An Identity-Based Anti-Quantum Privacy-Preserving Blind Authentication in Wireless Sensor Networks.

With the development of wireless sensor networks, IoT devices are crucial for the Smart City; these devices change people's lives such as e-payment and e-voting systems. However, in these two systems, the state-of-art authentication protocols based on traditional number theory cannot defeat a quantum computer attack. In order to protect user privacy and guarantee trustworthy of big data, we propose a new identity-based blind signature scheme based on number theorem research unit lattice, this scheme mainly uses a rejection sampling theorem instead of constructing a trapdoor. Meanwhile, this scheme does not depend on complex public key infrastructure and can resist quantum computer attack. Then we design an e-payment protocol using the proposed scheme. Furthermore, we prove our scheme is secure in the random oracle, and satisfies confidentiality, integrity, and non-repudiation. Finally, we demonstrate that the proposed scheme outperforms the other traditional existing identity-based blind signature schemes in signing speed and verification speed, outperforms the other lattice-based blind signature in signing speed, verification speed, and signing secret key size.

1. Introduction

With the development of wireless sensor networks, Internet of Things (IoT) devices play an important role in smart cities. IoT devices in e-payment and e-voting services are crucial for modernisation [1,2,3]. Meanwhile, a large amount data generated by these IoT devices face the threats of security and privacy leakage since the state-of-art authentication protocols in e-payment and e-voting systems can be attacked by quantum computers successfully [4], i.e., in e-payment and e-voting systems, blind signature (BS) is crucial to protect user privacy and guarantee trustworthy of big data in the cloud  [5,6,7,8]. However, these schemes based on traditional number theory can be attacked successfully by quantum computer.

BS was firstly introduced by Chaum. Then many BS schemes based on number theory were proposed [9], which can be presented as follows:

The first factoring BS scheme based on RSA was proposed by Chaum, this scheme can guarantee the security of payer. However, they did not prove its security. Later, Bellare et al. defined the hard problem of RSA formally. Based on it, they proved the security of Chaum’s scheme. Then a novel proven-secure RSA scheme was proposed by Camenisch and Koprowski etc., it was secure in the standard model. However, these schemes have to use long keys to guarantee security.

In order to overcome the shortages of factoring BS schemes, BS schemes based on discrete logarithm problem (DLP) were proposed for their short keys and high security. Chaum et al. proposed an e-wallet. Later, Okamoto proposed a BS scheme based on DLP. However, these schemes were not proven secure and only satisfy blindness. Then Pointcheval et al. initially considered the property of unforgeability.

After that, researchers were interested in constructing provably-secure BS schemes based on bilinear pairing. Boldyreva proposed a BS scheme based on GDH assumption, this scheme outperformed the other existing schemes in attribution and efficiency. Later, Okamoto proposed a BS scheme based on 2SDH assumption, which is stronger than SDH assumption. However, their efficiency is low.

Meanwhile, all the schemes outlined above need to depend on Public Key Infrastructure (PKI). In order to simplify key management of PKI, an identity-based signature scheme (IDS) was firstly presented by Shamir. In an IDS scheme, given a user’s identity, his public key can be easily obtained. Also, his private key can be obtained easily. Until 2001, Boneh et al. initially proposed an IDS scheme, it has high efficiency, its security is dependent on the bilinear pairing problem. Then some new IDS schemes based on pairing were proposed by researchers. After that, combining BS with identity-based signature, Zhang et al. initially presented an identity-based BS (IDBS) scheme, its security is based on hard problem of bilinear pairing, this scheme was secure and efficient. Unfortunately, its computation cost was too high. Later, a new IDBS based on DLP was presented, the running time and signature size of their scheme [10] were significantly improved. However, these schemes still face the threat of quantum computer attack [4].

Thus, the replaceable IDBS schemes are based on lattice for their high-efficiency and sufficiently secure to quantum computer attack [11,12]. In the paper, a lattice-based IDBS scheme is proposed by using the advantages of number theory research unit lattice (NTRU) such as high efficiency, extremely tight keys, and sufficient safety once properly parameterized.

Inspired by [13,14,15], we propose a new IDBS scheme on NTRU Lattice (named IDBS-NTRU), which can be secure to resist quantum computer attack.

We evaluate our IDBS-NTRU’s security. We demonstrate that the proposed scheme is secure. Then we prove that the proposed scheme satisfies confidentiality, integrity, and non-repudiation.

We compare our IDBS-NTRU’s performance with the other IDBS schemes.

Comparing with existing traditional IDBS schemes, its signing speed is faster than other schemes, its moves are shorter than other schemes, its signing secret key, and signature size are larger than other schemes.

Comparing with existing lattice-based BS schemes, its signing speed is faster than other lattice-based BS schemes, its moves are shorter than Rückert and ZM schemes, its signing secret key is smaller than other lattice-based schemes, and its signature length is smaller than Rückert scheme.

Organization. Section 2 presents the definitions of NTRU lattice and IDBS. Section 3 shows how to design an IDBS scheme. Section 4 proves the proposed IDBS’s security, and compares with the existing IDBS schemes in terms of performance. Lastly, we conclude the paper in Section 5.

2. Preliminaries

2.1. The Applications for BS

With the development of big data, which has the properties of volume, variety, velocity, value, veracity, variability, viscosity, and virality, organizations deploy their services such as e-payment and e-voting systems etc. to the cloud [16,17,18]. In e-payment and e-voting systems, BS scheme plays an important role for that BS scheme can protect user’s anonymous instead of encrypting all the data and searching on the ciphertexts [19,20,21]. In addition, scholars proposed some methods to protect security in the cloud [22,23,24,25], which can provide us with new methods to make our scheme in practice. Meanwhile, scholars proposed some methods to detect complex event analysis, which can be used to improve the security of these services and applications in the cloud [26,27]. We will briefly describe e-payment and e-voting systems as follows:

E-payment system: A, B, T, and  are denoted as buyer, merchandiser, trusted third party, and bank respectively. Then the e-payment process is presented in Figure 1 [4]. In the beginning, T will produce and deliver keys for all the s, will open a new account from their respectively. The details are as follows:

Figure 1

Blind authentication in e-payment system.

A logins into his account, draws e-cash m from the -A, blinds m by using blind factor f, and then obtains . The -A signs on , and sends the signature to A [28]. A unblinds the signature by using f and obtains . A sends the tuple to B. B verifies whether it is valid or not, if it is, he sends the tuple to -B. The -B deposits the money on B’s account.

E-voting system: the voter, registrar, administrator, tallier, nominators, and validator are denoted as , , , , , and  respectively. The protocol is presented in Figure 2 [4]:

Figure 2

Blind authentication in e-voting system.

sends his id to a , the checks whether the is valid. If he is, the can send two to , the will check whether they are valid. If they are, the can choose a ballot m, blind it by using blind factor f, and then get the blinded message . will be sent to a , the signs on it and sends the signature to the . The  unblinds by using blind factor f, and gets a signature . The  sends to a , the will count all his ballots and store the results to a voting database.

2.2. NTRU Lattice, Gaussians Sampling and Rejection Sampling on Lattice

Let and be the vectors, p and be integers, q be a prime which is greater than 5. Then we denote as a ring. We denote and as polynomials in R. is a set that all the elements have inverse in R. We write as vectors’ inner product and as ’s Euclidean norm. We write as the ring. We denote polynomial multiplication and concatenation as mod and in R respectively.

Next, we introduce the definitions of NTRU lattice, Gaussians sampling [29], and Rejection sampling [14]. NTRU lattice is used for constructing NTRUEncrypt and NTRUSign. These cryptosystems have high-efficiency, extremely tight keys, and are sufficiently secure once properly parameterized. The NTRU lattice is introduced as follows:

(NTRU lattice). Let

The security of our IDBS is based on R- problem over NTRU lattice, it is defined as follows:

( on NTRU lattice). in a ring

Gaussian sampling was used for constructing the trapdoor in [29], i.e., a short basis was used to construct the trapdoor without revealing anything about this basis.

(Discrete Gaussian Distribution). for

Given real , negligible probability , a lattice , and its smoothing parameter , there always exists for given any function. If , then the total Gaussian measure on all the kinds of translation of the lattice is the same according to Lemma 2.7 in [29]. If , then . If , then the min-entropy of is at least according to Lemma 2.10 in [29].

The two events occur with probability

Input: B, , c

Output: v

and .

for( to 1)

(a)

(b) choose

(c) and

end for

return

Next, we begin to introduce the Rejection-sampling. In a signature scheme, rejection sampling can make the output signature distribution not depend on the signing key.

[Rejection Sampling Theorem] V is the subset of

In particular, when is positive, then , the first algorithm’s distribution does not exceed the second algorithm’ statistical distance . The first algorithm outputs something with probability at least .

2.3. IDBS

An IDBS scheme consists of four algorithms , , , and  are denoted as user, signer, and verifier respectively. Master key, master public key, and master private key are severally written as , , and . System parameters are denoted as , n is the security parameter. The definition is described as follows.

: after inputting n, this algorithm outputs and , which contains and .

: after inputting , , , this algorithm outputs private key related to .

: interacts with as follows:

blinds the message m to by using blind factor, then sends to .

signs on and sends the signature to .

unblinds and gets . The signature tuple is .

: this algorithm returns true if is valid, otherwise returns false.

Before introducing the security properties of IDBS, we define some notations firstly. is denoted as an adversary, U is nonmalicious users, m is the plaintext message, are denoted as a constant and a big integer respectively, is a negligible probability, t is the time.

IDBS should achieve two properties, which are defined as follows [30,31]:

[32]: chooses two messages , then a random bit i is selected, are randomly denoted as , are the inputs of two honest users respectively. plays the Experiment 1 with these two users, are the outputs of them respectively. are dispatched to , after that, will output a bit . Finally, the probability of is denoted as . i.e., if no can win the Experiment 1 at the minimum with in t, then it satisfies blindness.

[4]: after interacts with a nonmalicious signer for l times, he tries to forge the valid signature with . The game is defined in Experiment 2. i.e., if cannot win the Experiment 2 with at most times respectively for extraction, hash, and signature oracles in t, then the scheme satisfies one-more unforgeability.

, are respectively ’s outputs

if and then

else

end if

return true iff

l is the successful interaction number between and signer

return true iff

for and

and

3. Proposed IDBS-NTRU Scheme

Most IDBS schemes are designed with the traditional number theorem; these schemes cannot defeat a quantum computers attack. So the replaceable IDBS schemes are based on lattice. Meanwhile, NTRU-cryptosystems have some advantages, such as high-efficiency, extremely tight keys, and sufficient safety after properly parameterized. Therefore, we choose the NTRU lattice to construct a novel IDBS scheme so that we can achieve both security and efficiency.

In this section, we will firstly introduce how to construct an IDBS scheme on NTRU lattice, then we design an e-payment protocol using our proposed scheme.

3.1. IDBS-NTRU Scheme

In this section, we propose our IDBS scheme . Let , , be a user, a signer, and a verifier respectively, N and be security parameter and user’s identity respectively, and be the asymptotic lower bound and N’s polynomial function respectively [13].

outputs , in which , , and . If , then , . If , then , . is generated as follows [13]:

The algorithm samples from , which satisfy . Meanwhile, and . Then the algorithm computes , which satisfy . We compute , and then obtain () by using babai algorithm in [11], which satisfies , . If , then outputs sk = = and .

computes , and , in which . Then the algorithm outputs to user [13].

: Let be the plaintext, randomly selects , then executes BS protocol in Figure 3.

Figure 3

Proposed IDBS-NTRU protocol.

computes and then sends to .

computes Equations (3) and (4), then sends to .

Here, we will explain how to use the rejection sampling theorem, Theorem 1 from Section 2.2. The core idea of this theorem is to make do not rely on the private key respectively. Our target is that the distribution of will obey the distribution . However, obey the distribution , where or , , and . After we appropriately choose a certain M and , the algorithm will approximately output a signature tuple with probability , whose distribution is approximate to the distribution where are chosen from [14].

Finally, gets the signature tuple <> from Equations (5) and (6) with probability , in which M is a constant.

: validates whether Equations (7) and (8) is true. If it is, accept it. Otherwise reject it.

3.2. An E-Payment Protocol

In this section, we design an e-payment protocol based on NTRU-IDBS scheme, which plays an important role in e-commerce. We will still follow the notations in Section 2.1. As described in Figure 4, A’s account belongs to , B’s account belongs to . Firstly, A draws e-money from . Secondly, A pays the money to B. Finally, B deposits the money to . Following is the details:

Figure 4

A buys goods from B.

T produces and sends keys

T runs the algorithm and produces the system parameter and master key .

T runs algorithm and generates the keys for and .

’s public key and private key are respectively.

’s public key and private key are respectively.

T distributes the corresponding private keys to and .

user opens an account from Bank

A and B open an account using their real identity, such as passport, ssn, address, email, male, age, and so on, their banks will give them their account information respectively.

A draws e-money from

A send their account information to .

will verify whether he is a valid user. If it is, continue. Otherwise, abort.

A wants to draw money m, he will randomly choose vectors , computes and to obtain .

A sends m with the blinded note to .

computes , for , and generates the signatures and , then records on the account of A.

Next, the bank returns to A.

A computes and to get .

A pays the e-money to B

A sends to B.

B computes , and checks whether all of them are true. If all are true, accept it, otherwise, reject them.

B deposits the e-money

B will send to .

computes and checks whether , and are true, if all of them are true, continue; otherwise abort.

checks whether the e-money is in the list. If it is, abort, otherwise, continue.

will deposit the e-money on B’s account.

will send a notice to B that B has received the e-money.

B will send the goods or receipt to A.

4. Analyzing the Security and Performances

Here, we evaluate our IDBS-NTRU scheme with regard to correctness and security, then we compare the IDBS-NTRU scheme with other IDBS schemes in terms of performance.

(Correctness). The IDBS-NTRU scheme is correct.

Following our IDBS-NTRU scheme, we can get

Thus, .

By using Lemmas 2 and 3 in [13], the distributions of are close to , are the vectors from . So the probability of is at least . Then we can get .

To prove IDBS-NTRU scheme’s blindness, we introduce the statistical distance theorem, that is crucial to prove blindness property. ☐

(Statistical Distance Theorem). let random variable number

4.1. Correctness, Blindness and One-More Unforgeability

When we prove IDBS-NTRU’s blindness, the malicious will play the Experiment 1 with two trust users respectively.

(Blindness). The IDBS-NTRU satisfies blindness.

A random bit is chosen, which is kept secret from . Then chooses , then interacts with two honest users as in Experiment 1. Following is the protocol:

Under finding mode, selects .

Under issuing mode, a random bit i is selected randomly, that cannot be obtained by . Then are randomly denoted as respectively. concurrently interacts with and .

If one user outputs , the other outputs , we will send a sequence < > to .

Under guessing mode, returns .

As in Figure 3, the Interactive values do not depend on m, so what we need to do is analyzing .

For , the statistical-distance is defined as follows

For is a random vector from Discrete Gaussian distribution, we can get the follow equations is close to , is close to . Therefor, we can get is close to 0.

Similarly, we can get , , , and are close to 0. Therefore, cannot recognize m from , i.e., wins the experiment with probability . Therefore, we prove the theorem.

Before proving the one-more unforgeability of IDBS-NTRU, we will define some notations as follows:

Let be simulating the cost functions of H hash, extract oracle, hash, and signature oracles respectively. Let be non-negligible probability, and t be time respectively, be a polynomial time algorithm, and be a polynomial time forger. ☐

(One-more Unforgeability). If

Assuming an adversary is able to produce an IDBS signature with , we can construct , this algorithm can obtain the solution of R- on the NTRU lattice. The followings are the simulated interactive environment.

ST: selects , at random. Then computes and sends the public parameters to the .

H oracle Queries: will maintains a list , in the beginning, the list is mull. Once receiving an , will inquire . If there exists a corresponding hash value , will return . Otherwise will return a random value. After that, will save in .

H oracle Queries: maintains a list , in the beginning, the list is null. Once receiving , we assume has already quire H oracle and gotten an entry . Then will quire . If there already exists a corresponding hash value , will return . Otherwise, will return a random value. After that, will save to .

EX Oracle Queries: maintains a list , in the beginning, the list is null. Once receiving an identity , will inquire H oracle. If there does not exist a corresponding hash value in , will randomly selects a and return it. Otherwise, return the corresponding . After that, can get a , returns to as the private key related with and saves the tuple in .

SG Oracle Queries: queries the signing oracle for . checks if is already queried for H, or extraction oracles. If it is, can get an entry from . Else simulates the extraction oracle and obtain a new secret key. Then executes the BS protocol to obtain a valid signature and stores the value in the list .

Output: Finally, firstly outputs a forged signature . rewinds to the point where it queries for and obtains another signature .

Therefore, can solve R- problem over the NTRU lattice. obtains and from the . computes , and . Then checks whether . If they are not equal, there is a collision of . If , we can get and . So is one solution to R-.

Now we start to analyze the advantage of . As discussed above, wins the game if and only if has successfully forged and . Next according to the Lemma 4.6 in [34], can solve R- with probability at least , where . It is obviously that . We prove this theorem. ☐

4.2. Performances

Here, we will compare our IDBS-NTRU’s performances with other IDBS schemes. First of all, we will compare NTRU-IDBS scheme with traditional IDBS schemes in terms of performance, which were constructed based on number theory. Secondly, we will compare our IDBS-NTRU scheme with lattice-based BS schemes in terms of performance.

(1) Comparing with traditional IDBS schemes

As shown in Table 1, we compare IDBS-NTRU’performance with ZK scheme [35], HCZ scheme [10], and CZYW scheme [36]. The ZK scheme is constructed based on computational diffie-hellman problem of bilinear pairings. The HCZ scheme is constructed based on discrete logarithm problem of ellipse curve. The CZYW scheme is constructed based on big integer factoring problem. The IDBS-NTRU scheme’s signing speed and verification speed are O(n), which outperform ZK scheme, HCZ scheme, and CZYW schemes. Its moves are 2, it is shorter than ZK scheme and HCZ scheme. Its signing secret key is , it is larger than ZK scheme and HCZ scheme. However, the rsa has to use to achieve n bits security, the signing secret key of IDBS-NTRU scheme is shorter than CZYW scheme. The signature size of IDBS-NTRU scheme is , it is larger than ZK, HCZ, and CZYW schemes. For the same reason, it is also shorter than CZYW scheme. The most important of all, the BS schemes based on number theory are considered to be insecure to resist quantum computers attack [4], our IDBS-NTRU scheme is more secure than other three traditional schemes.

Table 1

Performance comparison with traditional IDBS schemes.

IDBS Scheme	ZK  [35]	HCZ [10]	CZYW [36]	Ours
Hard Problem	CDHP	DLP	Factoring	R-SIS
Signing Speed	O(n^3)	O(n^3)	O(n^3)	O(n)
Verifying Speed	O(n^3)	O(n^3)	O(n^3)	O(n)
Moves	3	3	2	2
Signing Secret key	2n	logk+2n	n	2nlog(sn)
Signature size	3n	logk+4n	n	2nlog(12σ)+n(logλ+1)

(2) Comparing with lattice-based BS schemes

We compare IDBS-NTRU’s performance with GHWX [37], ZTZ [4], Rückert [32], and ZM schemes [38] in Table 2, n denotes safety parameter. GHWX scheme and ZM scheme are constructed based on small integer solution problem of lattice. ZTZ scheme is constructed based on closest vector problem of lattice. Rückert is constructed based on ideal-lattice shortest vector problem.

Table 2

Performance Comparison with lattice-based BS schemes.

Lattice-BasedBS Scheme	GHWX [37]	ZTZ [4]	Rückert [32]	ZM [38]	Ours
Hard Problem	SIS	CVP	ISVP	SIS	R-SIS
Signing Speed	O(n^2)	O(n^2logn)	O(n(logn)^c)	O(n^2)	O(n)
Verifying Speed	O(n^3)	O(n)	O(n)	O(n^3)	O(n)
Moves	2	2	4	3	2
Signing secret key	nmlog(q+1)	dn^2(logn+1)	mnlog(2d_s+1)	m^2log(q+1)	2n log(sn)
Signature size	mlog(q+1)	dn(logn+1)	n^2+mn log(2mnd_sd_ϵ^∗)	2mlog(q+1)	2nlog(12σ)+ n(logλ+1)
Identity Based	yes	no	no	yes	yes

As presented in Table 2, IDBS-NTRU’s signing speed is , which outperforms all the other schemes. IDBS-NTRU’s verification speed is , which outperforms GHWX and ZM schemes. Our IDBS-NTRU scheme has two moves, it is shorter than Rückert scheme, and ZM scheme. In Rückert scheme, the parameters satisfy , . In ZM schemes, the parameters satisfy . The signing secret key of our IDBS-NTRU scheme is , it is shorter than all the other schemes. The signature size of our IDBS-NTRU scheme is , it is shorter than Rückert scheme, but it is larger than GHWX, ZTZ, and ZM schemes. The ZTZ scheme and Rückert scheme are not identity-based scheme, they depend on the public key infrastructure. However, our IDBS-NTRU scheme does not need to dependent on public key infrastructure.

5. Conclusions

In this work, we present an IDBS-NTRU scheme by using NTRU lattice, this scheme can protect user privacy and guarantee the trustworthy of big data in e-payment and e-voting systems in wireless sensor networks, this scheme has the advantages of NTRU Lattice such as high efficiency, compact key, high security after appropriate parameterized etc. Our scheme is secure and efficient. Furthermore, we prove IDBS-NTRU satisfies blindness and unforgeability. In addition, comparing with traditional IDBS schemes, IDBS-NTRU outperforms other IDBS schemes in terms of signing speed and verifying speed. Comparing with lattice-based schemes, IDBS-NTRU scheme outperforms other schemes in terms of signing speed, verifying speed, and signing secret key, outperforms Rückert scheme in terms of signature size moves and signature size, and outperforms ZM scheme in terms of moves. The schemes based on number theorem are considered insecure to resist the quantum computers attack, so our scheme is more secure than them. Furthermore, lattice-based schemes usually have a lot of parameters which need to be initialized correctly, these schemes are not easy to implement. Therefore, almost all the works related with lattice-based cryptography are still in the step of theory research.

In addition, if we can add some common message such as date between the signer and a user in our scheme, it is easy to transform our scheme into an identity-based partial BS scheme, which is suitable for the real e-payment and e-voting systems. In the future, we will continue to construct a partial IDBS scheme based on lattice.