A Secure and Efficient Identity-Based Proxy Signcryption in Cloud Data Sharing

Abstract

As a user in modern societies with the rapid growth of Internet environment and more complicated business flow processes in order to be effective at work and accomplish things on time when the manager of the company went for a business trip, he/she need to delegate his/her signing authorities to someone such that, the delegatee can act as a manager and sign a message on his/her behalf. In order to make the delegation process more secure and authentic, we proposed a secure and efficient identity-based proxy signcryption in cloud data sharing (SE-IDPSC-CS), which provides a secure privilege delegation mechanism for a person to delegate his/her signcryption privilege to his/her proxy agent. Our scheme allows the manager of the company to delegate his/her signcryption privilege to his/her proxy agent and the proxy agent can act as a manager and generate signcrypted messages on his/her behalf using special information called "proxy key". Then, the proxy agent uploads the signcrypted ciphertext to a cloud service provider (CSP) which can only be downloaded, decrypted and verified by an authorized user at any time from any place through the Internet. Finally, the security analysis and experiment result determine that the proposed scheme outperforms previous works in terms of functionalities and computational time.

1. Introduction

The objective of public key cryptography (PKC) and digital signature is used to increase the privacy of the data by achieving the four important security requirements such as confidentiality, integrity, authentication, and non-repudiation. A traditional way of obtaining these four security goals is first to sign then apply the encryption algorithm on the message. Recently those most popular research areas such as cloud email systems, computer communications, a delegation of organizational power and electronic transactions need both security requirements. Because of the high computational cost and communication overhead, it’s difficult to achieve all these goals simultaneously with the traditional approach. In 1997, Zheng [1] made the signcryption idea that accomplishes both confidentiality and authentication in a single reasonable step with better performance than the traditional methods. Later, many signcryption schemes have been proposed [2-9]. Some of these are proxy signcryption [6-8] which efficiently combines the idea of proxy signature with the signcryption scheme, and allows an entity to delegate its signcryption authority to a trusted agent on PKI framework. To solve the key management processes in PKI, the idea of ID-based cryptography (IBC) was developed by Shamir [10] in 1984. In ID-based cryptography, the recognized string (ASCII string ) or identity such as email addresses, postal code, social security number represents an individual or organization public key, while the private key of user’s is generated by PKG from their identity information. Malone-Lee [11] extended the signcryption idea to an ID-based signcryption scheme. Ever since many ID-based signatures [12-15] and signcryption [16-20] schemes have been proposed. Their key objective is to decrease the computational costs and develop efficient ID-based signcryption schemes. Now let’s consider the situation when the manager of a company went for a business trip for a short or long period of time, in order to be effective at work and accomplish things on time he/she must delegate his/her signcryption authority to a proxy signcryptor who can legitimately signcrypt on behalf of him/her. So, this kind of situation must fulfill all the security requirements and the delegation process must be done in a secure and authentic way. The basic idea of our SE-IDPSC-CS scheme is as follow; the manager of the company officially delegate his/her signcryption authorization to his/her proxy agent and the proxy agent act as a manager and generate signcrypted messages on his/her behalf by using special information called “ proxy key”. Then the proxy agent uploads the signcrypted ciphertext to a trusted cloud service provider (CSP). Finally, the authorized user can download, recover and verify its source and validity at any time from any place through the Internet. Recently, Li and Chen [20] made ID-based proxy signcryption model, but their scheme is not secure and proxy protected, because the delegator is the only one who generates the proxy key without the knowledge of the proxy agent and they simply added the proxy key on [20] signcryption algorithm, if the original signcrypter remove the proxy key he/she will recover the message. Chen et al. [22] presented a probably secure ID-based proxy signcryption model under CDHP and BDHP assumptions. Ming et al. [23] constructed an ID-based proxy signcryption model without random oracles. Zhou [24] developed secure ID-based generalized proxy signcryption without random oracles from bilinear pairings and H Yu [25] proposed an ID-based proxy signcryption protocol with UC. But still, now all the above schemes consume high computational cost. This paper explains a new secure and efficient identity-based proxy signcryption in cloud data sharing (SE-IDPSC-CS) which is more secure and efficient than the existing schemes. The design philosophy behind our proposed scheme is as follow, the manager of the company that is the original signcryptor officially delegate his/ her signcryption authority to proxy signcryptor, who then act as a manager and generate a signcrypted messages on his/her behalf and upload the signcrypted ciphertext to cloud service provider (CSP), it is a trusted server which supplies storage services and sends the signcrypted ciphertexts to an authorized user. Finally, an authorized user download, decrypt and confirm the source and validness of the message. We also proof the security of the scheme in terms of IND-IDPSC-CS-CCA2 and EF-IDPSC-CS-CMA under DBDH and CDH problems respectively. We organized the paper as follows. We define the preliminary work and the basic notations in section 3. The details of the system model, the overall framework and the security definition are presented in section 4. Section 5, provide the details of the construction while section 6 and section 7 describe security proof and performance analysis respectively. Finally, we conclude the paper in sections 8.

2. Related Work

A proxy signcryption [6-8] is a cryptographic algorithm that merges the idea of signcryption and algorithm with a proxy signature. In cryptography, signcryption is a cryptographic algorithm that achieves the functionality of both confidentiality and authentication in a single reasonable step with better performance than a traditional approach. The first signcryption scheme was proposed by Y. Zheng [1] later, several signcryption schemes have been proposed [2-8]. Proxy signature model, allows an entity officially delegate his/her signing right to someone so that he/she can sign a message on his/her behalf. The first proxy signature was proposed by Mambo et al. [26]. Later many proxy signature schemes [27-28] have been proposed. To solve key controlling processes in PKI, the concept of ID-based cryptography (IBC) was developed by Shamir [10] in 1984. In ID-based cryptography, the well-known string (ASCII string ) or identity such as email address, postal code, social security number represents an individual or organization public key, while the secret key of the user's generated by PKG from their identity data. Later, several well-organized ID-based signatures [29-31] and ID-based schemes using pairings [32-33] have been proposed. Later many new ID-based signatures [34-35] and signcryption [18-20] schemes have been proposed. Malone-Lee [11] elaborated the signcryption idea to an ID-based signcryption scheme. Ever since many ID-based signcryption schemes have been proposed [15-20]. Recently, Li and Chen proposed an ID-based proxy signcryption scheme [21]. However, their scheme is not proxy protected and does not meet the unforgeability and forward security. In 2005, Wang and Cao [36] proposed an ID-based proxy signature and proxy signcryption scheme, which is based on [18] and is efficient than [21] in terms of computational point of view. Chen et al. [22] presented a probably secure ID-based proxy signcryption model under CDHP and BDHP assumptions. Ming et al. [23] constructed an ID-based proxy signcryption model without random oracles. Zhou [24] developed secure ID-based generalized proxy signcryption without random oracles from bilinear pairings and H Yu [25] proposed an ID-based proxy signcryption protocol with UC. Later Many schemes have been proposed for efficient and secure data accessing [37-40]. In this paper, by combining the idea of ID-based signcryption and proxy signature schemes, we proposed a new secure and efficient identity-based proxy signcryption in cloud data sharing (SE-IDPSC-CS) scheme, which is secure and efficient than the above schemes. In this scheme, after validating the identity of the delegator the proxy agent creates valid signcrypted ciphertext and uploads it to a cloud service provider (CSP). Moreover, only the authorized user can download, decrypt and confirm the source and authenticity of the message. Compared to the above schemes our scheme archived the necessary security requirements.

3. Preliminaries

In this section, we briefly define the bilinear pairings and notations.

3.1 Bilinear Pairings

Let G₁ additive and G₂ multiplicative cyclic groups having similar prime order q. Let a, b ∊ Z_q* and G₁ is generated by P. A bilinear map ê : G₁ × G₁ → G₂ has the following properties:

a. Bilinear : (aP, bQ)=(P,Q)^ab for all P, Q ∊ G₁, a,b ∊ Z_q*.

b. Non-degenerate : P, Q ∊ G₁ so that, ê(P, Q) ≠ 1 , where is the identity of G₂.

c. Computability : for all P,Q ∊ G₁, ê(P, Q) efficiently computable.

The revised Weil pairing and Tate pairing is acceptable applications [31]. The security of our EF-IDPSC-CS model depends on the following hard Diffie-Hellman problems. Given G₁ additive and G₂ multiplicative cyclic groups of the same prime order q. Let a,b ∊ Z_q* and G₁ is generated by P, a bilinear map ê : G₁ × G₁→G₂ :

a. Computational Diffie-Hellman Problem (CDHP): The CDHP in G₁ is to calculate given (P, aP, bP) for a, b ∊ Z_q*.

a. Decisional Bilinear Diffie-Hellman Problem (DBDHP): Assumed a set (P, aP, bP, cP) and an element h ∊ G₂, the DBDHP to decide whether h=ê(P, P)^abc or not. We define the benefit of the adversary C against the DBDHP like this: Adv(C) = |P_a,b,c ∊ _{Zq*, h ∊ G2} [1←C(aP, bP, cP, h)] - P_{a,b,c ∊ Zq*} [1←C(aP, bP, cP, ê(P, P)^abc)]|

The DBDHP normally not harder than CDHP.

3.2 Notations

The notations used in this paper are listed in Table 1.

Table 1. Acronym and Description

4. System model, Framework and Security definition

In this section, we will define the system model, framework and security definition of the scheme.

4.1 System Model

According to Fig. 1, the architecture of SE-IDPSC-CS scheme consists of the following entities:

a. PKG: This is a trusted authority used to compute the user’s private key from their identity information.

b. Delegator (Alice): This entity wants to delegate his/her signcryption authority to his/her proxy signcryptor (Bob).

c. Proxy Signcryptor (Bob): This is an entity that generates a signcrypted message on behalf of the delegator (Alice) by using the special information called ”proxy key” and uploads it to a trusted cloud service provider (CSP).

d. Cloud service provider (CSP): This entity supplies the storage service and sends the signcrypted ciphertext to an authorized user.

e. Receiver (Charlie): An entity who download, wants to recover the message content and verify it's validity at any time, from anywhere through the Internet.

Fig. 1. Model of the SE-IDPSC-CS scheme.

4.2 Framework of SE-IDPSC-CS scheme

Our scheme contains the following six algorithms, including the delegator (Alice) Q_IDA, proxy signcryptor (Bob) Q_IDB, receiver (Charlie) Q_IDC and the cloud service provider (CSP).

1. Setup: On input the security parameter k, PKG output the public params, and keep the master key s to itself.

2. Extract: On input, params, identity ID, and master secret key s returns the private key S_ID of , ID the PKG must transmit it to corresponding entities in a secure way. Assume (Q_IDA, S_IDA) is delegator key pairs, (Q_IDB, S_IDB) proxy signcryptor key pairs and (Q_IDC, S_IDC) is receiver's key pairs.

3. Proxy Credential: This is an algorithm run by delegator that takes on input params, delegator private key S_IDA, and warrant m_w(m_w contains the delegation time, identities of the delegator and proxy signcrypter), output a proxy credential S_PC and sends (S_PC, m_w) to a delegatee. There is a clear explanation of the delegation privileges and some common information about the delegator and proxy signcrypter in the warrant m_w such that a receiver can use it as verification information.

4. PKeyGen: An algorithm run by proxy signcryptor (Bob) which takes params, warrant m_w, proxy credential S_PC and delegatee private key S_IDβ as input. Outputs a proxy key Sk_ap.

5. Proxy Signcryption: An algorithm run by proxy signcryptor (Bob) that take on input params, the identity of the receiver Q_IDC, the proxy key Sk_ap, a warrant m_w, and a message m. Output a signcryption ciphertext C_T.

6. Unsigncryption: On input, public parameters params ciphertext C_T and S_IDC of the receiver, then confirm whether the ciphertext C_T is correct, if “yes” continue and output the plaintext m, otherwise, output ⊥.

4.3 Security Definition

We use a security game to describe the confidentiality and unforgeability of the message, here C is a challenger and A is an adversary respectively. We define two security models for these notions as follows:

Definition 1. We say that a SE-IDPSC-CS scheme is said to achieve the security requirement of IND-SE-IDPSC-CS-CCA2 if no polynomial-time adversaries who have a non-negligible advantage win in the following game:

Initial: C runs Setup algorithm to get params and s. Then send params A and keeps s to itself.

Phase 1: A adaptively performs several kinds of queries; each query may be dependent on the outcome of the previous queries:

Extract query QExtract(ID): A chooses an identity ID. C runs Extract (ID) and S_ID to A.

a. Proxy Credential query QPC(params, S_IDi, m_w) : A issues a proxy credential request with respect to the delegatee. C returns a warrant m_w and proxy credential S_pc.

b. PKeyGen query QPKeyGen(S_IDj, S_pc) : A selects two identities ID_i, ID_j, for a given identity ID_i and ID_j, C first runs the QPC query to get S_pc. Then C runs PKeyGen(S_pc, S_IDj) and returns Sk_ap to A.

c. Proxy Signcryption query QPSC(m, S_IDj, ID_u, Sk_ap) : A selects a message m and three identities ID_i, ID_j and ID_C. C first, run Extract and Proxy Credential to get the private keys of S_IDi, S_IDj and the proxy credential S_pc, then run PKeyGen(S_pc, S_IDj) to get Sk_ap. Finally, C it runs PSC(m, S_IDj, ID_C, Sk_ap) and sends the result C_T to A.

d. Unsigncryption query QUS(C_T, ID_i, ID_j, ID_C) : A chooses a ciphertext C_T and three identities ID_i, ID_j and ID_C. C first, run an Extract algorithm to get the S_IDC. Then C runs USC(C_T, ID_i, ID_j, S_IDC) and sends the output to A. This output can be the symbol ⊥ if C_T is an invalid ciphertext.

Challenge: A choose two plaintext M₀, M₁ ∊ M and two identities ID_B, ID_Con which he wishes to be challenged. He cannot have asked the private key corresponding to neither ID_B nor ID_C in the first stage. C chooses a random bit b ∊ {0, 1}and computes C = signcryption (M_b, S_IDB, ID_C) that is sent to A.

Phase 2: perform again a polynomial limited number of requests like in Phase 1. Except for the Extract query on ID_B nor ID_C and the plaintext corresponding to C.

Guess: creates a guess a bit b´ and wins the game if b´=b. We define A's advantage as A_dv(A) = \(\left|\operatorname{Pr}\left[b^{\prime}=b\right]-\frac{1}{2}\right|\).

Definition 2. A SE-IDPSC-CS scheme is said to achieve the security requirement of EF-SE-IDPSC-CS-CMA if no polynomially time adversaries who have a non-negligible advantage in the following game:

Initial: C runs Setup algorithm to get params and s. Then sends params to F.

The adversary F performs a polynomial limited number of requests just like in the gam IND-SE-IDPSC-CS-CCA2.

Finally, F produces a new triple (C_T, ID_B, ID_C), where the secret key of ID_B was not asked in the 2^nd phase and F wins the game if the output of Unsigncryption (C_T, S_IDB, ID_C) is not ⊥ a symbol. The advantage of F's is simply its probability of a win.

5. Construction

In this section, we briefly describe the six algorithms of our SE-IDPSC-CS scheme.

1. Setup (k) : on input the security parameters k, the PKG choose two groups G₁ and G₂ of prime order q, a generator of G₁ a bilinear map ê : G₁ × G₁→G₂ and hash functions H₁ : {0, 1}* → G₁, H₂ : {0, 1}* → Z_q*, H₃ : G₂ → {0,1 }ⁿ, H₄ : {0, 1}ⁿ × G₂ → Z_q*. The PKG randomly chooses s ∊ Z_q* as a master key and calculates P_pub=sP. It also chooses a secure symmetric cipher(E, D). Then PKG publishes the system public parameters as params : {G₁, G₂, n, ê, P, P_pub, H₁, H₂, H₃, H₄, E, D} and keeps the master key s secret. Where n is the bit length of a message.

2. Extract (ID) : on input an identity ID, the PKG computes Q_ID = H₁(ID) and S_ID = sQ_ID, as the public and private keys of the user's respectively and transmit the private key S_ID = sQ_ID to its owner in a secure way.

3. Proxy Credential (params, S_IDA, m_w) : On input params, a delegator private key S_IDA, and a warrant m_w. Then, delegator generates a proxy credential S_pc as follows:

x ∊ Z_q*

U = xP

z = H₂(m_w, U)

S_pc = zS_IDA + xP_pub

sends (m_w, U, S_pc) to a proxy signcryptor. There is a clear explanation of the delegation privileges and some common information about original and proxy signcrypter in the m_w which helps the receiver for verification.

4. PKeyGen (m_w, U, S_PC, S_IDB): Upon receiving (m_w, U, S_PC), the proxy signcryptor confirms the validity of the received proxy credential by computing:

ê(P, S_PC) = ê(P_pub, zQ_IDA + U)      (1)

Here, we show the verification process for Equ (1):

ê(P, SPC) = ê(P_pub, zQ_IDA + U)

= ê(P, zsQ_IDA = xsP)

= ê(P, zS_IDA + xP_pub)

= ê(P, S_PC)

If Equ (1) is true, the proxy signcryptor computes the proxy key as follow

Sk_ap = zS_IDB + S_PC

keep Sk_ap to itself and later it will be used to signcrypt message on behalf of the delegator.

5. Proxy Signcryption (paramas, m , Q_IDC, Sk_ap, S_IDS, m_w): When the proxy signcryptor wants to signcrypt a message m ∊ {0, 1}ⁿ, on behalf of the delegator he/she first chooses x^l ∊ Z_q* and then computes

Q_IDC = H₁(ID_C)

K₁ = ê(P, P_pub)^x´

k₂ = H₃(ê(P_pub, Q_IDC)^x´)

c = E_k2(m)

r = H₄(c, k₁)

S = x^´P_pub - (rS_IDB + Sk_ap)

C_T = (c, r, S, m_w)

where x´ is the random number, E_k2 is the encryption function with the private key E_k2. Then, the proxy signcryptor uploads the ciphertext C_T = (c, r, S, m_w, U)to the cloud service provider (CSP).

6. Unsigncryption (params, S_IDC, C_T) : When Charlie wants the data, he can download the signcrypted ciphertext (c, r, S, m_w) from a cloud service provider (CSP) and perform the following tasks:

Q_IDA = H₁(IDA)

Q_IDB = H₁(IDB)

k´₁ = ê(P, S)ê(P_pub, Q_IDB)^z+rê(P_pub, zQ_IDA + U)

k´₂ = H₃(ê(S, Q_IDC)ê(Q_IDB, S_IDC)^z+rê(zQ_IDA + U, S_IDC))

then receives m = E_k´2 (c) and accepts C_T iff r = H₄(c, k´₁). Otherwise, returns an error symbol ⊥.

Proof of correctness

The following equations give the correctness of our proposed scheme:

k₁ = ê(P, S)ê(P_pub, Q_IDB)^z+rê(P_pub, z_QIDA + U)

= ê(P, S)ê(P_pub, Q_IDB)^z+rê(P, zS_IDA + xP_pub)

= ê(P, S)ê(P_pub, Q_IDB)^z+rê(P, S_PC)

= ê(P, S)ê(P, rS_IDB)ê(P, zS_IDB)ê(P, S_PC)

= ê(P, x´P_pub - rS_IDB - Sk_ap)ê(P, rS_IDB)ê(P, SK_ap)

= ê(P, Ppub)^x´

=k₁

k₂ = H₃(ê(S, Q_IDC)ê(Q_IDB, S_IDC)^z+rê(zA_IDA + U, S_IDC))

= H₃(ê(S, Q_IDC)ê(rS_IDB, Q_IDC)

.ê(zS_IDB + zS_IDA + xP_pub, Q_IDC))

= H₃(ê(S, Q_IDC)ê(rS_IDB, Q_IDC)ê(Sk_ap, Q_IDC))

= H₃(ê(x´P_pub - rS_IDB - Sk_ap, Q_IDC)

ê(rS_IDB + Sk_ap, Q_IDC))

= H₃(ê(P_pub, QC)^x´)

=k₂

6. Security proof

In this section, we prove that the proposed scheme fulfills IND-SE-IDPSC-CS-CCA2 and EUF- SE-IDPSC-CS-CMA security by the following Theorems 1 and 2, respectively.

Theorem 1. (Proof of IND-SE-IDPSC-CS-CCA2 ): The proposed scheme in this paper secure against IND-SE-IDPSC-CS-CCA2, if no polynomial-time adversaries who have a non-negligible advantage A which can (e´, t´) break DBDHP where,

\(\varepsilon^{\prime} \geq 2\left(\varepsilon-q_{u} / 2^{k-1}\right) / q_{H_{1}}^{4}\)

\(t^{\prime} \approx t+O\left(q_{p k}+q_{s}+q_{u}\right) t_{\lambda}\)

where t_λ is time to calculate one pairing operation.

Proof: Assume A can break the SE-IDPSC-CS scheme with significant advantage under adaptive CCA2 after running (time) and requesting at most random oracle for Extract query, PKeyGen query, proxy signcryption query, and unsigncryption query. Then we can build another algorithm that -breaks the DBDHP by taking as a subroutine. Assume obtains a random instance of the DBDHP and the objective of is to obtain or not.