# Secure and Efficient Communication in VANETs Using Level-Based Access Control

Authors: P. Thorncharoensri; W. Susilo; Y. Chow
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

In recent years, the development of vehicular ad-hoc networks (VANETs) has received much attention in intelligent transportation systems (ITS). Unlike traditional ad-hoc networks, VANETs are emerging with unique characteristics that share similar technology with autonomous vehicles (AVs) and automated driving systems (ASDs). Communication between vehicles and the surrounding infrastructure unit, such as a roadside unit (RSU), must be secured, concise, and authentic. Hence, an access control system for the ad-hoc environment is required. We introduced a level-based controlled signcryption (LBS) scheme, which can be easily constructed and implemented into an access control system for VANETs environment. Our encrypted message has a short and constant size, which is better when compared with other attribute-based signcryption or encryption. Confidentiality, privacy, and authenticity are also provided in our scheme to ensure secure and authentic communication. Therefore, our scheme has addressed communication cost, scalability, security, and privacy issues in VANETs. This primitive can be applied to simplify attribute-based access control, as the only attribute required is an integer representing the security level. Our objective is to improve the quality and security of VANET communication. Moreover, an optional privacy mechanism in our scheme provides flexibility in controlling node privacy in VANETs.


---

## Body

## 1. Introduction

Vehicular ad-hoc networks (VANETs) are a key enabling technology in the development of autonomous vehicle technology and intelligent transportation systems (ITS). A VANET is a form of communication network that connects vehicles-to-vehicles and vehicles to roadside infrastructure. For example, Figure1 shows communication between roadside units (RSUs) and vehicles. It also shows that vehicles can access information at the edge of an ITS server or the Internet. VANETs together with ITS and the Internet deliver a wide range of services, such as route guidance, traffic conditions (e.g., average vehicle density and speed), safety alerts, proximity advertisements, location-based positioning information, and entertainment. In general, vehicles in VANETs need to connect wirelessly to ITS applications and the Internet via RSUs. Vehicles exchange information with edge ITS servers to access a variety of local environmental data. For example, a subject’s location positioning data are obtained through real-time point cloud data from LiDAR devices and cameras. This crucial information is particularly important for vehicles to be aware of any hidden out-of-sight vehicles/subjects that cannot be observed by the vehicle itself [1].Figure 1
VANETs.This is the fundamental information distribution system for autonomous vehicles (AVs). Despite the fact that VANETs and AV networks share similarities in communication and security issues, research in both areas have typically been conducted separately [2]. Secure broadcast communication plays a significant role in both systems. Whether using purely cellular, purely ad-hoc, or a hybrid architecture [3], VANETs need a confidential, efficient, concise, and precise communication protocol and access control.To date, many security mechanisms have been proposed for VANETs. Insight on security issues related to VANETs can be found in surveys conducted by Malhi et al. [4] and Engoulou et al. [5]. The security challenges described in Malhi et al. [4] are the dependence on infrastructure, RSU range of communication, high mobility, difficulty in trust management, huge amount of data, scalability, and high cost. Our work aims to provide an efficient primitive for access control and secure communication, which will solve many of the security challenges related to the communication aspect of VANETs. For example, an efficient primitive should be able to work efficiently in architectures for high mobility, and it should provide a high degree of scalability for secure network access and have low communication overhead to reduce the amount of data in the network. An attribute-based access control where an integer representing the security level is the only attribute in the system will help simplify the hierarchical structure of a VANET. We call this level-based access control. The purpose of clustering protocols in VANETs aims to improve the performance of target tracking, traffic estimation, misbehaviour detection, privacy preservation, and certificate revocation, which makes significant contribution toward the dependence on infrastructure issue [6]. By providing an optional privacy mechanism in our primitive, it is easy to construct secure revocable local cluster communication.Other than secure, fast, and efficient communication in VANETs, authentication, integrity, confidentiality, access control, and privacy are security requirements that are important in VANETs. Nevertheless, security requirements are application dependent. For example, message broadcasts from an RSU and message broadcasts from/to neighbouring vehicles may need to use two different primitives to satisfy VANET security requirements. To emphasise the importance of broadcast communication in VANETs, a survey on the quality-of-service (QoS) in relation to broadcast protocols is summarised [7]. It is an unavoidable fact that broadcast protocols play a significant role in VANETs for delivering emergency messages for the safety of vehicles or for reducing ad-hoc communication overhead. Due to the nature of VANETs that comprise of transient nodes and often unexpected changes in network topology, level-based access control can significantly improve broadcast performance.Let us illustrate this based on the following example. The Bell–LaPadula model can be used for simple but efficient access control in sharing resources and communication in a VANET (or ad-hoc network) environment. However, based on the aforementioned reason, we argue that multilevel security can help to make communication in VANETs simple but secure. For example, let us consider a VANET with a number of security levels, such as top-security level, high-security level, operator security level, and general user level. An ambulance, which is a node in the VANET, wants a roadside unit to arrange the best route to a hospital. The roadside unit, which has the operator security level, only needs to know that the ambulance is a high-security level node in order for it to help manage the route and traffic. Assuming that all vehicles on the road are autonomous vehicles, the roadside unit may request that other vehicles make way for the ambulance due to its high-security level.


### 1.1. Related Work

There are three areas of work that closely relate to our work. These are reviewed in this section.First, there is attribute-based and policy-based cryptography. Sahai and Waters were the first to propose attribute-based encryption in [8]. However, the implementation is not flexible and is only limited to particular systems. Later, Goyal et al. formalised and demonstrated a more general key-policy design for attribute-based encryption in [9]. An attribute-based encryption (ABE) scheme is a cryptographic primitive that only allows users who satisfy the fine-grained access structure to decrypt the ciphertext. A ciphertext is generated by encrypting a message along with a public string p. By using a decryption key associated with a Boolean predicate function φ., the ciphertext can be decrypted only when φp is true. Their ABE scheme can be classified as a key-policy attribute-based encryption (KP-ABE). Basic KP-ABE uses threshold gates to express the access policy.In later work on ABE schemes, logic gates (AND/OR) and threshold gates were used to construct the policy in ABE. A ciphertext-policy attribute-based encryption (CP-ABE) scheme was first proposed by Bethencourt et al. [10]. This primitive allows the policy to be constructed with a combination of numerical comparison and logic gates. Attribute-based access control benefited from this primitive in practice. Hence, their work is used for comparison with our work in a later section. Following their work, much research on CP-ABE has been published within the last decade. Recently, a CP-ABE scheme for a complex constructed attribute with multiauthorities was proposed by Rouselakis and Waters [11]. Their scheme supports any string for the attribute in the policy, and it can combine multiple trusted authorities in a single policy. This is an efficient and practical scheme that can cover a wide range of users, on the condition that the attributes and the policy must not be complicated. Hence, this work was also included for comparison with our scheme. Another CP-ABE scheme, which is constructed without a bilinear function, was proposed by Yao and others [12]. Their scheme achieves significantly fast computation, which is suitable in the Internet of thing (IoT) and wireless sensor network (WSN). Therefore, our work is also compared with this primitive in the comparison section of this study. Moreover, Xue et al. proposed a comparable attribute-based encryption scheme (CABE) in [13]. The CABE scheme provides a new way for attribute comparison which is an inspiration for our work. It allows the system to test whether an attribute is equal to, more than, or less than the given policy.Similar to attribute-based cryptography, Bagga and Molva [14] introduced the notion of policy-based cryptography (policy-based encryption and policy-based signature schemes). The policy in CP-ABE proposed by Bethencourt et al. [10] is conceptually similar to policy-based encryption. However, the access structure and complexity of the policy are more comprehensive, which can easily be used in an access control system. Due to the nature of applications in our work, we only applied the concept of a policy tree implementing integer comparison. With only an integer attribute in the policy (no AND/OR logic gates), our scheme achieves a constant size ciphertext.Bellare and Fuchsbauer later formally defined the security definition of policy-based signatures [15]. Like the attribute-based signature, a signer in the policy-based signature can sign on a message only if he/she meets the policy’s requirement (or attributes). From a signer’s point of view, both attribute-based and policy-based signatures ensure message integrity and authenticity properties. The authenticity and integrity of the message can be validated by only a verifier. Nevertheless, the signature cannot be generated or forged by other beside the signer who met the policy requirements. A variant policy-controlled signature scheme was proposed in [16], where authenticity was done in a reversed manner and limited to only the attribute-credential holder (verifier). In contrast to attribute-based and policy-based signatures, policy-controlled signatures guarantee that only verifiers, who hold credentials that satisfy the policy or attributes, can verify the authenticity and integrity of the message and the nonreputability of the signer.Closely related work on an attribute-based signature (ABS) scheme was presented in 2008 by Maji et al. [17]. They also proposed an ABS scheme in the standard model in [18]. In this primitive, a signer reveals nothing about their identity in the signing process. It shows only their specific attributes. Many variant ABS schemes were put forward based on Maji et al.’s works. These are presented in [19–26]. Shahandashti and Safavi-Naini [19] and Li et al. [27] independently published their work on the same topic of ABS with threshold predicate. Escala and others [22] also presented an ABS scheme with threshold predicate. Their scheme was equipped with a revocation method. They also formalised the adaptive unforgeability property for their ABS scheme. Additionally, a constant size ABS with threshold predicate was proposed by Herranz et al. [21]. Later, an ABS scheme with arbitrary circuits, which is supposed to be more efficient than the ABS schemes proposed by Maji et al. [18, 25], was presented by Sakai et al. [26]. This is true only when we increase the gate numbers. Their construction is based on the combination of a witness indistinguishable, an extractable noninteractive proof system and an existentially unforgeable signature scheme.As mentioned above, many ABE and ABS schemes were proposed in the last decade. It seems that a simple solution for the aforementioned problems can easily be achieved by applying attribute-based or policy-based cryptography to encrypt a message and its signature. Only qualified users, who hold the proper credentials, can recover the message from an encrypted message. However, this is not entirely true since authentication of the signature can be transferred to a third party. Since the products after the decryption process are the signature and the message, they can be verified by any party. From the aforementioned scenario, signcryption’s ability to authenticate and decrypt should be limited to verifiers who hold credentials that satisfy the security level.The second related topics is the hierarchical identity-based signature and encryption scheme (HIBS and HIBE). HIBE is a concept that combines an identity-based encryption (IBE) scheme and a hierarchical system. In the hierarchical system, a user’s identity at the security levelk is able to generate a secret key for the identity of its descendants. It also can decrypt a ciphertext meant for its descendants but not for other identities. Hence, it can provide a similar solution to the aforementioned problems about multilevel security. Our work has a slightly similar aspect; however, it differs in key generation and distribution. For example, every level in our scheme only has a single branch, but it can generate multiple private keys for the branch. Following the introduction of HIBE, there has been much subsequent work in this area [28, 29]. As a natural conversion from the HIBE scheme, the hierarchical identity-based signature (HIBS) scheme also inherits its properties. The ancestor’s identity can generate a secret key for the identity of its descendants, and it can generate the signature of behalf of its descendants as well. However, it cannot generate a signature on a message on behalf of other identities.Boneh et al. was the first to propose a HIBE scheme with a constant size ciphertext in [30]. Our work on a constant size ciphertext was inspired by their work. Zhang et al. [28] proposed a compact size HIBE with a constant size private key. Their scheme’s distinct feature is having a constant size for both private key and ciphertext. Our scheme achieves this feature as well. A review of existing HIBS schemes can be found in [29]. Chen et al. provided a performance comparison between four HIBS schemes. Our work uses a similar approach for comparison with various schemes. In general, the benefit of using HIBE and HIBS in the network system that applied the identity-based public key system is to mitigate the bottleneck in the communication. Moreover, it is also to limit the key escrow. Nevertheless, similar to ABS schemes, HIBS only provides authenticity and message integrity for a signer, but not nonrepudiation and authorisation for a verifier.The final related area of work is signcryption and attribute-based signcryption. Zheng was the first to proposed the signcryption scheme in [31]. This primitive provides both authenticity and secrecy. The first attribute-based signcryption (ABSC) scheme with threshold predicate was presented by Gagné et al. [32]. The primitive is a solution to the problems mentioned earlier, but is much less efficient when compared to our scheme in term of communication overhead and computation. Following the above work, several researchers proposed some works [33–35] to improve ABSC schemes in terms of applications and concrete construction in the standard model, efficient constructions, and formal security models, respectively. Pandit et al. [33] provided an ABSC scheme in a standard model. Their scheme proved to be secure in the IND-CCA in the adaptive-predicate model. The ABSC-based linear codes secret sharing scheme was introduced by Song et al. in [34]. The access control system based on ABSC scheme was proposed by Zheng et al. in [35]. They showed that the key agreement scheme, an important tool for the access control system, can be constructed efficiently with ABSC. Rao [36] proposed an attribute-based online/offline signcryption scheme, which reduced the computation signing time when needed. A certificateless threshold signcryption scheme proposed by Yu et al. in [37] allows t-out-of-n senders to work together to generate the signcryption for applications such as petition, voting. Wang et al. [38] proposed an efficient signcryption with a designated equality test. It allows a trusted third party to check the validity of ciphertext with a given message. Later on, Le et al. put forward a signcryption scheme in the standard model in [39], which adopted the concept of the designated equality test by Wang et al. in [38]. Nevertheless, in Wang et al.’s scheme [38], a signature on a message can easily be extracted from a signcrypted ciphertext. Hence, a signcrypted ciphertext can be linked to the sender identity. Recently, Yu et al. [40] introduced a lightweight hybrid ABSC scheme for IoT systems. Their schemes allow a low-power and low-computation device to pass the heavy computation in the signing and encrypting process to the edge node before returning the partial output. However, its communication cost (ciphertext size) is linear to the attributes; hence, it is only suitable for a simple access control system for the IoT system. The features comparison between signcryption, HIBE, ABE, ABSC, and our LBS schemes are given in Table 1.Table 1
Comparison of encryptions schemes with our LBS scheme.
Schemes\ propertiesMulti receiversConfidentialityAuthenticityPrivacyConstant sizeYW21(SignCryption) [37]✕✓✓✕✓LDR21(SignCryption) [39]✕✓✓✕✓ZMW16(HIBE) [28]✓✓✕✕✓GPSW06(KP-ABE) [9]✓✓✕✕✕XHXWYH17(CABE) [13]✓✓✕✕✕BSW07(CP-ABE) [10]✓✓✓✕✕RW15(CP-ABE) [11]✓✓✕✕✕YTC14(CP-ABE) [12]✓✓✕✕✕PPB16(ABSC) [33]✓✓✓✓✕SLLL17(ABSC) [34]✓✓✓✓✕Rao17(ABSC) [36]✓✓✓✓✕YLWXY20(ABSC) [40]✓✓✓✓✕Our LBS✓✓✓✕✓Our LBS with OP✓✓✓✓✓Finally, the access control schemes for ad-hoc networks or the Internet of Things are reviewed. There are many access control systems that have been proposed recently [41–44]. Vijayakumar et al. [41] proposed an access control scheme that can be secure against attacks such as message reply attack, Sybil attack, masquerading attack, integrity attacks, and collusion attacks. Wazid et al. [42] proposed an access control scheme that is secured in the fog computing environment. Recently, Xia et al. [43] introduced an efficient authentication and key agreement scheme for a secure and anonymous access control system. It allows users to identify themselves without revealing their identity. This anonymous property is intriguing the optional anonymity in our scheme. Our scheme is designed to easily apply with the access control system, which allows users to securely and privately transmit their broadcast messages or private data to other users. It also reduces the process of encryption and signing in the existing access control schemes mentioned above. To further the benefits from privacy-preserving in our scheme, we believe that our scheme can integrate with AI-enabled blockchain-based access control proposed by Bera [44]. Hence, the anonymity in intrusion detection systems that detect and mitigate malicious attacks for the Internet of Everything (IOE) environment can be constructed. Moreover, our scheme can be designed for the access control system in an ad-hoc environment, such as VANETs, since a node can prove itself to another node that it holds a valid credential. Moreover, the proof cannot be replicated and transferred to other parties. Hence, it provides another privacy protection layer on top of it.


### 1.2. Our Contributions

To tackle the secrecy and privacy issue in communication over VANETs or AV networks, we propose a level-based controlled signcryption (LBS) scheme for level-based access control systems. This primitive provides access control with a hierarchical structure or a simple multilevel access control. Level-based access control can be viewed as a simplified version of attribute-based access control where the only attribute is an integer representing the security level. Our aim is to flexibly and efficiently allow nodes to communicate with other nodes securely and privately. Hence, we provide an optional privacy mechanism in the signcrypting (sign with encrypt) and unsigncrypting (verify with decrypt) processes. The security of this primitive is also formalised in this study. The notion of LBS schemes allows receivers, who hold a credential of a certain security level specified by the sender, to verify the authenticity of the ciphertext and to decrypt it. Moreover, with optional privacy, higher levels of confidentiality can be provided in the LBS scheme. LBS with optional privacy provides privacy between two or more parties when required. Nodes in VANETs can securely, confidentially, and flexibly send messages to an individual node, a group of node, or all nodes (message broadcasts are often use in VANETs to get the current routing in the network). Hence, the LBS scheme is suitable for mass encryption with authenticity and privacy.We organized our study as follows. Some preliminaries and definitions are defined in the next section. In Section3, the formal definition of level-based controlled signcryption is presented. The security model is described as well in the same section. The construction detail of LBS scheme is described with its security proofs in Section 4. Finally, a comparison of our concrete scheme with ABS schemes and the conclusion of this study are presented in the last two sections.


## 1.1. Related Work

There are three areas of work that closely relate to our work. These are reviewed in this section.First, there is attribute-based and policy-based cryptography. Sahai and Waters were the first to propose attribute-based encryption in [8]. However, the implementation is not flexible and is only limited to particular systems. Later, Goyal et al. formalised and demonstrated a more general key-policy design for attribute-based encryption in [9]. An attribute-based encryption (ABE) scheme is a cryptographic primitive that only allows users who satisfy the fine-grained access structure to decrypt the ciphertext. A ciphertext is generated by encrypting a message along with a public string p. By using a decryption key associated with a Boolean predicate function φ., the ciphertext can be decrypted only when φp is true. Their ABE scheme can be classified as a key-policy attribute-based encryption (KP-ABE). Basic KP-ABE uses threshold gates to express the access policy.In later work on ABE schemes, logic gates (AND/OR) and threshold gates were used to construct the policy in ABE. A ciphertext-policy attribute-based encryption (CP-ABE) scheme was first proposed by Bethencourt et al. [10]. This primitive allows the policy to be constructed with a combination of numerical comparison and logic gates. Attribute-based access control benefited from this primitive in practice. Hence, their work is used for comparison with our work in a later section. Following their work, much research on CP-ABE has been published within the last decade. Recently, a CP-ABE scheme for a complex constructed attribute with multiauthorities was proposed by Rouselakis and Waters [11]. Their scheme supports any string for the attribute in the policy, and it can combine multiple trusted authorities in a single policy. This is an efficient and practical scheme that can cover a wide range of users, on the condition that the attributes and the policy must not be complicated. Hence, this work was also included for comparison with our scheme. Another CP-ABE scheme, which is constructed without a bilinear function, was proposed by Yao and others [12]. Their scheme achieves significantly fast computation, which is suitable in the Internet of thing (IoT) and wireless sensor network (WSN). Therefore, our work is also compared with this primitive in the comparison section of this study. Moreover, Xue et al. proposed a comparable attribute-based encryption scheme (CABE) in [13]. The CABE scheme provides a new way for attribute comparison which is an inspiration for our work. It allows the system to test whether an attribute is equal to, more than, or less than the given policy.Similar to attribute-based cryptography, Bagga and Molva [14] introduced the notion of policy-based cryptography (policy-based encryption and policy-based signature schemes). The policy in CP-ABE proposed by Bethencourt et al. [10] is conceptually similar to policy-based encryption. However, the access structure and complexity of the policy are more comprehensive, which can easily be used in an access control system. Due to the nature of applications in our work, we only applied the concept of a policy tree implementing integer comparison. With only an integer attribute in the policy (no AND/OR logic gates), our scheme achieves a constant size ciphertext.Bellare and Fuchsbauer later formally defined the security definition of policy-based signatures [15]. Like the attribute-based signature, a signer in the policy-based signature can sign on a message only if he/she meets the policy’s requirement (or attributes). From a signer’s point of view, both attribute-based and policy-based signatures ensure message integrity and authenticity properties. The authenticity and integrity of the message can be validated by only a verifier. Nevertheless, the signature cannot be generated or forged by other beside the signer who met the policy requirements. A variant policy-controlled signature scheme was proposed in [16], where authenticity was done in a reversed manner and limited to only the attribute-credential holder (verifier). In contrast to attribute-based and policy-based signatures, policy-controlled signatures guarantee that only verifiers, who hold credentials that satisfy the policy or attributes, can verify the authenticity and integrity of the message and the nonreputability of the signer.Closely related work on an attribute-based signature (ABS) scheme was presented in 2008 by Maji et al. [17]. They also proposed an ABS scheme in the standard model in [18]. In this primitive, a signer reveals nothing about their identity in the signing process. It shows only their specific attributes. Many variant ABS schemes were put forward based on Maji et al.’s works. These are presented in [19–26]. Shahandashti and Safavi-Naini [19] and Li et al. [27] independently published their work on the same topic of ABS with threshold predicate. Escala and others [22] also presented an ABS scheme with threshold predicate. Their scheme was equipped with a revocation method. They also formalised the adaptive unforgeability property for their ABS scheme. Additionally, a constant size ABS with threshold predicate was proposed by Herranz et al. [21]. Later, an ABS scheme with arbitrary circuits, which is supposed to be more efficient than the ABS schemes proposed by Maji et al. [18, 25], was presented by Sakai et al. [26]. This is true only when we increase the gate numbers. Their construction is based on the combination of a witness indistinguishable, an extractable noninteractive proof system and an existentially unforgeable signature scheme.As mentioned above, many ABE and ABS schemes were proposed in the last decade. It seems that a simple solution for the aforementioned problems can easily be achieved by applying attribute-based or policy-based cryptography to encrypt a message and its signature. Only qualified users, who hold the proper credentials, can recover the message from an encrypted message. However, this is not entirely true since authentication of the signature can be transferred to a third party. Since the products after the decryption process are the signature and the message, they can be verified by any party. From the aforementioned scenario, signcryption’s ability to authenticate and decrypt should be limited to verifiers who hold credentials that satisfy the security level.The second related topics is the hierarchical identity-based signature and encryption scheme (HIBS and HIBE). HIBE is a concept that combines an identity-based encryption (IBE) scheme and a hierarchical system. In the hierarchical system, a user’s identity at the security levelk is able to generate a secret key for the identity of its descendants. It also can decrypt a ciphertext meant for its descendants but not for other identities. Hence, it can provide a similar solution to the aforementioned problems about multilevel security. Our work has a slightly similar aspect; however, it differs in key generation and distribution. For example, every level in our scheme only has a single branch, but it can generate multiple private keys for the branch. Following the introduction of HIBE, there has been much subsequent work in this area [28, 29]. As a natural conversion from the HIBE scheme, the hierarchical identity-based signature (HIBS) scheme also inherits its properties. The ancestor’s identity can generate a secret key for the identity of its descendants, and it can generate the signature of behalf of its descendants as well. However, it cannot generate a signature on a message on behalf of other identities.Boneh et al. was the first to propose a HIBE scheme with a constant size ciphertext in [30]. Our work on a constant size ciphertext was inspired by their work. Zhang et al. [28] proposed a compact size HIBE with a constant size private key. Their scheme’s distinct feature is having a constant size for both private key and ciphertext. Our scheme achieves this feature as well. A review of existing HIBS schemes can be found in [29]. Chen et al. provided a performance comparison between four HIBS schemes. Our work uses a similar approach for comparison with various schemes. In general, the benefit of using HIBE and HIBS in the network system that applied the identity-based public key system is to mitigate the bottleneck in the communication. Moreover, it is also to limit the key escrow. Nevertheless, similar to ABS schemes, HIBS only provides authenticity and message integrity for a signer, but not nonrepudiation and authorisation for a verifier.The final related area of work is signcryption and attribute-based signcryption. Zheng was the first to proposed the signcryption scheme in [31]. This primitive provides both authenticity and secrecy. The first attribute-based signcryption (ABSC) scheme with threshold predicate was presented by Gagné et al. [32]. The primitive is a solution to the problems mentioned earlier, but is much less efficient when compared to our scheme in term of communication overhead and computation. Following the above work, several researchers proposed some works [33–35] to improve ABSC schemes in terms of applications and concrete construction in the standard model, efficient constructions, and formal security models, respectively. Pandit et al. [33] provided an ABSC scheme in a standard model. Their scheme proved to be secure in the IND-CCA in the adaptive-predicate model. The ABSC-based linear codes secret sharing scheme was introduced by Song et al. in [34]. The access control system based on ABSC scheme was proposed by Zheng et al. in [35]. They showed that the key agreement scheme, an important tool for the access control system, can be constructed efficiently with ABSC. Rao [36] proposed an attribute-based online/offline signcryption scheme, which reduced the computation signing time when needed. A certificateless threshold signcryption scheme proposed by Yu et al. in [37] allows t-out-of-n senders to work together to generate the signcryption for applications such as petition, voting. Wang et al. [38] proposed an efficient signcryption with a designated equality test. It allows a trusted third party to check the validity of ciphertext with a given message. Later on, Le et al. put forward a signcryption scheme in the standard model in [39], which adopted the concept of the designated equality test by Wang et al. in [38]. Nevertheless, in Wang et al.’s scheme [38], a signature on a message can easily be extracted from a signcrypted ciphertext. Hence, a signcrypted ciphertext can be linked to the sender identity. Recently, Yu et al. [40] introduced a lightweight hybrid ABSC scheme for IoT systems. Their schemes allow a low-power and low-computation device to pass the heavy computation in the signing and encrypting process to the edge node before returning the partial output. However, its communication cost (ciphertext size) is linear to the attributes; hence, it is only suitable for a simple access control system for the IoT system. The features comparison between signcryption, HIBE, ABE, ABSC, and our LBS schemes are given in Table 1.Table 1
Comparison of encryptions schemes with our LBS scheme.
Schemes\ propertiesMulti receiversConfidentialityAuthenticityPrivacyConstant sizeYW21(SignCryption) [37]✕✓✓✕✓LDR21(SignCryption) [39]✕✓✓✕✓ZMW16(HIBE) [28]✓✓✕✕✓GPSW06(KP-ABE) [9]✓✓✕✕✕XHXWYH17(CABE) [13]✓✓✕✕✕BSW07(CP-ABE) [10]✓✓✓✕✕RW15(CP-ABE) [11]✓✓✕✕✕YTC14(CP-ABE) [12]✓✓✕✕✕PPB16(ABSC) [33]✓✓✓✓✕SLLL17(ABSC) [34]✓✓✓✓✕Rao17(ABSC) [36]✓✓✓✓✕YLWXY20(ABSC) [40]✓✓✓✓✕Our LBS✓✓✓✕✓Our LBS with OP✓✓✓✓✓Finally, the access control schemes for ad-hoc networks or the Internet of Things are reviewed. There are many access control systems that have been proposed recently [41–44]. Vijayakumar et al. [41] proposed an access control scheme that can be secure against attacks such as message reply attack, Sybil attack, masquerading attack, integrity attacks, and collusion attacks. Wazid et al. [42] proposed an access control scheme that is secured in the fog computing environment. Recently, Xia et al. [43] introduced an efficient authentication and key agreement scheme for a secure and anonymous access control system. It allows users to identify themselves without revealing their identity. This anonymous property is intriguing the optional anonymity in our scheme. Our scheme is designed to easily apply with the access control system, which allows users to securely and privately transmit their broadcast messages or private data to other users. It also reduces the process of encryption and signing in the existing access control schemes mentioned above. To further the benefits from privacy-preserving in our scheme, we believe that our scheme can integrate with AI-enabled blockchain-based access control proposed by Bera [44]. Hence, the anonymity in intrusion detection systems that detect and mitigate malicious attacks for the Internet of Everything (IOE) environment can be constructed. Moreover, our scheme can be designed for the access control system in an ad-hoc environment, such as VANETs, since a node can prove itself to another node that it holds a valid credential. Moreover, the proof cannot be replicated and transferred to other parties. Hence, it provides another privacy protection layer on top of it.


## 1.2. Our Contributions

To tackle the secrecy and privacy issue in communication over VANETs or AV networks, we propose a level-based controlled signcryption (LBS) scheme for level-based access control systems. This primitive provides access control with a hierarchical structure or a simple multilevel access control. Level-based access control can be viewed as a simplified version of attribute-based access control where the only attribute is an integer representing the security level. Our aim is to flexibly and efficiently allow nodes to communicate with other nodes securely and privately. Hence, we provide an optional privacy mechanism in the signcrypting (sign with encrypt) and unsigncrypting (verify with decrypt) processes. The security of this primitive is also formalised in this study. The notion of LBS schemes allows receivers, who hold a credential of a certain security level specified by the sender, to verify the authenticity of the ciphertext and to decrypt it. Moreover, with optional privacy, higher levels of confidentiality can be provided in the LBS scheme. LBS with optional privacy provides privacy between two or more parties when required. Nodes in VANETs can securely, confidentially, and flexibly send messages to an individual node, a group of node, or all nodes (message broadcasts are often use in VANETs to get the current routing in the network). Hence, the LBS scheme is suitable for mass encryption with authenticity and privacy.We organized our study as follows. Some preliminaries and definitions are defined in the next section. In Section3, the formal definition of level-based controlled signcryption is presented. The security model is described as well in the same section. The construction detail of LBS scheme is described with its security proofs in Section 4. Finally, a comparison of our concrete scheme with ABS schemes and the conclusion of this study are presented in the last two sections.


## 2. Preliminaries

### 2.1. Notation

The rest of this study will use the following notations. We said that a functionf:ℕ⟶ℝ is negligible, if ∀c>0, and for all sufficiently large n, fn<1/nc. poly. is a deterministic polynomial function. Let n represent a series of numbers (or indexes), e g., if n is integer, then n=0,…,n. Let poly be a polynomial function. The security parameter is denoted by ℓ, and the polynomial time is denoted by P. We say that P∈poly1ℓ if ∀poly1ℓ;∀ℓ:P≤poly1ℓ.A process that randomly selects the elementl from a set L is denoted by l←$L. Let H:0,1∗⟶G1 be a collision-resistant hash function that maps a string to G1. Let h:0,1∗⟶ℤp∗ be a collision-resistant hash function that maps a string to ℤp∗.


### 2.2. Bilinear Pairing

Let us defineG1, G2, and GT cyclic multiplicative groups. The generators of G1 and G2 groups are g1 and g2, respectively. p is defined as a prime number and the order of all generators. e^ is denoted as an efficient algorithm that maps G1×G2⟶GT. We call this function a bilinear mapping function.The bilinear mapping function has the following properties:(1)
Bilinearity:∀g1∈G1;g2∈G2;a,b∈ℤp:e^g1a,g2b=e^g1,g2ab(2)
Nondegeneracy:∃g1∈G1∃g2∈G2: e^g1,g2≠1(3)
Computability:∃e^:∀g1∈G1,∀g2∈G2;e^g1,g2∈GTφ. is defined as an existing function mapping G1 to G2 in a one-time unit. It is also true in another way around.


### 2.3. Complexity Assumptions

Definition 1 (Computational Diffie–Hellman (CDH) problem).
With a tripleg,gχ,gψ∈G1 as input and gχ⋅ψ as output, we said that an algorithm A with an advantage probability ϵ′ breaks the CDH problem if(1)PrAg,gχ,gψ=gχ⋅ψ≥ε.
Note that the probability is taken over the random bits used byA and the arbitrarily selected random integers χ,ψ∈ℤq∗.Assumption 1.
Computational Diffie–Hellman assumption.
Thet,ϵ′-CDH assumption is intact if the probabilistic polynomial time-bound (PPT) algorithm with time complexity t. and a probability advantage of at least ϵ′ breaking the CDH problem does not exist.Definition 2 (Decisional bilinear Diffie–Hellman (DBDH) problem).
With a random quadrupleg,gx,gy,gz∈G1 and a random integer Z∈GT as input, determine if Z=e^g,gx⋅y⋅z or not. An algorithm A solves the DBDH problem in G1,GT within t,ϵ′, if A runs in time t, and(2)PrAg,gx,gy,gz,Z=e^g,gx⋅y⋅z=1−PrAg,gx,gy,gz,Z=e^g,gd=1≥ϵ′.
Note that the above probability is taken over the random bits used byA, random integers x,y,z,d∈ℤp, a random group g∈G1.Assumption 2.
Decisional bilinear Diffie–Hellman assumption.
Thet,ϵ′-DBDH assumption in G1,GT holds only if no PPT algorithm t,ϵ′ solving the DBDH problem does not exist.


## 2.1. Notation

The rest of this study will use the following notations. We said that a functionf:ℕ⟶ℝ is negligible, if ∀c>0, and for all sufficiently large n, fn<1/nc. poly. is a deterministic polynomial function. Let n represent a series of numbers (or indexes), e g., if n is integer, then n=0,…,n. Let poly be a polynomial function. The security parameter is denoted by ℓ, and the polynomial time is denoted by P. We say that P∈poly1ℓ if ∀poly1ℓ;∀ℓ:P≤poly1ℓ.A process that randomly selects the elementl from a set L is denoted by l←$L. Let H:0,1∗⟶G1 be a collision-resistant hash function that maps a string to G1. Let h:0,1∗⟶ℤp∗ be a collision-resistant hash function that maps a string to ℤp∗.


## 2.2. Bilinear Pairing

Let us defineG1, G2, and GT cyclic multiplicative groups. The generators of G1 and G2 groups are g1 and g2, respectively. p is defined as a prime number and the order of all generators. e^ is denoted as an efficient algorithm that maps G1×G2⟶GT. We call this function a bilinear mapping function.The bilinear mapping function has the following properties:(1)
Bilinearity:∀g1∈G1;g2∈G2;a,b∈ℤp:e^g1a,g2b=e^g1,g2ab(2)
Nondegeneracy:∃g1∈G1∃g2∈G2: e^g1,g2≠1(3)
Computability:∃e^:∀g1∈G1,∀g2∈G2;e^g1,g2∈GTφ. is defined as an existing function mapping G1 to G2 in a one-time unit. It is also true in another way around.


## 2.3. Complexity Assumptions

Definition 1 (Computational Diffie–Hellman (CDH) problem).
With a tripleg,gχ,gψ∈G1 as input and gχ⋅ψ as output, we said that an algorithm A with an advantage probability ϵ′ breaks the CDH problem if(1)PrAg,gχ,gψ=gχ⋅ψ≥ε.
Note that the probability is taken over the random bits used byA and the arbitrarily selected random integers χ,ψ∈ℤq∗.Assumption 1.
Computational Diffie–Hellman assumption.
Thet,ϵ′-CDH assumption is intact if the probabilistic polynomial time-bound (PPT) algorithm with time complexity t. and a probability advantage of at least ϵ′ breaking the CDH problem does not exist.Definition 2 (Decisional bilinear Diffie–Hellman (DBDH) problem).
With a random quadrupleg,gx,gy,gz∈G1 and a random integer Z∈GT as input, determine if Z=e^g,gx⋅y⋅z or not. An algorithm A solves the DBDH problem in G1,GT within t,ϵ′, if A runs in time t, and(2)PrAg,gx,gy,gz,Z=e^g,gx⋅y⋅z=1−PrAg,gx,gy,gz,Z=e^g,gd=1≥ϵ′.
Note that the above probability is taken over the random bits used byA, random integers x,y,z,d∈ℤp, a random group g∈G1.Assumption 2.
Decisional bilinear Diffie–Hellman assumption.
Thet,ϵ′-DBDH assumption in G1,GT holds only if no PPT algorithm t,ϵ′ solving the DBDH problem does not exist.


## 3. Level-Based Signcryption Schemes with Optional Privacy (LBS)

There are three main players in the level-based signcryption (LBS) scheme. A senderS generates a ciphertext that can only be verified and decrypted by a receiver V who holds a credential that satisfies the level-based security policy. This scenario can be used to ensure communication among authorised users. It can be used for message broadcasts in VANETs. It can also be used in secure group chats. However, if a sender wants to limit verification of the ciphertext to a particular receiver, the sender needs to place a personal receiver’s public key in the signcryption. We called this “optional privacy.” The “optional privacy” scenario is useful for sending private messages between the sender and the receiver. This solution can also be applied to a group of receivers where they share a group secret key, which is not affected by a member’s secret key. The last player is a trusted authority TA. In this level-based security system, a credential is generated by TA, where it associated the credential with the given security level.Notations on security level and level-based policy are defined as follows:L is a security level that specified in the level-based security policy. LP is defined as a level-based security policy that contains a security level as a security clearance of a verifier. Let us consider the following example. LP=“L>=l” means l is the minimum security level, and the policy is set such that l is the minimum level that can decrypt the ciphertext. Note that other types of index or symbol, such as A, B, C, and D, also can be used to indicate the security level in LP. We assume that the security levels are in ascending order, which means that the higher the number, the higher the security clearance.An LBS scheme is a sextuple (Setup, TKeyGen, SKeyGen, CreGen, SCrypt, Verify).System parameter generationSetup: with a security parameter ℓ as input, Setup, a probabilistic function, generates the system parameter param as follows:(3)Setup1ℓ⟶param.TA key generator TKeyGen: With param as input, TKeyGen, a probabilistic function, generates the private key skTA and the public parameter pkTA of a trusted authority as follows:(4)TKeyGenparam⟶pkTA,skTA.Signer key generatorSKeyGen: with param and pkTA as input, SKeyGen, a probabilistic function, generates the private key skE and the public parameter pkE of a signer as follows:(5)SKeyGenparam,pkTA⟶pkE,skE.Verifier credential generatorCreGen: with param, skTA, and an assertion L indicating the security level of a verifier as input, CreGen, a probabilistic function, generates a verifier’s credential ℂ as follows:(6)CreGenparam,skTA,L⟶ℂ.SigncryptionSCrypt: with param, pkTA, skE, pkE, a message M, and a level-based security policy LP as input, SCrypt, a probabilistic function, generates a sender’s ciphertext C, that is,(7)SCryptparam,M,skE,pkE,pkTA,LP⟶C.UnsigncryptionUSCrypt: with param, pkTA, pkE, LP, ℂ, and C as input, USCrypt, a deterministic function, returns with the decisional output d∈M,reject, that is,(8)USCryptparam,C,pkTA,pkE,LP,ℂ⟶d.Signcryption with optional privacySCOP: with param, pkTA, skE, pkE, pkR, a message M, and a level-based security policy LP as input, SCrypt, a probabilistic function, generates a sender’s ciphertext C as follows:(9)SCOPparam,M,skE,pkE,pkR,pkTA,LP⟶C.Unsigncryption with optional privacyUSCOP: with param, pkTA, pkE, skR, LP, ℂ, and C as input, USCOP, a deterministic function, determines the validity of the input and returns the decisional output d∈M,reject, that is,(10)USCOPparam,C,pkTA,pkE,skR,LP,ℂ⟶d.


### 3.1. Unforgeability

The unforgeability property in LBS provides an assurance that an attacker allowed to access the credential queries that cannot generate a valid level-based signcryptionC∗, which seems to be signed by the sender S on a new message M∗. The attacker is allowed to access the signing oracle SSO and the verifying oracle VCO. The pkE and pkTA is also known to the attacker; however, a signer’s secret key skE is restricted. Even the attacker can arbitrarily select a message M, the entire credentials, and a level-based security level policy LP as input, a valid signcryption on a new message M∗ cannot be generated. We called this a security against existential unforgeability under the adaptive chosen message and credentials exposure attack EUF−CMCEA.Let us define some notations before given a formal definition. LetAU be the adaptively chosen message and credentials exposure adversary. We assume that AU is an adversary who attacks the unforgeability of the LBS scheme. ℱ is defined as a simulator who run the attack simulation with AU. Note that ℂ is defined as the credentials of the entire security level, for example, if the system has 15 security levels, then ℂ=ℂ1,…,ℂ15. The SSO and VCO oracles that describe the ability of adversaries to break the unforgeability of an LBS scheme are illustrated as follows.SSO.,.: at most oS times, when a query for a signcryption C on its choice of message M and a signer S corresponding to pkE is issued, SSO runs the Sign algorithm to generate a signcryption C on a message M corresponding to pkTA, pkE, and LP. Finally, SSO responses to the query with C.VCO.: at most oC times, when a query for credential ℂi corresponding to the arbitrarily chosen security level L is issued, VCO responses with the corresponding credentials ℂ.Algorithm 1: Algorithm for unforgeability experiment ExptAEUF,ΣEUF−CMACE.
Input: A security parameterkOutput: The success of the attack.(1)
param←$Setup1k(2)
pkTA,skTA←$TKeyGenparam(3)
pkE,skE←$SKeyGenparam,pkTA(4)
Phase I: learning(5)
st,M,LP←$AUSSO.,.,VCO.stR,pkTA,pkE,param(6)
Phase II: challenging(7)
C←$AUVCO.forge,st,M,LP(8)
IfssoM,LP has never been executed;USCryptparam,C,pkTA,pkE,</span></i></p><i>LP,ℂ=M then(9)
return1(10)
else(11)
return 0(12)
endThe formalisation of unforgeability is now defined in the following statements. For a level-based signcryption, an adversaryAU is associated with the experiment given in Algorithm 1. AU has two functions, namely, stR stage and forge stage. Using an adaptive strategy, AU, in the stR stage, arbitrarily chooses a message and makes queries to the signing oracle SSO.,. and the credential oracle VCO.. The query processes are allowed repeatedly according to AU’s strategies. At the end of this stage, AU outputs a message M and a level-based security policy LP along with some state information st to be used in the forge state. In the second stage, AU takes M,LP,st as input and outputs a valid level-based signcryption C. AU wins the above experiment if(1)
AU results a forged signcryption δ on a new message M∗ corresponding to pkE and LP(2)
M∗←USCryptC,pkE,LP,ℂ(3)
AU never makes a request for a level-based signcryption with M∗,pkE,LP to the SSO oracleADVEUF−CMCEA. denotes the probability that AU successfully passes the winning condition in the above simulation.Definition 3.
Under a chosen message and credentials exposure attack model, an LBS scheme ist,oS,oC,ϵ-secure existential unforgeability, if the PPT adversary AU success in the attack the nonnegligible (within k) probability(11)ADVEUF−CMCEAk=PrExptAU,ΣEUF−CMCEAk=1=ϵ,does not exist. Let AU runs at most t times and makes at most oS signing queries and oC credential queries.


### 3.2. Indistinguishability

The indistinguishable property is modelled on the indistinguishability of ciphertext in the selective-credential exposed model. The attack models can be divided into two different models, which are the chosen plaintext attack and the (active) chosen ciphertext attack. The first attack model aims to prevent a group of corrupted credential holders (malicious receivers) from verifying and decrypting a level-based ciphertextC on a message M with a level-based security policy LP, where these malicious receivers do not have enough credentials to satisfy the security level indicated in LP. In the second attack model, an attacker has the added power to query for verification of any signature because excepted for the challenge signature, he/she does not have credentials that satisfy the level-based security policy LP to verify it by himself/herself.Before describing the formal definition of these models, some definitions are first defined.AI is defined as the adaptive chosen plaintext (or ciphertext) and chosen level-based security policy distinguisher.


#### 3.2.1. Chosen Plaintext Attack (IND-CPA)

The signcryption oracleSSO, credential generator oracle VCO, and verification oracle VSO are used to describe the abilities of AI breaking the chosen plaintext attack in the selective-credential exposed model IND−CPA. The VCO and SSO oracles are described as follows:VCO.: at most oC times, when a query for the credential ℂi corresponding to the arbitrarily chosen security level L is issued, VCO responses with the corresponding credentials ℂ.(i)
SSO.,.: at most oE times, AI can arbitrarily choose a message M and make a query for a ciphertext C. SSO responses with the result of the SCrypt algorithm generating a ciphertext C corresponding to a message M, pkTA, pkE, and LP.Algorithm 2: Algorithm for indistinguishability experiment ExptAI,ΣIND−CPAb.
Input: A security parameterk and a random bit bOutput: The success of the attack.(1)
Setup parameters:(2)
param←$Setup1k(3)
pkTA,skTA←$TKeyGenparam(4)
pkE,skE←$SKeyGenparam,pkTA(5)
Phase I: learningst,M0,M1,LP←$AISSO.,VCO.stC,pkTA,pkE,param;(6)
Prechallenge:Ifb=0, thenC←$SCryptparam,M0,skE,pkE,pkTA,LP(7)
else,C←$SCryptparam,M1,skE,pkE,pkTA,LPend(8)
Phase II: challengingd←$AIVCO.guess,st,M0,M1,LP,CIfvcoL:L>=minLP and ssoMb,L have never been executed, then(9)
Ifd=b, then return 1else return0elsereturn⊥endFormalisation of indistinguishability under the adaptive chosen plaintext attack model of an LBS scheme is described as follows. The experiment that is associated with an adversaryAI of a level-based signcryption scheme is illustrated in Algorithm 2. AI has two functions that are stC stage and guess stage. Using an adaptive strategy, in the stC stage, AI arbitrarily chooses a message and makes queries to the signing oracle SSO.,. and the credential oracle VCO.. The query processes are allowed repeatedly according to AI’s strategies. AI outputs two messages M0,M1, a level-based security policy LP and some state information st used in the guess state at the end of the stage. Based on a previously set bit b, the experiment runs SCrypt with a message Mb as an input and outputs a valid level-based ciphertext C. In the second stage (Phase 2), AI takes M0,M1,LP,st,C as input and outputs a guess bit (1 or 0). Note that AI still can make queries to the VCO oracle before outputting a guess, and if the following conditions are not satisfied, the experiment will be aborted.(1)
AI never issues a query for a level-based ciphertext with LP and M as input to the SSO oracle(2)
With a restriction thatLP=“L≥l”, AI can only make a request for credentials with a security level L<l to the VCO oracleLetADVIND−CPA. be the success probability of AI breaking the indistinguishability under the adaptive chosen plaintext attack in the selective-credential exposed model of an LBS scheme.Definition 4.
An LBS scheme ist,oE,oC,ϵ-secure indistinguishability under a chosen plaintext attack in the selective-credential exposed model if the PPT distinguisher AI success in the attack with a nonnegligible (within k) probability(12)ADVIND−CPAk=PrExptAI,ΣIND−CPA0k−PrExptAI,ΣIND−CPA0k=ϵ,does not exist. Note that AI runs at most t times and makes at most oE signcryption queries and oC credential queries.


#### 3.2.2. Chosen Ciphertext Attack (IND-CCA)

Before formalising this attack, we first give some definitions and outline the oracles. LetIND−CPA be indistinguishability under a chosen plaintext attack in the selective-credential exposed model. The signing oracle SSO, credential generator oracle VCO, and unsigncryption oracle USO are used to describe the abilities of AC breaking IND−CPA of an LBS scheme. The SSO and VCO oracles have been depicted in Section 3.2.1. The USO oracle, however, is described as follows.USO.,.: with a ciphertext C and a level-based security policy LP as input, AI can request up to oD queries for the decryption and verification of a ciphertext C. USO returns a decisional result d that is either reject regrading the authenticity of ciphertext C or a message M.Algorithm 3: Algorithm for indistinguishability experiment under CCA attack ExptAI,ΣIND−CCAb.
Input: a security parameterk and a random bit bOutput: the success of the attack.Setup parameters: the setup process is same with Algorithm 2.Phase I: learningst,M0,M1,LP←$AISSO.,VCO.,USO.stC,pkTA,pkE,paramPrechallenge: the prechallenge process is same with Algorithm 2.(1)
Phase II: challengingd←$AISSO.,VCO.,USO.guess,st,M0,M1,LP,C ifvcoL:L>=minLP andSSOMb,L andUSOC,. have never been executed, thenIfd=b, then return 1else return0elsereturn⊥endFormalisation of indistinguishability under the adaptive chosen ciphertext attack model of an LBS scheme is described as follows. The experiment in Algorithm 3 depicts an adversaryAI of a level-based signcryption scheme. There are two functions that are a stC stage and a guess stage, which AI can execute. In the first stage, AI, with some elastic and pliable strategies, chooses a message and issues a request to the credential queries VCO., the signing queries SSO.,., and the unsigncryption queries USO.,.. The query processes are allowed repeatedly according to AI’s strategies. AI outputs two messages M0,M1, a level-based security policy LP, and some state information st used in the guess state at the end of the stage. The experiment runs SCrypt with a message Mb as an input and outputs a valid level-based ciphertext C. In the guess stage (Phase 2), AI takes M0,M1,LP,st,C as input and outputs a guess bit (1 or 0). Note that AI can still make queries to VCO and USO oracles before outputting a guess. However, if the following conditions are not satisfied, the experiment will be aborted.(1)
AI never issues a query for a level-based ciphertext with LP and M0 or M1 as input to the SSO oracle(2)
AI never issues a query with C as input to the USO oracle(3)
With a restriction thatLP=″L≥l″, AI can only make a request for credentials with a security level L<l to the VCO oracleLetADVIND−CCA. be the success probability of AI breaking indistinguishability under the adaptive chosen ciphertext attack in the selective-credential exposed model of an LBS scheme.Definition 5.
An LBS scheme ist,oE,oC,oD,ϵ-secure indistinguishability of ciphertext under a chosen ciphertext attack in the selective-credential exposed model if a distinguisher AI success in the attack with a nonnegligible (within k) probability(13)ADVIND−CCAk=PrExptAI,ΣIND−CCA0k−PrExptAI,ΣIND−CCA1k=ϵ,does not exist. Note that AI runs at most t times and makes at most oE signcryption queries, oC credential queries, and oD unsigncryption queries.


## 3.1. Unforgeability

The unforgeability property in LBS provides an assurance that an attacker allowed to access the credential queries that cannot generate a valid level-based signcryptionC∗, which seems to be signed by the sender S on a new message M∗. The attacker is allowed to access the signing oracle SSO and the verifying oracle VCO. The pkE and pkTA is also known to the attacker; however, a signer’s secret key skE is restricted. Even the attacker can arbitrarily select a message M, the entire credentials, and a level-based security level policy LP as input, a valid signcryption on a new message M∗ cannot be generated. We called this a security against existential unforgeability under the adaptive chosen message and credentials exposure attack EUF−CMCEA.Let us define some notations before given a formal definition. LetAU be the adaptively chosen message and credentials exposure adversary. We assume that AU is an adversary who attacks the unforgeability of the LBS scheme. ℱ is defined as a simulator who run the attack simulation with AU. Note that ℂ is defined as the credentials of the entire security level, for example, if the system has 15 security levels, then ℂ=ℂ1,…,ℂ15. The SSO and VCO oracles that describe the ability of adversaries to break the unforgeability of an LBS scheme are illustrated as follows.SSO.,.: at most oS times, when a query for a signcryption C on its choice of message M and a signer S corresponding to pkE is issued, SSO runs the Sign algorithm to generate a signcryption C on a message M corresponding to pkTA, pkE, and LP. Finally, SSO responses to the query with C.VCO.: at most oC times, when a query for credential ℂi corresponding to the arbitrarily chosen security level L is issued, VCO responses with the corresponding credentials ℂ.Algorithm 1: Algorithm for unforgeability experiment ExptAEUF,ΣEUF−CMACE.
Input: A security parameterkOutput: The success of the attack.(1)
param←$Setup1k(2)
pkTA,skTA←$TKeyGenparam(3)
pkE,skE←$SKeyGenparam,pkTA(4)
Phase I: learning(5)
st,M,LP←$AUSSO.,.,VCO.stR,pkTA,pkE,param(6)
Phase II: challenging(7)
C←$AUVCO.forge,st,M,LP(8)
IfssoM,LP has never been executed;USCryptparam,C,pkTA,pkE,</span></i></p><i>LP,ℂ=M then(9)
return1(10)
else(11)
return 0(12)
endThe formalisation of unforgeability is now defined in the following statements. For a level-based signcryption, an adversaryAU is associated with the experiment given in Algorithm 1. AU has two functions, namely, stR stage and forge stage. Using an adaptive strategy, AU, in the stR stage, arbitrarily chooses a message and makes queries to the signing oracle SSO.,. and the credential oracle VCO.. The query processes are allowed repeatedly according to AU’s strategies. At the end of this stage, AU outputs a message M and a level-based security policy LP along with some state information st to be used in the forge state. In the second stage, AU takes M,LP,st as input and outputs a valid level-based signcryption C. AU wins the above experiment if(1)
AU results a forged signcryption δ on a new message M∗ corresponding to pkE and LP(2)
M∗←USCryptC,pkE,LP,ℂ(3)
AU never makes a request for a level-based signcryption with M∗,pkE,LP to the SSO oracleADVEUF−CMCEA. denotes the probability that AU successfully passes the winning condition in the above simulation.Definition 3.
Under a chosen message and credentials exposure attack model, an LBS scheme ist,oS,oC,ϵ-secure existential unforgeability, if the PPT adversary AU success in the attack the nonnegligible (within k) probability(11)ADVEUF−CMCEAk=PrExptAU,ΣEUF−CMCEAk=1=ϵ,does not exist. Let AU runs at most t times and makes at most oS signing queries and oC credential queries.


## 3.2. Indistinguishability

The indistinguishable property is modelled on the indistinguishability of ciphertext in the selective-credential exposed model. The attack models can be divided into two different models, which are the chosen plaintext attack and the (active) chosen ciphertext attack. The first attack model aims to prevent a group of corrupted credential holders (malicious receivers) from verifying and decrypting a level-based ciphertextC on a message M with a level-based security policy LP, where these malicious receivers do not have enough credentials to satisfy the security level indicated in LP. In the second attack model, an attacker has the added power to query for verification of any signature because excepted for the challenge signature, he/she does not have credentials that satisfy the level-based security policy LP to verify it by himself/herself.Before describing the formal definition of these models, some definitions are first defined.AI is defined as the adaptive chosen plaintext (or ciphertext) and chosen level-based security policy distinguisher.


### 3.2.1. Chosen Plaintext Attack (IND-CPA)

The signcryption oracleSSO, credential generator oracle VCO, and verification oracle VSO are used to describe the abilities of AI breaking the chosen plaintext attack in the selective-credential exposed model IND−CPA. The VCO and SSO oracles are described as follows:VCO.: at most oC times, when a query for the credential ℂi corresponding to the arbitrarily chosen security level L is issued, VCO responses with the corresponding credentials ℂ.(i)
SSO.,.: at most oE times, AI can arbitrarily choose a message M and make a query for a ciphertext C. SSO responses with the result of the SCrypt algorithm generating a ciphertext C corresponding to a message M, pkTA, pkE, and LP.Algorithm 2: Algorithm for indistinguishability experiment ExptAI,ΣIND−CPAb.
Input: A security parameterk and a random bit bOutput: The success of the attack.(1)
Setup parameters:(2)
param←$Setup1k(3)
pkTA,skTA←$TKeyGenparam(4)
pkE,skE←$SKeyGenparam,pkTA(5)
Phase I: learningst,M0,M1,LP←$AISSO.,VCO.stC,pkTA,pkE,param;(6)
Prechallenge:Ifb=0, thenC←$SCryptparam,M0,skE,pkE,pkTA,LP(7)
else,C←$SCryptparam,M1,skE,pkE,pkTA,LPend(8)
Phase II: challengingd←$AIVCO.guess,st,M0,M1,LP,CIfvcoL:L>=minLP and ssoMb,L have never been executed, then(9)
Ifd=b, then return 1else return0elsereturn⊥endFormalisation of indistinguishability under the adaptive chosen plaintext attack model of an LBS scheme is described as follows. The experiment that is associated with an adversaryAI of a level-based signcryption scheme is illustrated in Algorithm 2. AI has two functions that are stC stage and guess stage. Using an adaptive strategy, in the stC stage, AI arbitrarily chooses a message and makes queries to the signing oracle SSO.,. and the credential oracle VCO.. The query processes are allowed repeatedly according to AI’s strategies. AI outputs two messages M0,M1, a level-based security policy LP and some state information st used in the guess state at the end of the stage. Based on a previously set bit b, the experiment runs SCrypt with a message Mb as an input and outputs a valid level-based ciphertext C. In the second stage (Phase 2), AI takes M0,M1,LP,st,C as input and outputs a guess bit (1 or 0). Note that AI still can make queries to the VCO oracle before outputting a guess, and if the following conditions are not satisfied, the experiment will be aborted.(1)
AI never issues a query for a level-based ciphertext with LP and M as input to the SSO oracle(2)
With a restriction thatLP=“L≥l”, AI can only make a request for credentials with a security level L<l to the VCO oracleLetADVIND−CPA. be the success probability of AI breaking the indistinguishability under the adaptive chosen plaintext attack in the selective-credential exposed model of an LBS scheme.Definition 4.
An LBS scheme ist,oE,oC,ϵ-secure indistinguishability under a chosen plaintext attack in the selective-credential exposed model if the PPT distinguisher AI success in the attack with a nonnegligible (within k) probability(12)ADVIND−CPAk=PrExptAI,ΣIND−CPA0k−PrExptAI,ΣIND−CPA0k=ϵ,does not exist. Note that AI runs at most t times and makes at most oE signcryption queries and oC credential queries.


### 3.2.2. Chosen Ciphertext Attack (IND-CCA)

Before formalising this attack, we first give some definitions and outline the oracles. LetIND−CPA be indistinguishability under a chosen plaintext attack in the selective-credential exposed model. The signing oracle SSO, credential generator oracle VCO, and unsigncryption oracle USO are used to describe the abilities of AC breaking IND−CPA of an LBS scheme. The SSO and VCO oracles have been depicted in Section 3.2.1. The USO oracle, however, is described as follows.USO.,.: with a ciphertext C and a level-based security policy LP as input, AI can request up to oD queries for the decryption and verification of a ciphertext C. USO returns a decisional result d that is either reject regrading the authenticity of ciphertext C or a message M.Algorithm 3: Algorithm for indistinguishability experiment under CCA attack ExptAI,ΣIND−CCAb.
Input: a security parameterk and a random bit bOutput: the success of the attack.Setup parameters: the setup process is same with Algorithm 2.Phase I: learningst,M0,M1,LP←$AISSO.,VCO.,USO.stC,pkTA,pkE,paramPrechallenge: the prechallenge process is same with Algorithm 2.(1)
Phase II: challengingd←$AISSO.,VCO.,USO.guess,st,M0,M1,LP,C ifvcoL:L>=minLP andSSOMb,L andUSOC,. have never been executed, thenIfd=b, then return 1else return0elsereturn⊥endFormalisation of indistinguishability under the adaptive chosen ciphertext attack model of an LBS scheme is described as follows. The experiment in Algorithm 3 depicts an adversaryAI of a level-based signcryption scheme. There are two functions that are a stC stage and a guess stage, which AI can execute. In the first stage, AI, with some elastic and pliable strategies, chooses a message and issues a request to the credential queries VCO., the signing queries SSO.,., and the unsigncryption queries USO.,.. The query processes are allowed repeatedly according to AI’s strategies. AI outputs two messages M0,M1, a level-based security policy LP, and some state information st used in the guess state at the end of the stage. The experiment runs SCrypt with a message Mb as an input and outputs a valid level-based ciphertext C. In the guess stage (Phase 2), AI takes M0,M1,LP,st,C as input and outputs a guess bit (1 or 0). Note that AI can still make queries to VCO and USO oracles before outputting a guess. However, if the following conditions are not satisfied, the experiment will be aborted.(1)
AI never issues a query for a level-based ciphertext with LP and M0 or M1 as input to the SSO oracle(2)
AI never issues a query with C as input to the USO oracle(3)
With a restriction thatLP=″L≥l″, AI can only make a request for credentials with a security level L<l to the VCO oracleLetADVIND−CCA. be the success probability of AI breaking indistinguishability under the adaptive chosen ciphertext attack in the selective-credential exposed model of an LBS scheme.Definition 5.
An LBS scheme ist,oE,oC,oD,ϵ-secure indistinguishability of ciphertext under a chosen ciphertext attack in the selective-credential exposed model if a distinguisher AI success in the attack with a nonnegligible (within k) probability(13)ADVIND−CCAk=PrExptAI,ΣIND−CCA0k−PrExptAI,ΣIND−CCA1k=ϵ,does not exist. Note that AI runs at most t times and makes at most oE signcryption queries, oC credential queries, and oD unsigncryption queries.


## 3.2.1. Chosen Plaintext Attack (IND-CPA)

The signcryption oracleSSO, credential generator oracle VCO, and verification oracle VSO are used to describe the abilities of AI breaking the chosen plaintext attack in the selective-credential exposed model IND−CPA. The VCO and SSO oracles are described as follows:VCO.: at most oC times, when a query for the credential ℂi corresponding to the arbitrarily chosen security level L is issued, VCO responses with the corresponding credentials ℂ.(i)
SSO.,.: at most oE times, AI can arbitrarily choose a message M and make a query for a ciphertext C. SSO responses with the result of the SCrypt algorithm generating a ciphertext C corresponding to a message M, pkTA, pkE, and LP.Algorithm 2: Algorithm for indistinguishability experiment ExptAI,ΣIND−CPAb.
Input: A security parameterk and a random bit bOutput: The success of the attack.(1)
Setup parameters:(2)
param←$Setup1k(3)
pkTA,skTA←$TKeyGenparam(4)
pkE,skE←$SKeyGenparam,pkTA(5)
Phase I: learningst,M0,M1,LP←$AISSO.,VCO.stC,pkTA,pkE,param;(6)
Prechallenge:Ifb=0, thenC←$SCryptparam,M0,skE,pkE,pkTA,LP(7)
else,C←$SCryptparam,M1,skE,pkE,pkTA,LPend(8)
Phase II: challengingd←$AIVCO.guess,st,M0,M1,LP,CIfvcoL:L>=minLP and ssoMb,L have never been executed, then(9)
Ifd=b, then return 1else return0elsereturn⊥endFormalisation of indistinguishability under the adaptive chosen plaintext attack model of an LBS scheme is described as follows. The experiment that is associated with an adversaryAI of a level-based signcryption scheme is illustrated in Algorithm 2. AI has two functions that are stC stage and guess stage. Using an adaptive strategy, in the stC stage, AI arbitrarily chooses a message and makes queries to the signing oracle SSO.,. and the credential oracle VCO.. The query processes are allowed repeatedly according to AI’s strategies. AI outputs two messages M0,M1, a level-based security policy LP and some state information st used in the guess state at the end of the stage. Based on a previously set bit b, the experiment runs SCrypt with a message Mb as an input and outputs a valid level-based ciphertext C. In the second stage (Phase 2), AI takes M0,M1,LP,st,C as input and outputs a guess bit (1 or 0). Note that AI still can make queries to the VCO oracle before outputting a guess, and if the following conditions are not satisfied, the experiment will be aborted.(1)
AI never issues a query for a level-based ciphertext with LP and M as input to the SSO oracle(2)
With a restriction thatLP=“L≥l”, AI can only make a request for credentials with a security level L<l to the VCO oracleLetADVIND−CPA. be the success probability of AI breaking the indistinguishability under the adaptive chosen plaintext attack in the selective-credential exposed model of an LBS scheme.Definition 4.
An LBS scheme ist,oE,oC,ϵ-secure indistinguishability under a chosen plaintext attack in the selective-credential exposed model if the PPT distinguisher AI success in the attack with a nonnegligible (within k) probability(12)ADVIND−CPAk=PrExptAI,ΣIND−CPA0k−PrExptAI,ΣIND−CPA0k=ϵ,does not exist. Note that AI runs at most t times and makes at most oE signcryption queries and oC credential queries.


## 3.2.2. Chosen Ciphertext Attack (IND-CCA)

Before formalising this attack, we first give some definitions and outline the oracles. LetIND−CPA be indistinguishability under a chosen plaintext attack in the selective-credential exposed model. The signing oracle SSO, credential generator oracle VCO, and unsigncryption oracle USO are used to describe the abilities of AC breaking IND−CPA of an LBS scheme. The SSO and VCO oracles have been depicted in Section 3.2.1. The USO oracle, however, is described as follows.USO.,.: with a ciphertext C and a level-based security policy LP as input, AI can request up to oD queries for the decryption and verification of a ciphertext C. USO returns a decisional result d that is either reject regrading the authenticity of ciphertext C or a message M.Algorithm 3: Algorithm for indistinguishability experiment under CCA attack ExptAI,ΣIND−CCAb.
Input: a security parameterk and a random bit bOutput: the success of the attack.Setup parameters: the setup process is same with Algorithm 2.Phase I: learningst,M0,M1,LP←$AISSO.,VCO.,USO.stC,pkTA,pkE,paramPrechallenge: the prechallenge process is same with Algorithm 2.(1)
Phase II: challengingd←$AISSO.,VCO.,USO.guess,st,M0,M1,LP,C ifvcoL:L>=minLP andSSOMb,L andUSOC,. have never been executed, thenIfd=b, then return 1else return0elsereturn⊥endFormalisation of indistinguishability under the adaptive chosen ciphertext attack model of an LBS scheme is described as follows. The experiment in Algorithm 3 depicts an adversaryAI of a level-based signcryption scheme. There are two functions that are a stC stage and a guess stage, which AI can execute. In the first stage, AI, with some elastic and pliable strategies, chooses a message and issues a request to the credential queries VCO., the signing queries SSO.,., and the unsigncryption queries USO.,.. The query processes are allowed repeatedly according to AI’s strategies. AI outputs two messages M0,M1, a level-based security policy LP, and some state information st used in the guess state at the end of the stage. The experiment runs SCrypt with a message Mb as an input and outputs a valid level-based ciphertext C. In the guess stage (Phase 2), AI takes M0,M1,LP,st,C as input and outputs a guess bit (1 or 0). Note that AI can still make queries to VCO and USO oracles before outputting a guess. However, if the following conditions are not satisfied, the experiment will be aborted.(1)
AI never issues a query for a level-based ciphertext with LP and M0 or M1 as input to the SSO oracle(2)
AI never issues a query with C as input to the USO oracle(3)
With a restriction thatLP=″L≥l″, AI can only make a request for credentials with a security level L<l to the VCO oracleLetADVIND−CCA. be the success probability of AI breaking indistinguishability under the adaptive chosen ciphertext attack in the selective-credential exposed model of an LBS scheme.Definition 5.
An LBS scheme ist,oE,oC,oD,ϵ-secure indistinguishability of ciphertext under a chosen ciphertext attack in the selective-credential exposed model if a distinguisher AI success in the attack with a nonnegligible (within k) probability(13)ADVIND−CCAk=PrExptAI,ΣIND−CCA0k−PrExptAI,ΣIND−CCA1k=ϵ,does not exist. Note that AI runs at most t times and makes at most oE signcryption queries, oC credential queries, and oD unsigncryption queries.


## 4. The Level-Based Signcryption (LBS) Scheme

In this section, we present our concrete construction of the LBS scheme. The scheme is described as follows.Setup: with ℓ as the input, Setup randomly selects a prime p≈poly1ℓ. Setup select three groups G1, G1, and GT of the prime order p. Setup constructs a bilinear mapping function e^ that maps G1 and G2 to GT. The above mapping function is defined as e^:G1×G2⟶GT. Choose a random generator g∈G1, o∈G2. Construct a hash function h., such that h:0,1∗⟶ℤp. Finally, the system parameter param is composed of p,e^,g,o,h. param is returned as a response of the queries.TKeyGen: the total security level is denoted by n. Given param as input, TKeyGen computes a private key skTA and a public key pkTA randomly for each security level as follows: choose random integers μ0,…μn,γ0,…,γn,a,b∈ℤp. Let(14)pkTA=U1=oμ1⋅a,…Un=oμn⋅a,V0=gγ0,…,Vn=gγn,W1=g∑i=1nγ1⋅μi⋅a+γ0⋅μ0⋅a+b,…,Wn=gγn⋅μn⋅a+γ0⋅μ0⋅a+b.denote a public key. Then,TKeyGen returns skTA=μ0,…,μn,γ0,…,γn,a,b, as the trusted authority’s private key and pkTA=U,V,W as the trusted authority’s public key. Note that U, V, and W are the symbols that represent the set of vectors U1,…,Un, V0,…,Vn, and W1,…,Wn, respectively.SKeyGen: on input of a system parameter param and a public key of the trusted authority, SKeyGen randomly generates a private key skE and a public key pkE as follows: first, choose a random integer x∈ℤp. Let X=X0=V0x,…,Xn=Vnx. Let skE=x be the signer’s private key and pkE=X be the signer’s public key. At the end, SKeyGen outputs skE,pkE.CreGen: LL denotes a list that contains the generated credentials. A security level of a verifier, for example, L= ‘D″ or “5” is denoted by L. Given param, skTA, pkTA, and L=l, CreGen randomly generates a credential cskE with the following processes. CreGen arbitrary chooses ν0∈ℤp∗:ν0∉LL. Then, CreGen generates a credential at a security level of L=l by computed νl=γ0⋅μ0+γl⋅μl⋅a+b−ν0⋅γ0/γl;C0=oν0;Cl=oνl. CreGen stores ℂV=C0,Cl in LL and returns ℂV as a credential of L=l to the verifier.SCrypt: given param, pkTA, skE, pkE, LP=“L≥l” and a message M, an encryptor E computes a ciphertext C as follows:(15)r←$ℤp,R=e^Wl,or,σ1=hRpkEpkTALPσ3,σ2=oσ1⋅x+r,σ3=R⊕M.The level-based ciphertext isC=σ1,σ2,σ3. S publishes σ,LP.USCrypt: a receiver D possesses a credential L=k, where k≥l. Given pkE, pkTA, ℂ, LP=“L≥l”, σ decrypt C as follows:(1)
Compute(16)R=e^Wl,σ2⋅e^X0,C0−σ1⋅e^Xk,Ck−σ1∏i=l;i≠kne^Xi,Ui−σ1.(2)
Check whether or not the following equation holds.(17)σ1=?hRpkEpkTALPσ3.(3)
If the equation in (1) holds, then decrypt the ciphertext as follows.(18)M=σ3⊕R.SCOP: in optional privacy, the security policy needs to be set to the lowest level to cover all possible users, since the ciphertext is intended for a single receiver R or a group with a shared secret key. Given param, pkTA, skE, pkE, pkR, ℂE, LP=“L≥1”, and a message M, an encryptor E who possesses a credential for a security level assertion L=k, where k≥1, computes a ciphertext C as follows:(19)r⟵$ℤp,R=e^Wl,orR^=e^XR,0,CE,0⋅e^XR,k,CE,k∏i=1;i≠kne^XR,i,Uihσ3σ3=R⊕M,R¯=XR,0xE⋅hσ3σ1=hR^R¯RpkEpkRpkTALPσ3σ2=oσ1⋅x+r.The level-based ciphertext isC=σ1,σ2,σ3. S publishes σ,LP.USCOP: a receiver D who possesses a credential for a security level assertion L=k, where k≥l. Given skR,pkE, pkTA, ℂR, LP=“L≥l”, σ decrypts C as follows:(1)
Compute(20)R=e^Wl,σ2⋅e^XR,0,CR,0−σ1⋅e^XR,k,CR,k−σ1∏i=l;i≠kne^Xi,Ui−σ1,R¯=XE,0xR⋅hσ3,R^=e^XE,0,CR,0⋅e^XE,k,CR,k∏i=1;i≠kne^XE,i,Uihσ3.(2)
Check whether or not the following equation holds.(21)σ1=?hR^R¯RpkEpkRpkTALPσ3.(3)
If the equation in (1) holds, then decrypt the ciphertext as follows.(22)M=σ3⊕R.Note thate^Wl,o, e^XR,0,CR,0, e^XR,k,CR,k, e^XR,i,Ui, e^XR,0,CE,0,e^XR,k,CE,k, and e^XR,i,Ui are precomputed and can be reused in the signcryption or signcryption process of other signcryption. Hence, only one pairing computation is needed in the unsigncryption algorithm. The optional privacy process has similar computation costs, where the computation of the bilinear paring component in R,R^, and R¯ can be precomputed once and saved or reused later.


### 4.1. Completeness

The signcryption and unsigncryption algorithms can be verified its completeness with the following equations.(23)Generated by the sender=generated by the receivere^Wl,or=∏i=l;i≠kne^gγi⋅x,oμi⋅a−σ1=e^Wl,or⋅e^Wl,oσ1⋅x⋅e^g,oγ0⋅ν0⋅e^g,oγ0⋅μ0+γk⋅μk⋅a+b−ν0⋅γ0=e^Wl,oσ1⋅x+r⋅e^gγ0⋅x,oν0−σ1⋅e^gγk⋅x,oγ0⋅μ0+γk⋅μk⋅a+b−ν0⋅γ0/γk−σ1=e^Wl,σ2⋅e^X0,C0−σ1⋅e^Xk,Ck−σ1∏i=l;i≠kne^Xi,Ui−σ1⋅e^g,o∑i=l;i≠knγi⋅μi⋅a−σ1⋅x=e^Wl,or⋅e^g∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+b,oσ1⋅x⋅e^g,o−σ1⋅x⋅∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+b.e^Wl,or=e^Wl,or.


### 4.2. Unforgeability

Theorem 1.
Under the adaptive chosen message and credential exposure attack model, the level-based signcryption scheme is existentially unforgeable if and only if the CDH assumption is intact under the random oracle model.Proof.
We start with the assumption that a forger algorithmAU that can win the existential unforgeability model described in Section 3.1 exists. Using this AU, we can construct an adversary algorithm ℱ to break the CDH problem.
We now begin with the construction of oracles. First, on inputg1, g1x, and g1y as an instance of the CDH problem, ℱ runs Setup, sets g=g1,o=g1y, and obtains param=p,e^,g,o,h. ℱ then runs TKeyGen to obtain TA’s public-private keys and sets X=X0=g1x⋅γ0,…,Xn=g1x⋅γn as the signer’s public key pkE. The following algorithms are the construction of queries that are later used in the simulation.
HO oracle: given a string Γ as input, if it is a request for a hash value of hΓ, HO checks whether or not Γ is in the queried list. If it exists in the list, then return the corresponding value; otherwise, HO randomly chooses ι←$ℤp and then returns hΓ=ι. Note that HO keeps Γ,ι in the list, and this list can only be accessed by ℱ.
VCO queries: given skTA as input, VCO executes CreGen for the credential VCR, where L=l. VCO outputs VCR.
SSO queries: given “LP=L≥l” and a message M as input, SSO generated a level-based signcryption with the following equations.(24)r,ι1,ι2←$ℤp,K←$GT,R=e^Wlx,oι1e^Wl,or:Wlx=g1x∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+b,σ1=hRpkEpkTALPσ3=ι1,σ2=or,σ3=R⊕M,Γ=RpkEpkTALPσ3.
Note thatSSO has access to the list Γ,ι via ℱ. SSO uses this advantage to update Γ,ι to the list in HO. SSO then responds with C=σ1,σ2,σ3.
Optional privacy: letXR=XR,0=g1xR⋅γ0,…,XR,n=g1xR⋅γn as the receiver’s public key pkR. SSO generated a level-based signcryption with the following equations.(25)r,ι1,ι2,ι3←$ℤp,K←$GTR=e^Wlx,oι1e^Wl,or:Wlx=g1x∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+bR^=e^W1x,ohσ3hσ3=ι3σ1=hR^R¯RpkEpkRpkTALPσ3=ι1σ2=or,σ3=R⊕MΓ=R^R¯RpkEpkRpkTALPσ3.
Note thatR¯ does not need to be computed. It only needs to be verified by the following equation when AU submits the query of the hash value for σ1.(26)e^R¯,g=?e^XR,0,XE,0ι3.
If it matches withXR,0 in the list of verifier public key and the list of queried ciphertext, it then returns the corresponding result. Otherwise, it returns the new ι1.
We start the simulation by allowingAU to access the above queries. In fact, AU always issues a request of query to HO queries before outputting the forgery. Let us denote this potential forgery by M∗,C∗,LP∗. With any adaptive strategy, AU interacts with the simulator and eventually outputs a forgery.
AU successfully completes the challenge, if, with a message M∗ and LP∗ as input, AU generates a valid signcryption C∗. Note that this forgery should not be a result of SSO queries.
The success probabilityADVEUF−CMCEA. of AU winning the simulation is denoted by ϵ. Let the base of the natural logarithm be denoted by e. In the random oracle, the input of every query made for a signcryption is a result of a query to HO oracle. Hence, qH≥qS. Let solve the CHD problem using the forgery generated by AU. The forking technique in [45, 46] is applied in the following technique for the probability analysis.
First, a signcryptionC∗ on message M∗ where σ1∗=hΓ∗=ι∗ is obtained in the first round.
Then,ℱ resets AU to the initial state and repeats the above simulation again. Note that in the second simulation, AU uses a different hash value σ1′=hΓ∗=ι′.
Therefore,AU eventually should generate another signcryption C′ on message M∗ where hΓ∗=ι′.
With these two signcryptions,ℱ computes(27)σ2∗σ2′1/σ1∗−σ1′=oσ1∗⋅x+roσ1′⋅x+r1/σ1∗−σ1′=g1yι∗⋅x+rg1yι′⋅x+r1/ι∗−ι′=g1yι∗⋅x+r−ι′⋅x−r1/ι∗−ι′=g1y⋅xι∗−ι′1/ι∗−ι′=g1y⋅x.
ϵ′ is defined as the success probability ADVCDH. that ℱ solves the CDH problem. We base this on the forking lemma theorem in [45, 46] and obtain the success probability that ℱ uses AU to solve the CDH problem as follows:(28)ϵ′≥frk≥accaccqH−12lfrk≥ϵϵqH−12lfrk≥ϵ2qH−ϵ2lfrk>ϵ2qHϵ′>ϵ2qH∴ϵ<qHϵ′.
Note thatacc=ϵ, since the simulation behaves naturally, and it does not need to abort the experiment in any event. ϵ/2l is omitted since it is negligible. To summarise the probability, AU wins the above game and outputs a signcryption C∗ on a message M∗ with a probability less than qHϵ′. Therefore, the results of the above probability analysis lead us to conclude that the success of breaking the existential unforgeability of the LBS scheme is nonnegligible due to the probability of breaking the CDH problems that are nonnegligible in the random oracle model.


### 4.3. Indistinguishability

Theorem 2.
Against the adaptive chosen ciphertext distinguisherAI in the selective-credential exposed attack model, the cyphertext of the level-based signcryption scheme is existentially indistinguishable if CDH and DBDH assumptions hold in the random oracle model.Proof.
Let us assume that an adversaryAI exists. It runs the existentially indistinguishable game defined in Section 3.2. Then, it successfully outputs a correct guess. We will demonstrate that we can use an adversary ℱ to output a solution to the DBDH problem by using AI as a tool. Given g, gx, gy, gz, and Z as an instance of the DBDH problem, ℱ runs setup and sets g=g,o=gy and obtains param=p,e^,g,o,h.
ℱ assigns b=z and runs TKeyGen to obtain TA’s public-private keys. ℱ also sets x=x and runs SKeyGen to obtain the signer’s public key pkE. Assume that there exists an algorithm managing the list of each query, and such algorithms will be omitted. ℱ builds the queries in the following functions.
HO oracle: given a string Γ as input, HO checks whether or not Γ is in the queried list for a hash value request of hΓ. If it exists in the list, then return the corresponding value; otherwise, HO randomly chooses ι←$ℤp and then returns hΓ=ι. Note that HO keeps Γ,ι in the list and only ℱ can access the list.
VCO queries: ℱ randomly chooses an integer d←$ℤn+1∗. On input L=l, if l≥d, then output ⊥. Otherwise, VCO randomly chooses the integer kc∈ℤp, if kc has yet to be selected. ℂV is computed as follows:(29)k1←$ℤp:k1=k2+kcC0=ok2,Cl=oγ0⋅μ0+γl⋅μl⋅a+k1−k2⋅γ0/γl.
VCO then returns ℂV=C0,Cl.
SSO queries: let Lsso be the list that stores generated signcryption. On input LP=“L≥l” and a message M, if l≥d, then output ⊥. Otherwise, SSO generates a level-based signcryption ciphertext with the following algorithms.(30)r,ι←$ℤp,R=e^Wl,or⋅e^X0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^Xi,Uiι:σ1=hRpkEpkTALPσ3=ι,σ2=or,σ3=R⊕M,Γ1=RpkEpkTALPσ3.
Note thatSSO has an access to the list of Γ,ι via ℱ. SSO uses this advantage to update Γ,ι to the list in HO. SSO then responds with C=σ1,σ2,σ3 and keeps C,M in Lsso.
Optional privacy: letXR=XR,0=g1xR⋅γ0,…,XR,n=g1xR⋅γn be the receiver’s public key pkR and XE=XE,0=X0,…,XE,n=Xn be the sender’s public key pkE. SSO generates a level-based signcryption with the following algorithms.(31)r,ι,ι¯←$ℤp,R=e^Wl,or⋅e^XE,0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^XE,i,Uiι,R^=e^XR,0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^XR,i,Uiι¯,hσ3=ι¯,σ1=hR^R¯RpkEpkRpkTALPσ3=ι,σ2=or,σ3=R⊕M,Γ1=R^R¯RpkEpkRpkTALPσ3.
Note thatR¯ does not need to be computed. It only needs to be verified by the following equation when AU submits the query of the hash value for σ1.(32)e^R¯,g=?e^XR,0,XE,0ι¯.
If it matches withXR,0 in the list of verifier public key and the list of queried ciphertext, it then returns the corresponding result. Otherwise, it returns the new ι1.
USO queries: on input M,C, and LP=“L≥l”, if C∈Lsso, then USO responses with M from the corresponding C in the list. Otherwise, USO responses with “reject.” Note that this setting is based on the assumption that the unforgeability of LBS holds. Hence, all signcryption ciphertexts that are not generated by SSO are all invalid signcryption ciphertexts. If the adversary aborts, due to an unnatural simulation, we can then use this adversary to run the unforgeability simulation to solve the CDH problem.
At the beginning of a game,AI is given access to the above oracles. Next, we run the simulation between AI and ℱ as modelled in Section 3.2:(1)
Phase 1:AI with adaptive strategy makes queries to SSO, VCO, and USO oracles. The oracles responses are as we previously described.(2)
Challenge: at the end of the first phase,AI decides to challenge and outputs M0,M1, and LP∗. ℱ aborts the game if(1)
On inputM0,M1, and LP∗, AI makes a query for a level-based signcryption ciphertext to SSO queries(2)
AI has a credential that is equal or higher than the security level assigned in the level-based security policy LP∗Otherwise,ℱ selects a random bit b∗∈0,1 and computes a response as follows:(33)r,ι∗=←$ℤp,R=Zι∗⋅e^Wl,or⋅e^X0,oμ0⋅aι∗∏i=lne^Xi,Uiι∗:σ2∗=or,σ3∗=R⊕Mb∗,σ1∗=hRpkEpkTALP∗σ3∗=ι∗,Γ∗=RpkEpkTALP∗σ3∗.Note thatℱ has access to the list Γ∗,ι∗. ℱ uses this advantage to update Γ∗,ι∗ to the list in HO. ℱ then responds with C∗=σ1∗,σ2∗,σ3∗ to AI.Optional privacy: letXR=XR,0=g1xR⋅γ0,…,XR,n=g1xR⋅γn be the receiver’s public key pkR and XE=XE,0=X0,…XE,n=Xn be the sender’s public key pkE. ℱ computes the challenge ciphertext as follows:(34)r,ι∗,ι¯∗←$ℤp,R=Zι∗⋅e^Wl,or⋅e^XE,0,oμ0⋅aι∗∏i=lne^XE,i,Uiι∗:R^=e^XR,0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^XR,i,Uiι¯∗,hσ3∗=ι¯∗,σ1∗=hR^R¯RpkEpkRpkTALPσ3=ι∗,σ2∗=or,σ3∗=R⊕Mb∗,Γ∗=R^R¯RpkEpkRpkTALPσ3∗.Note thatR¯ does not need to be computed or it can be obtained from the previous queries by computing R¯=R¯′ι¯∗/ι¯′. It only needs to be verified by the following equation when AU submits the query of the hash value for σ1.(35)e^R¯,g=?e^XR,0,XE,0ι¯∗.If it matches withXR,0 in the list of verifier public key and the list of queried ciphertext, it then returns the corresponding result. Otherwise, it returns the new ι1.(3)
Phase 2: in this phase,AI can go back to Phase 1 as many as it requires. However, ℱ will abort the game if(1)
On inputM0,M1, and LP∗, AI issues a request for a level-based signcryption ciphertext to SSO queries(2)
On inputC∗ and LP∗, AC issues a request for an unsigncryption query to USO(3)
AI has a credential that is equal or higher than the security level assigned to the level-based security policy LP∗(4)
Guessing: on the valid challengeM0,M1,LP∗,C∗, AI finally outputs a guess b′
LetADVIND−CCA=ϵ be an advantage probability that AI wins the challenge in the above simulation. A upper bound of queries in polynomial time that AI request a hash value to the HO oracle is denoted as q. Note that q≥qH and q≪p. Since only ℱ and SSO access HO before it outputs a response, we can conclude that qH≥qS. Therefore, we can analyze the advantage that AI’s guess is correct and wins the above game as follows:(i)
E1: during the request of queries to VCO, ℱ did not abort. Let qVC be the highest security level that AI issues to the VCO oracle, rather than the number of queries that it makes to the VCO oracle. Since AI can only make one query for the security level L=n−1, AI can use this credential to verify and decrypt ciphertexts with the entire security level except for the security level n. Note that d is a random integer chosen at the beginning of the game and n is the upper bound of the security level. The fact is that AI can make a request for credentials, up to the security level qVC=n−1, to the VCO oracle, and the value of d is in range of 1,…,n. However, if qVC≥d, then VCO will always terminate the experiment. Otherwise, qVC<d, and VCO will not terminate the experiment. To choose qVC and d randomly, the probability that AI chooses qVC is 1/n and the probability that ℱ chooses d is 1/n Therefore, the probability of this event is 1/n2.(ii)
E2: after the request of queries to USO, AI did not abort. Let ϵ^ be the success probability of solving the CDH problem. Since the probability of AI breaking unforgeability is equal to ϵ^, the probability of this event is more than 1−qHϵ^.(iii)
E3: after Phase 1 and Phase 2, ℱ did not abort. Since we have assumed that AI follows the experiment and outputs a guess with a valid challenge LP∗,C∗, the probability of this event is 1.
The advantage thatAI successfully completes the challenge in the above simulation and generates a right educational guess b′=b is PrADVIND−CCA⋅PrADVIND−CCAE1E2E3≥ϵ⋅1−qHϵ^1/n2.
Let an advantage probability in solving the DBDH problem be denoted byϵ′. ℱ is using AI’s guess to answer the DBDH problem. Due to the condition that AI can choose a challenge level-based security policy LP∗, AI cannot have the credential above the security level in the challenge level-based security policy LP∗. Hence, there is an event where AI’s guess in the game is not the right guess for the DBDH problem, where LP∗≠“L≥d”. This event probability is 1/n. To conclude, the advantage probability of ℱ using AI to produce a correct solution for the DBDH problem is ϵ′≥ϵ⋅1−qHϵ^⋅1/n2⋅1/n=ϵ⋅1/n3. Against the adaptive chosen message and selective-credential exposure attack model, the advantage probability of AI breaking the existential indistinguishability of the LBS scheme is ϵ≤n3ϵ′/1−qHϵ^. Note that n≪qH≪q. Therefore, the results of the above probability analysis lead us to conclude that the success of breaking the existential indistinguishability of the LBS scheme is nonnegligible due to the probability of breaking the CDH and DBDH problems is nonnegligible in the random oracle model.


## 4.1. Completeness

The signcryption and unsigncryption algorithms can be verified its completeness with the following equations.(23)Generated by the sender=generated by the receivere^Wl,or=∏i=l;i≠kne^gγi⋅x,oμi⋅a−σ1=e^Wl,or⋅e^Wl,oσ1⋅x⋅e^g,oγ0⋅ν0⋅e^g,oγ0⋅μ0+γk⋅μk⋅a+b−ν0⋅γ0=e^Wl,oσ1⋅x+r⋅e^gγ0⋅x,oν0−σ1⋅e^gγk⋅x,oγ0⋅μ0+γk⋅μk⋅a+b−ν0⋅γ0/γk−σ1=e^Wl,σ2⋅e^X0,C0−σ1⋅e^Xk,Ck−σ1∏i=l;i≠kne^Xi,Ui−σ1⋅e^g,o∑i=l;i≠knγi⋅μi⋅a−σ1⋅x=e^Wl,or⋅e^g∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+b,oσ1⋅x⋅e^g,o−σ1⋅x⋅∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+b.e^Wl,or=e^Wl,or.


## 4.2. Unforgeability

Theorem 1.
Under the adaptive chosen message and credential exposure attack model, the level-based signcryption scheme is existentially unforgeable if and only if the CDH assumption is intact under the random oracle model.Proof.
We start with the assumption that a forger algorithmAU that can win the existential unforgeability model described in Section 3.1 exists. Using this AU, we can construct an adversary algorithm ℱ to break the CDH problem.
We now begin with the construction of oracles. First, on inputg1, g1x, and g1y as an instance of the CDH problem, ℱ runs Setup, sets g=g1,o=g1y, and obtains param=p,e^,g,o,h. ℱ then runs TKeyGen to obtain TA’s public-private keys and sets X=X0=g1x⋅γ0,…,Xn=g1x⋅γn as the signer’s public key pkE. The following algorithms are the construction of queries that are later used in the simulation.
HO oracle: given a string Γ as input, if it is a request for a hash value of hΓ, HO checks whether or not Γ is in the queried list. If it exists in the list, then return the corresponding value; otherwise, HO randomly chooses ι←$ℤp and then returns hΓ=ι. Note that HO keeps Γ,ι in the list, and this list can only be accessed by ℱ.
VCO queries: given skTA as input, VCO executes CreGen for the credential VCR, where L=l. VCO outputs VCR.
SSO queries: given “LP=L≥l” and a message M as input, SSO generated a level-based signcryption with the following equations.(24)r,ι1,ι2←$ℤp,K←$GT,R=e^Wlx,oι1e^Wl,or:Wlx=g1x∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+b,σ1=hRpkEpkTALPσ3=ι1,σ2=or,σ3=R⊕M,Γ=RpkEpkTALPσ3.
Note thatSSO has access to the list Γ,ι via ℱ. SSO uses this advantage to update Γ,ι to the list in HO. SSO then responds with C=σ1,σ2,σ3.
Optional privacy: letXR=XR,0=g1xR⋅γ0,…,XR,n=g1xR⋅γn as the receiver’s public key pkR. SSO generated a level-based signcryption with the following equations.(25)r,ι1,ι2,ι3←$ℤp,K←$GTR=e^Wlx,oι1e^Wl,or:Wlx=g1x∑i=lnγi⋅μi⋅a+γ0⋅μ0⋅a+bR^=e^W1x,ohσ3hσ3=ι3σ1=hR^R¯RpkEpkRpkTALPσ3=ι1σ2=or,σ3=R⊕MΓ=R^R¯RpkEpkRpkTALPσ3.
Note thatR¯ does not need to be computed. It only needs to be verified by the following equation when AU submits the query of the hash value for σ1.(26)e^R¯,g=?e^XR,0,XE,0ι3.
If it matches withXR,0 in the list of verifier public key and the list of queried ciphertext, it then returns the corresponding result. Otherwise, it returns the new ι1.
We start the simulation by allowingAU to access the above queries. In fact, AU always issues a request of query to HO queries before outputting the forgery. Let us denote this potential forgery by M∗,C∗,LP∗. With any adaptive strategy, AU interacts with the simulator and eventually outputs a forgery.
AU successfully completes the challenge, if, with a message M∗ and LP∗ as input, AU generates a valid signcryption C∗. Note that this forgery should not be a result of SSO queries.
The success probabilityADVEUF−CMCEA. of AU winning the simulation is denoted by ϵ. Let the base of the natural logarithm be denoted by e. In the random oracle, the input of every query made for a signcryption is a result of a query to HO oracle. Hence, qH≥qS. Let solve the CHD problem using the forgery generated by AU. The forking technique in [45, 46] is applied in the following technique for the probability analysis.
First, a signcryptionC∗ on message M∗ where σ1∗=hΓ∗=ι∗ is obtained in the first round.
Then,ℱ resets AU to the initial state and repeats the above simulation again. Note that in the second simulation, AU uses a different hash value σ1′=hΓ∗=ι′.
Therefore,AU eventually should generate another signcryption C′ on message M∗ where hΓ∗=ι′.
With these two signcryptions,ℱ computes(27)σ2∗σ2′1/σ1∗−σ1′=oσ1∗⋅x+roσ1′⋅x+r1/σ1∗−σ1′=g1yι∗⋅x+rg1yι′⋅x+r1/ι∗−ι′=g1yι∗⋅x+r−ι′⋅x−r1/ι∗−ι′=g1y⋅xι∗−ι′1/ι∗−ι′=g1y⋅x.
ϵ′ is defined as the success probability ADVCDH. that ℱ solves the CDH problem. We base this on the forking lemma theorem in [45, 46] and obtain the success probability that ℱ uses AU to solve the CDH problem as follows:(28)ϵ′≥frk≥accaccqH−12lfrk≥ϵϵqH−12lfrk≥ϵ2qH−ϵ2lfrk>ϵ2qHϵ′>ϵ2qH∴ϵ<qHϵ′.
Note thatacc=ϵ, since the simulation behaves naturally, and it does not need to abort the experiment in any event. ϵ/2l is omitted since it is negligible. To summarise the probability, AU wins the above game and outputs a signcryption C∗ on a message M∗ with a probability less than qHϵ′. Therefore, the results of the above probability analysis lead us to conclude that the success of breaking the existential unforgeability of the LBS scheme is nonnegligible due to the probability of breaking the CDH problems that are nonnegligible in the random oracle model.


## 4.3. Indistinguishability

Theorem 2.
Against the adaptive chosen ciphertext distinguisherAI in the selective-credential exposed attack model, the cyphertext of the level-based signcryption scheme is existentially indistinguishable if CDH and DBDH assumptions hold in the random oracle model.Proof.
Let us assume that an adversaryAI exists. It runs the existentially indistinguishable game defined in Section 3.2. Then, it successfully outputs a correct guess. We will demonstrate that we can use an adversary ℱ to output a solution to the DBDH problem by using AI as a tool. Given g, gx, gy, gz, and Z as an instance of the DBDH problem, ℱ runs setup and sets g=g,o=gy and obtains param=p,e^,g,o,h.
ℱ assigns b=z and runs TKeyGen to obtain TA’s public-private keys. ℱ also sets x=x and runs SKeyGen to obtain the signer’s public key pkE. Assume that there exists an algorithm managing the list of each query, and such algorithms will be omitted. ℱ builds the queries in the following functions.
HO oracle: given a string Γ as input, HO checks whether or not Γ is in the queried list for a hash value request of hΓ. If it exists in the list, then return the corresponding value; otherwise, HO randomly chooses ι←$ℤp and then returns hΓ=ι. Note that HO keeps Γ,ι in the list and only ℱ can access the list.
VCO queries: ℱ randomly chooses an integer d←$ℤn+1∗. On input L=l, if l≥d, then output ⊥. Otherwise, VCO randomly chooses the integer kc∈ℤp, if kc has yet to be selected. ℂV is computed as follows:(29)k1←$ℤp:k1=k2+kcC0=ok2,Cl=oγ0⋅μ0+γl⋅μl⋅a+k1−k2⋅γ0/γl.
VCO then returns ℂV=C0,Cl.
SSO queries: let Lsso be the list that stores generated signcryption. On input LP=“L≥l” and a message M, if l≥d, then output ⊥. Otherwise, SSO generates a level-based signcryption ciphertext with the following algorithms.(30)r,ι←$ℤp,R=e^Wl,or⋅e^X0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^Xi,Uiι:σ1=hRpkEpkTALPσ3=ι,σ2=or,σ3=R⊕M,Γ1=RpkEpkTALPσ3.
Note thatSSO has an access to the list of Γ,ι via ℱ. SSO uses this advantage to update Γ,ι to the list in HO. SSO then responds with C=σ1,σ2,σ3 and keeps C,M in Lsso.
Optional privacy: letXR=XR,0=g1xR⋅γ0,…,XR,n=g1xR⋅γn be the receiver’s public key pkR and XE=XE,0=X0,…,XE,n=Xn be the sender’s public key pkE. SSO generates a level-based signcryption with the following algorithms.(31)r,ι,ι¯←$ℤp,R=e^Wl,or⋅e^XE,0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^XE,i,Uiι,R^=e^XR,0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^XR,i,Uiι¯,hσ3=ι¯,σ1=hR^R¯RpkEpkRpkTALPσ3=ι,σ2=or,σ3=R⊕M,Γ1=R^R¯RpkEpkRpkTALPσ3.
Note thatR¯ does not need to be computed. It only needs to be verified by the following equation when AU submits the query of the hash value for σ1.(32)e^R¯,g=?e^XR,0,XE,0ι¯.
If it matches withXR,0 in the list of verifier public key and the list of queried ciphertext, it then returns the corresponding result. Otherwise, it returns the new ι1.
USO queries: on input M,C, and LP=“L≥l”, if C∈Lsso, then USO responses with M from the corresponding C in the list. Otherwise, USO responses with “reject.” Note that this setting is based on the assumption that the unforgeability of LBS holds. Hence, all signcryption ciphertexts that are not generated by SSO are all invalid signcryption ciphertexts. If the adversary aborts, due to an unnatural simulation, we can then use this adversary to run the unforgeability simulation to solve the CDH problem.
At the beginning of a game,AI is given access to the above oracles. Next, we run the simulation between AI and ℱ as modelled in Section 3.2:(1)
Phase 1:AI with adaptive strategy makes queries to SSO, VCO, and USO oracles. The oracles responses are as we previously described.(2)
Challenge: at the end of the first phase,AI decides to challenge and outputs M0,M1, and LP∗. ℱ aborts the game if(1)
On inputM0,M1, and LP∗, AI makes a query for a level-based signcryption ciphertext to SSO queries(2)
AI has a credential that is equal or higher than the security level assigned in the level-based security policy LP∗Otherwise,ℱ selects a random bit b∗∈0,1 and computes a response as follows:(33)r,ι∗=←$ℤp,R=Zι∗⋅e^Wl,or⋅e^X0,oμ0⋅aι∗∏i=lne^Xi,Uiι∗:σ2∗=or,σ3∗=R⊕Mb∗,σ1∗=hRpkEpkTALP∗σ3∗=ι∗,Γ∗=RpkEpkTALP∗σ3∗.Note thatℱ has access to the list Γ∗,ι∗. ℱ uses this advantage to update Γ∗,ι∗ to the list in HO. ℱ then responds with C∗=σ1∗,σ2∗,σ3∗ to AI.Optional privacy: letXR=XR,0=g1xR⋅γ0,…,XR,n=g1xR⋅γn be the receiver’s public key pkR and XE=XE,0=X0,…XE,n=Xn be the sender’s public key pkE. ℱ computes the challenge ciphertext as follows:(34)r,ι∗,ι¯∗←$ℤp,R=Zι∗⋅e^Wl,or⋅e^XE,0,oμ0⋅aι∗∏i=lne^XE,i,Uiι∗:R^=e^XR,0,oμ0⋅a+kc⋅γ0−1ι∏i=lne^XR,i,Uiι¯∗,hσ3∗=ι¯∗,σ1∗=hR^R¯RpkEpkRpkTALPσ3=ι∗,σ2∗=or,σ3∗=R⊕Mb∗,Γ∗=R^R¯RpkEpkRpkTALPσ3∗.Note thatR¯ does not need to be computed or it can be obtained from the previous queries by computing R¯=R¯′ι¯∗/ι¯′. It only needs to be verified by the following equation when AU submits the query of the hash value for σ1.(35)e^R¯,g=?e^XR,0,XE,0ι¯∗.If it matches withXR,0 in the list of verifier public key and the list of queried ciphertext, it then returns the corresponding result. Otherwise, it returns the new ι1.(3)
Phase 2: in this phase,AI can go back to Phase 1 as many as it requires. However, ℱ will abort the game if(1)
On inputM0,M1, and LP∗, AI issues a request for a level-based signcryption ciphertext to SSO queries(2)
On inputC∗ and LP∗, AC issues a request for an unsigncryption query to USO(3)
AI has a credential that is equal or higher than the security level assigned to the level-based security policy LP∗(4)
Guessing: on the valid challengeM0,M1,LP∗,C∗, AI finally outputs a guess b′
LetADVIND−CCA=ϵ be an advantage probability that AI wins the challenge in the above simulation. A upper bound of queries in polynomial time that AI request a hash value to the HO oracle is denoted as q. Note that q≥qH and q≪p. Since only ℱ and SSO access HO before it outputs a response, we can conclude that qH≥qS. Therefore, we can analyze the advantage that AI’s guess is correct and wins the above game as follows:(i)
E1: during the request of queries to VCO, ℱ did not abort. Let qVC be the highest security level that AI issues to the VCO oracle, rather than the number of queries that it makes to the VCO oracle. Since AI can only make one query for the security level L=n−1, AI can use this credential to verify and decrypt ciphertexts with the entire security level except for the security level n. Note that d is a random integer chosen at the beginning of the game and n is the upper bound of the security level. The fact is that AI can make a request for credentials, up to the security level qVC=n−1, to the VCO oracle, and the value of d is in range of 1,…,n. However, if qVC≥d, then VCO will always terminate the experiment. Otherwise, qVC<d, and VCO will not terminate the experiment. To choose qVC and d randomly, the probability that AI chooses qVC is 1/n and the probability that ℱ chooses d is 1/n Therefore, the probability of this event is 1/n2.(ii)
E2: after the request of queries to USO, AI did not abort. Let ϵ^ be the success probability of solving the CDH problem. Since the probability of AI breaking unforgeability is equal to ϵ^, the probability of this event is more than 1−qHϵ^.(iii)
E3: after Phase 1 and Phase 2, ℱ did not abort. Since we have assumed that AI follows the experiment and outputs a guess with a valid challenge LP∗,C∗, the probability of this event is 1.
The advantage thatAI successfully completes the challenge in the above simulation and generates a right educational guess b′=b is PrADVIND−CCA⋅PrADVIND−CCAE1E2E3≥ϵ⋅1−qHϵ^1/n2.
Let an advantage probability in solving the DBDH problem be denoted byϵ′. ℱ is using AI’s guess to answer the DBDH problem. Due to the condition that AI can choose a challenge level-based security policy LP∗, AI cannot have the credential above the security level in the challenge level-based security policy LP∗. Hence, there is an event where AI’s guess in the game is not the right guess for the DBDH problem, where LP∗≠“L≥d”. This event probability is 1/n. To conclude, the advantage probability of ℱ using AI to produce a correct solution for the DBDH problem is ϵ′≥ϵ⋅1−qHϵ^⋅1/n2⋅1/n=ϵ⋅1/n3. Against the adaptive chosen message and selective-credential exposure attack model, the advantage probability of AI breaking the existential indistinguishability of the LBS scheme is ϵ≤n3ϵ′/1−qHϵ^. Note that n≪qH≪q. Therefore, the results of the above probability analysis lead us to conclude that the success of breaking the existential indistinguishability of the LBS scheme is nonnegligible due to the probability of breaking the CDH and DBDH problems is nonnegligible in the random oracle model.


## 5. Theoretical Analysis

We introduced the notion of a level-based signcryption (LBS) scheme to capture the need for confidential and authenticated messages sent to a specific group of verifiers that satisfy the required security level. The LBS scheme has a short ciphertext, a constant credential size, and an efficient signcrypting algorithm. The encryption security of our LBS scheme is CCA-secure and relies on the CDH and DBDH assumptions.The communication and computation cost of our scheme and related schemes are compared, as given in Table2. l is denoted as a security level which is specified in the level-based security policy MP=“L≥l”. The total security levels or the total number of attributes are denoted by n, and let ln be the number of attribute specified in the policy.Table 2
Comparison cost with three ABE schemes.
Schemes/costCommunication (size)Computation (encryption)Computation (decryption)BSW07 [10]GT +2n+1G1h+M+2n+2E+P3n+2E+2n−1M+2n+1PRW15 [11]n+1GT +3nG1h+E+M+Pnh+nE+4nM+3nPYTC14 [12]n+2G1h+S+nMh+S+nMYLWXY20 [40]n+7G1+p2ln+2n+7E+S, +n+ln+9M+S3ln+13E+S+7P, +n+3ln+2MOur LBSG1+p+GTH+2E+P+11+H+n−l+2P+E+nMOur LBS with OPG1+p+GT1+2H+n−l+2P, +2E+nM1+2H+2n−l+2P+2E+2nMThe computation cost for the exponential in groupsG1 or GT is denoted by E, while the computation cost of the multiplication in groups G1 or GT is denoted by M. The computation cost for the bilinear pairing function is denoted as P. Computation for hash functions in Zp is denoted as H. A computation unit given in Table 2 is equivalent to the XOR operation’s computation. For lightweight cryptography, S denotes a unit of time used for computing a symmetric encryption scheme such as AES.We implemented our scheme based on the pairing-based cryptography (PBC) library. The comparison with the existing efficient schemes in PBC is shown in Figures2 and 3. Noted that, the results of some scheme may not be accurate due the original code not provided in the PBC library, Hence, only selected efficient ABE schemes in Table 2 are implemented. Moreover, from Table 2, our scheme’s ciphertext size is constant compared to other schemes, which increase due to the attributes.Figure 2
Signcryption ciphertext generation processing time. (a) Type A curve on Intel. (b) Type A curve on ARM. (c) Type A1 curve on Intel. (d) Type A1 curve on ARM.
(a)(b)(c)(d)Figure 3
Signcryption verification processing time. (a) Type A curve on Intel. (b) Type A curve on ARM. (c) Type A1 curve on Intel. (d) Type A1 curve on ARM.
(a)(b)(c)(d)The code was written in Python using the charm-crypto framework developed by Akinyele and others [48] for rapid cryptography development. The first experiment was conducted on an Intel 10th Gen Core i5-10400 with 6 cores and 12 threads configuration with 32 gigabytes of DDR4 memory. The operating system used in the experiment was Ubuntu 18.04. The results of this experiment are presented on the left side of each figure.The second experiment was conducted on a Raspberry Pi 4 Cortex-A72 (ARM v8) 64 bit SoC with a 1.5 GHz CPU clock speed, 4 cores, and 4 gigabytes of DDR4 memory. Raspbian was the operation system used in the second experiment. The results are presented on the right side of each figure.The experiments were executed with two different types of curves, namely, type A and type A1. Type A curve is a curve that produces the fastest bilinear pairing computation, and it achieves security comparable to 1024 bits of discrete logarithm (DLog) security. On the other hand, type A1 provides higher security, which is 2048 bits of DLog security. Comparison results using the type A and A1 curves are shown in Figures2 and 3. Meanwhile, our scheme’s performances for the rest of the results are quite good. Only the result where our scheme consumes more time than others is in the setup process. However, this is still acceptable for access control in VANETs.The parameters of these two curves are given in Table3. The experiment was conducted 500 times for each scheme to find the average time consumed in each computation process. The message used in the experiments was randomly generated in the GT domain. From the result in Figures 3 and 2, our scheme shows a significant boost in the encryption and verification in both curve types. Even when compared with a lightweight ABE scheme in [12], our scheme did not have much difference in the performance. Moreover, the size of our ciphertext is constant when the number of attributes increased. Meanwhile, the other schemes are linear to the number of attributes.Table 3
Curve type A and type A1 parameters used in PBC library [47].
Curve type AValueBase field size512 bitsK2DLog security1024Q878071079966331252243778198475404981 580688319941420821102865339926647563 088022295707862517942266222142315585 876958231745927771336731748132492512 9998224791H120160122648911460793888213667405342 048029544012513118229196151310472072 89359704531102844802183906537786776R730750818665451621361119245571504901 405976559617exp1107exp2159sign0 and sign11Curve type A1ValueBase field size512 bitsK2DLog security1024Q48512875896303752499712277254589628 51641935218829452119818956751100907 31581150453612948393470993158989600 45398524682007334164928531594799149 10054803644576011091315742065569036 18912908584413608071582472594605013 43449199712532828063940008683740048 50098044198971373968965561057845838 8126934242630557397618776539259L1304n (=r)36203638728584889925158415861634051 13165623297633919492402206530672318 89239664517621603278709696387305671 98058600508960697138006366861790409 77652838540728366486056523929529131 48442469092845976172822740742242547 33917313218308080644731349763985110 82162719551471174603705642580481969 2632040479575042834043863089


## 6. Conclusion

Privacy issues regarding information shared in organisations without an efficient and proper control mechanism have motivated us to provide a scheme to solve this. The notion of a level-based signcryption scheme provides simplicity, confidentiality, and privacy, enhancing secure communication in VANETs or any ad-hoc network that often needs to broadcast messages. With LBS, the communication among the VANET’s nodes, such as RSU nodes and vehicles, is now efficient, secure, and private. LBS ensure the confidentiality, authenticity, and data for RSU to securely broadcast message to nodes. On the other hand, the vehicle node can be confident that its message communicates with RSU that cannot be read by other nodes eventhough it sometimes needs to communicate with RSU via other nodes. Similar to WSN and IoT networks, LBS provides secure broadcast communication among IoT devices. The IoT node can choose to securely and privately communicate with its peer or have private communication with the primary access point units or any devices with a high-level policy setting such as the organisation’s server, workstation, or mobile.Moreover, the proposed scheme is an ideal tool for enabling access control systems or secure shared document systems for a large organisation where a hierarchical structure is applied. A file can be shared or transmitted to the same peer or higher-level security users via a broadcast channel. LBS scheme enables the above scenario securely. Even the message revel to the public, it will not be able to link the signer. In the event of credential disputes or discloses to others, our scheme did not provide a credential revocation mechanism. To resolve this issue, the system should resolve it without reissuing a new credential to other users. Our scheme can use the group key as a key to revoke the credential without affecting honest users. Nevertheless, this is not an ideal solution to this issue. Hence, this will be addressed in our future work.



---

*Source: 8736531-2022-03-29.xml*