# An Efficient Certificate-Based Aggregate Signature Scheme for Internet of Drones

Authors: Muhammad Asghar Khan; Insaf Ullah; Mohammed H. Alsharif; Abdulaziz H. Alghtani; Ayman A. Aly; Chien-Ming Chen
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Internet of drones (IoD) is a network of small drones that leverages IoT infrastructure to deliver real-time data communication services to users. On the one hand, IoD is an excellent choice for a number of military and civilian applications owing to key characteristics like agility, low cost, and ease of deployment; on the other hand, small drones are rarely designed with security and privacy concerns in mind. Intruders can exploit this vulnerability to compromise the security and privacy of IoD networks and harm the information exchange operation. An aggregate signature scheme is the best solution for resolving security and privacy concerns since multiple drones are connected in IoD networks to gather data from a certain zone. However, most aggregate signature schemes proposed in the past for this purpose are either identity-based or relied on certificateless cryptographic methods. Using these methods, a central authority known as a trusted authority (TA) is responsible for generating and distributing secret keys of every user. However, the key escrow problem is formulated as knowing the secret key generated by the TA. These methods are hampered by key distribution issues, which restrict their applicability in a variety of situations. To address these concerns, this paper presents a certificate-based aggregate signature (CBS-AS) scheme based on hyperelliptic curve cryptography (HECC). The proposed scheme has been shown to be both efficient in terms of computation cost and unforgeable while testing its toughness through formal security analysis.


---

## Body

## 1. Introduction

Drones have recently gained a lot of attention for their wide range of applications in areas including surveillance, agriculture, healthcare, traffic management, inspections, and public safety [1, 2]. Likewise, multiple small drones can be connected to accomplish given tasks more efficiently than a single large drone [3]. Therefore, a new clan of networks known as the Internet of drones (IoD) has evolved as a result of advancing from a single drone to multiple drones connected via the Internet. This network has all of the technological resources that needs to perform the assigned task autonomously, including a communication module for transmitting and receiving data, sensors for gathering data, memory for storing sensor data, and processors for computation [4]. However, drones in IoD network typically have limited storage, energy, and computing capacities, making it difficult for them to perform computationally complex operations [5, 6].IoD networks are typically deployed for applications that require users to retrieve real-time data from drones. There is a high chance that a malicious actor may conceivably control some drones or carry out impersonation attacks due to the multiple wireless connections among drones. Additionally, security and privacy concerns are rarely considered when small drones are designed [7]. Intruders who intend to violate the security and privacy measures of the IoD network have several options to carry out their malicious intent. They can, for example, transmit a large number of reservation requests, eavesdrop on the control messages, and/or forge information exchange [8]. A lightweight cryptographic scheme to offer data confidentiality, as well as a digital signature scheme to assure the integrity of data generated by a drone in an IoD environment, is required to solve this problem. Similarly, in an IoD network, where multiple drones are often connected to gather data from a designated zone, the notion of aggregation is essential for improving data distribution efficiency. The aggregate signature [9] is a sort of digital signature that allows several messages from different users to be compressed into a single signature. Instead of verifying all of the individual signatures, the verifier simply needs to examine the aggregate signature, resulting in a considerable decrease in the overall length of signatures. As a result, the load of network transmission can be minimized, and the efficiency of validating multiple signatures can be improved when employing the aggregate signature scheme.Most of the existing aggregate signature schemes generate aggregate signatures using either pairing operations or ECC. These methods are inefficient since they require heavy computations and are not suitable for devices with limited resources. Moreover, a Public Key Infrastructure (PKI) encryption mechanism was utilized in an early digital signature scheme. Following that, identity-based cryptography (IBC), identity-based signatures (IBS), identity-based aggregate signatures (IBAS), and certificateless cryptography (CLC) were used to create digital signature and aggregate signature schemes. Both the IBC and CLC approaches, however, have issues with key escrow and/or key distribution [10–12]. certificate-based signatures (CBS) and certificate-based aggregate signatures (CB-AS) have been offered as solutions to overcome these issues, and research is underway to guarantee that they can fulfil a number of security requirements, including data integrity, nonrepudiation, and resistance to signature forgery [13].To address the abovementioned issues, this article proposes a CB-AS scheme for IoD networks. The proposed scheme is efficient because it employs the concept of HECC. The HECC provides the same level of security as bilinear pairing (BP) and elliptic curve cryptography (ECC) with a small key size. The key contributions of the proposed scheme are summarized as follows:(i)
Firstly, the primary contribution of this research work is to design an aggregate signature scheme for an IoD network, in which a drone (aggregator drone) in a cluster will aggregate individual signatures of member drones and verify the validity of aggregated data.(ii)
Secondly, based on the notion of hyperelliptic curve cryptography (HECC) in a certificate-based setting, the proposed scheme is proved to be existentially unforgeable under adaptive chosen message.(iii)
Finally, the proposed scheme is compared to relevant existing schemes, and the comparison analysis reveals that our scheme is more efficient in terms of computation and communication costs.The rest of this paper is laid out as follows. We provide related work in Section2. Preliminaries are provided in Section 3. The system model and proposed CB-AS scheme is presented in Section 4. We evaluate provable security analysis in Section 5 before evaluating performance in terms of computation and communication costs in Section 6. Finally, in Section 7, we make a conclusion.


## 2. Related Work

Aggregate signatures, which are based on public key cryptography (PKC) methods, are commonly used for aggregate authentication of information exchange. In this approach, the senders sign the message using their own private keys, and then the aggregator, who is chosen by the senders, uses aggregation algorithms to compress all of the individual signatures into a fixed-length short signature. The validity of the short signature is the same as the validity of all individual signatures utilized to create the aggregate signature. Any verifier may only establish whether or not all individual signatures from the given users are legitimate by examining the aggregate signature. As a result, aggregate signature is more beneficial for IoD networks, increasing data verification and transmission efficiency.Liu et al. [14] introduced the first CBC aggregate signature scheme, in which signers use sequential aggregation to create an AS from a prior aggregated signature. As a result, aggregation is performed by each signer. However, in practice, this approach has limited use. It is also pairing-based, which makes it inappropriate for IoD systems. Wang et al. [15] proposed a provably secure aggregate authentication scheme for a UAV cluster network. The scheme is based on an ID-based encryption method, which is prone to key escrow issues. Moreover, the proposed scheme is based on elliptic curve cryptography, which is not well suited to IoD networks. Li et al. [16] proposed an authentication framework for UAVCN based on identity-based aggregate signature method. According to security analysis, the authors claimed that their scheme is unforgeable for (attested) authentication requests and (aggregate) responses. The scheme, however, has a large computational cost. Li et al. [17] presented a certificateless pairing-free authentication system for UAV networks. The authentication mechanism of the proposed scheme is based on the notion of elliptic curve cryptography and uses an aggregator signature. Kar et al. [18] proposed an efficient and low-cost certificateless aggregate signature scheme for wireless sensor networks. Security toughness of the proposed scheme is tested under random oracle model. Both of the schemes presented in [17, 18] were, however, based on ECC cryptography, which has a marginally higher computational cost than HECC.Verma et al. [19] proposed a pairing-free CBC-AS solution for healthcare monitoring that is devoid of key distribution and certificate management issues. The number of signers, on the other hand, determines the size of the aggregated signature. As a result of the variability in AS duration, the solution is impractical for resource-constrained IoD networks. Very recently, Verma et al. [20] presented another certificate-based efficient signature scheme with compact aggregation. The proposed CB-CAS scheme is the shortest since it uses compact aggregation. However, it may not meet the requirements of distributed ledger systems (DLSs). The reason for this is that with DLSs, several signers sign a single message. As a result, a multisignature method is needed. Furthermore, the proposed scheme is based on the concept of ECC, which is incompatible with IoD networks. Our scheme, on the other hand, is based on HECC, a more advanced variant of ECC that offers the same level of security as ECC but with a smaller key size, lowering computation, and communication costs.


## 3. Preliminaries

Firstly, we will go over some basics regarding HEC, which is an advanced version of EC that only require 80 bits of parameter and key size. The advantage of the hyper elliptic curve is that it provides the same level of security robustness as the elliptic curve. Secondly, we explain the hyperelliptic curve discrete logarithms problem, which is as follows: supposeπ=γ.D; then the task of the attacker is to extract the unknown γ from π that is called hyperelliptic curve discrete logarithm. Thirdly, we present two sorts of adversaries: Type 1 and Type 2 adversaries. Type 1 is an external attacker whose objective is to forge the signature; it also lacks access to the CA’s secret key. Type 2 is a malicious CA whose mission is to forge signatures. It also has access to the CA's secret key and will be unable to perform public key replacement and certificate queries. Finally, we evaluate the open channel for our proposed scheme, in which these two attackers could perform the forging procedure against it.


## 4. System Model and Proposed CB-AS Scheme

This section illustrates the overall concept and syntax of the proposed CB-AS scheme for IoD networks.


### 4.1. System Model

The proposed CB-AS system model [17] is depicted in Figure 1. Member drones (M-Drones), aggregator drones (AGT-Drones), certificate authority (CA), and base station (BS) are the four categories of entities in the proposed system. The M-Drones are in charge of monitoring a certain zone, and the AGT-Drone serves as a cluster head for a group of M-Drones that are directly attached to it. The CA is in charge of the setup and certificate generation. The BS, on the other hand, does mutual authentication before to assigning tasks to both types of drones (AGT-Drone and M-Drones). The authentication process is started by BS, which allows the aggregator drone to validate, attest, and disseminate authentication requests to its M-Drones. AGT-Drone serves as a bridge between BS and M-Drones, providing computing and communication capabilities to control its M-Drone in the cluster. The AGT-Drone in the cluster is used to communicate between the BS and the M-Drones. Each M-Drone may check its real source and the attested request before responding to authentication request of BS. AGT-Drone can validate the responses of M-Drone in the same cluster in batch. The notions used in the proposed scheme are illustrated in Table 1.Figure 1
The proposed CB-AS scheme model for IoD.Table 1
Notions used in the proposed scheme.
No.SymbolPurpose1µkA security parameter on HEC with 80 bit size2ℱA published set of defined parameter in IoD network3hℓSymbol used to represent HEC4FnSymbol used to represent a finite field ofn order on HEC5DSymbol used to represent a divisor on HEC6ΘSymbol used to represent the public key of certifiers7ηSymbol used to represent the private key of certifiers8ℏ0,ℏ1,ℏ2Symbols used to represent the irreversible cryptographic hash functions, that is, SHA 2569℧iSymbol used to represent each user withIDi10σiSymbol used to represent the public key of each user withIDi11φiSymbol used to represent the private key of each user withIDi12SiSymbol used to represent the certificate of each user withIDi13ζiSymbol used to represent the normal certificate based signature14ζSymbol used to represent the aggregated certificate based signature15AAKR1Symbol used to represent Type1 attacker16AAKR2Symbol used to represent Type2 attacker17ΦSymbol used to represent maximum number of queries18Φℏ0Symbol used to represent queries request forℏ0-oracle.19eSymbol used to represent a helper, which help to solve hyper elliptic curve discrete logarithm problem forAAKR1 and AAKR2


### 4.2. Proposed CB-AS Scheme

The phases of the proposed CB-AS scheme [19] are listed as follows:(i)
Setup: givenµk is a security parameter, this phase enables the certifiers to publish a param ℱ=D,Fn,ℏℓ,ℏ0,ℏ1,ℏ2,Θ, where D is the divisor, Fn represents a finite field, ℏℓ is used for hyper elliptic curve, (ℏ0,ℏ1,ℏ2) are the three irreversible cryptographic hash functions, and Θ=η.D means the public key of certifiers. Further, certifiers set η is his private key.(ii)
Key generation: each user℧i with IDi compute σi=φi.D, where φi is private key selected by user randomly from ℏℓ group.(iii)
Certificate generation: for each user℧i with IDi, certifiers select χi randomly from ℏℓ group and compute ωi=χi.D, ∂i=χi+ηℏ0IDi,ωi,σi and set Si=ωi,∂i as a certificate. When user wants verification of Si=ωi,∂i, then he/she use the following equation: ∂i.D=ωi+Θℏ0IDi,ωi,σi.(iv)
Certificate-based signature generation: for a signature generator withIDi, compute αi=ℓi.D, where ℓi is selected randomly from ℏℓ group, ri=ℏ1ωi,σi,mi,αi, Ri=ℏ2IDi,ωi,σi,mi,αi, compute ζi=∂i+φiri+ℓiRi, and set ψi=αi,ωi,ζi as a signature.(v)
Certificate-based signature verifications: a verifier can do the following computational steps: it computesri=ℏ1ωi,σi,mi,αi, Ri=ℏ2IDi,ωi,σi,mi,αi, ℓi=ℏ0IDi,ωi,σi and checks if ζi.D=ωi+ℓi.Θ+ri.σi+Ri.αi equals and then accepts the signature.(vi)
Certificate-based signature aggregations: after reception ofψi=αi,ωi,ζi, an aggregator can make ζ=∑i=0nζi; it means that ζi is the aggregated signature on mi.(vii)
Certificate-based signature aggregations verifications: a verifier can do the following computational steps: it computes∑i=0nri=ℏ1ωi,σi,mi,αi,∑i=0nRi=ℏ2IDi,ωi,σi,mi,αi, ∑i=0nℓi=ℏ0IDi,ωi,σi and checks if ζ.D=∑i=0nωi+∑i=0nℓi.Θ++∑i=0nri.σi+∑i=0nRi.αi equals and then accepts ζ.


### 4.3. Correctness

A verifier can do the following computational steps for verification ofψi=αi,ωi,ζi:(1)ζi.D=ωi+ℓi⋅Θ+ri⋅σi+Ri⋅αi,ζi.D=∂i+φiri+αiRi⋅D=χi+ηℏ0IDi,ωi,σi+φiri+αiRi⋅D=χi⋅D+η⋅Dℏ0IDi,ωi,σi+φi⋅Dri+ℓi⋅DRi=ωi+Θ⋅ℓi+σi⋅ri+αi⋅Ri=ωi+ℓi⋅Θ+ri⋅σi+Ri⋅αi.Hence, it is proved.Also, a verifier can do the following computational steps for verification ofζ:(2)ζ.D=∑i=0nωi+∑i=0nℓi⋅Θ++∑i=0nri⋅σi+∑i=0nRi⋅αi,ζ.D=∑i=0n∂i+φi∑i=0nri+ℓi∑i=0nRi⋅D=∑i=0nχi+η∑i=0nℓi+φi∑i=0nri+ℓi∑i=0nRiD=∑i=0nχi⋅D+η⋅D∑i=0nℓi+φi⋅D∑i=0nri+ℓi⋅D∑i=0nRi=∑i=0nωi+∑i=0nℓi⋅Θ++∑i=0nri⋅σi+∑i=0nRi⋅αi.Hence, it is proved.


## 4.1. System Model

The proposed CB-AS system model [17] is depicted in Figure 1. Member drones (M-Drones), aggregator drones (AGT-Drones), certificate authority (CA), and base station (BS) are the four categories of entities in the proposed system. The M-Drones are in charge of monitoring a certain zone, and the AGT-Drone serves as a cluster head for a group of M-Drones that are directly attached to it. The CA is in charge of the setup and certificate generation. The BS, on the other hand, does mutual authentication before to assigning tasks to both types of drones (AGT-Drone and M-Drones). The authentication process is started by BS, which allows the aggregator drone to validate, attest, and disseminate authentication requests to its M-Drones. AGT-Drone serves as a bridge between BS and M-Drones, providing computing and communication capabilities to control its M-Drone in the cluster. The AGT-Drone in the cluster is used to communicate between the BS and the M-Drones. Each M-Drone may check its real source and the attested request before responding to authentication request of BS. AGT-Drone can validate the responses of M-Drone in the same cluster in batch. The notions used in the proposed scheme are illustrated in Table 1.Figure 1
The proposed CB-AS scheme model for IoD.Table 1
Notions used in the proposed scheme.
No.SymbolPurpose1µkA security parameter on HEC with 80 bit size2ℱA published set of defined parameter in IoD network3hℓSymbol used to represent HEC4FnSymbol used to represent a finite field ofn order on HEC5DSymbol used to represent a divisor on HEC6ΘSymbol used to represent the public key of certifiers7ηSymbol used to represent the private key of certifiers8ℏ0,ℏ1,ℏ2Symbols used to represent the irreversible cryptographic hash functions, that is, SHA 2569℧iSymbol used to represent each user withIDi10σiSymbol used to represent the public key of each user withIDi11φiSymbol used to represent the private key of each user withIDi12SiSymbol used to represent the certificate of each user withIDi13ζiSymbol used to represent the normal certificate based signature14ζSymbol used to represent the aggregated certificate based signature15AAKR1Symbol used to represent Type1 attacker16AAKR2Symbol used to represent Type2 attacker17ΦSymbol used to represent maximum number of queries18Φℏ0Symbol used to represent queries request forℏ0-oracle.19eSymbol used to represent a helper, which help to solve hyper elliptic curve discrete logarithm problem forAAKR1 and AAKR2


## 4.2. Proposed CB-AS Scheme

The phases of the proposed CB-AS scheme [19] are listed as follows:(i)
Setup: givenµk is a security parameter, this phase enables the certifiers to publish a param ℱ=D,Fn,ℏℓ,ℏ0,ℏ1,ℏ2,Θ, where D is the divisor, Fn represents a finite field, ℏℓ is used for hyper elliptic curve, (ℏ0,ℏ1,ℏ2) are the three irreversible cryptographic hash functions, and Θ=η.D means the public key of certifiers. Further, certifiers set η is his private key.(ii)
Key generation: each user℧i with IDi compute σi=φi.D, where φi is private key selected by user randomly from ℏℓ group.(iii)
Certificate generation: for each user℧i with IDi, certifiers select χi randomly from ℏℓ group and compute ωi=χi.D, ∂i=χi+ηℏ0IDi,ωi,σi and set Si=ωi,∂i as a certificate. When user wants verification of Si=ωi,∂i, then he/she use the following equation: ∂i.D=ωi+Θℏ0IDi,ωi,σi.(iv)
Certificate-based signature generation: for a signature generator withIDi, compute αi=ℓi.D, where ℓi is selected randomly from ℏℓ group, ri=ℏ1ωi,σi,mi,αi, Ri=ℏ2IDi,ωi,σi,mi,αi, compute ζi=∂i+φiri+ℓiRi, and set ψi=αi,ωi,ζi as a signature.(v)
Certificate-based signature verifications: a verifier can do the following computational steps: it computesri=ℏ1ωi,σi,mi,αi, Ri=ℏ2IDi,ωi,σi,mi,αi, ℓi=ℏ0IDi,ωi,σi and checks if ζi.D=ωi+ℓi.Θ+ri.σi+Ri.αi equals and then accepts the signature.(vi)
Certificate-based signature aggregations: after reception ofψi=αi,ωi,ζi, an aggregator can make ζ=∑i=0nζi; it means that ζi is the aggregated signature on mi.(vii)
Certificate-based signature aggregations verifications: a verifier can do the following computational steps: it computes∑i=0nri=ℏ1ωi,σi,mi,αi,∑i=0nRi=ℏ2IDi,ωi,σi,mi,αi, ∑i=0nℓi=ℏ0IDi,ωi,σi and checks if ζ.D=∑i=0nωi+∑i=0nℓi.Θ++∑i=0nri.σi+∑i=0nRi.αi equals and then accepts ζ.


## 4.3. Correctness

A verifier can do the following computational steps for verification ofψi=αi,ωi,ζi:(1)ζi.D=ωi+ℓi⋅Θ+ri⋅σi+Ri⋅αi,ζi.D=∂i+φiri+αiRi⋅D=χi+ηℏ0IDi,ωi,σi+φiri+αiRi⋅D=χi⋅D+η⋅Dℏ0IDi,ωi,σi+φi⋅Dri+ℓi⋅DRi=ωi+Θ⋅ℓi+σi⋅ri+αi⋅Ri=ωi+ℓi⋅Θ+ri⋅σi+Ri⋅αi.Hence, it is proved.Also, a verifier can do the following computational steps for verification ofζ:(2)ζ.D=∑i=0nωi+∑i=0nℓi⋅Θ++∑i=0nri⋅σi+∑i=0nRi⋅αi,ζ.D=∑i=0n∂i+φi∑i=0nri+ℓi∑i=0nRi⋅D=∑i=0nχi+η∑i=0nℓi+φi∑i=0nri+ℓi∑i=0nRiD=∑i=0nχi⋅D+η⋅D∑i=0nℓi+φi⋅D∑i=0nri+ℓi⋅D∑i=0nRi=∑i=0nωi+∑i=0nℓi⋅Θ++∑i=0nri⋅σi+∑i=0nRi⋅αi.Hence, it is proved.


## 5. Provable Security Analysis

In this section, we intend to prove that the proposed scheme is unforgeable under the attack of both Type 1 and Type 2 adversaries. For this purpose, we perform the following four games [19].In Game 1, we evaluate the unforgeability of our proposed CB-AS scheme against Type 1 attacker (AAKR1). AAKR1 is the outsider attacker; its work is to forge the proposed scheme signature and solve hyperelliptic curve discrete logarithm problem (HECDLP) with the help of another entity e by using the advantage of AdveHECDLP=1/Φ+1−1/ΦΦξ. Note Φ represents maximum number of queries.Proof.
Whene received π=γ.D, then his task is to extract the unknown γ from π. Further, it can do the following Oracles:(i)
Setup (.)-Oracle:e set a param ℱ=D,Fn,ℏℓ,ℏ0,ℏ1,ℏ2,Θ, and Θ=π. Then, e gives ℱ to AAKR1. Further, e choose v is an index sustaining 1≤ν≤Φℏ0, where Φℏ0 is a number of query request for ℏ0-Oracle.(ii)
Key Generation (.)-Oracle:AAKR1 ask for this query, e combs in LKey for IDi,φi,σi, if it is exist, then it gives σi to AAKR1. Otherwise, e compute σi=φi.D, where φi is private key selected by user randomly from ℏℓ group and gives it to AAKR1, further it updates the list LKey with IDi,φi,σi.(iii)
ℏ0 (.)-Oracle: AAKR1 ask for this query, e combs in Lℏ0 for IDi,ωi,σi,ℓi, if it is exist, then it gives ℓi to AAKR1. Otherwise, e select ℓi at random and gives it to AAKR1, further it updates the list Lℏ0 with IDi,ωi,σi,ℓi.(iv)
ℏ1 (.)-Oracle: AAKR1 ask for this query, e combs in Lℏ1 for ωi,σi,mi,αi,ri, if it is exist, then it gives ℓi to AAKR1. Otherwise, e select ri at random and gives it to AAKR1, further it updates the list Lℏ1 with ωi,σi,mi,αi,ri.(v)
ℏ2 (.)-Oracle: AAKR1 ask for this query, e combs in Lℏ1 for IDi,ωi,σi,mi,αi,Ri, if it is exist, then it gives ℓi to AAKR1. Otherwise, e select Ri at random and gives it to AAKR1, further it updates the list Lℏ2 with IDi,ωi,σi,mi,αi,Ri.(vi)
Public Key Replacement (.)-Oracle:AAKR1 ask for this query with IDi,φi,σil, e combs in LKey for IDi,φi,σil, if it is exist, then it change the triple by IDi,⊥,σil.(vii)
Corruption (.)-Oracle:AAKR1 ask for this query, e combs in LKey for ID,φ,σ, if it is exist, then it gives σ to AAKR1. Otherwise, e compute σ=φ.D, where φ is private key selected by user randomly from ℏℓ group and gives it to AAKR1, further it updates the list LKey with ID,φ,σ.(viii)
Certificate Generation (.)-Oracle:AAKR1 ask for this query, if i=ν, then e abort further processing, otherwise e check the list LC for certificate, if it is exists, e sends it to AAKR1. If it is not exists, then it pick ∂i and ri, then compute ωi=∂i.D−ℓi. π. At the end of this process, e give (∂i,ωi) to AAKR1 and update the list LC accordingly.(ix)
Certificate Based Signature Generation (.)-Oracle:AAKR1 ask for this query, if i=ν, then e set rv=ℏ1ωv,σv,mv,αv,Rv=ℏ2IDv,ωv,σv,mv,αv, and ℓv=ℏ0IDv,ωv,σv, then compute ωv=∂v.D−ℓv.π,αv=Rv−∂v.D−rvσv. It also pick ζv randomly and delivers αv,ωv,ζv to AAKR1.
Eventually,AAKR1 returns a forge signature ψ∗= (α∗,ω∗,ζ∗) on m∗. Though, by using the concept of forking lemma,e returns two signatures that are α1∗,ω1∗,ζ1∗ and α1∗,ω1∗,ζ2∗. Thus, ζ1∗.D=ω1∗+ℓ1.π+r.σi+R.α1∗ and ζ2∗.D=ω1∗+ℓ2.π+r.σi+R.α1∗. So, ζ1∗−ζ2∗.D=ℓ1−ℓ2.γ.D=γ=ζ1∗−ζ2∗/ℓ1−ℓ2 will be the solution of HECDLP.
In the probability analysis, taking into account the above game, we have the probability of the following events.(i)
Event 1:e has not any intentions to stop this game and its probability as PEvent1≥1−1/ΦΦ(ii)
Event 2:AAKR1 has the capacity to stop this game and its probability as PEvent2≥ξ(iii)
Event 3: it can don the forgery for target identity and its probability asPEvent1≥1/Φ
So,PEvent1PEvent2PEvent3=1/Φ+1−1/ΦΦξ
In Game 2, we test the property of unforgeability of our proposed CB-AS scheme against Type 1 attacker (AAKR1).AAKR1struggles to forge the proposed scheme signature and solve HECDLP with the help of another entity e by using the advantage of AdveHECDLP=1/Φ+1−1/ΦΦξ. Note that Φ represents maximum number of queries.Proof.
Whene received π=γ.D, then his task is to extract the unknown γ from π. Further, it can do the following Oracles:(i)
Setup (.)-Oracle:e set a param as Game 1, and set Θ=π. Then, AAKR1 ask for the queries same as Game 1.
Finally, by using the concept of forking lemma,e returns two signatures that are α1∗,ω1∗,ζ∗ and α1∗,ω1∗,ζ∗∗. Thus, γ=ζ∗−ζ∗∗/ℓ1−ℓ2 will be the solution of HECDLP.
In the probability analysis, taking into account the above game, we have the probability of the following events.(i)
Event 1:e has not any intentions to stop this game and its probability as PEvent1≥1−1/ΦΦ(ii)
Event 2:AAKR1 has the capacity to stop this game and its probability as PEvent2≥ξ(iii)
Event 3: it can don the forgery for target identity and its probability asPEvent1≥1/Φ
So,PEvent1PEvent2PEvent3=1/Φ+1−1/ΦΦξ.
In Game 3, we are explaining the unforgeability of our proposed CB-AS scheme against Type 2 attacker (AAKR2).AAKR2 is the malicious certifiers attacker; its work is to forged the proposed scheme signature and solve hyperelliptic curve discrete logarithm problem (HECDLP) with the help of another entity e by using the advantage of AdveHECDLP=1/Φ+1−1/ΦΦξ. Note that Φ represents maximum number of queries.Proof.
Whene received π=γ.D, then his task is to extract the unknown γ from π. Further, it can do the following oracles.(i)
Setup (.)-Oracle:e set a param ℱ=D,Fn,ℏℓ,ℏ0,ℏ1,ℏ2,Θ, and Θ=η.D=π. Then, e gives ℱ and η to AAKR2. Further, e choose v is an index sustaining 1≤ν≤Φℏ0, where Φℏ0 is a number of query requests for ℏ0-Oracle.
Then,AAKR2 ask for the same queries as Game 1 neglecting the public key replacement (.)-Oracle and certificate generation (.)-Oracle.
Finally,AAKR2 returns a forged signature ψ∗= (α∗,ω∗,ζ∗) on m∗, though, by using the concept of forking lemma,e returns two signatures that are α1∗,ω1∗,ζ1∗ and α1∗,ω1∗,ζ2∗. Thus, ζ1∗.D=ω1∗+ℓ1.π+r.σi+R.α1∗ and ζ2∗.D=ω1∗+ℓ2.π+r.σi+R.α1∗. So, ζ1∗−ζ2∗.D=ℓ1−ℓ2.γ.D=γ=ζ1∗−ζ2∗/ℓ1−ℓ2 will be the solution of HECDLP.
In the probability analysis, taking into account the above game, we have the probability of the following events.(i)
Event 1:e has not any intentions to stop this game and its probability as PEvent1≥1−1/ΦΦ(ii)
Event 2:AAKR2 has the capacity to stop this game and its probability as PEvent2≥ξ(iii)
Event 3: it can don the forgery for target identity and its probability asPEvent1≥1/Φ
So,PEvent1PEvent2PEvent3=1/Φ+1−1/ΦΦξ.
In Game 4, we intend to prove the unforgeability of our proposed CB-AS scheme against Type 2 attacker (AAKR2).AAKR2 is struggles to forge the proposed scheme signature and solve HECDLP with the help of another entity e by using the advantage of AdveHECDLP=1/Φ+1−1/ΦΦξ. Note that Φ represents maximum number of queries.Proof.
Whene received π=γ.D, then his task is to extract the unknown γ from π. Further, it can do the following oracles.(i)
Setup (.)-Oracle:e set a param as Game 3, and set Θ=π. Then, AAKR2 ask for the same queries as Game 3
Finally, by using the concept of forking lemma,e returns two signatures that are α1∗,ω1∗,ζ∗ and α1∗,ω1∗,ζ∗∗. Thus, γ=ζ∗−ζ∗∗/ℓ1−ℓ2 will be the solution of HECDLP.
In the probability analysis, taking into account the above game, we have the probability of the following events.(i)
Event 1:e has not any intentions to stop this game and its probability as PEvent1≥1−1/ΦΦ(ii)
Event 2:AAKR2 has the capacity to stop this game and its probability as PEvent2≥ξ(iii)
Event 3: it can don the forgery for target identity and its probability asPEvent1≥1/Φ
So,PEvent1Event2PEvent3=1/Φ+1−1/ΦΦξ.


## 6. Performance Evaluation

In this section, we evaluate performance evaluation of the proposed scheme in terms of computation and communication costs.


### 6.1. Computational Cost

SupposeHDML,PM,PML, and P denote hyperelliptic curve divisor multiplication, multiplication operation on pairing, point multiplication on elliptic curve, and pairing operations, respectively. We picked the consuming time for PM,PML, and P as 4.31, 0.97, and 14.90 milliseconds (ms) from [23]; they did this experiment through the computer system with specifications of Intel Core i7-4510U Central Processing unit, 2.0 Gigahertz, Eight Giga Byte Random Access Memory, MIRACL, and Windows 7 Home Basic 64-bit OS. We then further picked the consuming cost for HDML from [21, 22] that is 0.48 ms. On the basis of these findings, we compared our scheme with similar published schemes that are of Wang et al. [15], Li et al. [16], and Li et al. [17]. The major findings obtained from the comparison are mentioned in Table 2 and depicted in Figure 2, which are as follows: Wang et al. [15] consumes 2P+5PM=2∗14.90+5∗4.31=51.35ms; Li et al. [16] consumes 6P+7PM=6∗14.90+7∗4.31=119.57ms; and Li et al. [17] consumes 16PML=16∗0.97=15.52ms, and they proposed scheme consumes 7HDML=7∗0.48=3.36ms, respectively. Hence, from the above calculation, it is obvious that the proposed scheme requires less running time from the schemes proposed by Wang et al. [15], Li et al. [16], and Li et al. [17].Table 2
Comparison of the proposed scheme with the existing schemes in terms of computation cost.
SchemesSenderReceiverTotal (ms)Wang et al. [15]2PM = 8.622P + 3PM = 42.7351.35Li et al. [16]2P4PM = 47.044P + 3PM = 72.53119.57Li et al. [17]9PML = 8.737PML = 6.7915.52Proposed scheme3HDML = 1.44HDML = 1.9243.36Figure 2
Comparison of computation cost (in ms).


### 6.2. Communication Cost

Supposem, G, q, and n denote the size of message, size of group parameter of bilinear pairing, parameter size of elliptic curve, and parameter size of hyperelliptic curve, respectively. We picked the utilized size in bits for m, G, q, and n as 1024, 1024, 160, and 80 [21, 22]. On the basis of this data, we compared the proposed scheme with similar published schemes presented by Wang et al. [15], Li et al. [16], and Li et al. [17], which are presented in Table 3. Then, in the last column of Table 3, by using the above-consuming bits for m, G, q, and n, we have calculated the total communication cost of proposed scheme and those that are presented by Wang et al. [15], Li et al. [16], and Li et al. [17], and the results are described in Table 3 and illustrated in Figure 3, respectively. The results show that the proposed scheme requires less amount of bits during communication.Table 3
Comparison of the proposed scheme with the existing schemes in terms of communication cost.
SchemesCommunication costCommunication cost in bitsWang et al. [15]m+2G1024+2∗1024=3072Li et al. [16]3m+8G3∗1024+8∗1024=11264Li et al. [17]2m+7q2∗1024+7∗160=3168Proposed schemem+3n1024+3∗80=1264Figure 3
Comparison of communication cost (in bits).


## 6.1. Computational Cost

SupposeHDML,PM,PML, and P denote hyperelliptic curve divisor multiplication, multiplication operation on pairing, point multiplication on elliptic curve, and pairing operations, respectively. We picked the consuming time for PM,PML, and P as 4.31, 0.97, and 14.90 milliseconds (ms) from [23]; they did this experiment through the computer system with specifications of Intel Core i7-4510U Central Processing unit, 2.0 Gigahertz, Eight Giga Byte Random Access Memory, MIRACL, and Windows 7 Home Basic 64-bit OS. We then further picked the consuming cost for HDML from [21, 22] that is 0.48 ms. On the basis of these findings, we compared our scheme with similar published schemes that are of Wang et al. [15], Li et al. [16], and Li et al. [17]. The major findings obtained from the comparison are mentioned in Table 2 and depicted in Figure 2, which are as follows: Wang et al. [15] consumes 2P+5PM=2∗14.90+5∗4.31=51.35ms; Li et al. [16] consumes 6P+7PM=6∗14.90+7∗4.31=119.57ms; and Li et al. [17] consumes 16PML=16∗0.97=15.52ms, and they proposed scheme consumes 7HDML=7∗0.48=3.36ms, respectively. Hence, from the above calculation, it is obvious that the proposed scheme requires less running time from the schemes proposed by Wang et al. [15], Li et al. [16], and Li et al. [17].Table 2
Comparison of the proposed scheme with the existing schemes in terms of computation cost.
SchemesSenderReceiverTotal (ms)Wang et al. [15]2PM = 8.622P + 3PM = 42.7351.35Li et al. [16]2P4PM = 47.044P + 3PM = 72.53119.57Li et al. [17]9PML = 8.737PML = 6.7915.52Proposed scheme3HDML = 1.44HDML = 1.9243.36Figure 2
Comparison of computation cost (in ms).


## 6.2. Communication Cost

Supposem, G, q, and n denote the size of message, size of group parameter of bilinear pairing, parameter size of elliptic curve, and parameter size of hyperelliptic curve, respectively. We picked the utilized size in bits for m, G, q, and n as 1024, 1024, 160, and 80 [21, 22]. On the basis of this data, we compared the proposed scheme with similar published schemes presented by Wang et al. [15], Li et al. [16], and Li et al. [17], which are presented in Table 3. Then, in the last column of Table 3, by using the above-consuming bits for m, G, q, and n, we have calculated the total communication cost of proposed scheme and those that are presented by Wang et al. [15], Li et al. [16], and Li et al. [17], and the results are described in Table 3 and illustrated in Figure 3, respectively. The results show that the proposed scheme requires less amount of bits during communication.Table 3
Comparison of the proposed scheme with the existing schemes in terms of communication cost.
SchemesCommunication costCommunication cost in bitsWang et al. [15]m+2G1024+2∗1024=3072Li et al. [16]3m+8G3∗1024+8∗1024=11264Li et al. [17]2m+7q2∗1024+7∗160=3168Proposed schemem+3n1024+3∗80=1264Figure 3
Comparison of communication cost (in bits).


## 7. Conclusion

IoD networks are equipped with cutting-edge technologies that can be used for a wide range of civilian and commercial applications. It does, however, have a lot of drawbacks, the most significant of which being security and privacy issues. In this article, we proposed a CB-AS scheme to address the security and privacy concerns of IoD networks. Unfortunately, existing CB-AS construction models rely on pairing and elliptic curve-based operations, which are computationally costly for small drones. As a result, in this paper, we provided a new construction model of CB-AS scheme, which is based on the HECC, an enhanced variant of the elliptic curve with a smaller parameter and key size (80 bits). A security analysis demonstrates that the proposed scheme provides substantial protection against malicious entity from forging the authentication request and responses of others. When compared to relevant schemes, it was found that the proposed scheme has the lowest computation and communication costs, with 3.36 milliseconds and 1264 bits, respectively, indicating that the proposed scheme is efficient in both computation and communication costs.



---

*Source: 9718580-2022-01-15.xml*