# An Efficient Multidocument Blind Signcryption Scheme for Smart Grid-Enabled Industrial Internet of Things

Authors: Ako Muhammad Abdullah; Insaf Ullah; Muhammad Asghar Khan; Mohammed H. Alsharif; Samih M. Mostafa; Jimmy Ming-Tai Wu
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The smart grid-enabled industrial Internet of Things (SG-IIoT) is a hybrid data communication network connected with the power grid that collects and analyzes data from transmission lines, distribution substations, and consumers. In the IIoT setting, SG provides predictive information to its supplier and customers on how to effectively manage the power based on this aggregated data. To achieve this goal, every virtual or physical entity in the SG-IIoT must be linked and accessible over the Internet, which can be susceptible to numerous cyberattacks. In this paper, we propose a multidocument blind signcryption scheme to simultaneously resolve the security and efficiency issues. The proposed scheme performs the blind signature and encryption operation on multiple digital documents in one step because SG-IIoT outputs a large amount of data that needs to be blind signed and encrypted in a batch. The proposed scheme employs the concept of hyperelliptic curve cryptography (HECC), which is lightweight owing to the smaller key size. The comparative analysis in both security and efficiency with the relevant existing scheme authenticates the viability of the proposed scheme.


---

## Body

## 1. Introduction

The electrical network that serves every residence, company, and infrastructure service in a city is known as the “grid.” The “smart grid” is the next generation of energy infrastructure that has been upgraded with communications technology and connectivity to enable more efficient utilization of resources [1]. Wireless equipment such as sensors, radio modules, gateways, and routers are among the technologies that make today’s IoT-enabled electricity grid “smart.” These devices provide the advanced connection and communications that enable customers to make smarter energy consumption decisions, communities to save energy and money, and power authorities to restore power more rapidly after a blackout. Similar to distributed energy resources, real-time smart meter readings, rapid reaction through reliable communication and information exchange, and monitoring systems, it can manage the responsibilities of various applications across industrial processes [2]. The industrial Internet of Things (IIoT), also known as SG-enabled industrial Internet of Things, is growing popularity, and it includes a variety of IoT devices and technology that make smart grid (SG) for Industry 4.0 simpler [3], also known as SG-enabled industrial Internet of Things (SG-IIoT). The SG-IIoT infrastructure is built on faster and more reliable communication technologies that connect intelligent information systems, the current power grid, and other IIoT devices. Furthermore, because industry 4.0 gadgets consume so much electricity, smart meters linked to them may need to request energy from power stations via substations and control centers (CC) [4]. Therefore, every virtual or physical thing in SG-IIoT can be interconnected, identified, and accessed through the Internet [5]. When evaluating the communication scenario of the SG-IIoT environment, authentication, confidentiality, and anonymity are the three key cybersecurity issues [6]. It is important to highlight that digital signatures can ensure authenticity, and anonymous encryption can ensure both confidentiality and anonymity. Blind signcryption [7] allows the sender to combine the concepts of blind signing and encryption on a message in a single step, achieving authenticity, confidentiality, and anonymity in one step. Further, making a blind signature and encryption on multiple digital documents is better than signcrypting a single document because SG-IIoT generates a huge amount of data that need to be blindly signcrypted in a bunch [8]. Most of the blindly signcryption, which is presented either for a single document or multi-digital documents is built upon the working strategy of old public key infrastructure (PKC) that can be poor in the view of the certificate renewal process. In contrast to PKC, identity-based cryptography (IBC) will be the best choice when the private key generation center is fully trusted, and further, IBC can enjoy the feature of certificate renewing and revocation-free features. Recently, several blind signcryptions are contributed to multi-digital documents; unfortunately, these schemes are not suitable for resource-hungry SG-IIoT devices due to higher computational cost and certificate renewing and revocation [8–10]. Thus, to neglect such types of flaws, we design a new scheme with the following advantages.
(i)
The proposed scheme is based on the notion of blind signcryption with IBC for multi-digital documents utilizing hyperelliptic curve concepts for power requests in SG-IIoT(ii)
The proposed scheme ensures the integrity of multi-digital documents, nonrepudiation of blind signature, unlinkability of the signer to the multi-digital documents, untraceability of the signer to an original signature, confidentiality, and forward secrecy, respectively(iii)
When comparing the proposed scheme to three recently published relevant schemes, we observed that our scheme is more efficient in terms of computation and communication costs.This paper is organized in the following way. In Section2, we present the related work of existing blind signcryption and multidocument blind signcryption. In Section 3, we provide the proposed network model for power requests. Section 4 presents the construction of the proposed scheme. In Section 5, correctness is provided. Sections 6 and 7 provide security analysis and costs analysis in terms of computational cost, respectively. Lastly, in Section 8, conclusions are presented.


## 2. Related Work

The SG-IIoT configuration relies entirely on faster and more reliable communication technologies to connect intelligent information systems, existing power grids, and other IIoT devices. Every device in the SG-IIoT can be networked, identified, and connected to the Internet in this manner. Thus, during communications, the three key concerns of the SG-IIoT environment are anonymity, privacy, and validation. It is critical to understand that signatures can provide authentication and anonymity, while encryption can provide confidentiality to SG-IIoT data. Awasthi and Lal [7] devised a blind signcryption employing a discrete logarithm problem to meet authentication, confidentiality, and anonymity requirements in one step. This scheme does not provide forward secrecy and has a longer processing time as a result. Using the discrete logarithm problem, Xiuying and Dake [11] proposed a blind signcryption with public verifiability. More processing time is a problem for this scheme once again. Riaz et al. [12] developed an elliptic curve discrete logarithm problem for blind signcryption. Unforgeability, authentication, integrity, and signer nonrepudiation are all vulnerabilities in the scheme [13]. Furthermore, the authors in [13] presented an improved blind signcryption scheme, although when considering resource-hungry devices, this scheme suffers from higher processing CPU time owing to the elliptic curve. Mohib et al. [14] proposed an elliptic curve-based blind signcryption to allow anonymous communication to mobile voting systems. Waheed et al. [15] presented blind signcryption utilizing the elliptic curve discrete logarithm problem for the use of electronic voting. However, both schemes [14, 15] suffer from increased processing CPU time and are hence unsuitable for resource-intensive devices. Ullah and Din [16] presented blind signcryption using a hyperelliptic curve discrete logarithm problem; however, the approach does not ensure that numerous digital documents are encrypted and signed. Tsai et al. [8] suggested multidocument blind signcryption based on elliptic curve cryptography to offer encryption and blind signing in one step. They did not, however, provide forward security and did not benefit from the reduced computational cost. Blind signcryption using a hyperelliptic curve discrete logarithm issue was presented by Fazlullah et al. [9]. However, in terms of authentication and integrity, this technique is weak [10]. Furthermore, the authors of [10] suggested an enhanced multidocument blind signcryption system; nevertheless, when considering resource-hungry devices, this scheme suffers from increased processing CPU time needs due to more main operations of the hyperelliptic curve. Although, because they are all built on ancient public key infrastructure cryptography, all of the aforementioned blind signcryption techniques are prone to certificate revocation and renewal issues.


## 3. Network Model

Figure1 depicts the flow of our proposed blind signcryption for multiple digital documents’ scheme, which includes entities such as the industrial Internet of Things (IIoT), smart meters (SMs), substation (SS), private key generator (PKG), and power station (PS). When IIoT requires more power or some other utility, SMs seek a blind signature from CC, after which CC sends its identity to PKG for a private and public key, and PKG generates a public and private key for CC after receiving the CC identity. After that, CC generates a blind signature for SMs using his private key and returns it. When SMs obtain a blind signature, they transmit their identification to PKG for a private and public key. When PKG receives the SMs’ identity, it generates a public and private key for them. After that, SMs produce and submit blind signcryption on many papers, including power requests and other utilities to CC, using his private numbers and secret key. After receiving blind signcryption on numerous papers, CC can verify them using the verification method, then decode the ciphertext and supply power or other desired utilities to SMs if they are legitimate. Because all this information transmission is often in the range of a few bytes, LPWANs (low-power wide-area networks) are appropriate for interoperability of local micropower grids. The low-power wide-area network (LPWAN) is a wide-area wireless communication network designed for long-range communications with low data rates and low power consumption.Figure 1
Network model of proposed SG-IIoT power request scheme [4].


## 4. Proposed Multidocument Blind Signcryption

The proposed multidocuments blind signcryption can continue with the following phases and the symbols used in construction is available in Table1.Table 1
Symbols used in the constructions of the proposed algorithm.
No.SymbolDescriptions1H1,H2,H3One-way hash functions2fThe private key of PKG3DDivisor of a hyperelliptic curve4nThe order of finite field of a hyper elliptic curve and normally greater or equals 80 bits5ηThe public key of PKG6⩓Published parameter set7miMulti-digital documents8UsSigner private key9VsSigner public key10UvVerifier private key11VvVerifier public key12φAlice signature13SSigner signature14KThe secret key used for encryption and decryption


### 4.1. Setup

In private key generator (PKG), pick three one-way hash functions (H1,H2,H3), hyperelliptic curve with genus 2, a divisor (D), and a finite field of order n; then, PKG selects fϵ1,2,3,⋯⋯.,n−1 as the private key of the signer and computes the corresponding master public key asη=f.D. In the end, PKG published ⩓=n,D,H1,H2,H3,η to the network


### 4.2. Key Generation

Here, PKG selectsUiϵ1,2,3,⋯⋯.,n−1 as the private key and computes the corresponding public key as Vi=Ui.G for the user with identity IDi. Then, PKG dispatched Ui,Vi to the user with IDi using an open network


### 4.3. Alice

It can proceed with the following steps:(a)
Choose a random numberℓϵ1,2,3,⋯⋯.,n−1(b)
ComputeVh=H1ℓ(c)
ComputeR=H2mi,Vh(d)
SendRtothesigner.


### 4.4. Signer

It can proceed with the following steps:(a)
Choose a random numberLϵ1,2,3,⋯⋯.,n−1(b)
ComputeT=L.D(c)
ComputeS=Us+R.Lmodn(d)
SendsT,Stosigner.


### 4.5. Alice

It can proceed with the following steps:(a)
Select random numberζϵ1,2,3,⋯⋯.,n−1(b)
ComputeZ=ζ.D(c)
Choose a random numberTϵ1,2,3,⋯⋯.,n−1, compute K=H3T.Vv(d)
ComputeC=EKmI,Vh(e)
Computeφ=T/ζ+R+Smodn(f)
SendA=C,T,φ,Z,R.


### 4.6. Verifications and Decryption

It can proceed with the following steps:(a)
ComputeK=H3φ.Uv.Vs+R.T+D+Z(b)
Computemi,Vh=DKC(c)
ComputeΡ=H2mi,Vh(d)
AcceptifΡ=R.


## 4.1. Setup

In private key generator (PKG), pick three one-way hash functions (H1,H2,H3), hyperelliptic curve with genus 2, a divisor (D), and a finite field of order n; then, PKG selects fϵ1,2,3,⋯⋯.,n−1 as the private key of the signer and computes the corresponding master public key asη=f.D. In the end, PKG published ⩓=n,D,H1,H2,H3,η to the network


## 4.2. Key Generation

Here, PKG selectsUiϵ1,2,3,⋯⋯.,n−1 as the private key and computes the corresponding public key as Vi=Ui.G for the user with identity IDi. Then, PKG dispatched Ui,Vi to the user with IDi using an open network


## 4.3. Alice

It can proceed with the following steps:(a)
Choose a random numberℓϵ1,2,3,⋯⋯.,n−1(b)
ComputeVh=H1ℓ(c)
ComputeR=H2mi,Vh(d)
SendRtothesigner.


## 4.4. Signer

It can proceed with the following steps:(a)
Choose a random numberLϵ1,2,3,⋯⋯.,n−1(b)
ComputeT=L.D(c)
ComputeS=Us+R.Lmodn(d)
SendsT,Stosigner.


## 4.5. Alice

It can proceed with the following steps:(a)
Select random numberζϵ1,2,3,⋯⋯.,n−1(b)
ComputeZ=ζ.D(c)
Choose a random numberTϵ1,2,3,⋯⋯.,n−1, compute K=H3T.Vv(d)
ComputeC=EKmI,Vh(e)
Computeφ=T/ζ+R+Smodn(f)
SendA=C,T,φ,Z,R.


## 4.6. Verifications and Decryption

It can proceed with the following steps:(a)
ComputeK=H3φ.Uv.Vs+R.T+D+Z(b)
Computemi,Vh=DKC(c)
ComputeΡ=H2mi,Vh(d)
AcceptifΡ=R.


## 5. Correctness

The blind signcryption scheme can be correct if it holds the below equation.(1)H3φ.Ui.Vs+R.T+D+Z=T.Vi.Proof:(2)=H3φ.Uv.Us.D+R.T+D+Z=H3φ.Uv.Us.D+R.L.D+D+Z=H3φ.Uv.Us.D+R.L.D+R.D+K.D=H3Tζ+R+S.Uv.Us.D+R.L.D+R.D+ζ.D=H3Tζ+R+Us+R.L.Uv.Us+R.L+R+ζD=H3T.Uv.D=H4T.Vv=K


## 6. Security Analysis

This phase includes detailed security analysis of the proposed scheme, which are based on the following hard problem: supposeP&D is given two divisors on the hyperelliptic curve of ordern: hence, to find a unique integer α from equation P=α.D is called hyperelliptic curve discrete logarithm problem HECDLP. So, in the following subphases of this section, we are going to explain each security requirement fulfilled by the proposed scheme in detail.


### 6.1. Confidentiality

Suppose an adversaryA attacked the proposed scheme for gaining the contents of ciphertext C; then it must successfully be passed through the following subphases.
(i)
Here, the first attempt ofA as it needs to process Ks=H3φ.Uv.Vs+R.T+D+Z further requires Uv from Vv=Uv.D that can be clues towards the solution of HECDLP(ii)
The second attempt ofA needs to process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(iii)
The third attempt ofA needs T from φ=T/ζ+R+S to process Ks=H3T.Vv, so φ contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that the proposed scheme is secured from the content-stealing attack (confidentiality) againstA.


### 6.2. Unforgeability

Assume thatA attacked the proposed scheme for forging the original signature; then A must effectively solve φ=T/ζ+R+S for this; it passed through the following subphases.
(i)
Here, the first thing is thatA can require T, and for this, A must processKs=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(ii)
The second thing is thatA requires ζ, and for this, it process Z=ζ.D, so it requires ζ that can be clues towards the solution of HECDLP(iii)
The third attempt ofA needs S from φ=T/ζ+R+S, where S=Us+R.Lmodn, so S contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that the proposed scheme is secured from forging attack (unforgeability) againstA.


### 6.3. Message Integrity

In our designed scheme, with ciphertext, the sender appends and computesR=H2mi,Vh as a hash value and is dispatched to the receiver. After the reception, the receiver can verify using the following steps.
(i)
It computes the new hash value after decrypting the ciphertext asΡ=H2mi,Vh(ii)
Then compareΡ=R, if it equals then accept the ciphertext; otherwise it returns a null value.The above two steps indicate that the proposed scheme is secured from the content modifying attack (message integrity) againstA.


### 6.4. Blindness

In our designed scheme, when the signer acts asA, then he just failed to get mi, from R=H2mi,Vh, because of the one-way nature of the hash function. Also, A requires to proceed first the blind factor Vh=H1ℓ, and for this, A needs ℓ which is the private number of Alice, so we can say that the proposed scheme is secure from unfair signer attack (blindness).


### 6.5. Untraceability

Suppose the signer acts asA when it received A=C,T,φ,Z,R and tries to gain the contents of ciphertext C, forging the original signature φ=T/ζ+R+Smodn. Therefore, for gaining the contents of the ciphertext C,it must be successfully passed through the following subphases.
(i)
Here, the first attempt ofA needs to process Ks=H3φ.Uv.Vs+R.T+D+Z; further, it requires Uv from Vv=Uv.D that can be clues towards the solution of HECDLP(ii)
The second attempt ofA needs to process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(iii)
The third attempt ofA needs T from φ=T/ζ+R+S to process Ks=H3T.Vv, so φ contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that the proposed scheme is secured from the signer to get access to the content of an original text.Also, forging the original signatureφ=T/ζ+R+Smodn, it must successfully be passed through the following subphases.
(i)
Here, the first thing is thatA can require T, and for this, A must process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(ii)
The second thing is thatA requires ζ, and for this, it processes Z=ζ.D, so it requires ζ that can be clues towards the solution of HECDLP.The above two subphases indicate that the proposed scheme is secured from forging attacks against the signer. Further, the above discussion indicates that the proposed scheme is secured from an untraceable attack against the signer.


### 6.6. Forward Secrecy

The designed scheme assures the property of message forward secrecy. Suppose an adversaryA attacked the proposed scheme for gaining the contents of ciphertext C; then it must successfully be passed through the following subphases.
(i)
The first attempt ofA needs to process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(ii)
The second attempt ofA needs T from φ=T/ζ+R+S to process Ks=H3T.Vv, so φ contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that if the private key signer or Alice is compromised, then the proposed scheme is still secured from the content-stealing attack (forward secrecy) againstA.


### 6.7. Authentication

Upon reception ofA=C,T,φ,Z,R, the receiver can proceed with it compute K=H3φ.Uv.Vs+R.T+D+Z, mi,Vh=DKC, Ρ=H2mi,Vh, and acceptifΡ=R. So, the authentication will be done in this way in our proposed scheme.


### 6.8. Nonrepudiation

The blinded signatureS=Us+R.Lmodn which is processed by the signer contains the signer’s private key which is directly associated with its public key; that is why in our scheme, the signer cannot deny his generated signature.


## 6.1. Confidentiality

Suppose an adversaryA attacked the proposed scheme for gaining the contents of ciphertext C; then it must successfully be passed through the following subphases.
(i)
Here, the first attempt ofA as it needs to process Ks=H3φ.Uv.Vs+R.T+D+Z further requires Uv from Vv=Uv.D that can be clues towards the solution of HECDLP(ii)
The second attempt ofA needs to process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(iii)
The third attempt ofA needs T from φ=T/ζ+R+S to process Ks=H3T.Vv, so φ contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that the proposed scheme is secured from the content-stealing attack (confidentiality) againstA.


## 6.2. Unforgeability

Assume thatA attacked the proposed scheme for forging the original signature; then A must effectively solve φ=T/ζ+R+S for this; it passed through the following subphases.
(i)
Here, the first thing is thatA can require T, and for this, A must processKs=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(ii)
The second thing is thatA requires ζ, and for this, it process Z=ζ.D, so it requires ζ that can be clues towards the solution of HECDLP(iii)
The third attempt ofA needs S from φ=T/ζ+R+S, where S=Us+R.Lmodn, so S contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that the proposed scheme is secured from forging attack (unforgeability) againstA.


## 6.3. Message Integrity

In our designed scheme, with ciphertext, the sender appends and computesR=H2mi,Vh as a hash value and is dispatched to the receiver. After the reception, the receiver can verify using the following steps.
(i)
It computes the new hash value after decrypting the ciphertext asΡ=H2mi,Vh(ii)
Then compareΡ=R, if it equals then accept the ciphertext; otherwise it returns a null value.The above two steps indicate that the proposed scheme is secured from the content modifying attack (message integrity) againstA.


## 6.4. Blindness

In our designed scheme, when the signer acts asA, then he just failed to get mi, from R=H2mi,Vh, because of the one-way nature of the hash function. Also, A requires to proceed first the blind factor Vh=H1ℓ, and for this, A needs ℓ which is the private number of Alice, so we can say that the proposed scheme is secure from unfair signer attack (blindness).


## 6.5. Untraceability

Suppose the signer acts asA when it received A=C,T,φ,Z,R and tries to gain the contents of ciphertext C, forging the original signature φ=T/ζ+R+Smodn. Therefore, for gaining the contents of the ciphertext C,it must be successfully passed through the following subphases.
(i)
Here, the first attempt ofA needs to process Ks=H3φ.Uv.Vs+R.T+D+Z; further, it requires Uv from Vv=Uv.D that can be clues towards the solution of HECDLP(ii)
The second attempt ofA needs to process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(iii)
The third attempt ofA needs T from φ=T/ζ+R+S to process Ks=H3T.Vv, so φ contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that the proposed scheme is secured from the signer to get access to the content of an original text.Also, forging the original signatureφ=T/ζ+R+Smodn, it must successfully be passed through the following subphases.
(i)
Here, the first thing is thatA can require T, and for this, A must process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(ii)
The second thing is thatA requires ζ, and for this, it processes Z=ζ.D, so it requires ζ that can be clues towards the solution of HECDLP.The above two subphases indicate that the proposed scheme is secured from forging attacks against the signer. Further, the above discussion indicates that the proposed scheme is secured from an untraceable attack against the signer.


## 6.6. Forward Secrecy

The designed scheme assures the property of message forward secrecy. Suppose an adversaryA attacked the proposed scheme for gaining the contents of ciphertext C; then it must successfully be passed through the following subphases.
(i)
The first attempt ofA needs to process Ks=H3T.Vv, so it requires T that can be clues towards the solution of HECDLP(ii)
The second attempt ofA needs T from φ=T/ζ+R+S to process Ks=H3T.Vv, so φ contains two unknown hyperelliptic curve variables which are infeasible for A.The above three subphases indicate that if the private key signer or Alice is compromised, then the proposed scheme is still secured from the content-stealing attack (forward secrecy) againstA.


## 6.7. Authentication

Upon reception ofA=C,T,φ,Z,R, the receiver can proceed with it compute K=H3φ.Uv.Vs+R.T+D+Z, mi,Vh=DKC, Ρ=H2mi,Vh, and acceptifΡ=R. So, the authentication will be done in this way in our proposed scheme.


## 6.8. Nonrepudiation

The blinded signatureS=Us+R.Lmodn which is processed by the signer contains the signer’s private key which is directly associated with its public key; that is why in our scheme, the signer cannot deny his generated signature.


## 7. Computational Cost

For the computational cost comparisons, we first introduce some notations that are EM, EA, HEDM, and HEDA representing elliptic curve point multiplication, elliptic curve point addition, hyperelliptic curve divisor multiplication, and hyperelliptic curve divisor addition. The experiment is done for the running time of a single EM and EA, with the help of a personal computer containing DUAL CPU E2200, 2.20 gigahertz processor, 2048 megabyte primary memory; EM consumes 2.226 ms and EA takes 0.0288 ms [17, 18]. Therefore, for HEDM and HEDA, we assume the half running time of EM and EA are 1.113 ms and 0.0144 ms, because the hyperelliptic curve consumes half of the elliptic curve [19]. The major operations proposed and those of Tsai et al. [8], Fazlullah et al. [9], and Bashir and Ali [10] are presented in Table 2. Then, based on the above major operations running time, in Tables 3 and 4, we present the running time comparison between the proposed scheme and Tsai et al. [8], Fazlullah et al. [9], and Bashir and Ali [10], for single message and a varying number of messages. In the end, Figures 2 and 3 clearly show that our scheme is efficient in requiring the processing time.Table 2
Major operations in proposed and existing schemes.
SchemesBlind signcryptionVerifications and decryptionTotalTsai et al. [8]8 EM + 2 EA4 EM12 EM + 2 EAFazlullah et al. [9]5 HEDM + 6 HEDA3 HEDM + 2 HEDA8 HEDM + 8 HEDABashir and Ali [10]8 HEDM + 6 HEDA4 HEDM + 2 HEDA12 HEDM + 8 HEDAProposed scheme4 HEDM + 3 HEDA3 HEDM + 3 HEDA7 HEDM + 6 HEDATable 3
Computational cost comparison of proposed and existing scheme for a single message in milliseconds (ms).
SchemesBlind signcryptionVerifications and decryptionTotalTsai et al.[8]8×2.226+2×0.0288=17.86564×2.226=8.90412×0.0288+2×0.0288=26.7696Fazlullah et al. [9]5×1.113+6×0.0144=5.65143×1.113+2×0.0144=3.36788×1.113+8×0.0144=9.0192Bashir and Ali [10]8×1.113+6×0.0144=8.99044×1.113+2×0.0144=4.480812×1.113+8×0.0144=13.4712Proposed scheme4×1.113+3×0.0144=4.49523×1.113+3×0.0144=3.3397×1.113+6×0.0144=7.8774Table 4
Computational cost comparison of proposed and existing scheme for a single message in milliseconds (ms).
Number of messagesTsai et al. [8]Fazlullah et al. [9]Bashir and Ali [10]Proposed scheme501338.48450.96673.56393.871002676.96901.921347.12787.741504015.441352.882020.681181.61Figure 2
Computational cost comparisons for a single message.Figure 3
Computational cost comparisons for 50, 100, and 150 messages.


## 8. Conclusions

In this article, we proposed a multidocument blind signcryption scheme to concurrently address security concerns such as untraceability, confidentiality, and forward secrecy, as well as efficiency challenges such as high computation cost. Because SG-IIoT generates a considerable quantity of data that has to be blind signed and encrypted in a batch, the proposed scheme executes the blind signature and encryption operation on numerous digital documents in one step. The proposed scheme makes use of the hyperelliptic curve cryptography (HECC) idea, which is lightweight because of its lower key size. We performed a security analysis study for the proposed scheme, confirming our view that our scheme is more secure and capable of meeting data exchange security requirements such as untraceability, confidentiality, and forward secrecy. Furthermore, an efficiency study of the proposed scheme in terms of computational cost reveals that our scheme is more efficient than the relevant existing schemes.



---

*Source: 7779152-2022-02-21.xml*