ECC based certificateless aggregate signature scheme for healthcare wireless sensor networks

Abstract

Wireless sensor networks (WSNs) are heavily used in applications like remote monitoring, vehicle management, manufacturing and healthcare. In healthcare, they are used to collect the data from the patients and transmit to the doctors. Patients wear the healthcare devices such as fit bands, watches, ECG and BP monitors to collect the various health indicators including temperature, oxygen, blood pressure and heart rate, and then this information is sent over the public network to the designated doctor for the assessment. The healthcare information is very sensitive for the patients, so it becomes important to protect the information from the various possible attacks. In this paper, a certificateless aggregate signature scheme based on ECC called E-CLAS is proposed. The proposed scheme generates the aggregate signature on the healthcare information produced by the n number of patients and then this aggregate signature is verified by the designated doctor. The formal security analysis of the scheme using random oracle model proves that it is secure against forgery attack. Its formal security verification using the AVISPA tool shows that it is secure against active and passive attacks. In the performance analysis, we show that the proposed scheme has less computation cost than the related schemes.

Introduction

Recent advances in the wireless technology have enabled to employ the wireless sensor network in the applications like smart healthcare, operation management and vehicle management. Smart healthcare [1] involves the healthcare wireless sensor network (HWSN) to collect and monitor the data produced by the patients. In the HWSNs [2], patients wear the various healthcare wearables and each wearable has the biomedical sensors to measure the various signals. Sensors have been made to measure and record the health-related data like oxygen, blood pressure, ecg signals, temperature, heart rate. Patients send the recorded health information to the designated doctor over the network for the medical assessment and then accordingly, doctor treats the patient.

The medical information contains the sensitive data [3] which includes the past medical history, personal information about the patients such as family background, psychological defects and reproductive history. Unfortunately, during the last decade, malicious attacks on patients information have become too common [4, 5]. Any unauthorised or unintentional exposure of patient information might jeopardise the patients privacy or result in the loss of user property. The medical information in HWSNs is transferred among the patients and doctor over the public network which is more dangerous. If the patient information is subjected to attacks such as, eavesdropping, tampering, and interception, then doctors may be misled and issue a wrong assessment, which is highly threatening to the patient’s life. As a result, maintaining the integrity, validity and availability of patients medical information in HWSNs possess several issues. Therefore, it is necessary to safeguard the patients information in HWSNs from the possible malicious attacks [5]. To address the integrity and privacy issues of healthcare data, various digital signature schemes [3, 6, 7–8], have been proposed for the HWSNs.

Nowadays, the certificateless signature schemes (CLS) [9] have been used in the HWSNs as the CLS removes the traditional public key infrastructure’s certification management problem and intrinsic key escrow problem of identity based signature. But traditional CLS schemes cannot be directly used in the HWSNs as the sensor nodes are resource constrained devices and when a high number of patients medical information is delivered online, both the computation and communication cost increase drastically. Due to which, the aggregate CLS [10] is used in the HWSNs so that computational cost involved in the scheme can be reduced. To provide the better security, the aggregate CLS needs to be verified only by the designated verifier. Hence, the aggregate CLS scheme with designated verifier can provide the better computation cost as well as security. On keeping these two points under the consideration, the paper presents a certificateless aggregate anonymous signature scheme with designated verifier for the HWSNs [11].

The paper is organized as follows: Sect. 2 reviews the existing schemes and Sect. 3 introduces the preliminaries including the mathematical background and notations. In Sect. 4, system model, its security requirements and security model are presented. Section 5 presents the proposed scheme in detail. The formal security analysis and verification of the proposed scheme is presented in Sect. 6. Section 7 presents the performance analysis of the proposed scheme along with the related schemes. Lastly, the paper is concluded in Sect. 8.

Literature survey

The medical information in HWSNs is transferred from the patient to the doctor over the public channel for the medical assessment. As the data is sent through an insecure public channel, it is vulnerable to many attacks such as interception, eavesdropping and alteration [2, 5]. Since, modification attack may lead to doctors making incorrect assessments, which can be incredibly damaging to patient’s lives [12]. Hence to prevent the patients medical information, many signature schemes have been proposed for HWSNs. Initially, the public key cryptography (PKC) [7, 13] is employed for protecting the medical information in HWSNs. Sangari et al. [7] developed a protocol for secure communication using the PKC between the inter-node. The scheme has the high computation cost and no detection mechanism for detecting the faulty node. Both the schemes [7, 13] suffer from the certificate management problem. The PKC comes with the drawback in managing and storing the certificate and has high computation and communication costs. These drawbacks make the PKC unsuitable for the HWSNs. And then researchers solved this issue by employing the ID based cryptography (IDBC) [14]. The ID based cryptography uses the information of the patients in generating the signature [15, 16]. Tan et al. [15] used IDBC to remove the issues of public key infrastructure. But if once the key generation center (KGC) is exposed, then key escrow problem will be a major security issue. Shen et al. [16] also used IDBC and the number of needed pairing operations rises linearly with the number of patients, resulting in a significant computation cost. However, the ID based cryptography has the inherent private key escrow problem [14].

Riyami and Pterson [9] solved the certificate management problem of traditional PKC and inherent key escrow problem of IDBC by introducing a new certificateless public key cryptography (CLPKC). After the scheme [9], many signature schemes have been proposed using the CLPKC [17, 18, 19–20] for the HWSNs. Boneh et al. [10] proposed the concept of aggregate signature. In the aggregate signature, the n number of users singed n data and generates n signatures and these n signatures are aggregated to a single sign which result in the less verification time. The verifier verifies the single aggregate signature. The concept of CLKPC is usually used with the aggregate signature to provide the secure communication as well as less computation overhead. As a result, the combination of these two concepts is employed in the signature schemes designed for HWSNs.

Many signature schemes were [3, 6, 8, 21, 22, 23, 24–25] proposed which use both the concept of CLKPC and aggregate signature. In all the CLAS schemes, n number of patients sign the n data and produce n signatures and then these n signatures are aggregated into a single signature by the aggregator. The aggregator sends the single aggregated signature to the doctor and then the doctor has to verify only one signature which results in less verification time. Kumar et al. [21] constructed a certificateless aggregate signature scheme using the Bilinear pairing for the HSWNs. But the scheme is found to be vulnerable to malicious-but-passive attacks and the scheme did not provide the patients privacy protection and has high computation overhead. Xie et al [3] improved the scheme [21] using the elliptic curve cryptography and reduce the computation cost. Liu et al. [22] presented a new CLAS based on bilinear mapping for mobile healthcare crowd sensing. The scheme [22, 26] is vulnerable to the forgery attacks. Gayathri et al. [8] introduced a new pairing free signature scheme based on the elliptic curve group. The scheme is forgeable as anyone can able to forge the signature. The schemes [11, 27, 28–29] do not require bilinear pairing. But the schemes [11, 27, 28] have high computational costs which make them unsuitable for the HSWNs and the scheme [29] is delegatable.

All the schemes [3, 7, 8, 11, 15, 16, 21, 22, 26, 27–28, 30] can be verified by any doctor. In designated verifier (DV) signature scheme, signature is verified only by the designated verifier and provides better data security. Deng et al. [6] constructed a signature scheme based on the CLAS and DV for the HWSNs. But the signature has too much computational overhead.

Motivation and contribution

In HWSNs, a doctor has to serve many patients. If a doctor verifies the signature of every patient separately, there will be burden of computational cost on the doctor. An aggregate signature scheme reduces the verification time of the doctor as it verifies the legibility of the signatures of multiple patients at a time. The health data of a patient is required to be secured as it is very sensitive and important. Most of the time, a patient does not want his health related data to be leaked except the designated doctor (DD). The existing certificateless aggregate schemes [3, 8, 11, 16, 21, 22, 26, 27–28, 30] for HWSNs can be verified by the public and these are not suitable for this environment. Therefore, it is required to design a certificateless aggregate signature scheme for HWSNs, which can be verified by a designated verifier. Our contribution in this paper is presented as follows:

1. A certificateless aggregate signature scheme for HWSNs is proposed based on ECC. In this scheme, each SN generates a signature and transmits it to the aggregator (AG). AG uses the doctor’s public key to aggregate n signatures into one signature and sends it to the DD. The doctor verifies the validity of the signature using his private key.

2. The security attributes like unforgeability for SN, indistinguishability for doctor, anonymity for SN and doctor, identity-identifiable for SN and doctor are investigated for the proposed scheme.

3. Its formal security verification is done using a well known tool AVISPA.

4. In the performance analysis, the computation and communication costs of the proposed scheme are compared with the other related schemes [3, 6, 8, 31]. It is also shown that the proposed scheme has less computation cost as compared to that of the related schemes.

Preliminaries

Table 1. Notations used in the proposed scheme

Notation	Description
P, Q	Two large prime numbers
$F_q$	A prime finite field
$Z_q^{\ast }$	Multiplicative group of order $q-1$
G	An additive group with generator X
$E/F_q$	An elliptic curve E over $F_q$
$\tau$	Security parameter
$P{K}_{\mathit{ms}}$	Public key of MS
$H_i,i=1,2,3$	Hash function
vars	$\{\tau ,a,b,X,q,P{K}_{\mathit{ms}},H_1,H_2,H_3\}$
||	Concatenation operator
$⨁$	Bitwise XOR operator
$I{D}_i$	Real identity of $S{N}_i$
$UI{D}_i$	Unique identifier of $S{N}_i$
$PI{D}_i$	Pseudo-identity of $S{N}_i$
$PP{K}_i$	Partial Private Key of $S{N}_i$
$S{K}_i,P{K}_i$	Secret value & Public key of $S{N}_i$
$I{D}_d$	Real identity of doctor
$UI{D}_d$	Unique identifier of doctor
$PI{D}_d$	Pseudo-identity of doctor
$PP{K}_d$	Partial Private Key of doctor
$S{K}_d,P{K}_d$	Secret value & Public key of doctor
$T{s}_i$	Time stamp used by the $S{N}_i$
$m_i$	Message of $S{N}_i$
${\sigma }_i$	Signature on $m_i$ by $S{N}_i$
$D=\{PI{D}_1,...,PID_n^{}\}$	Set of pseudo identities of the n SNs
$K=D\cup \{P{K}_i:PI{D}_i\in D\}$	Set of pseudo identities public keys of n SNs
$M=\{m_1,...,m_n^{}\}$	Set of n messages
$T=\{T{s}_1,...Ts_n^{}\}$	Set of n timestamps
$\sigma$	Aggregate signature

This section covers the mathematical background including elliptic curve group and complexity assumptions. Notations are defined in Table 1.

Elliptic curve group and complexity assumptions

Let E be an elliptic curve over finite field $F_q$ and $q>3$ is defined as $E:y^2=x^3+ax+bmodp$, where $a,b\in F_q$ and $4a^3+27b^2\ne 0$. An additive group G with q as order and P as generator is obtained by the points over $E/F_q$ and O as a point at infinity.

Elliptic curve discrete logarithmic problem (ECDLP): For a given two points $X_1,X_2\in G$, where $X_2=k{X}_1$ and $k\in Z_q^{\ast }$, it is hard to compute k from $X_2$.

System model and security model

The section presents the system model, security requirements, E-CLAS scheme and security model as follows:

[See PDF for image]

Fig. 1

Architecture for HWSNs

System model

The HWSNs comprises of four entities: Medical Server (MS), Patients (SNs), Aggregator (AG) and Designated Doctor (DD) which are shown in Fig. 1.

1. MS: It is responsible for generating and publishing system parameters. It also produces PID and partial private key for patients and doctor, and then it sends them to the patients and doctor.

2. SN: It is worn by the patient in the form of wearable devices, and it produces a signature for the data acquired on a regular basis and sends it to the AG.

3. AG: It collects n signatures from n SNs, combines them into one signature, and transmits it to a DD.

4. DD: It receives a signature from AG and checks it with his private key to see if it was created by n SNs.

E-CLAS scheme

An E-CLAS scheme for HSWNs has eight algorithms as listed below:

1. Setup: MS run the setup algorithm and takes security parameter as input and generates the public and private keys for MS and vars.

2. PID Generation: MS takes the patients and designated doctor ID as input and generates the pseudo identity for the patients and doctor using the PID generation algorithm.

3. PPK Generation: The algorithm is executed by MS to generate the partial private key for the patients and doctor.

4. Secret Value Generation: Patients and doctor execute the algorithm to generate the secret value.

5. Public Key Generation: Patients and doctor execute the algorithm to generate the public key.

6. Signature Generation: This algorithm takes the medical information as input and generates the signature of the patients on medical information.

7. Aggregation: Aggregator runs this algorithm to produce the single aggregate signature from the n patients signatures.

8. Aggregate-Verification: Designated doctor verifies the aggregate’s signature sent by the aggregator using this algorithm.

Security requirements

The medical information is shared over an open channel among the doctor and patients in the HWSNs and so information is susceptible to various security threats. Hence, the E-CLASS for HWSNs need to satisfy the following security requirements to protect patient privacy and data security:

1. Anonymity: An E-CLAS scheme must keep the patients anonymous so that the no one can extract the real IDs of the patients except the MS in the HWSNs.

2. Conditional Traceability: An E-CLAS scheme has MS in HWSNs which can able to extract the real IDs of patients whenever it is needed.

3. Nonrepudiation: An E-CLAS scheme must provide the non-repudiation so that the patients cannot refuse data once it has been sent in HWSNs.

4. Message integrity and authentication: An E-CLAS scheme for HWMSNs is required to assure message authentication and integrity, and access medical services to authorised patients.

Security model

Definition 1

The proposed scheme is said to be unforgeable in the random oracle model if there is no eve who can win the two games: Game I and Game II. Game I and Game II are played between challenger $\zeta$ and Eve ${\xi }_1$ or ${\xi }_2$, respectively.

Game 1: $\zeta$ plays the game with a Type I Eve ${\xi }_1$ to prove the unforgeability.

Initialization: $\zeta$ executes the setup algorithm and obtains the s and vars, then sends the vars to ${\xi }_1$.

• $Quer{y}_H$: ${\xi }_1$ inputs a data to obtain the hash of data.

• $Quer{y}_{\mathit{CU}}$: $\zeta$ creates a $ID\in \left\{0,,,1\right\}_{}^{\ast }$ for a new user, if ID is already a user, then $\zeta$ does nothing.

• $Quer{y}_{\mathit{PPK}}$: ${\xi }_1$ submits $PI{D}_i$ or $PI{D}_d$, then obtains $PP{K}_i$ or $PP{K}_d$.

• $Quer{y}_{\mathit{PK}}$: ${\xi }_1$ inputs a $PI{D}_i$ or $PI{D}_d$, and gets $S{K}_i$ or $S{K}_d$.

• $Quer{y}_{\mathit{UPK}}$: ${\xi }_1$ submits a $\left(P,I,D_i,,,P,K_i^{\prime }\right)$ or $\left(P,I,D_d,,,P,K_d^{\prime }\right)$, then $P{K}_i$, $P{K}_d$ is update to be $P{K}_i^{\prime }$, $P{K}_d^{\prime }$.

• $Quer{y}_{\mathit{Sign}}$: ${\xi }_1$ submits $\left(m_i,,,P,I,D_i,,,P,K_i\right)$, then gets signature ${\sigma }_i$.

Forge: ${\xi }_1$ generates $\sigma =(\gamma _{}^{\ast },{\beta }_1^{\ast },,...,{\beta }_n^{\ast },M_{}^{\ast },Ts_{}^{\ast },PID_{}^{\ast },$$PK_{}^{\ast })$. If the following requirements are satisfied, the winner is ${\xi }_1$ where $D^{\ast }=\{PI{D}_1^{\ast },PI{D}_2^{\ast },\dots ,PID_n^{}_{}^{\ast }\}$$K^{\ast }=D^{\ast }\cup \{P{K}_i^{\ast }:PI{D}_i^{\ast }\in D^{\ast }\}$$M^{\ast }=\{m_1^{\ast },m_2^{\ast },\dots ,m_n^{\ast }\}$: $\sigma$ must be a legal aggregate signature on $\left(I,D_i,,,m_i,,,P,K_{2i},,,T,s_i\right),i=\left(1,\le ,i,\le ,n\right).$ At least $\left(I,D_i,,,P,I,D_i\right)$ has not been used in the $Quer{y}_{\mathit{PPK}}$ and $\left(m_i,,,P,I,D_i,,,P,K_i\right)$ has not been used in the $Quer{y}_{\mathit{Sign}}$. Advantage of ${\xi }_1$ is defined as $A{d}_{{\xi }_1}^{\mathit{unforgeable}}=Pr[{\xi }_{1}wins]$.

Game 2: $\zeta$ plays the game with a Type II Eve ${\xi }_1$ to prove the unforgeability. Initialization: $\zeta$ executes the setup algorithm and obtains the s and vars, then sends the vars to ${\xi }_2$.

• $Quer{y}_H$: ${\xi }_2$ inputs a data to obtain the hash of data.

• $Quer{y}_{\mathit{CU}}$: $\zeta$ creates a $ID\in \left\{0,,,1\right\}_{}^{\ast }$ for new user, if ID is already a user, the $\zeta$ does nothing.

• $Quer{y}_{\mathit{PK}}$: ${\xi }_2$ inputs a $PI{D}_i$ or $PI{D}_d$, and gets $S{K}_i$ or $S{K}_d$.

• $Quer{y}_{\mathit{Sign}}$: ${\xi }_2$ submits $\left(m_i,,,P,I,D_i,,,P,K_i\right)$, then gets signature ${\sigma }_i$.

Forge: ${\xi }_2$ generates $\sigma =(\gamma ,{\beta }_1,{\beta }_2,{\beta }_3,...,{\beta }_n)$${\xi }_1$ generates $\sigma =\left(\gamma _{}^{\ast },,,{\beta }_1^{\ast },,,{\beta }_2^{\ast },,,{\beta }_3^{\ast },,,.,.,.,,,{\beta }_n^{\ast },,,M_{}^{\ast },,,T,s_{}^{\ast },,,P,I,D_{}^{\ast },,,P,K_{}^{\ast }\right)$. If the following requirements are satisfied, the winner is ${\xi }_2$ where $D^{\ast }=\{PI{D}_1^{\ast },PI{D}_2^{\ast },...,PID_n^{}_{}^{\ast }\}$$K^{\ast }=D^{\ast }\cup \{P{K}_i^{\ast }:PI{D}_i^{\ast }\in D^{\ast }\}$$M^{\ast }=\{m_1^{\ast },m_2^{\ast },...,m_n^{\ast }\}$: $\sigma$ must be a legal aggregate signature on $\left(I,D_i,,,m_i,,,P,K_{2i},,,T,s_i\right),i=\left(1,\le ,i,\le ,n\right).$ No $\left(I,D_i,,,P,I,D_i\right)$ has been utilised in the $Quer{y}_{\mathit{PK}}$ and $\left(m_i,,,P,I,D_i,,,P,K_i\right)$ has not been used in the $Quer{y}_{\mathit{Sign}}$.

Advantage of ${\xi }_2$ is defined as $A{d}_{{\xi }_2}^{\mathit{unforgeable}}=Pr[{\xi }_{2}wins]$.

[See PDF for image]

Fig. 2

Setup

[See PDF for image]

Fig. 3

PID Generation

Proposed scheme

This section presents the E-CLAS scheme for the HWSNs. The scheme takes the n signatures from the n SNs and aggregates into the single aggregate signature by AG and then this single aggregate signature is verified only by the DD. The scheme has eight algorithms as shown below:

1. Setup: MS takes $\tau$ as input and generates the $(s,P{K}_{\mathit{ms}})$ as its private and public keys as shown in Fig. 2.

2. PID Generation: The MS computes the PID of patients (SNs) and doctor(DD) using the algorithm as shown in Fig. 3.

3. PPK Generation: The MS computes the PPK of patients (SNs) and doctor(DD) using the algorithm shown in the Fig. 4.

4. Secret value generation: $S{N}_i$ and DD run the algorithm as shown in Fig. 5 to produce their secret values $S{K}_i$ and $S{K}_d$, respectively.

5. Public Key Generation: $S{N}_i$ and DD run the algorithm as shown in Fig. 6 to produce the public key pair (SK, PK).

6. Signature: $S{N}_i$ generates signature ${\sigma }_i$ on healthcare information $m_i$ using the algorithm as shown in Fig. 7.

7. Aggregation: Aggregator receives the n signatures from n$S{N}_i$ and generates an aggregate certificateless signature $\sigma$ using the algorithm as shown in Fig. 8.

8. Aggregate Verify: Doctor receives $\sigma =\left(\gamma ,,,{\beta }_1,,,{\beta }_2,,,{\beta }_3,,,.,.,.,,\right)\left({\beta }_n\right)$ on the message $\{m_i||T{s}_i\}$ where $i=(1\le i\le n)$, The doctor runs the algorithm as shown in Fig. 9 to verify the signature.

[See PDF for image]

Fig. 4

PPK Generation

[See PDF for image]

Fig. 5

Secret value generation

[See PDF for image]

Fig. 6

Public key generation

[See PDF for image]

Fig. 7

Signature

[See PDF for image]

Fig. 8

Aggregation

[See PDF for image]

Fig. 9

Aggregate-Verify

Proof of Correctness:$$\begin{array}{cc}\hfill \gamma =& \left(w_{2d},+,Q,w_{1d}\right)\sum _{i=1}^n\left[{\beta }_i,+,H_i,P,K_{2i},+,P,K_{\mathit{ms}}\right]\hfill \\ \hfill =& \left(w_{2d},+,Q,w_{1d}\right)\sum _{i=1}^n\left[r_i,P,K_{1i}\right)\hfill \\ \hfill & \left(+,e_i,R_i,+,H_i,P,K_{2i},+,P,K_{\mathit{ms}}\right]\hfill \\ \hfill =& \left(w_{2d},+,Q,w_{1d}\right)\sum _{i=1}^n\left[r_i,w_{1i},X\right)\hfill \\ \hfill & \left(+,e_i,R_i,+,H_i,P,K_{2i},+,P,K_{\mathit{ms}}\right]\hfill \\ \hfill =& \left(w_{2d},+,Q,w_{1d}\right)\sum _{i=1}^n\left[r_i,w_{1i},X\right)\hfill \\ \hfill & \left(+,e_i,f_i,X,+,H_i,P,K_{2i},+,P,K_{\mathit{ms}}\right]\hfill \\ \hfill =& \left(w_{2d},+,Q,w_{1d}\right)\sum _{i=1}^n\left[r_i,w_{1i},X\right)\hfill \\ \hfill & \left(+,e_i,f_i,X,+,H_i,w_{2i},X,+,P,K_{\mathit{ms}}\right]\hfill \\ \hfill =& \left(w_{2d},+,Q,w_{1d}\right)\sum _{i=1}^n\left[r_i,w_{1i},X\right)\hfill \\ \hfill & \left(+,e_i,f_i,X,+,H_i,w_{2i},X,+,s,X\right]\hfill \\ \hfill =& \sum _{i=1}^n\left[r_i,w_{1i},+,e_i,f_i,+,H_i,w_{2i},+,s\right]\left(w_{2d},+,Q,w_{1d}\right)X\hfill \\ \hfill =& \sum _{i=1}^n\left[r_i,w_{1i},+,H_i,w_{2i},+,n_i\right]\left(w_{2d},+,Q,w_{1d}\right)X\hfill \\ \hfill =& \alpha .\left(w_{2d},+,Q,w_{1d}\right)X\hfill \\ \hfill =& \alpha .\left(P,K_{2d},+,Q,P,K_{1d}\right)\hfill \end{array}$$

Security analysis

This section presents the security analysis and security requirements of the proposed scheme. The formal verification of the scheme is also done using AVISPA in this section.

Security analysis using random oracle model

Theorem 1

The proposed CL-DVAAS scheme is unforgeable against the eve ${\xi }_1$ if the DLP is intractable.

Proof

If ${\xi }_1$ has an advantage $ϵ$ in forging a signature, then ${\xi }_1$ wins Game I if it can create $\zeta$ with a non-negligible probability of solving the ECDLP. If $\zeta$ has $Y=sX$, where $s\in Z_q^{\ast }$, Y and X are two points on $E/F_q$, then the $\zeta$’s goal is to calculate s by modelling ${\xi }_1$. Setup: $\zeta$ chooses ID’ randomly and transmits $vars=\{\tau ,a,b,X,q,P{K}_{\mathit{ms}},H_1,H_2,H_3\}$ to ${\xi }_1$ and also selects a $P{K}_{\mathit{ms}}=sX$ randomly, and keeps empty hash lists $L_{H{P}_i},L_{H{D}_i},L_{\mathit{FP}}$ and $L_{\mathit{FD}}$, where $i=0,1,$ and 2. The following random oracle queries can be executed by ${\xi }_1$ in the game I. $Quer{y}_{H_1}$: On receiving query on data $m_i$, $\zeta$ sends ${\omega }_{H{P}_1}$ to ${\xi }_1$ if $\left(m_i,,,{\omega }_{H{P}_1}\right)$ is in $L_{H{P}_1}$; else, it picks a random ${\omega }_{H{P}_1}\in Z_q^{\ast }$, inserts the tuple $\left(m_i,,,{\omega }_{H{P}_1}\right)$ in $L_{H{P}_1}$, and then submits $L_{H{P}_1}$ to ${\xi }_1$. $Quer{y}_{H_2}$: $\zeta$ keeps a list $L_{H{P}_2}=\{\left(I,D_i,,,U,I,D_i,,,e_i\right),\left(I,D_{\mathit{ms}},,\right)\left(s,,,v,a,r,s,,,I,D_i,,,f_i\right)\}$. ${\xi }_1$ send $Quer{y}_{H_2}$ to $\zeta$ and then $\zeta$ checks if the tuple $\left(I,D_i,,,U,I,D_i,,,e_i\right)$ and $\left(I,D_{\mathit{ms}},,,s,,,I,D_i,,,v,a,r,s,,,f_i\right)$ are in $L_{H{P}_2}$ then sends $e_i$ or $f_i$ to ${\xi }_1$; otherwise, selects $e_i$,$f_i\in Z_q^{\ast }$, adds them to the list $L_{H{P}_2}$, and submits $e_i$ or $f_i$ to ${\xi }_1$. $Quer{y}_{H_3}$: $\zeta$ keeps a list $L_{H{P}_2}$ of the form $\left(P,I,D_i,,,m_i,,,{\beta }_i\right)\left(,,P,K_{2i},,,T,s_i,,,H_i\right)$. ${\xi }_1$ sends query $Quer{y}_{H_3}$ to $\zeta$. $\zeta$ checks if the tuple $\left(P,I,D_i,,,m_i,,,{\beta }_i,,,P,K_{2i},,,T,s_i,,,H_i\right)$ is in $L_{H{P}_3}$ then $\zeta$ returns $H_i$ to ${\xi }_1$; else, $\zeta$ selects a random $H_i\in Z_q^{\ast }$, and adds to $L_{H{P}_3}$, and submits $H_i$ to ${\xi }_1$. $Quer{y}_{\mathit{CU}}$: For SN: $\zeta$ keeps list $L_{\mathit{FP}}=(I{D}_i,PP{K}_i=\left(n_i,,,R_i\right),S{K}_i=\left(w_{2i},,,w_{1i},),P,K_i,=,\left(P,K_{1i},,,P,K_{2i}\right),,,P,I,D_i\right)$. ${\xi }_1$ queries $I{D}_i$ and then $\zeta$ looks in $L_{\mathit{FP}}$ and does the following:

1. If $(I{D}_i,PP{K}_i=\left(n_i,,,R_i\right),S{K}_i=\left(w_{2i},,,w_{1i}\right),P{K}_i=\left(P,K_{1i},,,P,K_{2i}\right),PI{D}_i)$ is in $L_{\mathit{FP}}$, then submits $P{K}_i$ to ${\xi }_1$.

2. If $I{D}_i\ne I{D}_i^{\prime }$, chooses two random numbers $a_i,b_i\in Z_q^{\ast }$, computes $e_i=a_i,n_i=a_i{b}_i,R_i=b_{i}X-a^{-1}P{K}_{\mathit{ms}}$, adds $(I{D}_i,PP{K}_i,=\left(n_i,,,R_i\right),S{K}_i=\left(w_{2i},,,w_{1i}\right),P{K}_i=\left(P,K_{1i},,,P,K_{2i},),PI,D_i\right)$ to $L_{\mathit{FP}}$, and then submits $P{K}_i$ to ${\xi }_1$. The computed $PP{K}_i$ can be validated using $n_i.X=e_i{R}_i+P{K}_{\mathit{ms}}.$

3. If $I{D}_i=I{D}^{\prime }$, selects randomly $a_i,b_i,c_i\in Z_q^{\ast }$, computes $R_i=a_{i}X,n_i=\mathrm{\Theta },S{K}_i=\left(b_i,,,c_i\right)$ and $P{K}_i=\left(b_i,X,,,c_i,X\right)$, add $\left(I,D_i,,,\mathrm{\Theta },,,R_i,,,S,K_i,=,\left(b_i,,,c_i\right),,,P,K_i\right)\left(,,P,I,D_i\right)$ into the list $L_{\mathit{FP}}$, and submits $P{K}_i$ to ${\xi }_1$.

For Doctor: $\zeta$ keeps list $L_{\mathit{FD}}=(I{D}_d,PP{K}_d=\left(n_d,,,R_d\right),S{K}_d=\left(w_{2d},,,w_{1d}\right),P{K}_d=\left(P,K_{1d},,,P,K_{2d}\right),PI{D}_d)$. ${\xi }_1$ queries $I{D}_d$ and then $\zeta$ looks in $L_{\mathit{FD}}$ and does the following:

1. If $(I{D}_d,PP{K}_d=\left(n_d,,,R_d\right),S{K}_d=\left(w_{2d},,,w_{1d}\right),P{K}_d=\left(P,K_{1d},,,P,K_{2d}\right),PI{D}_d)$ is in $L_{\mathit{FD}}$, then submits $P{K}_d$ to ${\xi }_1$.

2. If $I{D}_d\ne I{D}_d^{\prime }$, chooses a random $a_d,b_d\in Z_q^{\ast }$, computes $e_d=a_d,n_d=a_d{b}_d,R_d=b_{d}X-a^{-1}P{K}_{\mathit{ms}}$, adds $(I{D}_d,PP{K}_d,=\left(n_d,,,R_d\right),S{K}_d=\left(w_{2d},,,w_{1d}\right),P{K}_d=\left(P,K_{1d},,,P,K_{2d},),PI,D_d\right)$ to $L_{\mathit{FD}}$, and then submits $P{K}_d$ to ${\xi }_1$. The computed $PP{K}_d$ can be validated using $n_d.X=e_d{R}_d+P{K}_{\mathit{ms}}.$

3. If $I{D}_d=I{D}^{\prime }$, selects randomly $a_d,b_d,c_d\in Z_q^{\ast }$, computes $R_d=a_{d}X,n_d=\mathrm{\Theta },S{K}_d=\left(b_d,,,c_d\right)$ and $P{K}_d=\left(b_d,X,,,c_d,X\right)$, add $\left(I,D_d,,,\mathrm{\Theta },,,R_d,,,S,K_d,=,\left(b_d,,,c_d\right),,,P,K_d,,\right)\left(P,I,D_d\right)$ into the list $L_{\mathit{FD}}$, and submits $P{K}_d$ to ${\xi }_1$.

$Quer{y}_{\mathit{PPK}}$: For SN: ${\xi }_1$ queries on $I{D}_i$ to $\zeta$ and it does as follows:

1. If $I{D}_i=I{D}^{\prime }$, aborts the game.

2. If $I{D}_i\ne I{D}^{\prime }$, if $\left(I,D_i,,,P,P,K_i,,,S,K_i,,,P,K_i,,,P,I,D_i\right)$ is in $L_{\mathit{FP}}$ and then submits $PP{K}_i$ to ${\xi }_1$.

For Doctor: ${\xi }_1$ queries on $I{D}_d$ to $\zeta$ and it does as follows:

1. If $I{D}_d=I{D}^{\prime }$, aborts the game.

2. If $I{D}_d\ne I{D}^{\prime }$, if $\left(I,D_d,,,P,P,K_d,,,S,K_d,,,P,K_d,,,P,I,D_d\right)$ is in $L_{\mathit{FD}}$ and then submits $PP{K}_d$ to${\xi }_1$.

$Quer{y}_{\mathit{PK}}$: For SN: On receiving the query, $\zeta$ does as follows:

1. If $\left(I,D_i,,,P,P,K_i,,,S,K_i,,,P,K_i,,,P,I,D_i\right)$ is in $L_{\mathit{FP}}$, then returns $S{K}_i$ to ${\xi }_1$; else, selects randomly $x_i,y_i\in Z_q^{\ast }$, computes $P{K}_i=\left(x_i,X,,,y_i,X\right)$, then transmits $S{K}_i=\left(x_i,,,y_i\right)$ to ${\xi }_1$.

2. If $\left(I,D_i,,,P,P,K_i,,,S,K_i,,,P,K_i,,,P,I,D_i\right)$ is not in $L_{\mathit{FP}}$,${\xi }_1$ makes $S{K}_i=\mathrm{\Theta }$; if $P{K}_i=\mathrm{\Theta }$, ${\xi }_1$ selects randomly $x_i\in Z_q^{\ast }$, calculates $P{K}_i=x_i.X$, submits $P{K}_i$ to ${\xi }_1$, and inserts $\left(I,D_i,,,P,P,K_i,,,S,K_i,,,P,K_i,,,P,I,D_i\right)$ in the list $L_{\mathit{FP}}$.

For Doctor: On receiving the query, $\zeta$ does as follows:

1. If $\left(I,D_d,,,P,P,K_d,,,S,K_d,,,P,K_d,,,P,I,D_d\right)$ is in $L_{\mathit{FD}}$, then returns $S{K}_d$ to ${\xi }_1$; else, selects randomly $x_d,y_d\in Z_q^{\ast }$, computes $P{K}_d=\left(x_d,X,,,y_d,X\right)$, then transmits $S{K}_d=\left(x_d,,,y_d\right)$ to ${\xi }_1$.

2. If $\left(I,D_d,,,P,P,K_d,,,S,K_d,,,P,K_d,,,P,I,D_d\right)$ is not in $L_{\mathit{FD}}$,${\xi }_1$ makes $S{K}_d=\mathrm{\Theta }$; if $P{K}_d=\mathrm{\Theta }$, ${\xi }_1$ selects randomly $x_d\in Z_q^{\ast }$, calculates $P{K}_d=x_d.X$, submits $P{K}_d$ to ${\xi }_1$, and inserts $\left(I,D_d,,,P,P,K_d,,,S,K_d,,,P,K_d,,,P,I,D_d\right)$ in the list $L_{\mathit{FD}}$.

$Quer{y}_{\mathit{UPK}}$: For SN: ${\xi }_1$ receives query on $I{D}_i$ and then $\zeta$ performs the following:

1. If $\left(I,D_i,,,P,P,K_i,,,S,K_i,,,P,K_i,,,P,I,D_i\right)$ is in $L_{\mathit{FP}}$, makes $S{K}_i=\mathrm{\Theta }$, and replaces $P{K}_i$ with $P{K}_i^{\prime }$.

For Doctor: ${\xi }_1$ receives query on $I{D}_d$ and then $\zeta$ performs the following:

1. If $\left(I,D_d,,,P,P,K_d,,,S,K_d,,,P,K_d,,,P,I,D_d\right)$ is in $L_{\mathit{FD}}$, makes $S{K}_d=\mathrm{\Theta }$, and replaces $P{K}_d$ with $P{K}_d^{\prime }$.

$Quer{y}_{\mathit{Sign}}$: ${\xi }_1$ sends a query on $\left(m_i,,,I,D_i\right)$, $\zeta$ performs as follows:

1. Choose randomly $H_i,{\alpha }_i\in Z_q^{\ast }$.

2. Calculates ${\beta }_i={\alpha }_{i}X-H_{i}P{K}_{2i}-P{K}_{\mathit{ms}}$

3. submits $\left({\alpha }_i,,,{\beta }_i\right)$ to ${\xi }_1$ and adds the result to the corresponding list.

Forgery: ${\xi }_1$ submits a tuple $\sigma =\left(\gamma _{}^{\ast },,,{\beta }_1^{\ast },,,{\beta }_2^{\ast },,,,,.,.,.,,,{\beta }_n^{\ast },,,M_{}^{\ast },,\right)\left(T,s_{}^{\ast },,,P,I,D_{}^{\ast },,,P,K_{}^{\ast }\right)$ that fulfills the requirements of Game I. The $\zeta$ provides the solution to problem as $\left\{\left({\alpha }_i^{\ast },H_i^{-1},-,{\alpha }_i,H_i^{-1}\right)\right)\left(-,\left(H_i^{\ast _{}^{-1}},-,H_i^{-1},w_2^i\right)\right\}\left(H_i^{\ast _{}^{-1}},-,H_i^{-1}\right)_{}^{-1}$.

Probabilistic analysis: Assume $ϵ$ be the probability of ${\xi }_1$ in forging a valid signature within time $\varpi$, ${\xi }_1$ runs any query only once using the same input. ${\mathrm{\Gamma }}_1,{\mathrm{\Gamma }}_2,{\mathrm{\Gamma }}_3$ happens, $\zeta$ wins the game. ${\mathrm{\Gamma }}_1$: $Quer{y}_{\mathit{PPK}}$ by ${\xi }_2$ is not terminated. ${\mathrm{\Gamma }}_2$: ${\xi }_1$ creates a certificateless signature that is valid. ${\mathrm{\Gamma }}_3$: Likelihood of ${\xi }_1$ creating a legal forgery and $\zeta$ not terminating the procedure. Probability of ${\xi }_1$ wins Game I is $P[{\mathrm{\Gamma }}_1\mathrm{\Lambda }{\mathrm{\Gamma }}_2\mathrm{\Lambda }{\mathrm{\Gamma }}_3]=P[{\mathrm{\Gamma }}_1]P[{\mathrm{\Gamma }}_2|{\mathrm{\Gamma }}_1]P[{\mathrm{\Gamma }}_3|{\mathrm{\Gamma }}_2\mathrm{\Lambda }{\mathrm{\Gamma }}_1]\ge (1-\frac{1}{q_c+1}).ϵ.\frac{1}{q_c+1}\ge ({\frac{q_C}{q_c+1}}^{q_{\mathit{ppk}}})(\frac{ϵ}{q_c+1})$, where, $q_c$ be the number of $Quer{y}_{\mathit{CU}}$ and $q_{\mathit{ppk}}$ be the number of $Quer{y}_{\mathit{PPK}}$ So, $\zeta$ solves ECDLP with $ϵ$. However, intractability of the ECDLP makes a contradiction with it. Hence, the proposed scheme is proved to be unforgeable against ${\xi }_1$ in the random oracle model. $\square$

Theorem 2

The proposed CL-DVAAS scheme is unforgeable against the eve ${\xi }_2$ when the DLP is intractable.

Proof

If ${\xi }_2$ successfully forges a signature with an advantage $ϵ$, then ${\xi }_2$ wins Game II if it can create $\zeta$ with a non-negligible probability of solving the ECDLP. If $\zeta$ has $Y=sX$, and $s\in Z_q^{\ast }$,Y and X are points on $E/F_q$; $\zeta$’s goal is to calculate the s with modelling ${\xi }_2$. Setup: $\zeta$ chooses ID’ randomly and transmit $vars=\{\tau ,a,b,X,q,P{K}_{\mathit{ms}},H_1,H_2,H_3\}$ to ${\xi }_1$ and also selects a $P{K}_{\mathit{ms}}=sX$ randomly, and keeps empty hash lists $L_{H{P}_i},L_{H{D}_i},L_{\mathit{FP}}$ and $L_{\mathit{FD}}$, where $i=0,1,$ and 2. ${\xi }_2$ has the master secret key so it does not need to execute the $Quer{y}_{\mathit{PPK}}$ and $Quer{y}_{\mathit{UPK}}$. The following random oracle queries can be executed by ${\xi }_2$ in the game I. $Quer{y}_{H_1}$, $Quer{y}_{H_2}$, $Quer{y}_{H_3}$ are the same as Theorem 1. $Quer{y}_{\mathit{CU}}$: For SN: $\zeta$ keeps list $L_{\mathit{FP}}=(I{D}_i,PP{K}_i=\left(n_i,,,R_i\right),S{K}_i=\left(w_{2i},,,w_{1i}\right),P{K}_i=\left(P,K_{1i},,,P,K_{2i}\right),PI{D}_i)$. ${\xi }_1$ queries $I{D}_i$ and then $\zeta$ looks in $L_{\mathit{FP}}$ and does the following:

1. If $(I{D}_i,PP{K}_i=\left(n_i,,,R_i\right),S{K}_i=\left(w_{2i},,,w_{1i}\right),P{K}_i=\left(P,K_{1i},,,P,K_{2i}\right),PI{D}_i)$ is in $L_{\mathit{FP}}$, then submits $P{K}_i$ to ${\xi }_1$.

2. If $I{D}_i\ne I{D}_i^{\prime }$, chooses a random $a_i,b_i\in Z_q^{\ast }$, computes $e_i=H_1\left(I,D_i,,,U,I,D_i\right),f_i=H_1\left(I,D_{\mathit{ms}},,,s,,,I,D_i,,,v,a,r,s\right),R_i=f_{i}X,n_i=e_i{f}_i+s,S{K}_i=\left(e_i,,,f_i\right),P{K}_{1i}=a_{i}X,P{K}_{2i}=b_{i}X,P{K}_i=\left(P,K_{1i},,,P,K_{2i}\right),$ adds $\{I{D}_i,PP{K}_i,S{K}_i,P{K}_i,PI{D}_i\}$ to $L_{\mathit{FP}}$, and then submits $P{K}_i$ to ${\xi }_2$.

3. If $I{D}_i=I{D}^{\prime }$, computes $e_i=H_1\left(I,D_i,,,U,I,D_i\right),f_i=H_1\left(I,D_{\mathit{ms}},,,s,,,I,D_i,,,v,a,r,s\right),R_i=f_{i}X,S{K}_i=\mathrm{\Theta },P{K}_i=\psi ,$ adds $\left(I,D_i,,,P,P,K_i,,,\mathrm{\Theta },,,P,K_i,,,P,I,D_i\right)$ to $L_{\mathit{FP}}$, and submits $P{K}_i$ to ${\xi }_2$.

For Doctor: $\zeta$ keeps list $L_{\mathit{FD}}=(I{D}_d,PP{K}_d=\left(n_d,,,R_d\right),S{K}_d=\left(w_{2d},,,w_{1d}\right),P{K}_d=\left(P,K_{1d},,,P,K_{2d}\right),PI{D}_d)$. ${\xi }_1$ queries $I{D}_d$ and then $\zeta$ looks in $L_{\mathit{FD}}$ and does the following:

1. If $(I{D}_d,PP{K}_d=\left(n_d,,,R_d\right),S{K}_d=\left(w_{2d},,,w_{1d}\right),P{K}_d=\left(P,K_{1d},,,P,K_{2d}\right),PI{D}_d)$ is in $L_{\mathit{FD}}$, then submits $P{K}_d$ to ${\xi }_1$.

2. If $I{D}_d\ne I{D}_d^{\prime }$, chooses a random $a_d,b_d\in Z_q^{\ast }$, computes $e_d=H_1\left(I,D_d,,,U,I,D_d\right),f_d=H_1\left(I,D_{\mathit{ms}},,,s,,,I,D_d,,,v,a,r,s\right),R_d=f_{d}X,n_d=e_d{f}_d+s,S{K}_d=\left(e_d,,,f_d\right),P{K}_{1d}=a_{d}X,P{K}_{2d}=b_{d}X,P{K}_d=\left(P,K_{1d},,,P,K_{2d}\right),$ adds {$I{D}_d,PP{K}_d,S{K}_d,P{K}_d,PI{D}_d\}$ to $L_{\mathit{FD}}$,and then submits $P{K}_d$ to ${\xi }_2$.

3. If $I{D}_d=I{D}^{\prime }$, computes $e_d=H_1\left(I,D_d,,,U,I,D_d\right),f_d=H_1\left(I,D_{\mathit{ms}},,,s,,,I,D_d,,,v,a,r,s\right),R_d=f_{d}X,S{K}_d=\mathrm{\Theta },P{K}_d=\psi ,$ adds $\left(I,D_d,,,P,P,K_d,,,\mathrm{\Theta },,,P,K_d,,,P,I,D_d\right)$ to $L_{\mathit{FD}}$, and submits $P{K}_d$ to ${\xi }_2$.

$Quer{y}_{\mathit{PK}}$: For SN: ${\xi }_2$ sends query on $I{D}_i$ to $\zeta$ and then $\zeta$ does the following:

1. If $I{D}_i=I{D}^{\prime }$, aborts the game.

2. If $I{D}_i\ne I{D}^{\prime }$, if $\left(I,D_i,,,P,P,K_i,,,S,K_i,,,P,K_i,,,P,I,D_i\right)$ is in $L_{\mathit{FP}}$, then submits $S{K}_i$ to ${\xi }_2$.

For Doctor: ${\xi }_2$ sends query on $I{D}_d$ to $\zeta$ and then $\zeta$ does the following:

1. If $I{D}_d=I{D}^{\prime }$, aborts the game.

2. If $I{D}_d\ne I{D}^{\prime }$, if $\left(I,D_d,,,P,P,K_d,,,S,K_d,,,P,K_d,,,P,I,D_d\right)$ is in $L_{\mathit{FD}}$, then submits $S{K}_d$ to ${\xi }_2$.

$Quer{y}_{\mathit{Sign}}$: ${\xi }_2$ sends a query on $(m_i,I{D}_i)$ to $\zeta$ and $\zeta$ does as follows:

1. Selects randomly $H_i,{\alpha }_i\in Z_q^{\ast }.$

2. Calculates ${\beta }_i={\alpha }_{i}X-H_{i}P{K}_{2i}-P{K}_{\mathit{ms}}$

3. Submits $({\alpha }_i,{\beta }_i)$ to ${\xi }_2$ and inserts results to the corresponding list.

Forgery: ${\xi }_2$ submits a tuple $\sigma =\left(\gamma _{}^{\ast },,,{\beta }_1^{\ast },,,{\beta }_2^{\ast },,,,,.,.,.,,,{\beta }_n^{\ast },,,M_{}^{\ast },,\right)\left(P,I,D_{}^{\ast },,,T,s_{}^{\ast },,,P,K_{\ast }^{}\right)$ that fulfils the requirements of Game II. The $\zeta$ provides the solution to problem as $\left(\alpha _i^{\ast },-,{\alpha }_i\right)\left(H_i^{\ast },-,H_i\right)_{}^{-1}$. Probabilistic analysis: Assume $ϵ$ be the probability of ${\xi }_2$ forge a valid signature within the time period $\varpi$ and ${\xi }_2$ has not run any hash query more than once with same input in the game. ${\mathrm{\Gamma }}_1,{\mathrm{\Gamma }}_2,{\mathrm{\Gamma }}_3$ happens, $\zeta$ wins the game. ${\mathrm{\Gamma }}_1$: $Quer{y}_{\mathit{PK}}$ by $x{i}_2$ is not terminated. ${\mathrm{\Gamma }}_2$: ${\xi }_2$ creates a certificateless signature that is valid. ${\mathrm{\Gamma }}_3$: Likelihood of ${\xi }_2$ creating a legal forgery and $\zeta$ not terminating the procedure. Probability of ${\xi }_2$ wins Game I is $P[{\mathrm{\Gamma }}_1\mathrm{\Lambda }{\mathrm{\Gamma }}_2\mathrm{\Lambda }{\mathrm{\Gamma }}_3]=P[{\mathrm{\Gamma }}_1]P[{\mathrm{\Gamma }}_2|{\mathrm{\Gamma }}_1]P[{\mathrm{\Gamma }}_3|{\mathrm{\Gamma }}_2\mathrm{\Lambda }{\mathrm{\Gamma }}_1]\ge {(1\frac{1}{q_c+1})}^{q_{\mathit{pk}}}.ϵ.\frac{1}{q_c+1}\ge {\frac{q_C}{q_c+1}}^{q_{\mathit{pk}}}(\frac{ϵ}{q_C+1})$. Where, $q_c=$ the number of $Quer{y}_{\mathit{CU}}$ and $q_{\mathit{pk}}=$ be the number of $Quer{y}_{\mathit{PK}}$ So, $\zeta$ solves ECDLP with $ϵ$. However, intractability of the ECDLP makes a contradiction with it. Hence, the proposed scheme is proved to be unforgeable against ${\xi }_2$ in the random oracle model. $\square$

[See PDF for image]

Fig. 10

Simulation result in OFMC back-end

[See PDF for image]

Fig. 11

Simulation result in CL-Atse back-end

Table 2. Computation cost

Schemes	Sign-Agg	Agg-Verify	Total Execution Cost (ms)
[3]	1.768n	$2.21n+2.21$	$3.978n+2.21$
[6]	$0.442n+1.326$	$1.326n+0.442$	$1.768n+1.768$
[8]	1.768n	$0.884n+0.442$	$2.652n+0.442$
[31]	0.442n	$1.326n+0.442$	$1.768n+0.442$
[32]	$0.884n+0.442$	1.326n	$2.210n+0.442$
Our Scheme	$0.442n+0.884$	$0.884n+0.442$	$1.326n+1.326$

[See PDF for image]

Fig. 12

Comparison of Computation Cost for n=100

Security requirements

Table 3. Communication cost

Schemes	Single Signature	Aggregate Signature	Size
[3]	489n	$163n+326$	$652n+326$
[6]	489n	$326n+163$	$815n+163$
[8]	489n	489	$489n+489$
[31]	489n	326n	815n
[32]	326n	326	$326n+326$
Our Scheme	326n	$326n+163$	$652n+163$

1. Anonymity: The scheme uses the pseudoidentity to protect a patient’s and doctor’s privacy. If an attacker hijacks all of the patient’s information exchanged via the public network, it has no way of knowing the patient’s or doctor’s real identity as the proposed scheme protects the real id of a patient $I{D}_i$ or doctor $I{D}_d$ by masking the real id in pseudoidentity $PI{D}_i=H_1\left(s,,,I,D_i,,,t_i\right)\oplus UI{D}_i$. or $PI{D}_d=H_1\left(s,,,I,D_d,,,t_d\right)\oplus UI{D}_d$. An attacker cannot gain the real id $I{D}_i$ or $I{D}_d$ because $s,I{D}_i,I{D}_d,t_i$ and $t_d$ are secret values, and $H_1$ is one-way hash function. As a result, the proposed scheme is capable of achieving anonymity.

2. Conditional traceability: Despite the fact that a patient’s identity $I{D}_i$ is masked under its pseudoidentity $PI{D}_i$ the MS can access it if required. The MS has power to calculate the pseudoidentity on a contentious message. MS recovers patient’s real id since it has $\left(I,D_i,,,U,I,D_i,,,P,P,K_i,,\right)\left(t_i\right)$ and s. On receiving contentious message signed by patient with $PI{D}_i^{\ast }$, MS computes $PI{D}_i=H_1\left(s,,,I,D_i,,,t_i\right)\oplus UI{D}_i$ and verifies if $PI{D}_i=PI{D}_i^{\ast }$. If this is true, the signer of the message is a $I{D}_i$.

3. Non-repudiation: The MS can identify a patient’s identity on the message. As a result, no patient can refuse the signature on that message. The MS can perform signature verification and conditional traceability.

4. Message integrity and authentication: The proposed scheme has been shown to be safe against forgery attacks using Theorem 1 and 2. As a result, ${\xi }_1$ or ${\xi }_2$ cannot tamper the healthcare information which are signed by the SNs. The eves also cannot impersonate the SNs or patient. When the doctor receives a certificateless aggregate signature $\sigma =(\gamma ,{\beta }_1,{\beta }_2,{\beta }_3,...,{\beta }_n)$ on $\{m_1,m_2,...,m_n^{}\}$ signed by $\{I{D}_1,I{D}_2,...,ID_n^{}\}$, it checks the validity of $\sigma$ and if it is valid, doctor confirms that messages $\{m_1,m_2,...,m_n^{}\}$ are sent by $I{D}_i$ for $i=1,2,..,n$ and also these message are not tampered during the transmission. As a result, the proposed system ensures message integrity and authenticity.

[See PDF for image]

Fig. 13

Comparison of communication cost for n=100

Formal verification using AVISPA

Automated Validation of Internet Security Protocols and Applications (AVISPA) is used to evaluate the security protocol’s resistance to active and passive threats. We use the AVISPA tool to verify the security of the proposed scheme formally. To specify our scheme in AVISPA, High Level Protocols Specification Language (HLPSL) is used. The code is available at. https://github.com/ilalitnegi/AVISPA_CLAS.

Out of four AVISPA backends, OFMC and CL-AtSe are used as the other backend TA4SP and SATMC do not support feature like bitwise XOR. Figure 10 and Fig. 11 present the simulation results using OFMC and CL-AtSe, respectively. The summary section in the figures show that the proposed scheme is SAFE. Thus, our scheme is resistant to the active and passive attacks such as man-in-the-middle, replay attacks, etc.

Performance analysis

This section presents the performance of the proposed scheme and the related existing schemes [3, 6, 8, 31, 32] in the terms of computation and communication costs. We take n be the number of patients in HWSNs for computing computation and communication costs.

Computation cost

The computation cost is calculated by the summation of time taken to perform the scalar multiplication operation in the signature, aggregation and aggregate-verify algorithms as these algorithms are executed frequently. We use the same running time $(T_{\mathit{mul}}\approx 0.442ms)$ of ECC based scalar multiplication operation $(O_{\mathit{mul}})$ as in Du et al. [3]. Xie et al. [3] requires $(9n+5)$$O_{\mathit{mul}}$. So its total computation cost is $(9n+5)T_{\mathit{mul}}=(3.978n+2.21)ms$. Gayathri et al. [8] requires $(6n+1)$$O_{\mathit{mul}}$. Its total computation cost is $(6n+1)T_{\mathit{mul}}=(2.652n+0.442)ms$. Du et al. [31] requires $(4n+1)$$O_{\mathit{mul}}$. Its total computation cost is $(4n+1)T_{\mathit{mul}}=(1.768n+0.442)ms$. Deng et al. [6] requires $(4n+4)$$O_{\mathit{mul}}$. Its total computation cost is $(4n+4)T_{\mathit{mul}}=(1.768n+1.768)ms$. Yang et al. [32] has the total computation cost of $(5n+1)T_{\mathit{mul}}=(2.210n+0.442)ms$. In the proposed scheme, signature of each patient requires $\left(n,+,2\right)$$O_{\mathit{mul}}$ in G. So, the computation time required is $\left(n,+,2\right)T_{\mathit{mul}}$. Time required to generate aggregate signature is $\left(2,n,+,1\right)T_{\mathit{mul}}$ as it requires $\left(2,n,+,1\right)$$O_{\mathit{mul}}$ in G. Hence, the total computation cost of the proposed scheme is $\left(n,+,2\right)T_{\mathit{mul}}+\left(2,n,+,1\right)T_{\mathit{mul}}=0.442n+0.884+0.884n+0.442=(1.326n+1.326)$ms. The comparison of the computation cost of all the existing related schemes [3, 6, 8, 31, 32] and the proposed scheme is shown in Table 2. Figure 12 shows the computation cost for the proposed scheme and the related schemes [3, 6, 8, 31] for 100 patients in the HWSNs. From Table 2 and Fig. 12, it can be clearly seen that the proposed system has the least computation cost as compared to the other related schemes [3, 6, 8, 31].

Communication cost

The communication cost is calculated by adding the size of signature of n patients and the aggregate signature. Assume that the size of G and $Z_q^{\ast }$ are 163 bits each. In the proposed scheme, signature of patient has one-one element in G and $Z_q^{\ast }$. So, the size of signature for n patients is $n\left(|G|+|,Z_q^{\ast },|\right)$. Size of aggregate signature is $\left(n,+,1\right)|G|+n|Z_q^{\ast }|$ as it has $n+1$ elements in G and n elements in $Z_q^{\ast }$. Hence, the total communication cost of the proposed scheme is $n\left(|G|+|,Z_q^{\ast },|\right)+\left(n,+,1\right)|G|+n|Z_q^{\ast }|=n\left(163,+,163\right)+\left(n,+,1\right)163+(n)163=652n+163$ bits. The comparison of the communication cost of the related schemes [3, 6, 8, 31, 32] and that of the proposed scheme is shown in Table 3. From this table, it can be clearly seen that the proposed system has lower communication cost than the schemes [3, 6, 31] and higher than the scheme [8, 32]. However, the scheme [8] is vulnerable to malicious medical server and public key replacement attacks [33] and the scheme [32] has more computation cost than the proposed scheme, which is already shown in Table 2. Figure 13 shows that the communication cost of the proposed scheme and the existing schemes [3, 6, 8, 31, 32] for 100 patients in the HWSNs.

Conclusion

In HWSNs, the patients real time medical data like BP, oxygen and heart rate is recorded through the wearable devices and then it is sent to the doctors for the assessment over the public network. As the patients medical data contains the sensitive information, so the main issue in the HWSNs becomes to send the data to the designated doctor with full integrity while maintaining the privacy of the patient and reducing the computation cost. To provide a secure communication between patients and doctors, this paper have presented a certificateless aggregate signature scheme called E-CLAS based on ECC for healthcare environment. We have analyzed its security using random oracle model formally. The performance analysis has revealed that the computation cost of the proposed scheme is less than the that of the existing related schemes.

Funding

Not applicable.

Availability of supporting data

Not applicable.

Declarations

Conflict of interest

The authors have no relevant financial or non-financial interests to disclose.

Ethical approval

Not applicable.

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

References

1. Sakthidharan G, Chitra S (2012) A survey on wireless sensor network: an application perspective. In: 2012 international conference on computer communication and informatics. IEEE, pp 1–5

2. Ko, J; Lu, C; Srivastava, MB; Stankovic, JA; Terzis, A; Welsh, M. Wireless sensor networks for healthcare. Proc IEEE; 2010; 98, 11 pp. 1947-1960. [DOI: https://dx.doi.org/10.1109/JPROC.2010.2065210]

3. Xie, Y; Li, X; Zhang, S; Li, Y. $\mathit{iclas}$: an improved certificateless aggregate signature scheme for healthcare wireless sensor networks. IEEE Access; 2019; 7, pp. 15170-15182. [DOI: https://dx.doi.org/10.1109/ACCESS.2019.2894895]

4. Thamilarasu G, Odesile A (2016) Securing wireless body area networks: challenges, review and recommendations. In: 2016 IEEE international conference on computational intelligence and computing research (ICCIC). IEEE, pp 1–7

5. Al Ameen, M; Liu, J; Kwak, K. Security and privacy issues in wireless sensor networks for healthcare applications. J Med Syst; 2012; 36, 1 pp. 93-101. [DOI: https://dx.doi.org/10.1007/s10916-010-9449-4]

6. Deng, L; Yang, Y; Gao, R. Certificateless designated verifier anonymous aggregate signature scheme for healthcare wireless sensor networks. IEEE Internet Things J; 2021; 8, 11 pp. 8897-8909. [DOI: https://dx.doi.org/10.1109/JIOT.2021.3056097]

7. Sangari AS, Manickam JML (2014) Public key cryptosystem based security in wireless body area network. In: 2014 international conference on circuits, power and computing technologies [ICCPCT-2014]. IEEE, pp 1609–1612

8. Gayathri, N; Thumbur, G; Kumar, PR; Rahman, MZU; Reddy, PV et al. Efficient and secure pairing-free certificateless aggregate signature scheme for healthcare wireless medical sensor networks. IEEE Internet Things J; 2019; 6, 5 pp. 9064-9075. [DOI: https://dx.doi.org/10.1109/JIOT.2019.2927089]

9. Al-Riyami SS, Paterson KG (2003) Certificateless public key cryptography. In: International conference on the theory and application of cryptology and information security. Springer, pp 452–473

10. Boneh D, Gentry C, Lynn B, Shacham H (2003) Aggregate and verifiably encrypted signatures from bilinear maps. In: International conference on the theory and applications of cryptographic techniques. Springer, pp 416–432

11. Islam, SH; Biswas, G. Provably secure certificateless strong designated verifier signature scheme based on elliptic curve bilinear pairings. J King Saud Univ Comput Inf Sci; 2013; 25, 1 pp. 51-61.

12. Keerthika, M; Shanmugapriya, D. Wireless sensor networks: active and passive attacks-vulnerabilities and countermeasures. Glob Transit Proc; 2021; 2, 2 pp. 362-367. [DOI: https://dx.doi.org/10.1016/j.gltp.2021.08.045]

13. Li, M; Lou, W; Ren, K. Data security and privacy in wireless body area networks. IEEE Wirel Commun; 2010; 17, 1 pp. 51-58. [DOI: https://dx.doi.org/10.1109/MWC.2010.5416350]

14. Gorantla MC, Saxena A (2005) An efficient certificateless signature scheme. In: International conference on computational and information science. Springer, pp 110–116

15. Tan CC, Wang H, Zhong S, Li Q (2008) Body sensor network security: an identity-based cryptography approach. In: Proceedings of the first ACM conference on wireless network security, pp 148–153

16. Shen, L; Ma, J; Liu, X; Wei, F; Miao, M. A secure and efficient id-based aggregate signature scheme for wireless sensor networks. IEEE Internet Things J; 2016; 4, 2 pp. 546-554. [DOI: https://dx.doi.org/10.1109/JIOT.2016.2557487]

17. Huang X, Susilo W, Mu Y, Zhang F (2005) On the security of certificateless signature schemes from asiacrypt 2003. In: International conference on cryptology and network security. Springer, pp 13–25

18. Zhang, L; Zhang, F. A new certificateless aggregate signature scheme. Comput Commun; 2009; 32, 6 pp. 1079-1085.3469259 [DOI: https://dx.doi.org/10.1016/j.comcom.2008.12.042]

19. Au M.H, Mu Y, Chen J, Wong D.S, Liu J.K, Yang G (2007) Malicious kgc attacks in certificateless cryptography. In: Proceedings of the 2nd ACM symposium on information, computer and communications security, pp 302–311

20. He, D; Huang, B; Chen, J. New certificateless short signature scheme. IET Inform Secur; 2013; 7, 2 pp. 113-117. [DOI: https://dx.doi.org/10.1049/iet-ifs.2012.0176]

21. Kumar, P; Kumari, S; Sharma, V; Sangaiah, AK; Wei, J; Li, X. A certificateless aggregate signature scheme for healthcare wireless sensor network. Sustain Comput Inform Syst; 2018; 18, pp. 80-89.

22. Liu, J; Cao, H; Li, Q; Cai, F; Du, X; Guizani, M. A large-scale concurrent data anonymous batch verification scheme for mobile healthcare crowd sensing. IEEE Internet Things J; 2018; 6, 2 pp. 1321-1330. [DOI: https://dx.doi.org/10.1109/JIOT.2018.2828463]

23. Rabie, OBJ; Selvarajan, S; Hasanin, T; Mohammed, GB; Alshareef, AM; Uddin, M. A full privacy-preserving distributed batch-based certificateless aggregate signature authentication scheme for healthcare wearable wireless medical sensor networks (hwmsns). Int J Inform Secur; 2024; 23, 1 pp. 51-80. [DOI: https://dx.doi.org/10.1007/s10207-023-00748-1]

24. Zhou, L; Yin, X. An improved pairing-free certificateless aggregate signature scheme for healthcare wireless medical sensor networks. Plos one; 2022; 17, 7 0268484. [DOI: https://dx.doi.org/10.1371/journal.pone.0268484]

25. Qiao, Z; Yang, Q; Zhou, Y; Yang, B; Zhang, M. A novel construction of certificateless aggregate signature scheme for healthcare wireless medical sensor networks. Comput J; 2023; 66, 11 pp. 2810-2824.4668004 [DOI: https://dx.doi.org/10.1093/comjnl/bxac123]

26. Hashimoto, K; Ogata, W. Unrestricted and compact certificateless aggregate signature scheme. Inform Sci; 2019; 487, pp. 97-114. [DOI: https://dx.doi.org/10.1016/j.ins.2019.03.005]

27. Yang B, Hu Z, Xiao Z (2009) Efficient certificateless strong designated verifier signature scheme. In: 2009 international conference on computational intelligence and security. IEEE, vol 1, pp 432–436

28. Duan, M; Zhu, J; Li, Y. Efficient and provably-secure certificateless strong designated verifier signature scheme without pairings. Tehnički vjesnik; 2018; 25, 6 pp. 1801-1809.

29. Lin, H-Y. A new certificateless strong designated verifier signature scheme: non-delegatable and ssa-kca secure. Ieee Access; 2018; 6, pp. 50765-50775. [DOI: https://dx.doi.org/10.1109/ACCESS.2018.2809437]

30. Xiong, H; Guan, Z; Chen, Z; Li, F. An efficient certificateless aggregate signature with constant pairing computations. Inform Sci; 2013; 219, pp. 225-235.2991567 [DOI: https://dx.doi.org/10.1016/j.ins.2012.07.004]

31. Du, H; Wen, Q; Zhang, S. An efficient certificateless aggregate signature scheme without pairings for healthcare wireless sensor network. IEEE Access; 2019; 7, pp. 42683-42693. [DOI: https://dx.doi.org/10.1109/ACCESS.2019.2907298]

32. Yang X, Wen H, Diao R, Du X, Wang C (2023) Improved security of a pairing-free certificateless aggregate signature in healthcare wireless medical sensor networks. IEEE Internet Things J

33. Liu, J; Wang, L; Yu, Y. Improved security of a pairing-free certificateless aggregate signature in healthcare wireless medical sensor networks. IEEE Internet Things J; 2020; 7, 6 pp. 5256-5266. [DOI: https://dx.doi.org/10.1109/JIOT.2020.2979613]