUF-IBCES-CMA is defined as follows. Suppose that no opponent can win the above games with a nonnegligible advantage after q key extraction, signature, and decryption queries in a polynomial bounded time. In that case, the IBCES signature system is secure against CMA, namely, EUF-IBCES-CMA.


## 3.7.1. IND-IBCES-CCA2

Suppose that (key generation, encryption, decryption, signature, and verification) is a combined encryption and signature method. In that case, the security definition of the IBCES encryption system is given as follows. This is a game between ChallengerC and opponent A. Figure 6 is a schematic diagram of the IBCES encryption system under CCA2. The whole process is divided into the initial stage, stage 1, the challenge stage, stage 2, and the guess stage.Figure 6
Schematic diagram of IBCES encryption system under CCA2.According to Figure6, IND-IBCES-CCA2 is defined as follows. Suppose that no opponent A can win the above game with a nonnegligible advantage after q key extraction, decryption, and signature queries in a polynomial bounded time. In that case, the IBCES encryption system is secure against CCA2, namely, IND-IBCES-CCA2.


## 3.7.2. EUF-IBCES-CMA

Suppose that (key generation, encryption, decryption, signature, and verification) is a combined encryption-signature system. In that case, the security definition of existence forgery of its IBCES signature system is given as follows. This is a game between challengerC and opponent A. Figure 7 draws the certificate flow of the IBCES signature system.Figure 7
Schematic diagram of IBCES signature system under CMA.According to Figure7, EUF-IBCES-CMA is defined as follows. Suppose that no opponent can win the above games with a nonnegligible advantage after q key extraction, signature, and decryption queries in a polynomial bounded time. In that case, the IBCES signature system is secure against CMA, namely, EUF-IBCES-CMA.


## 3.8. Design of IBCES Ensemble Scheme

The main content here is to propose an IBCES scheme [13].


### 3.8.1. System Establishment Stage

With a cyclic additive groupG1, the order is a prime number q. G2 is a cyclic multiplication group, and G and G2 have the same order. P is a generator in the group G11, and there is a bilinear mapping e:G1×G1⟶G. Define four secure hash functions: H1:0,1∗⟶Zq∗,H2:0,1∗×G2×G14⟶Zq∗,H3:0,1∗⟶0,1M,H4:0,1∗×G1×G2⟶Zq∗. M is the plaintext length, and Zq∗ means the multiplicative cyclic group modulo q (the elements in the group do not include 0). PKG randomly selects s∈Zq∗ as the master key and computes Ppub=sP,g=ep,p. PKG exposes system parameters (G1, G2, P, Ppub, g, e, H1, H2, H3, H4) and saves the master key s.


### 3.8.2. Key Extraction

Given an identity ID, PKG generates a public-private key pair (QID, SID) according to the system parameters generated above and the master key s, the private key SID=QID+s−1P, and public key QID=H1ID. Finally, PKG transfers the private key through a secure channel to the corresponding user.


### 3.8.3. Offline Encryption

Given the public system parameters, the offline encryption algorithm randomly selectsx,a∈Zq∗ and calculates according to equations (1)–(3):(1)R=gx,(2)T0=aP,(3)T1=xaP+Ppub.In equations (1)–(3), R is a new bit parameter generated about x. T0 and T1 are new time parameters, and the final generated offline ciphertext is ∅=a,x,R,T0,T1.


### 3.8.4. Online Encryption

Givenm,ID,∅, the online encryption algorithm is calculated by equations (4)–(6).(4)u=xH1ID−amodq,(5)c1=H2m,R,T0,T1,ux−amodq,(6)c2=m⊗H3R.Equations (4)–(6), u is a new bit parameter generated by x. c1 and c2 are the new ciphertext. Finally, the generated online ciphertext is c=T0,T1,u,c1,c2.


### 3.8.5. Decryption

Givenc,ID,SID, the decryption algorithm is counted by equations (7) and (8).(7)R=euP+T1,SID,(8)m=c2⊗H3R.Suppose thatRH2m,R,T0,T1,u=ec1P+T0,P holds. In that case, the message m is output; otherwise, the symbol × is output.


### 3.8.6. Offline Signature

GivenID,SID, the offline signature algorithm randomly selects l,α∈Zq∗ and calculates according to equations (9) and (10):(9)r=gl,(10)S′=αSID.In equations (9) and (10), r is a new bit parameter generated by l. S′ denotes a randomly generated pseudokey. Finally, the offline signature is δ=l,α−1,r,S′.


### 3.8.7. Online Signature

GivenID,δ, the online signature algorithm is calculated by equations (11) and (12):(11)h=H4m,r,S′,(12)θ=l+hα−1modq.In equations (11) and (12), h is the newly defined hash function. θ signifies the key factor to verify the master key and the pseudokey. Finally, the online signature is generated as σ=h,θ,S′.


### 3.8.8. Verification

Givenm,ID,σ, the verification algorithm is specified in equations (13) and (14).(13)S=θS′,(14)r=eS,H1IDP+Ppubg−h.Suppose thath=H4m,r,S′ holds. In that case, the receiver accepts the signature; otherwise, it outputs symbol ×.


## 3.8.1. System Establishment Stage

With a cyclic additive groupG1, the order is a prime number q. G2 is a cyclic multiplication group, and G and G2 have the same order. P is a generator in the group G11, and there is a bilinear mapping e:G1×G1⟶G. Define four secure hash functions: H1:0,1∗⟶Zq∗,H2:0,1∗×G2×G14⟶Zq∗,H3:0,1∗⟶0,1M,H4:0,1∗×G1×G2⟶Zq∗. M is the plaintext length, and Zq∗ means the multiplicative cyclic group modulo q (the elements in the group do not include 0). PKG randomly selects s∈Zq∗ as the master key and computes Ppub=sP,g=ep,p. PKG exposes system parameters (G1, G2, P, Ppub, g, e, H1, H2, H3, H4) and saves the master key s.


## 3.8.2. Key Extraction

Given an identity ID, PKG generates a public-private key pair (QID, SID) according to the system parameters generated above and the master key s, the private key SID=QID+s−1P, and public key QID=H1ID. Finally, PKG transfers the private key through a secure channel to the corresponding user.


## 3.8.3. Offline Encryption

Given the public system parameters, the offline encryption algorithm randomly selectsx,a∈Zq∗ and calculates according to equations (1)–(3):(1)R=gx,(2)T0=aP,(3)T1=xaP+Ppub.In equations (1)–(3), R is a new bit parameter generated about x. T0 and T1 are new time parameters, and the final generated offline ciphertext is ∅=a,x,R,T0,T1.


## 3.8.4. Online Encryption

Givenm,ID,∅, the online encryption algorithm is calculated by equations (4)–(6).(4)u=xH1ID−amodq,(5)c1=H2m,R,T0,T1,ux−amodq,(6)c2=m⊗H3R.Equations (4)–(6), u is a new bit parameter generated by x. c1 and c2 are the new ciphertext. Finally, the generated online ciphertext is c=T0,T1,u,c1,c2.


## 3.8.5. Decryption

Givenc,ID,SID, the decryption algorithm is counted by equations (7) and (8).(7)R=euP+T1,SID,(8)m=c2⊗H3R.Suppose thatRH2m,R,T0,T1,u=ec1P+T0,P holds. In that case, the message m is output; otherwise, the symbol × is output.


## 3.8.6. Offline Signature

GivenID,SID, the offline signature algorithm randomly selects l,α∈Zq∗ and calculates according to equations (9) and (10):(9)r=gl,(10)S′=αSID.In equations (9) and (10), r is a new bit parameter generated by l. S′ denotes a randomly generated pseudokey. Finally, the offline signature is δ=l,α−1,r,S′.


## 3.8.7. Online Signature

GivenID,δ, the online signature algorithm is calculated by equations (11) and (12):(11)h=H4m,r,S′,(12)θ=l+hα−1modq.In equations (11) and (12), h is the newly defined hash function. θ signifies the key factor to verify the master key and the pseudokey. Finally, the online signature is generated as σ=h,θ,S′.


## 3.8.8. Verification

Givenm,ID,σ, the verification algorithm is specified in equations (13) and (14).(13)S=θS′,(14)r=eS,H1IDP+Ppubg−h.Suppose thath=H4m,r,S′ holds. In that case, the receiver accepts the signature; otherwise, it outputs symbol ×.


## 4. Results and Discussion

### 4.1. Security Certification of IBCES Ensemble Scheme

First, it is proved that the IBCES encryption scheme satisfies the IND-IBCES-CCA2 security, as exhibited in Figure8. There is only one difference between the encryption part of the IBCES scheme and the traditional security proof method of identity-based encryption scheme. Opponent A can access both the decryption Oracle and the signature Oracle. The challenger can simulate a signature Oracle. Suppose that the simulated Oracle can respond to the challenge of the opponent like a real signature Oracle. In that case, it can be said that the opponent can access the signature Oracle or not has zero impact. In the proof process, challenger C is the challenger of the IBCES encryption part. C can ask its challenger B for key extraction and decryption and send the result returned by B to opponent A.Figure 8
IBCES encryption scheme certification.OpponentA performs polynomially bounded key extraction, decryption, and signature queries. In the key extraction and query stage, A provides a set of IDs to C. C sends the ID to its own Oracle B and feeds back the response results to A. In the decryption query stage, A submits a set of IDs and ciphertext C. Similarly, C can call his own Oracle and send the response to A. Therefore, in addition to the signature inquiry, C can correctly answer all A’s challenges. When A asks for a signature, C needs to construct a signature simulator SIG to respond to A’s challenge because C has no signature Oracle. At this time, when A submits a set of IDs and a message m to C, C first selects randomly in order to output a signature θ,h∈Zq∗,S′∈G1. Then, it calculates S=θS′,r=eS,H1IDP+Ppubg−h and defines h=H4m,r,S′. Finally, C will send h,θ,S′ to A. According to the verification algorithm, the signature verification results of all SIG outputs are legal. It shows that the error probability of C is negligible. That is, even if Challenger C does not have a signature Oracle, a signature Oracle can be simulated to answer A’s challenge when the opponent asks for a signature. Therefore, whether opponent A can access the signature Oracle or not has no impact on the security of the IBCES encryption scheme. The IBCES encryption scheme can meet the IND-IBCES-CCA2 security.Furthermore, the security of the IBCES signature scheme is proved, as in Figure9. Similar to encryption, there is only one difference between the signature security proof of the IBCES scheme and the security proof of the traditional identity-based signature scheme. Opponent A can access both the signature Oracle and the decryption Oracle. Suppose that the challenger can simulate a decryption Oracle to respond to the opponent’s challenge. Even if the opponent can access the decryption Oracle, it is not helpful. In this way, the EUF-CMA security proof of the signature part of the IBCES scheme can be transformed into the security proof of the original signature scheme. In this game, C is both a challenger and an opponent. C performs a key extraction query and signature query like its challenger B and sends the result returned by B to opponent A.Figure 9
IBCES signature scheme certification.WhenA is in the decryption challenge phase, C needs to construct a decryption simulator DEC to answer A’s challenge. There is a difference between the decryption simulator DEC and the real decryption Oracle. When the DEC outputs ×, the real decryption Oracle can correctly return a message m. This error between the two is actually the probability that A does not perform a m,R,T0,T1,u hash query on H2. Thus, the probability that C can succeed is close to 1. In other words, even if challenger C does not have a decryption Oracle, a simulated signature Oracle can cope with the challenge from A. Therefore, whether opponent A can access the signature Oracle or not does not affect the security of the IBCES signature scheme. Now, it is derived that the IBCES signature scheme meets the EUF-CMA security.


### 4.2. Performance Analysis of IBCES Ensemble Scheme

There are two main security performance concerns: the computational cost and the signature scheme’s communication cost. The proposed IBCES ensemble scheme is compared with four other online/offline signature schemes by factoring in the computational cost and ciphertext length, as plotted in Figure10.Figure 10
Communication cost comparison.Given the same security level, the proposed IBCES ensemble scheme’s performance is faster in the offline signature stage because the exponential operation is faster than the point-to-point operation. Meanwhile, it is faster than the other four schemes in the decryption stage because the pair operation is more time-consuming than the dot product operation. Figure10 proves that the computational cost of the proposed IBCES ensemble scheme is the lowest.


## 4.1. Security Certification of IBCES Ensemble Scheme

First, it is proved that the IBCES encryption scheme satisfies the IND-IBCES-CCA2 security, as exhibited in Figure8. There is only one difference between the encryption part of the IBCES scheme and the traditional security proof method of identity-based encryption scheme. Opponent A can access both the decryption Oracle and the signature Oracle. The challenger can simulate a signature Oracle. Suppose that the simulated Oracle can respond to the challenge of the opponent like a real signature Oracle. In that case, it can be said that the opponent can access the signature Oracle or not has zero impact. In the proof process, challenger C is the challenger of the IBCES encryption part. C can ask its challenger B for key extraction and decryption and send the result returned by B to opponent A.Figure 8
IBCES encryption scheme certification.OpponentA performs polynomially bounded key extraction, decryption, and signature queries. In the key extraction and query stage, A provides a set of IDs to C. C sends the ID to its own Oracle B and feeds back the response results to A. In the decryption query stage, A submits a set of IDs and ciphertext C. Similarly, C can call his own Oracle and send the response to A. Therefore, in addition to the signature inquiry, C can correctly answer all A’s challenges. When A asks for a signature, C needs to construct a signature simulator SIG to respond to A’s challenge because C has no signature Oracle. At this time, when A submits a set of IDs and a message m to C, C first selects randomly in order to output a signature θ,h∈Zq∗,S′∈G1. Then, it calculates S=θS′,r=eS,H1IDP+Ppubg−h and defines h=H4m,r,S′. Finally, C will send h,θ,S′ to A. According to the verification algorithm, the signature verification results of all SIG outputs are legal. It shows that the error probability of C is negligible. That is, even if Challenger C does not have a signature Oracle, a signature Oracle can be simulated to answer A’s challenge when the opponent asks for a signature. Therefore, whether opponent A can access the signature Oracle or not has no impact on the security of the IBCES encryption scheme. The IBCES encryption scheme can meet the IND-IBCES-CCA2 security.Furthermore, the security of the IBCES signature scheme is proved, as in Figure9. Similar to encryption, there is only one difference between the signature security proof of the IBCES scheme and the security proof of the traditional identity-based signature scheme. Opponent A can access both the signature Oracle and the decryption Oracle. Suppose that the challenger can simulate a decryption Oracle to respond to the opponent’s challenge. Even if the opponent can access the decryption Oracle, it is not helpful. In this way, the EUF-CMA security proof of the signature part of the IBCES scheme can be transformed into the security proof of the original signature scheme. In this game, C is both a challenger and an opponent. C performs a key extraction query and signature query like its challenger B and sends the result returned by B to opponent A.Figure 9
IBCES signature scheme certification.WhenA is in the decryption challenge phase, C needs to construct a decryption simulator DEC to answer A’s challenge. There is a difference between the decryption simulator DEC and the real decryption Oracle. When the DEC outputs ×, the real decryption Oracle can correctly return a message m. This error between the two is actually the probability that A does not perform a m,R,T0,T1,u hash query on H2. Thus, the probability that C can succeed is close to 1. In other words, even if challenger C does not have a decryption Oracle, a simulated signature Oracle can cope with the challenge from A. Therefore, whether opponent A can access the signature Oracle or not does not affect the security of the IBCES signature scheme. Now, it is derived that the IBCES signature scheme meets the EUF-CMA security.


## 4.2. Performance Analysis of IBCES Ensemble Scheme

There are two main security performance concerns: the computational cost and the signature scheme’s communication cost. The proposed IBCES ensemble scheme is compared with four other online/offline signature schemes by factoring in the computational cost and ciphertext length, as plotted in Figure10.Figure 10
Communication cost comparison.Given the same security level, the proposed IBCES ensemble scheme’s performance is faster in the offline signature stage because the exponential operation is faster than the point-to-point operation. Meanwhile, it is faster than the other four schemes in the decryption stage because the pair operation is more time-consuming than the dot product operation. Figure10 proves that the computational cost of the proposed IBCES ensemble scheme is the lowest.


## 5. Conclusions

This work proves the security of the combined encryption and signature system. The encryption part of the proposed IBCES scheme meets the IND-IBCES-CCA2 security. The security is also proved for the signature part of the IBCES scheme. Meanwhile, this work compares the performance of different combined encryption-signature systems. The computational cost of the signature scheme selected in this work is the lowest. Although this work has made some efforts in the security of the smart grid, there are still some shortcomings. All the security verification methods are verified under the random prediction model. All hash functions are regarded as ideal. However, verifying security under the random prediction model is not necessarily safe and reliable in the real environment. Therefore, future works will design a protocol with higher security and a faster communication rate for the system. The research finding provides a reference for the maintenance and stability of the power system. It provides an improvement direction for the further development of the smart grid under the PIoT.



---

*Source: 6853902-2023-02-17.xml*