# Privacy-Protection Scheme Based on Sanitizable Signature for Smart Mobile Medical Scenarios

Authors: Zhiyan Xu; Min Luo; Neeraj Kumar; Pandi Vijayakumar; Li Li
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

With the popularization of wireless communication and smart devices in the medical field, mobile medicine has attracted more and more attention because it can break through the limitations of time, space, and objects and provide more efficient and quality medical services. However, the characteristics of a mobile smart medical network make it more susceptible to security threats such as data integrity damage and privacy leakage than those of traditional wired networks. In recent years, many digital signature schemes have been proposed to alleviate some of these challenges. Unfortunately, traditional digital signatures cannot meet the diversity and privacy requirements of medical data applications. In response to this problem, this paper uses the unique security attributes of sanitizable signatures to carry out research on the security and privacy protection of medical data and proposes a data security and privacy protection scheme suitable for smart mobile medical scenarios. Security analysis and performance evaluation show that our new scheme effectively guarantees data security and user privacy while greatly reducing computation and communication costs, making it especially suitable for mobile smart medical application scenarios.


---

## Body

## 1. Introduction

With the swift development of the Internet and smart devices, mobile medicine has emerged at the historic moment. It is a new type of medical model that can break through the limitations of objective factors such as time, space, and objects. In mobile medical applications, smart devices can provide remote health monitoring and medical supervision for patients using wireless sensor networks [1, 2].Compared with the traditional medical model, the value of electronic medical records is no longer limited to the application of medical, scientific research, and teaching activities but more related to hospital management, insurance claims, judicial evidence collection, and preventive healthcare [3, 4]. The scope of application of medical information is getting wider and wider, and the utilization rate is getting higher and higher. Therefore, the authenticity and availability of the electronic medical information are critical to the correct use of medical data and to fully reflect the value of medical data sharing. A slight difference may endanger the safety of the patient’s life and property, causing irreparable losses [5].At the same time, medical data contains a lot of personal privacy, which may lead to the leakage of patient privacy in resource sharing [6, 7]. Unnecessary medical information leakage will cause patients to suffer unpredictable hazards such as loss of biological information, telephone fraud, and precise marketing and also seriously endanger the safety of people’s life and property [8, 9]. The problems of medical data security and privacy protection have become the biggest obstacles to the further development and promotion of the mobile medical industry.Digital signature is one of the important means to protect the authenticity and availability of medical data [10–12]. However, not all applications must obtain the complete electronic medical record. For example, when an electronic medical record is used for medical reimbursement, patients only need to provide the insurance company with real information about the treatment and insurance number. When the complete electronic medical record is provided, too much personal information unrelated to medical claims will be disclosed.To protect the privacy of patients, one of the solutions is to require the signer to only sign information related to medical claims [13]. However, whenever a new subset of the electronic medical record needs to be shared, the signer is required to repeat the signing process, which will generate excessively high computation costs, and sometimes, even the documents cannot be resigned due to the departure of the signer.Sanitizable signature [14] is a type of digital signature that supports controlled modification of signed messages. This feature makes it not only guarantee the integrity and authenticity of medical data but also effectively hide sensitive information of patients (specific sensitive information can be flexibly set according to different information sharing objects), which not only follows the “minimum necessary” disclosure standard of HIPAA privacy rules [15] but also promotes the use of value-added medical information and improves the efficiency of the scheme. Therefore, sanitizable signatures are very suitable for solving data security and privacy protection issues in smart mobile medical scenarios.


### 1.1. Our Research Contributions

We regard the main contributions of our scheme to be as follows:(i)
We propose a system model suitable for data security and privacy protection in smart mobile medical scenarios(ii)
We propose a privacy-protection scheme based on sanitizable signature for smart mobile medical scenarios (hereafter referred to as the PP-SS scheme).(iii)
We conduct security analysis and performance evaluation for the newly proposed PP-SS scheme


### 1.2. Organization of the Paper

The rest of the paper is organized as follows. Sections2 and 3 present related work and the problem statement, respectively. The new PP-SS scheme is proposed in Section 4. In Sections 5 and 6, we describe the security analysis and the performance evaluation, respectively. Finally, we conclude the paper in the last section.


## 1.1. Our Research Contributions

We regard the main contributions of our scheme to be as follows:(i)
We propose a system model suitable for data security and privacy protection in smart mobile medical scenarios(ii)
We propose a privacy-protection scheme based on sanitizable signature for smart mobile medical scenarios (hereafter referred to as the PP-SS scheme).(iii)
We conduct security analysis and performance evaluation for the newly proposed PP-SS scheme


## 1.2. Organization of the Paper

The rest of the paper is organized as follows. Sections2 and 3 present related work and the problem statement, respectively. The new PP-SS scheme is proposed in Section 4. In Sections 5 and 6, we describe the security analysis and the performance evaluation, respectively. Finally, we conclude the paper in the last section.


## 2. Related Work

The traditional digital signature does not allow any modification operation to the signed message; otherwise, the message signature is invalid [16, 17]. However, to achieve data integrity, authenticity, and availability while ensuring data privacy in smart mobile medical and many other application fields, users hope that signed messages can be modified in a controlled manner to derive new signed messages [18, 19].The concept of a sanitizable signature was first proposed by Ateniese et al. [14] in 2005, which can break through the limitations of traditional digital signatures and support an entity (sanitizer) designated by the original signer to modify the signed message within the scope of authorization and generate a new signature without any interaction with the signer. Compared with a traditional signature, it not only ensures data integrity but also solves the hidden problem of sensitive information and provides more flexibility.Brzuska et al. [20] gave the first formal security model for a sanitizable signature. Gong et al. [21] analyzed the formal security model proposed in [20] and pointed out that the security model is vulnerable to rights forgery attacks and then provided new definitions of attributes such as unforgeability and immutability. Subsequently, Krenn et al. [22] made further research on the above model and introduced stronger unforgeability and privacy.With the continuous development of sanitizable signature technology, it covers more application examples. Brzuska et al. [23] introduced unlinkability, which can ensure that the sanitized signature will not leak from the original signature; even if the original signature is known, it is difficult determine whether the two signatures are related. Subsequent literature [24] introduced noninteractive public accountability, which can facilitate the implementation of the multieye principle [25]. Pöhls et al. [26] proposed the concept of hidden attributes, which means that outsiders cannot know which parts of the signed message are allowed to be modified. Then, Camenisch et al. [27] gave a formal definition of the hidden attribute, and Beck et al. [28] reinforced the attribute. Very recently, Bultel et al. [29] proposed a new sanitizable signature scheme, but it did not perform well in terms of performance.At present, sanitizable signature schemes have been tried to be implemented on different devices, from desktops [28], to smart cards [30], and then to applications in XML signatures [20]. Before deploying the sanitizable signature scheme in practical applications, users must be aware of the possible legal consequences. Some researchers have proposed emergency properties to avoid some legal challenges [31, 32], because qualified digital signatures are equivalent to handwritten digital signatures in court. The value of concern is that a sanitizable signature scheme can be used to help a redactable signature [33] achieve accountability [34].


## 3. Problem Statement

The definitions of the equivalence class signature and system model of our proposed PP-SS scheme are presented in this section. System components and security requirements of the privacy-protection scheme based on a sanitizable signature for smart mobile medical scenarios are then described.


### 3.1. Equivalence Class Signature

We give the definition of equivalence class signature (EQS). For more details, please refer to Reference [35].Definition 1.
(EQS). An EQS signature scheme consists of the following five polynomial algorithms, whereG is the bilinear group and l is the length of a message.
(i)
KGen1l,G→pk,sk is a key generation algorithm; it inputs parameters 1l,G and outputs a key pair pk,sk(ii)
Signsk,M¯→σ is a signing algorithm; it inputs parameters sk,M¯ and outputs a signature σ on the equivalence class M¯R(iii)
ChgReppk,M¯,σ,ρ→σ′ is a change representation algorithm; it inputs parameters pk,M¯,σ,ρ and outputs a signature σ′ on the equivalence class M¯ρR(iv)
Vfparam,M¯,σ→b is a signature verification algorithm; it inputs parameters param,M¯,σ and outputs b, if b=1 and σ is a valid signature; otherwise, b=0 and σ is an invalid signature(v)
VfKeypk,sk→b is a key verification algorithm; it inputs parameters pk,sk and outputs b, if b=1 the keys are consistent; otherwise, b=0 and the keys are consistent


### 3.2. System Model

The architecture of our smart mobile medical scenarios is shown in Figure1, and there are six types of entities in a privacy-protection scheme based on a sanitizable signature scheme: trusted authority, smart medical device, medical server, signer, sanitizer, and verifier. Each entity is specifically defined as follows:
(i)
Trusted authority. A trusted authority is responsible for initializing the system and generating system parameters(ii)
Smart medical device. A smart medical device refers to a portable or wearable medical device used to monitor the health status of patients and give timely feedback to medical experts to get better medical services(iii)
Medical server. A medical server is a device with strong computing power and plenty of storage space, which can handle a large amount of data received from smart medical devices(iv)
Signer. A signer is usually a doctor who is responsible for completing the setting of relevant parameters that allow modification of the content, the authorization of the semitrust sanitizer, and the signature of the original message(v)
Sanitizer. A sanitizer is usually a semitrusted third party authorized by the signer, responsible for modifying the specified content within the scope of the signer’s authorization and generating a signature on the sanitized message(vi)
Verifier. A verifier is usually a medical data sharing entity which refers to the beneficiaries of medical data sharing, such as insurance companies, scientific research centers, and medical institutions, who can verify the validity of the message signature before and after sanitization and the legality of the identity of the signer and sanitizerFigure 1
The architecture of our smart mobile medical scenarios.


### 3.3. System Components

Our proposed PP-SS scheme is a collection of the following six polynomial time algorithms:(i)
Setup1λ→params is a probabilistic algorithm to complete system initialization, where λ is a security parameter and params is the system parameters(ii)
Extract‐SKeyparams→SKs,PKs is a probabilistic algorithm to generate key pairs for the signer(iii)
Extract‐ZKeyparams→SKz,PKz is a probabilistic algorithm to generate key pairs for the sanitizer(iv)
Signparams,m,SKs,PKz,α,→σ is a randomized algorithm to generate an original signature, where m=mi is the message, α is a description of the admissible modifications to m, and σ=σi is the signature of message m, and i∈1,ι(v)
Sanitizeparams,m,PKs,SKz,ξ→m′,σ′ is a randomized algorithm to generate a sanitized signature, where ξ is a description of information that needs to be modified on m, m′ is the sanitized message, σ′=σi′ is the signature of sanitized message m′, and i∈1,ι(vi)
Verifyparams,PKs,PKz,m,σ→0,1 is a deterministic algorithm to verify the validity of the signature σ, with 1 or 0 as outputs to indicate whether the message m keeps intergrity


### 3.4. Security Requirements

A privacy-protection scheme based on a sanitizable signature needs to satisfy the following functions and security requirements:(i)
Integrity. To ensure that a verifier can check the message integrity by verifying the validity of the signature(ii)
Unforgeability. To ensure that the signature can be proven whether it is generated by the signer or sanitizer, and no one can forge the signature generated by the signer or sanitizer(iii)
Privacy. On the premise of maintaining the validity of the original signature, the sanitizer can be allowed to sanitize the sensitive information in the signed message, and no one can distinguish whether the message has been sanitized


## 3.1. Equivalence Class Signature

We give the definition of equivalence class signature (EQS). For more details, please refer to Reference [35].Definition 1.
(EQS). An EQS signature scheme consists of the following five polynomial algorithms, whereG is the bilinear group and l is the length of a message.
(i)
KGen1l,G→pk,sk is a key generation algorithm; it inputs parameters 1l,G and outputs a key pair pk,sk(ii)
Signsk,M¯→σ is a signing algorithm; it inputs parameters sk,M¯ and outputs a signature σ on the equivalence class M¯R(iii)
ChgReppk,M¯,σ,ρ→σ′ is a change representation algorithm; it inputs parameters pk,M¯,σ,ρ and outputs a signature σ′ on the equivalence class M¯ρR(iv)
Vfparam,M¯,σ→b is a signature verification algorithm; it inputs parameters param,M¯,σ and outputs b, if b=1 and σ is a valid signature; otherwise, b=0 and σ is an invalid signature(v)
VfKeypk,sk→b is a key verification algorithm; it inputs parameters pk,sk and outputs b, if b=1 the keys are consistent; otherwise, b=0 and the keys are consistent


## 3.2. System Model

The architecture of our smart mobile medical scenarios is shown in Figure1, and there are six types of entities in a privacy-protection scheme based on a sanitizable signature scheme: trusted authority, smart medical device, medical server, signer, sanitizer, and verifier. Each entity is specifically defined as follows:
(i)
Trusted authority. A trusted authority is responsible for initializing the system and generating system parameters(ii)
Smart medical device. A smart medical device refers to a portable or wearable medical device used to monitor the health status of patients and give timely feedback to medical experts to get better medical services(iii)
Medical server. A medical server is a device with strong computing power and plenty of storage space, which can handle a large amount of data received from smart medical devices(iv)
Signer. A signer is usually a doctor who is responsible for completing the setting of relevant parameters that allow modification of the content, the authorization of the semitrust sanitizer, and the signature of the original message(v)
Sanitizer. A sanitizer is usually a semitrusted third party authorized by the signer, responsible for modifying the specified content within the scope of the signer’s authorization and generating a signature on the sanitized message(vi)
Verifier. A verifier is usually a medical data sharing entity which refers to the beneficiaries of medical data sharing, such as insurance companies, scientific research centers, and medical institutions, who can verify the validity of the message signature before and after sanitization and the legality of the identity of the signer and sanitizerFigure 1
The architecture of our smart mobile medical scenarios.


## 3.3. System Components

Our proposed PP-SS scheme is a collection of the following six polynomial time algorithms:(i)
Setup1λ→params is a probabilistic algorithm to complete system initialization, where λ is a security parameter and params is the system parameters(ii)
Extract‐SKeyparams→SKs,PKs is a probabilistic algorithm to generate key pairs for the signer(iii)
Extract‐ZKeyparams→SKz,PKz is a probabilistic algorithm to generate key pairs for the sanitizer(iv)
Signparams,m,SKs,PKz,α,→σ is a randomized algorithm to generate an original signature, where m=mi is the message, α is a description of the admissible modifications to m, and σ=σi is the signature of message m, and i∈1,ι(v)
Sanitizeparams,m,PKs,SKz,ξ→m′,σ′ is a randomized algorithm to generate a sanitized signature, where ξ is a description of information that needs to be modified on m, m′ is the sanitized message, σ′=σi′ is the signature of sanitized message m′, and i∈1,ι(vi)
Verifyparams,PKs,PKz,m,σ→0,1 is a deterministic algorithm to verify the validity of the signature σ, with 1 or 0 as outputs to indicate whether the message m keeps intergrity


## 3.4. Security Requirements

A privacy-protection scheme based on a sanitizable signature needs to satisfy the following functions and security requirements:(i)
Integrity. To ensure that a verifier can check the message integrity by verifying the validity of the signature(ii)
Unforgeability. To ensure that the signature can be proven whether it is generated by the signer or sanitizer, and no one can forge the signature generated by the signer or sanitizer(iii)
Privacy. On the premise of maintaining the validity of the original signature, the sanitizer can be allowed to sanitize the sensitive information in the signed message, and no one can distinguish whether the message has been sanitized


## 4. Our Proposed PP-SS Scheme

Our proposed PP-SS scheme includes six phases, namely,Setup phase, Extract‐SKey phase, Extract‐ZKey phase, Sign phase, Sanitize phase, and Verify phase.


### 4.1. Setup

The trusted authority generates system parameters after obtaining the security parameterλ by executing the following operations:
(1)
Generate two cyclic addition groupsG1, G2 and one multiplication group GT with the same order q, where q is a prime. P is a generator of G1. e:G1×G2→GT is a bilinear pairing(2)
Select one hash function:H:0,1∗→G2(3)
Publish system parameter listparams=λ,G1,G2,GT,P,e,q,H


### 4.2. Extract-SKey

The signer produces his public-private key by executing the following operations:(1)
Select random valuesx1, x2, y1, y2∈Zq∗(2)
ComputeX1=Px1, X2=Px2 and set X=X1,X2(3)
ComputeY1=X1y1, Y2=X1y2 and set Y=Y1,Y2(4)
SetPKs=X,Y as signer’s public key and SKs=x1,x2,y1,y2 as signer’s private key


### 4.3. Extract-ZKey

The sanitizer produces his public-private key by executing the following operations:(1)
Select random valuex∈Zq∗ and set SKz=x as the sanitizer’s private key(2)
ComputePKz=x·P as the sanitizer’s public key


### 4.4. Sign

The signer produces the signatureσ on the message m=m1∥m2∥⋯∥mι by executing the following operations:
(1)
Input system parametersparams, signer’s private key SKs, sanitizer’s public key PKz, message m, and a description α of the admissible modifications to m(2)
Computeϑ=EQS·SignSKsX and ω=EQS·SignSKsY(3)
Computeσi=Hi∥miςi for i=1,2,⋯,ι, where(1)ςi=y1,ifi∈α,0,Otherwise,and set σ=σ1,σ2,⋯,σι as the signature of message m(4)
Choose a random numberr∈Zq∗ and compute R=rP, Q=rPKz(5)
SetR=xR,yR,Q=xQ,yQ(6)
Computec=xQ∥yQ⊕α∥y1(7)
Returnϑ,ω,X,Y,R,σ=σi1ι,c


### 4.5. Sanitization

The sanitizer completes the modification of the messagem and produces the signature σ′ for the sanitized message m′ by executing the following operations:
(1)
Input system parametersparams, signer’s public key PKs, sanitizer’s private key SKz, message m, signature σ, and a description ξ of the admissible modifications to m(2)
Computeθ=SKz·R and set θ=xθ,yθ(3)
Computexθ∥yθ⊕c to get α∥y1(4)
Ifξ∈α, then excute m′=ξm; otherwise, return ⊥(5)
Select random valuesu, v∈Zq∗ as randomization factors(6)
ComputeX′=X1′,X2′=X1u,X2u and Y′=Y1′,Y2′=Y1u.v,Y2u.v and set PKs′=X′,Y′(7)
Computeϑ′=EQS·ChgRepPKsX1,X2,ϑ,u) and ω′=EQS·ChgRepPKsY1,Y2,ω,u·v)(8)
Computey1′=v·y1(9)
Fori=1,2,⋯,ι, compute(2)σi′=Hi∥mi′ςi′,ifi∈α,σiv,Otherwise,where ςi′=y1′(10)
Returnϑ′,ω′,X′,Y′,σ′=σi′1ι


### 4.6. Verification

The verifier verifies the signatureσ′ of message m′ by executing the following operations:
(1)
Input system parametersparams, signer’s public key PKs′, sanitizer’s public key PKz, message m′, signature σ′, and a description ξ of the admissible modifications to m(2)
Fori=1,2,⋯,ι, compute(3)bi=eXi′,σi′=eYi′,Hi∥mi′,where
(4)Xi′=X1′,ifi∈ξ,X2′,Otherwise,Yi′=Y1′,ifi∈ξ,Y2′,Otherwise(3)
Compute(5)b=∏i=1ιbi(4)
Ifb=1, accept σ′; otherwise, reject σ′


## 4.1. Setup

The trusted authority generates system parameters after obtaining the security parameterλ by executing the following operations:
(1)
Generate two cyclic addition groupsG1, G2 and one multiplication group GT with the same order q, where q is a prime. P is a generator of G1. e:G1×G2→GT is a bilinear pairing(2)
Select one hash function:H:0,1∗→G2(3)
Publish system parameter listparams=λ,G1,G2,GT,P,e,q,H


## 4.2. Extract-SKey

The signer produces his public-private key by executing the following operations:(1)
Select random valuesx1, x2, y1, y2∈Zq∗(2)
ComputeX1=Px1, X2=Px2 and set X=X1,X2(3)
ComputeY1=X1y1, Y2=X1y2 and set Y=Y1,Y2(4)
SetPKs=X,Y as signer’s public key and SKs=x1,x2,y1,y2 as signer’s private key


## 4.3. Extract-ZKey

The sanitizer produces his public-private key by executing the following operations:(1)
Select random valuex∈Zq∗ and set SKz=x as the sanitizer’s private key(2)
ComputePKz=x·P as the sanitizer’s public key


## 4.4. Sign

The signer produces the signatureσ on the message m=m1∥m2∥⋯∥mι by executing the following operations:
(1)
Input system parametersparams, signer’s private key SKs, sanitizer’s public key PKz, message m, and a description α of the admissible modifications to m(2)
Computeϑ=EQS·SignSKsX and ω=EQS·SignSKsY(3)
Computeσi=Hi∥miςi for i=1,2,⋯,ι, where(1)ςi=y1,ifi∈α,0,Otherwise,and set σ=σ1,σ2,⋯,σι as the signature of message m(4)
Choose a random numberr∈Zq∗ and compute R=rP, Q=rPKz(5)
SetR=xR,yR,Q=xQ,yQ(6)
Computec=xQ∥yQ⊕α∥y1(7)
Returnϑ,ω,X,Y,R,σ=σi1ι,c


## 4.5. Sanitization

The sanitizer completes the modification of the messagem and produces the signature σ′ for the sanitized message m′ by executing the following operations:
(1)
Input system parametersparams, signer’s public key PKs, sanitizer’s private key SKz, message m, signature σ, and a description ξ of the admissible modifications to m(2)
Computeθ=SKz·R and set θ=xθ,yθ(3)
Computexθ∥yθ⊕c to get α∥y1(4)
Ifξ∈α, then excute m′=ξm; otherwise, return ⊥(5)
Select random valuesu, v∈Zq∗ as randomization factors(6)
ComputeX′=X1′,X2′=X1u,X2u and Y′=Y1′,Y2′=Y1u.v,Y2u.v and set PKs′=X′,Y′(7)
Computeϑ′=EQS·ChgRepPKsX1,X2,ϑ,u) and ω′=EQS·ChgRepPKsY1,Y2,ω,u·v)(8)
Computey1′=v·y1(9)
Fori=1,2,⋯,ι, compute(2)σi′=Hi∥mi′ςi′,ifi∈α,σiv,Otherwise,where ςi′=y1′(10)
Returnϑ′,ω′,X′,Y′,σ′=σi′1ι


## 4.6. Verification

The verifier verifies the signatureσ′ of message m′ by executing the following operations:
(1)
Input system parametersparams, signer’s public key PKs′, sanitizer’s public key PKz, message m′, signature σ′, and a description ξ of the admissible modifications to m(2)
Fori=1,2,⋯,ι, compute(3)bi=eXi′,σi′=eYi′,Hi∥mi′,where
(4)Xi′=X1′,ifi∈ξ,X2′,Otherwise,Yi′=Y1′,ifi∈ξ,Y2′,Otherwise(3)
Compute(5)b=∏i=1ιbi(4)
Ifb=1, accept σ′; otherwise, reject σ′


## 5. Security Analysis

### 5.1. Correctness

Our proposed sanitizable signature scheme is correct if and only if the sanitized signature generated from our scheme can satisfy Equation (3), where the correctness of the scheme is elaborated as follows, where i∈1,2,⋯ι:
(6)eXi′,σi′=eXi′,Hi∥mi′yi′=eXi′yi′,Hi∥mi′=eYi′,Hi∥mi′.


### 5.2. Provable Security

In this section, we demonstrate that our presented PP-SS scheme has perfect strong transparency against adversaries as defined in [29].Definition 2.
(transparency). Transparency is also indistinguishability, which means that the sanitized signature looks like it has not been sanitized. It requires that one cannot decide whether the signature is sanitized or nonsanitized without the help of the oracle [22].Theorem 3.
A sanitizable signature scheme is perfectly strongly transparent if for all probability polynomial time adversaries A,Asanitize
(7)PrExpTransA0λ=1=PrExpTransA1λ=1,
whereExpTransAb is the security experiments of transparency for sanitizable signatures.Proof.
We prove that the scheme has perfectly strong transparency through the hybrid argument. Now, letq denote the maximum number of times that adversary A can query the Sign/SanOb oracle, and define the hybrid variables Hb0, Hb1,..., Hbq as follows.Hb0 is identical to ExpTransA0λ. For j∈1,2,⋯,q, Hbj is almost the same as the value of Hbj−1, except for the answer of the j-th query to Sign/SanOb is ExpTransA1λ. That is to say, the answer of the first j-th query to Sign/SanOb is the sanitized signature, and the remaining q-j signatures are unsanitized (original) signatures. It should be noted that Hbq=ExpTransA1λ. Obviously, if PrHbj−1=1=PrHbj=1 for j∈1,2,⋯,q, then ExpTransA1λ=ExpTransA0λ holds.Forj∈1,2,⋯,q, we demonstrate that PrHbj−1=1=PrHbj=1 as below. Let the tuple m,ξ,α be the j-th query of adversary A to Sign/SanOb oracle, if ξ∉α, then oracle returns ⊥ and the equality holds trivially. Otherwise, let m′≔ξm and σ′ be the answer. The signature σ′ comes from the mathematical distribution D, where
(8)D≔xi,yi∈Zq∗,Xi≔Pxi,Yi≔Xiyi,i∈ιϑ=EQS·SignSKsX1,X2ω=EQS·SignSKsY1,Y2σi=Hi∥mi′ςi,i∈ιςi=y1,ifi∈α0,OtherwiseR=rP,Q=rPKz.c=xQ∥yQ⊕α∥y1.σ=u,v,σi,Xi,Yii=1ι,c.Replacingxi and yi with u·xi and v·yi, respectively, for some u,v∈Zq∗, we can obtain a mathematical distribution D′=D, where
(9)D′≔u,v∈Zq∗xi,yi∈Zq∗,Xi≔Pxi,Yi≔Xiyi,i∈ιϑ=EQS·SignSKsX1,X2uω=EQS·SignSKsY1,Y2u·vσi=Hi∥mi′ςi′,i∈ιςi′=v·y1,ifi∈α0,OtherwiseR=rP,Q=rPKz.c=xQ∥yQ⊕α∥y1.σ=u,v,σi,Xiu,Yiu·vi=1ι,c.Because of the perfect adaption ofEQS [35], the distribution of ϑ=EQS·SignSKsX1,X2u and ω=EQS·SignSKsY1,Y2u·v is the same as that of ChgRepPKsX1,X2,ϑ′,u) and ChgRepPKsY1,Y2,ω′,u·v), where ϑ′=EQS·SignSKsX1,X2, ω′=EQS·SignSKsY1,Y2. Then, we can obtain a distribution D′=D′′, and we have
(10)D′′≔u,v∈Zq∗xi,yi∈Zq∗,Xi≔Pxi,Yi≔Xiyi,i∈ιϑ′=EQS·SignSKsX1,X2ω′=EQS·SignSKsY1,Y2ϑ=ChgRepPKsX1,X2,ϑ′,uω=ChgRepPKsY1,Y2,ω′,u·vσi=Hi∥mi′ςi′,i∈ιςi′=v·y1,ifi∈α0,OtherwiseR=rP,Q=rPKz.c=xQ∥yQ⊕α∥y1.σ=u,v,σi,Xiu,Yiu·vi=1ι,c.From the above derivation process, it is easy to find that inHbj, the signature σ′ completely came from D′′. Therefore, we can conclude that Hbj−1 and Hbj are equivalent in function.


### 5.3. Comparative Summary: Security Properties

We show that our PP-SS scheme can meet all the security requirements presented in Section3.
(i)
Integrity. The PP-SS scheme proposed in this paper has the characteristics of a traditional digital signature. Before sharing medical data, first sign it, and then the verifier can determine the integrity of the medical data by verifying the signature of the message(ii)
Unforgeability. The PP-SS scheme proposed in this paper introduces Fuchsbauer et al.’s EQS scheme, which has been proven to be unforgeable under chosen message attacks [35], which can ensure no one can forge the signature generated by the signer or sanitizer(iii)
Sanitization. The sanitizer in our proposed PP-SS scheme in this paper can be allowed to sanitize the information in the signed message, which can effectively hide the patient’s sensitive information(iv)
Privacy. The PP-SS scheme proposed in this paper can effectively hide the patient’s sensitive information, and the unsanitized signature and the sanitized signature generated from our PP-SS scheme are indistinguishable as proven in Section 5.2, which effectively protects the privacy of the patient


### 5.4. Comparative Summary: Security Comparison

As can be seen from Table1, we observe that Jiang et al.’s scheme [16], Wu et al.’s scheme [17], Bultel et al.’s scheme [29], and our proposed PP-SS scheme can all meet the integrity and unforgeability. Only our PP-SS scheme can satisfy the sanitization and privacy. Suppose a patient agrees to share his electronic medical record with other medical research institutions through a third-party platform (hospital) but does not want to expose the privacy information such as the identity in the message. If users try to solve the above problems using the schemes of Jiang et al. or Wu et al., they will find that both of them can only obscure the identity of the information publisher, but cannot effectively hide user privacy information contained in the message.Table 1
Comparative summary: security properties.
Jiang et al.’s scheme [16]Wu et al.’s scheme [17]Bultel et al.’s scheme [29]Our schemeIntegrity✓✓✓✓Unforgeability✓✓✓✓Sanitization××✓✓Privacy××✓✓In Bultel et al.’s scheme [29] and our PP-SS scheme, patients can entrust a third-party platform as a sanitizer to modify the privacy information specified by the original signer in the message. In addition, both of them can meet the indistinguishability and the attacker cannot obtain the user’s private information, which can effectively protect the privacy of the user’s sensitive information. Comparatively speaking, Bultel et al.’s scheme and our PP-SS scheme satisfy all four security requirements in Table 1 and outperform the two other schemes in terms of data security and privacy protection.


## 5.1. Correctness

Our proposed sanitizable signature scheme is correct if and only if the sanitized signature generated from our scheme can satisfy Equation (3), where the correctness of the scheme is elaborated as follows, where i∈1,2,⋯ι:
(6)eXi′,σi′=eXi′,Hi∥mi′yi′=eXi′yi′,Hi∥mi′=eYi′,Hi∥mi′.


## 5.2. Provable Security

In this section, we demonstrate that our presented PP-SS scheme has perfect strong transparency against adversaries as defined in [29].Definition 2.
(transparency). Transparency is also indistinguishability, which means that the sanitized signature looks like it has not been sanitized. It requires that one cannot decide whether the signature is sanitized or nonsanitized without the help of the oracle [22].Theorem 3.
A sanitizable signature scheme is perfectly strongly transparent if for all probability polynomial time adversaries A,Asanitize
(7)PrExpTransA0λ=1=PrExpTransA1λ=1,
whereExpTransAb is the security experiments of transparency for sanitizable signatures.Proof.
We prove that the scheme has perfectly strong transparency through the hybrid argument. Now, letq denote the maximum number of times that adversary A can query the Sign/SanOb oracle, and define the hybrid variables Hb0, Hb1,..., Hbq as follows.Hb0 is identical to ExpTransA0λ. For j∈1,2,⋯,q, Hbj is almost the same as the value of Hbj−1, except for the answer of the j-th query to Sign/SanOb is ExpTransA1λ. That is to say, the answer of the first j-th query to Sign/SanOb is the sanitized signature, and the remaining q-j signatures are unsanitized (original) signatures. It should be noted that Hbq=ExpTransA1λ. Obviously, if PrHbj−1=1=PrHbj=1 for j∈1,2,⋯,q, then ExpTransA1λ=ExpTransA0λ holds.Forj∈1,2,⋯,q, we demonstrate that PrHbj−1=1=PrHbj=1 as below. Let the tuple m,ξ,α be the j-th query of adversary A to Sign/SanOb oracle, if ξ∉α, then oracle returns ⊥ and the equality holds trivially. Otherwise, let m′≔ξm and σ′ be the answer. The signature σ′ comes from the mathematical distribution D, where
(8)D≔xi,yi∈Zq∗,Xi≔Pxi,Yi≔Xiyi,i∈ιϑ=EQS·SignSKsX1,X2ω=EQS·SignSKsY1,Y2σi=Hi∥mi′ςi,i∈ιςi=y1,ifi∈α0,OtherwiseR=rP,Q=rPKz.c=xQ∥yQ⊕α∥y1.σ=u,v,σi,Xi,Yii=1ι,c.Replacingxi and yi with u·xi and v·yi, respectively, for some u,v∈Zq∗, we can obtain a mathematical distribution D′=D, where
(9)D′≔u,v∈Zq∗xi,yi∈Zq∗,Xi≔Pxi,Yi≔Xiyi,i∈ιϑ=EQS·SignSKsX1,X2uω=EQS·SignSKsY1,Y2u·vσi=Hi∥mi′ςi′,i∈ιςi′=v·y1,ifi∈α0,OtherwiseR=rP,Q=rPKz.c=xQ∥yQ⊕α∥y1.σ=u,v,σi,Xiu,Yiu·vi=1ι,c.Because of the perfect adaption ofEQS [35], the distribution of ϑ=EQS·SignSKsX1,X2u and ω=EQS·SignSKsY1,Y2u·v is the same as that of ChgRepPKsX1,X2,ϑ′,u) and ChgRepPKsY1,Y2,ω′,u·v), where ϑ′=EQS·SignSKsX1,X2, ω′=EQS·SignSKsY1,Y2. Then, we can obtain a distribution D′=D′′, and we have
(10)D′′≔u,v∈Zq∗xi,yi∈Zq∗,Xi≔Pxi,Yi≔Xiyi,i∈ιϑ′=EQS·SignSKsX1,X2ω′=EQS·SignSKsY1,Y2ϑ=ChgRepPKsX1,X2,ϑ′,uω=ChgRepPKsY1,Y2,ω′,u·vσi=Hi∥mi′ςi′,i∈ιςi′=v·y1,ifi∈α0,OtherwiseR=rP,Q=rPKz.c=xQ∥yQ⊕α∥y1.σ=u,v,σi,Xiu,Yiu·vi=1ι,c.From the above derivation process, it is easy to find that inHbj, the signature σ′ completely came from D′′. Therefore, we can conclude that Hbj−1 and Hbj are equivalent in function.


## 5.3. Comparative Summary: Security Properties

We show that our PP-SS scheme can meet all the security requirements presented in Section3.
(i)
Integrity. The PP-SS scheme proposed in this paper has the characteristics of a traditional digital signature. Before sharing medical data, first sign it, and then the verifier can determine the integrity of the medical data by verifying the signature of the message(ii)
Unforgeability. The PP-SS scheme proposed in this paper introduces Fuchsbauer et al.’s EQS scheme, which has been proven to be unforgeable under chosen message attacks [35], which can ensure no one can forge the signature generated by the signer or sanitizer(iii)
Sanitization. The sanitizer in our proposed PP-SS scheme in this paper can be allowed to sanitize the information in the signed message, which can effectively hide the patient’s sensitive information(iv)
Privacy. The PP-SS scheme proposed in this paper can effectively hide the patient’s sensitive information, and the unsanitized signature and the sanitized signature generated from our PP-SS scheme are indistinguishable as proven in Section 5.2, which effectively protects the privacy of the patient


## 5.4. Comparative Summary: Security Comparison

As can be seen from Table1, we observe that Jiang et al.’s scheme [16], Wu et al.’s scheme [17], Bultel et al.’s scheme [29], and our proposed PP-SS scheme can all meet the integrity and unforgeability. Only our PP-SS scheme can satisfy the sanitization and privacy. Suppose a patient agrees to share his electronic medical record with other medical research institutions through a third-party platform (hospital) but does not want to expose the privacy information such as the identity in the message. If users try to solve the above problems using the schemes of Jiang et al. or Wu et al., they will find that both of them can only obscure the identity of the information publisher, but cannot effectively hide user privacy information contained in the message.Table 1
Comparative summary: security properties.
Jiang et al.’s scheme [16]Wu et al.’s scheme [17]Bultel et al.’s scheme [29]Our schemeIntegrity✓✓✓✓Unforgeability✓✓✓✓Sanitization××✓✓Privacy××✓✓In Bultel et al.’s scheme [29] and our PP-SS scheme, patients can entrust a third-party platform as a sanitizer to modify the privacy information specified by the original signer in the message. In addition, both of them can meet the indistinguishability and the attacker cannot obtain the user’s private information, which can effectively protect the privacy of the user’s sensitive information. Comparatively speaking, Bultel et al.’s scheme and our PP-SS scheme satisfy all four security requirements in Table 1 and outperform the two other schemes in terms of data security and privacy protection.


## 6. Comparative Summary: Performance

In this section, we analyze the performance of our proposed PP-SS scheme by evaluating the computation and communication costs.


### 6.1. Computation Costs

We evaluate the performance of our new proposal and Bultel et al.’s scheme [29]. In the specific implementation, we choose a nonsingular elliptic curve E:y2=x3+ax+b mod q, and a, b∈Zq∗, G is the additive group with the order q on E, security parameter ∣λ∣=80 bits, and p and q are both prime numbers with a length of 160 bits. We run the simulation experiment using the MIRACL library [36] on a personal computer (Intel core with I7-4770@3.4 GHz CPU, 4 GB random memory, and Windows 7 operating system). The running time of different operations is shown in Table 2.Table 2
Running time of different operations (ms).
NotationsOperationsTimeTexpA modular exponentiation operation3.8636TpaA point addition operation0.0018TpmA point multiplication operation0.4421TbpA bilinear pair operation4.2110TmtpA hash to point operation4.4060BecauseSetup, Extract‐SKey, and Extract‐ZKey phases are a one-off operation, we only consider the computation costs in the Sign phase, Sanitize phase, and Verify phase. AnEQS·Signalgorithm includes2n−2point addition operations and2n+2point multiplication operations, an EQS·ChgRep algorithm requires n+4 point multiplication operations, and an EQS·Verify algorithm requires n+5 bilinear pair operations, where n is the number of messages involved in the operation [35].In theSign phase, the signer in Bultel et al.’s scheme needs to perform 3ι exponentiation operations, 4ι−4 point addition operations, 4ι+6 point multiplication operations, and ι hash to point operations; therefore, the computation cost of the Sign phase in Bultel et al.’s scheme is 3ιTexp+4ι−4Tpa+4ι+6Tpm+ιTmtp. The signer in our PP-SS scheme needs to perform ι exponentiation operations, four point addition operations, fourteen point multiplication operations, and ι hash to point operations; therefore, the computation cost of Sign phase in our PP-SS scheme is ιTexp+4Tpa+14Tpm+ιTmtp.In theSanitize phase, the sanitizer in Bultel et al.’s scheme needs to perform 3ι exponentiation operations, 2ι+9 point multiplication operations, and α hash to point operations; therefore, the computation cost of the Sanitize phase in Bultel et al.’s scheme is 3ιTexp+2ι+9Tpm+αTmtp. The sanitizer in our PP-SS scheme needs to perform 4+ι exponentiation operations, thirteen point multiplication operations, and α hash to point operations; therefore, the computation cost of Sanitize phase in our PP-SS scheme is 4+ιTexp+13Tpm+αTmtp.In theVerify phase, the verifier in Bultel et al.’s scheme needs to perform 4ι+10 bilinear pair operations and ι hash to point operations; therefore, the computation cost of the Verify phase in Bultel et al.’s scheme is 4ι+10Tbp+ιTmtp. The verifier in our PP-SS scheme needs to perform 2ι+20 bilinear pair operations and ι hash to point operations; therefore, the computation cost of Verify phase in Bultel et al.’s scheme is 2ι+20Tbp+ιTmtp.As shown in Figure2 and Table 3, if ι=100 and α=20, we can observe that the computation cost of the Sign phase in our PP-SS scheme is 833.16 ms, which is reduced by 53.19% compared with Bultel et al.’s scheme (the computation cost is 1779.89 ms); the computation cost of the Sanitize phase in our PP-SS scheme is 495.68 ms, which is reduced by 62.99% compared with Bultel et al.’s scheme (the computation cost is 1339.60 ms); and the computation cost of the Verify phase in our PP-SS scheme is 1367.02 ms, which is reduced by 36.92% compared with Bultel et al.’s scheme (the computation cost is 2167.11 ms) in terms of computation cost percentage. Obviously, our new scheme greatly reduces the computation cost at different phases.Figure 2
Comparative summary: computation costs.Table 3
Computation cost comparison (ms).
SchemeSignSanitizeVerifyBultel et al.’s [29]300Texp+396Tpa+406Tpm+100Tmtp≈1779.89300Texp+209Tpm+20Tmtp≈1339.60410Tbp+100Tmtp≈2167.11Our scheme100Texp+4Tpa+14Tpm+100Tmtp≈833.16104Texp+13Tpm+20Tmtp≈495.68220Tbp+100Tmtp≈1367.02


### 6.2. Communication Costs

In theSetup, Extract‐SKey, Extract‐ZKey, and Verify phases, there is no additional communication cost in Bultel et al.’s scheme [29] and our proposed PP-SS scheme. Hence, we only consider the communication costs of the Sign phase and the Sanitize phase. For simplicity, we assume the length of the user’s electronic medical record F is ℓ in accordance with the above implementation. The communication cost is analyzed as follows.In theSign phase, the signer in Bultel et al.’s scheme needs to send σ=μ,η,σi,Xi,Yii=1ι,c, R, and the electronic medical record F to the sanitizer. Since ∣μ∣=8∣q∣, ∣η∣=8∣q∣, ∣c∣=ι+1∣q∣, and R, σi, Xi, Yi are all the elements in G2, the communication cost of Bultel et al.’s scheme is μ+η+c+ισi+Xi+Yi+R+F=8∣q∣+8∣q∣+ι+1∣q∣+ι2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ bits. The signer in our PP-SS scheme needs to send ϑ,ω,X,Y,R,σ=σi1ι,c and electronic medical record F to the sanitizer. Since ∣ϑ∣=8∣q∣, ∣ω∣=8∣q∣, ∣c∣=2∣q∣, and R, σi, X1, X2, Y1, Y2 are all the elements in G2, the communication cost of Bultel et al.’s scheme is ϑ+ω+c+ισi+X1+X2+Y1+Y2+R+F=8∣q∣+8∣q∣+2∣q∣+2ι∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ bits.In theSanitize phase, the sanitizer in Bultel et al.’s scheme needs to send σ′=μ′,η′,σi′,Xi′,Yi′i=1ι to the sanitizer. Since ∣μ′∣=8∣q∣, ∣η′∣=8∣q∣, and σi′, Xi′, Yi′ are all the elements in G2, the communication cost of Bultel et al.’s scheme is μ′+η′+ισi′+Xi′+Yi′+F′=8∣q∣+8∣q∣+ι2∣q∣+2∣q∣+∣Yi∣+ℓ bits. The signer in our PP-SS scheme needs to send ϑ′,ω′,X′,Y′,σ′=σi′1ι and electronic medical record F′ to the sanitizer. Since ∣ϑ′∣=8∣q∣, ∣ω′∣=8∣q∣, and σi′, X1′, X2′, Y1′, Y2′ are all the elements in G2, the communication cost of Bultel et al.’s scheme is ϑ′+ω′+ισi′+X1′+X2′+Y1′+Y2′+F′=8∣q∣+8∣q∣+ι2∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ bits.If we chooseι=50 and F=ℓ=1024 bits, the comparative summary of the communication costs is demonstrate in Table 4 and Figure 3. We can observe that the communication cost of the Sign phase in our PP-SS scheme is 21504 bits, which is reduced by 64.20% compared with Bultel et al.’s scheme (the communication cost is 60064 bits), and the communication cost of the Sanitize phase in our PP-SS scheme is 20864 bits, which is reduced by 59.55% compared with Bultel et al.’s scheme (the communication cost is 51584 bits) in terms of communication cost percentage. Obviously, our new scheme greatly reduces the communication cost at different phases.Table 4
Comparative summary: communication cost (bit).
Bultel et al.’s scheme [29]Our schemeSign8∣q∣+8∣q∣+51∣q∣+502∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ≈600648∣q∣+8∣q∣+2∣q∣+100∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ≈21504Sanitize8∣q∣+8∣q∣+502∣q∣+2∣q∣+2∣q∣+ℓ≈515848∣q∣+8∣q∣+100∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ≈20864Figure 3
Comparative summary: communication costs.


## 6.1. Computation Costs

We evaluate the performance of our new proposal and Bultel et al.’s scheme [29]. In the specific implementation, we choose a nonsingular elliptic curve E:y2=x3+ax+b mod q, and a, b∈Zq∗, G is the additive group with the order q on E, security parameter ∣λ∣=80 bits, and p and q are both prime numbers with a length of 160 bits. We run the simulation experiment using the MIRACL library [36] on a personal computer (Intel core with I7-4770@3.4 GHz CPU, 4 GB random memory, and Windows 7 operating system). The running time of different operations is shown in Table 2.Table 2
Running time of different operations (ms).
NotationsOperationsTimeTexpA modular exponentiation operation3.8636TpaA point addition operation0.0018TpmA point multiplication operation0.4421TbpA bilinear pair operation4.2110TmtpA hash to point operation4.4060BecauseSetup, Extract‐SKey, and Extract‐ZKey phases are a one-off operation, we only consider the computation costs in the Sign phase, Sanitize phase, and Verify phase. AnEQS·Signalgorithm includes2n−2point addition operations and2n+2point multiplication operations, an EQS·ChgRep algorithm requires n+4 point multiplication operations, and an EQS·Verify algorithm requires n+5 bilinear pair operations, where n is the number of messages involved in the operation [35].In theSign phase, the signer in Bultel et al.’s scheme needs to perform 3ι exponentiation operations, 4ι−4 point addition operations, 4ι+6 point multiplication operations, and ι hash to point operations; therefore, the computation cost of the Sign phase in Bultel et al.’s scheme is 3ιTexp+4ι−4Tpa+4ι+6Tpm+ιTmtp. The signer in our PP-SS scheme needs to perform ι exponentiation operations, four point addition operations, fourteen point multiplication operations, and ι hash to point operations; therefore, the computation cost of Sign phase in our PP-SS scheme is ιTexp+4Tpa+14Tpm+ιTmtp.In theSanitize phase, the sanitizer in Bultel et al.’s scheme needs to perform 3ι exponentiation operations, 2ι+9 point multiplication operations, and α hash to point operations; therefore, the computation cost of the Sanitize phase in Bultel et al.’s scheme is 3ιTexp+2ι+9Tpm+αTmtp. The sanitizer in our PP-SS scheme needs to perform 4+ι exponentiation operations, thirteen point multiplication operations, and α hash to point operations; therefore, the computation cost of Sanitize phase in our PP-SS scheme is 4+ιTexp+13Tpm+αTmtp.In theVerify phase, the verifier in Bultel et al.’s scheme needs to perform 4ι+10 bilinear pair operations and ι hash to point operations; therefore, the computation cost of the Verify phase in Bultel et al.’s scheme is 4ι+10Tbp+ιTmtp. The verifier in our PP-SS scheme needs to perform 2ι+20 bilinear pair operations and ι hash to point operations; therefore, the computation cost of Verify phase in Bultel et al.’s scheme is 2ι+20Tbp+ιTmtp.As shown in Figure2 and Table 3, if ι=100 and α=20, we can observe that the computation cost of the Sign phase in our PP-SS scheme is 833.16 ms, which is reduced by 53.19% compared with Bultel et al.’s scheme (the computation cost is 1779.89 ms); the computation cost of the Sanitize phase in our PP-SS scheme is 495.68 ms, which is reduced by 62.99% compared with Bultel et al.’s scheme (the computation cost is 1339.60 ms); and the computation cost of the Verify phase in our PP-SS scheme is 1367.02 ms, which is reduced by 36.92% compared with Bultel et al.’s scheme (the computation cost is 2167.11 ms) in terms of computation cost percentage. Obviously, our new scheme greatly reduces the computation cost at different phases.Figure 2
Comparative summary: computation costs.Table 3
Computation cost comparison (ms).
SchemeSignSanitizeVerifyBultel et al.’s [29]300Texp+396Tpa+406Tpm+100Tmtp≈1779.89300Texp+209Tpm+20Tmtp≈1339.60410Tbp+100Tmtp≈2167.11Our scheme100Texp+4Tpa+14Tpm+100Tmtp≈833.16104Texp+13Tpm+20Tmtp≈495.68220Tbp+100Tmtp≈1367.02


## 6.2. Communication Costs

In theSetup, Extract‐SKey, Extract‐ZKey, and Verify phases, there is no additional communication cost in Bultel et al.’s scheme [29] and our proposed PP-SS scheme. Hence, we only consider the communication costs of the Sign phase and the Sanitize phase. For simplicity, we assume the length of the user’s electronic medical record F is ℓ in accordance with the above implementation. The communication cost is analyzed as follows.In theSign phase, the signer in Bultel et al.’s scheme needs to send σ=μ,η,σi,Xi,Yii=1ι,c, R, and the electronic medical record F to the sanitizer. Since ∣μ∣=8∣q∣, ∣η∣=8∣q∣, ∣c∣=ι+1∣q∣, and R, σi, Xi, Yi are all the elements in G2, the communication cost of Bultel et al.’s scheme is μ+η+c+ισi+Xi+Yi+R+F=8∣q∣+8∣q∣+ι+1∣q∣+ι2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ bits. The signer in our PP-SS scheme needs to send ϑ,ω,X,Y,R,σ=σi1ι,c and electronic medical record F to the sanitizer. Since ∣ϑ∣=8∣q∣, ∣ω∣=8∣q∣, ∣c∣=2∣q∣, and R, σi, X1, X2, Y1, Y2 are all the elements in G2, the communication cost of Bultel et al.’s scheme is ϑ+ω+c+ισi+X1+X2+Y1+Y2+R+F=8∣q∣+8∣q∣+2∣q∣+2ι∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ bits.In theSanitize phase, the sanitizer in Bultel et al.’s scheme needs to send σ′=μ′,η′,σi′,Xi′,Yi′i=1ι to the sanitizer. Since ∣μ′∣=8∣q∣, ∣η′∣=8∣q∣, and σi′, Xi′, Yi′ are all the elements in G2, the communication cost of Bultel et al.’s scheme is μ′+η′+ισi′+Xi′+Yi′+F′=8∣q∣+8∣q∣+ι2∣q∣+2∣q∣+∣Yi∣+ℓ bits. The signer in our PP-SS scheme needs to send ϑ′,ω′,X′,Y′,σ′=σi′1ι and electronic medical record F′ to the sanitizer. Since ∣ϑ′∣=8∣q∣, ∣ω′∣=8∣q∣, and σi′, X1′, X2′, Y1′, Y2′ are all the elements in G2, the communication cost of Bultel et al.’s scheme is ϑ′+ω′+ισi′+X1′+X2′+Y1′+Y2′+F′=8∣q∣+8∣q∣+ι2∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ bits.If we chooseι=50 and F=ℓ=1024 bits, the comparative summary of the communication costs is demonstrate in Table 4 and Figure 3. We can observe that the communication cost of the Sign phase in our PP-SS scheme is 21504 bits, which is reduced by 64.20% compared with Bultel et al.’s scheme (the communication cost is 60064 bits), and the communication cost of the Sanitize phase in our PP-SS scheme is 20864 bits, which is reduced by 59.55% compared with Bultel et al.’s scheme (the communication cost is 51584 bits) in terms of communication cost percentage. Obviously, our new scheme greatly reduces the communication cost at different phases.Table 4
Comparative summary: communication cost (bit).
Bultel et al.’s scheme [29]Our schemeSign8∣q∣+8∣q∣+51∣q∣+502∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ≈600648∣q∣+8∣q∣+2∣q∣+100∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ≈21504Sanitize8∣q∣+8∣q∣+502∣q∣+2∣q∣+2∣q∣+ℓ≈515848∣q∣+8∣q∣+100∣q∣+2∣q∣+2∣q∣+2∣q∣+2∣q∣+ℓ≈20864Figure 3
Comparative summary: communication costs.


## 7. Conclusion

Smart mobile medical is a trend that is unlikely to disappear in the foreseeable future, and as the amount of user data continues to increase, it is essential to ensure the availability of medical data and the privacy of user information. Many digital signature schemes have been proposed recently, but most schemes have certain limitations and cannot be well adapted to the needs of smart medical applications.To overcome this security problem, we propose a new data security and privacy protection scheme based on a sanitizable signature for smart mobile medical scenarios. Security analysis and detailed performance evaluation demonstrate that our PP-SS scheme can not only ensure the integrity of medical data and support the privacy protection of patient but also achieve a higher level of security assurance when communication and computation costs are greatly reduced. Therefore, our proposed PP-SS scheme is more suitable for actual deployment in smart mobile medical scenarios.



---

*Source: 8877405-2020-11-24.xml*