# Multiaccess Edge Computing Empowered Flying Ad Hoc Networks with Secure Deployment Using Identity-Based Generalized Signcryption

Authors: Muhammad Asghar Khan; Insaf Ullah; Shibli Nisar; Fazal Noor; Ijaz Mansoor Qureshi; Fahimullah Khanzada; Hizbullah Khattak; Muhammad Adnan Aziz
Journal: Mobile Information Systems
 (2020)

---

## Abstract

A group of small UAVs can synergize to form a flying ad hoc network (FANET). The small UAVs are, typically, prone to security lapses because of limited onboard power, restricted computing ability, insufficient bandwidth, etc. Such limitations hinder the applicability of standard cryptographic techniques. Thus, assuring confidentiality and authentication on part of small UAV remains a far-fetched goal. We aim to address such an issue by proposing an identity-based generalized signcryption scheme. The lightweight security scheme employs multiaccess edge computing (MEC) whereby the primary UAV, as a MEC node, provides offloading to the computationally fragile member UAVs. The scheme is based on the concept of the hyperelliptic curve (HEC), which is characterized by a smaller key size and is, therefore, suitable for small UAVs. The scheme is robust since it offers confidentiality and authentication simultaneously as well as singly. Formal as well as informal security analyses and the validation results, using the Automated Validation for Internet Security Validation and Application (AVISPA) tool, second such notion. Comparative analysis with the existing schemes further authenticates the sturdiness of the proposed scheme. As a case study, the scheme is applied for monitoring crops in an agricultural field. It has been found out that the scheme promises higher security and incurs lower computational and communication costs.


---

## Body

## 1. Introduction

Unmanned Aerial Vehicles (UAVs) have earned recognition in multiple domains owing to their versatile applications for surveillance, agriculture, health services, traffic monitoring, inspection, public safety, etc. [1]. Multiple small UAVs, as a flying ad hoc network (FANET), can combine and accomplish the assigned tasks efficiently in an autonomous manner [2, 3]. In FANETs, small interconnected UAVs synergize and exchange data with one another and with the ground stations [4]. They are characterized by high mobility, easy deployment, and self-organizing behavior [5]. However, such distinctive features, for efficient and effective deployment, demand the compliance of stringent guidelines [6]. For instance, it is mandatory to assure security and Quality of Service (QoS) when choosing a FANET system for on-time data communication services. Moreover, the networks must deploy an efficient networking architecture complemented by an efficient security scheme in order to allow a reliable exchange of information between UAVs and the ground stations.FANETs can either be deployed independently or they can be integrated with the traditional networks via satellite or cellular communication links. The topic allures experts from the industry as well as academia. Most of the relevant research studies propose to integrate multiple-UAV systems with the traditional networks to assure Quality of Service (QoS), unhampered security, and sustained reliability. Therefore, it is imperative to identify loopholes in existing solutions. This can pave the way for solutions that support high throughput and a secure data communication regime. The envisioned Fifth Generation (5G) of wireless cellular communication systems is expected to offer higher capacity, enhanced data rate, and lower latency [7]. Besides, 5G offers multiaccess edge computing (MEC) architecture, which is characterized by cloud computing functionalities. Thus, 5G, when integrated into a UAV environment, by leveraging MEC, can relieve the resource-constrained UAVs from processing the computational tasks. Instead, the computationally intensive tasks will be offloaded to the edge of the network.Generally, the small UAVs are not designed with security considerations and are, therefore, prone to security and privacy pitfalls [8]. UAV’s sensing portion is also worth consideration. For instance, in the worst case, a sensor might transmit wrong information and that can result in UAVs making erroneous decisions. Similarly, the case of the faulty sensor is far more sinister. A damaged sensor can severely hamper the UAV’s attempt to obtain information and might result in an event of a crash. Furthermore, a strong communication link is essential to allow the exchange of information between a UAV and a Base Station. An insecure and vulnerable link, on the other hand, is susceptible to attacks [9]. The concerns of confidentiality and authentication can be addressed by employing encryption and digital signature, respectively. And, in case both the attributes are desired, a hybrid version, the sign-then-encrypt approach, is utilized mostly.However, the stringent constraints associated with a flying ad hoc network (FANET), such as limited onboard energy and limited computing capability, do not permit complex cryptographic operations. Moreover, undertaking computationally intensive tasks may result in slow response time which can, in turn, deteriorate the performance of FANETs. Fortunately, such deficiencies can be resolved by employing an amalgamated scheme, named “signcryption” [10]. It is a public key cryptosystem that performs the function of encryption and digital signature simultaneously. It is far more efficient and cost-effective than each of the alternates, i.e., encryption and digital signature. To simplify the key management process and to allow flexibility, Han et al. [11] presented an extension of the signcryption scheme, i.e., generalized signcryption (GSC). Not only does GSC offer encryption and digital signature in one go, but it also has the option to offer them separately, if demanded. Such feature is helpful in case either of the two key attributes, confidentiality or authenticity, is required.In the public key cryptosystems, two basic approaches, Public Key Infrastructure (PKI) and Identity-Based Cryptography (IBC), are used to authenticate public keys [12]. In the PKI environment, it is crucial to ensure a trustworthy unforgeable link between the identity of the participant and its public key. This further stipulates the need for a signature Certificate Authority (CA) that assigns the link a unique signature. In the certification stage, the CA bounds the public key as the identity of a participant with certificates. The Public Key Infrastructure (PKI) approach encounters issues with certificate distribution and storage. On the other hand, an identity-based cryptosystem is used to reduce the cost of public key management [13]. In ID-based systems, a trusted third party named private key generator (PKG) computes private keys from a master secret and users’ identity information. It then distributes these private keys to the users participating in the scheme. This eradicates the necessity for certificates as used in a conventional PKI.The security and efficiency of the aforementioned security schemes are based on computationally hard problems. The RSA cryptography [14, 15] is based on a large factorization problem, which utilizes a large key, parameter certificate, and the identity stretches as much as 1024 bits [16]. This is not suitable for resource-constrained networks, or FANETs, because small UAVs lack onboard processing resources. Furthermore, bilinear pairing is 14.31 times worse than RSA [17], due to huge pairing and map-to-point function computation. In order to eliminate the discrepancies accompanying RSA and bilinear pairing, a new type of cryptography called the elliptic curve was introduced [18]. The elliptic curve cryptography is characterized by smaller parameter size, smaller public/private key size, smaller identity, and smaller certificate size. Moreover, unlike bilinear pairing and RSA, the security hardiness and efficiency of the elliptic curve cryptography scheme are based on 160-bit small keys [19]. The 160-bit key is, still, not suitable for and affordable by resource-hungry devices such as small UAVs. Thus, the hyperelliptic curve, a more modern version of the elliptic curve cryptography, was proposed [20]. The hyperelliptic curve uses an 80-bit key, identity, and certificate size and, at the same time, promises the security features assured by the elliptic curve, bilinear pairing, and RSA [21, 22]. Therefore, the hyperelliptic curve is a cogent choice for energy-constrained devices.


### 1.1. Authors’ Motivation and Contributions

To reap the extensive benefits of multi-UAV systems, the underlying technical challenges need to be addressed. For instance, the small UAVs have limited onboard energy, which restricts the flying time to a specified period and the UAV’s limited computational capability does not permit complex cryptographic operations. Therefore, there is a need to harness a state-of-the-art communication architecture with a lightweight security mechanism, which can, significantly, stabilize the battery lifetime, offer limited computation cost, and provide better connectivity.Motivated by such objectives, for FANETs, the authors, here, suggest an identity-based generalized signcryption scheme. The very scheme makes use of multiaccess edge computing (MEC) and is based on a much advanced version of the elliptic curve, i.e., the hyperelliptic curve (HEC). HEC is characterized by a smaller key size and, at the same time, promises security comparable to that of the counterparts, i.e., elliptic curve, bilinear pairing, and modular exponentiation. Incorporation of HEC reduces power consumption and improves the device’s performance, thereby making it suitable for a wide range of devices, ranging from sensors to UAVs.Some of the salient features signifying the contribution of our research work, in this paper, are as follows:(i)
We introduce a new architecture for flying ad hoc networks (FANETs) leveraging multiaccess edge computing (MEC) facility, where the primary UAV acts as a MEC node in order to provide computational offloading services for the member UAVs having limited local computing capabilities(ii)
We propose an efficient and provably secure identity-based generalized signcryption scheme for the architecture using the concept of a hyperelliptic curve(iii)
The proposed scheme is potent enough to thwart attacks, both known and unknown, and the validation results using the Automated Validation for Internet Security Validation and Application (AVISPA) tool second such notion(iv)
Moreover, upon doing a comparative analysis with the extant schemes, it is revealed that our proposed scheme is superior, particularly, in terms of computational and communication costs


### 1.2. Structure of the Paper

The rest of the paper is organized as follows. In Section2, we provide a brief about the related work. Foundational concepts of the research work are presented in Section 3. Section 4 is dedicated to present the two system models, i.e., network model and threat model. In Section 5, we explain the salient features of the proposed scheme. Informal security analysis is provided in Section 6. Section 7 presents the practical deployment of the proposed scheme. For performance evaluation, the proposed scheme is compared with the existing schemes in Section 8. Section 9 contains a brief about a case study in which the scheme is applied for precision agriculture. Finally, Section 10 concludes the work.


## 1.1. Authors’ Motivation and Contributions

To reap the extensive benefits of multi-UAV systems, the underlying technical challenges need to be addressed. For instance, the small UAVs have limited onboard energy, which restricts the flying time to a specified period and the UAV’s limited computational capability does not permit complex cryptographic operations. Therefore, there is a need to harness a state-of-the-art communication architecture with a lightweight security mechanism, which can, significantly, stabilize the battery lifetime, offer limited computation cost, and provide better connectivity.Motivated by such objectives, for FANETs, the authors, here, suggest an identity-based generalized signcryption scheme. The very scheme makes use of multiaccess edge computing (MEC) and is based on a much advanced version of the elliptic curve, i.e., the hyperelliptic curve (HEC). HEC is characterized by a smaller key size and, at the same time, promises security comparable to that of the counterparts, i.e., elliptic curve, bilinear pairing, and modular exponentiation. Incorporation of HEC reduces power consumption and improves the device’s performance, thereby making it suitable for a wide range of devices, ranging from sensors to UAVs.Some of the salient features signifying the contribution of our research work, in this paper, are as follows:(i)
We introduce a new architecture for flying ad hoc networks (FANETs) leveraging multiaccess edge computing (MEC) facility, where the primary UAV acts as a MEC node in order to provide computational offloading services for the member UAVs having limited local computing capabilities(ii)
We propose an efficient and provably secure identity-based generalized signcryption scheme for the architecture using the concept of a hyperelliptic curve(iii)
The proposed scheme is potent enough to thwart attacks, both known and unknown, and the validation results using the Automated Validation for Internet Security Validation and Application (AVISPA) tool second such notion(iv)
Moreover, upon doing a comparative analysis with the extant schemes, it is revealed that our proposed scheme is superior, particularly, in terms of computational and communication costs


## 1.2. Structure of the Paper

The rest of the paper is organized as follows. In Section2, we provide a brief about the related work. Foundational concepts of the research work are presented in Section 3. Section 4 is dedicated to present the two system models, i.e., network model and threat model. In Section 5, we explain the salient features of the proposed scheme. Informal security analysis is provided in Section 6. Section 7 presents the practical deployment of the proposed scheme. For performance evaluation, the proposed scheme is compared with the existing schemes in Section 8. Section 9 contains a brief about a case study in which the scheme is applied for precision agriculture. Finally, Section 10 concludes the work.


## 2. Related Work

### 2.1. UAV-Enabled Multiaccess Edge Computing

Owing to the promising features of on-demand communication services and flexible deployment, UAV-enabled multiaccess edge computing capabilities have received much attention in recent years. So far, various studies have been conducted to examine the usability of edge computing for UAVs [23, 24]. However, the studies do not address the topic of security. Garg et al. [25] aimed to answer the surveillance-related concerns by proposing a framework based on probabilistic data structures. The framework treats UAVs as intermediate aerial nodes that offer a cyberthreat detection mechanism complemented with a real-time analysis. Four major elements of the framework are as follows: UAV, dispatcher, aggregator, and edge devices. The UAV is responsible for capturing and validating the data. The processing tasks in the edge computing devices are scheduled by the dispatcher. The aggregator assures the secure transmission of data. And, the edge devices analyze the data.In [26], the authors extend the concept of network slicing to the case of UAV-based 5G network deployment and investigate the feasibility of a backhaul of an aerial node utilizing a UAV. The LTE signals are monitored to evaluate the suitability of UAVs in two scenarios: network capacity enhancement and increasing network coverage.The methodology proposed by Christian et al. [27] increases the system reliability and reduces the end-to-end source-actuator latency. Their work intends to broaden the 5G network edge by making the FANET UAVs fly close to the monitoring layer. For enhanced operations, the UAVs follow a policy of mutual help and are accoutered with MEC facilities. However, the work fails to address the issue of the limited battery duration of the MEC-UAVs. In [28], the authors proposed a UAV edge-cloud computing model that utilizes a UAV swarm to provide the users real-time support. The end data are stored in the cloud server. In [29], the authors presented an architectural design of a slice orchestrator that enables new application models where the Internet of Things related functions can be applied on small Unmanned Aerial Vehicles, thus paving the way for implementing these functions on the edge network.


### 2.2. Security Mechanisms in Flying Ad Hoc Networks

The primary security mechanisms for FANETs emphasize authenticity, confidentiality, and integrity of data via cryptography. A well-designed data protection mechanism can significantly reduce the probability of the data get compromised, irrespective of the devilish technique involved. There are a few studies dedicated to investigating the data protection issues for UAV Networks. In a secure communication scheme proposed by He et al. [30], the requirement of an online centralized authority is waived off. The UAVs manage the area themselves and the authorized devices can obtain a broadcast key. The scheme is characterized by employing hierarchical identity-based broadcast encryption and a pseudonym mechanism, whereby the devices can, anonymously, broadcast the encrypted messages and decrypt the legal ciphertext. The work done seconds the notion that the very scheme, satisfactorily, addresses the four important security concerns: confidentiality, authentication, partial privacy preservation, and resistance to Denial of Service (DoS) attacks. However, it inherits a restriction in the registration phase, i.e., the concern of finding a hash value’s preimage persists.Three communication scenarios have been described by Won et al. [31, 32] to propose cryptographic protocols for drones and smart objects. The first scenario, i.e., one-to-one, implies a certificateless signcryption tag key for facilitating an authenticated key agreement and for providing nonrepudiation and user revocation. One-to-many, or the second scenario, enables a UAV to broadcast privacy-sensitive data to multiple smart objects using a certificateless multirecipient encryption scheme. The third scenario is termed “many-to-one” and is characterized by UAVs capable of collecting data from multiple smart objects. However, for such protocols [31, 32], transmitting encrypted messages and assuring privacy simultaneously are too difficult to undertake. Such novel cryptographic mechanisms are efficient and secure. However, they are supposed to be used in group communication where nodes are of equal computational capability. In 2019, Asghar et al. [33] proposed a blind signature scheme for flying ad hoc networks in a certificateless setting. The scheme is suitable for authentication; however, it does not offer confidentiality and authentication simultaneously.


### 2.3. Identity-Based Generalized Signcryption Schemes

Lal et al. [34], in 2008, introduced the first identity-based generalized signcryption scheme and proposed a security model for it. However, Yu et al. [13] pointed out that the security model presented by Lal et al. [34] scheme is incomplete and proposed a new scheme, which is efficient in terms of computation and is secure. Later, in 2011, Kushwah et al. [35] simplified the security model introduced by Yu et al. [13] and proposed a more efficient identity-based generalized signcryption scheme. Wei et al. [36], in 2015, presented an identity-based generalized signcryption scheme, which demonstrated to be secure enough in the random oracle model. Shen et al. [37], in 2017, proposed an identity-based generalized signcryption scheme in the standard model. Nevertheless, the proposed scheme is based on bilinear pairing that is computationally expensive. In 2019, Waheed et al. [38] analyzed the work done by Wei et al. [36] and suggested an improved scheme that is far more secure and cost-effective. Lastly, in 2019, Zhou et al. [39] proposed an identity-based combined public key scheme for signature, encryption, and signature (IBCSESC). Under the premise of ensuring the confidentiality, integrity, authentication, and nonrepudiation of data, the combined cryptosystem reduces the key management work, saves storage space, and offers decreased computational consumption.


## 2.1. UAV-Enabled Multiaccess Edge Computing

Owing to the promising features of on-demand communication services and flexible deployment, UAV-enabled multiaccess edge computing capabilities have received much attention in recent years. So far, various studies have been conducted to examine the usability of edge computing for UAVs [23, 24]. However, the studies do not address the topic of security. Garg et al. [25] aimed to answer the surveillance-related concerns by proposing a framework based on probabilistic data structures. The framework treats UAVs as intermediate aerial nodes that offer a cyberthreat detection mechanism complemented with a real-time analysis. Four major elements of the framework are as follows: UAV, dispatcher, aggregator, and edge devices. The UAV is responsible for capturing and validating the data. The processing tasks in the edge computing devices are scheduled by the dispatcher. The aggregator assures the secure transmission of data. And, the edge devices analyze the data.In [26], the authors extend the concept of network slicing to the case of UAV-based 5G network deployment and investigate the feasibility of a backhaul of an aerial node utilizing a UAV. The LTE signals are monitored to evaluate the suitability of UAVs in two scenarios: network capacity enhancement and increasing network coverage.The methodology proposed by Christian et al. [27] increases the system reliability and reduces the end-to-end source-actuator latency. Their work intends to broaden the 5G network edge by making the FANET UAVs fly close to the monitoring layer. For enhanced operations, the UAVs follow a policy of mutual help and are accoutered with MEC facilities. However, the work fails to address the issue of the limited battery duration of the MEC-UAVs. In [28], the authors proposed a UAV edge-cloud computing model that utilizes a UAV swarm to provide the users real-time support. The end data are stored in the cloud server. In [29], the authors presented an architectural design of a slice orchestrator that enables new application models where the Internet of Things related functions can be applied on small Unmanned Aerial Vehicles, thus paving the way for implementing these functions on the edge network.


## 2.2. Security Mechanisms in Flying Ad Hoc Networks

The primary security mechanisms for FANETs emphasize authenticity, confidentiality, and integrity of data via cryptography. A well-designed data protection mechanism can significantly reduce the probability of the data get compromised, irrespective of the devilish technique involved. There are a few studies dedicated to investigating the data protection issues for UAV Networks. In a secure communication scheme proposed by He et al. [30], the requirement of an online centralized authority is waived off. The UAVs manage the area themselves and the authorized devices can obtain a broadcast key. The scheme is characterized by employing hierarchical identity-based broadcast encryption and a pseudonym mechanism, whereby the devices can, anonymously, broadcast the encrypted messages and decrypt the legal ciphertext. The work done seconds the notion that the very scheme, satisfactorily, addresses the four important security concerns: confidentiality, authentication, partial privacy preservation, and resistance to Denial of Service (DoS) attacks. However, it inherits a restriction in the registration phase, i.e., the concern of finding a hash value’s preimage persists.Three communication scenarios have been described by Won et al. [31, 32] to propose cryptographic protocols for drones and smart objects. The first scenario, i.e., one-to-one, implies a certificateless signcryption tag key for facilitating an authenticated key agreement and for providing nonrepudiation and user revocation. One-to-many, or the second scenario, enables a UAV to broadcast privacy-sensitive data to multiple smart objects using a certificateless multirecipient encryption scheme. The third scenario is termed “many-to-one” and is characterized by UAVs capable of collecting data from multiple smart objects. However, for such protocols [31, 32], transmitting encrypted messages and assuring privacy simultaneously are too difficult to undertake. Such novel cryptographic mechanisms are efficient and secure. However, they are supposed to be used in group communication where nodes are of equal computational capability. In 2019, Asghar et al. [33] proposed a blind signature scheme for flying ad hoc networks in a certificateless setting. The scheme is suitable for authentication; however, it does not offer confidentiality and authentication simultaneously.


## 2.3. Identity-Based Generalized Signcryption Schemes

Lal et al. [34], in 2008, introduced the first identity-based generalized signcryption scheme and proposed a security model for it. However, Yu et al. [13] pointed out that the security model presented by Lal et al. [34] scheme is incomplete and proposed a new scheme, which is efficient in terms of computation and is secure. Later, in 2011, Kushwah et al. [35] simplified the security model introduced by Yu et al. [13] and proposed a more efficient identity-based generalized signcryption scheme. Wei et al. [36], in 2015, presented an identity-based generalized signcryption scheme, which demonstrated to be secure enough in the random oracle model. Shen et al. [37], in 2017, proposed an identity-based generalized signcryption scheme in the standard model. Nevertheless, the proposed scheme is based on bilinear pairing that is computationally expensive. In 2019, Waheed et al. [38] analyzed the work done by Wei et al. [36] and suggested an improved scheme that is far more secure and cost-effective. Lastly, in 2019, Zhou et al. [39] proposed an identity-based combined public key scheme for signature, encryption, and signature (IBCSESC). Under the premise of ensuring the confidentiality, integrity, authentication, and nonrepudiation of data, the combined cryptosystem reduces the key management work, saves storage space, and offers decreased computational consumption.


## 3. Preliminaries

### 3.1. Hyperelliptic Curve Cryptography (HECC)

HECC is the advanced form of elliptic curve cryptography (ECC), and it is used to exchange keys and facilitate secure communications between two parties with very small size keys and incur lower computational and communication costs. For instance, an encryption activity done using RSA with a 1024-bit key and ECC with a 160-bit key is equivalent in performance to HECC encryption with an 80-bit key [40].Suppose that ℑq is a predetermined set and presume ∂ as the genus of hεc having order as ∂≥2. Let (v), f(v) ∈ ℑq [v], deg (h(v)) ≤ ∂, and f(v) is a monic-polynomial having deg (f(v)) = 2∂ + 1. Thus, hεc of genus ∂≥2 over ℑq is set of points (v,) ℑq ∗ ℑq as shown in(1)hεc:w2+vw=fv.It forms the divisors which are the formal sum of finite integers liked=∑xizi where xi∈ℑq and zi∈hεc. Further, it forms a Jacobian group ℑhεcℑq having the following order:(2)t−12∂≤Jhεcℑq≤t+12∂.


### 3.2. Hyperelliptic Curve Discrete Logarithm Problemhεc−dlΡ

Assume thatd is the divisor that is publicly available in the network and ℒ is a randomly picked private number from ℑt. Upon recovering ℒ from d1=d, ℒ is said to be hεc−dlΡ.


## 3.1. Hyperelliptic Curve Cryptography (HECC)

HECC is the advanced form of elliptic curve cryptography (ECC), and it is used to exchange keys and facilitate secure communications between two parties with very small size keys and incur lower computational and communication costs. For instance, an encryption activity done using RSA with a 1024-bit key and ECC with a 160-bit key is equivalent in performance to HECC encryption with an 80-bit key [40].Suppose that ℑq is a predetermined set and presume ∂ as the genus of hεc having order as ∂≥2. Let (v), f(v) ∈ ℑq [v], deg (h(v)) ≤ ∂, and f(v) is a monic-polynomial having deg (f(v)) = 2∂ + 1. Thus, hεc of genus ∂≥2 over ℑq is set of points (v,) ℑq ∗ ℑq as shown in(1)hεc:w2+vw=fv.It forms the divisors which are the formal sum of finite integers liked=∑xizi where xi∈ℑq and zi∈hεc. Further, it forms a Jacobian group ℑhεcℑq having the following order:(2)t−12∂≤Jhεcℑq≤t+12∂.


## 3.2. Hyperelliptic Curve Discrete Logarithm Problemhεc−dlΡ

Assume thatd is the divisor that is publicly available in the network and ℒ is a randomly picked private number from ℑt. Upon recovering ℒ from d1=d, ℒ is said to be hεc−dlΡ.


## 4. System Models

To elaborate on the operation and applicability of the proposed scheme, two models are used.


### 4.1. Network Model

We devise a novel architecture for a flying ad hoc network (FANET), constituted by UAVs, with a multiaccess edge computing (MEC) facility that makes use of the Fifth Generation (5G) wireless communication technology on backhaul and the Wi-Fi technology on fronthaul, as shown in Figure1. The 5G and Wi-Fi wireless technologies are enabled on MEC-UAV in order to link it with the Macro Base Station (MBS) and to provide a hotspot service over the M-UAVs. The M-UAVs are connected with each other via a Wi-Fi link. The primary reason behind opting for such a hybridized approach is to utilize the prominent features of both technologies. This ends up in the resulting solution being of low cost, low power, high range, and high speed. A huge bandwidth is required when linking the Macro Base Stations with the core network. The proposed architecture involves the UAVs connected together via either of the two classes: monitoring UAV (M-UAV), responsible for performing the monitoring function from an assigned zone; and multiaccess edge computing UAV (MEC-UAV), utilizing MEC to handle a set of M-UAVs connected to it. It is the load generated by an M-UAV that acts as a decisive factor when assigning M-UAV(s) to a MEC-UAV, or the primary UAV. In the maneuver, each of the MEC-UAVs is equipped with Raspberry PI (RPI) powered with a 1.5 GHz 64-bit quad-core ARM Cortex-A72 processor [41].Figure 1
Multiaccess edge computing empowered FANET architecture of the proposed scheme when applied for monitoring.


### 4.2. Threat Model

The proposed scheme employs the Dolev-Yao (DY) threat model [42]. The model indicates that an untrustworthy nature prevails between the end-point entities and that there is an insecure open channel between the parties. Thus, for an attacker, it eases the task to eavesdrop and delete/modify the exchanged messages. Far worse is the scenario when a drone, while hovering over a hostile area, is physically captured and the data is compromised. Recently, the widely accepted “Canetti and Krawczyk’s adversary model (CK-adversary model)” [43] becomes the “current de facto standard model in modeling authenticated key exchange protocols.” According to the CK-adversary model, “the adversary can not only deliver the messages (as in the DY model), but can compromise the secret credentials, secret keys and session states a well, particularly, when stored in the insecure memory.” Therefore, it becomes an essential requirement that “the leakage of some forms of secret credentials, such as session ephemeral secrets or secret key, should minimally effect the secrecy of the communicating participants” [33].


## 4.1. Network Model

We devise a novel architecture for a flying ad hoc network (FANET), constituted by UAVs, with a multiaccess edge computing (MEC) facility that makes use of the Fifth Generation (5G) wireless communication technology on backhaul and the Wi-Fi technology on fronthaul, as shown in Figure1. The 5G and Wi-Fi wireless technologies are enabled on MEC-UAV in order to link it with the Macro Base Station (MBS) and to provide a hotspot service over the M-UAVs. The M-UAVs are connected with each other via a Wi-Fi link. The primary reason behind opting for such a hybridized approach is to utilize the prominent features of both technologies. This ends up in the resulting solution being of low cost, low power, high range, and high speed. A huge bandwidth is required when linking the Macro Base Stations with the core network. The proposed architecture involves the UAVs connected together via either of the two classes: monitoring UAV (M-UAV), responsible for performing the monitoring function from an assigned zone; and multiaccess edge computing UAV (MEC-UAV), utilizing MEC to handle a set of M-UAVs connected to it. It is the load generated by an M-UAV that acts as a decisive factor when assigning M-UAV(s) to a MEC-UAV, or the primary UAV. In the maneuver, each of the MEC-UAVs is equipped with Raspberry PI (RPI) powered with a 1.5 GHz 64-bit quad-core ARM Cortex-A72 processor [41].Figure 1
Multiaccess edge computing empowered FANET architecture of the proposed scheme when applied for monitoring.


## 4.2. Threat Model

The proposed scheme employs the Dolev-Yao (DY) threat model [42]. The model indicates that an untrustworthy nature prevails between the end-point entities and that there is an insecure open channel between the parties. Thus, for an attacker, it eases the task to eavesdrop and delete/modify the exchanged messages. Far worse is the scenario when a drone, while hovering over a hostile area, is physically captured and the data is compromised. Recently, the widely accepted “Canetti and Krawczyk’s adversary model (CK-adversary model)” [43] becomes the “current de facto standard model in modeling authenticated key exchange protocols.” According to the CK-adversary model, “the adversary can not only deliver the messages (as in the DY model), but can compromise the secret credentials, secret keys and session states a well, particularly, when stored in the insecure memory.” Therefore, it becomes an essential requirement that “the leakage of some forms of secret credentials, such as session ephemeral secrets or secret key, should minimally effect the secrecy of the communicating participants” [33].


## 5. Proposed Identity-Based Generalized Signcryption Scheme

### 5.1. Syntax of Identity-Based Generalized Signcryption Scheme

A formal model of identity-based generalized signcryption scheme consists of the following four algorithms [13, 37]: setup, key extraction, generalized signcryption, and generalized unsigncryption. The notations used in the proposed scheme are illustrated in Table 1.(i)
Setup. In the setup phase, the private key generation (PKG) generates the public parameters, randomly selects their master private key, and computes the master public key with the input of security parameter.(ii)
Key Extraction. When each of the participated contestants transmits their respective identities (IDps) to the PKG, PKG generates the private (Apc) and public (Bpc) keys for each of them and delivers them using the private network.(iii)
Generalized Signcryption. The sender performs this process for producing generalized signcryption of a message m.It initially takes the input parameter such as the identity of the sender and receiver IDcs,IDcr), message m,the private key of the sender (Acs), the public key of the receiver (Bcr), and a fresh nonce (ncs).(iv)
Generalized Unsigncryption. The receiver performs this process for recovering a message m and verifying generalized signcryption text ψ. It takes the input parameter like generalized signcryption text ψ, the identity of the sender and receiverIDcs,IDcr), the private key of the receiver (Acr), the public key of the receiver(Bcr), and the public key of the sender (Bcs).Table 1
Notations used in the proposed algorithm.
S.NOSymbolDefinition1hεcHyperelliptic curve2κSecurity parameter3PKGPrivate key generation center4qA large prime number with length equivalents to 80 bits5ℑqA finite field of the orderq6ha, hb.Hash functions7δMaster private key of PKG8ΛMaster public key of PKG9ΕPublic parameter param10IDcsIdentity sender11IDcrIdentity receiver12AcsPrivate key of the sender13AcrPrivate key of the receiver14BcsPublic key of the sender15BcrPublic key of receiver16η,mCiphertext and plain text17ncsA fresh nonce18βEncryption and decryption key19eβ,dβEncryption and decryption throughβ20ψ=∂,σ,η,ΔGeneralized signcryption text for the receiver21//Used for concatenation22╨Used for error


### 5.2. Construction of the Proposed Identity-Based Generalized Signcryption Scheme

It includes the following four subphases [13, 37]:Setup: in this phase, the private key generation (PKG) center performs essential steps. It(a)
Selects a security parameterκ(b)
Selects a hyperelliptic curve (HEC) of genus 2(c)
Selects a parameterq where the length is equivalents to 80 bits(d)
Selects a finite fieldfq, where its order is q(e)
Selects a divisorD of the order q(f)
Selects two one-way hash function, i.e.,ha and hb(g)
Selects a number uniformly for its private key asδ∈1,2,…,q−1(h)
Computes its public key asΛ=δ.D(i)
Produces all the public parameter paramE=q,ha,hb,fq,κ,Λ,HEC,D and publish them to the networkKey extraction: when each of the participating contestants transmits their identity (IDpc) to the PKG, the PKG generates the private and public keys by utilizing the performing the following computations:(a)
It computes private key for identity (IDpc) as Apc = δ⋅haIDpcmodq(b)
It computes public key for identity (IDpc) as Bpc = Apc.D(c)
It delivers the pair of the public and private keys (Bpc,Apc) to the participating contestants with its identity (IDpc) by using the private networkGeneralized signcryption: given a message (m), the private key of the sender (Acs), the public key of the receiver (Bcr), the identity of the sender and receiver (IDcs,IDcr), and a fresh nonce (ncs), the sender performs this process for producing generalized signcryption by undertaking the following steps(a)
It selects a number in an irregular manner asφ∈1,2,…,q−1 and calculates Δ=φ⋅D(b)
It calculatesβ=φ⋅Bcr⋅IDcr(c)
It computesη=eβm//IDcs//IDcr//ncs(d)
It calculatesσ=hbm//IDcs//IDcr//ncs(e)
It computes∂=IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcsmodq(f)
It produces the final generalized signcryption text for the receiver asψ=∂,σ,η,ΔGeneralized unsigncryption: given a generalized signcryption textψ=∂,σ,η,Δ, the private key of the receiver (Acr), the public key of sender and receiver (Bcs,Bcr), and the identity of the receiver (IDcr), the sender performs this process for verifying the signature, and recovering a plain text m by undertaking the following steps:(a)
It computesβ=∂⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr(b)
It decryptsm//IDcs//IDcr//ncs=dβη(c)
It computesσ∧=hbm//IDcs//IDcr//ncs(d)
It comparesσ∧=σ, if holds, then accept ψ otherwise generate the error symbol ╨Note that, in the above algorithm, ifIDcs=null and IDcr≠null, then generalized signcryption proceeds in an encryption process. If IDcr=null andIDcs≠null, then generalized signcryption will run in the signature mode. And, if IDcs≠null andIDcr≠null, then generalized signcryption will run in signcryption mode.


### 5.3. Correctness

The receiver can compute the decryption key as(3)β=∂.Bcr+IDcs⋅Δ⋅σ⋅Bcs.Acr,IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr,IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr,IDcr⋅φ⋅Bcr−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr,IDcr⋅φ⋅Bcr−σ.Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Acs⋅D⋅Acr,IDcr⋅φ⋅Bcr−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Acs⋅Bcr,IDcr⋅φ⋅Bcr−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅σ⋅Δ⋅Acs⋅Bcr,IDcr⋅φ⋅Bcr=β,and it verifies ψ as it computes σ∧=hbm//IDcs//IDcr//ncs and compares σ∧=σ. In case of equality, it accepts ψ and else generates the error symbol ╨.


## 5.1. Syntax of Identity-Based Generalized Signcryption Scheme

A formal model of identity-based generalized signcryption scheme consists of the following four algorithms [13, 37]: setup, key extraction, generalized signcryption, and generalized unsigncryption. The notations used in the proposed scheme are illustrated in Table 1.(i)
Setup. In the setup phase, the private key generation (PKG) generates the public parameters, randomly selects their master private key, and computes the master public key with the input of security parameter.(ii)
Key Extraction. When each of the participated contestants transmits their respective identities (IDps) to the PKG, PKG generates the private (Apc) and public (Bpc) keys for each of them and delivers them using the private network.(iii)
Generalized Signcryption. The sender performs this process for producing generalized signcryption of a message m.It initially takes the input parameter such as the identity of the sender and receiver IDcs,IDcr), message m,the private key of the sender (Acs), the public key of the receiver (Bcr), and a fresh nonce (ncs).(iv)
Generalized Unsigncryption. The receiver performs this process for recovering a message m and verifying generalized signcryption text ψ. It takes the input parameter like generalized signcryption text ψ, the identity of the sender and receiverIDcs,IDcr), the private key of the receiver (Acr), the public key of the receiver(Bcr), and the public key of the sender (Bcs).Table 1
Notations used in the proposed algorithm.
S.NOSymbolDefinition1hεcHyperelliptic curve2κSecurity parameter3PKGPrivate key generation center4qA large prime number with length equivalents to 80 bits5ℑqA finite field of the orderq6ha, hb.Hash functions7δMaster private key of PKG8ΛMaster public key of PKG9ΕPublic parameter param10IDcsIdentity sender11IDcrIdentity receiver12AcsPrivate key of the sender13AcrPrivate key of the receiver14BcsPublic key of the sender15BcrPublic key of receiver16η,mCiphertext and plain text17ncsA fresh nonce18βEncryption and decryption key19eβ,dβEncryption and decryption throughβ20ψ=∂,σ,η,ΔGeneralized signcryption text for the receiver21//Used for concatenation22╨Used for error


## 5.2. Construction of the Proposed Identity-Based Generalized Signcryption Scheme

It includes the following four subphases [13, 37]:Setup: in this phase, the private key generation (PKG) center performs essential steps. It(a)
Selects a security parameterκ(b)
Selects a hyperelliptic curve (HEC) of genus 2(c)
Selects a parameterq where the length is equivalents to 80 bits(d)
Selects a finite fieldfq, where its order is q(e)
Selects a divisorD of the order q(f)
Selects two one-way hash function, i.e.,ha and hb(g)
Selects a number uniformly for its private key asδ∈1,2,…,q−1(h)
Computes its public key asΛ=δ.D(i)
Produces all the public parameter paramE=q,ha,hb,fq,κ,Λ,HEC,D and publish them to the networkKey extraction: when each of the participating contestants transmits their identity (IDpc) to the PKG, the PKG generates the private and public keys by utilizing the performing the following computations:(a)
It computes private key for identity (IDpc) as Apc = δ⋅haIDpcmodq(b)
It computes public key for identity (IDpc) as Bpc = Apc.D(c)
It delivers the pair of the public and private keys (Bpc,Apc) to the participating contestants with its identity (IDpc) by using the private networkGeneralized signcryption: given a message (m), the private key of the sender (Acs), the public key of the receiver (Bcr), the identity of the sender and receiver (IDcs,IDcr), and a fresh nonce (ncs), the sender performs this process for producing generalized signcryption by undertaking the following steps(a)
It selects a number in an irregular manner asφ∈1,2,…,q−1 and calculates Δ=φ⋅D(b)
It calculatesβ=φ⋅Bcr⋅IDcr(c)
It computesη=eβm//IDcs//IDcr//ncs(d)
It calculatesσ=hbm//IDcs//IDcr//ncs(e)
It computes∂=IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcsmodq(f)
It produces the final generalized signcryption text for the receiver asψ=∂,σ,η,ΔGeneralized unsigncryption: given a generalized signcryption textψ=∂,σ,η,Δ, the private key of the receiver (Acr), the public key of sender and receiver (Bcs,Bcr), and the identity of the receiver (IDcr), the sender performs this process for verifying the signature, and recovering a plain text m by undertaking the following steps:(a)
It computesβ=∂⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr(b)
It decryptsm//IDcs//IDcr//ncs=dβη(c)
It computesσ∧=hbm//IDcs//IDcr//ncs(d)
It comparesσ∧=σ, if holds, then accept ψ otherwise generate the error symbol ╨Note that, in the above algorithm, ifIDcs=null and IDcr≠null, then generalized signcryption proceeds in an encryption process. If IDcr=null andIDcs≠null, then generalized signcryption will run in the signature mode. And, if IDcs≠null andIDcr≠null, then generalized signcryption will run in signcryption mode.


## 5.3. Correctness

The receiver can compute the decryption key as(3)β=∂.Bcr+IDcs⋅Δ⋅σ⋅Bcs.Acr,IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr,IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr,IDcr⋅φ⋅Bcr−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Bcs⋅Acr,IDcr⋅φ⋅Bcr−σ.Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Acs⋅D⋅Acr,IDcr⋅φ⋅Bcr−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅Δ⋅σ⋅Acs⋅Bcr,IDcr⋅φ⋅Bcr−σ⋅Δ⋅Acs⋅IDcs⋅Bcr+IDcs⋅σ⋅Δ⋅Acs⋅Bcr,IDcr⋅φ⋅Bcr=β,and it verifies ψ as it computes σ∧=hbm//IDcs//IDcr//ncs and compares σ∧=σ. In case of equality, it accepts ψ and else generates the error symbol ╨.


## 6. Informal Security Analysis

This section is dedicated to spotlight the proposed scheme’s contribution in upholding basic security including resistance to replay attack, confidentiality, integrity, and unforgeability. Each of the characteristics is briefly analyzed in the following sections.


### 6.1. Confidentiality

The proposed scheme ensures confidentiality. In case an intruder wants to steal the original contents of a message or the secret key, he/she must have beforehand information about the key asβ=φ⋅Bcr⋅BIDcr. In order to determine β, it is required to compute φ from Δ=φ.D, which is the discrete log problem in the hyperelliptic curve.


### 6.2. Replay Attack

The scheme offers replay attack resistance. Each session implies a fresh key (β) and a nonce (ncs) i.e., η=eβm//IDcs//IDcr//ncs. Therefore, it is, literally, not possible for an intruder of a session to penetrate another session with the same session key. Besides, the receiver is required to run a check for ascertaining the freshness of a message at every instance of reception. An obsoleteness, if spotted, renders the message useless.


### 6.3. Integrity

The sender takes the “hash value” of the message before sending the message, i.e.,:σ=hbm//IDcs//IDcr//ncs. The “hash” exhibits a property of being an irreversible function. For the confirmation if either of the ciphertexts is altered or not, the receiver performs the following steps: it first decrypts m//IDcs//IDcr//ncs=dβη and computes σ∧=hbm//IDcs//IDcr//ncs. After it compares σ∧=σ, if it holds, then it accepts ψ; otherwise, it generates the error symbol ╨.


### 6.4. Unforgeability

In our proposed scheme, if the intruder tries to generate a valid signature, then he/she is, first of all, required to compute∂=IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcs, and to do so, the intruder needs to findφ from Δ=φ⋅D and Acs from Bcs = Acs⋅D. This equates to solving two hard problems with commensurate efforts. Thus, it is ensured that our designed approach offers resistance against the signature forging attack.


## 6.1. Confidentiality

The proposed scheme ensures confidentiality. In case an intruder wants to steal the original contents of a message or the secret key, he/she must have beforehand information about the key asβ=φ⋅Bcr⋅BIDcr. In order to determine β, it is required to compute φ from Δ=φ.D, which is the discrete log problem in the hyperelliptic curve.


## 6.2. Replay Attack

The scheme offers replay attack resistance. Each session implies a fresh key (β) and a nonce (ncs) i.e., η=eβm//IDcs//IDcr//ncs. Therefore, it is, literally, not possible for an intruder of a session to penetrate another session with the same session key. Besides, the receiver is required to run a check for ascertaining the freshness of a message at every instance of reception. An obsoleteness, if spotted, renders the message useless.


## 6.3. Integrity

The sender takes the “hash value” of the message before sending the message, i.e.,:σ=hbm//IDcs//IDcr//ncs. The “hash” exhibits a property of being an irreversible function. For the confirmation if either of the ciphertexts is altered or not, the receiver performs the following steps: it first decrypts m//IDcs//IDcr//ncs=dβη and computes σ∧=hbm//IDcs//IDcr//ncs. After it compares σ∧=σ, if it holds, then it accepts ψ; otherwise, it generates the error symbol ╨.


## 6.4. Unforgeability

In our proposed scheme, if the intruder tries to generate a valid signature, then he/she is, first of all, required to compute∂=IDcr⋅φ−σ⋅Δ⋅Acs⋅IDcs, and to do so, the intruder needs to findφ from Δ=φ⋅D and Acs from Bcs = Acs⋅D. This equates to solving two hard problems with commensurate efforts. Thus, it is ensured that our designed approach offers resistance against the signature forging attack.


## 7. Deployment of the Proposed Scheme

In this phase, we provide the practical deployment of our proposed technique in the UAVs network for precision agriculture that involves monitoring of crop health in a cultivated field. The proposed scheme includes three subphases that are initializations, registration, and data transmission and verification, respectively.


### 7.1. Initialization

Figure2 illustrates the initialization process, in which the PKG first calls the setup algorithm; i.e., it first selects a security parameter κ, picks a hyperelliptic curve (HEC) of the genus, chooses a parameterq where the length is equivalent to 80 bits, selects a finite field fq , where its order is q, picks a divisor D of order q, select two one-way hash functions, i.e., ha and hb, chooses a number uniformly for its private key as δ∈1,2,…,q−1, computes its public as Λ=δ⋅D, produces all the public parameter E=q,ha,hb,fq,κ,Λ,HEC,D, and published it to the network. Note that, in this subphase, we used IDmec, IDmbs, and IDm−uav for the identity of MEC-UAV, MBS/SBS, and M-UAV.Figure 2
Initialization phase.


### 7.2. Registration

Figure3 illustrates the registration process in which the PKG first calls the key extraction algorithm; i.e., when each of the participated contestants transmits its identity (IDpc) to the PKG, then PKG generates the private and public keys as follows: it computes the private key for identity (IDpc) as Apc=δ⋅haIDpcmodq, and then it computes public key for identity (IDpc) as Bpc=Apc⋅D Finally, PKG delivers the pair of public and private keys (Bpc,Apc) to the participated contestants with its identity (IDpc) by using the private network.note; in this subphase, we used Amec,Bmec, Ambs,Bmbs, and Am−uav,Bm−uav for the private and public keys of MEC-UAV, MBS/SBS, and M-UAV.Figure 3
Registration phase.


### 7.3. Data Transmission and Verification

Figure4 illustrates the data transmission and verification of the proposed scheme. In this phase, MEC-UAV performs the following process for generating a signcrypted ciphertext: it first selects a number in an irregular manner as φ∈1,2,…,q−1 and calculates Δ=φ⋅D. It also calculates β=φ⋅Bmbs⋅Dmbs and computes η=eβm//IDmec//IDmbs//nmec. Then, it computes σ=hbm//IDmec//IDmbs//nmec and ∂=IDmbs⋅φ−σ⋅Δ⋅Amec.IDmecmodq. Finally, it sends ψ to MBS/SBS using an open network. Upon reception of ψ MBS/SBS, it performs the verification and decryption process as follows: it computes β=∂⋅Bmbs+IDmec⋅Δ⋅σ⋅Bmec⋅Ambs and decrypts m//IDmec//IDmbs//nmec=dβη. It also computes σ∧=hbm//IDmec//IDmbs//nmec and compares σ∧=σ; if it holds, then, it accepts ψ; otherwise, it generates the error symbol ╨.Figure 4
Data transmission and verification phase.In the above process, ifIDmec=null and IDmbs≠null, then MEC-UAV performs the encryption process. If IDmbs=null and IDmec≠null, then MEC-UAV performs the signature method. If IDmbs≠null and IDmec≠null, then MEC-UAV performs the signcryption mode.


## 7.1. Initialization

Figure2 illustrates the initialization process, in which the PKG first calls the setup algorithm; i.e., it first selects a security parameter κ, picks a hyperelliptic curve (HEC) of the genus, chooses a parameterq where the length is equivalent to 80 bits, selects a finite field fq , where its order is q, picks a divisor D of order q, select two one-way hash functions, i.e., ha and hb, chooses a number uniformly for its private key as δ∈1,2,…,q−1, computes its public as Λ=δ⋅D, produces all the public parameter E=q,ha,hb,fq,κ,Λ,HEC,D, and published it to the network. Note that, in this subphase, we used IDmec, IDmbs, and IDm−uav for the identity of MEC-UAV, MBS/SBS, and M-UAV.Figure 2
Initialization phase.


## 7.2. Registration

Figure3 illustrates the registration process in which the PKG first calls the key extraction algorithm; i.e., when each of the participated contestants transmits its identity (IDpc) to the PKG, then PKG generates the private and public keys as follows: it computes the private key for identity (IDpc) as Apc=δ⋅haIDpcmodq, and then it computes public key for identity (IDpc) as Bpc=Apc⋅D Finally, PKG delivers the pair of public and private keys (Bpc,Apc) to the participated contestants with its identity (IDpc) by using the private network.note; in this subphase, we used Amec,Bmec, Ambs,Bmbs, and Am−uav,Bm−uav for the private and public keys of MEC-UAV, MBS/SBS, and M-UAV.Figure 3
Registration phase.


## 7.3. Data Transmission and Verification

Figure4 illustrates the data transmission and verification of the proposed scheme. In this phase, MEC-UAV performs the following process for generating a signcrypted ciphertext: it first selects a number in an irregular manner as φ∈1,2,…,q−1 and calculates Δ=φ⋅D. It also calculates β=φ⋅Bmbs⋅Dmbs and computes η=eβm//IDmec//IDmbs//nmec. Then, it computes σ=hbm//IDmec//IDmbs//nmec and ∂=IDmbs⋅φ−σ⋅Δ⋅Amec.IDmecmodq. Finally, it sends ψ to MBS/SBS using an open network. Upon reception of ψ MBS/SBS, it performs the verification and decryption process as follows: it computes β=∂⋅Bmbs+IDmec⋅Δ⋅σ⋅Bmec⋅Ambs and decrypts m//IDmec//IDmbs//nmec=dβη. It also computes σ∧=hbm//IDmec//IDmbs//nmec and compares σ∧=σ; if it holds, then, it accepts ψ; otherwise, it generates the error symbol ╨.Figure 4
Data transmission and verification phase.In the above process, ifIDmec=null and IDmbs≠null, then MEC-UAV performs the encryption process. If IDmbs=null and IDmec≠null, then MEC-UAV performs the signature method. If IDmbs≠null and IDmec≠null, then MEC-UAV performs the signcryption mode.


## 8. Performance Comparison

This section equates the performance of the proposed scheme with the existing counterparts suggested by Yu et al.’s scheme [13], Kushwah et al.’s scheme [35], Wei et al.’s scheme [36], Shen et al.’s scheme [37], and Zhou et al.’s scheme [39].


### 8.1. Computational Cost

For evaluating the effectiveness, the proposed scheme is compared with five existing schemes proposed by Yu et al. [13], Kushwah et al. [35], Wei et al. [36], Shen et al. [37], and Zhou et al. [39]. The major findings obtained from the comparison are depicted in Table 2. The five existing schemes utilize elliptic curve scalar multiplication and bilinear pairings, both of which are costlier options. Therefore, we apply the hyperelliptic divisor multiplication. From the observations, it has been revealed that the time taken for processing a single scalar multiplication varies considerably: Elliptic Curve Point Multiplication (ECPM), 0.97 ms; bilinear pairing, 14.90 ms; pairing-based point multiplications, 4.31 ms; and modular exponentiation, 1.25 ms [44]. In order to measure the performance of the proposed scheme, the Multiprecision Integer and Rational Arithmetic C Library (MIRACL) [12] is used. It tests the runtime of the basic cryptographic operations for about 1000 times. For testing the simulation results, a workstation having the following specifications is used: Intel Core i7- 4510U CPU @ 2.0 GHz, 8 GB RAM, and Windows 7 Home Basic 64-bit Operating System [42]. Owing to a smaller key size of 80 bits, the Hyperelliptic Curve Divisor Multiplication (HCDM) is assumed to be of 0.48-millisecond duration [45, 46].Table 2
Computational cost.
SchemesGeneralized signcryptGeneralized unsigncryptTotalYu et al.’s scheme [13]4bpm + 1bp + 1mexp1bpm + 3bp + 3mexp5bpm + 4bp + 4mexpKushwah et al.’s scheme [35]5bpm + 2mexp4bpm + 2bp + 3mexp9bpm + 2bp + 5mexpWei et al.’s scheme [36]9bpm + 1bp + 7mexp2bpm + 4bp11bpm + 5bp + 7mexpShen et al.’s scheme [37]2bpm + 6mxp5bpm + 2mexp7bpm + 8mexpZhou et al.’s scheme [39]3bpm + 1bp1bpm + 2bp4bpm + 3bpProposed6 hm5 hm11 hmhm = hyperelliptic curve divisor multiplication, em = elliptic curve scalar multiplication, bp = bilinear pairing, bpm = pairing-based point multiplications, mexp = modular exponentiation.From the findings in Tables2–4 and Figure 5, it is evident that our approach is far more efficient in terms of computational costs.Table 3
Computational cost in milliseconds.
SchemesGeneralized signcrypt (ms)Generalized unsigncrypt (ms)Total (ms)Yu et al.’s scheme [13]33.3958.3886.23Kushwah et al.’s scheme [35]24.0550.7974.84Wei et al.’s scheme [36]62.4468.22130.66Shen et al.’s scheme [37]16.1224.0540.17Zhou et al.’s scheme [39]27.8334.1161.94Proposed2.882.405.28Table 4
Percentage improvement in computational cost.
SchemesTotal computational cost of extant scheme (x) (%)Total computational cost of proposed scheme (y) (%)z (using the formula∗∗) (%)Yu et al.’s scheme [13]86.235.2893.87Kushwah et al.’s scheme [35]74.845.2892.94Wei et al.’s scheme [36]130.665.2895.95Shen et al.’s scheme [37]40.175.2886.85Zhou et al.’s scheme [39]61.945.2891.47∗∗Percentage change, z = x − y/x ∗ 100.Figure 5
Computational cost (in ms).


### 8.2. Communication Cost

This section is dedicated to discuss the comparison results in the perspective of communication costs. The proposed approach is compared with the existing five schemes presented by Yu et al. [13], Kushwah et al. [35], Wei et al. [36], Shen et al. [37], and Zhou et al. [39]. In the comparative analysis, the variables used along with the respective values are shown in Table 5 [40].Table 5
Variables used for a communication cost comparison.
VariableValue (bits)|S|1024|Zq|160|Zn|80|H|512|m|1024|W|1024It is assumed that each of the schemes has associated communication costs as shown in Table6.Table 6
Communication cost.
SchemesCommunication costYu et al.’s scheme [13]|S| + |m|Kushwah et al.’s scheme [35]|S| + |m|Wei et al.’s scheme [36]7|S| + |m|Shen et al.’s scheme [37]4|S| + |m|Zhou et al.’s scheme [39]|S| + |m|Proposed scheme3|Zn| + |m|From Figure6, it is evident that a decision to opt for our proposed scheme results in a significant reduction in the associated communication costs. Table 7 depicts the percentage reduction in communication costs.Figure 6
Total communication cost (in bits).Table 7
Percentage reduction in communication cost.
SchemeEquation for evaluating reductionResulting reduction in communication cost (%)Yu et al.’s scheme [13](|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)38.28Kushwah et al.’s scheme [35](|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)38.28Wei et al.’s scheme [36](7|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)84.57Shen et al.’s scheme [37](4|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)75.31Zhou et al.’s scheme [39](|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)38.28


### 8.3. Security Functionalities

Here, the proposed scheme is compared with the existing schemes in terms of security functionalities. Table8 lists the comparison outcomes based on the following security parameters: unforgeability, integrity, replay attack, and formal analysis. From the table, it can be seen that none of the existing schemes offer a replay attack.Table 8
Comparison with relevant existing schemes.
SchemesSecurity functionalitiesInformalFormalUICRAFAYu et al.’s scheme [13]✓✓✓✗✗Kushwah et al.’s scheme [35]✓✓✓✗✗Wei et al.’s scheme [36]✓✓✓✗✗Shen et al.’s scheme [37]✓✓✓✗✗Zhou et al.’s scheme [39]✓✓✓✗✗Proposed✓✓✓✓✓U: unforgeability, I: integrity, RA: replay attack, FA: formal analysis. The symbol ✓ satisfies the security functionality; ✗ does not satisfy the security functionality.


## 8.1. Computational Cost

For evaluating the effectiveness, the proposed scheme is compared with five existing schemes proposed by Yu et al. [13], Kushwah et al. [35], Wei et al. [36], Shen et al. [37], and Zhou et al. [39]. The major findings obtained from the comparison are depicted in Table 2. The five existing schemes utilize elliptic curve scalar multiplication and bilinear pairings, both of which are costlier options. Therefore, we apply the hyperelliptic divisor multiplication. From the observations, it has been revealed that the time taken for processing a single scalar multiplication varies considerably: Elliptic Curve Point Multiplication (ECPM), 0.97 ms; bilinear pairing, 14.90 ms; pairing-based point multiplications, 4.31 ms; and modular exponentiation, 1.25 ms [44]. In order to measure the performance of the proposed scheme, the Multiprecision Integer and Rational Arithmetic C Library (MIRACL) [12] is used. It tests the runtime of the basic cryptographic operations for about 1000 times. For testing the simulation results, a workstation having the following specifications is used: Intel Core i7- 4510U CPU @ 2.0 GHz, 8 GB RAM, and Windows 7 Home Basic 64-bit Operating System [42]. Owing to a smaller key size of 80 bits, the Hyperelliptic Curve Divisor Multiplication (HCDM) is assumed to be of 0.48-millisecond duration [45, 46].Table 2
Computational cost.
SchemesGeneralized signcryptGeneralized unsigncryptTotalYu et al.’s scheme [13]4bpm + 1bp + 1mexp1bpm + 3bp + 3mexp5bpm + 4bp + 4mexpKushwah et al.’s scheme [35]5bpm + 2mexp4bpm + 2bp + 3mexp9bpm + 2bp + 5mexpWei et al.’s scheme [36]9bpm + 1bp + 7mexp2bpm + 4bp11bpm + 5bp + 7mexpShen et al.’s scheme [37]2bpm + 6mxp5bpm + 2mexp7bpm + 8mexpZhou et al.’s scheme [39]3bpm + 1bp1bpm + 2bp4bpm + 3bpProposed6 hm5 hm11 hmhm = hyperelliptic curve divisor multiplication, em = elliptic curve scalar multiplication, bp = bilinear pairing, bpm = pairing-based point multiplications, mexp = modular exponentiation.From the findings in Tables2–4 and Figure 5, it is evident that our approach is far more efficient in terms of computational costs.Table 3
Computational cost in milliseconds.
SchemesGeneralized signcrypt (ms)Generalized unsigncrypt (ms)Total (ms)Yu et al.’s scheme [13]33.3958.3886.23Kushwah et al.’s scheme [35]24.0550.7974.84Wei et al.’s scheme [36]62.4468.22130.66Shen et al.’s scheme [37]16.1224.0540.17Zhou et al.’s scheme [39]27.8334.1161.94Proposed2.882.405.28Table 4
Percentage improvement in computational cost.
SchemesTotal computational cost of extant scheme (x) (%)Total computational cost of proposed scheme (y) (%)z (using the formula∗∗) (%)Yu et al.’s scheme [13]86.235.2893.87Kushwah et al.’s scheme [35]74.845.2892.94Wei et al.’s scheme [36]130.665.2895.95Shen et al.’s scheme [37]40.175.2886.85Zhou et al.’s scheme [39]61.945.2891.47∗∗Percentage change, z = x − y/x ∗ 100.Figure 5
Computational cost (in ms).


## 8.2. Communication Cost

This section is dedicated to discuss the comparison results in the perspective of communication costs. The proposed approach is compared with the existing five schemes presented by Yu et al. [13], Kushwah et al. [35], Wei et al. [36], Shen et al. [37], and Zhou et al. [39]. In the comparative analysis, the variables used along with the respective values are shown in Table 5 [40].Table 5
Variables used for a communication cost comparison.
VariableValue (bits)|S|1024|Zq|160|Zn|80|H|512|m|1024|W|1024It is assumed that each of the schemes has associated communication costs as shown in Table6.Table 6
Communication cost.
SchemesCommunication costYu et al.’s scheme [13]|S| + |m|Kushwah et al.’s scheme [35]|S| + |m|Wei et al.’s scheme [36]7|S| + |m|Shen et al.’s scheme [37]4|S| + |m|Zhou et al.’s scheme [39]|S| + |m|Proposed scheme3|Zn| + |m|From Figure6, it is evident that a decision to opt for our proposed scheme results in a significant reduction in the associated communication costs. Table 7 depicts the percentage reduction in communication costs.Figure 6
Total communication cost (in bits).Table 7
Percentage reduction in communication cost.
SchemeEquation for evaluating reductionResulting reduction in communication cost (%)Yu et al.’s scheme [13](|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)38.28Kushwah et al.’s scheme [35](|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)38.28Wei et al.’s scheme [36](7|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)84.57Shen et al.’s scheme [37](4|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)75.31Zhou et al.’s scheme [39](|S| + |m|) − (3|Zn| + |m|)/(|S| + |m|)38.28


## 8.3. Security Functionalities

Here, the proposed scheme is compared with the existing schemes in terms of security functionalities. Table8 lists the comparison outcomes based on the following security parameters: unforgeability, integrity, replay attack, and formal analysis. From the table, it can be seen that none of the existing schemes offer a replay attack.Table 8
Comparison with relevant existing schemes.
SchemesSecurity functionalitiesInformalFormalUICRAFAYu et al.’s scheme [13]✓✓✓✗✗Kushwah et al.’s scheme [35]✓✓✓✗✗Wei et al.’s scheme [36]✓✓✓✗✗Shen et al.’s scheme [37]✓✓✓✗✗Zhou et al.’s scheme [39]✓✓✓✗✗Proposed✓✓✓✓✓U: unforgeability, I: integrity, RA: replay attack, FA: formal analysis. The symbol ✓ satisfies the security functionality; ✗ does not satisfy the security functionality.


## 9. Flying Ad Hoc Network-Based Precision Agriculture: A Case Study

To further assess the practicability, the proposed scheme is applied to a precision agriculture case that involves FANETs for monitoring the health of the crops. Small UAVs are used to capture the images, which are, in the next step, processed to extract useful information. Values from the Normalized Difference Vegetation Index (NDVI) are computed to differentiate healthy plants from the nonhealthy ones. This is done by measuring the chlorophyll content. It further helps in the localization of the area under stress. The images captured by the M-UAVs are transferred to the MEC-UAV, which, utilizing the onboard microcontroller, generates the respective tasks to be carried on by the Decision Support Engine (DSE). For value addition and versatility, the M-UAVs can have additional gadgets, such as cameras, IMU, sensors, and GPS units. The web portal contains a variety of services such as visualization of historical/real data, NDVI mapping, and the correlation functionality.


## 10. Conclusions

There is an evolving trend of combining multiple small UAVs, as a flying ad hoc network (FANET), to cater to the needs of future applications that demand autonomy and pervasiveness. However, the small UAVs inherent limited onboard energy and restricted computational capability. Such limitations hinder their deployment for longer time-intervals and complex cryptographic operations. Addressing such deficiency, in this article, utilizing the concept of the hyperelliptic curve (HEC), we propose an efficient lightweight security scheme, called identity-based generalized signcryption. The scheme is based on multiaccess edge computing (MEC). The HEC approach is effective in generating small keys and is, therefore, suitable for low-computational devices such as small UAVs. Both formal and informal security analyses, using the AVISPA tool, demonstrate the potency of the proposed scheme in thwarting various known and unknown cyberattacks. Moreover, upon comparative analysis with the major existing counterparts, the scheme has demonstrated to be efficient in terms of computational and communication costs.For our future work, we aim to complement the research work by including other aspects of formal analysis, such as the Real-Or-Random (ROR) model and Random Oracle Model (ROM). Moreover, we also intend to incorporate a computational offloading and scheduling mechanism, in which the M-UAVs will be able to offload and schedule the computing tasks to the MEC-UAV for improved processing power and faster execution.



---

*Source: 8861947-2020-07-01.xml*