A Strong Designated Verifier Proxy Re-Signature Scheme for IoT Environments

Abstract

With the rapid popularization of the Internet of Things (IoT) in our daily lives, the communication security and identity privacy of IoT devices must be ensured. However, traditional authentication mechanisms utilized in IoT cannot completely ensure a user’s privacy when his/her messages are routed via an untrusted intermediate device. Strong designated-verifier proxy re-signature (SDVPRS) is a new cryptographic technology that combines the advantages of strong designated verifier signature and proxy re-signature. Therefore, SDVPRS is considered to be a better approach to maintain data integrity and protect the identity privacy of the signer in a resource-limited IoT device. Nevertheless, designing a secure SDVPRS scheme without random oracles is still a challenging task. In this paper, we mainly focus on such a construction by providing a new method. We first provide the formal definition of SDVPRS and its security model. Then, we present the first SDVPRS scheme, which is bidirectional, multi-use and non-transferable, and we prove its security under the standard complexity assumptions in the standard model. The analysis results show that our SDVPRS scheme can not only protect the privacy of the signer’s identity, but also provide non-delegatability for signature verification. We present an example of potential application to environmental monitoring systems using our SDVPRS scheme.

1. Introduction

The Internet of Things (IoT) is rapidly entering all aspects of our daily lives. IoT uses sensors, radio frequency identification (RFID), wireless data communications and other technologies to construct a network that covers all things in the world to make the interactions between people and things and between things and things more intelligent and convenient [1]. IoT devices equipped with sensors have the ability to sense and process information, and they are used to collect, transmit and disseminate data from the field to a server or other IoT devices. IoT has been deployed in many environments, such as smart transportation, smart cities, environmental surveillance, smart homes, military target tracking, biomedical health monitoring and industrial automation [2].

IoT is everywhere in our daily lives and offers great benefits for human life. However, IoT data are transmitted over public networks, and ensuring a user’s privacy and data security is of particular importance [3]. In an IoT environment, most IoT devices have limitations in terms of energy capacity, storage capacity and computing power. Therefore, conventional cryptosystems cannot be implemented in resource-constrained IoT devices. Digital signature technology guarantees the integrity of the data during transmission and also authenticates the identity of the sender. Based on various digital signature techniques, such as identity-based signature and certificateless signature, researchers have proposed several schemes [2,3,4,5,6] to ensure the integrity and authenticity of IoT data transmitted over public channels. However, anyone can use the signer’s public key to verify the validity of the signature, so these schemes [2,3,4,5,6] reveal some private information of the signer (such as the identity of the signer). Strong designated verifier proxy re-signature (SDVPRS) can provide a better solution to solve these problems. Due to the combination of the features of strong designated verifier signature (SDVS) and proxy re-signature (PRS), SDVPRS not only maintains the integrity of IoT data during transmission, but also protects the identity privacy of the IoT device that signs IoT data. In an SDVPRS scheme, only the designated verifier can verify the validity of a signature. Specifically, SDVPRS allows a signer to designate a verifier, and a semi-trusted proxy is allowed to convert the signer or the designated verifier into a signature. However, how to design an SDVPRS scheme without random oracles is still challenging. Hence, we focus on constructing an SDVPRS scheme in the standard model that can be applied to IoT devices.

PRS, which allows a proxy to transform the signature of a message generated by Alice into Bob’s signature of the same message, is an important cryptosystem in cryptography [7]. However, the proxy by itself is unable to create arbitrary signatures on behalf of Alice or Bob. If the proxy can not only convert Alice’s signature into Bob’s signature, but also convert Bob’s signature into Alice’s signature, then we say that a PRS scheme is bidirectional. Additionally, if the transformed signatures can be further transformed by the proxy, then we say that a PRS scheme is multi-use. Since PRS can convert signatures, it has been applied to key management, cross-domain identity authentication and other fields [7,8,9].

To designate a verifier to verify the validity of a signature, the designated verifier signature (DVS) was presented by Jakobsson et al. [10]. A DVS scheme ensures that only the designated verifier can verify signatures generated by the signer. However, the designated verifier is able to produce simulated signatures that are computationally indistinguishable from the real signatures on the same messages created by the signer. Consequently, a DVS scheme provides the authentication of signatures, but it does not satisfy the non-repudiation of ordinary signatures since only the designated verifier is able to ensure that signatures are generated by a real signer. Specifically, in a DVS scheme, both the signer and the designated verifier can generate a valid signature of the message. To avoid man-in-the-middle attacks, Jakobsson et al. [10] further proposed the concept of the strong designated verifier signature (SDVS), which requires the secret key of the designated verifier during signature verification. Since the attacker does not know the verifier’s secrete key, the validity of the intercepted signature cannot be verified. SDVS has stronger security and many special applications such as voting and deniable authentication [11,12,13].

Based on the concepts of PRS and DVS, designated verifier proxy re-signature (DVPRS) was introduced by Wei et al. [14]. In a DVPRS scheme, a semi-trusted proxy can change the signer or the verifier in a DVS. Consequently, DVPRS has the properties of both PRS and DVS. DVPRS is a useful technique in deniable or anonymous authentication, and it can be applied to fields such as wireless communication networks [15,16,17].

To enhance the privacy of the signer’s identity, we introduce the concept of SDVPRS in this paper, which is a variant of DVPRS. In SDVPRS, the designated verifier’s secret key is required in the signature verification; thus, the validity of the signature can only be checked by the signer or the designated verifier. This approach ensures that an adversary who captures a signature only knows that either the signer or the designated verifier created the signature, but the adversary cannot infer which one of them is the real signature generator. No third party other than the designated verifier knows the true identity of the signer; thus, SDVPRS can protect the privacy of the signer’s identity. Because SDVPRS combines the advantages of SDVS and PRS, most of the significant security requirements, such as integrity, unforgeability and non-transferability, and the signer’s identity privacy protection can be guaranteed in a single logic step.

The security concepts of DVPRS were presented by Wei et al. [14], but the formal definition of SDVPRS was not taken into account in [14]. In addition, Wei et al. [14] designed a DVPRS scheme in the random oracle model, which is also the only publicly available DVPRS scheme. Unfortunately, the random oracle model might not ensure the security of the scheme if the random oracles are instantiated with concrete hash functions [18]. In fact, Wei et al.’s proposal [14] is an SDVPRS scheme since the verification of the signature requires the designated verifier’s secret key. Therefore, constructing a secure (S)DVPRS scheme without random oracles in the standard model is an unsolved problem.

1.1. Our Contributions

In this paper, we first present the security concepts of SDVPRS. In contrast to PRS, our formal definition for SDVPRS relies on the security concepts of SDVS. Based on Waters’ technique [19], we then present a construction of an SDVPRS scheme without random oracles, which is proven to be existentially unforgeable in the standard model. Our SDVPRS scheme is bidirectional, multi-use, transparent and non-transferable. Furthermore, the security proof shows that our SDVPRS scheme can ensure the integrity and authenticity of IoT data, as well as protect the identity privacy of the IoT device. To the best of our knowledge, our proposal is the first (strong) designated verifier PRS scheme without random oracles. Our SDVPRS scheme is very useful for protecting the security of IoT data and the identity privacy of the sender.

1.2. Related Work

With the substantial development of cloud computing and IoT techniques, data privacy [20,21,22,23], access control [24,25] and message authentication [26,27,28] have become important issues and the focus of many studies. According to the diverse requirements of the authentication, various signature schemes, such as homomorphic signature schemes [29,30] and proxy signature schemes [31,32,33], have been proposed. However, most of the existing message authentication schemes do not consider the privacy of IoT devices. SDVPRS is a new cryptographic technology that has the advantages of PRS and SDVS, so we introduce SDVPRS to solve the sender’s identity privacy problem in IoT environments.

The concept of PRS was presented by Blaze et al. [7] in 1998, and the security definition of PRS was formalized by Ateniese and Hohenberge [34] in 2005. Since then, researchers have designed a large number of PRS schemes with special properties. Hu et al. [35] proposed a secure identity-based proxy re-signature scheme under the standard model, but its security relies on strong difficult problem assumptions. Tian [36] designed an identity-based proxy re-signature scheme over lattices, but the size of the signature and secret key was relatively large. Wang and Xia [37] presented an identity-based proxy re-signature scheme with the aggregate property. However, their scheme required numerous system parameters. To reduce the security risks of an individual proxy, Yang et al. [38] introduced the concept of threshold proxy re-signature, which can distribute the re-signature key to multiple proxies for management. Yang et al. [39] introduced the concept of flexible threshold proxy re-signature, which can flexibly select different thresholds according to the importance of the message to be re-signed. To improve the response time of re-signing, Yang et al. [40] proposed an on-line/off-line threshold proxy re-signature scheme, which completes most of the computational tasks of re-signing in the off-line phase. To solve the key escrow problem in identity-based proxy re-signature, some certificateless proxy re-signature schemes [41,42] have been proposed. Unfortunately, these schemes have some security flaws [43].

The first DVS scheme was presented by Jakobsson et al. [10] in 1996. Saeednia et al. [44] gave the formal definition of SDVS. Later, some SDVS schemes were presented in [45,46,47]. Hung et al. [48] designed a secure SDVS scheme in the standard model, but its security depended on the security of pseudo-random functions. Hence, their scheme has potential security risks. Based on the standard complexity assumptions, Tian et al. [49] designed two SDVS schemes without random oracles. The researchers also proposed some variants of DVS such as universal DVS [50,51] and multi-verifier DVS [52,53]. Until now, the only DVPRS scheme was that proposed by Wei et al. [14], but its security was dependent on ideal random oracles.

Data security has become an important issue in IoT. When IoT data are transmitted through open and insecure channels, they are vulnerable to various attacks, such as forgery attack, tamper attack, and so on. To ensure the communication security of IoT devices, Jia et al. [3] proposed a data authentication scheme based on a certificateless signature. Combining aggregate signature and identity-based signature, Shen et al. [2] designed a data integrity protection scheme for wireless sensor networks. Kumar et al. [4] proposed a secure data transmission scheme for a healthcare wireless sensor network using certificateless aggregation signature technology. Yeh et al. [6] proposed an efficient certificateless signature scheme to ensure the security of IoT devices. However, these schemes [2,3,4,5,6] were proven to be secure in the random oracle model, which means that these schemes might be insecure in reality. In particular, these existing schemes protect the integrity of IoT data, but at the same time, they disclose the identity privacy of IoT devices. Motivated by this scenario, we construct an SDVPRS scheme in the standard model to protect the integrity of IoT data and the privacy of the sender’s identity. The proxy converts the IoT device’s signature to a group’s signature on the same data, thereby reducing the risk of identifying the identity of the IoT device according to the signature and realizing the anonymity of data transmission. In addition to the designated verifier, no one can verify the legality of the final signature. That is, our scheme enables the integrity and authenticity of IoT data to be verified without revealing the user’s identity privacy.

2. Preliminaries

2.1. Bilinear Pairing

Assume that p is a large prime, $G_1$ and $G_2$ are two multiplicative cyclic groups of order p and g is an arbitrary generator of $G_1$. A map $e:G_1\times G_1\to G_2$ is called a bilinear pairing if it satisfies the following conditions.

• Bilinearity: $e(g^x,g^y)$ = $e{(g,g)}^{xy}$, where $x,y\in Z_p$.
• Non-degeneracy: $e(g,g)\ne 1_{G_2}$, where $1_{G_2}$ is the identity element of $G_2$.
• Computability: $e(g^x,g^y)$ is efficiently computable, where $x,y\in Z_p$.

2.2. Complexity Assumptions

Polynomial-time algorithms are unable to solve the following hard problems [34,54], which are considered to be intractable in complexity theory.

Definition 1.

Given four elements $g,g^a,g^b,g^c\in G_1$, where unknown values a, b and c are randomly selected from $Z_p$, the bilinear Diffie–Hellman (BDH) problem in $(G_1,G_2)$ is to calculate $e{(g,g)}^{abc}\in G_2$.

Definition 2.

Given $g,g^a,g^b,g^c\in G_1$ and $Z\in G_2$ where unknown values a, b and c are randomly selected from $Z_p$, the decisional bilinear Diffie–Hellman (DBDH) problem in $(G_1,G_2)$ is to determine whether $Z=e{(g,g)}^{abc}$ holds.

Taking as input $(g,g^a,g^b,g^c)\in G_1^4$ and $Z\in G_2$, the DBDH oracle ${\mathcal{O}}_{DBDH}$ outputs one if $Z=e{(g,g)}^{abc}$; else, it outputs zero.

Definition 3.

Given $g,g^a,g^b,g^c\in G_1$ where unknown values a, b and c are randomly selected from $Z_p$, the gap bilinear Diffie–Hellman (GBDH) problem in $(G_1,G_2)$ is to use the oracle ${\mathcal{O}}_{DBDH}$ to calculate $e{(g,g)}^{abc}\in G_2$.

The main difference between the BDH problem and the GBDH problem is whether the DBDH oracle ${\mathcal{O}}_{DBDH}$ is required to solve the corresponding problem.

3. Security Model and System Framework

3.1. The Syntax of SDVPRS

An SDVPRS scheme includes the following nine algorithms:

• $\mathbf{Setup}$: This algorithm takes a security parameter $\lambda \in Z$ as input and produces system parameters $sp$.
• $\mathbf{KeyGen}$: Upon input of $sp$, this algorithm outputs a secret key $sk$ and a corresponding public key $pk$.
• $\mathbf{ReSKey}$: Upon input of $sp$, a signer’s key pair $(p{k}_A,s{k}_A)$ and another signer’s key pair $(p{k}_B,s{k}_B)$, this algorithm generates a re-signing key $rs{k}_{A\to B}$ for the proxy.
• $\mathbf{ReVKey}$: Upon input of $sp$ and two verifiers’ key pairs $(p{k}_C,s{k}_C)$ and $(p{k}_D,s{k}_D)$, this algorithm generates a re-designate-verifier key $rv{k}_{C\to D}$.
• $\mathbf{Sign}$: This algorithm takes $sp$, a signer’s secret key $s{k}_S$, a message m and a designated verifier’s public key $p{k}_V$ as input. It outputs a signature $\sigma$ on m.
• $\mathbf{ReSign}$: This algorithm takes $sp$, a re-signing key $rs{k}_{A\to B}$ between a signer $S_A$ and another signer $S_B$ and a signature ${\sigma }_{AC}$ on a message m under the signer $S_A$ and a verifier $V_C$ as input. It generates a re-signature ${\sigma }_{BC}$ on m under $S_B$ and $V_C$.
• $\mathbf{ReVer}$: This algorithm takes $sp$, a re-designate-verifier key $rv{k}_{C\to D}$ between a verifier $V_C$ and another verifier $V_D$ and a signature ${\sigma }_{AC}$ on a message m under a signer $S_A$ and the verifier $V_C$ as input. It generates a re-signature ${\sigma }_{AD}$ on m under $S_A$ and $V_D$.
• $\mathbf{Verify}$: This algorithm takes $sp$, a signer’s public key $p{k}_S$, a designated verifier’s secret key $s{k}_V$ and a signature $\sigma$ on a message m as input. It outputs one if $\sigma$ is a valid signature; otherwise, it outputs zero.
• $\mathbf{Sim}$: This algorithm takes $sp$, a signer’s public key $p{k}_S$, a designated verifier’s secret key $s{k}_V$ and a message m as input. It generates a simulated signature ${\sigma }^{{}^{\prime }}$ that is indistinguishable from the one created by the signer.

3.2. Security Model of SDVPRS

An SDVPRS scheme consists of three entities: the signer, the proxy and the designated verifier. The security model of SDVPRS mainly considers the following four security concepts. Among them, two properties, unforgeability and non-delegatability for signature verification, ensure the integrity and authenticity of the IoT data in the communication process, and the other two properties, non-transferability and privacy of the signer’s identity (PSI), prevent any third party from obtaining the identity information of the IoT device from a signature. Similar to the security model of a bidirectional PRS scheme [34], the security model of a bidirectional SDVPRS scheme also requires that the proxy is semi-trusted and is not allowed to collude with the signer or the designated verifier.

Unforgeability means that a legal signature can only be generated by the signer or the designated verifier. We define a game between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ to describe the unforgeability of an SDVPRS scheme.

• $\mathbf{Setup}$: $\mathcal{C}$ executes the algorithms $\mathbf{Setup}$ and $\mathbf{KeyGen}$ to generate system parameters $sp$, the key pair $(p{k}_S$, $s{k}_S)$ of the target signer and the key pair $(p{k}_V,s{k}_V)$ of the target verifier. Then, $\mathcal{C}$ sends $(sp,p{k}_S,p{k}_V)$ and the public keys of other users to $\mathcal{A}$.
• $\mathbf{Queries}$: $\mathcal{A}$ may adaptively request the following oracles built by $\mathcal{C}$.

  -

  ${\mathcal{O}}_{Sign}$: Upon input of message $m_i$, this oracle outputs a signature ${\sigma }_i$ = $\mathbf{Sign}(s{k}_S,p{k}_V,m_i)$ on $m_i$.

  -

  ${\mathcal{O}}_{ReSKey}$: Upon input of two signers’ public keys $p{k}_i$ and $p{k}_j$, this oracle outputs a re-signing key $rs{k}_{i\to j}$ = $\mathbf{ReSKey}(p{k}_i,s{k}_i,p{k}_j,s{k}_j)$, where $s{k}_i$ and $s{k}_j$ are the secret keys corresponding to $p{k}_i$ and $p{k}_j$, respectively.

  -

  ${\mathcal{O}}_{ReVKey}$: Upon input of two verifiers’ public keys $p{k}_i$ and $p{k}_j$, this oracle outputs a re-designate-verifier key $rv{k}_{i\to j}$ = $\mathbf{ReVKey}(p{k}_i$, $s{k}_i,p{k}_j,s{k}_j)$.

  -

  ${\mathcal{O}}_{Sim}$: Upon input of a message $m_i$, this oracle returns a simulated signature ${\sigma }_i^{{}^{\prime }}$ = $\mathbf{Sim}(s{k}_V,p{k}_S,m_i)$ on $m_i$.

  -

  ${\mathcal{O}}_{Verify}$: This oracle takes a message $m_i$ and a signature ${\sigma }_i$ as input, and it outputs a decision $dec$ = $\mathbf{Verify}(s{k}_V$, $p{k}_S,m_i,{\sigma }_i)$, where $dec\in \{0,1\}$.

• $\mathbf{Forgery}$: Eventually, $\mathcal{A}$ produces a forgery $(m^{*},{\sigma }^{*})$. The adversary $\mathcal{A}$ wins if the following conditions are satisfied.
  • $\mathbf{Verify}(s{k}_V,p{k}_S,m^{*},{\sigma }^{*})$ = 1, which means that ${\sigma }^{*}$ is a valid signature on $m^{*}$.
  • $m^{*}$ has never been submitted to ${\mathcal{O}}_{Sign}$ and ${\mathcal{O}}_{Sim}$.

Definition 4.

If there is no polynomial-time attacker $\mathcal{A}$ who can win in the above game with a non-negligible probability, then we say that a bidirectional SDVPRS scheme is existentially unforgeable against adaptive chosen-message attacks.

The property of non-transferability means that any third party cannot distinguish whether the real generator of a signature is the signer or the designated verifier.

Definition 5.

If the signature created by the signer and the signature simulated by the designated verifier are computationally indistinguishable, then we say that an SDVPRS scheme is non-transferable [14].

PSI ensures that no one other than the designated verifier can infer the signer’s true identity from a signature. Specifically, two signers $S_0$ and $S_1$ produce signatures for a designated verifier V. Given a signature $\sigma$ on a message m, anyone without V’s secret key is unable to determine whether $\sigma$ is created by $S_0$ or $S_1$. We provide a game between a distinguisher $\mathcal{D}$ and a challenger $\mathcal{B}$ to describe the formal definition of PSI.

• $\mathbf{Setup}$: $\mathcal{B}$ performs the algorithms $\mathbf{Setup}$ and $\mathbf{KeyGen}$ to generate system parameters $sp$, $S_0$’s key pair $(p{k}_{S_0},s{k}_{S_0})$, $S_1$’s key pair $(p{k}_{S_1},s{k}_{S_1})$ and V’s key pair $(p{k}_V,s{k}_V)$. Then, $\mathcal{B}$ sends $(sp,p{k}_{S_0}$, $p{k}_{S_1},p{k}_V)$ to $\mathcal{D}$.
• $\mathbf{Phase}\mathbf{1}$: $\mathcal{D}$ may adaptively issue the following oracle queries.

  -

  ${\mathcal{O}}_{Sign}$: Upon receiving $sp$, a message $m_i$ and an index $d\in \{0,1\}$, this oracle returns a signature ${\sigma }_i$ = $\mathbf{Sign}($$s{k}_{S_d},p{k}_V,m_i)$ of $m_i$.

  -

  ${\mathcal{O}}_{Sim}$: Upon receiving $sp$, a message $m_i$ and an index $d\in \{0,1\}$, this oracle returns a simulated signature ${\sigma }_i^{{}^{\prime }}$ = $\mathbf{Sim}(s{k}_V,p{k}_{S_d},m_i)$ on $m_i$.

  -

  ${\mathcal{O}}_{Verify}$: Taking $sp$, an index $d\in \{0,1\}$ and a signature $\sigma$ on a message m as input, this oracle outputs a decision $dec$ = $\mathbf{Verify}(s{k}_V,p{k}_{S_d},m,\sigma )$, where $dec\in \{0,1\}$.

  -

  ${\mathcal{O}}_{ReSign}$: Upon input of $sp$, a message $m_d$, an index $d\in \{0,1\}$, a signature ${\sigma }_d$ on $m_d$ and an index $d_2\in \{0,1\}$, this oracle outputs a re-signature ${\sigma }_{d_2}$ = $\mathbf{ReSign}(\mathbf{ReVKey}(p{k}_d,s{k}_d,p{k}_{d_2},s{k}_{d_2}),m_d,p{k}_d$, ${\sigma }_d)$ on $m_d$.

• $\mathbf{Challenge}$: Upon receiving a challenge message $m^{*}$ submitted by $\mathcal{D}$, $\mathcal{B}$ first selects a random bit $b\in \{0,1\}$ and runs the algorithm $\mathbf{Sign}$ to generate a signature ${\sigma }^{*}$ = $\mathbf{Sign}(s{k}_{S_b},p{k}_V,m^{*})$. Then, $\mathcal{B}$ returns ${\sigma }^{*}$ to $\mathcal{D}$.
• $\mathbf{Phase}\mathbf{2}$: $\mathcal{D}$ continues to query ${\mathcal{O}}_{Sign}$, ${\mathcal{O}}_{Sim}$ and ${\mathcal{O}}_{Verify}$ defined in Phase 1, but $\mathcal{D}$ is not allowed to submit $(m^{*},{\sigma }^{*})$ to ${\mathcal{O}}_{Verify}$.
• $\mathbf{Guessing}\mathbf{Phase}$: $\mathcal{D}$ finally outputs a guess $b^{{}^{\prime }}\in \{0,1\}$. The distinguisher $\mathcal{D}$ wins the game if $b=b^{{}^{\prime }}$.

The advantage of $\mathcal{D}$ in the game is defined as follows:

$$\begin{array}{c}\hfill Ad{v}_D=\left|Pr[b^{{}^{\prime }}=b]-\frac{1}{2}\right|.\end{array}$$

Definition 6.

If the advantage $Ad{v}_D$ of any polynomial-time distinguisher $\mathcal{D}$ is negligible in the above game, then we say that an SDVPRS scheme possesses the PSI property.

Non-delegatability for signature verification requires that the legality of a signature can only be correctly verified by those who know the secret key of the designated verifier. We use a game between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ to define non-delegatability for signature verification.

• $\mathbf{Setup}$: $\mathcal{C}$ executes the algorithms $\mathbf{Setup}$ and $\mathbf{KeyGen}$ to generate system parameters $sp$, the key pair $(p{k}_S,s{k}_S)$ of the target signer and the key pair $(p{k}_V,s{k}_V)$ of the target verifier. Then, $\mathcal{C}$ sends $(sp,p{k}_S,p{k}_V)$ to $\mathcal{A}$.
• $\mathbf{Queries}$: $\mathcal{C}$ answers $\mathcal{A}$’s signing query and simulation query in the same manner as in the formal definition of existential unforgeability in Definition 5.
• $\mathbf{Forgery}$: $\mathcal{A}$ finally produces a forgery $(m^{*},{\sigma }^{*})$. If the following conditions are satisfied, then we say that $\mathcal{A}$ wins the game.
  • ${\sigma }^{*}$ is a valid signature on $m^{*}$, namely $\mathbf{Verify}(s{k}_V$, $p{k}_S,m^{*},{\sigma }^{*})$ = 1.
  • $\mathcal{A}$ has never made a signature query and a simulated query on $m^{*}$.

Definition 7.

An SDVPRS scheme is said to be non-delegatable for signature verification if there is no polynomial-time attacker $\mathcal{A}$ who can win the above game with a non-negligible probability.

3.3. System Framework

Our system model is shown in Figure 1, which contains three entities: IoT device, proxy and data center. It focuses on the integrity and authenticity of IoT data during transmission while protecting the identity privacy of the IoT device. The proposed SDVPRS scheme is easily implemented on each IoT device as software. Our system model focuses on the integrity and authenticity of IoT data.

• IoT device: This entity has very limited computing and communication capabilities. Each IoT device uses its secret key to sign the data collected from the physical world and then sends the data and its signature to the proxy.
• Proxy: This entity is usually served by a semi-trusted server with a certain computation and communication power. To ensure the security of data storage, IoT data are stored by multiple data centers for consumers of different security levels. The proxy uses the re-signing key $rs{k}_{A\to B}$ to convert the signature ${\sigma }_{AC}$ generated by the IoT device into a group’s signature ${\sigma }_{BC}$ for the same message m, so that the data center only knows that ${\sigma }_{BC}$ is a valid signature on m, but cannot infer the identity of the real signer. After receiving $(m,{\sigma }_{BC})$, another proxy uses the re-designate-verifier key $rv{k}_{C\to D_i}$ to convert the signature ${\sigma }_{BC}$ into the signature ${\sigma }_{B{D}_i}$ for every data center, and it sends the IoT data m and ${\sigma }_{B{D}_i}$ to the i-th data center, where $i\in \{1,\dots ,n\}$.
• Data center: This entity has high computing and storage capacities. After verifying the validity of the received signature, the authentic IoT data are stored by each data center.

4. Our SDVPRS Scheme

In this section, we present a construction of an SDVPRS scheme based on Waters’ scheme [19]. In our proposed SDVPRS scheme, the length of a message is assumed to be n bits. For a message of arbitrary length, we use a hash function $H:{\{0,1\}}^{*}\to {\{0,1\}}^n$ to convert the length of the message to fixed length n. Our SDVPRS scheme works as follows.

• $\mathbf{Setup}$: This algorithm takes a security parameter $\lambda \in Z$ as input and produces system parameters $sp$ = $(G_1,G_2,p,g,e,u_0,u_1,\dots ,u_n)$, where $G_1$ and $G_2$ are two cyclic groups of prime order p, g is a generator of $G_1$, $e:G_1\times G_1\to G_2$ is a bilinear pairing and $n+1$ elements $u_0,u_1,\dots ,u_n$ are randomly chosen from $G_1$.
• $\mathbf{KeyGen}$: The signer S randomly selects $(x_S,y_S)\in Z_p$, computes $p{k}_{S,1}=g^{x_S}$ and $p{k}_{S,2}=g^{y_S}$ and sets its secret key $s{k}_S=(s{k}_{S,1},s{k}_{S,2})=(x_S,y_S)$ and the public key $p{k}_S=(p{k}_{S,1}$, $p{k}_{S,2})=(g^{x_S},g^{y_S})$. Similarly, the designated verifier V randomly selects $x_V\in Z_p$, computes $p{k}_V=g^{x_V}$ and outputs its public/secret key pair $(p{k}_V,s{k}_V)=(g^{x_V},x_V)$.
• $\mathbf{ReSKey}$: The proxy randomly selects $r_1\in Z_p$ and sends $r_1$ to the signer $S_A$. After receiving $r_1$, $S_A$ uses his/her secret key $s{k}_A=(x_A,y_A)$ to compute $r_2=x_A{y}_A{r}_1(mod p)$ and forwards $r_2$ to the signer $S_B$. Then, $S_B$ uses his/her secret key $s{k}_B=(x_B,y_B)$ to calculate and send $r_3=\frac{x_B{y}_B}{r_2}(mod p)$ to the proxy. Finally, the proxy computes the re-signing key between $S_A$ and $S_B$:

  $$rs{k}_{A\to B}=r_3{r}_1=r_1(\frac{x_B{y}_B}{x_A{y}_A{r}_1})=\frac{x_B{y}_B}{x_A{y}_A}(mod p).$$
• $\mathbf{ReVKey}$: To generate a re-designate-verifier key $rv{k}_{C\to D}$ between two verifiers $V_C$ and $V_D$, the proxy does the following:
  • The proxy randomly selects $s_1\in Z_p$ and returns $s_1$ to the verifier $V_C$.
  • $V_C$ uses his/her secret key $s{k}_C=x_C$ to compute $s_2=s_1{x}_C(mod p)$ and sends $s_2$ to the verifier $V_D$.
  • $V_D$ uses his/her secret key $s{k}_D=x_D$ to compute $s_3=\frac{x_D}{s_2}(mod p)$. Then, $V_D$ returns $s_3$ to the proxy.
  • After receiving $s_3$, the proxy calculates the re-designate-verifier key as follows:

    $$rv{k}_{C\to D}=s_3{s}_1=s_1(\frac{x_D}{s_1{x}_C})=\frac{x_D}{x_C}(mod p).$$
  Note that $rs{k}_{A\to B}$ and $rv{k}_{C\to D}$ can be kept by different proxies to perform different operations, and they can also be assigned to a proxy to perform all operations. In $\mathbf{ReSKey}$ and $\mathbf{ReVKey}$, a cryptographic algorithm (such as RSA or ECC) may be used to encrypt the transmitted messages to prevent the proxy from obtaining each participant’s secret key through intercepted messages in practical applications.
• $\mathbf{Sign}$: Given a message $m=(m_1,\dots m_n)\in {\{0,1\}}^n$ and a designated verifier V’s public key $g^v$, the signer S performs the following steps:
  • Choose a random integer $r\in Z_p$, and calculate ${\sigma }_2=g^r$.
  • Calculate ${\sigma }_1=e(g^{x_S{y}_S}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^v)$, where $(x_S,y_S)$ is the secret key of the signer S.
  • Output $\sigma =({\sigma }_1,{\sigma }_2)$ as a signature on m.
• $\mathbf{ReSign}$: For a signature ${\sigma }_{AC}=({\sigma }_{AC,1},{\sigma }_{AC,2})$ on a message m with respect to a signer $S_A$ and a verifier $V_C$, the proxy uses a re-signing key $rs{k}_{A\to B}$ between two signers $S_A$ and $S_B$ to compute a new signature ${\sigma }_{BC}$ on m related to the signer $S_B$ and the verifier $V_C$ as follows:

  $${\sigma }_{BC}=({({\sigma }_{AC,1})}^{rs{k}_{A\to B}},{({\sigma }_{AC,2})}^{rs{k}_{A\to B}}).$$
• $\mathbf{ReVer}$: Given a re-designate-verifier key $rv{k}_{C\to D}$ between two verifiers $V_C$ and $V_D$, a message m and a signature ${\sigma }_{AC}=({\sigma }_{AC,1},{\sigma }_{AC,2})$ of m for a signer $S_A$ and a verifier $V_C$, the proxy computes a new signature ${\sigma }_{AD}$ on m for $S_A$ and $V_D$ as follows:

  $${\sigma }_{AD}=({({\sigma }_{AC,1})}^{rv{k}_{C\to D}},{({\sigma }_{AC,2})}^{rv{k}_{C\to D}}).$$
• $\mathbf{Verify}$: Upon receiving the public key $p{k}_S=(g^{x_S},g^{y_S})$ of a signer S, a message m and a corresponding signature $\sigma =({\sigma }_1,{\sigma }_2)=(e(g^{x_S{y}_S}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^{x_V}),g^r)$, the designated verifier V utilizes its own secret key $s{k}_V=x_V$ to check whether:

  $$\begin{array}{c}\begin{array}{c}\hfill {\sigma }_1=e{(g^{x_S},g^{y_S})}^{x_V}e(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_2{)}^{x_V}\end{array}\end{array}$$

  holds. If it holds, output one; else, output zero.
• $\mathbf{Sim}$: For a message m and the public key $p{k}_S=(g^{x_S},g^{y_S})$ of a signer S, the designated verifier V with a secret key $s{k}_V=x_V$ randomly selects $r^{{}^{\prime }}\in Z_p$, computes ${\sigma }_2^{{}^{\prime }}=g^{r^{{}^{\prime }}}$ and:

  $${\sigma }_1^{{}^{\prime }}=e{(g^{x_S},g^{y_S})}^{x_V}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_2^{{}^{\prime }})}^{x_V},$$

  then generates ${\sigma }^{{}^{\prime }}=({\sigma }_1^{{}^{\prime }},{\sigma }_2^{{}^{\prime }})$ as a simulated signature on m with respect to S and V.

Correctness: Assume that ${\sigma }_{AC}=({\sigma }_{AC,1},{\sigma }_{AC,2})=(e(g^{x_A{y}_A}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{r_A},g^{x_V}),g^{r_A})$ is a signature on a message m for $S_A$ and $V_C$, $rs{k}_{A\to B}=\frac{x_B{y}_B}{x_A{y}_A}(mod p)$ is a re-signing key between $S_A$ and $S_B$ and ${\sigma }_{BC}=({\sigma }_{BC,1},{\sigma }_{BC,2})$ is a signature on m that is derived from ${\sigma }_{AC}$ and $rs{k}_{A\to B}$.

Let ${\widehat{r}}_A=r_A$; we have:

$$\begin{array}{cc}\hfill {\sigma }_{BC,1}& ={({\sigma }_{AC,1})}^{rs{k}_{A\to B}}\hfill \\ & =e{(g^{x_A{y}_A}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{r_A},g^{x_V})}^{\frac{x_B{y}_B}{x_A{y}_A}}\hfill \\ & =e(g^{(x_A{y}_A)\frac{x_B{y}_B}{x_A{y}_A}}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{r_A\frac{x_B{y}_B}{x_A{y}_A}},g^{x_V})\hfill \\ & =e(g^{x_B{y}_B}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{{\widehat{r}}_A},g^{x_V}),\hfill \end{array}$$

$${\sigma }_{BC,2}={({\sigma }_{AC,2})}^{rs{k}_{A\to B}}={(g^{r_A})}^{\frac{x_B{y}_B}{x_A{y}_A}}=g^{r_A\frac{x_B{y}_B}{x_A{y}_A}}=g^{{\widehat{r}}_A}.$$

Then, we can obtain:

$$\begin{array}{cc}\hfill {\sigma }_{BC,1}& =e(g^{x_B{y}_B}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{{\widehat{r}}_A},g^{x_V})\hfill \\ & =e(g^{x_B{y}_B},g^{x_V})e({(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{{\widehat{r}}_A},g^{x_V})\hfill \\ & =e{(g^{x_B},g^{y_B})}^{x_V}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},g^{{\widehat{r}}_A})}^{x_V}\hfill \\ & =e{(g^{x_B},g^{y_B})}^{x_V}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_{BC,2})}^{x_V}.\hfill \end{array}$$

Similarly, we are able to check the correctness of the signature ${\sigma }_{AD}$ for $S_A$ and $V_D$. Hence, we can conclude that our SDVPRS scheme is correct.

Remark 1.

For a re-signing key $rs{k}_{A\to B}$ between $S_A$ and $S_B$, it is easy to obtain another key $rs{k}_{B\to A}=\frac{1}{rs{k}_{A\to B}}$ between $S_B$ and $S_A$ that converts $S_B$’s signatures into $S_A$’s signatures. From a re-designate-verifier key $rv{k}_{C\to D}$ between $V_C$ and $V_D$, we can also obtain another key $rv{k}_{D\to C}=\frac{1}{rv{k}_{C\to D}}$ that transforms the identity of the verifier in a signature from $V_D$ to $V_C$. Hence, our SDVPRS scheme is bidirectional.

Remark 2.

As ${\sigma }_{BC}={({\sigma }_{AC})}^{rs{k}_{A\to B}}$ and ${\sigma }_{AD}$ = ${({\sigma }_{AC})}^{rv{k}_{C\to D}}$, it is easy to infer that signatures created by the $\mathbf{Sign}$ algorithm are computationally indistinguishable from signatures generated by the $\mathbf{ReSign}$ and $\mathbf{ReVer}$ algorithms. This shows that the proposed SDVPRS scheme possesses the multi-use property.

Remark 3.

If $\sigma =(e(g^{x_S{y}_S}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^{x_V}),g^r)$ is a signature created by the signer S for the message m, then the designated verifier V can also output a valid signature ${\sigma }^{{}^{\prime }}=(e{(g^{x_S},g^{y_S})}^{x_V}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},g^r)}^{x_V},g^r)$ on the same message m. Consequently, the distribution of σ is the same as that of ${\sigma }^{{}^{\prime }}$. This result implies that signatures generated by the $\mathbf{Sign}$ algorithm are indistinguishable from those simulated by the $\mathbf{Sim}$ algorithm. Therefore, our SDVPRS scheme is non-transferable.

Theorem 1.

If the GBDH problem is intractable, then our proposed SDVPRS scheme is existentially unforgeable against adaptively chosen message attacks in the standard model.

Proof of Theorem 1.

Let $\mathcal{A}$ be an attacker against the unforgeability of the proposed scheme with probability ε. $\mathcal{A}$ is allowed to make at most $q_S$ signing queries, $q_V$ signature verification queries, $q_{Sim}$ simulation queries, $q_{rsk}$ re-signing key queries and $q_{rvk}$ re-designate-verifier key queries. We can build an algorithm $\mathcal{C}$ that utilizes $\mathcal{A}$’s output to solve the GBDH problem. Given an instance $(g,g^a,g^b,g^c)\in G_1^4$ of the GBDH problem, $\mathcal{C}$’s goal is to calculate $e{(g,g)}^{abc}$ by invoking the oracle ${\mathcal{O}}_{DBDH}$. $\mathcal{C}$ will act as a challenger to answer the following queries requested by $\mathcal{A}$.

• $\mathbf{Setup}$: $\mathcal{C}$ sets $l_m=2(q_S+q_V+q_{Sim})$ such that $l_m(n+1)<p$. Then, $\mathcal{C}$ chooses a random integer $k_m(0\le k_m\le n)$, $n+1$ random values $v_0,v_1,\dots ,v_n\in Z_{l_m}$ and $n+1$ random elements $w_0,w_1,\dots ,w_n\in Z_p$. Furthermore, $\mathcal{C}$ assigns $u_0={(g^b)}^{v_0-l_m{k}_m}{g}^{w_0}$ and $u_i={(g^b)}^{v_i}{g}^{w_i}$ for $i=1,\dots ,n$. In addition, $\mathcal{C}$ randomly selects $x_i,y_i,z_j\in Z_p$ and sets the public key of the signer i to be $p{k}_i=(g^{a{x}_i},g^{b{y}_i})$ and the public key of the verifier j as $p{k}_j=g^{c{z}_j}$ for $i=1,\dots ,2q_{rsk}$ and $j=1,\dots ,2q_{rvk}$. The public key of the target signer is set to $p{k}_S=(p{k}_{S,1},p{k}_{S,2})=(g^a,g^b)$, and the public key of the target designated verifier’s public key is set to $p{k}_V=g^c$. This implicitly indicates that $s{k}_S=(a,b)$ is the target signer’s secret key and $s{k}_V=c$ is the target designated verifier’s secret key, but $(a,b)$ and c are unknown to $\mathcal{C}$. Finally, $\mathcal{C}$ sends $(G_1,G_2,p,g,e,u_0,u_1,\dots ,u_n$, $p{k}_S,p{k}_V)$ and the public keys of other users to $\mathcal{A}$.
  Given any n-bit message $m=(m_1,\dots ,m_n)$, we define two functions to simplify the expression: $F(m)=v_0-l_m{k}_m+{\displaystyle \sum _{i=1}^n}{v}_i{m}_i$ and $J(m)=w_0+{\displaystyle \sum _{i=1}^n}{w}_i{m}_i$. Consequently, we have $u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i}={(g^b)}^{F(m)}{g}^{J(m)}.$
• $\mathbf{Queries}$: $\mathcal{C}$ builds the following oracles to answer $\mathcal{A}$’s queries.

  -

  ${\mathcal{O}}_{Sign}$: Upon receiving a message m, $\mathcal{C}$ checks whether $F(m)=0(mod{l}_m)$ holds. If it does hold, then $\mathcal{C}$ aborts. Otherwise, $\mathcal{C}$ randomly selects $r\in Z_p$, computes ${\sigma }_1=e({(g^a)}^{\frac{-J(m)}{F(m)}}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^c)$ and ${\sigma }_2={(g^a)}^{\frac{-1}{F(m)}}{g}^r$ and then returns a signature $\sigma =({\sigma }_1,{\sigma }_2)$ on m to $\mathcal{A}$.

  Correctness: For a signature $\sigma =({\sigma }_1,{\sigma }_2)$ produced by $\mathcal{C}$, we have:

  $$\begin{array}{cc}\hfill {\sigma }_1& =e({(g^a)}^{\frac{-J(m)}{F(m)}}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^c)\hfill \\ & =e((g^{ab})(g^{-ab}){(g^a)}^{\frac{-J(m)}{F(m)}}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^c)\hfill \\ & =e(g^{ab}{({(g^b)}^{F(m)}(g^{J(m)}))}^{\frac{-a}{F(m)}}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^c)\hfill \\ & =e(g^{ab}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{\frac{-a}{F(m)}}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^c)\hfill \\ & =e(g^{ab}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{r-\frac{a}{F(m)}},g^c)\hfill \\ & =e(g^{ab}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{\widehat{r}},g^c)\hfill \end{array}$$

  and ${\sigma }_2={(g^a)}^{\frac{-1}{F(m)}}{g}^r=g^{r-\frac{a}{F(m)}}=g^{\widehat{r}}$, where $\widehat{r}=r-\frac{a}{F(m)}$.

  Then, we deduce that $\sigma =({\sigma }_1,{\sigma }_2)$ satisfies the following signature verification equation:

  $$\begin{array}{cc}\hfill {\sigma }_1& =e(g^{ab}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{\widehat{r}},g^c)\hfill \\ & =e(g^{ab},g^c)e({(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^{\widehat{r}},g^c)\hfill \\ & =e{(g^a,g^b)}^{c}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_2)}^c.\hfill \end{array}$$

  This equation shows that the signature σ is valid. Moreover, it indicates that the signature computed by $\mathcal{C}$ and the signature created by the signer in the real scheme are computationally indistinguishable from the adversary $\mathcal{A}$’s view.

  -

  ${\mathcal{O}}_{ReSKey}$: Upon receiving two signers’ public keys $p{k}_i$ and $p{k}_j$, $\mathcal{C}$ computes $rs{k}_{i\to j}=\frac{a{x}_j·b{y}_j}{a{x}_i·b{y}_i}=\frac{x_j·y_j}{x_i·y_i}(mod p)$ and returns a re-signing key $rs{k}_{i\to j}$ to $\mathcal{A}$.

  -

  ${\mathcal{O}}_{ReVKey}$: Upon input of two verifiers’ public keys $p{k}_i$ and $p{k}_j$, $\mathcal{C}$ computes $rv{k}_{i\to j}=\frac{c{z}_j}{c{z}_i}=\frac{z_j}{z_i}(mod p)$ and returns a corresponding re-designate-verifier key $rv{k}_{i\to j}$ to $\mathcal{A}$.

  -

  ${\mathcal{O}}_{Sim}$: This oracle is the same as ${\mathcal{O}}_{Sign}$.

  -

  ${\mathcal{O}}_{Verify}$: Upon receiving a message m and a signature $\sigma =({\sigma }_1,{\sigma }_2)$, $\mathcal{C}$ responds by performing the following steps:

  (1)

  If $F(m)\ne 0(mod p)$, then $\mathcal{C}$ creates another signature $\tilde{\sigma }=({\tilde{\sigma }}_1,{\tilde{\sigma }}_2)$ of m just as $\mathcal{C}$ responds to the signing queries in the oracle ${\mathcal{O}}_{Sign}$. Subsequently, $\mathcal{C}$ submits $(g,u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},\frac{{\sigma }_2}{{\tilde{\sigma }}_2},g^c,\frac{{\sigma }_1}{{\tilde{\sigma }}_1})$ to the oracle ${\mathcal{O}}_{DBDH}$. If ${\mathcal{O}}_{DBDH}$ outputs one, then $\mathcal{C}$ sends one to $\mathcal{A}$; otherwise, $\mathcal{C}$ sends zero to $\mathcal{A}$.

  Correctness: If $\sigma =({\sigma }_1,{\sigma }_2)$ is a valid signature for message m, then σ must satisfy the following signature verification equation:

  $${\sigma }_1=e{(g^a,g^b)}^{c}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_2)}^c.$$

  Another valid signature $\tilde{\sigma }=({\tilde{\sigma }}_1,{\tilde{\sigma }}_2)$ calculated by $\mathcal{C}$ must also satisfy the following verification equation:

  $${\tilde{\sigma }}_1=e{(g^a,g^b)}^{c}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\tilde{\sigma }}_2)}^c.$$

  Thus, we can obtain:

  $$\begin{array}{cc}\hfill \frac{{\sigma }_1}{{\tilde{\sigma }}_1}& =\frac{e{(g^a,g^b)}^{c}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_2)}^c}{e{(g^a,g^b)}^{c}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\tilde{\sigma }}_2)}^c}\hfill \\ & =e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},\frac{{\sigma }_2}{{\tilde{\sigma }}_2})}^c.\hfill \end{array}$$

  The above equation demonstrates that $(g$, $u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i}$, $\frac{{\sigma }_2}{{\tilde{\sigma }}_2},g^c,\frac{{\sigma }_1}{{\tilde{\sigma }}_1})$ is a correct BDH tuple.

  (2)

  If $F(m)=0(mod p)$, $\mathcal{C}$ makes a query to the oracle ${\mathcal{O}}_{DBDH}$ with input $(g,g^a,g^b,g^c$, $\frac{{\sigma }_1}{e{(g^c,{\sigma }_2)}^{J(m)}})$. If ${\mathcal{O}}_{DBDH}$ returns one, then $\mathcal{C}$ sends one to $\mathcal{A}$; else, $\mathcal{C}$ sends zero to $\mathcal{A}$.

  Correctness: Assuming that $\sigma =({\sigma }_1,{\sigma }_2)$ is a valid signature, the following equation holds:

  $$\begin{array}{cc}\hfill {\sigma }_1& =e{(g^a,g^b)}^{c}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_2)}^c\hfill \\ & =e{(g^a,g^b)}^{c}e{({(g^b)}^{F(m)}{g}^{J(m)},{\sigma }_2)}^c\hfill \\ & =e{(g^a,g^b)}^{c}e{(g^{J(m)},{\sigma }_2)}^c\hfill \\ & =e{(g^a,g^b)}^{c}e{(g^c,{\sigma }_2)}^{J(m)}.\hfill \end{array}$$

  Hence, we can obtain:

  $$e{(g,g)}^{abc}=\frac{{\sigma }_1}{e{(g^c,{\sigma }_2)}^{J(m)}}.$$

  This shows that $(g,g^a,g^b,g^c,\frac{{\sigma }_1}{e{(g^c,{\sigma }_2)}^{J(m)}})$ is a valid BDH tuple.

• $\mathbf{Forgery}$: $\mathcal{A}$ produces a message/signature pair $(m^{*}$, ${\sigma }^{*})=(m^{*},({\sigma }_1^{*},{\sigma }_2^{*}))$, where $m^{*}$ has never been submitted to ${\mathcal{O}}_{Sign}$ and ${\mathcal{O}}_{Sim}$. If $F(m^{*})\ne 0(mod p)$, then $\mathcal{C}$ terminates the simulation. Otherwise, $\mathcal{C}$ can successfully obtain a solution for the given CDHinstance by calculating:

  $$e{(g,g)}^{abc}=\frac{{\sigma }_1^{*}}{e{(g^c,{\sigma }_2^{*})}^{J(m^{*})}}.$$

We now analyze the probability that $\mathcal{C}$ can successfully solve the GBDH instance. If $\mathcal{C}$ completes the entire simulation without aborting, then the following events must occur.

• $A_1$: All signature, simulation and verification queries on any message $m_j$ satisfy $F(m_j)\ne 0(mod l_m)$.
• $A_2$: $F(m^{*})=0(mod p)$.

As $F(m)=v_0-l_m{k}_m+{\displaystyle \sum _{i=1}^n}{v}_i{m}_i$ and $n+1$ random elements $v_0,v_1,\dots ,v_n\in Z_{l_m}\in Z_p$, $F(m)=0(mod p)$ implies that $F(m)=0(mod l_m)$. In contrast, $F(m)\ne 0(mod l_m)$ implies that $F(m)\ne 0(mod p)$. The probability of $\mathcal{C}$ completing the entire simulation is $Pr[A_1\cap A_2]$. Since $Pr[F(m^{*})=0(mod l_m)]=\frac{1}{l_m}$ and $l_m(n+1)<p$, we have:

$$\begin{array}{cc}\hfill Pr[A_2]& =Pr[F(m^{*})=0(mod l_m)\cap F(m^{*})=0(mod p)]\hfill \\ & \ge \frac{1}{l_m}\frac{1}{n+1}.\hfill \end{array}$$

Since two events $A_1$ and $A_2$ are independent, we have:

$$\begin{array}{cc}\hfill Pr[A_1|A_2]& =Pr[A_1]\hfill \\ & =Pr[{\displaystyle \bigcap _{j=1}^{q_S+q_{Sim}+q_V}}F(m_j)\ne 0(mod l_m)]\hfill \\ & =1-\frac{q_S+q_{Sim}+q_V}{l_m}\hfill \\ & =1-\frac{q_S+q_{Sim}+q_V}{2(q_S+q_{Sim}+q_V)}\hfill \\ & =\frac{1}{2}.\hfill \end{array}$$

Furthermore, we conclude that:

$$\begin{array}{cc}\hfill Pr[A_1\cap A_2]& =Pr[A_2]·Pr[A_1|A_2]\hfill \\ & \ge \frac{1}{l_m}·\frac{1}{n+1}·\frac{1}{2}\hfill \\ & =\frac{1}{2(q_S+q_{Sim}+q_V)}·\frac{1}{2(n+1)}\hfill \\ & =\frac{1}{4(n+1)(q_S+q_{Sim}+q_V)}.\hfill \end{array}$$

The probability ${\epsilon }^{{}^{\prime }}$ of $\mathcal{C}$ successfully solving the GBDH problem is at least $\frac{\epsilon }{4(n+1)(q_S+q_{Sim}+q_V)}$. ☐

Theorem 2.

If the DBDH problem is intractable, then our SDVPRS scheme possesses the PSI property.

Proof of Theorem 2.

Let $\mathcal{D}$ be a polynomial-time distinguisher against the PSI property in the proposed SDVPRS scheme. We can construct another algorithm $\mathcal{B}$ that invokes $\mathcal{D}$ to solve the DBDH problem. Upon receiving a DBDH instance $(g,g^a,g^b,g^c,Z)$, where $a,b,c\in Z_p$ and $Z\in G_2$, the task of $\mathcal{B}$ is to determine whether $Z=e{(g,g)}^{abc}$ holds.

• $\mathbf{Setup}$: $\mathcal{B}$ selects $x,y,w_0,w_1,\dots$, $w_n\in Z_p$ at random and sets $u_0=g^{w_0}$ and $u_i=g^{w_i}(1\le i\le n)$. Then, $\mathcal{B}$ assigns the signer $S_0$’s public key $p{k}_{S_0}=(g^a,g^b)$, the signer $S_1$’s public key $p{k}_{S_1}=(g^x,g^y)$ and the public key $p{k}_V=g^c$ of the designated verifier V. $\mathcal{B}$ sets the common secret key between $S_0$ and V as $s{k}_{S_0\leftrightarrow V}=Z$. Additionally, $\mathcal{B}$ sets the common secret key between $S_1$ and V as $s{k}_{S_1\leftrightarrow V}=e{(g^x,g^c)}^y$. Finally, $\mathcal{B}$ sends $(G_1,G_2,p,g,e$, $u_0,u_1,\dots ,u_n,p{k}_{S_0},p{k}_{S_1},p{k}_V)$ to $\mathcal{D}$.
  Given any n-bit message $m=(m_1,\dots ,m_n)$, we define a function $K(m)=w_0+{\displaystyle \sum _{i=1}^n}{w}_i{m}_i$. Thus, we have:

  $$u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i}=g^{K(m)}.$$
• $\mathbf{Phase}\mathbf{1}$: $\mathcal{D}$ adaptively issues queries to the following oracles.

  -

  ${\mathcal{O}}_{Sign}$: Upon receiving an index $d\in \{0,1\}$ and a message m, $\mathcal{B}$ selects $r\in Z_p$ at random and uses the common secret key $s{k}_{S_d\leftrightarrow V}$ to compute:

  $${\sigma }_1=s{k}_{S_d\leftrightarrow V}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},g^c)}^r$$

  and ${\sigma }_2=g^r$. Then, $\mathcal{B}$ sends a signature $\sigma =({\sigma }_1,{\sigma }_2)$ of m to $\mathcal{D}$.

  -

  ${\mathcal{O}}_{Sim}$: This oracle is the same as ${\mathcal{O}}_{Sign}$.

  -

  ${\mathcal{O}}_{Verify}$: When $\mathcal{D}$ issues a verification query on a signature $\sigma =({\sigma }_1,{\sigma }_2)$ of a message m and an index $d\in \{0,1\}$, $\mathcal{B}$ computes $K(m)$ and uses $s{k}_{S_d\leftrightarrow V}$ to check whether the following equation is true:

  $${\sigma }_1=s{k}_{S_d\leftrightarrow V}e{({\sigma }_2,g^c)}^{K(m)}.$$

  If this equation holds, then $\mathcal{B}$ sends one to $\mathcal{D}$; else, $\mathcal{B}$ sends zero to $\mathcal{D}$.

  Correctness: For a signature $\sigma =({\sigma }_1,{\sigma }_2)$ associated with the signer $S_d$ and the verifier V, we have:

  $$\begin{array}{cc}\hfill {\sigma }_1& =s{k}_{S_d\leftrightarrow V}e{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},g^c)}^r\hfill \\ & =s{k}_{S_d\leftrightarrow V}e{(g^{K(m)},g^c)}^r\hfill \\ & =s{k}_{S_d\leftrightarrow V}e{(g^r,g^c)}^{K(m)}\hfill \\ & =s{k}_{S_d\leftrightarrow V}e{({\sigma }_2,g^c)}^{K(m)}.\hfill \end{array}$$

  This shows that $\mathcal{B}$ can correctly verify the legality of the signature submitted by $\mathcal{D}$.

  -

  ${\mathcal{O}}_{ReSign}$: Upon input of a message $m_d$, an index $d\in \{0,1\}$, a signature ${\sigma }_d$ on $m_d$ and an index $d_2\in \{0,1\}$, $\mathcal{B}$ first performs a verification query ${\mathcal{O}}_{Verify}$ with input $(m_d,d,{\sigma }_d)$ to obtain a corresponding decision $dec\in \{0,1\}$. If $dec=0$, then $\mathcal{B}$ returns ⊥; otherwise, $\mathcal{B}$ obtains a signature ${\sigma }_{d_2}$ related to $S_{d_2}$ and V by querying the oracle ${\mathcal{O}}_{Sign}$ with input $(m_d,d_2)$. Then, $\mathcal{B}$ sends ${\sigma }_{d_2}$ to $\mathcal{D}$ as a re-signature on $m_d$.

• $\mathbf{Challenge}$: After receiving a challenge message $m^{*}$ submitted by $\mathcal{D}$, $\mathcal{B}$ first randomly selects a bit $b\in \{0,1\}$ and queries the oracle ${\mathcal{O}}_{Sign}$ on input $(m^{*},b)$ to obtain a corresponding signature ${\sigma }^{*}$ of $m^{*}$. Then, $\mathcal{B}$ sends ${\sigma }^{*}$ to $\mathcal{D}$.
  Note that if $b=0$, then $Z=e{(g,g)}^{abc}$; otherwise, $Z=e{(g^x,g^c)}^y$ is a random element in $G_2$.
• $\mathbf{Phase}\mathbf{2}$: $\mathcal{B}$ handles the subsequent queries submitted by $\mathcal{D}$ as in Phase 1, and $\mathcal{D}$ is not allowed to query ${\mathcal{O}}_{Verify}$ with input $(m^{*},{\sigma }^{*},d)$, where $d\in \{0,1\}$.
• $\mathbf{Guessing}\mathbf{Phase}$: $\mathcal{D}$ eventually produces a guess $b^{{}^{\prime }}\in \{0,1\}$. $\mathcal{B}$ outputs one if $b=b^{{}^{\prime }}$ and zero otherwise.

If $\mathcal{D}$ can correctly guess $b^{{}^{\prime }}$ such that $b=b^{{}^{\prime }}$, then we have:

$$\begin{array}{ccc}\hfill \epsilon & =& |Pr[b=b^{{}^{\prime }}\cap z=e{(g,g)}^{abc}]-Pr[b=b^{{}^{\prime }}\cap z=\hfill \\ & & e{(g^x,g^c)}^y]|\hfill \\ & \le & \frac{1}{2}(|Pr[b=b^{{}^{\prime }}|z=e{(g,g)}^{abc}]-Pr[b=b^{{}^{\prime }}|z=\hfill \\ & & e{(g^x,g^c)}^y]|)\hfill \\ & =& \frac{1}{2}{\epsilon }_{DBDH}.\hfill \end{array}$$

Therefore, $\mathcal{B}$ can successfully solve a DBDH instance with at least $2\epsilon$ probability. ☐

Theorem 3.

If the BDH problem is intractable, then our SDVPRS scheme is non-delegatable for signature verification.

Proof of Theorem 3.

Let $\mathcal{A}$ be a polynomial-time attacker against the property of non-delegatability for signature verification. Given a BDH tuple $(g,g^a,g^b,g^c)\in G_1^4$, we can construct another algorithm $\mathcal{C}$ that utilizes $\mathcal{A}$’s forgery to calculate $Z=e{(g,g)}^{abc}$.

• $\mathbf{Setup}$: $\mathcal{C}$ sets system parameters $sp$, the signer’s public key $p{k}_S=(g^a,g^b)$ and the designated verifier’s public key $p{k}_V=g^c$ in the same way as in the proof of Theorem 1.
• $\mathbf{Queries}$: $\mathcal{C}$ answers $\mathcal{A}$’s signing and simulation queries in the same manner as in the proof of Theorem 1.
• $\mathbf{Forgery}$: Eventually, $\mathcal{A}$ produces a message/signature pair $(m^{*},{\sigma }^{*}=({\sigma }_1^{*},{\sigma }_2^{*}))$. If $F(m^{*})\ne 0(mod p)$, then $\mathcal{C}$ terminates the simulation. Otherwise, $\mathcal{C}$ evaluates $J(m^{*})$ and outputs the BDH value:

  $$e{(g,g)}^{abc}=\frac{{\sigma }_1^{*}}{e{(g^c,{\sigma }_2^{*})}^{J(m^{*})}}.$$

The probabilistic analysis of $\mathcal{C}$ successfully solving the BDH problem is similar to the probability analysis of Theorem 1. ☐

5. Performance Evaluation

This section discusses the performance comparison between our SDVPRS scheme and Wei et al.’s [14] DVPRS scheme with respect to the security model, the size of the secret key, the signature length and the computational overhead. The corresponding comparison results are shown in

Table 1. Comparison of communication overhead. SigSize, signature size; SDVPRS, strong designated-verifier proxy re-signature.

Schemes	KeySize	SigSize	Standard Model
Wei et al.’s scheme [14]	$2\left|p\right|$	$|G_1|$	No
Our SDVPRS scheme	$2\left|p\right|$	$2|G_1|$	Yes

and

Table 2. Comparison of computational overhead.

Schemes	Sign	ReSign	ReVer	Verify
Wei et al.’s scheme [14]	$E+P$	E	E	$E+2P$
Our SDVPRS scheme	$2E+P$	$2E$	$2E$	$E+P$

. We use the PBClibrary to evaluate the time cost of cryptographic operations. We select the curve a.param of Type A in the PBC-0.47-VC library to perform bilinear pairing, and p is a 512-bit prime. The simulated environment is set up on a laptop with the Windows 10 operating system, with an Intel(R) Core(TM) i7-6500 CPU @2.59 GHz and 8 GB of RAM. Since the computational overhead of other cryptographic operations is relatively small, we mainly consider time-consuming exponentiation and bilinear pairing. To simplify the description, let E denote an exponentiation computation that takes 7.46 ms. P represents a bilinear pairing operation, which takes 14.13 ms. $\left|p\right|$ represents the length of an element in $Z_p$, which is 20 bits. $|G_1|$ represents the length of an element in $G_1$, which is 128 bits. In Table 1, KeySize and SigSize are used to represent the size of a secret key and a signature, respectively.

Table 1 presents the comparisons of the communication overhead based on the size of the secret key and signature. In both our SDVPRS scheme and Wei et al.’s scheme [14], the size of the secret key is $2\left|p\right|$ (40 bits). In our SDVPRS scheme, the length of a signature is $2|G_1|$ (256 bits). The length of a signature in Wei et al.’s scheme [14] is $|G_1|$ (128 bits), but this scheme has been proven to be secure in the random oracle model.

Table 2 presents the comparisons between our SDVPRS scheme and Wei et al.’s DVPRS scheme [14] in terms of the computational overheads of the $\mathbf{Sign}$, $\mathbf{ReSign}$, $\mathbf{ReVer}$ and $\mathbf{Verify}$ algorithms. It should be noted that $g^{x_S{y}_S}$ and $e{(g^{x_S},g^{y_S})}^{x_V}$ can be pre-computed in our scheme. To generate a signature, our scheme needs two exponentiations and one bilinear pairing operation (29.05 ms), while Wei et al.’s scheme [14] needs one exponentiation and one bilinear pairing operation (21.59 ms). As for the computation cost of signature conversion, our scheme requires two exponentiations (14.92 ms), while Wei et al.’s scheme [14] requires one exponentiation (7.46 ms). For the signature verification process, our scheme needs one exponentiation and one bilinear pairing operation (21.59 ms), while Wei et al.’s scheme [14] requires one exponentiation and two bilinear pairing operations (35.72 ms).

From the above analysis, we have observed that our scheme is comparable in computational performance to that of Wei et al.’s scheme [14]. However, our SDVPRS scheme provides higher security because the security of our scheme does not depend on ideal random oracles.

6. Application for Environmental Monitoring System

We describe an environmental monitoring data transmission system using our proposed SDVPRS scheme. This system, as shown in Figure 2, consists of three entities: IoT device, a server node and a set of n data centers that store IoT data.

The IoT device A belonging to a group B is mainly responsible for collecting environmental data and generating signatures of these data. Each data center $U_i$ has powerful computing and storage capabilities to store or analyze environmental data sent by IoT devices. For example, data centers receiving environmental data are usually government agencies, universities, research institutes or various types of environmental companies. The server node S acts as a proxy with a certain computing power and communication capabilities. It can convert the signature of IoT device A into the signature of group B, where the IoT device is located, and send the environmental monitoring data and corresponding signature anonymously to a subset of some designated data centers (denoted by $\{U_1,\dots ,U_n\}$). The system consists of four phases: system setup, data acquisition, data transmission and data storage. The environmental monitoring data transmission system is described as follows.

• System setup:
  The system parameters $sp$ = $(G_1,G_2,p,g,e,u_0,u_1,\dots ,u_n)$ are generated by the $\mathbf{Setup}$ algorithm in Section 4. Each entity in the system generates its public/secret key pair $(pk,sk)$ by running the $\mathbf{KeyGen}$ algorithm in Section 4.
  • The IoT device A sets its secret key $s{k}_A=(s{k}_{A,1},s{k}_{A,2})=(x_A,y_A)$ and public key $p{k}_A=(p{k}_{A,1}$, $p{k}_{A,2})=(g^{x_A},g^{y_A})$. Similarly, the group B in which the IoT device A is located sets the secret key $s{k}_B=(s{k}_{B,1},s{k}_{B,2})=(x_B,y_B)$ and public key $p{k}_B=(p{k}_{B,1}$, $p{k}_{B,2})=(g^{x_B},g^{y_B})$.
  • Each data center $U_i$ sets its public/secret key pair $(p{k}_i,s{k}_i)=(g^{x_i},x_i)$, $i=1,\dots ,n$.
  • The server node S runs the $\mathbf{ReSKey}$ algorithm in Section 4 to generate the re-signing key $rs{k}_{A\to B}=\frac{x_B{y}_B}{x_A{y}_A}(mod p)$ between the IoT device A and the group B. The server node S then runs the $\mathbf{ReVKey}$ algorithm in Section 4 to generate the re-designate-verifier key $rv{k}_{1\to i}=\frac{x_i}{x_1}(mod p)$ between the data center $U_1$ and the other data center $U_i(i=2,\dots ,n)$.
• Data acquisition:
  The IoT device A that assembles the sensor(s) collects environmental monitoring data $m=(m_1,\dots m_n)\in {\{0,1\}}^n$ (e.g., atmosphere, water, soil, plants, etc.). Then, A randomly selects $r\in Z_p$ and calculates ${\sigma }_{A1,2}=g^r$ and ${\sigma }_{A1,1}=e(g^{x_A{y}_A}{(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i})}^r,g^{x_1})$, where $g^{x_1}$ is the public key of the data center $U_1$. Finally, A sends m and the corresponding signature ${\sigma }_{A1}=({\sigma }_{A1,1},{\sigma }_{A1,2})$ to the server node S.
• Data transmission:
  After receiving the message m and signature ${\sigma }_{A1}=({\sigma }_{A1,1},{\sigma }_{A1,2})$ sent by A, the server node S performs the following steps.
  • S calculates the signature ${\sigma }_{B1}=({\sigma }_{B1,1},{\sigma }_{B1,2})=({({\sigma }_{A1,1})}^{rs{k}_{A\to B}},{({\sigma }_{A1,2})}^{rs{k}_{A\to B}})$ using the re-signature key $rs{k}_{A\to B}$. That is, the server node S converts the signature ${\sigma }_{A1}$ of the IoT device into the signature ${\sigma }_{B1}$ on m of the group B.
  • S uses the re-designate-verifier key $rv{k}_{1\to i}$ to convert the signature ${\sigma }_{B1}=({\sigma }_{B1,1},{\sigma }_{B1,2})$ to ${\sigma }_{Bi}=({\sigma }_{Bi,1},{\sigma }_{Bi,2})$, where ${\sigma }_{Bi,1}={({\sigma }_{B1,1})}^{rv{k}_{1\to i}}$ and ${\sigma }_{Bi,2}={({\sigma }_{B1,2})}^{rv{k}_{1\to i}}$ for $i=2,\dots ,n$.
  • S sends m and the corresponding signature ${\sigma }_{Bi}$ to the designated data center $U_i$, $i=1,\dots ,n$.
• Data storage:
  After receiving the environmental monitoring data $m=(m_1,\dots m_n)\in {\{0,1\}}^n$ and the corresponding signature ${\sigma }_{Bi}=({\sigma }_{Bi,1},{\sigma }_{Bi,2})$, each data center $U_i(1\le i\le n)$ uses its own private key $s{k}_i=x_i$ and the public key $p{k}_B=(g^{x_B},g^{y_B})$ of group B to check whether the following equation holds:

  $$\begin{array}{c}\begin{array}{c}\hfill {\sigma }_{Bi,1}=e{(g^{x_B},g^{y_B})}^{x_i}e(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_{Bi,2}{)}^{x_i}.\end{array}\end{array}$$
  If the above equation does not hold, it means that m is not authentic environmental monitoring data, and $U_i$ aborts and stops. Otherwise, m is securely stored by the data center $U_i$ so that other authorized users can access and analyze the collected environmental data.

In the above system, only the data center $U_i$ can verify the validity of the signature ${\sigma }_{Bi}$ on the environmental monitoring data m. The server node S converts the signature of the IoT device A into the signature of the group B, so that each data center $U_i$ cannot infer the true identity of the IoT device from the received signature. Therefore, our system can verify the authenticity and integrity of environmental monitoring data, while protecting the identity privacy of IoT devices.

Here, we experimentally evaluate the performance of the proposed system. The experimental environment is the same as the simulation environment in Section 5. In the data acquisition phase, the following values can be precomputed:

$$Z_1=g^{x_A{y}_A},Z_2=g^r,T_0=u_0^r,T_i=u_i^r,i=1,\dots ,n.$$

For environmental monitoring data $m=(m_1,\dots m_n)\in {\{0,1\}}^n$, IoT device A generates a signature ${\sigma }_{A1}=({\sigma }_{A1,1},{\sigma }_{A1,2})$ on m as:

$${\sigma }_{A1}=(e(Z_1·T_0·{\displaystyle \prod _{i=1}^n}{T}_i^{m_i},p{k}_1),Z_2),$$

where $p{k}_1=g^{x_1}$ is the public key of data center $U_1$. Figure 3 shows that when the length of the data is 100 bits, 300 bits, 500 bits, 700 bits and 900 bits, the time overhead of the IoT device is up to 20 ms, 27 ms, 35 ms, 42 ms and 50 ms, respectively.

In the data transmission phase, the server node needs two exponentiations to convert the signature ${\sigma }_{A1}$ of the IoT device into the signature ${\sigma }_{B1}$ of its group. In addition, the server node needs two exponentiations to change the data center $U_1$ in ${\sigma }_{B1}$ to the data center $U_i$. Figure 4 shows that when the total number of data centers is 2, 4, 6, 8 and 10, the computational overhead required by the server node is approximately 29 ms, 60 ms, 92 ms, 125 ms and 156 ms, respectively.

For the data storage phase, the signature verification equation of the data is:

$$\begin{array}{c}\begin{array}{c}\hfill {\sigma }_{Bi,1}=e{(g^{x_B},g^{y_B})}^{x_i}e(u_0{\displaystyle \prod _{i=1}^n}{u}_i^{m_i},{\sigma }_{Bi,2}{)}^{x_i},\end{array}\end{array}$$

where $e{(g^{x_B},g^{x_B})}^{x_i}$ can be pre-computed. When the length of the data is 100 bits, 300 bits, 500 bits, 700 bits and 900 bits, the time overhead required for each data center is as shown in Figure 5. Because the server nodes and data centers have strong computing power, our proposal has practical application.

7. Conclusions

Data authenticity and identity privacy are still critical issues for IoT devices. To secure IoT devices, a new SDVPRS technique applied to the IoT environment is presented in this paper. First, we present the security concepts of SDVPRS, and then, we propose the first construction of an SDVPRS scheme without random oracles. Furthermore, we prove that the proposed scheme is secure in the standard model based on the BDH, GBDH and DBDH problems. The security proofs demonstrate that our SDVPRS scheme can protect the identity privacy of IoT devices while ensuring the authenticity and integrity of IoT data. Our SDVPRS scheme is very useful for IoT-based data transmission systems.