# Secure Information Sharing System for Online Patient Networks

Authors: Hyun-A Park
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Recently, privacy emerged as a hot issue again, as the General Data Protection Regulation (GDPR) of EU has become enforceable since May 25, 2018. This paper deals with the problem of health information sharing on a website securely and with preserving privacy. In the context of patient networks (such as ‘PatientsLikeMe’ or ‘CureTogether’), we propose the model Secure Information Sharing System (SISS) with the main method of group key cryptosystem. SISS addresses important problems of group key systems. (1) The new developed equations for encryption and decryption can eliminate the rekeying and redistribution process for every membership-change of the group, keeping the security requirements. (2) The new 3D Stereoscopic Image Mobile Security Technology with AR (augmented reality) solves the problem of conspiracy by group members. (3) SISS uses the reversed one-way hash chain to guarantee forward secrecy and backward accessibility (security requirements for information sharing in a group). We conduct a security analysis of SISS according to group information sharing secrecy and an experiment on its performance. Consequently, although current IT paradigm is changing to be more and more ‘complicated’, ‘overlapped’, and ‘virtualized’, SISS makes it possible to securely share sensitive information from collaborative work.


---

## Body

## 1. Introduction

Patients around the world want to connect to people who are suffering from the same symptoms and try to find the best treatments. These days, there are some online patient websites for health information sharing such as “PatientsLikeMe”[1] or “CureTogether”[2], where patients talk about their symptoms and successful (or failed) experiences. Researchers can also discover new and better solutions based on the patient-contributed data.


### 1.1. Problem Identification

The problem is that these kinds of health data may be sensitive and private information. Therefore, patients want the sensitive health data to be protected and managed with safety, and the data to be revealed to only limited persons. That is, the individuals' right to privacy and control over the circulation of their information [3]. In particular, privacy emerged as a hot issue again, as the General Data Protection Regulation (GDPR) of EU has become enforceable since May 25, 2018.One of the substantial ways to share patients’ information and to protect privacy is a group key management system. However, a group key system has some peculiar characteristics; the group key should be updated whenever members leave or join the group. This is called rekeying and redistribution. These processes need a complicated and high level of security. Another feature that differentiates an information sharing system from other general group key management systems is that leaving members cannot access the group’s information anymore, but joining members can access all the previous group’s information to get more information for better treatment. Moreover, current members may conspire with leaving members or other people by revealing their group key [4].In this paper, the proposed model SISS (Secure Information Sharing System) addresses the above problems in the context of online patient networks such as PatientsLikeMe or CureTogether. The main methods are group key management system, including the newly developed encryption/decryption algorithm and reversed hash key chain, and 3D Stereoscopic Image Mobile Security Technology (augmented reality technique). Namely, that is the secure version for the websites which can make people with the same symptoms share their health information safely and securely.


### 1.2. Main Goals

The SISS’s principle to manage users’ information with safety is that general information should be presented in plaintexts but sensitive information should be managed in ciphertexts. The solution for sharing ciphertexts with users is group key management system. The following is the main goals of SISS’s group key system.There Should Be No Processes of Rekeying and Redistribution. Whenever membership-changes (users leaving or joining groups) happen in the general group key system, the system should generate a new group key and distribute the new key to all members very quickly. This process needs more complicated and secure level of techniques, so ‘rekeying and redistribution’ falls under the hard problem in group key systems. To solve this problem, we develop new equations of the encryption and decryption with the group key. Therefore, SISS has no process of rekeying and redistribution for membership-changes. To the best of my knowledge, this is the first trial to eliminate the process of rekeying and redistribution keeping the security of the group key.SISS Guarantees Forward Secrecy and Backward Accessibility. The representative security requirements for general group key systems are forward secrecy and backward secrecy. However, the security requirements of SISS to share information with group members are forward secrecy and backward accessibility, not backward secrecy. The reversed hash chain can guarantee the security properties of SISS.SISS is Collusion-Resistant with New Technology. In every group member system, one of the important security problems is the potential for conspiracy between users and illegal members. As a solution, SISS proposes a new concept of 3D Stereoscopic Image Mobile Security Technology using VR/AR technique.


### 1.3. Methods and Contributions

The main methods and contributions are listed in detail as follows:( 1 ) The group key system for encryption and decryption: Only valid users can share the secret information with their group keys and pseudonyms. Others (invalid users) cannot know the contents and ownership for the information: ‘what about’ and ‘whose information’.( 2 ) SISS addresses the security problem with reversed hash chain and 3D Stereoscopic Image Mobile Security Technology. And, the newly developed encryption and decryption algorithms are used for efficiency. It is because the information sharing has been and will be highly increased in the networked collaborative computing environments.(2.1)Equations for Encryption and Decryption: SISS has no need for rekeying and redistribution for membership-changes. The principle of group key generation for each member is that a fixed master group key is assigned to each group, and random numbers for each user and every session are newly generated by applying random numbers to hash function respectfully, reversedly, and repeatedlys times. Thereafter, each random number and the master group key are combined according to the developed equation algorithm. Then, a total of five subgroup keys are generated as each member’s group session key for every session. Hence, every member has completely different group keys for each session and each member because of generating different random number each time. However, one of the most important things is that the results after calculation of all other group keys for the developed equation (for encryption and decryption) are the same as the result of master group key for encryption and decryption, which makes it possible for SISS not to have rekeying and redistribution processes whenever there are membership-changes.(2.2)3D Stereoscopic Image Mobile Security Technology: It is a new concept of a security solution using VR/AR techniques against conspiracy. The combination of human’s facial expressions and gestures which are identified at the registration time of a legitimate group member (LGM) should be rendered as a 3D image in the login process to authenticate a legitimate user. Consequently, the rendering of users’ own facial expressions and gestures can prohibit conspiracy between users and invalid persons.(2.3)Reversed Hash Chain: SISS should guarantee forward secrecy and backward accessibility, along with group key secrecy [5], which are security requirements in group information sharing system. In SISS, every member’s group key is generated based on reversed one-way hash chain. Due to one-way properties of reversed hash function[6], a leaving member cannot know the next group key (forward secrecy) but a joining member can know all the previous keys and information (backward accessibility). Therefore, SISS is suitable for secret collaborative work and sensitive information sharing among group members.(2.4)All Different Random Numbers for Each Member and Each Session: In SISS system, every member’s group session key looks like private key because their group key has completely different values with different random numbers for each member. Nevertheless, the key plays a role of a group key, with which every group member can share their sensitive health information with other members in a group.( 3 ) Stronger authentication for login: The proposed model uses LGM (legitimate group member) for stronger authentication. Moreover, the authentication processes are mutual, so that the proposed model is secure against spoofing or masquerading attack.( 4 ) Scalability to other group project systems and mobile phone applicability: SISS is scalable to other group project systems on websites. Although application scenario is about patient networks on the web, SISS is extendable to other secure group projects. Furthermore, it is applicable to even LGM of mobile phones, because the next smartphone will feature a front-facing 3D laser scanner for facial recognition, which was the expectation of upcoming iPhone 8 in early 2018 [7] (but Apple released it without 3D laser scanner in late 2017).( 5 ) Privacy preserving system: SISS can meet the privacy requirements: pseudonymity (partial anonymity), unlinkability, and unobservability.( 6 ) Blinding: In every flow, SISS uses newly generated random numbers. This masking method does not allow an attacker to know or to guess real contents correctly.


## 1.1. Problem Identification

The problem is that these kinds of health data may be sensitive and private information. Therefore, patients want the sensitive health data to be protected and managed with safety, and the data to be revealed to only limited persons. That is, the individuals' right to privacy and control over the circulation of their information [3]. In particular, privacy emerged as a hot issue again, as the General Data Protection Regulation (GDPR) of EU has become enforceable since May 25, 2018.One of the substantial ways to share patients’ information and to protect privacy is a group key management system. However, a group key system has some peculiar characteristics; the group key should be updated whenever members leave or join the group. This is called rekeying and redistribution. These processes need a complicated and high level of security. Another feature that differentiates an information sharing system from other general group key management systems is that leaving members cannot access the group’s information anymore, but joining members can access all the previous group’s information to get more information for better treatment. Moreover, current members may conspire with leaving members or other people by revealing their group key [4].In this paper, the proposed model SISS (Secure Information Sharing System) addresses the above problems in the context of online patient networks such as PatientsLikeMe or CureTogether. The main methods are group key management system, including the newly developed encryption/decryption algorithm and reversed hash key chain, and 3D Stereoscopic Image Mobile Security Technology (augmented reality technique). Namely, that is the secure version for the websites which can make people with the same symptoms share their health information safely and securely.


## 1.2. Main Goals

The SISS’s principle to manage users’ information with safety is that general information should be presented in plaintexts but sensitive information should be managed in ciphertexts. The solution for sharing ciphertexts with users is group key management system. The following is the main goals of SISS’s group key system.There Should Be No Processes of Rekeying and Redistribution. Whenever membership-changes (users leaving or joining groups) happen in the general group key system, the system should generate a new group key and distribute the new key to all members very quickly. This process needs more complicated and secure level of techniques, so ‘rekeying and redistribution’ falls under the hard problem in group key systems. To solve this problem, we develop new equations of the encryption and decryption with the group key. Therefore, SISS has no process of rekeying and redistribution for membership-changes. To the best of my knowledge, this is the first trial to eliminate the process of rekeying and redistribution keeping the security of the group key.SISS Guarantees Forward Secrecy and Backward Accessibility. The representative security requirements for general group key systems are forward secrecy and backward secrecy. However, the security requirements of SISS to share information with group members are forward secrecy and backward accessibility, not backward secrecy. The reversed hash chain can guarantee the security properties of SISS.SISS is Collusion-Resistant with New Technology. In every group member system, one of the important security problems is the potential for conspiracy between users and illegal members. As a solution, SISS proposes a new concept of 3D Stereoscopic Image Mobile Security Technology using VR/AR technique.


## 1.3. Methods and Contributions

The main methods and contributions are listed in detail as follows:( 1 ) The group key system for encryption and decryption: Only valid users can share the secret information with their group keys and pseudonyms. Others (invalid users) cannot know the contents and ownership for the information: ‘what about’ and ‘whose information’.( 2 ) SISS addresses the security problem with reversed hash chain and 3D Stereoscopic Image Mobile Security Technology. And, the newly developed encryption and decryption algorithms are used for efficiency. It is because the information sharing has been and will be highly increased in the networked collaborative computing environments.(2.1)Equations for Encryption and Decryption: SISS has no need for rekeying and redistribution for membership-changes. The principle of group key generation for each member is that a fixed master group key is assigned to each group, and random numbers for each user and every session are newly generated by applying random numbers to hash function respectfully, reversedly, and repeatedlys times. Thereafter, each random number and the master group key are combined according to the developed equation algorithm. Then, a total of five subgroup keys are generated as each member’s group session key for every session. Hence, every member has completely different group keys for each session and each member because of generating different random number each time. However, one of the most important things is that the results after calculation of all other group keys for the developed equation (for encryption and decryption) are the same as the result of master group key for encryption and decryption, which makes it possible for SISS not to have rekeying and redistribution processes whenever there are membership-changes.(2.2)3D Stereoscopic Image Mobile Security Technology: It is a new concept of a security solution using VR/AR techniques against conspiracy. The combination of human’s facial expressions and gestures which are identified at the registration time of a legitimate group member (LGM) should be rendered as a 3D image in the login process to authenticate a legitimate user. Consequently, the rendering of users’ own facial expressions and gestures can prohibit conspiracy between users and invalid persons.(2.3)Reversed Hash Chain: SISS should guarantee forward secrecy and backward accessibility, along with group key secrecy [5], which are security requirements in group information sharing system. In SISS, every member’s group key is generated based on reversed one-way hash chain. Due to one-way properties of reversed hash function[6], a leaving member cannot know the next group key (forward secrecy) but a joining member can know all the previous keys and information (backward accessibility). Therefore, SISS is suitable for secret collaborative work and sensitive information sharing among group members.(2.4)All Different Random Numbers for Each Member and Each Session: In SISS system, every member’s group session key looks like private key because their group key has completely different values with different random numbers for each member. Nevertheless, the key plays a role of a group key, with which every group member can share their sensitive health information with other members in a group.( 3 ) Stronger authentication for login: The proposed model uses LGM (legitimate group member) for stronger authentication. Moreover, the authentication processes are mutual, so that the proposed model is secure against spoofing or masquerading attack.( 4 ) Scalability to other group project systems and mobile phone applicability: SISS is scalable to other group project systems on websites. Although application scenario is about patient networks on the web, SISS is extendable to other secure group projects. Furthermore, it is applicable to even LGM of mobile phones, because the next smartphone will feature a front-facing 3D laser scanner for facial recognition, which was the expectation of upcoming iPhone 8 in early 2018 [7] (but Apple released it without 3D laser scanner in late 2017).( 5 ) Privacy preserving system: SISS can meet the privacy requirements: pseudonymity (partial anonymity), unlinkability, and unobservability.( 6 ) Blinding: In every flow, SISS uses newly generated random numbers. This masking method does not allow an attacker to know or to guess real contents correctly.


## 2. Related Works and Application

### 2.1. Related Works

In this section, we introduce our main solution’s research area of group key.Many researchers have worked on group key in various views such as group key agreement, exchange, revocation, and multicast/broadcast. However, this paper only focuses on the group key application for sharing information among multiple users. In particular, SISS has a little different property from the general group key in that the security requirement of SISS is not backward secrecy (a joining member cannot know all the previous keys and information) but backward accessibility (a joining member can know all the previous keys and information). It is caused by the different application’s goal from other group key systems, which can enable current group members to share all their information securely. That is the reason why SISS is related to the research area of keyword search schemes for multiuser setting.At first, we address the researches about ‘multiuser setting’. In [8], Park et. al firstly proposed privacy preserving keyword-based retrieval protocols for dynamic groups (multiuser setting) based on reversed hash key chain. In multiuser setting environments like companies and municipal offices, a server contains heterogeneous documents accessible by different groups or persons. A leaving member from a group should not have access to any documents of the group anymore, that is, forward secrecy. Because a newly joining member should perform the tasks of the group to which he belongs, all documents accessible to the group must be still available and he should be able to obtain all the group keys, that is, backward accessibility. They accomplished both security properties with reversed hash key chain. Thereafter, they made the formal definition for ‘backward accessibility’ firstly in [5], where they proposed two practical group search schemes in the respect of efficiency in cloud datacenter. As for the researches not based on reversed hash key chain, Wang et. al. [9] analyzed Park et. al’s scheme[8] on various views including security and efficiency. They achieved backward accessibility for multiple users with public key and Pallier’s cryptosystem instead of reversed hash key chain. The next year, Wang et. al proposed another scheme of keyword field-free conjunctive keyword searches on encrypted data in the dynamic group setting [10]. In [11], Li et al. suggested a new effective fuzzy keyword search in a multiuser system over encrypted cloud data. This system supports differential searching and privileges based on the techniques attribute-based encryption and Edit Distance.In respect of key-updating and redistribution, there have been also many researches until now, because group key’s rekeying and redistribution to all group members are complicated and hard tasks. Generally, this research area is divided into four categories: a centralized distribution scheme, a distributed key agreement scheme, a hybrid group key management scheme, and a self-healing group key distribution scheme (SGKD). The significant point of centralized key distribution schemes [12–20] is that a centralized key management center as a trusted party generates, updates, and distributes the group keys to all members. As to distributed key agreement schemes [21–28], all group members participate in generation, rekeying, and redistribution of their group keys. Hybrid group key management schemes [29–32] are about the best use of both schemes: a centralized distribution scheme and a distributed key agreement scheme. Lastly, a self-healing group key distribution scheme (SGKD) is for wireless networks including sensor networks [33–50]. In this paper, we focus on SGKD schemes because SISS’s application includes both networks of wired and wireless and SISS has more relations with SGKD schemes than other schemes.The main point of self-healing schemes is that group members can recover the missing session keys without retransmission of the missing messages from the GM (group manager). A SGKD scheme is largely divided into four categories again: polynomial based SGKD (P-SGKD) schemes [33–37], vector space secret sharing based SGKD schemes [38–41], bilinear pairings based SGKD schemes [42, 43], and exponential arithmetic based SGKD (E-SGKD) schemes [44–51]. P-SGKD and vector space secret sharing based SGKD schemes are generally known as “not efficient”. A polynomial secret sharing scheme is the most common technique, where two types of polynomials are constructed: the revocation polynomial and the access polynomial. In [44], Rams et al. pointed out that almost all of the polynomial based SGKD schemes can be converted to E-SGKD schemes. P-SGKD schemes can be divided into two types based on using Lagrange Interpolation or not. In [33, 45–47] E-SGKD schemes are constructed from P-SGKD schemes with Lagrange Interpolation. The other P-SGKD schemes without Lagrange Interpolation can be classified into two types again based on using hash chains or not. Scheme 3 in [48] and Scheme 2 in [49] are E-SGKD schemes transformed from revocation polynomial based P-SGKD schemes without hash chains. In [50], Gou et. al first proposed E-SGKD scheme with high efficiency and backward secrecy by combining dual chains: a traditional hash chain and a key chain.


### 2.2. Entities and Application Scenario

SISS has three parties: users, SM (security manager), and SISS server. SM (security manager) is a kind of a client, which is granted a special role of a security manager. SM is assumed as a TTP (trusted third party) and it is located in front of the SISS server. SM controls group key and key-related information, all sensitive information, and all other events with powerful computational and storage abilities. Figure1 shows the system configuration of SISS.Figure 1
The configuration of SISS.The main participants of SISS are group members who want to get help through information sharing. The information scope is health conditions and patient profile. Mostly, the health information could be shared but some secret personal data in patient profile should be revealed to the allowed people only.With the mobile devices or PC, Secure Information Sharing System (SISS) is constructed for online website patients with any disease all over the world. The needs are as follows: Many patients want to get in such kind of patient networks and to be helped more easily and securely. Each member uploads his/her conditions or information to his/her personal ciphertext pages (for sensitive data) or plaintext pages (for public data).One more important thing is that the augmented reality (AR) technique of 3D image rendering is applied to external devices. The rendered image is selected from the contents-list consisting of the randomly repeated and rearranged human’s facial expressions and gestures. As the first process, every user should register at SM; thereafter they should get through the authentication processes every session and then they start some actions. When some sensitive information is shared with other patients (it means that the ciphertext pages are generated), we know the page is encrypted by the group’s encryption key. Only the legitimate users (who registered at SM and kept the information given by SM at their devices for authentication) can pass authentication processes and know the sharing information. In the last step of the authentication, 3-dimensional image is rendered. This image can be called a legitimate group member.


## 2.1. Related Works

In this section, we introduce our main solution’s research area of group key.Many researchers have worked on group key in various views such as group key agreement, exchange, revocation, and multicast/broadcast. However, this paper only focuses on the group key application for sharing information among multiple users. In particular, SISS has a little different property from the general group key in that the security requirement of SISS is not backward secrecy (a joining member cannot know all the previous keys and information) but backward accessibility (a joining member can know all the previous keys and information). It is caused by the different application’s goal from other group key systems, which can enable current group members to share all their information securely. That is the reason why SISS is related to the research area of keyword search schemes for multiuser setting.At first, we address the researches about ‘multiuser setting’. In [8], Park et. al firstly proposed privacy preserving keyword-based retrieval protocols for dynamic groups (multiuser setting) based on reversed hash key chain. In multiuser setting environments like companies and municipal offices, a server contains heterogeneous documents accessible by different groups or persons. A leaving member from a group should not have access to any documents of the group anymore, that is, forward secrecy. Because a newly joining member should perform the tasks of the group to which he belongs, all documents accessible to the group must be still available and he should be able to obtain all the group keys, that is, backward accessibility. They accomplished both security properties with reversed hash key chain. Thereafter, they made the formal definition for ‘backward accessibility’ firstly in [5], where they proposed two practical group search schemes in the respect of efficiency in cloud datacenter. As for the researches not based on reversed hash key chain, Wang et. al. [9] analyzed Park et. al’s scheme[8] on various views including security and efficiency. They achieved backward accessibility for multiple users with public key and Pallier’s cryptosystem instead of reversed hash key chain. The next year, Wang et. al proposed another scheme of keyword field-free conjunctive keyword searches on encrypted data in the dynamic group setting [10]. In [11], Li et al. suggested a new effective fuzzy keyword search in a multiuser system over encrypted cloud data. This system supports differential searching and privileges based on the techniques attribute-based encryption and Edit Distance.In respect of key-updating and redistribution, there have been also many researches until now, because group key’s rekeying and redistribution to all group members are complicated and hard tasks. Generally, this research area is divided into four categories: a centralized distribution scheme, a distributed key agreement scheme, a hybrid group key management scheme, and a self-healing group key distribution scheme (SGKD). The significant point of centralized key distribution schemes [12–20] is that a centralized key management center as a trusted party generates, updates, and distributes the group keys to all members. As to distributed key agreement schemes [21–28], all group members participate in generation, rekeying, and redistribution of their group keys. Hybrid group key management schemes [29–32] are about the best use of both schemes: a centralized distribution scheme and a distributed key agreement scheme. Lastly, a self-healing group key distribution scheme (SGKD) is for wireless networks including sensor networks [33–50]. In this paper, we focus on SGKD schemes because SISS’s application includes both networks of wired and wireless and SISS has more relations with SGKD schemes than other schemes.The main point of self-healing schemes is that group members can recover the missing session keys without retransmission of the missing messages from the GM (group manager). A SGKD scheme is largely divided into four categories again: polynomial based SGKD (P-SGKD) schemes [33–37], vector space secret sharing based SGKD schemes [38–41], bilinear pairings based SGKD schemes [42, 43], and exponential arithmetic based SGKD (E-SGKD) schemes [44–51]. P-SGKD and vector space secret sharing based SGKD schemes are generally known as “not efficient”. A polynomial secret sharing scheme is the most common technique, where two types of polynomials are constructed: the revocation polynomial and the access polynomial. In [44], Rams et al. pointed out that almost all of the polynomial based SGKD schemes can be converted to E-SGKD schemes. P-SGKD schemes can be divided into two types based on using Lagrange Interpolation or not. In [33, 45–47] E-SGKD schemes are constructed from P-SGKD schemes with Lagrange Interpolation. The other P-SGKD schemes without Lagrange Interpolation can be classified into two types again based on using hash chains or not. Scheme 3 in [48] and Scheme 2 in [49] are E-SGKD schemes transformed from revocation polynomial based P-SGKD schemes without hash chains. In [50], Gou et. al first proposed E-SGKD scheme with high efficiency and backward secrecy by combining dual chains: a traditional hash chain and a key chain.


## 2.2. Entities and Application Scenario

SISS has three parties: users, SM (security manager), and SISS server. SM (security manager) is a kind of a client, which is granted a special role of a security manager. SM is assumed as a TTP (trusted third party) and it is located in front of the SISS server. SM controls group key and key-related information, all sensitive information, and all other events with powerful computational and storage abilities. Figure1 shows the system configuration of SISS.Figure 1
The configuration of SISS.The main participants of SISS are group members who want to get help through information sharing. The information scope is health conditions and patient profile. Mostly, the health information could be shared but some secret personal data in patient profile should be revealed to the allowed people only.With the mobile devices or PC, Secure Information Sharing System (SISS) is constructed for online website patients with any disease all over the world. The needs are as follows: Many patients want to get in such kind of patient networks and to be helped more easily and securely. Each member uploads his/her conditions or information to his/her personal ciphertext pages (for sensitive data) or plaintext pages (for public data).One more important thing is that the augmented reality (AR) technique of 3D image rendering is applied to external devices. The rendered image is selected from the contents-list consisting of the randomly repeated and rearranged human’s facial expressions and gestures. As the first process, every user should register at SM; thereafter they should get through the authentication processes every session and then they start some actions. When some sensitive information is shared with other patients (it means that the ciphertext pages are generated), we know the page is encrypted by the group’s encryption key. Only the legitimate users (who registered at SM and kept the information given by SM at their devices for authentication) can pass authentication processes and know the sharing information. In the last step of the authentication, 3-dimensional image is rendered. This image can be called a legitimate group member.


## 3. Preliminaries

### 3.1. Notations

The notations for SISS are explained in Table1.Table 1
Notations.
SM Security Manager  KG the group keys set of groupG  Gt thet-th group  T the total number of groups in a SISS server  mKg the master group key of groupG  CPi,tj the j-th ciphertext-page of a memberi in a group t  n the total number of groupG’s members  sn session number  m the total number of ciphertext-pageCP  Ut,ij a memberi of the t-th group in the j-th session  K G t , i j a group session key for each memberi of t-th group Gt in the j-th session s K i , 1 j , s K i , 2 j , s K i , 3 j , s K i , 4 j , s K i , 5 j: five subkeys for a group session key KGij of a member i in group G  αij random number of memberi in the j-th session  pij pseudonym of memberi in the j-th session  h(⋅) hash function  ht(x) the value hashed t-times for x  f(⋅) pseudorandom function  Sij stereoscopic image information for 3D real model of memberi in the j-th session  RSi a rendered image ofSi  E Encryption function  D Decryption function  M a message


### 3.2. Algorithms for SISS Model

A SISS model consists of the following eight algorithms.(1)
SysPrm(1k): Parameter Generation algorithm SysPrm takes as an input a security parameterk and produces a system parameter λ.(2)
KeyGen(λ): Taking λ as input, Key Generation algorithm KeyGen produces group session random numbers setRH, group member keys setK, and member pseudonym keys setP.(3)
InfGenStr(λ,RH,K,P): Taking λ, RH, K, P as input, Information Generation and Storage algorithm InfGenStr produces LGM (legitimate group member) and other information for authentication.(4)
Qr(RH,K,P): GivenRH, K, P, Query algorithm produces Query Value Qv.(5)
Vr_Qr(Qv). Given Qv, Verification algorithm verifies Qv, and Query algorithm produces Query Value Qv.(6)
Vr(Qv): Given Qv, Verification algorithm verifies Qv.(7)
EncUp(M): This algorithm encrypts and uploads messageM.(8)
DnDec(M): This algorithm downloads and decrypts messageM.


### 3.3. Security Building Blocks and Model

Definition 1 (one-way hash chain).
It is generated by selecting the last value at random and applying it to one-way hash functionh repeatedly. The initially chosen value is the last value of the key chain. Following are two properties of one-way hash chain.Property 2.
Anybody can deduce the earlier valueki belonging to the one-way key chain with the later value kj by checking hj-i(kj) which equals ki with the later value kj.Property 3.
Given the latest released valueki of one-way key chain, an adversary cannot find a later value kj such that hj-i(kj) equals ki. Even when value ki+1 is released, the second preimage collision resistant property prevents an adversary from finding ki+1′ different from ki+1 such that h(ki+1) equals ki [6].Remark. We call property 1 of one-way hash key chain ‘backward accessibility’ and property 2 ‘forward security’.Definition 4 (PRF (pseudorandom function) ).
We say that ‘F:Kf×X→Y is (t,q,e)-secure pseudorandom function’ if every oracle algorithm A making at most q oracle queries and with running time at most t has advantage AdvA<e. The advantage is defined as AdvA=|Pr⁡AFk=1-Pr⁡[Ag=1]| where g represents a random function selected uniformly from the set of all maps from X to Y, and where the probabilities are taken over the choice of k and g [51].Definition 5 (PRGGr (pseudorandom generator) ).
We say that ‘Gr:KGr→S is a (t,e)-secure pseudorandom generator’ if every algorithm A with running time at most t has advantage AdvA<e. The advantage is defined as AdvA=|Pr⁡AGrUKGr=1-Pr⁡[A(US)=1]|, where UKGr, US are random variables distributed uniformly on KGr, S [51].Definition 6 (DDH (decisional Diffie-Hellman) ).
LetG be a group of prime order q and g a generator of G. The DDH problem is to distinguish between triplets of the form (ga,gb,gab) and (ga,gb,gc), where a,b,c are random elements of {1,…,q-1}.Definition 7 (collusion resistance).
The leaving memberUil∈Gl(1≤i≤n,1≤l<l′≤s) colluding with the members in the after sessions Ui′j∈Gj(1≤i′≤n,j≥l′,i≠i′) cannot recover KGij even knowing {αil,KGil} and {αi′j,KGi′j} [50], where Gl is a group G at l-th session.Definition 8 (security game ICR-IS).
(Indistinguishability of Ciphertexts from Random Bit Strings in Information Sharing)
Setup. The challenger C creates a ciphertext set B of m pages ∈{CPit}∈{Bt}(1≤i≤n,1≤t≤T) and gives this to the adversary A. A chooses a polynomial number of subsets from B. This collection of subsets is called B∗; C runs algorithm SysPrm,KeyGen,InfGenStr and encrypts each subset running algorithm Qr,VrQr,Vr,EncUp. Finally, C sends A all ciphertexts with their associated subsets.
Queries. A may request the encryption EncUp(B∗)) of any B and any verification Vr.
Challenge. A chooses a B0 and its subsets such that none of the algorithms (Qr,VrQr,Vr) given in the step Queries distinguishes B0 from B1=rand(B0). The challenger C chooses a random bit b and gives EncUp(Bb) to A. A again asks for encrypted pages and their verifications with the restriction that A may not ask for the algorithm that distinguishes B0 from B1. The total number of ciphertexts and verifications is ink.
Response. A outputs bA∈{0,1}. If bA=b, A is successful. In security game ICR-IS, adversary’s advantage is defined as Adv(1k)=|Pr⁡[bA=b]-1/2|.


### 3.4. Legitimate Group Member (LGM)

Every user (member) registers at SM with the contents-list which is the combination set for gestures and facial expressions of the user. All the gestures and facial expressions are randomly repeated and rearranged in the contents-list. Then, the user keeps the contents-list in their device for later authentication.St,ij is put as the stereoscopic image information for the gesture and facial expression of the memberi of groupt at thej-th session. Every session, SM selects one of the combinations of gestures and facial expressions from the contents-list and challenges the member of the group. Then, the member renders his own gesture and facial expression for St,ij.


## 3.1. Notations

The notations for SISS are explained in Table1.Table 1
Notations.
SM Security Manager  KG the group keys set of groupG  Gt thet-th group  T the total number of groups in a SISS server  mKg the master group key of groupG  CPi,tj the j-th ciphertext-page of a memberi in a group t  n the total number of groupG’s members  sn session number  m the total number of ciphertext-pageCP  Ut,ij a memberi of the t-th group in the j-th session  K G t , i j a group session key for each memberi of t-th group Gt in the j-th session s K i , 1 j , s K i , 2 j , s K i , 3 j , s K i , 4 j , s K i , 5 j: five subkeys for a group session key KGij of a member i in group G  αij random number of memberi in the j-th session  pij pseudonym of memberi in the j-th session  h(⋅) hash function  ht(x) the value hashed t-times for x  f(⋅) pseudorandom function  Sij stereoscopic image information for 3D real model of memberi in the j-th session  RSi a rendered image ofSi  E Encryption function  D Decryption function  M a message


## 3.2. Algorithms for SISS Model

A SISS model consists of the following eight algorithms.(1)
SysPrm(1k): Parameter Generation algorithm SysPrm takes as an input a security parameterk and produces a system parameter λ.(2)
KeyGen(λ): Taking λ as input, Key Generation algorithm KeyGen produces group session random numbers setRH, group member keys setK, and member pseudonym keys setP.(3)
InfGenStr(λ,RH,K,P): Taking λ, RH, K, P as input, Information Generation and Storage algorithm InfGenStr produces LGM (legitimate group member) and other information for authentication.(4)
Qr(RH,K,P): GivenRH, K, P, Query algorithm produces Query Value Qv.(5)
Vr_Qr(Qv). Given Qv, Verification algorithm verifies Qv, and Query algorithm produces Query Value Qv.(6)
Vr(Qv): Given Qv, Verification algorithm verifies Qv.(7)
EncUp(M): This algorithm encrypts and uploads messageM.(8)
DnDec(M): This algorithm downloads and decrypts messageM.


## 3.3. Security Building Blocks and Model

Definition 1 (one-way hash chain).
It is generated by selecting the last value at random and applying it to one-way hash functionh repeatedly. The initially chosen value is the last value of the key chain. Following are two properties of one-way hash chain.Property 2.
Anybody can deduce the earlier valueki belonging to the one-way key chain with the later value kj by checking hj-i(kj) which equals ki with the later value kj.Property 3.
Given the latest released valueki of one-way key chain, an adversary cannot find a later value kj such that hj-i(kj) equals ki. Even when value ki+1 is released, the second preimage collision resistant property prevents an adversary from finding ki+1′ different from ki+1 such that h(ki+1) equals ki [6].Remark. We call property 1 of one-way hash key chain ‘backward accessibility’ and property 2 ‘forward security’.Definition 4 (PRF (pseudorandom function) ).
We say that ‘F:Kf×X→Y is (t,q,e)-secure pseudorandom function’ if every oracle algorithm A making at most q oracle queries and with running time at most t has advantage AdvA<e. The advantage is defined as AdvA=|Pr⁡AFk=1-Pr⁡[Ag=1]| where g represents a random function selected uniformly from the set of all maps from X to Y, and where the probabilities are taken over the choice of k and g [51].Definition 5 (PRGGr (pseudorandom generator) ).
We say that ‘Gr:KGr→S is a (t,e)-secure pseudorandom generator’ if every algorithm A with running time at most t has advantage AdvA<e. The advantage is defined as AdvA=|Pr⁡AGrUKGr=1-Pr⁡[A(US)=1]|, where UKGr, US are random variables distributed uniformly on KGr, S [51].Definition 6 (DDH (decisional Diffie-Hellman) ).
LetG be a group of prime order q and g a generator of G. The DDH problem is to distinguish between triplets of the form (ga,gb,gab) and (ga,gb,gc), where a,b,c are random elements of {1,…,q-1}.Definition 7 (collusion resistance).
The leaving memberUil∈Gl(1≤i≤n,1≤l<l′≤s) colluding with the members in the after sessions Ui′j∈Gj(1≤i′≤n,j≥l′,i≠i′) cannot recover KGij even knowing {αil,KGil} and {αi′j,KGi′j} [50], where Gl is a group G at l-th session.Definition 8 (security game ICR-IS).
(Indistinguishability of Ciphertexts from Random Bit Strings in Information Sharing)
Setup. The challenger C creates a ciphertext set B of m pages ∈{CPit}∈{Bt}(1≤i≤n,1≤t≤T) and gives this to the adversary A. A chooses a polynomial number of subsets from B. This collection of subsets is called B∗; C runs algorithm SysPrm,KeyGen,InfGenStr and encrypts each subset running algorithm Qr,VrQr,Vr,EncUp. Finally, C sends A all ciphertexts with their associated subsets.
Queries. A may request the encryption EncUp(B∗)) of any B and any verification Vr.
Challenge. A chooses a B0 and its subsets such that none of the algorithms (Qr,VrQr,Vr) given in the step Queries distinguishes B0 from B1=rand(B0). The challenger C chooses a random bit b and gives EncUp(Bb) to A. A again asks for encrypted pages and their verifications with the restriction that A may not ask for the algorithm that distinguishes B0 from B1. The total number of ciphertexts and verifications is ink.
Response. A outputs bA∈{0,1}. If bA=b, A is successful. In security game ICR-IS, adversary’s advantage is defined as Adv(1k)=|Pr⁡[bA=b]-1/2|.


## 3.4. Legitimate Group Member (LGM)

Every user (member) registers at SM with the contents-list which is the combination set for gestures and facial expressions of the user. All the gestures and facial expressions are randomly repeated and rearranged in the contents-list. Then, the user keeps the contents-list in their device for later authentication.St,ij is put as the stereoscopic image information for the gesture and facial expression of the memberi of groupt at thej-th session. Every session, SM selects one of the combinations of gestures and facial expressions from the contents-list and challenges the member of the group. Then, the member renders his own gesture and facial expression for St,ij.


## 4. Construction of SISS Model

In this section, SISS is constructed by using the eight algorithms described before. This SISS model is divided largely into four processes: system setting, registration, authentication for login, and action. The whole process is shown in Table2 and the details are addressed in Section 4.1.Table 2
The whole process of SISS.
U s e r S M 1. System Setting 1.1. SysPrm  2. Registration 2.1. KeyGen 2.2. InfGenStr  3. Log-in by Authentication  3.1. QrU1 (1) Compute and Query:fpi1(KGi1),h(pi1) → { 1 ( s n ) , h ( p i 1 ) , f p i 1 ( K G i 1 ) , h ( E K G i 1 ( p i 1 | | S i 1 ) ) }  3.2. VrSM1_QrSM2 (1) Find:1(sn),h(pi1)→αis,pi1 (2) Decrypt:D(fpi1(KGi1))=KGi1 (3) Compute:hs-1(αis)=αi1′, K G i 1 ′ = { K 1 1 , K 2 1 , K 3 1 , K 4 1 , K 5 1 } ′ Verify:KGi1′=KGi1 (4) Compute & Verify: h ( E K G i 1 ( p i 1 | | S i 1 ) ) ′  = ?  h ( E K G i 1 ( p i 1 | | S i 1 ) ) (5) Compute:αi2,KGi2 (6) Compute & Query: ← f p i 1 ( K G i 2 , p i 2 ) , f p i 2 ( p i 1 | | S i 1 )  3.3. VrU2_QrU3 (1) Decrypt:D(fpi1(KGi2,pi2))=KGi2′,pi2′ (2) Compute & Verify: h ( E K G i 2 ( p i 2 ) ) ′  = ?  h ( E K G i 2 ( p i 2 ) ), h(pi2′)=pi1 Then,KGi2′→KGi2,pi2′→pi2 (3) Decrypt:D(fpi2(pi1||Si1))=pi1||Si1 (4) Render at a page:RSi1′  3.4. VrSM3 (1) Verify:RSi1′=RSi1  4. Action  4.1. EncUp [member-i] (1) Encrypt & Upload M:Ci1=EKGi1(M) → = K i , 3 1 K i , 1 1 ⋅ g K i , 2 1 ⋅ M = g h ( K G ) f ( K G ) M  4.2. DnDec [member-u] (1) Download from SISS Server: ← C i 1 (2) DecryptCi1:D=Ci1⋅Ku,31Ku,41⋅gKu,51=M


### 4.1. System Setting

#### 4.1.1.SysPrm(1k) Construction

The basis of security system SISS is established.(i)
Input;k: a security parameter.(ii)
Output;λ=f(·),h(·),G,g,Gr,n,j,i,E,D: system parameters’ set.f : { 0,1 } k × { 0,1 } ∗ → { 0,1 } kis a pseudorandom function and h:{0,1}∗→{0,1}k is a one-way hash function. Gr is a pseudorandom generator.G is a group of orderq which is a large prime. g is a generator of a groupG,n is the total members of groupG,j is the session number, andi is each member of groupG.E andD are encryption and decryption function.


### 4.2. Registration

The registration process consists of two algorithms:KeyGen(λ), InfGenStr(λ,RH,K,P).


#### 4.2.1.KeyGen(λ) Construction

Key materials are generated.(i)
Input; λ.(ii)
Output;RH(groupsessionrandomnumbersset), K(groupmemberskeysset), P(pseudonymkeysset).(  1) Group Session Random Numbers RH: Reversed One-Way Hash Chain. It is assumed that the total number of sessions iss. For every memberi, each different random number αis(1≤i≤n) is generated for the last session. Here, each αis is applied to one-way hash function (s-1) times repeatedly to generate all sessions’ random numbers and, respectively, for each user as follows.(1)αis,randomlygeneratedhαis=αis-1hαis-1=αis-2=h2αishαis-2=αis-3=h3αis⋯hαi4=αi3=hs-3αishαi3=αi2=hs-2αishαi2=αi1=hs-1αisTherefore, the first session’s random number of memberi is αi1 and thet-th session’s random number of memberi is αit:h(αit+1)=αit=hs-t(αis).With these different random numbers, we can make all different group keys for each member and each session, respectively.One-way hash functionh(·) plays the important role in group information sharing. One-Way hash chain is generated by randomly selecting the last value, which is repeatedly applied to one-way hash function h(·). The initially selected value is the last value of the hash chain. One-way hash chain has two properties as mentioned in Definition 1 in Section 3. Therefore, the two properties make it possible that a leaving member cannot compute new keys after leaving the group and any newly joining member can obtain all previous keys and information through applying the current key to hash function h(·) repeatedly.(  2) Group Keys Set K. It is assumed that there are ‘n’ members of the group ‘G’, and the group session keys for each memberi of groupG are {KGij}(1≤i≤n,1≤j≤s). Here,j is a session number ands is the last session. The each memberi’s group key KGij consists of totally five subkeys; sKi,1j,sKi,2j,sKi,3j,sKi,4j,sKi,5j. SM selects the master group key mKg of groupG∈{Gt},t≥1 and generates a random number to blind the master key in five subkeys, which is the way to construct a group member’s session key and, therefore, the last session group key KGis of useri.(2)sKi,1s=hmKgαis,sKi,2s=hmKgfmKgmKg1-αis,sKi,3s=gfmKgmKg,sKi,4s=-hmKg+αis,sKi,5s=fmKgmKgαisThe generation principle of group keys is that every different random number for each member and each session (n×s random numbers) is combined to the master group key mKg. Table 3 shows the random numbers and group keys for each member and each session which belong to the group G. The group G is one of the groups {Gt},t≥1.Table 3
Random number and group key.
Users U 1 U 2 U 3... session 1 random number α 1 1 α 2 1 ...  group key K G 1 1; K G 2 1; ... s K 1,1 1 = h ( m K g ) α 1 1 s K 2,1 1 = h ( m K g ) α 2 1 ... s K 1,2 1 = h ( m K g ) f m K g ( m K g ) ( 1 - α 1 1 ) s K 2,2 1 = h ( m K g ) f m K g ( m K g ) ( 1 - α 2 1 ) ... s K 1,3 1 = g f m K g ( m K g ) s K 1,3 1 = g f m K g ( m K g ) ... s K 1,4 1 = - ( h ( m K g ) + α 1 1 ) s K 2,4 1 = - ( h ( m K g ) + α 2 1 ) ... s K 1,5 1 = f m K g ( m K g ) α 1 1 s K 2,5 1 = f m K g ( m K g ) α 2 1 ...  session 2 random number α 1 2 α 2 2 ...  group key K G 1 2; K G 2 2; ... s K 1,1 2 = h ( m K g ) α 1 2 s K 2,1 2 = h ( m K g ) α 2 2 ... s K 1,2 2 = h ( m K g ) f m K g ( m K g ) ( 1 - α 1 2 ) s K 2,2 2 = h ( m K g ) f m K g ( m K g ) ( 1 - α 2 2 ) ... s K 1,3 2 = g f m K g ( m K g ) s K 1,3 2 = g f m K g ( m K g ) ... s K 1,4 2 = - ( h ( m K g ) + α 1 2 ) s K 2,4 2 = - ( h ( m K g ) + α 2 2 ) ... s K 1,5 2 = f m K g ( m K g ) α 1 2 s K 2,5 2 = f m K g ( m K g ) α 2 2 ...  session 3... ... ... ... ...(  3) Group Members’ Pseudonym Keys Set P: Reversed One-Way Hash Chain. For stronger security and privacy, SISS uses each member’s pseudonyms, which are generated with the reversed one-way hash chain in the same way as group session keys. Thus, each member has alsos pseudonyms which are denoted as pij (for each memberi,  1≤j≤s).(3)pis,randomlygeneratedhpis=pis-1hpis-1=pis-2=h2pishpis-2=pis-3=h3pis⋯hpi4=pi3=hs-3pishpi3=pi2=hs-2pishpi2=pi1=hs-1pis


#### 4.2.2.InfGenStr(λ) Construction

The values to be used for authentication are generated and saved.(i)
Input; λ: system parameters’ set.(ii)
Output; St,ij, h(EKGi1(pi1∥S)), {h(EKGij(pij))}, pi1, KGi1, αiq, {h(pij), pij}  (1≤j≤s).At the registration process, every user is given some information from SM and stores them in one’s own device such as in smartphone or PC:St,ij, pi1, KGi1, {h(EKGij(pij))},  h(EKGi1(pi1∥S)),  (1≤i≤n,1≤j≤s). SM also stores some information for each memberi: αis, {h(pij), pij}, mKg, St,ij,  (1≤j≤s).As such, the output ofInfGenStr(λ) is the values created by the SM and each user during the registration process, which means the values are stored in advance for later use in the authentication process.Additional Explanation for Encryption (E) and Decryption (D) with Group Keys. Here, EKGij(M) means ciphertextC with group members’ group key ‘KG={KGij}’ for a messageM. The encryption with the master key mKg is assumed C=EmKg(M)=gh(mKg)f(mKg)M.For simplicity, we putsKi,1s,sKi,2s,sKi,3s,sKi,4s,sKi,5s as K1,K2,K3,K4,K5, and fmKg(mKg) as f(mKg). Then, the encryption with each member’s group key {KGij}, for example, in the last session (i.e., j=s, KGis) is as follows:(4)C=EKGisM=K3K1gK2M=gfmKghmKgαisghmKgfmKg1-αisM=ghmKgfmKgM.The decryption method with the group master key ‘mKg’ is D=C·g-h(mKg)f(mKg)=M. Then, the decryption method with each member’s group key KGis in the last session is as follows:(5)D=C·K3K4gK5=ghmKgfmKgM·gfmKg-hmKg+αis·gfmKgαis=ghmKgfmKg-fmKghmKg-fmKgαis+fmKgαis·M=M.We can check whether the result of encryption/decryption with the master group key ‘mKg’ is the same as anything of each member’s group key KGij = {sKi,1j,sKi,2j,sKi,3j,sKi,4j,sKi,5j}  (1≤i≤n,1≤j≤s). Because of the properties of this developed encryption and decryption algorithms, SISS has no need for rekeying processes whenever membership-changes happen.


### 4.3. Login by Authentication

The login process consists of four algorithms:QrU1(RH,K,P), VrSM1_QrSM2(QvU1), VrU2QrU3(Qv-SM2), and VrSM3(RSij).


#### 4.3.1.QrU1(RH,K,P) Construction

A memberi makes login-request to SM with the stored information.(i)
Input; RH,K,P.(ii)
Output; QvU1 (1st querying value of a user).(1)Compute: fpi1(KGi1),h(pi1); with the stored value pi1,KGi1, a memberi computes fpi1(KGi1),h(pi1).(2)A member i queries SM withQvU1:(6)QvU1=1sn,hpi1,fpi1KGi1,hEKGi1pi1∥Si1.Here, h(EKGi1(pi1∥Si1)) is also the stored value at registration time. Because KGi1 is the memberi’s group key in the first session, EKGi1(pi1∥Si1) means (7)C=EKGi1pi1∥Si1=K31K11gK21pi1∥Si1=gfmKghmKgαi1ghmKgfmKg1-αi1pi1∥Si1=ghmKgfmKgpi1∥Si1.Here, for simplicity, K11,K21,K31 are denoted as the memberi’s subkeys for its group key KGi1 in the first session. K41,K51 are also the subkeys (for decryption) of KGi1.


#### 4.3.2.VrSM1_QrSM2(QvU1) Construction

The SM verifies the login-request of memberi and sends the next session information, the group key and the pseudorandom number, to memberi.(i)
Input; QvU1.(ii)
Output; QvSM2 (2nd querying value of SM).(1)Find: αis,pi1.SM checks1(sn),h(pi1) and finds the corresponding values αis,pi1 from its storage.(2)SM decrypts with pi1:D(fpi1(KGi1))=KGi1.(3)Compute and Verify: hs-1(αis)=αi1′, KGi1′=KGi1.For the found valueαis, SM applies αis to hash function repeatedly, up to (s-1) times. If he obtains the result αi1′, then SM computes KGi1′;(8)K11′=hmKgαi1′,K21′=hmKgfmKgmKg1-αi1′,K31′=gfmKgmKg,K41′=-hmKg+αi1′,K51′=fmKgmKgαi1′.Then, SM verifies KGi1′=KGi1 or not.(4)Compute and Verify with KGi1: h(EKGi1(pi1∥Si1))′=h(EKGi1(pi1∥Si1)).Here,EKGi1(pi1∥Si1) is the stored value at the registration time and the encryption method is the same as the above 1.(5)Compute: αi2,KGi2.SM appliesαis to hash function (s-2) times and then computes KGi2;(9)K12=hmKgαi2,K22=hmKgfmKgmKg1-αi2,K32=gfmKgmKg,K42=-hmKg+αi2,K52=fmKgmKgαi2.(6)Compute and Query withQvSM2:Q v S M 2 = fpi1(KGi2,pi2),fpi2(pi1∥Si1), where pi2 is also the stored value.


#### 4.3.3.VrU2_QrU3(QvSM2) Construction

A memberi verifies the received information from SM, then stores it for the next session, and renders the stereoscopic image on his page.(i)
Input; QvSM2.(ii)
Output; RSij (rendering of Sij).(1)Decrypt:i decrypts D(fpi1(KGi2,pi2))=KGi2′,pi2′ with the value pi1.(2)Compute and Verify: h(EKGi2(pi2))′=h(EKGi2(pi2)), h(pi2′)=pi1.With the decrypted valuesKGi2′,pi2′, the group memberi computes h(EKGi2(pi2))′ and verifies if this is the same as h(EKGi2(pi2)). Then,i hashes the value pi2′ and verifies h(pi2′)=pi1. If the verifications are successful, KGi2′ and pi2′ become KGi2 and pi2.(3)Decrypt with pi2: D(fpi2(pi1∥Si1))=pi1∥Si1.(4)Render and Upload:RSi1′ at a page.


#### 4.3.4.VrSM3(RSi1) Construction

SM verifies what the memberi has rendered.(i)
Input; RSij.(ii)
Output; 1 or 0.(1)Verify: RSi1′=RSi1(3D  facial  expression  and  gesture).In this process, a legitimate group member authentication is processed by rendering the decryptedSi1 with the member’s external device. If SM’s verification is successful (return message: 1), the memberi can begin to act (login allowed). The action means uploading, downloading, and reading (decryption).


### 4.4. Action

The Action Process consists of two algorithms:EncUp(M), DnDec(M).


#### 4.4.1.EncUp(M) Construction

A memberi encrypts and uploads the sharing information.(i)
Input; M.(ii)
Output; Ci1.(1)Encrypt and Upload M by a memberi.(10)Ci1=EKGi1M=Ki,31Ki,11·gKi,21·M=ghmKgfmKgM


#### 4.4.2.DnDec(M) Construction

Another memberu downloads and decrypts the sharing information.(i)
Input; Ci1.(ii)
Output; M.(1)Download: Ci1.Another memberu downloads Ci1 from SISS bulletin (server).(2)DecryptCi1: D=Ci1·Ku,31Ku,41·gKu,51 = gh(mKg)f(mKg)M·(gf(mKg))-(h(mKg)+αu1)·gf(mKg)αu1 = gh(mKg)f(mKg)-f(mKg)h(mKg)-f(mKg)αu1+f(mKg)αu1·M=M.[The Second Session]. From the second session, most processes are similar to the first session. As the session is changed, the corresponding pseudonym keys and group session keys are also changed. As for the stereoscopic image information S for 3D real model, a member sends the information St kept from the first session to SM, and then SM challenges the member with the newly selected information St+1 at (6) of the algorithm VrSM1_QrSM2. Lastly, the member renders 3D real model RSt+l at his page. Action stage is also similar to the first session.


## 4.1. System Setting

### 4.1.1.SysPrm(1k) Construction

The basis of security system SISS is established.(i)
Input;k: a security parameter.(ii)
Output;λ=f(·),h(·),G,g,Gr,n,j,i,E,D: system parameters’ set.f : { 0,1 } k × { 0,1 } ∗ → { 0,1 } kis a pseudorandom function and h:{0,1}∗→{0,1}k is a one-way hash function. Gr is a pseudorandom generator.G is a group of orderq which is a large prime. g is a generator of a groupG,n is the total members of groupG,j is the session number, andi is each member of groupG.E andD are encryption and decryption function.


## 4.1.1.SysPrm(1k) Construction

The basis of security system SISS is established.(i)
Input;k: a security parameter.(ii)
Output;λ=f(·),h(·),G,g,Gr,n,j,i,E,D: system parameters’ set.f : { 0,1 } k × { 0,1 } ∗ → { 0,1 } kis a pseudorandom function and h:{0,1}∗→{0,1}k is a one-way hash function. Gr is a pseudorandom generator.G is a group of orderq which is a large prime. g is a generator of a groupG,n is the total members of groupG,j is the session number, andi is each member of groupG.E andD are encryption and decryption function.


## 4.2. Registration

The registration process consists of two algorithms:KeyGen(λ), InfGenStr(λ,RH,K,P).


### 4.2.1.KeyGen(λ) Construction

Key materials are generated.(i)
Input; λ.(ii)
Output;RH(groupsessionrandomnumbersset), K(groupmemberskeysset), P(pseudonymkeysset).(  1) Group Session Random Numbers RH: Reversed One-Way Hash Chain. It is assumed that the total number of sessions iss. For every memberi, each different random number αis(1≤i≤n) is generated for the last session. Here, each αis is applied to one-way hash function (s-1) times repeatedly to generate all sessions’ random numbers and, respectively, for each user as follows.(1)αis,randomlygeneratedhαis=αis-1hαis-1=αis-2=h2αishαis-2=αis-3=h3αis⋯hαi4=αi3=hs-3αishαi3=αi2=hs-2αishαi2=αi1=hs-1αisTherefore, the first session’s random number of memberi is αi1 and thet-th session’s random number of memberi is αit:h(αit+1)=αit=hs-t(αis).With these different random numbers, we can make all different group keys for each member and each session, respectively.One-way hash functionh(·) plays the important role in group information sharing. One-Way hash chain is generated by randomly selecting the last value, which is repeatedly applied to one-way hash function h(·). The initially selected value is the last value of the hash chain. One-way hash chain has two properties as mentioned in Definition 1 in Section 3. Therefore, the two properties make it possible that a leaving member cannot compute new keys after leaving the group and any newly joining member can obtain all previous keys and information through applying the current key to hash function h(·) repeatedly.(  2) Group Keys Set K. It is assumed that there are ‘n’ members of the group ‘G’, and the group session keys for each memberi of groupG are {KGij}(1≤i≤n,1≤j≤s). Here,j is a session number ands is the last session. The each memberi’s group key KGij consists of totally five subkeys; sKi,1j,sKi,2j,sKi,3j,sKi,4j,sKi,5j. SM selects the master group key mKg of groupG∈{Gt},t≥1 and generates a random number to blind the master key in five subkeys, which is the way to construct a group member’s session key and, therefore, the last session group key KGis of useri.(2)sKi,1s=hmKgαis,sKi,2s=hmKgfmKgmKg1-αis,sKi,3s=gfmKgmKg,sKi,4s=-hmKg+αis,sKi,5s=fmKgmKgαisThe generation principle of group keys is that every different random number for each member and each session (n×s random numbers) is combined to the master group key mKg. Table 3 shows the random numbers and group keys for each member and each session which belong to the group G. The group G is one of the groups {Gt},t≥1.Table 3
Random number and group key.
Users U 1 U 2 U 3... session 1 random number α 1 1 α 2 1 ...  group key K G 1 1; K G 2 1; ... s K 1,1 1 = h ( m K g ) α 1 1 s K 2,1 1 = h ( m K g ) α 2 1 ... s K 1,2 1 = h ( m K g ) f m K g ( m K g ) ( 1 - α 1 1 ) s K 2,2 1 = h ( m K g ) f m K g ( m K g ) ( 1 - α 2 1 ) ... s K 1,3 1 = g f m K g ( m K g ) s K 1,3 1 = g f m K g ( m K g ) ... s K 1,4 1 = - ( h ( m K g ) + α 1 1 ) s K 2,4 1 = - ( h ( m K g ) + α 2 1 ) ... s K 1,5 1 = f m K g ( m K g ) α 1 1 s K 2,5 1 = f m K g ( m K g ) α 2 1 ...  session 2 random number α 1 2 α 2 2 ...  group key K G 1 2; K G 2 2; ... s K 1,1 2 = h ( m K g ) α 1 2 s K 2,1 2 = h ( m K g ) α 2 2 ... s K 1,2 2 = h ( m K g ) f m K g ( m K g ) ( 1 - α 1 2 ) s K 2,2 2 = h ( m K g ) f m K g ( m K g ) ( 1 - α 2 2 ) ... s K 1,3 2 = g f m K g ( m K g ) s K 1,3 2 = g f m K g ( m K g ) ... s K 1,4 2 = - ( h ( m K g ) + α 1 2 ) s K 2,4 2 = - ( h ( m K g ) + α 2 2 ) ... s K 1,5 2 = f m K g ( m K g ) α 1 2 s K 2,5 2 = f m K g ( m K g ) α 2 2 ...  session 3... ... ... ... ...(  3) Group Members’ Pseudonym Keys Set P: Reversed One-Way Hash Chain. For stronger security and privacy, SISS uses each member’s pseudonyms, which are generated with the reversed one-way hash chain in the same way as group session keys. Thus, each member has alsos pseudonyms which are denoted as pij (for each memberi,  1≤j≤s).(3)pis,randomlygeneratedhpis=pis-1hpis-1=pis-2=h2pishpis-2=pis-3=h3pis⋯hpi4=pi3=hs-3pishpi3=pi2=hs-2pishpi2=pi1=hs-1pis


### 4.2.2.InfGenStr(λ) Construction

The values to be used for authentication are generated and saved.(i)
Input; λ: system parameters’ set.(ii)
Output; St,ij, h(EKGi1(pi1∥S)), {h(EKGij(pij))}, pi1, KGi1, αiq, {h(pij), pij}  (1≤j≤s).At the registration process, every user is given some information from SM and stores them in one’s own device such as in smartphone or PC:St,ij, pi1, KGi1, {h(EKGij(pij))},  h(EKGi1(pi1∥S)),  (1≤i≤n,1≤j≤s). SM also stores some information for each memberi: αis, {h(pij), pij}, mKg, St,ij,  (1≤j≤s).As such, the output ofInfGenStr(λ) is the values created by the SM and each user during the registration process, which means the values are stored in advance for later use in the authentication process.Additional Explanation for Encryption (E) and Decryption (D) with Group Keys. Here, EKGij(M) means ciphertextC with group members’ group key ‘KG={KGij}’ for a messageM. The encryption with the master key mKg is assumed C=EmKg(M)=gh(mKg)f(mKg)M.For simplicity, we putsKi,1s,sKi,2s,sKi,3s,sKi,4s,sKi,5s as K1,K2,K3,K4,K5, and fmKg(mKg) as f(mKg). Then, the encryption with each member’s group key {KGij}, for example, in the last session (i.e., j=s, KGis) is as follows:(4)C=EKGisM=K3K1gK2M=gfmKghmKgαisghmKgfmKg1-αisM=ghmKgfmKgM.The decryption method with the group master key ‘mKg’ is D=C·g-h(mKg)f(mKg)=M. Then, the decryption method with each member’s group key KGis in the last session is as follows:(5)D=C·K3K4gK5=ghmKgfmKgM·gfmKg-hmKg+αis·gfmKgαis=ghmKgfmKg-fmKghmKg-fmKgαis+fmKgαis·M=M.We can check whether the result of encryption/decryption with the master group key ‘mKg’ is the same as anything of each member’s group key KGij = {sKi,1j,sKi,2j,sKi,3j,sKi,4j,sKi,5j}  (1≤i≤n,1≤j≤s). Because of the properties of this developed encryption and decryption algorithms, SISS has no need for rekeying processes whenever membership-changes happen.


## 4.2.1.KeyGen(λ) Construction

Key materials are generated.(i)
Input; λ.(ii)
Output;RH(groupsessionrandomnumbersset), K(groupmemberskeysset), P(pseudonymkeysset).(  1) Group Session Random Numbers RH: Reversed One-Way Hash Chain. It is assumed that the total number of sessions iss. For every memberi, each different random number αis(1≤i≤n) is generated for the last session. Here, each αis is applied to one-way hash function (s-1) times repeatedly to generate all sessions’ random numbers and, respectively, for each user as follows.(1)αis,randomlygeneratedhαis=αis-1hαis-1=αis-2=h2αishαis-2=αis-3=h3αis⋯hαi4=αi3=hs-3αishαi3=αi2=hs-2αishαi2=αi1=hs-1αisTherefore, the first session’s random number of memberi is αi1 and thet-th session’s random number of memberi is αit:h(αit+1)=αit=hs-t(αis).With these different random numbers, we can make all different group keys for each member and each session, respectively.One-way hash functionh(·) plays the important role in group information sharing. One-Way hash chain is generated by randomly selecting the last value, which is repeatedly applied to one-way hash function h(·). The initially selected value is the last value of the hash chain. One-way hash chain has two properties as mentioned in Definition 1 in Section 3. Therefore, the two properties make it possible that a leaving member cannot compute new keys after leaving the group and any newly joining member can obtain all previous keys and information through applying the current key to hash function h(·) repeatedly.(  2) Group Keys Set K. It is assumed that there are ‘n’ members of the group ‘G’, and the group session keys for each memberi of groupG are {KGij}(1≤i≤n,1≤j≤s). Here,j is a session number ands is the last session. The each memberi’s group key KGij consists of totally five subkeys; sKi,1j,sKi,2j,sKi,3j,sKi,4j,sKi,5j. SM selects the master group key mKg of groupG∈{Gt},t≥1 and generates a random number to blind the master key in five subkeys, which is the way to construct a group member’s session key and, therefore, the last session group key KGis of useri.(2)sKi,1s=hmKgαis,sKi,2s=hmKgfmKgmKg1-αis,sKi,3s=gfmKgmKg,sKi,4s=-hmKg+αis,sKi,5s=fmKgmKgαisThe generation principle of group keys is that every different random number for each member and each session (n×s random numbers) is combined to the master group key mKg. Table 3 shows the random numbers and group keys for each member and each session which belong to the group G. The group G is one of the groups {Gt},t≥1.Table 3
Random number and group key.
Users U 1 U 2 U 3... session 1 random number α 1 1 α 2 1 ...  group key K G 1 1; K G 2 1; ... s K 1,1 1 = h ( m K g ) α 1 1 s K 2,1 1 = h ( m K g ) α 2 1 ... s K 1,2 1 = h ( m K g ) f m K g ( m K g ) ( 1 - α 1 1 ) s K 2,2 1 = h ( m K g ) f m K g ( m K g ) ( 1 - α 2 1 ) ... s K 1,3 1 = g f m K g ( m K g ) s K 1,3 1 = g f m K g ( m K g ) ... s K 1,4 1 = - ( h ( m K g ) + α 1 1 ) s K 2,4 1 = - ( h ( m K g ) + α 2 1 ) ... s K 1,5 1 = f m K g ( m K g ) α 1 1 s K 2,5 1 = f m K g ( m K g ) α 2 1 ...  session 2 random number α 1 2 α 2 2 ...  group key K G 1 2; K G 2 2; ... s K 1,1 2 = h ( m K g ) α 1 2 s K 2,1 2 = h ( m K g ) α 2 2 ... s K 1,2 2 = h ( m K g ) f m K g ( m K g ) ( 1 - α 1 2 ) s K 2,2 2 = h ( m K g ) f m K g ( m K g ) ( 1 - α 2 2 ) ... s K 1,3 2 = g f m K g ( m K g ) s K 1,3 2 = g f m K g ( m K g ) ... s K 1,4 2 = - ( h ( m K g ) + α 1 2 ) s K 2,4 2 = - ( h ( m K g ) + α 2 2 ) ... s K 1,5 2 = f m K g ( m K g ) α 1 2 s K 2,5 2 = f m K g ( m K g ) α 2 2 ...  session 3... ... ... ... ...(  3) Group Members’ Pseudonym Keys Set P: Reversed One-Way Hash Chain. For stronger security and privacy, SISS uses each member’s pseudonyms, which are generated with the reversed one-way hash chain in the same way as group session keys. Thus, each member has alsos pseudonyms which are denoted as pij (for each memberi,  1≤j≤s).(3)pis,randomlygeneratedhpis=pis-1hpis-1=pis-2=h2pishpis-2=pis-3=h3pis⋯hpi4=pi3=hs-3pishpi3=pi2=hs-2pishpi2=pi1=hs-1pis


## 4.2.2.InfGenStr(λ) Construction

The values to be used for authentication are generated and saved.(i)
Input; λ: system parameters’ set.(ii)
Output; St,ij, h(EKGi1(pi1∥S)), {h(EKGij(pij))}, pi1, KGi1, αiq, {h(pij), pij}  (1≤j≤s).At the registration process, every user is given some information from SM and stores them in one’s own device such as in smartphone or PC:St,ij, pi1, KGi1, {h(EKGij(pij))},  h(EKGi1(pi1∥S)),  (1≤i≤n,1≤j≤s). SM also stores some information for each memberi: αis, {h(pij), pij}, mKg, St,ij,  (1≤j≤s).As such, the output ofInfGenStr(λ) is the values created by the SM and each user during the registration process, which means the values are stored in advance for later use in the authentication process.Additional Explanation for Encryption (E) and Decryption (D) with Group Keys. Here, EKGij(M) means ciphertextC with group members’ group key ‘KG={KGij}’ for a messageM. The encryption with the master key mKg is assumed C=EmKg(M)=gh(mKg)f(mKg)M.For simplicity, we putsKi,1s,sKi,2s,sKi,3s,sKi,4s,sKi,5s as K1,K2,K3,K4,K5, and fmKg(mKg) as f(mKg). Then, the encryption with each member’s group key {KGij}, for example, in the last session (i.e., j=s, KGis) is as follows:(4)C=EKGisM=K3K1gK2M=gfmKghmKgαisghmKgfmKg1-αisM=ghmKgfmKgM.The decryption method with the group master key ‘mKg’ is D=C·g-h(mKg)f(mKg)=M. Then, the decryption method with each member’s group key KGis in the last session is as follows:(5)D=C·K3K4gK5=ghmKgfmKgM·gfmKg-hmKg+αis·gfmKgαis=ghmKgfmKg-fmKghmKg-fmKgαis+fmKgαis·M=M.We can check whether the result of encryption/decryption with the master group key ‘mKg’ is the same as anything of each member’s group key KGij = {sKi,1j,sKi,2j,sKi,3j,sKi,4j,sKi,5j}  (1≤i≤n,1≤j≤s). Because of the properties of this developed encryption and decryption algorithms, SISS has no need for rekeying processes whenever membership-changes happen.


## 4.3. Login by Authentication

The login process consists of four algorithms:QrU1(RH,K,P), VrSM1_QrSM2(QvU1), VrU2QrU3(Qv-SM2), and VrSM3(RSij).


### 4.3.1.QrU1(RH,K,P) Construction

A memberi makes login-request to SM with the stored information.(i)
Input; RH,K,P.(ii)
Output; QvU1 (1st querying value of a user).(1)Compute: fpi1(KGi1),h(pi1); with the stored value pi1,KGi1, a memberi computes fpi1(KGi1),h(pi1).(2)A member i queries SM withQvU1:(6)QvU1=1sn,hpi1,fpi1KGi1,hEKGi1pi1∥Si1.Here, h(EKGi1(pi1∥Si1)) is also the stored value at registration time. Because KGi1 is the memberi’s group key in the first session, EKGi1(pi1∥Si1) means (7)C=EKGi1pi1∥Si1=K31K11gK21pi1∥Si1=gfmKghmKgαi1ghmKgfmKg1-αi1pi1∥Si1=ghmKgfmKgpi1∥Si1.Here, for simplicity, K11,K21,K31 are denoted as the memberi’s subkeys for its group key KGi1 in the first session. K41,K51 are also the subkeys (for decryption) of KGi1.


### 4.3.2.VrSM1_QrSM2(QvU1) Construction

The SM verifies the login-request of memberi and sends the next session information, the group key and the pseudorandom number, to memberi.(i)
Input; QvU1.(ii)
Output; QvSM2 (2nd querying value of SM).(1)Find: αis,pi1.SM checks1(sn),h(pi1) and finds the corresponding values αis,pi1 from its storage.(2)SM decrypts with pi1:D(fpi1(KGi1))=KGi1.(3)Compute and Verify: hs-1(αis)=αi1′, KGi1′=KGi1.For the found valueαis, SM applies αis to hash function repeatedly, up to (s-1) times. If he obtains the result αi1′, then SM computes KGi1′;(8)K11′=hmKgαi1′,K21′=hmKgfmKgmKg1-αi1′,K31′=gfmKgmKg,K41′=-hmKg+αi1′,K51′=fmKgmKgαi1′.Then, SM verifies KGi1′=KGi1 or not.(4)Compute and Verify with KGi1: h(EKGi1(pi1∥Si1))′=h(EKGi1(pi1∥Si1)).Here,EKGi1(pi1∥Si1) is the stored value at the registration time and the encryption method is the same as the above 1.(5)Compute: αi2,KGi2.SM appliesαis to hash function (s-2) times and then computes KGi2;(9)K12=hmKgαi2,K22=hmKgfmKgmKg1-αi2,K32=gfmKgmKg,K42=-hmKg+αi2,K52=fmKgmKgαi2.(6)Compute and Query withQvSM2:Q v S M 2 = fpi1(KGi2,pi2),fpi2(pi1∥Si1), where pi2 is also the stored value.


### 4.3.3.VrU2_QrU3(QvSM2) Construction

A memberi verifies the received information from SM, then stores it for the next session, and renders the stereoscopic image on his page.(i)
Input; QvSM2.(ii)
Output; RSij (rendering of Sij).(1)Decrypt:i decrypts D(fpi1(KGi2,pi2))=KGi2′,pi2′ with the value pi1.(2)Compute and Verify: h(EKGi2(pi2))′=h(EKGi2(pi2)), h(pi2′)=pi1.With the decrypted valuesKGi2′,pi2′, the group memberi computes h(EKGi2(pi2))′ and verifies if this is the same as h(EKGi2(pi2)). Then,i hashes the value pi2′ and verifies h(pi2′)=pi1. If the verifications are successful, KGi2′ and pi2′ become KGi2 and pi2.(3)Decrypt with pi2: D(fpi2(pi1∥Si1))=pi1∥Si1.(4)Render and Upload:RSi1′ at a page.


### 4.3.4.VrSM3(RSi1) Construction

SM verifies what the memberi has rendered.(i)
Input; RSij.(ii)
Output; 1 or 0.(1)Verify: RSi1′=RSi1(3D  facial  expression  and  gesture).In this process, a legitimate group member authentication is processed by rendering the decryptedSi1 with the member’s external device. If SM’s verification is successful (return message: 1), the memberi can begin to act (login allowed). The action means uploading, downloading, and reading (decryption).


## 4.3.1.QrU1(RH,K,P) Construction

A memberi makes login-request to SM with the stored information.(i)
Input; RH,K,P.(ii)
Output; QvU1 (1st querying value of a user).(1)Compute: fpi1(KGi1),h(pi1); with the stored value pi1,KGi1, a memberi computes fpi1(KGi1),h(pi1).(2)A member i queries SM withQvU1:(6)QvU1=1sn,hpi1,fpi1KGi1,hEKGi1pi1∥Si1.Here, h(EKGi1(pi1∥Si1)) is also the stored value at registration time. Because KGi1 is the memberi’s group key in the first session, EKGi1(pi1∥Si1) means (7)C=EKGi1pi1∥Si1=K31K11gK21pi1∥Si1=gfmKghmKgαi1ghmKgfmKg1-αi1pi1∥Si1=ghmKgfmKgpi1∥Si1.Here, for simplicity, K11,K21,K31 are denoted as the memberi’s subkeys for its group key KGi1 in the first session. K41,K51 are also the subkeys (for decryption) of KGi1.


## 4.3.2.VrSM1_QrSM2(QvU1) Construction

The SM verifies the login-request of memberi and sends the next session information, the group key and the pseudorandom number, to memberi.(i)
Input; QvU1.(ii)
Output; QvSM2 (2nd querying value of SM).(1)Find: αis,pi1.SM checks1(sn),h(pi1) and finds the corresponding values αis,pi1 from its storage.(2)SM decrypts with pi1:D(fpi1(KGi1))=KGi1.(3)Compute and Verify: hs-1(αis)=αi1′, KGi1′=KGi1.For the found valueαis, SM applies αis to hash function repeatedly, up to (s-1) times. If he obtains the result αi1′, then SM computes KGi1′;(8)K11′=hmKgαi1′,K21′=hmKgfmKgmKg1-αi1′,K31′=gfmKgmKg,K41′=-hmKg+αi1′,K51′=fmKgmKgαi1′.Then, SM verifies KGi1′=KGi1 or not.(4)Compute and Verify with KGi1: h(EKGi1(pi1∥Si1))′=h(EKGi1(pi1∥Si1)).Here,EKGi1(pi1∥Si1) is the stored value at the registration time and the encryption method is the same as the above 1.(5)Compute: αi2,KGi2.SM appliesαis to hash function (s-2) times and then computes KGi2;(9)K12=hmKgαi2,K22=hmKgfmKgmKg1-αi2,K32=gfmKgmKg,K42=-hmKg+αi2,K52=fmKgmKgαi2.(6)Compute and Query withQvSM2:Q v S M 2 = fpi1(KGi2,pi2),fpi2(pi1∥Si1), where pi2 is also the stored value.


## 4.3.3.VrU2_QrU3(QvSM2) Construction

A memberi verifies the received information from SM, then stores it for the next session, and renders the stereoscopic image on his page.(i)
Input; QvSM2.(ii)
Output; RSij (rendering of Sij).(1)Decrypt:i decrypts D(fpi1(KGi2,pi2))=KGi2′,pi2′ with the value pi1.(2)Compute and Verify: h(EKGi2(pi2))′=h(EKGi2(pi2)), h(pi2′)=pi1.With the decrypted valuesKGi2′,pi2′, the group memberi computes h(EKGi2(pi2))′ and verifies if this is the same as h(EKGi2(pi2)). Then,i hashes the value pi2′ and verifies h(pi2′)=pi1. If the verifications are successful, KGi2′ and pi2′ become KGi2 and pi2.(3)Decrypt with pi2: D(fpi2(pi1∥Si1))=pi1∥Si1.(4)Render and Upload:RSi1′ at a page.


## 4.3.4.VrSM3(RSi1) Construction

SM verifies what the memberi has rendered.(i)
Input; RSij.(ii)
Output; 1 or 0.(1)Verify: RSi1′=RSi1(3D  facial  expression  and  gesture).In this process, a legitimate group member authentication is processed by rendering the decryptedSi1 with the member’s external device. If SM’s verification is successful (return message: 1), the memberi can begin to act (login allowed). The action means uploading, downloading, and reading (decryption).


## 4.4. Action

The Action Process consists of two algorithms:EncUp(M), DnDec(M).


### 4.4.1.EncUp(M) Construction

A memberi encrypts and uploads the sharing information.(i)
Input; M.(ii)
Output; Ci1.(1)Encrypt and Upload M by a memberi.(10)Ci1=EKGi1M=Ki,31Ki,11·gKi,21·M=ghmKgfmKgM


### 4.4.2.DnDec(M) Construction

Another memberu downloads and decrypts the sharing information.(i)
Input; Ci1.(ii)
Output; M.(1)Download: Ci1.Another memberu downloads Ci1 from SISS bulletin (server).(2)DecryptCi1: D=Ci1·Ku,31Ku,41·gKu,51 = gh(mKg)f(mKg)M·(gf(mKg))-(h(mKg)+αu1)·gf(mKg)αu1 = gh(mKg)f(mKg)-f(mKg)h(mKg)-f(mKg)αu1+f(mKg)αu1·M=M.[The Second Session]. From the second session, most processes are similar to the first session. As the session is changed, the corresponding pseudonym keys and group session keys are also changed. As for the stereoscopic image information S for 3D real model, a member sends the information St kept from the first session to SM, and then SM challenges the member with the newly selected information St+1 at (6) of the algorithm VrSM1_QrSM2. Lastly, the member renders 3D real model RSt+l at his page. Action stage is also similar to the first session.


## 4.4.1.EncUp(M) Construction

A memberi encrypts and uploads the sharing information.(i)
Input; M.(ii)
Output; Ci1.(1)Encrypt and Upload M by a memberi.(10)Ci1=EKGi1M=Ki,31Ki,11·gKi,21·M=ghmKgfmKgM


## 4.4.2.DnDec(M) Construction

Another memberu downloads and decrypts the sharing information.(i)
Input; Ci1.(ii)
Output; M.(1)Download: Ci1.Another memberu downloads Ci1 from SISS bulletin (server).(2)DecryptCi1: D=Ci1·Ku,31Ku,41·gKu,51 = gh(mKg)f(mKg)M·(gf(mKg))-(h(mKg)+αu1)·gf(mKg)αu1 = gh(mKg)f(mKg)-f(mKg)h(mKg)-f(mKg)αu1+f(mKg)αu1·M=M.[The Second Session]. From the second session, most processes are similar to the first session. As the session is changed, the corresponding pseudonym keys and group session keys are also changed. As for the stereoscopic image information S for 3D real model, a member sends the information St kept from the first session to SM, and then SM challenges the member with the newly selected information St+1 at (6) of the algorithm VrSM1_QrSM2. Lastly, the member renders 3D real model RSt+l at his page. Action stage is also similar to the first session.


## 5. Security Analysis

The security requirements related to group key are as follows:(1) Group Key Secrecy: It should be computationally impossible that a passive adversary discovers any secret group key.(2) Forward Secrecy:Any passive adversary with a subset of old group keys cannot discover any subsequent (later) group key.(3) Backward Secrecy:Any passive adversary with a subset of subsequent group keys cannot discover any preceding (earlier) group key.(4) Key Independence:Any passive adversary with any subset of group keys cannot discover any other group key [4].In this paper, the term negligible function refers to a functionη:N→R such that for any c∈N, there exists nc∈N, such that η(n)<1/nc for all n≥nc [5].The model SISS satisfies group information sharing secrecy as follows: (1) forward secrecy, (2) backward accessibility, (3) group key secrecy, and (4) collusion resistance.Theorem 1 (forward secrecy).
For any group, an adversaryA (including a participant p∈Gtj) cannot know valid group key for(j+l)-th authentication when the adversaryA knows group key KGij, where p∉Gtj+l  (1≤j≤s, 0<l≤s-j, 1≤t≤T).Proof.
By Property3 of Definition 1, if the latest released group key is KGij, no one can know a later value KGil such that h(l-j)(KGil)=KGij. Therefore, the probability that a participant p∈Gtj can generate valid group keys for the nextl-th session is negligible, where p∉Gtj+l (j<l≤s). It means that all leaving group members cannot access any of the next documents of the group anymore.Theorem 2 (backward accessibility).
For any groupGt, an adversaryA (including a participant p∈Gtj) can generate valid group key for(j-l)-th authentication when the adversaryA knows group key KGij, where p∉Gtj-l (0<l<j). Namely, all joining members to a group can access all of the previous information of the group.Proof.
By Property2 of Definition 1, if the latest released group key is KGij, anyone can deduce earlier values KGil (0<l<j) by applying the later value KGij to one-way hash key chain like this: h(j-l)(KGij)=KGil. Therefore, the probability that a participant p∈Gtj can generate valid group keys for the earlierl-th session is 1-η(n), where p∉Gtj-l (0<l<j). Namely, all members joining a group can access all of the previous information of the group.Theorem 3 (group key secrecy).
For any groupGt, when a revelation of group key KGij happens, the probability that an adversaryA (including a participant p∈Gtj) can guess correctly the encrypted information message M of group Gt at the j-th session is negligible.Corollary 4.
SISS is semantic secure according to the security game ICR -IS, if DDH is hard and the key material is chosen as described in the algorithm construction.The cryptographic elements for authentication and whole protocol are PRF (pseudorandom function, e.g., 128 bit-AES), PRG (pseudorandom generator, e.g., middle-square method, Naor-Reingold pseudorandom function, etc.), and hash function (HAS-160), generally known as secure cryptographic function. Through the cooperative processes of these elements, the final encryption isC=EKGis(M)=gh(mKg)f(mKg)M. Hence, we have only to show the security under the condition of ‘DDH is hard’.Proof (it is proved by contraposition) .
A is assumed as an adversary that wins the security game ICR-IS with advantage ε. We construct an adversary Ω, which usesA as a subroutine and breaks the DDH with nonnegligible advantage.
(i)Setup. Algorithm Ω createsm message pages ∈{Mi,tj}∈{Mt}(1≤i≤n,1≤t≤T,1≤j≤m) and gives this to the adversaryA.
A chooses a polynomial number of subsets {Mi,tj}∈{Mt} from messages set M. This collection of subsets is called M∗.A sends them to Ω again. Ω invokes algorithm SysPrm,KeyGen,InfGenStr. After creating all ciphertext pages {CPi,tj}∈{CPt} for M∗, Ω gives them and their associated subsets toA.
Here, letgδ,gτ,gγ be a Diffie-Hellman triplet; the challenge is to determine γ=δτ. Ω guesses a value CPx for the page CPy that A will choose in the game ICR-IS, by picking Mx uniformly at random in {Mi,tj}(1≤t≤T). Ω simulates the algorithm EndUp on {CPi,tj} as follows. Ω maps every ciphertext page {CPi,tj} to a random value {xi,tj}. For B= {Bt}={CPi,tj}, Ω chooses random number γt and outputs the following.(11)Bt1≤i≤n,1≤t≤T,1≤j≤m=CPi,1j=ghk1fk1Mi,1j=gγ1xi,1j=gδ1τ1xi,1j=CPi,2j=ghk2fk2Mi,2j=gγ2xi,2j=gδ2τ2xi,2j⋯⋯=CPi,Tj=ghkTfkTMi,Tj=gγtxi,Tj=gδTτTxi,Tj
(ii)Queries. IfA queries for the message page {Mi,tj}, Ω outputs the ciphertext page {CPi,tj}= {(gγt(xi,tj)}.
(iii)Challenge. Finally,A selects a challenge page set B0∈Mt at random and generates another page set B1 from M. Next,A gives B0,B1 to Ω. Ω chooses bR←{0,1} and chooses random number γb. Ω returns toA the following ciphertext: In the case of b=0, CPy=gγ0(xi,0j). If b=1, Ω returns random value in reply to DDH challenge. If γ=δτ, this is an encryption of {CPx}; otherwise it is not.A is again allowed to ask for pages of the Board set with the restriction thatA must not make a query to distinguish {CPi,0j} from {CPi,1j}=rand(CPi,0j) where {CPi,0j} means a DDH triplet and {CPi,1j} is not a DDH triplet.
(iv)Response.A outputs a bit b′. If b′=b, Ω guesses that gδ,gτ,gγ constitute a DDH triplet. If b′≠b, Ω guesses that gδ,gτ,gγ do not constitute a DDH triplet. Since the encryption will be random for the page {CPx} if and only if the challenge is not a DDH tuple, Ω solves the DDH challenge with the same advantage thatA has in winning security game ICR-IS.
It is shown thatΩ can solve the DDH problem (γ=δτ) with nonnegligible probability. Accordingly, the advantage of Ω in winning this experiment is as follows. (12)AdvΩ=Pr⁡ExpΩDDH=1=Pr⁡b′=b=Pr⁡b′=b∣b=1·Pr⁡b=1+Pr⁡b′=b∣b=0·Pr⁡b=0=Pr⁡b′=b∣b=1·12+Pr⁡b′=b∣b=0·12=Pr⁡b′=1∣b=1·12+Pr⁡b′=0∣b=0·12=Pr⁡b′=1∣b=1·12+1-Pr⁡b′=1∣b=0·12=12+12Pr⁡ExpAICR-IS-1=1-Pr⁡ExpAICR-IS-0=1=12+12AdvAICR-IS=12+12εTheorem 5 (collusion resistance).
For any leaving memberUil∈Gl(1≤i≤n,1≤l<l′≤s) including any other adversaries, SISS is ns-collusion-resistant.Proof.
For anyoneUil(1≤l<l′≤s) colluding with the legitimate member Ui′j, the illegal member cannot compute KGij(j≥l′). Although the compromised (illegal) member Uil knows {αil,KGil} and {αi′j,KGi′j}, the illegal member cannot receive {αil+1,KGil+1} of the next (l+1)th session. Hence, they cannot compute KGij(1≤i≤n,1≤l<l′≤j≤s). One more important thing is that the illegal member cannot pass the verifiable process to render the real 3D image from the stereoscopic information Sij which consists of the member’s own gesture and facial expression. Therefore, the illegal member cannot pass the authentication process of login.


## 6. Performance Analysis

The main purpose of this paper is to design a prototype scheme for secure patient networks. In addition, we try to apply a new technology like the AR/VR technique of 3D model to the authentication process. However, the performance for whole protocol of SISS largely depends on the network condition. Hence, we experiment the performance of SISS with separate eight parts as follows: (1) the generation time in a server including storage time, (2) the time for a client including data transfer and storage in DB, (3)QrU1 of login, (4) VrSM1_QrSM2 of login, (5) VrU2_QrU3 of login, (6) VrSM3 of login, (7) EncUp, and (8) DnDec


### 6.1. Implementation and Experimental Environment

The experimental environments of a server and a client are addressed in Tables4 and 5.Table 4
The specification of a server.
Server Hardware CPU Intel Core i7-4770K 3.5 GHz Memory 4 GB Disk 200 GB  OS Ubuntu 14.04 LTS / LinuxKernel 3.19.0  Development Tool gcc 4.8Table 5
The specification of a client.
Client (Nexus 5X) Hardware CPU Snapdragon 808 1.8 GHz Memory 2 GB Disk 16 GB  OS Android 6.0  Development Tool eclipse / Android SDK


### 6.2. Cryptographic Parameters and Library

Cryptographic parameters and libraries are described in Table6.Table 6
Cryptographic parameters and libraries.
Pseudorandom functionf AES 128 bits  Hash functionh SHA-1  Group parameter cyclic group  ModulusP 2048 bits  Orderq 256 bits  Generatorg 2048 bits  Time measurement function in a Server clock()  Time measurement function in a Client System.currentTimeMillis()  Crypto Library of a Server MIRACLE  Crypto Library of a Client Android OpenSSL & Java BigInteger


### 6.3. The Results of Implementation

Table7 shows the performance of SISS divided into eight parts. The registration process which needs only once to join the website totally takes over 20 seconds. Considering that users should generate all their information to use it through all their sessions at this registration process in advance, the estimated time is understandable and applicable to a real world in general. Other processes such as login or actions take much less than 1 second (cf. in the implementation of VrU_QrU3, the rendering process can be skipped because there is no commercialized tools for rendering until now; we replace RSij with 20-byte 3-dimensional image).Table 7
The result.
Operation  Process time (ms) Registration (1000 Session) The generation time in a server including storage time 6138 ms (6.1 s) The time for a client including data transfer and storage in DB 14499 ms (14.4 s)  Login Q r U 1 16 ms (0.016 s) V r S M 1 _ Q r S M 2 2 ms (0.002 s) V r U 2 _ Q r U 3 56 ms (0.056 s) D V r S M 3 skip (comparison between simple values)  EncUp  54 ms (0.054 s)  DnDec  32 ms (0.032 s)


### 6.4. Comparison with Other Works

The related works’ main goal was only focused on the methods of group key’s rekeying, revocation, and redistribution, whereas SISS’s main goal is to design the information sharing protocol with safety for application website. Hence, the Storage Overhead and Communication Overhead analyzed in the related works are obviously different from SISS because our proposed group key system is developed to eliminate the processes of rekeying and redistribution that constitute hard and complicated work with heavy overheads. To the best of my knowledge, SISS’s group key is the first scheme without rekeying and redistribution; nevertheless it can guarantee the security requirements of group key.Gou et al.’s paper [50] is the latest work to analyze the performances of current schemes until now; the minimal Storage Overhead is log2⁡p (p: finite field’s order) and Communication Overhead is (n+2)jlog2q (n: maximum revoked users, j: session, q: multiplicative group’s order). As for SISS, Storage and Communication Overheads are O(0). Thus, based on Gou et al.’s work, we only compare and analyze the security performances of group key because the proposed scheme SISS has no process itself for group key’s rekeying and redistribution.Table8 shows that Staddon et al. and Liu et al.’s schemes can guarantee only forward secrecy, and Rams et al. and Guo et al.’s new scheme can meet all properties of forward secrecy, backward secrecy, and collusion resistance. The number of Revocation Limit is the maximum for Guo et al.’s new scheme and the proposed scheme SISS. And, SISS can guarantee all security properties of forward secrecy, backward accessibility, and collusion resistance, but not backward secrecy.Table 8
The comparison of group key security performance.
Scheme Revocation Limit Forward Secrecy Backward Secrecy Collusion Resistance Staddon et al. n Yes No No  Liu et al. n Yes No No  Rams et al. n Yes Yes Yes  Guo et al.’s basic scheme n Yes No No  Guo et al.’s new scheme n s Yes Yes Yes  SISS n s Yes Backward Accessibility Yes n: maximum revoked users, s: maximum session.


## 6.1. Implementation and Experimental Environment

The experimental environments of a server and a client are addressed in Tables4 and 5.Table 4
The specification of a server.
Server Hardware CPU Intel Core i7-4770K 3.5 GHz Memory 4 GB Disk 200 GB  OS Ubuntu 14.04 LTS / LinuxKernel 3.19.0  Development Tool gcc 4.8Table 5
The specification of a client.
Client (Nexus 5X) Hardware CPU Snapdragon 808 1.8 GHz Memory 2 GB Disk 16 GB  OS Android 6.0  Development Tool eclipse / Android SDK


## 6.2. Cryptographic Parameters and Library

Cryptographic parameters and libraries are described in Table6.Table 6
Cryptographic parameters and libraries.
Pseudorandom functionf AES 128 bits  Hash functionh SHA-1  Group parameter cyclic group  ModulusP 2048 bits  Orderq 256 bits  Generatorg 2048 bits  Time measurement function in a Server clock()  Time measurement function in a Client System.currentTimeMillis()  Crypto Library of a Server MIRACLE  Crypto Library of a Client Android OpenSSL & Java BigInteger


## 6.3. The Results of Implementation

Table7 shows the performance of SISS divided into eight parts. The registration process which needs only once to join the website totally takes over 20 seconds. Considering that users should generate all their information to use it through all their sessions at this registration process in advance, the estimated time is understandable and applicable to a real world in general. Other processes such as login or actions take much less than 1 second (cf. in the implementation of VrU_QrU3, the rendering process can be skipped because there is no commercialized tools for rendering until now; we replace RSij with 20-byte 3-dimensional image).Table 7
The result.
Operation  Process time (ms) Registration (1000 Session) The generation time in a server including storage time 6138 ms (6.1 s) The time for a client including data transfer and storage in DB 14499 ms (14.4 s)  Login Q r U 1 16 ms (0.016 s) V r S M 1 _ Q r S M 2 2 ms (0.002 s) V r U 2 _ Q r U 3 56 ms (0.056 s) D V r S M 3 skip (comparison between simple values)  EncUp  54 ms (0.054 s)  DnDec  32 ms (0.032 s)


## 6.4. Comparison with Other Works

The related works’ main goal was only focused on the methods of group key’s rekeying, revocation, and redistribution, whereas SISS’s main goal is to design the information sharing protocol with safety for application website. Hence, the Storage Overhead and Communication Overhead analyzed in the related works are obviously different from SISS because our proposed group key system is developed to eliminate the processes of rekeying and redistribution that constitute hard and complicated work with heavy overheads. To the best of my knowledge, SISS’s group key is the first scheme without rekeying and redistribution; nevertheless it can guarantee the security requirements of group key.Gou et al.’s paper [50] is the latest work to analyze the performances of current schemes until now; the minimal Storage Overhead is log2⁡p (p: finite field’s order) and Communication Overhead is (n+2)jlog2q (n: maximum revoked users, j: session, q: multiplicative group’s order). As for SISS, Storage and Communication Overheads are O(0). Thus, based on Gou et al.’s work, we only compare and analyze the security performances of group key because the proposed scheme SISS has no process itself for group key’s rekeying and redistribution.Table8 shows that Staddon et al. and Liu et al.’s schemes can guarantee only forward secrecy, and Rams et al. and Guo et al.’s new scheme can meet all properties of forward secrecy, backward secrecy, and collusion resistance. The number of Revocation Limit is the maximum for Guo et al.’s new scheme and the proposed scheme SISS. And, SISS can guarantee all security properties of forward secrecy, backward accessibility, and collusion resistance, but not backward secrecy.Table 8
The comparison of group key security performance.
Scheme Revocation Limit Forward Secrecy Backward Secrecy Collusion Resistance Staddon et al. n Yes No No  Liu et al. n Yes No No  Rams et al. n Yes Yes Yes  Guo et al.’s basic scheme n Yes No No  Guo et al.’s new scheme n s Yes Yes Yes  SISS n s Yes Backward Accessibility Yes n: maximum revoked users, s: maximum session.


## 7. Discussion

### 7.1. The Differences from Other Group Key Structure

(1) The application and aim of our group key are different from the traditional group key. Rather, they are closer to ‘keyword search schemes for multiuser setting with group keys’, whose security requirements are forward secrecy and backward accessibility; the leaving members should not know the group’s documents, and newly joining members should know the previous documents of the group to perform the group’s tasks. In the sense of sharing information among group members, we used the term group key.(2) The formation structure of the group key is completely different. General group key systems make every user share the same group key for the session. However, in SISS, on the basis of the master key, random numbers and other things are combined, where the random number has a different initial value for each user, which is hashed(s-1) times for s sessions (total number of sessions is s). Finally, each user has different group keys for each session and does not share any key with any one, except for K3 only. The important thing is that even members themselves do not know their group’s master key because it is masked with random numbers. At registration, s hashed values generated through hash chain are stored in only SM’s server. Each user has only St,ij, pi1, KGi1, {h(EKGij(pij))}, h(EKGi1(pi1∥S)),  (1≤i≤n,1≤j≤q) for the authentic information required at the start of the session as mentioned in the algorithm InfGenStr.(3) The result of encryption/decryption with the group’s master key and the result of encryption/decryption with the every member’s group key are the same (refer to [Additional Explanation for Encryption (E) and Decryption (D) with Group Keys] in Section4). This is because the developed equation (algorithm) is designed according to the principle that all random numbers attached before the computation should be removed after the computation. It makes rekeying and redistributing of the group key unnecessary for SISS. In SISS, members can upload only on their web pages, while download can be done on their own web pages and those of other users (valid users). Therefore, members encrypt the information that they want to share with the group key and encrypt the information that they want to be secret with their private keys.(4) It can be said that the group key renewals for session changes are accomplished in the authentication processes of login for each member. In other words, the group key and pseudonym key for each user’s next session are given by the SM at the end of the login process, which serve more as authenticators to pass the login process. If any member does not receive the group key and pseudonym key for the next session from the SM, the value can never be deduced. The reasons are as follows:(1) Group keys have an effect similar to a one-time password because they have completely different values for each member and for each session. (2) The master key and the random number cannot be inferred because of the combined characteristics (safety) between master key and random number such as DDH, DLP, and other cryptographic functions. (3) Due to the hash chain’s one-wayness, which is the method of random number generation, we never know the random number of the next session, so we do not know the group key value of the next session(5) The leave and revocation process of SISS is also different from the general group key because SISS does not have a rekeying and redistributing process. When SM receives the leave request from a member, the SM enters the revocation process, records the member’s id in the leave-list, and deletes the user’s hash chain and other additional information. Even if a member who has left a session tries to log in with the next session information which is received from the previous session, the member cannot pass the authentication because all information of the user has been removed from SM’s server. And the member cannot receive the next session information any longer. In other words, a member can no longer log in to the group if the member leaves the group, so that the member should download all the previous information before requesting leave. The leaving members can never know the next subsequent information, while newly joining members can decrypt all the shareable information encrypted with the group key.(6) The meaning of a session of SISS is different from other general group key systems that consider the session as the number of membership-changes, as SISS considers the session as the number of logins for each member. If a member has performed a total ofs logins, then the member can reconnect to SM and generate a new hash chain again as he did at the registration time. The total number of sessions, s, can be determined by the policies of the website or by the needs of individual members.


### 7.2. Legitimate Group Member

In the last step of the login authentication, 3-dimensional imageRS is rendered. RS plays a role of a LGM (legitimate group member) which is decided with SM at the registration time. The goal is “improving authentication and security against conspiracy and compromise”. If 3-dimensional image is inefficient in a real world, 2-dimensional image is recommendable.In 2016, Google’s project ‘Tango’ has been showcased with indoor mapping and VR/AR platform [52]. ‘Tango’ technology enables a mobile device to measure the physical world. Tango-enabled devices (smartphones, tablets) are used to capture the dimensions of physical space to create 3D representations of the real world. ‘Tango’ gives the Android device platform the new ability of spatial perception.According to JPMorgan analyst Rod Hall [7], Apple expects that iPhone 8 would feature a front-facing 3D laser scanner for facial recognition. It can be also said that the facial recognition will potentially be more secure than Touch ID, and 3D laser scanner could eventually be used for other purposes such as augmented reality. Unfortunately, however, the iPhone 8 released in 2017 did not have the expected function of front-facing 3D laser scanner. Even though the released AR technique of iPhone 8 was different from the 3D laser scanner for facial recognition by Rod Hall [7], we can anticipate the generalized AR technique for the facial recognition in the near future. Therefore, we can say that the proposition of SISS is timely good to apply LGM to the real world keeping abreast of Tango and iPhone’s AR/VR technique of mobile devices.


### 7.3. Privacy Preserving SISS

SISS can meet the privacy requirements as follows:(1) Anonymity and Pseudonymity: In SISS, each member uses different pseudonymity for each session. Although perfect anonymity cannot be provided, pseudonymity can be provided instead.(2) Unlinkability: Every session, users log in with different pseudonyms (P) and use different encryption keys (each member’s group key). Consequently, SISS can achieve unlinkability and similar level of security to ‘One-Time Encryption’.(3) Unobservability: All information is encrypted by members’ group keys, which have different values by being masked with the differently generated random numbers for each user and each session [53].


### 7.4. Mutual Authentication

An attacker may try to pretend to be a valid member to log in to the SIS system or masquerade as an SM server to extract users’ information. This property is about spoofing attack.The authentication between a member and the SM server is accomplished through the query and verification algorithms:Qr, Vr_Qr, Vr. Specifically, authentication processes for login consist of QrU1(RH,K,P), VrSM1_QrSM2(QvU1), VrU2_QrU3(QvSM2), and VrSM3(RSij). In QrU1(RH,K,P), a member queries the SM with QvU1 which is the computed values using the stored values at the registration time. Then, in VrSM1_QrSM2(QvU1), the SM server verifies the value QvU1 with the stored values, too. After the successful verification, the SM server queries the member with QvSM2, which is also computed using the stored values and QvU1. To the last processes VrSM3(RSij), the member and the SM server authenticate each other using the stored values, respectively.From a member to the SM server, if the SM server can obtain the corresponding rightly rendered image in the last authentication process, it means that the SM server is the real server to which a member wants to log in and the member is a valid user to be registered in advance.


## 7.1. The Differences from Other Group Key Structure

(1) The application and aim of our group key are different from the traditional group key. Rather, they are closer to ‘keyword search schemes for multiuser setting with group keys’, whose security requirements are forward secrecy and backward accessibility; the leaving members should not know the group’s documents, and newly joining members should know the previous documents of the group to perform the group’s tasks. In the sense of sharing information among group members, we used the term group key.(2) The formation structure of the group key is completely different. General group key systems make every user share the same group key for the session. However, in SISS, on the basis of the master key, random numbers and other things are combined, where the random number has a different initial value for each user, which is hashed(s-1) times for s sessions (total number of sessions is s). Finally, each user has different group keys for each session and does not share any key with any one, except for K3 only. The important thing is that even members themselves do not know their group’s master key because it is masked with random numbers. At registration, s hashed values generated through hash chain are stored in only SM’s server. Each user has only St,ij, pi1, KGi1, {h(EKGij(pij))}, h(EKGi1(pi1∥S)),  (1≤i≤n,1≤j≤q) for the authentic information required at the start of the session as mentioned in the algorithm InfGenStr.(3) The result of encryption/decryption with the group’s master key and the result of encryption/decryption with the every member’s group key are the same (refer to [Additional Explanation for Encryption (E) and Decryption (D) with Group Keys] in Section4). This is because the developed equation (algorithm) is designed according to the principle that all random numbers attached before the computation should be removed after the computation. It makes rekeying and redistributing of the group key unnecessary for SISS. In SISS, members can upload only on their web pages, while download can be done on their own web pages and those of other users (valid users). Therefore, members encrypt the information that they want to share with the group key and encrypt the information that they want to be secret with their private keys.(4) It can be said that the group key renewals for session changes are accomplished in the authentication processes of login for each member. In other words, the group key and pseudonym key for each user’s next session are given by the SM at the end of the login process, which serve more as authenticators to pass the login process. If any member does not receive the group key and pseudonym key for the next session from the SM, the value can never be deduced. The reasons are as follows:(1) Group keys have an effect similar to a one-time password because they have completely different values for each member and for each session. (2) The master key and the random number cannot be inferred because of the combined characteristics (safety) between master key and random number such as DDH, DLP, and other cryptographic functions. (3) Due to the hash chain’s one-wayness, which is the method of random number generation, we never know the random number of the next session, so we do not know the group key value of the next session(5) The leave and revocation process of SISS is also different from the general group key because SISS does not have a rekeying and redistributing process. When SM receives the leave request from a member, the SM enters the revocation process, records the member’s id in the leave-list, and deletes the user’s hash chain and other additional information. Even if a member who has left a session tries to log in with the next session information which is received from the previous session, the member cannot pass the authentication because all information of the user has been removed from SM’s server. And the member cannot receive the next session information any longer. In other words, a member can no longer log in to the group if the member leaves the group, so that the member should download all the previous information before requesting leave. The leaving members can never know the next subsequent information, while newly joining members can decrypt all the shareable information encrypted with the group key.(6) The meaning of a session of SISS is different from other general group key systems that consider the session as the number of membership-changes, as SISS considers the session as the number of logins for each member. If a member has performed a total ofs logins, then the member can reconnect to SM and generate a new hash chain again as he did at the registration time. The total number of sessions, s, can be determined by the policies of the website or by the needs of individual members.


## 7.2. Legitimate Group Member

In the last step of the login authentication, 3-dimensional imageRS is rendered. RS plays a role of a LGM (legitimate group member) which is decided with SM at the registration time. The goal is “improving authentication and security against conspiracy and compromise”. If 3-dimensional image is inefficient in a real world, 2-dimensional image is recommendable.In 2016, Google’s project ‘Tango’ has been showcased with indoor mapping and VR/AR platform [52]. ‘Tango’ technology enables a mobile device to measure the physical world. Tango-enabled devices (smartphones, tablets) are used to capture the dimensions of physical space to create 3D representations of the real world. ‘Tango’ gives the Android device platform the new ability of spatial perception.According to JPMorgan analyst Rod Hall [7], Apple expects that iPhone 8 would feature a front-facing 3D laser scanner for facial recognition. It can be also said that the facial recognition will potentially be more secure than Touch ID, and 3D laser scanner could eventually be used for other purposes such as augmented reality. Unfortunately, however, the iPhone 8 released in 2017 did not have the expected function of front-facing 3D laser scanner. Even though the released AR technique of iPhone 8 was different from the 3D laser scanner for facial recognition by Rod Hall [7], we can anticipate the generalized AR technique for the facial recognition in the near future. Therefore, we can say that the proposition of SISS is timely good to apply LGM to the real world keeping abreast of Tango and iPhone’s AR/VR technique of mobile devices.


## 7.3. Privacy Preserving SISS

SISS can meet the privacy requirements as follows:(1) Anonymity and Pseudonymity: In SISS, each member uses different pseudonymity for each session. Although perfect anonymity cannot be provided, pseudonymity can be provided instead.(2) Unlinkability: Every session, users log in with different pseudonyms (P) and use different encryption keys (each member’s group key). Consequently, SISS can achieve unlinkability and similar level of security to ‘One-Time Encryption’.(3) Unobservability: All information is encrypted by members’ group keys, which have different values by being masked with the differently generated random numbers for each user and each session [53].


## 7.4. Mutual Authentication

An attacker may try to pretend to be a valid member to log in to the SIS system or masquerade as an SM server to extract users’ information. This property is about spoofing attack.The authentication between a member and the SM server is accomplished through the query and verification algorithms:Qr, Vr_Qr, Vr. Specifically, authentication processes for login consist of QrU1(RH,K,P), VrSM1_QrSM2(QvU1), VrU2_QrU3(QvSM2), and VrSM3(RSij). In QrU1(RH,K,P), a member queries the SM with QvU1 which is the computed values using the stored values at the registration time. Then, in VrSM1_QrSM2(QvU1), the SM server verifies the value QvU1 with the stored values, too. After the successful verification, the SM server queries the member with QvSM2, which is also computed using the stored values and QvU1. To the last processes VrSM3(RSij), the member and the SM server authenticate each other using the stored values, respectively.From a member to the SM server, if the SM server can obtain the corresponding rightly rendered image in the last authentication process, it means that the SM server is the real server to which a member wants to log in and the member is a valid user to be registered in advance.


## 8. Conclusion

SISS is the proposal for the patients from all over the world who want to get some help and share information through websites such as ’PatientsLikeMe’ or ’CureTogether’. The proposed model SISS can guarantee security and privacy for the sensitive health and private information. As for the main method of group key management system, SISS addressed the hard problems of rekeying and redistribution, conspiracy, and backward accessibility with new ideas such as equations for encryption/decryption and LGM. Moreover, SISS is scalable to general group’s project applications with safety. Therefore, it is clear that the problem of information sharing and the approaches between collaborative computing and security should be managed as Integrated Security Management (ISM).



---

*Source: 7541269-2019-03-12.xml*