An Efficient Certificate-Based Linearly Homomorphic Signature Scheme for Secure Network Coding

Abstract

With the development of mobile crowdsensing systems (MCSs), wireless network transmission efficiency has attracted widespread attention. Network coding can be used in wireless communication to improve network throughput and robustness, which allows intermediate nodes to perform arbitrary coding operations on data packets. However, the data packet in network coding systems is vulnerable to pollution attacks. The special operation of intermediate nodes makes some security protocols in traditional store-and-forward networks unavailable in network coding systems. To address this problem, an efficient certificate-based linearly homomorphic signature scheme against pollution attacks in network coding systems is presented. A novel homomorphic contraction mapping technique is introduced to reduce the computational cost of signature generation. In the proposed scheme, the computational cost of both signature generation and verification is independent of the data packet size. Furthermore, a construction is provided to simultaneously defend against both eavesdropping attacks and pollution attacks in unicast networks. The security of the certificate-based linearly homomorphic signature scheme is formally proved in the random oracle model (ROM), and the scheme is implemented using the Java Pairing-Based Cryptography (JPBC) library. Simulation results demonstrate that the scheme is efficient and practical for real-world deployments in public environments without requiring secure channels.

1. Introduction

With the rapid development of network technologies, the communication industry is evolving towards a mobile information era. Mobile crowdsensing systems (MCSs) have become indispensable in various applications, such as environmental monitoring, smart cities, and e-health. However, network throughput and stability remain significant bottlenecks restricting the application of mobile devices.

Network coding offers a solution by maximizing throughput and improving network stability [1]. Unlike traditional store-and-forward mechanisms, network coding allows intermediate nodes to perform arbitrary coding operations on data packets. This design significantly enhances robustness; even if parts of the network (e.g., nodes or links) fail, the destination node retains a high probability of message recovery, provided a sufficient number of correct data packets are received. Consequently, network coding has proven to be a powerful strategy for wireless communication systems.

In typical MCS environments, data packets are vulnerable to modification during transmission. A single uncorrected packet can spread rapidly through the network via forwarding, causing so-called “pollution attacks”. If the destination node fails to receive enough valid packets, the original message cannot be retrieved, resulting in wasted network resources and reduced performance. Addressing pollution attacks is therefore a critical issue. While digital signatures are an effective solution for data integrity in traditional store-and-forward networks, they cannot be directly applied to network coding. This is because intermediate nodes must modify packets without possessing the signing key, rendering the original “authentication code” invalid for the encoded packet.

Various solutions have been proposed to mitigate pollution attacks, including network error correction [2,3,4], homomorphic MACs [5,6,7], and homomorphic signatures [8,9,10,11,12]. Among these, linearly homomorphic signatures (LHSs) are particularly suitable. An LHS allows an intermediate node to verify the authenticity of received packets, discard corrupted ones, and combine valid packets from the same source into a new signed packet. This enables both hop-by-hop and end-to-end error detection.

Numerous LHS schemes have been proposed, but most rely on traditional Public Key Infrastructure (PKI), which imposes a heavy certificate management burden [13,14,15]. Furthermore, PKI security relies on Certificate Authorities (CAs), whose trustworthiness is difficult to guarantee. To address this, Identity-Based Cryptography (IBC) schemes have been proposed [16,17,18]. However, IBC suffers from key escrow, as the Private Key Generator (PKG) generates all user keys, restricting these schemes to small, closed settings. While Certificateless Cryptography (CLC) eliminates key escrow [19,20,21], it introduces a new challenge: the requirement for an expensive secure channel to transmit partial private keys. To overcome these limitations, this work utilizes Certificate-Based Cryptography (CBC), introduced in [22], to construct an efficient LHS scheme.

This work presents a certificate-based linearly homomorphic signature (CB-LHS) scheme for network coding. An improved homomorphic hash function based on the construction in [8] is developed, which significantly reduces the computational cost of signature generation and makes the scheme particularly suitable for resource-constrained mobile devices. In addition, the scheme supports pre-encryption using a secure symmetric cipher to simultaneously defend against both eavesdropping and pollution attacks. The security of the scheme is formally proved in the random oracle model, and theoretical analysis shows that the proposed approach improves transmission efficiency without affecting network throughput. Furthermore, simulation results confirm that the scheme achieves significantly lower computational costs compared with existing methods.

2. Related Work

The conceptual foundation of homomorphic signatures (HSs) originated with Desmedt [23], followed by the establishment of a formal framework by Johnson et al. [24]. Over the years, the field has diversified into various constructions, ranging from polynomial [25,26] and fully homomorphic schemes [27] to homomorphic aggregate signatures [28]. Among these, linearly homomorphic signatures (LHSs) have emerged as a critical primitive for distributed systems, finding extensive application in network coding and cloud data auditing.

Following the seminal definition and security model for LHSs introduced by Boneh et al. [8], whose initial construction incurred verification costs proportional to vector size, subsequent research has rigorously focused on mitigating computational overheads. For instance, Gennaro et al. [29] utilized the RSA assumption to reduce complexity via small integer coefficients. Advancing the security model further, Attrapadung et al. [30] introduced the first LHS secure under the standard model with constant signature size, later enhancing this design to support complete content hiding [31]. In the context of IBC, Li et al. [17] achieved a significant milestone by decoupling the signature cost from the vector dimension.

Parallel to these efficiency improvements, the emergence of quantum computing has necessitated a shift from traditional assumptions toward lattice-based cryptography. Boneh et al. [32] pioneered this transition with the first lattice-based LHS. Building upon this to address key escrow issues, Dong et al. [33] proposed a certificateless LHS based on lattices. This trend towards certificateless environments is further supported by recent work [34], which developed a secure and efficient certificateless scheme specifically optimized for network coding. Concurrently, addressing the resource constraints of modern edge devices, [35] introduced an LHS scheme with high signature efficiency tailored for IoT applications, demonstrating the practical scalability of these primitives.

Beyond foundational security and efficiency, other works have sought to expand the functional granularity of these schemes. Inspired by Rivest’s open problem, Lin et al. developed schemes involving designated entities, initially restricting operations to a designated combiner [36] and later enabling public verification [37]. In a similar vein, Fuchsbauer et al. [38] employed equivalence classes to enable randomization in structure-preserving signatures. Expanding on this concept, Li et al. [39] introduced a structure-preserving LHS with a designated combiner, providing a flexible theoretical basis for secure subspace aggregation.

To clarify the position of our work, we compare our proposed scheme with several representative state-of-the-art constructions in Table 1.

Table 1. Comparison with state-of-the-art schemes in network coding.

Scheme	Infrastructure	Key Escrow	Efficiency	Secure Channel	Constant Size
Boneh et al. [8]	PKI	No	Low	No	No
Li et al [39]	PKI	No	Low	No	No
Li et al. [17]	IBC	Yes	High	Yes	Yes
Dong et al. [33]	CLC	No	Low	Yes	No
Huang et al. [34]	CLC	No	High	Yes	Yes
Ours	CBC	No	High	No	Yes

3. Preliminaries and Definitions

This section establishes the mathematical foundations necessary for our construction, followed by a formal definition of the proposed scheme. Finally, we delineate the security model and the specific adversarial assumptions under which the scheme operates.

3.1. Mathematical Background

Definition 1.

Let ${\mathbb{G}}_1$, ${\mathbb{G}}_2$, and ${\mathbb{G}}_T$ be cyclic groups of the same large prime order q. A function $e:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$ is said to be a bilinear pairing if it satisfies the following conditions:

1. 

Bilinearity: For all $a,b\in {\mathbb{Z}}_q$ and any $g_1\in {\mathbb{G}}_1$, $g_2\in {\mathbb{G}}_2$, it holds that

$$e(g_1^a,g_2^b)=e{(g_1,g_2)}^{ab}.$$

2. 

Non-degeneracy: If $g_1$ and $g_2$ are generators of ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$, respectively, then $e(g_1,g_2)$ generates ${\mathbb{G}}_T$.

3. 

Computability: The pairing value $e(g_1,g_2)$ can be computed in polynomial time for any $g_1\in {\mathbb{G}}_1$ and $g_2\in {\mathbb{G}}_2$.

• k-Collusion Attack Algorithm Problem (k-CAA) [40]. Suppose ${\mathbb{G}}_1,{\mathbb{G}}_2$ are two cyclic groups with sizeable prime order q and $x,h_1,\cdots ,h_k\in {{\mathbb{Z}}_q}^{*}$ are $k+1$ integers. Given $g_1\in {\mathbb{G}}_1,{g_2}^x\in {\mathbb{G}}_2$, and k pairs $(h_1,{g_1}^{{\displaystyle \frac{1}{x+h_1}}}),\cdots ,(h_k,{g_1}^{{\displaystyle \frac{1}{x+h_k}}})$, output a new pair $(h^{*},{g_1}^{{\displaystyle \frac{1}{x+h^{*}}}})$ for some $h^{*}\notin \{h_1,\cdots ,h_k\}$.
• k-CAA Assumption. The k-CAA assumption holds in $({\mathbb{G}}_1,{\mathbb{G}}_2)$ provided that no probabilistic polynomial-time algorithm exists that can break the k-CAA problem in these groups with a non-negligible advantage.
• Modified k-CAA Problem. Suppose ${\mathbb{G}}_1,{\mathbb{G}}_2$ are two cyclic groups with sizeable prime order q and $x,a,b,h_1,\cdots ,h_k\in {{\mathbb{Z}}_q}^{*}$ are $k+3$ integers. Given $g_1,{g_1}^b\in {\mathbb{G}}_1$, ${g_2}^x,{g_2}^a\in {\mathbb{G}}_2$, and k pairs $(h_1,{g_1}^{{\displaystyle \frac{ab}{x+h_1}}}),\cdots ,(h_k,{g_1}^{{\displaystyle \frac{ab}{x+h_k}}})$, output ${g_1}^{ab}$ or a new pair $(h^{*},{g_1}^{{\displaystyle \frac{ab}{x+h^{*}}}})$ for some $h^{*}\notin \{h_1,\cdots ,h_k\}$.
• Modified k-CAA Assumption. The modified k-CAA assumption holds in $({\mathbb{G}}_1,{\mathbb{G}}_2)$ provided that every probabilistic polynomial-time algorithm can solve the modified k-CAA problem only with negligible probability.

3.2. The Formal Definition of the Certificated-Based Linearly Homomorphic Signature Scheme

A certificate-based linearly homomorphic signature (CB-LHS) scheme consists of the following seven polynomial-time algorithms, and the details are given below.

• Setup$\left(1^{\lambda }\right)\to \left(pp,msk\right)$. On inputting a security parameter $1^{\lambda }$, the certifier outputs the public parameters $pp$ and the system master private key $msk$.
• UserKeyGen$\left(pp,ID\right)\to \left(usk,upk\right)$. On inputting the public parameters $pp$ and a user identity $ID$, the user outputs a private key $usk$ and the corresponding public key $upk$.
• Certify$\left(pp,msk,ID,upk\right)\to Cert$. On inputting the public parameters $pp$, the system master private key $msk$, a user identity $ID$, and its public key $upk$, the certifier outputs the certificate $Cert$ for user with identity $ID$.
• TagGen$\left(pp,ID,usk,Cert,vid\right)\to \tau$. The signer runs the algorithm. The algorithm takes the system public parameters $pp$, a user identity $ID$, the user’s private key $usk$, the user’s certificate $Cert$, and the identifier $vid$ of a subspace V as input. The algorithm outputs a tag $\tau$ for the subspace V.
• Sign$\left(pp,ID,usk,\tau ,\mathbf{m}\right)\to \sigma$. Executed by the signer, this algorithm takes as input the public parameters $pp$, the user’s identity $ID$ and private key $usk$, a tag $\tau$ corresponding to an encrypted subspace V, and an encrypted vector $\mathbf{m}\in V$. It produces a signature $\sigma$.
  Note. To generate signatures for an entire subspace V, the signer first produces a tag $\tau$ associated with V and then signs a collection of basis vectors ${\mathbf{m}}_1,\dots ,{\mathbf{m}}_m\in V$. Given these signatures, a valid signature on any other vector in V with respect to the same tag $\tau$ can be efficiently derived using the Combine algorithm.
• Combine$\left(pp,ID,vid,\tau ,{\left\{c_i,{\mathbf{m}}_i,{\sigma }_i\right\}}_{i=1}^m\right)\to (\widehat{\mathbf{m}},\widehat{\sigma })$. This algorithm accepts the public parameters $pp$, identity $ID$, subspace identifier $vid$, and tag $\tau$. It also takes a set ${\left\{c_i,{\mathbf{m}}_i,{\sigma }_i\right\}}_{i=1}^m$, where $c_i\in {\mathbb{F}}_q$ is a coefficient, ${\mathbf{m}}_i\in V$, and ${\sigma }_i$ is the signature on ${\mathbf{m}}_i$. It outputs a combined vector/signature pair $(\widehat{\mathbf{m}},\widehat{\sigma })$ such that $\widehat{\mathbf{m}}={\sum }_{i=1}^m{c}_i{\mathbf{m}}_i$.
• Verify$\left(pp,ID,upk,Cert,vid,\tau ,\widehat{\mathbf{m}},\widehat{\sigma }\right)\to \{0,1\}$. The verifier runs this algorithm. It inputs the public parameters $pp$, identity $ID$, public key $upk$, certificate $Cert$, subspace identifier $vid$, and tag $\tau$. It also takes the vector $\widehat{\mathbf{m}}\in V$ and its signature $\widehat{\sigma }$. The output is binary: 1 for accept or 0 for reject.

A CB-LHS scheme is considered correct if, for any $(pp,msk)$ generated by Setup, it satisfies these properties:

1.

For any user $ID$, a certificate $Cert$ generated by $\mathbf{Certify}$ for a key pair $(usk,upk)$ from $\mathbf{UserKeyGen}$ must be valid upon verification.

2.

Given a valid tag $\tau \leftarrow$TagGen and signature $\sigma \leftarrow$Sign for a vector $\mathbf{m}\in V$, the verification Verify$(pp,ID,upk,Cert,vid,\tau ,\mathbf{m},\sigma )$ must hold with probability 1. Conversely, the probability that an invalid signature passes verification must be negligible.

3.

Let $(\widehat{\mathbf{m}},\widehat{\sigma })$ be the output of $\mathbf{Combine}(pp,ID,vid,\tau ,{\left\{c_i,{\mathbf{m}}_i,{\sigma }_i\right\}}_{i=1}^m)$ using arbitrary scalars $\left\{c_i\right\}$ and valid vector/signature pairs $({\mathbf{m}}_i,{\sigma }_i)$. The verification Verify$(pp,ID,upk,vid,\tau ,\widehat{\mathbf{m}},\widehat{\sigma })$ must succeed with probability 1. Any other combined pair should pass verification with only a negligible probability.

3.3. Security Model

We define two distinct types of probabilistic polynomial-time (PPT) adversaries. A Type I adversary represents an external attacker who is able to replace a user’s public key yet has no access to the certificate of the challenged user. In contrast, a Type II adversary corresponds to a dishonest certifying authority that possesses the system master secret key but is prohibited from modifying the target user’s public key. Both adversaries have access to a set of oracles, with the specific access rules for each type detailed in the definitions of Game 1 and Game 2.

• User-Key-Gen Oracle. Upon receiving a user identity $ID$ from the adversary, this oracle executes the $\mathbf{UserKeyGen}$ algorithm to generate a public/private key pair $(upk,usk)$ and returns this pair to the adversary.
• Corruption Oracle. This oracle takes a user identity $ID$ as input. If this $ID$ was previously submitted to the User-Key-Gen oracle, the oracle returns the corresponding private key $usk$. If not, the oracle returns nothing.
• Certification Oracle. When the adversary provides a user identity $ID$ and a public key $upk$, this oracle executes the $\mathbf{Certify}$ algorithm. The resulting certificate, $Cert$, is then returned to the adversary.
• Key-Replace Oracle. The adversary can submit a user identity $ID$ along with a new key pair $(up{k}^{\prime },us{k}^{\prime })$ to this oracle. The oracle’s function is to store this new key pair, associating it with $ID$.
• Subspace-Signature Oracle. This oracle takes multiple inputs: a user $ID$, their private key $usk$ (corresponding to the current $upk$), their certificate $Cert$, a subspace V, and its identifier $vid$. It then computes and returns the subspace tag $\tau$ for V, along with signatures $({\sigma }_1,\cdots ,{\sigma }_n)$ for a set of basis vectors $({\mathbf{m}}_1,\cdots ,{\mathbf{m}}_n)$ within V.

Game 1. Game 1 between the Type I adversary ${\mathcal{A}}_I$ and the challenger $\mathcal{C}$ is as follows.

Initialization. Given a security parameter $1^{\lambda }$, the challenger executes the Setup$\left(1^{\lambda }\right)$ algorithm to obtain the public parameters $pp$, which are then provided to ${\mathcal{A}}_I$.

Query. The adversary ${\mathcal{A}}_I$ may adaptively issue queries to the following oracles: User-Key-Gen, Corruption, Certification, Key-Replace, and Subspace-Signature.

Forgery. The adversary ${\mathcal{A}}_I$ produces a tuple $({ID}^{*},{upk}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})$. The adversary wins the game if all of the following conditions are met:

(1)

The verification Verify$(pp,I{D}^{*},up{k}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})$ returns 1 (accept).

(2)

No query was ever made to the Certification oracle for the identity ${ID}^{*}$.

(3)

The adversary ${\mathcal{A}}_I$ did not issue a Subspace-Signature query for $V^{*}$, where ${\mathbf{m}}^{*}\in V^{*}$.

(4)

The adversary ${\mathcal{A}}_I$ did query the Subspace-Signature oracle for $V^{*}$; it must have been with a tag $\tau$ such that $\tau \ne {\tau }^{*}$.

The advantage of the adversary ${\mathcal{A}}_I$ in Game 1 is defined as

$$Ad{v}_{{\mathcal{A}}_I}=Pr\left[{\mathcal{A}}_I\mathrm{wins}\right].$$

Definition 2.

A CB-LHS scheme is said to be secure against a Type I adversary ${\mathcal{A}}_I$ under adaptive chosen-subspace and adaptive chosen-identity attacks if any probabilistic polynomial-time adversary ${\mathcal{A}}_I$ can win Game 1 only with negligible probability.

Game 2. The interaction between a Type II adversary ${\mathcal{A}}_{II}$ and the challenger $\mathcal{C}$ is defined as follows.

Initialization. Given the security parameter $1^{\lambda }$, the challenger executes the Setup$\left(1^{\lambda }\right)$ algorithm to generate the public parameters $pp$ and the system master secret key $msk$, both of which are provided to ${\mathcal{A}}_{II}$.

Query. The adversary ${\mathcal{A}}_{II}$ may adaptively query the following oracles: User-Key-Gen, Corruption, and Subspace-Signature.

Forgery. The adversary ${\mathcal{A}}_{II}$ outputs a tuple $({ID}^{*},{upk}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})$. ${\mathcal{A}}_{II}$ wins the game if this tuple satisfies all four of the following conditions:

(1)

The signature ${\sigma }^{*}$ is valid for ${\mathbf{m}}^{*}$; i.e., Verify$(pp,I{D}^{*},up{k}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})$ returns 1.

(2)

The private key for ${ID}^{*}$ was never revealed via the Corruption oracle.

(3)

The adversary ${\mathcal{A}}_{II}$ has not requested signatures for the subspace $V^{*}$ (where ${\mathbf{m}}^{*}\in V^{*}$).

(4)

The adversary ${\mathcal{A}}_{II}$ did query for signatures on $V^{*}$ with the tag $\tau$, where $\tau \ne {\tau }^{*}$.

We define the advantage of an adversary ${\mathcal{A}}_{II}$ in winning Game 2 as $Ad{v}_{{\mathcal{A}}_{II}}$ = Pr$\left[{\mathcal{A}}_{II}wins\right]$.

Definition 3.

A CB-LHS scheme is secure against Type II adversary ${\mathcal{A}}_{II}$ under adaptive chosen-subspace and adaptive chosen-identity attacks if no polynomial ${\mathcal{A}}_{II}$ wins Game 2 with a non-negligible advantage.

4. Our Construction

4.1. Overview

Preventing pollution attacks in network coding requires each packet to be embedded with verifiable information. The mobile device processes collected data by splitting it into m data vectors. The i-th vector, ${\mathbf{v}}_i$, is an augmented vector structured as ${\mathbf{v}}_i=(v_{i1},\cdots ,v_{in},v_{i(n+1)},\cdots ,v_{i(n+m)})$. This augmentation combines the n-item data vector (left part) with the m-item global coefficient vector (right part). Figure 1 depicts the communication flow between the two entities (mobile device and server) utilizing network coding and a linearly homomorphic signature. The steps of this process are detailed as follows.

Figure 1. System model.

During the system initialization phase, the server, acting as the system manager, generates and disseminates public parameters. Before collecting data, a mobile device must request access to join the system. This involves the node submitting its public key (a unique identifier) to the server, which then issues a certificate upon receiving the access requirement, thereby legalizing the node as a system user. Prior to sending data, the mobile device must sign the vector ${\mathbf{v}}_i$ as per the signature generation phase and package the vector and its signature into a data packet (see Figure 1). These packets are sent to neighboring nodes. Intermediate nodes must first verify the integrity of all received packets. A packet is deemed uncorrupted if its vector and signature pass the verification detailed in Section 4.5. All uncorrupted packets are then encoded by the intermediate node, which also generates a new signature for the combined packet following the Combine algorithm in Section 4.5. This merged packet is then forwarded. Finally, the destination node, upon accumulating sufficient uncorrupted packets, recovers the original data using the decoding rule from Section 4.6.

The following section delineates the algorithms underlying the proposed scheme in meticulous detail.

4.2. System Initialization: Setup

In the system initialization phase, the server defines a positive integer N based on the maximum transmission unit (MTU). The purpose of N is to set the upper limit for the augmented vector’s dimension. The server then runs the Setup algorithm, publishes the system public parameters $pp$, and keeps the system master key $msk$ secret. The specific process is as follows. Taking a security parameter $1^{\lambda }$, which determines the size of q as input, the server performs the following steps.

1.

Choose two cyclic groups ${\mathbb{G}}_1=<g_1>,{\mathbb{G}}_2=<g_2>$ with prime order q and a symmetric bilinear map $e:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$.

2.

Pick an integer $s\in {{\mathbb{Z}}_q}^{*}$ and set $pk={g_2}^s$.

3.

Choose four collision-resistant hash functions such as $H_1:{\left\{0,1\right\}}^{*}\times {\mathbb{G}}_2\to {\mathbb{G}}_1$, $H_2:{\left\{0,1\right\}}^{*}\times {\left\{0,1\right\}}^{*}\times {\mathbb{G}}_1\to {{\mathbb{Z}}_q}^{*}$, and $H_3:{\left\{0,1\right\}}^{*}\times {{\mathbb{Z}}_n}^{*}\times {\mathbb{G}}_1\to {{\mathbb{Z}}_q}^{*}$.

4.

Set system public parameters $pp=\left(q,{\mathbb{G}}_1,{\mathbb{G}}_2,e,g_1,g_2,pk,H_1,H_2,H_3\right)$ and system master key $msk=s$.

4.3. User Registration: UserKeyGen and Certify

The mobile devices must join the MCS system before assisting the server in collecting data. The specifics are as follows.

UserKeyGen. Given the public parameters $pp$ and an identity $ID$, the user selects a random value $x\in {\mathbb{Z}}_q^{*}$ as the private key $usk$ and computes the corresponding public key $upk=g_2^x$. The pair $(ID,upk)$ is then submitted to the certifier.

Certify. On inputting the public parameters $pp$, the system master secret key $msk$, a user identity $ID$, and a public key $upk$, the certifier generates the certificate

$$Cert=H_1{(ID,upk)}^s$$

and returns it to the user associated with identity $ID$. Upon receiving the certificate, the user verifies its correctness by checking whether

$$e(Cert,g_2)=e(H_1(ID,upk),pk).$$

If the above equation holds, the certificate is accepted and the user is granted access to the system.

4.4. Data Process: TagGen and Sign

TagGen. Given the public parameters $pp$, an identity $ID$, the user’s private key $usk$, the corresponding certificate $Cert$, and a subspace identifier $vid$ for V, the sender chooses a random value $\alpha \in {\mathbb{Z}}_q^{*}$ and computes $\beta =g_2^{\alpha }$. The sender then derives

$${\tau }_0=Cer{t}^{{\displaystyle \frac{1}{usk+H_2(ID,vid,\beta )}}}$$

and defines the tag of subspace V as $\tau =({\tau }_0,\beta )$.

Sign. On inputting the public parameters $pp$, an identity $ID$, the private key $usk$, and a vector ${\mathbf{m}}_k=(m_{k1},\cdots ,m_{kn})\in V$ for $k\in [1,m]$, the sender computes the signature

$$\sigma ={\left(g_1^{{\sum }_{j=1}^n{H}_3(ID,j,{\tau }_0)·m_j}\right)}^{\alpha }.$$

Note that $\tau$ is the tag of the subspace V, and the source node should generate signatures ${\sigma }_1,\cdots ,{\sigma }_m$ for vectors ${\mathbf{m}}_1,\cdots ,{\mathbf{m}}_m\subseteq V$.

4.5. Data Detection: Combine and Verify

Combine. Taking the public parameters $pp$, a user identity $ID$, the tag $\tau$ of the subspace, and a vector signature set with random coefficients ${\{c_k,{\mathbf{m}}_k,{\sigma }_k\}}_{k=1}^l$ as input, the combiner computes the combined vector $\widehat{\mathbf{m}}$ and signature $\widehat{\sigma }$. The details are given as follows.

$$\begin{array}{cc}\hfill & \widehat{\mathbf{m}}=\sum _{i=1}^l{c}_i{\mathbf{m}}_i=(\widehat{m_1},...,{\widehat{m}}_n)\in V,\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill & \hfill \widehat{\sigma }=\prod _{i=1}^l{{\sigma }_i}^{c_i}\end{array}$$

(2)

Verify$\left(pp,ID,upk,Cert,\tau ,\widehat{\mathbf{m}},\widehat{\sigma }\right)\to (0,1)$. Taking the public parameters $pp$, a user identity $ID$, the user’s public key $upk$, a certificate $Cert$, the tag $\tau$ of the subspace, a combined vector $\widehat{\mathbf{m}}$, and a signature $\widehat{\sigma }$, the verifier checks the integrity of vector $\widehat{\mathbf{m}}$.

$$e({\tau }_0,upk·{g_2}^{H_2(ID,vid,\beta )})=e(H_1(ID,upk),pk)$$

(3)

$$e(\widehat{\sigma },g_2)=e({g_1}^{{\sum }_{j=1}^n{H}_3(ID,j,{\tau }_0)·{\widehat{m}}_j},\beta )$$

(4)

4.6. The Application

The certificate-based linearly homomorphic signature can be used in a network to guarantee data integrity and authenticity. However, an attacker who hijacks adequate data packets can retrieve the original message. In order to ensure confidentiality, we encrypt the message before signing it.

To enhance network throughput, linear network coding is employed. This requires the source node to first process the collected data by partitioning it into m vectors, ${\mathbf{w}}_i=(m_{i1},\cdots ,m_{in})\in {\mathbb{Z}}_q^n$ for $i\in [1,m]$. Subsequently, each vector ${\mathbf{w}}_i$ is expanded to create an augmented vector ${\mathbf{m}}_i=(m_{i1},\cdots ,m_{in},m_{i(n+1)},...,m_{i(n+m)})$. The specific method used for this augmentation is detailed below:

$$m_{i(n+j)}=\left\{\begin{array}{cc}\hfill 1,i=j& \\ \hfill & i,j=1,2,\cdots ,m\hfill \\ \hfill 0,i\ne j& \end{array}\right.$$

(5)

The vector ${\mathbf{m}}_i$ is partitioned into two parts: the data vector component, ${{\mathbf{m}}_i}^L$, which comprises the n leftmost items, and the global coefficient vector component, ${{\mathbf{m}}_i}^R$, which consists of the m rightmost items. It is assumed that the destination node successfully receives m linearly independent vectors, ${\widehat{\mathbf{m}}}_1,\cdots ,{\widehat{\mathbf{m}}}_m$. Upon receiving these, the destination node proceeds to compute an $m\times m$ matrix B as follows:

$$B={\left(\begin{array}{c}{{\widehat{\mathbf{m}}}_1}^R\\ ⋮\\ {{\widehat{\mathbf{m}}}_m}^R\end{array}\right)}^{-1}$$

(6)

The original vectors ${\mathbf{w}}_1,{\mathbf{w}}_2,...,{\mathbf{w}}_m$ can be computed by

$$\left(\begin{array}{c}{\mathbf{w}}_1\\ ⋮\\ {\mathbf{w}}_m\end{array}\right)=B·\left(\begin{array}{c}{{\widehat{\mathbf{m}}}_1}^L\\ ⋮\\ {{\widehat{\mathbf{m}}}_m}^L\end{array}\right)$$

(7)

• System Setup: The certifier runs the Setup algorithm to generate system public parameters $pp$ and the system master key $msk$. The certifier chooses a function $KDF$: ${0,1}^{*}\to {\{0,1\}}^l$. The certifier broadcasts $pp$ and $KDF$ and keeps the master private key $msk$ secret.
• User Register: The user runs the UserKeyGen algorithm to generate their private/public key pair $(us{k}_i,up{k}_i),i\in \{A,B\}$ and sends their public key $up{k}_i$ to the certifier. On receiving the request, the certifier issues a certificate $Cer{t}_i$ to the user with identity $I{D}_i$ by running the Certify algorithm.
• Data Process: The source node with identity $I{D}_A$ first randomly chooses a number $r\in {\mathbb{Z}}_q$ and computes $R={g_2}^r$ and the session key stream $sk=KDF(I{D}_A,I{D}_B,{up{k}_{I{D}_B}}^r)$. The source node encrypts the file F using a secure and efficient stream cipher algorithm, $\tilde{F}=E_{sk}\left(F\right)$. The source node splits the encrypted file into vectors ${\mathbf{w}}_1,\cdots ,{\mathbf{w}}_m$ and augments the vectors ${\mathbf{m}}_1,\cdots ,{\mathbf{m}}_m$ according to Equation (5). Let $V=span\{{\mathbf{m}}_1,\cdots ,{\mathbf{m}}_m\}$ denote the subspace that is spanned by the m augmented vectors. The source node then computes the tag $\tau$ for the subspace V by running the TagGen algorithm and computes signatures for ${\mathbf{m}}_1,\cdots ,{\mathbf{m}}_m$ by running the Sign algorithm. The source node sends ${\mathbf{m}}_1,\cdots ,{\mathbf{m}}_m$, the corresponding signatures ${\sigma }_1,\cdots ,{\sigma }_m$, the tag $\tau =({\tau }_0,\beta )$, and decryption information R to the next node.
• Data Detection: On receiving some ${\mathbf{m}}_j,j\in I,I\subseteq [1,m]$, the corresponding signatures ${\sigma }_j$, and the tag $\tau$, the node (intermediate node or destination node) runs the verification algorithm to verify the integrity of all received data packets. If Equation (3) holds, these data packets come from the same source node. The node verifies these data packets in turn through Equation (4). The node combines all corrected data packets according to the Combine algorithm and discards the damaged data packets.
• Decryption: If the destination node with the identity $I{D}_B$ has received enough corrected data packets, it can retrieve the encrypted file $\tilde{F}$ and decrypt the original file $F=D_{sk}\left(\tilde{F}\right)$, where $sk=PRF(I{D}_A,I{D}_B,R^{x_B})$.

We enable a certificate-based linearly homomorphic signature scheme in network coding to defend against pollution attacks by ensuring data integrity and authenticity. In addition, we adopt a secure and efficient stream cipher algorithm; even if an attacker can hijack adequate data packets, it can only recover the encrypted message. The probability of the attacker decrypting the ciphertext is negligible. The encrypt key can only be computed by the communicating entities $A,B$. That is to say, only A and B can decrypt the ciphertext to obtain the original message. Therefore, a certificate-based linearly homomorphic signature scheme can be used in network coding to prevent the data from being damaged and eavesdropped.

5. Security Analysis

In this section, we give the formal security proof of the proposed CH-LBS scheme.

Theorem 1.

If the Type I adversary can break the proposed scheme with advantage at most ϵ, the modified k-CAA problem can be solved with non-negligible advantage ${ϵ}^{\prime }\ge {(1-{\displaystyle \frac{1}{q_u}})}^{q_r+q_e}{(1-{\displaystyle \frac{1}{q_t+1}})}^{q_t}{\displaystyle \frac{1}{(q_t+1)q_u}}ϵ$, where $q_u,q_r,q_e,q_t$ are the times of queries made to the User-Key-Gen query, Corruption query, Certification query, and Subspace-Signature query, respectively.

Proof. 

Given the public parameters $pp=(q,{\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T,g_1,g_2,e)$, assume that there exists a Type I adversary ${\mathcal{A}}_I$. We construct a probabilistic polynomial-time algorithm $\mathcal{B}$ that leverages ${\mathcal{A}}_I$ as a subroutine to solve the modified k-CAA problem.

Let $x,a,b,h_1,\dots ,h_k\in {\mathbb{Z}}_q^{*}$ be $k+3$ randomly chosen elements. Algorithm $\mathcal{B}$ is given a modified k-CAA instance of the form

$$\left(g_1,g_1^b,g_2^a,g_2^x,(h_1,{\left(g_1^{ab}\right)}^{{\displaystyle \frac{1}{x+h_1}}}),\dots ,(h_k,{\left(g_1^{ab}\right)}^{{\displaystyle \frac{1}{x+h_k}}})\right),$$

and its goal is to output either $g_1^{ab}$ or a fresh pair $(h^{*},{\left(g_1^{ab}\right)}^{{(x+h^{*})}^{-1}})$.

• Initialization. Algorithm $\mathcal{B}$ sets the public key $pk=g_2^a$ and forwards the public parameters $(q,{\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T,g_1,g_2,e)$ to the adversary ${\mathcal{A}}_I$. Let $\psi :{\mathbb{G}}_2\to {\mathbb{G}}_1$ denote an efficiently computable isomorphism. The hash functions $H_1$, $H_2$, and $H_3$ are modeled as random oracles.
• Oracle Simulation. The adversary ${\mathcal{A}}_I$ is allowed to adaptively issue the following oracle queries.
• User-Key-Gen Query. Let $I{D}_i$ denote the identity submitted in the i-th query. Algorithm $\mathcal{B}$ randomly guesses that the I-th query, for some $I\in \{1,\cdots ,q_u\}$, corresponds to the challenge identity.
  To answer these queries, $\mathcal{B}$ maintains a list $L_u$ consisting of tuples $(I{D}_i,x_i,up{k}_i)$, which is initially empty. Upon receiving a query for identity $I{D}_i$, $\mathcal{B}$ proceeds as follows: If $I{D}_i$ already appears in $L_u$, the corresponding key information is returned. Otherwise, $\mathcal{B}$ generates the user key pair according to

  $$(us{k}_i,up{k}_i)=\left\{\begin{array}{cc}(x_i,g_2^{x_i}),\hfill & \mathrm{if}i\ne I,\hfill \\ (x,g_2^x),\hfill & \mathrm{if}i=I,\hfill \end{array}\right.$$

  where $x_i$ is randomly sampled from ${\mathbb{Z}}_q^{*}$, while x is implicitly embedded from the modified k-CAA instance and is unknown to both $\mathcal{B}$ and ${\mathcal{A}}_I$.
  Algorithm $\mathcal{B}$ returns the public key $up{k}_i$ to ${\mathcal{A}}_I$ and records either $(I{D}_i,x_i,up{k}_i)$ or $(I{D}_I,\perp ,up{k}_I)$ in the list $L_u$.
• ${\mathit{H}}_{\mathbf{1}}$ Query. Algorithm $\mathcal{B}$ maintains a list $L_{H_1}$ that stores tuples $(I{D}_i,H_1(I{D}_i,up{k}_i),d_i)$, which is initially empty. Upon receiving an $H_1$ query on $(I{D}_i,up{k}_i)$, $\mathcal{B}$ proceeds as follows.
  If the identity $I{D}_i$ already appears in the list $L_{H_1}$, then $\mathcal{B}$ returns the previously defined value $H_1(I{D}_i,up{k}_i)$. Otherwise, $\mathcal{B}$ defines the hash output according to

  $$H_1(I{D}_i,up{k}_i)=\left\{\begin{array}{cc}\psi {\left(g_2\right)}^{d_i},\hfill & \mathrm{if}i\ne I,\hfill \\ g_1^b,\hfill & \mathrm{if}i=I,\hfill \end{array}\right.$$

  where $d_i$ is chosen uniformly at random from ${\mathbb{Z}}_q^{*}$.
  The simulator $\mathcal{B}$ returns to this query with $H_1(I{D}_i,up{k}_i)$ and adds $({ID}_i,H_1(I{D}_i,up{k}_i),d_i)$ or $({ID}_I,H_1(I{D}_i,up{k}_i),\perp )$ into the $L_{H_1}$ list.
• Corruption Query. For a corruption request on identity $I{D}_i$, algorithm $\mathcal{B}$ first checks whether $I{D}_i$ appears in the user list $L_u$ and whether $I{D}_i$ coincides with the challenge identity $I{D}_I$. If $I{D}_i\notin L_u$ or $I{D}_i=I{D}_I$, the simulation is aborted and $\mathcal{B}$ outputs ⊥. Otherwise, $\mathcal{B}$ retrieves the corresponding secret value $x_i$ from $L_u$ and returns it to ${\mathcal{A}}_I$.
• Certification Query. Algorithm $\mathcal{B}$ maintains a list $L_c$ containing tuples $(I{D}_i,Cer{t}_i)$. Upon receiving a certification query for identity $I{D}_i$, $\mathcal{B}$ proceeds as follows.
  If a tuple associated with $I{D}_i$ already exists in $L_c$, the stored certificate $Cer{t}_i$ is returned. Otherwise, $\mathcal{B}$ obtains the value $d_i$ from the list $L_{H_1}$ and defines

  $$Cer{t}_i=\left\{\begin{array}{cc}\psi {\left(g_2^a\right)}^{d_i},\hfill & \mathrm{if}i\ne I,\hfill \\ \perp ,\hfill & \mathrm{if}i=I.\hfill \end{array}\right.$$
  The computed result is then returned to ${\mathcal{A}}_I$, and the pair $(I{D}_i,Cer{t}_i)$ is added to the list $L_c$.
• Key-Replace Query. When ${\mathcal{A}}_I$ submits a replacement key pair $(us{k}_i^{\prime },up{k}_i^{\prime })$ for identity $I{D}_i$, algorithm $\mathcal{B}$ verifies whether the consistency condition $g_2^{us{k}_i^{\prime }}=up{k}_i^{\prime }$ is satisfied. If the check succeeds, $\mathcal{B}$ updates the list $L_u$ by recording the tuple $(I{D}_i,us{k}_i^{\prime },up{k}_i^{\prime })$.
• ${\mathit{H}}_{\mathbf{2}}$ Query. $\mathcal{B}$ maintains a list $L_{H_2}$ consisting of $({ID}_i,vid,\beta ,\widehat{h},c)$. The list is initially empty. If $({ID}_i,vid,\beta )$ is in the list $L_{H_2}$, then $\mathcal{B}$ sends $\widehat{h}$ to ${\mathcal{A}}_I$. Otherwise, $\mathcal{B}$ sets $H_2(I{D}_i,vid,\beta )$ as

  $$H_3(I{D}_i,\beta )=\left\{\begin{array}{cc}\hfill \widehat{h}\in {\mathbb{Z}}_q^{*},& i\ne I\hfill \\ \hfill \widehat{h}\notin \{h_1,\cdots ,h_k\},& i=I,c=1\hfill \\ \hfill \widehat{h}\in \{h_1,\cdots ,h_k\},& i=I,c=0\hfill \end{array}\right.$$
  The simulator chooses a binary variable $c\in \{0,1\}$ such that $c=1$ occurs with probability $\zeta$ and $c=0$ with probability $1-\zeta$. It then returns $\widehat{h}$ as the response and appends $(I{D}_i,\beta ,\widehat{h},c)$ to $L_{H_2}$.
• ${\mathit{H}}_{\mathbf{3}}$ Query. $\mathcal{B}$ maintains a list $L_{H_3}$ consisting of $({ID}_i,k,{\tau }_0,{\gamma }_k)$. The list is initially empty. If $({ID}_i,k,{\tau }_0)$ is in the list $L_{H_3}$, then $\mathcal{B}$ sends ${\gamma }_k$ to ${\mathcal{A}}_I$. Otherwise, $\mathcal{B}$ randomly selects ${\gamma }_k$ and sets $H_3(I{D}_i,k,{\tau }_0)={\gamma }_k$. The simulator responses this query with ${\gamma }_k$ and adds $({ID}_i,k,{\tau }_0,{\gamma }_k)$ into the $L_{H_3}$ list.
• Subspace-Signature Query. For a signature query on $(I{D}_i,vid,V)$, the simulator $\mathcal{B}$ first randomly choose $\alpha \in {\mathbb{Z}}_q^{*}$ and computes $\beta ={g_2}^{\alpha }$. If $(I{D}_i,vid,\beta )$ has been issued an $H_2$ query, abort. Otherwise, $\mathcal{B}$ imitates ${\mathcal{A}}_I$ to issue an $H_2$ query, and computes ${\tau }_0$ as

  $${\tau }_0=\left\{\begin{array}{cc}\hfill Cer{t}_i^{{\displaystyle \frac{1}{us{k}_i+\widehat{h}}}},& i\ne I\hfill \\ \hfill \perp ,& i=I,c=1\hfill \\ \hfill {\left(g_1^{ab}\right)}^{{\displaystyle \frac{1}{x+\widehat{h}}}},& i=I,c=0\hfill \end{array}\right.$$
  The simulator $\mathcal{B}$ sets the tag of file $\tau =({\tau }_0,\beta )$ and computes the signature for the subspace V, where ${\mathbf{m}}_1,\cdots ,{\mathbf{m}}_m$ is a basis vector of V. The simulator computes ${\sigma }_j$ for ${\mathbf{m}}_j$ as

  $${\sigma }_j=\left\{\begin{array}{cc}\hfill \perp ,& i=I,c=1\hfill \\ \hfill {\left({g_1}^{{\sum }_{k=1}^m{\gamma }_k{m}_{jk}}\right)}^{\alpha },& otherwise\hfill \end{array}\right.$$
  The simulator B sends the tag $\tau =({\tau }_0,\beta )$ and signatures ${\sigma }_1,\cdots ,{\sigma }_m$ to ${\mathcal{A}}_I$.
• Forgery. Eventually ${\mathcal{A}}_I$ outputs a tuple $({ID}^{*},{upk}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})$. The adversary ${\mathcal{A}}_I$ wins the game if the following requirements are satisfied:

  1.

  The Corruption query on ${ID}^{*}$ has never been issued.

  2.

  The Certification query on ${ID}^{*}$ has never been issued.

  3.

  ${\mathcal{A}}_I$ has never queried the signature on subspace $V^{*}$, where ${\mathbf{m}}^{*}\in V^{*}$.

  4.

  ${\mathcal{A}}_I$ has queried the signature on subspace $V^{*}$ with tag $\tau$, but $\tau \ne {\tau }^{*}$.

  5.

  Verify$(pp,I{D}^{*},up{k}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})$ = 1.

  If ${ID}^{*}\ne {ID}_I$, abort. Otherwise, $\mathcal{B}$ iterates over the $L_{H3}$ list; if $c=0$, abort. Otherwise, we have $c=1$ and $h^{*}\notin \{h_1,...,h_k\}$. According to the simulation, we have

  $$\begin{array}{cc}\hfill {{\tau }_0}^{*}& ={Cer{t}^{*}}^{{\displaystyle \frac{1}{us{k}^{*}+H_3(I{D}^{*},\beta )}}}\hfill \\ \hfill & ={\left(H_1{(I{D}^{*},up{k}^{*})}^a\right)}^{{\displaystyle \frac{1}{us{k}^{*}+h^{*}}}}(I{D}_I=I{D}^{*})\hfill \\ \hfill & ={\left({g_1}^{ab}\right)}^{{\displaystyle \frac{1}{us{k}^{*}+h^{*}}}}\hfill \end{array}$$

  If the public key ${upk}^{*}$ is the original one that has not been replaced, that is $us{k}^{*}=x$, $\mathcal{B}$ will output the solution of the k-CAA problem, i.e., $(h^{*},{\left({g_1}^{ab}\right)}^{{\displaystyle \frac{1}{x+h^{*}}}})$. If the public key ${upk}^{*}$ has been replaced by ${\mathcal{A}}_I$, the corresponding private key is known to $\mathcal{B}$, and $\mathcal{B}$ will output the solution ${g_1}^{ab}=({\left({g_1}^{ab}\right)}^{{\displaystyle \frac{1}{us{k}^{*}+h^{*}}}}{)}^{us{k}^{*}+h^{*}}$ of the modified k-CAA problem.

Probability Analysis. Algorithm $\mathcal{B}$ successfully solves the k-CAA or the modified k-CAA problem only if the following events occur simultaneously: (1) $E_1$: The simulation does not abort; i.e., $\mathcal{B}$ never outputs ⊥. (2) $E_2$: The adversary ${\mathcal{A}}_I$ wins the security game. (3) $E_3$: The forged identity satisfies $I{D}^{*}=I{D}_I$ and the corresponding bit equals $c^{*}=1$.

Accordingly, the success probability of $\mathcal{B}$ can be expressed as

$${ϵ}^{\prime }=Pr[E_1\cap E_2\cap E_3]=Pr\left[E_1\right]·Pr[E_2\mid E_1]·Pr[E_3\mid E_1\cap E_2].$$

(1)

If $E_1$ happens, then we consider the following three circumstances:

(a)

During the Corruption query phase, the simulator $\mathcal{B}$ does not abort. Since the challenge identity is guessed uniformly at random, the probability that the simulation remains valid is ${\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_r}$.

(b)

During the Certification query phase, the simulator $\mathcal{B}$ also avoids aborting. Similarly, the probability that the simulation is not terminated in this phase is ${\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_e}$.

(c)

During the Subspace-Signature query phase, the simulator $\mathcal{B}$ does not output ⊥ with probability ${\left(1-{\displaystyle \frac{\zeta }{q_u}}\right)}^{q_t}$.

Therefore, we have $\mathrm{Pr}\left[E_1\right]={(1-{\displaystyle \frac{1}{q_u}})}^{q_r+q_e}{(1-{\displaystyle \frac{1}{q_u}}\zeta )}^{q_t}\ge {(1-{\displaystyle \frac{1}{q_u}})}^{q_r+q_e}{(1-\zeta )}^{q_t}$.

(2)

If $E_2$ happens, then we have $\mathrm{Pr}\left[E_2\right|E_1]=ϵ$.

(3)

If $E_3$ happens, then we have $\mathrm{Pr}\left[E_3\right|E_1\wedge E_2]={\displaystyle \frac{\zeta }{q_u}}$.

In summary, we have ${ϵ}^{\prime }\ge {(1-{\displaystyle \frac{1}{q_u}})}^{q_r+q_e}{(1-\zeta )}^{q_t}{\displaystyle \frac{\zeta }{q_u}}ϵ$. The function ${(1-\zeta )}^{q_t}\zeta$ is maximized when $\zeta ={\displaystyle \frac{1}{q_t+1}}$. Therefore, ${ϵ}^{\prime }\ge {(1-{\displaystyle \frac{1}{q_u}})}^{q_r+q_e}{(1-{\displaystyle \frac{1}{q_t+1}})}^{q_t}{\displaystyle \frac{1}{(q_t+1)q_u}}ϵ$.

Theorem 2.

If a Type II adversary is able to break the proposed scheme with advantage at most ϵ, then one can construct an algorithm that solves the k-CAA problem with non-negligible advantage ${ϵ}^{\prime }$ satisfying

$${ϵ}^{\prime }\ge {\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_r}{\left(1-{\displaystyle \frac{1}{q_t+1}}\right)}^{q_t}{\displaystyle \frac{1}{(q_t+1)q_u}}ϵ,$$

where $q_u$, $q_r$, and $q_t$ denote the numbers of queries issued to the User-Key-Gen, Corruption, and Subspace-Signature oracles, respectively.

Proof. 

Let $pp=(q,{\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T,g_1,g_2,e)$ denote the public parameters. Assume that there exists a Type II adversary ${\mathcal{A}}_{II}$. We build a probabilistic polynomial-time reduction algorithm $\mathcal{B}$ that uses ${\mathcal{A}}_{II}$ as a subroutine to solve the k-CAA problem.

Let $x,h_1,\dots ,h_k\in {\mathbb{Z}}_q^{*}$ be $k+1$ values. Algorithm $\mathcal{B}$ is given a k-CAA instance

$$\left(g_1,g_2^x,(h_1,g_1^{{\displaystyle \frac{1}{x+h_1}}}),\dots ,(h_k,g_1^{{\displaystyle \frac{1}{x+h_k}}})\right),$$

and its task is to output a fresh solution pair $(h^{*},g_1^{{\displaystyle \frac{1}{x+h^{*}}}})$ for some $h^{*}\notin \{h_1,\dots ,h_k\}$.

• Initialization. Algorithm $\mathcal{B}$ samples a random value $s\in {\mathbb{Z}}_q^{*}$ and sets the system public key as $pk=g_2^s$. It then provides the public parameters $(q,{\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T,g_1,g_2,e)$ to the adversary ${\mathcal{A}}_{II}$. The hash functions $H_1$, $H_2$, and $H_3$ are modeled as random oracles.
• Oracle Simulation. The adversary ${\mathcal{A}}_{II}$ may adaptively issue oracle queries. The simulations of the User-Key-Gen, Corruption, $H_2$, $H_3$, and $H_4$ queries are identical to those defined in Game 2.
• ${\mathit{H}}_{\mathbf{1}}$ Query. Algorithm $\mathcal{B}$ maintains a list $L_{H_1}$ of tuples $(I{D}_i,H_1(I{D}_i,up{k}_i),d_i)$, which is initially empty. Upon receiving an $H_1$ query on input $(I{D}_i,up{k}_i)$, $\mathcal{B}$ proceeds as follows.
  If an entry associated with $I{D}_i$ already exists in $L_{H_1}$, the stored hash value $H_1(I{D}_i,up{k}_i)$ is returned to ${\mathcal{A}}_{II}$. Otherwise, $\mathcal{B}$ samples a random value $d_i\in {\mathbb{Z}}_q^{*}$ and defines $H_1(I{D}_i,up{k}_i)=g_1^{d_i}$. The newly generated tuple $(I{D}_i,H_1(I{D}_i,up{k}_i),d_i)$ is then recorded in $L_{H_1}$, and the hash value is returned to the adversary.
• Subspace-Signature Query. For a signature query on $(I{D}_i,vid,V)$, the simulator $\mathcal{B}$ first randomly choose $\alpha \in {\mathbb{Z}}_q^{*}$ and computes $\beta ={g_1}^{\alpha }$. If $(I{D}_i,vid,\beta )$ has been issued an $H_2$ query, abort. Otherwise, $\mathcal{B}$ imitates ${\mathcal{A}}_{II}$ to issue an $H_2$ query and computes ${\tau }_0$ as

  $${\tau }_0=\left\{\begin{array}{cc}\hfill {\left({g_1}^{d_{i}s}\right)}^{{\displaystyle \frac{1}{x_i+\widehat{h}}}},& i\ne I\hfill \\ \hfill \perp ,& i=I,c=1\hfill \\ \hfill {({g_1}^{{\displaystyle \frac{1}{x+\widehat{h}}}})}^{d_{i}s},& i=I,c=0\hfill \end{array}\right.$$
  The simulator $\mathcal{B}$ sets the tag of file $\tau =({\tau }_0,\beta )$ and computes the signature for the subspace V, where ${\mathbf{m}}_1,\cdots ,{\mathbf{m}}_m$ is a basis vector of V. The simulator computes ${\sigma }_j$ for ${\mathbf{m}}_j$ as

  $${\sigma }_j=\left\{\begin{array}{cc}\hfill \perp ,& i=I,c=1\hfill \\ \hfill {\left({g_1}^{{\sum }_{k=1}^m{\gamma }_k{m}_{jk}}\right)}^{\alpha },& otherwise\hfill \end{array}\right.$$
  The simulator B sends the tag $\tau =({\tau }_0,\beta )$ and signatures ${\sigma }_1,\cdots ,{\sigma }_m$ to ${\mathcal{A}}_{II}$.
• Forgery. Eventually, the adversary ${\mathcal{A}}_{II}$ outputs a tuple $(I{D}^{*},up{k}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})$. The adversary is said to win the game if all of the following conditions are satisfied:

  1.

  No Corruption query has been issued on the identity $I{D}^{*}$.

  2.

  ${\mathcal{A}}_{II}$ has never requested a signature on the subspace $V^{*}$ such that ${\mathbf{m}}^{*}\in V^{*}$.

  3.

  ${\mathcal{A}}_{II}$ has queried a signature on the same subspace $V^{*}$, but under a different tag $\tau \ne {\tau }^{*}$.

  4.

  The verification algorithm accepts the forgery; i.e.,

  $\mathbf{Verify}(pp,I{D}^{*},up{k}^{*},vi{d}^{*},{\mathbf{m}}^{*},{\tau }^{*},{\sigma }^{*})=1$.

  If $I{D}^{*}\ne I{D}_I$, the simulator $\mathcal{B}$ aborts. Otherwise, $\mathcal{B}$ scans the list $L_{H_3}$. If the associated bit satisfies $c=0$, the simulation is aborted. When $c=1$, it follows that $h^{*}\notin \{h_1,\dots ,h_k\}$. According to the simulation, the following relation holds:

  $$\begin{array}{cc}\hfill {\tau }_0^{*}& ={\left(Cer{t}^{*}\right)}^{{\displaystyle \frac{1}{us{k}^{*}+H_3(I{D}^{*},\beta )}}}\hfill \\ \hfill & ={\left(H_1{(I{D}^{*},up{k}^{*})}^s\right)}^{{\displaystyle \frac{1}{us{k}^{*}+h^{*}}}}(I{D}^{*}=I{D}_I)\hfill \\ \hfill & ={\left(g_1^{d_{i}s}\right)}^{{\displaystyle \frac{1}{x+h^{*}}}}.\hfill \end{array}$$
  Therefore, the solution of the k-CAA problem is ${g_1}^{{\displaystyle \frac{1}{x+h^{*}}}}={{\tau }_0}^{{\displaystyle \frac{1}{d_{i}s}}}$.

• Probability Analysis. Algorithm $\mathcal{B}$ successfully solves the k-CAA problem only if the following events occur simultaneously:

• $E_1$: The simulation does not abort; i.e., $\mathcal{B}$ never outputs ⊥;
• $E_2$: The adversary ${\mathcal{A}}_{II}$ wins the security game;
• $E_3$: The forged identity satisfies $I{D}^{*}=I{D}_I$ and the corresponding bit equals $c^{*}=1$.

Accordingly, the success probability of $\mathcal{B}$ can be decomposed as ${ϵ}^{\prime }=Pr[E_1\cap E_2\cap E_3]=Pr\left[E_1\right]·Pr[E_2\mid E_1]·Pr[E_3\mid E_1\cap E_2]$.

1.

Analysis of ${\mathbf{E}}_{\mathbf{1}}$. The event $E_1$ holds if the simulator does not abort during the query phases. In particular, the following occur:

• During the Corruption query phase, the probability that the simulation remains valid is ${\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_r}$.
• During the Subspace-Signature query phase, the simulator avoids aborting with probability ${\left(1-{\displaystyle \frac{\zeta }{q_u}}\right)}^{q_t}$.

Therefore, $Pr\left[E_1\right]={\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_r}{\left(1-{\displaystyle \frac{\zeta }{q_u}}\right)}^{q_t}\ge {\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_r+q_e}{(1-\zeta )}^{q_t}$.

2.

Analysis of ${\mathbf{E}}_{\mathbf{2}}$. Conditioned on $E_1$, the probability that ${\mathcal{A}}_{II}$ wins the game equals its advantage. Hence, $Pr[E_2\mid E_1]=ϵ$.

3.

Analysis of ${\mathbf{E}}_{\mathbf{3}}$. Given that both $E_1$ and $E_2$ occur, the probability that the forgery involves the challenge identity and satisfies $c^{*}=1$ is $Pr[E_3\mid E_1\cap E_2]={\displaystyle \frac{\zeta }{q_u}}$.

Combining the above bounds, we obtain ${ϵ}^{\prime }\ge {\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_r}{(1-\zeta )}^{q_t}{\displaystyle \frac{\zeta }{q_u}}ϵ$. The expression ${(1-\zeta )}^{q_t}\zeta$ is maximized when $\zeta ={\displaystyle \frac{1}{q_t+1}}$. Substituting this value yields ${ϵ}^{\prime }\ge {\left(1-{\displaystyle \frac{1}{q_u}}\right)}^{q_r}{\left(1-{\displaystyle \frac{1}{q_t+1}}\right)}^{q_t}{\displaystyle \frac{1}{(q_t+1)q_u}}ϵ$.

6. Performance Analysis

6.1. Theoretical Analysis

Table 2 presents a comparative analysis of our CB-LHS scheme against those proposed by Chang et al. [19], Zhang et al. [11], and Boneh et al. ($NC{S}_1$) [8]. The comparison focuses on the computational overhead of signature generation and verification.

Table 2. Comparison of computation cost and tag verification.

Scheme	Sig.Comp	Sig.Ver.Comp	Tag
[8]	$m{T}_H+m(n+2)T_{E_1}+mn{T}_{M_1}$	$\begin{array}{c}\hfill m{T}_H+N{T}_{E_1}+(N-1)T_{M_1}+2T_P\end{array}$	✗
[11]	$N{T}_H+m(N+1)T_{E_1}+m(N-1)T_{M_1}$	$\begin{array}{c}\hfill N{T}_H+(N+2)T_{E_1}+T_{E_2}+N{T}_{M_1}+T_{M_2}+2T_P\end{array}$	✗
[19]	$(nN+3n+1)T_{E_1}+N{T}_H+n(N+1)T_{M_1}$	$\begin{array}{c}\hfill (N+1)T_H+(N+2)T_{E_1}+N{T}_{M_1}+2T_P\end{array}$	✗
Our Scheme	$2m{T}_{E_1}$	$T_{E_1}+2T_P$	✓

We denote the primary computational operations as follows: $T_H$ for map-to-point hashing, $T_P$ for bilinear pairing, $T_{E_1}$ and $T_{E_2}$ for exponentiations in ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$, and $T_{M_1}$ and $T_{M_2}$ for multiplications in ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$. Minor operations like ${\mathbb{Z}}_q$ addition, ${\mathbb{Z}}_q^{*}$ inversion, and hashing to ${\mathbb{Z}}_q$ are considered negligible and thus excluded. For a fair comparison, we set m as the number of vectors and n as the sectors per vector, making the augmented vector dimension $N=(m+n)$.

As shown in Table 2, our scheme’s signature generation cost is contingent on the number of data packets, while its verification cost remains constant. In contrast, the costs for the other two linearly homomorphic schemes are dictated by the file size. This demonstrates the superior efficiency of our approach. Furthermore, our scheme includes tag verification, which incurs a generation cost of $2T_{E_1}$ and a verification cost of $T_H+T_{E_2}+T_{M_2}$.

6.2. Experiment Analysis

This section evaluates our scheme’s time cost using a custom Java simulator on a 3.2 GHz quad-core PC. We employ the JPBC library’s [41] f.param setting, suitable for the asymmetric bilinear maps used in our scheme, as well as those by Zhang et al. [11] and Boneh et al. [8]. For 80-bit security, this corresponds to 160-bit elements in ${\mathbb{G}}_1$ and 320-bit elements in ${\mathbb{G}}_2$. Our experiments used an 11.2 KB (11,518 bytes) test file, which is segmented into m blocks of n segments each, with every segment being a 160-bit ${\mathbb{Z}}_q$ element. This implies ${\displaystyle \frac{160}{8}}(m-1)n\le \mathrm{11,518}\le {\displaystyle \frac{160}{8}}mn$. Given a standard 1500-byte MTU (1460-byte payload) in IP networks, a packet can hold up to 73 segments; hence $N=m+n\le 73$. Figure 2 and Figure 3 illustrate the comparative results against the schemes of Chang et al. [19], Zhang et al. [11], and Boneh et al. [8].

Figure 2. Computational cost of signature generation. The results of Chang et al. [19], Zhang et al. [11], and Boneh et al. [8] are compared with our proposed scheme.

Figure 3. Computational cost of data packet detection. The results of Chang et al. [19], Zhang et al. [11], and Boneh et al. [8] are compared with our proposed scheme.

Figure 2 illustrates the computational cost of signature generation for a file under identical experimental conditions, comparing our proposed scheme with [8,11,19]. As observed in the figure, the computational overhead of the three comparison schemes generally decreases or stabilizes as the dimension n increases, yet remains significantly high. In stark contrast, our Sig (CB-LHS) scheme (represented by the yellow line) exhibits a consistently low and stable time cost, appearing almost negligible compared to the baselines. It is important to clarify that the total signing cost in our scheme comprises two parts: tag generation and signature generation. The curve Sig (CB-LHS) specifically denotes the signature generation phase. To evaluate performance in a realistic network scenario, we maximized transmission efficiency by setting parameters to the maximum transmission unit (MTU) limit, specifically with $n=64$ and $m=9$ (total vector length $N=73$). For signing an 11.2 KB file under these parameters, our scheme required a total of approximately 46 ms (with the signature generation phase alone taking only 36 ms). This represents a substantial performance leap—approximately 25 to 160 times faster—compared to the 1194 ms, 1327 ms, and 7771 ms reported for [8,11,19], respectively. This efficiency is attributed to our construction’s avoidance of expensive operations dependent on vector dimension.

Figure 3 presents the verification cost for detecting polluted data packets. A critical advantage of our scheme, as shown in the figure, is that the computation cost remains constant regardless of the vector dimension n. Conversely, the verification costs of the other schemes exhibit a linear increase as the dimension grows, which can lead to processing bottlenecks in high-dimensional data transmission. Specifically, our scheme requires approximately 150 ms for signature verification and 153 ms for tag verification. While the total verification overhead (including tag verification) sums to approximately 303 ms, it is crucial to note that the signature verification component itself is significantly faster than the counterparts. Furthermore, given the dual protection against both pollution and eavesdropping provided by our scheme, this slight total overhead is well within a reasonable range for practical deployment.

In summary, considering the results from Figure 2 and Figure 3 together, our scheme demonstrates the lowest overall computational burden, particularly when operating at the MTU limit ($n=64$). The simulation results robustly confirm that the proposed CB-LHS scheme achieves superior efficiency and scalability for network coding applications compared to existing state-of-the-art solutions.

7. Conclusions

In this paper, we established a formal definition and security model for certificate-based linearly homomorphic network coding signature (CB-LHS) schemes. We then constructed an efficient CB-LHS scheme and detailed its application in network coding, demonstrating its ability to ensure data integrity and authenticity against pollution attacks.

To protect against eavesdropping in unicast networks, our approach integrates a secure stream cipher for message encryption prior to signing. This mechanism ensures that even if an attacker intercepts sufficient packets, the original message remains confidential and accessible only to the communicating entities. The correctness and security of the CB-LHS scheme were formally proven under our security model. Finally, through theoretical analysis and simulation, we evaluated the computation costs of signature generation and verification. The results confirm that our scheme is more efficient than other comparable schemes for network coding.