Granular Content Distribution for IoT Remote Sensing Data Supporting Privacy Preservation

Abstract

Facilitated by the Internet of Things (IoT) and diverse IoT devices, remote sensing data are evolving into the multimedia era with an expanding data scale. Massive remote sensing data are collected by IoT devices to monitor environments and human activities. Because IoT devices are involved in the data collection, there are probably private data contained in the collected remote sensing data, such as the device owner information and the precise location. Therefore, when data analysts, researchers, and other stakeholders require remote sensing data from numerous IoT devices for different analyses and investigations, how to distribute massive remote sensing data efficiently and regulate different people to view different parts of the distributed remote sensing data is a challenge to be addressed. Many general solutions rely on granular access control for content distribution but do not consider the low computational efficiency caused by the huge file size of the remote sensing data or certain IoT devices only have a constrained computational performance. Therefore, we propose a new granular content distribution scheme, which is more lightweight and practical for the distribution of multimedia remote sensing data with the consideration of the large data size to avoid complicated operations to the data. Furthermore, a dual data integrity check (hash summary and watermark) designed in our scheme can detect tampering or forgery from encrypted remote sensing data before decrypting it and validate it again after decryption. The security analyses and experimental results manifest that our new scheme can maintain high computational efficiency and block tampering and forgery during the granular content distribution for IoT remote sensing data.

1. Introduction

The Internet of Things (IoT) describes physical objects embedded with sensors that connect with other objects and devices over the Internet and other communication networks to construct holistic systems for seamless interactions between people and objects [1,2]. It is reported that the global IoT market is anticipated to reach around USD 1842 billion by 2028 [3]. The increasing tendency of the IoT indicates that the IoT is playing a much more significant role in the evolution of the smart world. An IoT system consists of numerous sensors and smart devices to collect, exchange, and process data that can not only provide high-quality services but also boost a smarter life and work for people [4,5]. The advances of the IoT have resulted in proliferated IoT applications ranging from healthcare and analyses of human activities and smart cities to remote sensing, environmental monitoring, and agriculture [6,7].

Recently, employing IoT devices and networks shows an incremental trend in collecting remote sensing data for different purposes, such as the analysis of population mobility, indoor/outdoor air quality monitoring, and the surveillance of crops in agriculture [8,9]. Due to the involvement of different IoT devices for remote sensing, the collected data are various in types (e.g., images, videos, and text data) so that remote sensing data are shifting to be more multimedia. To be specific, IoT remote sensing data can contain not only conventional images but also text data and videos, such as carbon dioxide values and video records of plant growth [6,10,11]. Compared with text data, the other two kinds of media (i.e., image and video) are more massive in terms of their data size. Such a large data size raised by the multimedia trend challenges related organisations and institutions to systemically harness the collected remote sensing data in research and analysis, especially for data distribution. For different research purposes, remote sensing data collected by IoT devices can be distributed to different people, such as data analysts and scientists, governmental staff, epidemiological investigators, etc. However, there are two challenges in content distribution that should be considered for IoT remote sensing data.

The first challenge is how to control the contents distributed to various roles without exposing the private information, which is a practical and urgent issue to be addressed for distributing IoT remote sensing data. For example, data analysts and epidemiological investigators should only obtain the targeted data they need to analyse, such as human activity tracks and traffic flows, whilst precise location information and car information should not be public [12]. When traffic accidents occur and traffic risks are detected by IoT-based remote sensing, governmental staff may require concrete location information for emergency assistance [13]. On the other hand, all the contents of the distributed remote sensing data should be protected during the transmission to avoid privacy leakage if there are malicious users (attackers) eavesdropping on the transmission or the transmission has to pass an untrusted third party (e.g., public clouds) [14].

The second challenge is that the large data size caused by multimedia remote sensing data may result in slow encryption and signing in content distribution. For example, some IoT devices can collect videos with a large data size in remote sensing. When we consider privacy preservation to enable different roles to view different videos in content distribution, some operations of encrypting and signing are needed. However, some current content distribution approaches [15,16] are difficult for processing such data with a large data size because their public key operations require the collected data to participate in, leading to quite slow encryption and signing operations.

Therefore, a lightweight granular content distribution scheme should be considered for distributing IoT remote sensing data to protect sensitive information and fit the large data size and resource-constrained IoT devices simultaneously.

In this paper, we consider the large data size raised by the multimedia characteristics of IoT remote sensing data and propose a customised content distribution scheme with granularity control based on the elliptic-curve signcryption, the GCD-RSD (granular content distribution for remote sensing data), which achieves privacy protection (for sensitive information) and a higher computational efficiency to be more suitable for large-scale remote sensing data distributions. The GCD-RSD can be used to efficiently distribute IoT remote sensing data with different data sizes from small to large. Meanwhile, the granularity designed in the proposed GCD-RSD can enable different roles to access different parts of the data. Compared with the current studies [15,16,17,18,19], the novel contributions of the proposed scheme GCD-RSD lie in:

• Considering the large data size introduced by the multimedia feature of IoT remote sensing data, we avoid signing the distributed data directly or involving them in the public key operations for granularity control, i.e., the only operation to the distributed data is the fast symmetric encryption;
• Dual data integrity: Unlike [16,19], who only check the data integrity after decryption, the GCD-RSD verifies the data integrity of the received encrypted remote sensing data before decrypting it and then utilises the watermark to check the data integrity after the encrypted data are decrypted;
• Lightweight cryptography: The applied cryptographic basis is the elliptic curve instead of a costly bilinear pairing to encourage the GCD-RSD to be more lightweight.

The remainder of this paper is organised as follows. Section 2 introduces the related work, including some discussions about the security of IoT remote sensing and some studies on privacy-preserving content distribution in the IoT. The preliminaries and our system model to better understand the proposed scheme GCD-RSD are presented in Section 3. Then, in Section 4, the definition of each phase in the GCD-RSD is demonstrated before we formally illustrate the design of the GCD-RSD and show the correctness and the security analysis for the GCD-RSD. Section 5 analyses the performance of the GCD-RSD by comparing it with other mainstream schemes in terms of the time efficiency and encrypted data size in the experiments, which is followed by the final Section 6 which concludes our work.

2. Related Work

In the field of IoT remote sensing, Triantafyllou et al. [20] proposed a seven-layer architecture for IoT remote sensing monitoring in agriculture. In the middleware and management layers of the architecture, one requirement is that the collected remote sensing data can be securely distributed to different stakeholders for further processing and utilisation, such as data mining. Furthermore, this architecture suggested encrypting remote sensing data in data transmission to avoid data leakage. However, it is only a high-level design without any concrete encryption or access control schemes for data management. To protect IoT remote sensing data in transmission, Adi et al. [21] proposed an on-chip (hardware) encryption scheme using a secret random number against manipulation attacks. This method can secure transmitted remote sensing data but cannot restrict accessible content by roles to achieve granularity control. Gao et al. [22] proposed to encrypt remote sensing images in distribution for cloud-based object recognition. This algorithm can encrypt the matrices of images based on the eigenvalue decomposition, but it has the same drawback with the scheme [21] to be unable to support granularity control. In addition, when encrypting quite large remote sensing images, this algorithm may be slow in computation due to complex matrix operations. Overall, the current studies on data security and privacy in IoT remote sensing are limited. Most of the current studies only focus on data encryption in data collection, but the research about data security and privacy for data/content distribution is still in its infancy in IoT remote sensing.

In IoT and other smart-related fields, there are different technical routes, which have been discussed for content distribution in the current studies. In order to share massive smart health data, Li et al. [17] proposed to sign the data to be distributed with the organisation signature. This method can avoid tampering as the receiver can validate the data integrity of the distributed data to find out forged data, but there is no encryption applied in their constructed scheme. Therefore, the plain data can be browsed by both the legitimate receivers and the malicious attackers in the distribution. Furthermore, the signature scheme in [17] does not consider the granularity control to restrict different data receivers to access different parts of the data. Similarly, Yang et al. [15] demonstrated a data management system with data signing to ensure the data integrity in the data distribution, but the authors do not consider the granularity control or define any access policies in the authorisation. To address the granularity control issue in distribution and avoid plain data, Li et al. [18] divided users into social and professional domains and then presented an advanced encryption scheme which can provide different parts of encrypted sensing data for different users. The core method the authors employed is attribute-based encryption (ABE) to encrypt data with the key generated by the user’s attributes. Meanwhile, the scalability of the scheme [18] is noticeable as the ABE can allow the system authority to update (add and delete) the users and the attributes of each user. Based upon the work of [18], Liu et al. [16] integrated signcryption (signature and encryption) [23] with ABE to implement an improved data-sharing system with fine-grained access control in the cloud computing environment. After that, Rao [19] pointed out that the bilinear pairing used in the scheme [16] is much more time-consuming than the modular exponentiation and elliptic multiplication in the computation. Therefore, Rao [19] refined the scheme in [16] by reducing the use of bilinear pairing operations to construct a more efficient scheme. Compared with the scheme [18] supporting confidentiality only, two recent schemes [16,19] can also ensure the integrity (i.e., authenticity and unforgeability) to avoid malicious data manipulations during data transmission. Karati et al. [24] proposed a lightweight certificateless data-sharing scheme based on a bilinear pairing for the industrial IoT (IIoT), but it only fits to encrypt small data. Later, Truong et al. [25] and Chen et al. [26] proposed to utilise blockchain to share IoT data, but the network latency is high (few seconds) because all the nodes require a time-consuming proof of work (PoW) to achieve consensus sharing. Apart from the high time consumption, the decentralised blockchain may not fit to the scenario of content distribution in IoT remote sensing. The decentralised information sharing is more suitable to share data in large-scale groups, where each participant possesses some data equally, e.g., the data scale is similar. However, the content distribution of IoT remote sensing data is more centralised because large-scale remote sensing data that probably need to be distributed are only possessed by a few national/international institutions and giant companies [27].

Recently, Chen et al. [28] employed signcryption and a bilinear pairing to protect IoT data collection. However, this scheme has a similar issue to [15,16], i.e., it heavily relies on a bilinear pairing to lead to a slow encryption. Furthermore, this scheme still requires the data (to be encrypted) to participate in the public key operations, which may also result in a slow encryption process when the data size is quite large, e.g., large videos and images collected in IoT remote sensing. On the other hand, Fadlullah and Kato [29] applied federated learning in IoT remote sensing for edge nodes to build models for the forest fire detection. This solution can protect the privacy of the acquired remote sensing data during the aggregation of the trained models but does not consider that parts of the raw sensing data may contain sensitive or private information that should not be accessed by edge nodes in the federated learning.

Based on the above analysis, we notice that efficient and granular content distribution has not been considered for distributing IoT remote sensing data. Furthermore, all these studies neglect two important characteristics brought by IoT remote sensing data.

• Large data size caused by multimedia: IoT remote sensing data are going to multimedia which means such data can contain text data (e.g., values), images, videos, and so on. Therefore, the size of the current IoT remote sensing data can be quite large and probably incur slow signing operations [15,17] and signcryption operations [16,19,28], especially for the data whose size is over gigabytes.
• Watermark: Some remote sensing data are watermarked by its owners [30], but this feature has not been considered as a potential approach to realise an integrity check in the data distribution.

Hence, when facing large multimedia remote sensing data collected by the IoT, the current methods from the literature may not be suitable to be utilised for the content distribution of such data if the time efficiency and privacy preservation are considered. To achieve granular content distribution for IoT remote sensing data efficiently, we propose the GCD-RSD, considering not only the watermark feature as an integrity check method but also the large data size caused by multimedia IoT remote sensing data. To process large-size data efficiently, the GCD-RSD does not encrypt the data using public key operations like other granular content distribution schemes [15,16,28]. Instead, the GCD-RSD encrypts the data with a fast symmetric encryption AES (Advanced Encryption Standard) [31]. Meanwhile, the GCD-RSD is constructed based on signcryption to protect the data integrity but does not involve time-consuming public key operations, such as a bilinear pairing, to be lightweight.

In order to summarise the literature review, we compare some state-of-the-art schemes with our proposed GCD-RSD. Because there is no similar content distribution scheme for IoT remote sensing data, we select some schemes related to granular content distribution in the IoT field for the comparison. The security and computational efficiency features of the compared schemes [15,16,17,19,28] and GCD-RSD are summarised in

Table 1. The comparison of security and performance features for [15,16,17,19,28] and GCD-RSD.

Scheme	[17]	[15]	[16]	[19]	[28]	GCD-RSD
Confidentiality	×	√	√	√	√	√
Integrity	√	√	√	√	√	√
Granularity control	×	×	√	√	×	√
Lightweight computation	√	×	×	×	×	√

.

Most of the compared schemes can realise the confidentiality and integrity, but only three schemes [16,19] and the GCD-RSD consider the granularity control in content distribution. As for the computational overhead for encrypting and decrypting the distributed data, the scheme [17] and the proposed GCD-RSD schemes are lightweight to fit IoT devices in remote sensing as they do not require complex cryptographic operations, such as a bilinear pairing to the distributed data, but the scheme [17] is not secure, as we discussed above. As a result, our proposed scheme GCD-RSD is the only one that can meet all the features in the comparison.

3. Preliminaries and Model

3.1. Notations

In this part, the notations used to describe the cryptographic assumption and our proposed scheme are summarised in

Table 2. Notations.

Symbol	Description
${\in }_R$	$X{\in }_{R}Y$ means the element X belongs to set Y and X is not an empty set
${\mathbb{Z}}_p^{*}$	Multiplicative group of integers with the modulo p
$Pr$	Probability
$E_p(a,b)$	An elliptic curve E with two coefficients $a,b$ and the modulo p
M	Plain data (Plaintext)
$C,c,c_1,c_2$	Ciphertext
$PK$	Public keys
$SK$	Private keys
$did,id$	Data or user identification
$\mathcal{T}$	Attribute tree
${\mathcal{T}}_d$	Attribute tree depth
$pp$	Public parameters
$k,k_1,k_2,{k_1}^{{}^{\prime }},{k_2}^{{}^{\prime }}$	Secret keys
$AE{S}_k(·)$	AES encryption with the secret key k
$AE{S}_k^{{}^{\prime }}(·)$	AES decryption with the secret key k
$H_1,H_2$	Hash functions
$H_c,H_c^{{}^{\prime }}$	Hash values

.

3.2. Elliptic Curve Computational Diffie–Hellman (ECCDH) Assumption

The ECCDH assumption [31] is a public key computational problem with the following cryptographic description. Let $E_p(a,b):y^2\equiv x^3+ax+b\left(modp\right)$ be a secure elliptic curve in cryptography. For any point $P\in E$ and $u,v{\in }_R{\mathbb{Z}}_p^{*}$, any probabilistic polynomial-time algorithm $\mathcal{A}$ computes $uvP$ with its advantage $Ad{v}_{\mathcal{A},E_p(a,b)}^{ECCDH}=$

$$Pr[c=uvP\mid u,v{\in }_R{\mathbb{Z}}_p^{*},c=\mathcal{A}(P,uP,vP)].$$

The ECCDH assumption can hold if for any probabilistic polynomial-time algorithm $\mathcal{A}$, its advantage $Ad{v}_{\mathcal{A},E_p(a,b)}^{ECCDH}$ is negligible.

There are two reasons for us to select the ECCDH assumption as the foundation to construct our GCD-RSD scheme. The first one is that the ECCDH can achieve a higher security level with a shorter key size, which has been recommended by the National Institute of Standards and Technology (NIST), US [32]. The other reason is the higher computational efficiency and lower energy consumption of elliptic curve scalar multiplication in ECCDH than other cryptographic operations, such as bilinear pairing and modular exponentiation, which has been widely evaluated, especially for IoT devices [33,34,35].

3.3. System Model

Our system model is depicted in Figure 1 with four entities: remote sensing data sources, data centre, data requesters, and a trusted authority (TA). The data centre acts as the management role to store and update the remote sensing data collected by different remote sensing data sources, including IoT devices, sensors, satellites, etc. Databases can be used to maintain plain remote sensing data by the data centre. When a data requester requires the specific data from the data centre, the data centre can delegate the trusted authority to validate the identity and access attributes of the data requester. If the trusted authority confirms the data requester is authorised to access the requested data, the data centre encrypts the requested data and distributes them to the data requester. After receiving the encrypted data, the data requester can use the key negotiated with the data centre to decrypt the encrypted data and check its integrity. Note that data requesters may use some mobile devices or IoT devices to receive the requested data in practice [36].

3.4. Attribute Tree

The attribute tree is used to control the access granularity (i.e., granular authorisation) in the content distribution. For each remote sensing data archive $RS{D}_{did}$, it has an attribute tree defined by the data centre. Different $RS{D}_{did}$ may have different attribute trees. Here, an exemplar attribute tree ${\mathcal{T}}_{did}$ corresponding to the remote sensing data archive $RS{D}_{did}$ is shown in Figure 2 (tree depth ${\mathcal{T}}_d=3$). Because $RS{D}_{did}$ can involve different collected data and collector information, its exemplar attribute tree ${\mathcal{T}}_{did}$ is constructed by four attribute tags in two layers. In the first layer of Figure 2, ${\mathcal{T}}_{did}$ involves two attribute tags, “Collected data” and “Collector information”. Then, in the second layer, the collected data are divided into two parts (tags): “Sensitive” and “Anonymous”. As shown in Figure 2, each node in ${\mathcal{T}}_{did}$ has an attribute tag, such as $\left(0\right)$ for “Collected data” and $(0,1)$ for “Anonymous”. Note that in the category of sensitive, personal information represents individuals’ faces and other characteristics (e.g., tattoos and clothes). Meanwhile, the sensitive information should be removed from all the data in the anonymous category.

Before the content distribution, the attribute tree ${\mathcal{T}}_{did}$ for each remote sensing data archive $RS{D}_{did}$ should be defined by the data centre clearly. After that, the attributes different data requesters can own should be issued by the data centre and the trusted authority jointly. Based upon attribute trees and issued attributes, the attributes possessed by the data requester can be used to achieve granular content distribution. For example, a governmental data requester may own several attributes, such as $(did,0),did=1,2,\dots$, which means that this user can access the collected data of several data archives regulated by $did$. On the other hand, a data analyst can possess the attribute $(did,0,1)$ to be allowed to access the anonymous parts of $RS{D}_{did}$ only.

4. Proposed Scheme

We formally propose our GCD-RSD scheme by describing how the authorisation and granularity control work in the Authorise phase and elaborating the detailed algorithms in the Signcrypt and Unsigncrypt phases. Then, the correctness of GCD-RSD is illustrated, followed by the security analysis, including confidentiality, integrity, resistance to sniffing, tampering and tracing, and formal verification. Note that the detailed theoretical security models and proofs of confidentiality and integrity for GCD-RSD are presented in Appendix A and Appendix B.

4.1. Scheme Definitions

There are five phases in our proposed scheme GCD-RSD, including Setup, Request, Authorise, Signcrypt, and Unsigncrypt, for the granular content distribution. The data centre and the data requester are denoted by $dc$ and $req$, respectively. The detailed definition of each phase is manifested as follows.

•Setup (λ): This algorithm takes the security parameter $\lambda$ and generates the public parameters $pp$ for the following remote sensing data distribution.

•KeyInitialise ($pp$): The data centre and the data requester initialise their public keys ($P{K}_{dc},P{K}_{req}$) and private keys ($S{K}_{dc},S{K}_{req}$) for the data distribution.

•Request ($pp$, $id$): The data requester uses this algorithm to send an access request Q for the data identity $id$ to the data centre. Note that Q also contains the identity information and access attributes of the data requester.

•Authorise ($pp,Q$): The data centre sends Q to the trusted authority to verify the access legitimacy of the data requester to the requested data.

•Signcrypt ($pp$, $id$, $S{K}_{dc}$, $P{K}_{req}$): The data centre retrieves the requested data M by $id$ and then signs and encrypts M with its private key $S{K}_{dc}$ and the data requester’s public key $P{K}_{req}$, then returns the ciphertext C to the data requester.

•Unsigncrypt ($pp$, C, $S{K}_{req}$, $P{K}_{dc}$): After receiving the encrypted data C, the data requester decrypts the encrypted data C with their private key $S{K}_{req}$ and the data centre’s public key $P{K}_{dc}$ to retrieve the requested data M.

4.2. GCD-RSD Scheme

•Setup ($\lambda$):

This algorithm outputs public parameters $pp$ with the security parameter $\lambda$ through the following steps.

1. Pick a cryptographic secure elliptic curve group $\mathbb{G}$ with a base point G on the curve, where the order of $\mathbb{G}$ is $p>2^{\lambda }$.

2. Select two cryptographic secure hash functions: $H_1:{\{0,1\}}^{*}\stackrel{}{\to }{\{0,1\}}^{\lambda }$ and $H_2:\mathbb{G}\stackrel{}{\to }{\{0,1\}}^{2\lambda }$.

3. Select a fast and secure symmetric encryption algorithm, for example, Advanced Encryption Standard (AES) [31]. Note that $AE{S}_k(·)$ is defined as the AES encryption with the secret key k and $AE{S}_k^{{}^{\prime }}(·)$ represents the AES decryption with the secret key k.

4. The watermarked remote sensing data set is denoted by $S_{RSD}=\left\{RS{D}_{did}\right\}$, where $did$ is the data identification number.

5. The data centre defines the attribute tree ${\mathcal{T}}_{did}$ for each data set $RS{D}_{did}$ as illustrated in Section 3.4 for the granular authorisation in the content distribution.

6. Output the public parameters $pp=(\mathbb{G},p,G,H_1,H_2,AES)$.

•KeyInitialise ($pp$): This subroutine is executed by both the data centre $\mathcal{O}$ and the data requester $\mathcal{D}$ with their corresponding private keys $S{K}_{\mathcal{O}}=a$ and $S{K}_{\mathcal{D}}=b$ to generate the key pairs for the remote sensing data distribution:

$$(P{K}_{\mathcal{O}},P{K}_{\mathcal{D}})=(A=aG,B=bG).$$

Note that $\mathcal{D}$ and $\mathcal{O}$ have the certificates $CE{R}_{\mathcal{D}}$ and $CE{R}_{\mathcal{O}}$ issued by the trusted authority (TA): $CE{R}_{\mathcal{D}}=({\mathcal{D}}_{id},{\mathcal{D}}_{att},S{K}_{\mathcal{D}})$, where ${\mathcal{D}}_{id}$, ${\mathcal{D}}_{att}$, and $S{K}_{\mathcal{D}}$ represent $\mathcal{D}$’s identity, the access attribute(s) possessed by $\mathcal{D}$, and $\mathcal{D}$’s private key, respectively; $CE{R}_{\mathcal{O}}=({\mathcal{O}}_{id},S{K}_{\mathcal{O}})$, where ${\mathcal{O}}_{id}$ and $S{K}_{\mathcal{O}}$ denote $\mathcal{O}$’s identity and $\mathcal{O}$’s private key, respectively. ${\mathcal{D}}_{att}$ can be a set to contain multiple attributes, such as $(di{d}_1,0,1)$, $(di{d}_2,0,0,1)$, $(di{d}_3,0,1,1,1)$, and so on. The structure of each attribute can be different depending on different structures of the corresponding attribute trees, as discussed in Section 3.4. In addition, the public keys A and B can be shared; however, the private keys $a,b$ and the certificates $CE{R}_{\mathcal{O}},CE{R}_{\mathcal{D}}$ should be kept by $\mathcal{O}$ and $\mathcal{D}$ secretly.

•Request ($pp,{\mathcal{D}}_{id},CE{R}_{\mathcal{D}}$): The request scenario we use to describe our scheme is a data analyst $\mathcal{D}$ requires the specific remote sensing data $RS{D}_{did}\in S_{RSD}$ from the data centre $\mathcal{O}$.

$\mathcal{D}$ constructs the request $Q=(did,{\mathcal{D}}_{id},CE{R}_{\mathcal{D}})$, then sends Q to $\mathcal{O}$ securely.

•Authorise ($pp$, Q): There are two steps in this phase after Q is received by $\mathcal{O}$.

1. $\mathcal{O}$ sends Q to TA for validation, then TA validates $CE{R}_{\mathcal{D}}$ and $P{K}_{\mathcal{D}}$.

2. If TA confirms $\mathcal{D}$ has valid $CE{R}_{\mathcal{D}},P{K}_{\mathcal{D}}$ and correct attribute(s) ${\mathcal{D}}_{att}\in CE{R}_{\mathcal{D}}$ to access $RS{D}_{did}$ by referring to ${\mathcal{T}}_{did}$, $\mathcal{O}$ authorises the request Q and then executes the following phases; otherwise, $\mathcal{O}$ denies $\mathcal{D}$’s request Q.

•Signcrypt ($pp$, Q, $CE{R}_{\mathcal{D}}$, a, B): The data centre $\mathcal{O}$ follows the shown steps to sign and encrypt the requested data.

1. Prepare the requested data M by extracting the data allowed to be accessed by $\mathcal{D}$ in $RS{D}_{did}$, which is defined by ${\mathcal{D}}_{att}\in CE{R}_{\mathcal{D}}$.

2. Choose a random number $r{\in }_R{\mathbb{Z}}_p^{*}$.

3. Compute: $k_1,k_2=H_2\left(rB\right)$,

$c=AE{S}_{k_1}\left(M\right),H_c=H_1\left(c\right)$,

$c_1=H_1(H_c,k_2)$,

$c_2=\frac{r}{c_1+a}\left(modp\right)$.

4. Send the ciphertext $C=(c,c_1,c_2)$ to $\mathcal{D}$.

•Unsigncrypt ($pp$, C, A, b): After receiving C from $\mathcal{O}$, $\mathcal{D}$ can execute the following steps to retrieve the requested data M.

1. Compute: $d_1=b{c}_2\left(modp\right)$

${k_1}^{{}^{\prime }},{k_2}^{{}^{\prime }}=H_2(d_{1}A+d_1{c}_{1}G)$,

${H_c}^{{}^{\prime }}=H_1\left(c\right)$.

2. If the condition $c_1=H_1({H_c}^{{}^{\prime }},{k_2}^{{}^{\prime }})$ holds, $\mathcal{D}$ continues the next steps; otherwise, it means the first integrity check fails and this algorithm outputs ⊥ (error).

3. Decrypt $c\in C$ to retrieve M by computing $M=AE{S}_{k_1^{{}^{\prime }}}^{{}^{\prime }}\left(c\right)$.

4. If the watermark of M is intact, this algorithm outputs M to $\mathcal{D}$; otherwise, it indicates the second integrity check is not passed then this algorithm outputs ⊥ (error).

•Correctness: When observing the phases Signcrypt and Unsigncrypt, we can notice that the important condition is $k_1^{{}^{\prime }},k_2^{{}^{\prime }}=k_1,k_2$ to ensure $\mathcal{D}$ can obtain the correct M via calculating $AE{S}_{k_1^{{}^{\prime }}}^{{}^{\prime }}\left(c\right)$. In the Unsigncrypt phase,

$$\begin{array}{cc}\hfill k_1^{{}^{\prime }},k_2^{{}^{\prime }}& =H_2(d_{1}A+d_1{c}_{1}G)\hfill \\ \hfill & =H_2(b{c}_{2}A+b{c}_2{c}_{1}G)\hfill \\ \hfill & =H_2(c_{2}aB+c_2{c}_{1}B)\hfill \\ \hfill & =H_2\left((a+c_1)c_{2}B\right)\hfill \\ \hfill & =H_2\left((a+c_1)\frac{r}{c_1+a}B\right)\hfill \\ \hfill & =H_2\left(rB\right)\hfill \\ \hfill & =k_1,k_2.\hfill \end{array}$$

Therefore, after receiving the correct $C=(c,c_1,c_2)$, $\mathcal{D}$ can retrieve the requested M correctly by executing the algorithm Unsigncrypt. To summarise how GCD-RSD works, the workflow of GCD-RSD is presented in Figure 3.

4.3. Security Analysis

In this section, we briefly illustrate how GCD-RSD can satisfy confidentiality and integrity in the remote sensing data distribution as the backbone of GCD-RSD signcryption primitive has been proved to be secure in terms of confidentiality and integrity in [23]. The formally theoretical proofs (with security models), including indistinguishability under chosen ciphertext attack (IND-CCA) and existential unforgeability under chosen message attack (EUF-CMA), to manifest the confidentiality and integrity of GCD-RSD are illustrated in Appendix A and Appendix B, respectively. Apart from confidentiality and integrity, we analyse the resistance of sniffing, tampering, and tracing attacks and provide the result of formal verification for GCD-RSD in the content distribution.

4.3.1. Confidentiality

If an attacker can obtain the ciphertext $C=(c,c_1,c_2)$ from the communication between $\mathcal{O}$ and $\mathcal{D}$, M cannot be recovered as the attacker does not know $\mathcal{D}$’s secret key $S{K}_{\mathcal{D}}=b$ to calculate correct $d_1$ or $k_1^{{}^{\prime }},k_2^{{}^{\prime }}$ based upon the correctness analysis. Even though the attacker always knows the public keys $P{K}_{\mathcal{O}}=A=aG,P{K}_{\mathcal{D}}=B=bG$ of $\mathcal{O}$ and $\mathcal{D}$, calculating $d_{1}A=c_{2}baG$ with $c_2,aG,bG$ to recover $k_1^{{}^{\prime }},k_2^{{}^{\prime }}$ is still a difficult problem due to the ECCDH assumption. Hence, the confidentiality of GCD-RSD can be ensured to avoid data leakage during the data distribution.

4.3.2. Data Integrity

Because the attacker cannot acquire $k_2$ based on the confidentiality analysis, it is infeasible to manipulate c and generate the matched $c_1$. Therefore, the tampered or forged $c\in C$ can be found out at step 2 (the first integrity check) in the Unsigncrypt phase. On the other hand, if the attacker can tamper c then generate matched $c_1$ occasionally, the watermark check (the second integrity check) at step 4 in the phase Unsigncrypt can prevent $\mathcal{D}$ from obtaining corrupted M. This is because the tampering to c is irregular (i.e., not following the original remote sensing data format) that can result in the corrupted watermark or even the damaged M directly. Hence, GCD-RSD can achieve dual data integrity checks.

4.3.3. Sniffing Resistance

When facing sniffing attacks in content distribution, the proposed GCD-RSD scheme can avoid plain data leakage in two aspects. Firstly, the ciphertext c is encrypted and $c_1$ is a hash value so then cannot be compromised. Meanwhile, even though the attacker can obtain $c_1$ and $c_2$ by sniffing, it cannot compute the secret key a of the data centre because the random number r is not involved in the transmitted ciphertext C. Secondly, r is generated as a random number in each content distribution so the probability of sniffing the same secret keys $k_1,k_2=H_2\left(rB\right)$ in different content distributions can be negligible. Therefore, our scheme GCD-RSD can resist sniffing attacks to prevent attackers to obtain effective information in sniffing.

4.3.4. Tampering Resistance

The tampering in the communication for the content distribution may threaten the integrity of the distributed content. However, GCD-RSD can resist tampering attacks because any tampering can be detected by the data requester based on the above analysis of data integrity. If the attacker replaces c or $c_1$ with random data, the steps 2 and 4 cannot be passed in Unsigncrypt because the hash value $H_c$ hidden in $c_1$ and the replaced c cannot match. On the other hand, the attacker cannot generate valid c and $c_1$ to replace the original c and $c_1$ with the generated ones because $k_1,k_2$ are unknown based on the analyses of confidentiality and sniffing.

4.3.5. Tracing Resistance

Another potential attack is tracing, i.e., attackers may trace the identities of data requesters using sniffing data. GCD-RSD can resist the tracking attack because the ciphertext C does not contain any identity information. The public information that can be used to identify the data requester is the public key $P{K}_{\mathcal{D}}=B$ of the data requester. However, this information is not contained in the ciphertext $C=(c,c_1,c_2)$ directly. Furthermore, the public key B is hashed by $H_2\left(rB\right)$ in Signcrypt of GCD-RSD. It indicates the probability of recovering B from the hash value can be negligible. Therefore, our scheme GCD-RSD can have tracing resistance to protect data requesters’ identity information in content distributions.

4.3.6. Formal Verification

This section yields the formal verification result of the proposed scheme GCD-RSD by adopting the widely-used automated security protocol simulator, termed “Casper/FDR”, including the compiler Casper [37] of the communicating sequential process (CSP) language [38] and a CSP model checker Failures Divergences Refinement (FDR) [39]. CSP is a formal language to describe the interaction and states to model communications and security protocols.

The security properties of GCD-RSD are modelled by the CSP language and compiled by Casper. Then, the output from Casper is analysed with FDR. In the model, the data requester and the data centre are represented by two roles, Alice and Bob, respectively. The used version of Casper is 2.1, and the used version of FDR is FDR4. The results are demonstrated in Figure 4, where the overview result of two verification items (i.e., message secret and sequence secret) is passed, shown in the top right corner. The detailed results are displayed in two sub-windows. The left sub-window presents the verification result of the message secret. Our scheme GCD-RSD can pass this verification so it means GCD-RSD can ensure the confidentiality of the transmitted data. Meanwhile, the right sub-window shows the verification result of the sequence secret. The passed result manifests that GCD-RSD can protect the ciphertext $C=(c,c_1,c_2)$ to be intact in the communication so the integrity of the transmitted data can be ensured. Through this analysis, it is shown that the proposed scheme GCD-RSD is secure enough to ensure the confidentiality and integrity of the distributed content in the communication.

5. Experiments and Results

In this section, we use four actual IoT remote sensing data samples to conduct our experiments. Because there is no similar content distribution scheme or best practice for distributing IoT remote sensing data, we select several schemes [15,16,17,19,28] related to granular content distribution in IoT-related fields for the comparisons with our scheme GCD-RSD in terms of the computational time consumption and the size of the generated ciphertext in actuality.

5.1. Data Preparation

In order to involve more multimedia data of IoT remote sensing in the samples, we prepare four different multimedia remote sensing data obtained from satellites and IoT sensors as the samples for our experiments, described in

Table 3. Sample description of the used IoT remote sensing data in our experiments.

Sample	Description	Original Size (MB)	Compressed Size (MB)
$R_1$	PM2.5 sensor data	0.40	0.13
$R_2$	Low-resolution aerosol images	13.84	3.30
$R_3$	A LST&E video from 2021.01 to 2022.02	144.85	133.67
$R_4$	Large-scale terrain images	2598.30	1254.21

with their size information. Note that we compress each sample into a single file (zip format) to load them into the memory more quickly in our experiments.

$R_1$ contains PM2.5 sensor values extracted from the national air quality observation data set in the national urban air quality real-time publishing platform (National Urban Air Quality Real-time Publishing Platform: https://air.cnemc.cn:18007/, accessed on 27 February 2022) of the China Environmental Monitoring Sites. $R_2$ involves low-resolution images of processed aerosol optical thickness data with a 1 km pixel resolution collected by satellites’ sensors from the NASA MCD19A2 data set (https://lpdaac.usgs.gov/products/mcd19a2v006/, accessed on 3 June 2018). $R_3$ is a video made by the land surface temperature and emissivity (LST&E) from January 2021 to February 2022 based on the NASA MOD11C2 data set (https://ladsweb.modaps.eosdis.nasa.gov/missions-and-measurements/products/MOD11C2, accessed on 26 February 2022). $R_4$ is a large-scale terrain image observed by synthetic aperture radars (SAR) [40] from the European Space Agency (https://sentinels.copernicus.eu/web/sentinel/user-guides/sentinel-1-sar/acquisition-modes/interferometric-wide-swath, accessed on 5 May 2018).

5.2. Experiments

Because the computational time cost and the actual ciphertext size are decided by the detailed algorithm, we implement the signing and verifying algorithms in [15,17], the signcryption and unsigncryption algorithms in [16,19], and our GCD-RSD scheme based on the cryptographic SDK MIRACL [41]. A Raspberry Pi 2 with a Wi-Fi module acts as an IoT device of the data requester and a conventional computer with an Intel i5 processor running at 3.30 GHz works as the data centre and the trusted authority to conduct our experiments. Note that because the compared schemes [15,16] may involve complicated algorithms to encrypt and decrypt data that are quite time-consuming for the IoT device, the data verification and decryption that should be performed by the IoT device in practice are delegated to the conventional computer in our experiments for the comparison. To reduce the programs’ running time, we invoke the corresponding APIs from OpenSSL [42] when the AES encryption/decryption and hash summary are required. For each algorithm, we run it 100 times for each sample to obtain the mean of the computational time consumption and the ciphertext size. Note that for the scheme [16], we only run it 2 times when it processes the sample $R_4$ as the computational time cost of [16] is extremely high (about several days). All the security parameters in the implemented experiments are under the equivalent cryptographic security level (128-bit security) [32].

5.3. Results and Analysis

The results of our time cost experiments are shown in Figure 5 and Figure 6. It is clear that [15,16] are quite costly in the computation in Figure 5 because their schemes are sensitive to the data size, i.e., these two schemes involve the distributed data in public key operations for encryption and signing in the content distribution. Meanwhile, the scheme [17] is the most efficient scheme, but it only signs the samples to ensure the data integrity without any encryption. On the contrary, compared with the scheme [17], the schemes [19,28] and GCD-RSD can ensure the confidentiality and data integrity in the data distribution and achieve a comparable efficiency simultaneously. However, Chen et al.’s scheme [28] does not have the design of granularity control to achieve the granular content distribution as shown in Table 1. In processing the small-scale data ($R_1$ and $R_2$), the time cost of our scheme GCD-RSD for signing and verifying is less than that of the schemes [19,28] with an average advantage of 31.2% and 54.1%, respectively. When the size of the distributed data increases significantly ($R_3$ and $R_4$), the superiority of the GCD-RSD becomes more and more slight (less than 20%) as the major time cost comes from the encryption, decryption, and hash operations. However, if the attacker tampers or forges the ciphertext C, the GCD-RSD can find out the malicious manipulations in advance because of the designed data integrity check before the decryption. For example, the GCD-RSD requires only 5.85 s to detect the abnormal ciphertext C, while the scheme [19] needs 11.97 s for the sample $R_4$.

In Figure 6, the total time consumption of signing and verifying to distribute the samples $R_1$, $R_2$, $R_3$, and $R_4$ is reported. In this figure, four time-efficient schemes [17,19,28] and the GCD-RSD are compared because the schemes [15,16] are heavily time-consuming in the content distribution. The total computational time consumption grows with the size of the data for all four schemes. Apart from the scheme [17], which does not encrypt the distributed data to probably incur data leakage, our scheme GCD-RSD costs the least time in computation (27.6% faster than the scheme [28] and 43.6% faster than the scheme [19] on average) to complete the distributions of the four samples. Overall, our scheme GCD-RSD has the best computational time efficiency to achieve the content distribution while considering the confidentiality, integrity, and granularity control simultaneously in the comparison.

On the other hand, we measure the size of the ciphertext generated by the signing or signcryption algorithms for each scheme in our experiments and calculate the corresponding efficient data rate $\eta =\frac{\left|M\right|}{\left|C\right|}$, where $\left|M\right|$ and $\left|C\right|$ denote the length of the distributed data and the length of the generated ciphertext. The reason for calculating $\eta$ is to evaluate the size of the extra data used in the different schemes. The extra data can be the keys for the decryption or some auxiliary parameters for verifying the signature. Fewer extra data mean a smaller $\left|C\right|$ and higher $\eta$ to reduce the time cost in the ciphertext transmission. Based upon the results presented in Figure 7, the GCD-RSD can achieve a higher $\eta$ when compared with the schemes [16,19,28], which indicates the GCD-RSD requires fewer extra data to realise the data integrity check and decryption for the ciphertext (encrypted data). When a data requester frequently requests small remote sensing data (e.g., IoT sensor data), our scheme has an obvious advantage of reducing the communication cost with a smaller transmitted data size. Because the extra data are quite tiny when compared with the samples, the $\eta$ of each scheme is over 99%, but the $\eta$ of the schemes [15,17] and GCD-RSD are observed to be higher than the $\eta$ of the schemes [16,19] which need about 7 times the data than the other three schemes on average. For example, the original data size of the sample $R_1$ (compressed) is 133.1 KB, and the schemes [16,19] add 0.406 KB and 0.438 KB extra data in the ciphertext, respectively. Meanwhile, our scheme GCD-RSD requires 0.063 KB extra data in the ciphertext and the schemes [15,17,28] add 0.031 KB, 0.094 KB, and 0.125 KB extra data, respectively. However, we emphasise again that the scheme [17] can expose the distributed data when eavesdropping occurs as the scheme [17] only signs the data without the necessary encryption. Meanwhile, the scheme [15] requires heavy computation to lead to the high time cost as shown in Figure 5. In addition, it may expose sensitive data to the data requester without the consideration of granularity control in the distribution of the remote sensing data. Furthermore, when the depth and width of the used attribute tree grow, the schemes [16,19] can generate more extra data in the ciphertext because the scale of the extra data in the ciphertext generated by the schemes [16,19] is related to the scale of the used attribute tree. Therefore, our scheme GCD-RSD can achieve not only a high-efficient data rate but also a low computational time cost for the granular content distribution when compared with the other related schemes [15,16,17,19,28] based on the conducted experiments.

6. Conclusions

In this paper, we propose a granular content distribution scheme GCD-RSD for IoT remote sensing data distributions. The large data size feature brought by multimedia remote sensing data is considered in the GCD-RSD to avoid complicated public key operations in the data and hence to achieve high computational efficiency when compared with other content distribution methods in the experiments. Meanwhile, the GCD-RSD does not apply time-consuming public key operations, such as a bilinear pairing, to be lightweight for IoT devices as data requesters. Before the content distribution, the attribute tree is designed for granularity control to regulate different roles to access different parts of the data to safeguard the privacy of sensitive data. Furthermore, watermarks in remote sensing data are utilised to implement a dual data integrity check before and after decryption. It can help the data requester to perceive data tampering or forgery earlier. As a result, the data centre can employ our scheme GCD-RSD to provide a granular content distribution service more efficiently with privacy preservation.