Message Integration Authentication in the Internet-of-Things via Lattice-Based Batch Signatures.

The internet-of-things (also known as IoT) connects a large number of information-sensing devices to the Internet to collect all kinds of information needed in real time. The reliability of the source of a large number of accessed information tests the processing speed of signatures. Batch signature allows a signer to sign a group of messages at one time, and signatures' verification can be completed individually and independently. Therefore, batch signature is suitable for data integration authentication in IoT. An outstanding advantage of batch signature is that a signer is able to sign as many messages as possible at one time without worrying about the size of signed messages. To reduce complexity yielded by multiple message signing, a binary tree is usually leveraged in the construction of batch signature. However, this structure requires a batch residue, making the size of a batch signature (for a group of messages) even longer than the sum of single signatures. In this paper, we make use of the intersection method from lattice to propose a novel generic method for batch signature. We further combine our method with hash-and-sign paradigm and Fiat⁻Shamir transformation to propose new batch signature schemes. In our constructions, a batch signature does not need a batch residue, so that the size of the signature is relatively smaller. Our schemes are securely proved to be existential unforgeability against adaptive chosen message attacks under the small integer solution problem, which shows great potential resisting quantum computer attacks.

1. Introduction

IoT connects all kinds of objects with the Internet, through various sensing technologies and various means of communication, to achieve remote monitoring and other purposes [1,2,3,4]. Because of large numbers of nodes, wide sources of information and fast updating of information, information authentication processing is very stressful, which brings forward a new research topic for digital signature.

Digital signature was firstly defined and designed in [5,6,7]. This security mechanism allows a message owner to put digital "stamp" on a message to declare the corresponding ownership. Since its introduction, digital signature has been widely employed in many real-world applications, e.g., authentication [8], message integrity check [9], electronic voting, electronic property ownership proof (cryptocurrencies—https://bitcoin.org/en/) and other cloud-based applications [10,11,12]. Due to various of construction techniques, there are many variants of digital signature systems by far, e.g., El-Gamal [13], RSA-based [7], DSA and ECDSA. When it comes to the environment of IoT, batch signature, which is a variant of conventional digital signature, is a good choice.

1.1. Batch Signature

The notion of batch signature was firstly proposed by Fiat [14] in CRYPTO 1989. It allows a valid user to sign many messages with almost the cost of one signature operation. In other words, batch signature scheme could sign multiple messages simultaneously. Like carbon paper, someone only needs to sign the top file once by inserting each file in the middle of the carbon paper, all the documents are signed, and each message can be independently verified by recipients. This cryptographic primitive has greatly improved the efficiency of signing a large number of messages.

Following Fiat’s seminal work, a lot of works on batch signature have been proposed. In 1996, M’Raïhi and Naccache [15] gave a batch exponentiation strategy, and applied it to the batch generation of fixed-g-based signatures. In 1999, Pavlovski and Boyd [16] presented a batch signature scheme based on binary tree structure. Binary tree structure is a general construction to transform a common signature algorithm into a batch signature algorithm. In addition, Cheng et al. [17] and Korkmaz [18] analysed the efficiency of existed batch signatures independently.

Besides theoretical construction, there are many more scenarios to apply batch signature technology. In 1999, Boyd et al. [19] proposed an efficient electronic cash using batch signatures. In 2008, Youn et al. [20] applied batch signature in imbalanced communication. We find batch signature is also indispensable in IoT and blockchain. In IoT, when messages from multiple sensor nodes are imported into the host, batch signature of messages is a good way to improve the efficiency of signature. In blockchain, multiple transactions could be handled simultaneously in one-block-generated time. We may save time and space cost by using batch signature scheme.

Faced with a large number of application requirements, the theoretical research of batch signature is not perfect. There are some defects about the existed batch signature, for example, the limited number of signed messages, dependence of signature verification on batch residue and the risk of anti-quantum algorithm attack.

1.2. Lattice-Based Signature

The above constructions are based on the traditional number theory assumptions. According to Shor’s results [21], they can not resist the quantum computer’s attack. In the aspect of anti-quantum, lattice-based cryptography is a hot spot for cryptologists, due to the following three advantages. Firstly, large integer factorization and discrete logarithm problems have been proven to be unable to resist quantum computer’s attacks, meanwhile, there is no quantum algorithm that could solve hard problems in lattice. Secondly, cryptographic schemes based on the difficulty assumptions of the average case lattice problems can be reduced to the difficulty assumptions of the worst case lattice problems. It means that the security of cryptographic schemes built on average case lattice problems depends on the worst case lattice problems. The majority of public key cryptosystems are lack of this feature. Thirdly, most of the operations in the lattice are linear operations, so that lattice-based cryptographic schemes have potential computational efficiency.

Lattice-based cryptography has achieved many results. Ajtai [22] proposed the small integer solution problem, known as the SIS problem, in 1996. It is an average case problem hard to solve for appropriate parameter settings, and its difficulty is based on worst case lattice hard problems. The SIS problem, as well as its extension, the inhomogeneous small integer solution problem ISIS, forms the foundation of lattice-based signature schemes.

The most important theoretical breakthrough of lattice-based signature began with the signature scheme in [23]. The main structure of this signature scheme includes a trapdoor generation algorithm and preimage sampleable algorithm; these two algorithms are both with relatively large computational complexity, which hinders the practicability of signature schemes.

In order to solve the efficiency problem of signature schemes, cryptologists have considered the issue from many different perspectives. Alwen and Peikert [24] showed the techniques to get better trapdoor at a faster speed. Micciancio and Peikert [25] proposed a different structure, converted the general lattice trapdoor generation algorithm into a simple lattice trapdoor generation algorithm, and designed a more efficient trapdoor generation algorithm. As a by-product of this new algorithm, the efficiency of preimage sampleable algorithm has also been greatly improved. Therefore, the signature scheme in [25] has better efficiency and security.

Signature schemes in [23,25] have the same construction idea and both belong to the hash-and-sign paradigm. In 2012, Lyubashevsky [26] followed the Fiat–Shamir transformation, managed to avoid the use of trapdoor generation algorithm and preimage sampleable algorithm, and constructed more efficient signature schemes using matrix-vector multiplications and rejecting samplings. These signature schemes make the lattice-based signature schemes practical. Since then, lattice-based signature has continued with more and more contributions, but the core idea still follows the above mentioned signature schemes from [23,25,26].

1.3. Our Contributions

In this paper, we propose lattice-based batch signature schemes. Our batch signature schemes remove the batch residue in [19], which makes our batch signature has the same length as one ordinary signature.

We propose lattice-based batch signature schemes for the first time. Our schemes possess a general property, that is, our construction can be combined with any existing lattice-based signature scheme.

The technique we use is an extension of the intersection method from [27]. The intersection method is as follows: for —dimensional integer lattices and such that and , there exists a short vector , which belongs to and can be viewed as a signature of and .

We demonstrate this technique with a concrete example in terms of . In detail, let , with k primes . Because are different primes, and . Therefore, for k messages , there exists a short vector , which binds and can be viewed as their batch signature.

With the intersection method as core technique, we give two batch signature schemes based on hash-and-sign paradigm and Fiat–Shamir transformation, as well as a lattice-based batch signature scheme based on binary tree.

1.4. Organization

Our paper is organized as follows. First, we give some basic definitions and facts about lattice-based cryptography in Section 2. Then, we describe batch signature scheme definition and security in Section 3. In Section 4, we give lattice-based batch signature scheme based on binary tree. In Section 5, we propose lattice-based batch signature scheme based on hash-and-sign paradigm and the intersection method. In Section 6, we demonstrate lattice-based batch signature scheme based on Fiat–Shamir transformation and the intersection method. In Section 7, we present the comparison of our schemes with other lattice-based batch signatures, then describe batch signature’s application to IoT. Finally, we conclude the paper in Section 8.

2. Preliminaries

We make use of standard asymptotic notations in our paper. For any function and with positive real value set as range, means that there are constants a and b such that for all ; if and only if ; if and only if ; is negligible if and only if for any polynomial ; is overwhelming if and only if is negligible.

is the discrete Gaussian distribution in,its center isand Gaussian parameter is s. If the center is vector, may be omitted. If,its Euclidean norm iswith overwhelming probability [

Trapdoor generation algorithm TrapGeninputs n, q and m, where n is an integer,is an odd, andis the minimum integer not less than.The algorithm outputs a pairsuch thatis statistically close to a uniform random matrix in, is a basis forsatisfyingandwith overwhelming probability. Here,is the Gram-Schmidt orthogonalization matrix of, denotes the largest Euclidean norm of the column vectors in matrix[

Let,is a basis for,and. Then for,preimage sampleable algorithm SamplePresamplessatisfyingand[

Small integer solution (SIS) [

SIS problem is defined as: for integer q, real β and matrix , search an integer vector satisfying , and .

The intersection of lattice and lattice is not empty, and for element wise addition. are the coset representatives of and , respectively. Then there exists a vector such that and . This result can be generalized to multiple lattices [

Target Collision Resistant (TCR) Hash function [

Let is a collision-resistant hash function if it satisfies the following properties:

(length-compressing):

(hard to find collisions): For all PPT A, there exists a negligible function ϵ such that for all security parameters,

3. System Definition and Threat Model

In this section, we give batch signature definitions of generic algorithms and security, which divide into two parts.

3.1. Definition of Batch Signature System

Batch signature can use a signing action to complete the signing of a number of different messages, and the verification of individual message is independent. Besides, the system setup algorithm and key generation algorithm in batch signature scheme are as same as that of ordinary signature scheme.

Setup(): Inputting security parameter , this algorithm determines necessary system public parameters .

KeyGen(): With security parameter and system parameters as above, this algorithm provides public verification key and secret signing key .

Sign(): Given signing key and messages set , this algorithm computes batch signature e.

Verify(): Given message and its signature e associated with verification key , this algorithm tells whether the j-th message has gained valid authentication, and outputs 1 if the answer is yes, otherwise outputs 0.

3.2. Threat Model

Batch signature scheme should also satisfy existential unforgeability against adaptive chosen message attacks (EUF-CMA). We introduce a challenger and an adversary interacting with each other in the next game, to describe batch signature scheme’s security.

Initialization: In this period, challenger executes algorithms Setup and KeyGen, provides system public parameters and public verification key for adversary .

Signing queries: In this stage, adversary selects a set of messages , sends the messages’ set to challenger for the associated signature. Challenger invokes Sign algorithm, returns the result to adversary . Adversary may repeat the query polynomial times in his favorite manner.

Forgery: Once adversary terminates signing queries, he offers a new message-signature pair .

If message-signature pair is valid and has not been queried, adversary wins the game.

Batch signature scheme is existential unforgeability against adaptive chosen message attacks(EUF-CMA), if for all adversary

4. Lattice-Based Batch Signature with Binary Tree

4.1. Proposed Construction

In this part, we combine the signature scheme in [23] and the structure of binary tree in [19], propose the first lattice-based batch signature scheme. The scheme includes the following steps, and the Figure 1 shows the binary tree for message processing.

Figure 1

The Schematic of the Binary Tree.

Setup(): In this stage, system parameters are provided with knowledge of security parameter .

n is a polynomial of , is a polynomial of n, , .

k is the number of messages to batch sign, and is the Gaussian parameter.

and are two collision resistant hash functions.

KeyGen(): With system parameters as above, public verification key and secret signing key are obtained as follows. Invoke trapdoor generation algorithm TrapGen to get a uniform and random matrix , and the short basis for lattice with .

Finally output , .

Sign(): Given and the set of messages , the following steps lead to batch signature on such messages.

Compute , ,⋯, , let , and execute for-loop as follows.

for to :

Compute SamplePre.

For , compute its brother . Firstly, , the left are shown in the next for-loop.

for to :

Here, for ’s brother , its first entry denotes ’s brother note, its second entry denotes the brother locates on ’s left or right .

For , compute its residue . At first,

,

the left are shown in the next for-loop.

for to :

When , .

Here, ’s residue includes ’s brother and all of its ancestor nodes’s brothers.

For , its signature is .

Verify(): Given message and its signature associated with verification key ,

should be recovered firstly.

(1) If ,

,

for to :

When for-loop terminates, is obtained.

(2) If ,

,

for to :

When for-loop terminates, is obtained.

Check whether and . If both relations are true, return 1 and accept the message-signature pair ; otherwise, return 0 and reject the message-signature pair.

4.2. Security Analysis

Correctness of the scheme comes from the preimage sampleable algorithm. According to Definition 3, for messages set , assume the root of the binary tree is , due to SamplePre, and hold. Moreover, without secret signing key , no one can call preimage sampleable algorithm to get a vector that meets the verification criteria. Therefore, there is no problem with the correctness of the scheme.

Security of the scheme comes from the following Theorem 2.

If SIS problem is hard to solve, the lattice-based batch signature scheme based on binary tree has existential unforgeability against adaptive chosen message attacks (EUF-CMA).

We assume that adversary has breached the signature scheme, taking advantage of this attack power, challenger can solve SIS problem for matrix . Because SIS problem is a hard problem, we ca not find the answer to SIS instance , which conflicts with our result. In this way, we get that no such adversary exists, and our scheme is secure.

Initialization: In this period, challenger executes setup algorithm to set system parameters, he sets public verification key , sends all of them to adversary .

Hash queries: Challenger creates a list to save the binary tree for k messages, and sets .

When adversary sends a set of messages to challenger for hash values. searches list ,

If do not exist in list , chooses , sets . Then randomly picks , , sets for to , here . saves in the list .

If exist in list , does nothing.

At last, returns to adversary .

Signature queries: In this stage, adversary selects a set of messages , sends the messages’ set to challenger for the associated signature. Challenger firstly searches list for the messages’ set. If it exists, returns to adversary . If the messages’ set does not exist, executes hash query firstly. Adversary may repeat the query polynomial times in his favorite manner.

Forgery: Once adversary terminates signing queries, he forges a valid message-signature pair .

searches in list , then computes as the solution to the SIS instance , and the analysis is as following.

Due to the validity of the message-signature pair, adversary has not made signing query on , and hash query on has been done. Given , according to preimage min-entropy property of hash function [23], the min-entropy of is , so that with overwhelming probability. Because , . depends on the validity of forged signature. Therefore, .   □

5. Lattice-Based Batch Signature Based on Hash-and-Sign Paradigm

Lattice-based batch signature scheme based on binary tree is successfully constructed and proved, but the signature should associate with all other messages in the batch to complete signature verification, and batch signature length is, thus, longer. Inspired by [27,29], we make use of an intersection method to accomplish the second and third lattice-based batch signature schemes. These two schemes’ signature verification does not require involvement of other messages, so that the length of the signature is shorter, and their schematic of algorithms is shown in the Figure 2.

Figure 2

The Schematic of the Intersection Method.

5.1. Design

Here is our second lattice-based batch signature scheme, which follows the hash-and-sign paradigm and the core technique is the intersection method.

Setup(): In this stage, system parameters are provided with knowledge of security parameter .

n is a polynomial of , is a polynomial of n, , .

k is the number of messages to batch sign, and is the Gaussian parameter.

is a collision resistant hash function.

KeyGen(): With system parameters as above, public verification key and secret signing key are obtained in the following manners.

Invoke trapdoor generation algorithm TrapGen to get a uniform and random matrix , and the short basis for lattice with .

Compute k different lattices , such that and , which takes q as modulus.

Then , .

Sign(): Given and the set of messages , the following steps lead to batch signature on such messages.

Construct equations: compute its solution .

Invoke preimage sampleable algorithm SamplePre to get the signature .

Verify(: For the j-th message and the signature , validation involves the following two relations:

.

.

If they are both true, accept message ; otherwise, reject it.

5.2. Security Analysis

Correctness of the second scheme is similar to that of the first scheme. By Definition 3, and . By Definition 2, . Combining and , . Moreover, without signing key , nobody can invoke preimage sampleable algorithm to get a vector satisfying the verification relations.

Security of the scheme comes from the following Theorem 3.

If SIS problem is a hard problem, the lattice-based batch signature scheme based on hash-and-sign paradigm has existential unforgeability against adaptive chosen message attacks (EUF-CMA).

If there exists an adversary who has the ability to forge batch signature for some messages, there exists a challenger has the ability to give the solution to SIS instance , here the challenger will seek the help of the adversary . Since SIS problem is a hard problem, the solution to SIS instance is hard to obtained, this is in contradiction with our result. Therefore, the adversary who has the ability to forge batch signature does not exist, and our lattice-based batch signature scheme based on hash-and-sign paradigm has EUF-CMA security.    □

Initialization: In this period, challenger sets appropriate system parameters, lets public verification key , sends all of them to adversary .

Hash queries: Challenger creates a list to save the hash values for k messages, and sets .

When adversary sends a set of messages to challenger for hash values. searches list .

If exist in list , returns directly.

If do not exist in list , samples , sets , and lets , . Then saves in list , and returns to adversary .

Signing queries: In this stage, adversary selects a set of messages , sends the messages’ set to challenger for the associated signature. Challenger searches list for messages .

If the messages exist in list , challenger returns directly.

If the messages do not exist in list , Challenger firstly executes Hash query, then returns to adversary .

Forgery: Once adversary terminates signing queries, he offers a new message-signature pair .

Challenger searches in list , then computes as the solution to the SIS instance .

Because message-signature pair is valid, adversary has not made signing query on , and hash query on has been done. Given , according to preimage min-entropy property of hash function [23], the min-entropy of is , so that with overwhelming probability. Because , . depends on the validity of forged signature. Therefore, .

6. Lattice-Based Batch Signature Based on FS Transformation

In lattice-based cryptography, trapdoor generation algorithm (Definition 2) and preimage sampleable algorithm (Definition 3) are fundamental algorithms of signature scheme, but both algorithms have high computational complexity. To improve signature scheme’s efficiency, we take lattice signature based on Fiat–Shamir transformation in [26], apply to lattice-based batch signature with intersection method, obtain a new and more efficient batch signature scheme.

Setup(n): In this stage, system parameters are provided with knowledge of security parameter n.

q may be , d may be 1, r may be 512.

, satisfies .

s may be , and M may be .

and are collision resistant hash functions, where is the 1-norm of vector , namely, it is the sum of the absolute values of each element of vector .

KeyGen(n): With system parameters as above, public verification key and secret signing key are obtained in the following manners.

Select randomly as secret signing key.

Select , compute as public verification key.

Compute k different lattices , such that and , which takes q as modulus.

Then , .

Sign(): Given and the set of messages , the following steps lead to batch signature on such messages.

Construct equations: compute its solution .

Sample randomly, compute .

Let , output as signature with probability .

Verify(: For the j-th message and the signature , validation involves the following three relations:

.

.

.

If they are true, accept message ; otherwise, reject it.

6.2. Security Analysis

The batch signature scheme in Section 5 and the batch signature scheme in Section 6 are different in terms of basic signature schemes: the first basic signature scheme comes from the literature [23], the second basic signature scheme comes from the literature [26]. According to literature [30], for the same security, the second bath signature scheme has better efficiency.

The same as batch signature scheme in Section 5, the batch signature scheme in Section 6’s correctness and security can be reduced to its basic signature scheme, and the details are omitted here.

7. Efficiency Comparison and the Application to IoT

Refs. [14,15,16] are among the several most important batch signature schemes and improved techniques so far. Ref. [14] first introduced the idea and provide the construction based on RSA scheme. Later in [15], the authors focused on speeding up the modular exponentiation operation which is used in many DLP based signatures. In other words, the work [15] focuses on signature schemes which were built in the traditional multiplicative group, and then the authors in [16] managed to achieve the constant complexity for signature generation and verification, which does not rely on the number of messages. Our second and third schemes enjoy the same advantage as [16] regarding constant generation and verification complexity. Comparing the concrete efficiency for those schemes boils down to the issue of comparing the underlined algebraic primitives. According to [31], the key parameters, namely in our lattice based scheme should be chosen at around 500 and 200,000 to achieve approximately the 128-bit level security. Generally speaking, our signature size will be larger than the ones constructed in the group where DLP or ECDLP problem is hard. According to [32], the computation of the lattice is very fast, and at the same security level the current lattice scheme will outperform the RSA and DLP or ECDLP based schemes. Most importantly, up to now, none of the previous listed batch signature schemes are able to resist against quantum attacks, which makes our scheme a very attractive choice in a long run. Lattice primitives are also being optimized by taking advantage of the modern CPU instruction such as AVX, AVX2 and so on [33], thus, the computation speed can be expected to be further improved.

In our constructions, we make use of two different approaches to integrate a group of messages to fulfill batch signatures, namely, binary tree and intersection methods. The schemes are existentially unforgeable against adaptive chosen message attacks. Table 1 shows the efficiency of our scheme regarding the different signature stages and parameter sizes in the asymptotic manner. From Table 1, it can be seen that all of the schemes require complexity on the secret key generation, while the 2nd and 3rd constructions only take for the size of signature, which means that a batch signature is independent of the parameter k. For computational comparison, it can be seen that the 3rd construction requires least computational complexity, , while others have to take S and other operations. In the verification stage, the 2nd and 3rd scheme are constant cost instead of being linear with k, unlike the 1st construction. In all aspects, 3rd construction is the most efficient, and we describe its application in wireless body sensor network, which is a typical application of IoT.

Table 1

Efficiency comparison of our schemes.

Scheme (Size/Computation)	Our 1st Scheme (with Binary Tree)	Our 2nd Scheme (With Intersection Method)	Our 3rd Scheme (With FS Transformation)
sk	O(n^2log^3n)	O(n^2log^3n)	O(n^2log^3n)
vk	O(n^2log^2n)	O(kn^2)	O(kn^2)
signature	O(kn)	O(n)	O(n)
Sign	(2k−1)H+S+O(n^2)	O(n^3)+S	O(n^3)
Verify	2V+kH	2V+H	3V+H
Anti-quantum	√	√	√

Notation: denotes Hash function, denotes SamplePre, denotes verification.

A wireless body sensor network [34] is composed of three sides: a receiver station(RS), many central control units (CCU), and many sensors (SS). A receiver station manages multiple central control units and a central control unit manages many sensors. Specifically, A patient’s body is implanted with many sensors and a central control unit, which collects human medical data and sends it to the receiver station. The receiver station is responsible for verifying data and warehousing for all central control units, that is, the receiver station checks medical data and signs all of them. When a large number of medical data, which is from different patients, come in at the same time, the receiver station will become the bottleneck of data processing. Batch signature can solve the requirement of batch signing and individual verification for patients’ medical data; the process is as follows.

Firstly, according to the 3rd batch signature scheme, wireless body sensor network sets up system parameters and public/private keys for the receiver station. A central control unit collects medical data in real time and sends it to the receiver station. The receiver station divides k central control unit data into one group, such as , executes algorithm Sign(), obtain , store it with the message , . When the j-th central control unit’s data is called, ( is provided, and the algorithm Verify( can be invoked to verify the validity of data . If the answer is yes, the data is authoritative and credible. Otherwise, the data is unusable. The data flow diagram is shown in the Figure 3.

Figure 3

Data Flow Diagram in Wireless Body Sensor Network.

8. Conclusions

In this paper, we presented three new lattice-based batch signature schemes by using binary tree and intersection methods, with hash-and-sign paradigm and Fiat–Shamir transformation, respectively. Our schemes were existential unforgeability against adaptive chosen message attacks based on the difficulty of a small integer solution problem, which provided quantum security. A detailed efficiency analysis was also given, which showed that our schemes optimized the size of the public key, private key and signature. Moreover, we applied our batch signature schemes to a wireless body sensor network, which was a typical application of IoT, improved signature efficiency and security. In addition, batch signatures can also be applied to blockchain systems for speeding up the process of block signing operations, which we aim to be our next work.