Advertisement
Browse Subject Areas
?

Click through the PLOS taxonomy to find articles in your field.

For more information about PLOS Subject Areas, click here.

  • Loading metrics

Open Access

Peer-reviewed

Research Article

An improved pairing-free certificateless aggregate signature scheme for healthcare wireless medical sensor networks

  • Lifeng Zhou ,

    Contributed equally to this work with: Lifeng Zhou, Xinchun Yin

    Roles Conceptualization, Data curation, Formal analysis, Investigation, Methodology, Software, Visualization, Writing – original draft

    Affiliation College of Information Engineering, Yangzhou University, Yangzhou, Jiangsu, China

    ⨯
  • Xinchun Yin

    Contributed equally to this work with: Lifeng Zhou, Xinchun Yin

    Roles Funding acquisition, Project administration, Resources, Supervision, Validation, Writing – review & editing

    xcyin@yzu.edu.cn

    Affiliations College of Information Engineering, Yangzhou University, Yangzhou, Jiangsu, China, College of Guangling, Yangzhou University, Yangzhou, Jiangsu, China

    ⨯

Abstract

In healthcare wireless medical sensor networks (HWMSNs), the medical sensor nodes are employed to collect medical data which is transmitted to doctors for diagnosis and treatment. In HWMSNs, medical data is vulnerable to various attacks through public channels. In addition, leakage of patients’ information happens frequently. Hence, secure communication and privacy preservation are major concerns in HWMSNs. To solve the above issues, Zhan et al. put forward a pairing-free certificateless aggregate signature (PF-CLAS) scheme. However, according to our cryptanalysis, the malicious medical sensor node (MSNi) can generate the forged signature by replacing the public key in the PF-CLAS scheme. Hence, to address this security flaw, we design the improved PF-CLAS scheme that can achieve unforgeability, anonymity, and traceability. Since we have changed the construction of the partial private key, the improved PF-CLAS scheme can resist Type I and Type II attacks under the Elliptic Curve Discrete Logarithm assumption. In terms of the performance evaluation, the proposed scheme outperforms related CLAS schemes, which is more suitable for HWMSNs environments.

Citation: Zhou L, Yin X (2022) An improved pairing-free certificateless aggregate signature scheme for healthcare wireless medical sensor networks. PLoS ONE 17(7): e0268484. https://doi.org/10.1371/journal.pone.0268484

Editor: Pandi Vijayakumar, University College of Engineering Tindivanam, INDIA

Received: March 15, 2022; Accepted: May 1, 2022; Published: July 11, 2022

Copyright: © 2022 Zhou, Yin. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.

Data Availability: All relevant data are within the paper and its Supporting information files.

Funding: This work is supported by the National Natural Science Foundation of China (No. 61472343), funded by Xinchun Yin. The funder has the role in data collection, preparation of the manuscript, validation of the manuscript, review of the manuscript, and editing of the manuscript.

Competing interests: The authors have declared that no competing interests exist.

Introduction

With the rapid development of wireless body area networks, healthcare wireless medical sensor networks (HWMSNs) are driving the progress of intelligent medical treatment. In the current HWMSNs environment, patients use wearable and implantable medical devices from which multifarious medical data is collected [1]. Then the data is transmitted to doctors for real-time processing and feedback. Since the outbreak of COVID-19, hospitals have been using HWMSNs to monitor and treat the symptoms of patients [2]. However, medical data is transmitted through insecure public channels, and adversaries are able to eavesdrop on, tamper with, and forge the data readily [3, 4]. Upon tampering and forgery, doctors may make accurate diagnoses that can harm patients [5]. Furthermore, if the identities of patients are exposed in the form of plaintext, the patients’ real identities will be divulged [6–8]. Consequently, it is of great importance to guarantee secure communication and privacy preservation in HWMSNs.

In recent years, various technologies have been used for HWMSNs [9, 10]. To ensure the security of medical data, Mamta et al. [11] adopted the blockchain technology to design a decentralized and efficient attribute-based searchable encryption scheme. Nguyen et al. [12] put forward a blockchain-based intrusion detection and data transmission scheme that can realize the high-security level of the system. To guarantee secure communication and build trustworthiness among nodes in networks, Mirsadeghi et al. [13] presented a trust infrastructure-based authentication scheme by using digital signature and encryption technologies. Vijayakumar et al. [14] constructed a secure and lightweight communication scheme that can provide authentication and confidentiality to the multicast SMS communication. To achieve privacy preservation in HWMSNs, Xu et al. [15] proposed a sanitizable signature scheme that can hide the sensitive data of patients.

In 2003, a cryptographic technology called aggregate signature (AS) was proposed by Boneh et al. [16]. They showed that the AS can realize the authentication and integrity of the message with high efficiency, which makes it suitable for resource-constrained environments. Therefore, many authentication schemes using the AS have been proposed [17–22]. In 2004, Lysyanskaya et al. [17] constructed an ordered AS scheme based on a one-way function with trapdoors. Signers need to aggregate their signatures in the corresponding order. Whereas Lysyanskaya et al.’s scheme is based on the traditional public key infrastructure, which greatly increases the burden of key management and verification overhead. Soon after, Cheon et al. [18] proposed the first identity-based AS scheme that avoided complex certificate management issues. However, most identity-based AS schemes suffer from key escrow problems. Certificateless public key cryptography is considered one of the solutions to overcome these [23]. In [24], the full private key consists of the partial private key generated by the key generation center (KGC) and the secret value selected by the unmanned aerial vehicle. The aerial vehicle only knows its secret value and cannot achieve the partial private key of KGC. Hence, Gong et al. [20] extended the AS to certificateless public key cryptography and first proposed two certificateless AS (CLAS) schemes. Nevertheless, the complicated verification algorithm caused these two schemes to be inefficient.

Shortly after, the CLAS technology was widely applied to HWMSNs environments to address security and privacy problems. In 2018, Kumar et al. [25] designed a CLAS scheme to ensure the secure transmission of medical data in HWMSNs. Nevertheless, Wu et al. [26] proved that Kumar et al.’s scheme [25] is vulnerable to malicious medical server attacks. To ensure the high efficiency of verification and the identity privacy of patients, Liu et al. [27] devised a certificateless anonymous batch verification scheme and asserted that their scheme can authenticate all medical data in one time. Unfortunately, Zhang et al. [28] declared that Liu et al.’s scheme [27] is unable to withstand malicious participant attacks and malicious data center attacks. In 2019, Gayathri et al. [29] devised an anonymous CLAS scheme without bilinear pairings to further reduce the computational overhead. However, Liu et al. [30] substantiated that Gayathri et al.’s scheme [29] cannot withstand malicious MS attacks and public key replacement attacks. In addition, Liu et al. [30] proposed an improved scheme to resist the above attacks.

Recently, Zhan et al. [31] found that Liu et al.’s improved scheme [30] is insecure for the reason that it cannot withstand malicious MS attacks. To solve these security issues, Zhan et al. [31] put forward a pairing-free CLAS (PF-CLAS) scheme for HWMSNs. In addition, Zhan et al. [31] asserted that the PF-CLAS scheme has high computational efficiency and is secure against forgery attacks on any message. However, after our analysis, we found that the PF-CLAS scheme is unable to achieve the expected target.

Contribution

The contributions of the proposed work are shown below.

  1. We analyze Zhan et al.’s PF-CLAS scheme that cannot withstand malicious MSNi attacks. Simultaneously, the process of how malicious MSNi attacks successfully forge the signature is shown.
  2. The reasons why Zhan et al.’s PF-CLAS scheme is insecure against malicious MSNi attacks are explained. In addition, we design an improved PF-CLAS to address this security vulnerability.
  3. We substantiate that our improved PF-CLAS scheme is secure under the random oracle model. Furthermore, the performance evaluation reveals that the proposed scheme is more efficient than the existing related schemes.

Preliminaries

In this section, we introduce the complexity assumption, system model, security requirement, and security model in HWMSNs environments.

Complexity assumption

Elliptic Curve Discrete Logarithm Problem (ECDLP).

The group G has the prime order q and generator P. Given two random points P, Q ∈ G, it is hard to work out .

Computational Diffie-Hellman Problem (CDHP).

The group G has the order q and genera-tor P. Given two random points aP, bP ∈ G, it is hard to work out abP ∈ G, where .

System model of HWMSNs

As is described in Fig 1, the system model contains four entities: Medical Sensor Node (MSNi), Medical Server (MS), Cluster Head (CH), and Authorized Healthcare Professionals (AHP). MS is able to generate the public parameters and send it to MSNi. When MSNi applies for the partial private key, MS will utilize the master secret key to generate the partial private key and send it to MSNi. Simultaneously, MSNi takes advantage of its secret key and partial private key to create the signature and transmits it to CH. Multiple signatures can be aggregated into one signature by CH. Afterward, the aggregate signature can be transmitted to MS by CH. MS sends the aggregate signature to AHP after confirming the validity of the aggregate signature.

thumbnail
Download:
Fig 1. System model for HWMSNs.

https://doi.org/10.1371/journal.pone.0268484.g001

Security requirements of HWMSNs

Message Authentication and Integrity.

The messages received by the receiver are reliable and have not been tampered with during transmission.

Anonymity.

No entity can know the real identity of MSNi except MS and MSNi itself.

Traceability.

If abnormal MSNi provides false medical data, MS will trace and extract the real identity of MSNi.

Security model of HWMSNs

The CLAS scheme contains two types of adversaries: malicious MSNi and malicious MS.

Malicious MSNi.

It is Type I adversary in HWMSNs environments. Malicious MSNi can replace the public key of MSNi, but it is incapable of achieving the master secret key s.

Malicious MS.

It is Type II adversary in HWMSNs environments. Malicious MS can achieve the master secret key s, but it is incapable of replacing public keys.

The existential unforgeability of the PF-CLAS scheme is guaranteed by the following two games.

Game 1:

Setup: The System Initialization algorithm is executed by the challenger ζ1. Given the security parameter v, the algorithm returns system parameters params and master secret key s. ζ1 transmits params to while s is kept secretly.

Query Phase: carries out a bounded number of queries in polynomial time. The specific process is shown below.

  • PPK Query: When makes queries on the partial private key with PIDi, ζ1 returns di to .
  • PK Query: When makes queries on the public key of MSNi, ζ1 returns PKi to .
  • SV Query: When makes queries on the secret value of MSNi with PIDi, ζ1 returns xi to .
  • PK Replacement Query: When chooses a new public key of MSNi with PIDi, ζ1 records this replacement.
  • Signature Query: When makes queries on the signature with PIDi and PKi, ζ1 returns σi to in the tuple (mi, PIDi, PKi).

Forgery: returns identities , public keys , messages , timestamps , and an AS σ*. can win Game 1 if the following three situations happen:

  1. σ* is a valid CLAS;
  2. PPK Query has never been performed for at least one of ;
  3. Signature Query under the tuple has never been performed, where 1 ≤ i ≤ n.

Game 2:

Setup: The System Initialization algorithm is executed by the challenger ζ2. Given the security parameter v, the algorithm returns system parameters params and master key s. ζ2 transmits params and s to .

Query Phase: carries out a bounded number of queries in polynomial time. The specific process is shown below.

  • PK Query: When makes queries on the public key of MSNi, ζ2 returns PKi to .
  • SV Query: When makes queries on the secret value of MSNi with PIDi, ζ2 returns xi to .
  • Signature Query: When makes queries on the signature with PIDi and PKi, ζ2 returns σi to in the tuple (mi, PIDi, PKi).

Forgery: returns identities , public keys , messages , timestamps , and an AS σ*. can win Game 2 if the following three situations happen:

  1. σ* is a valid CLAS;
  2. SV Query has never been performed for at least one of ;
  3. Signature Query under the tuple has never been performed, where 1 ≤ i ≤ n.

Review of PF-CLAS scheme in [31]

Here, we summarize the notations of the PF-CLAS scheme in Table 1 and review the PF-CLAS scheme in [31].

thumbnail
Download:
Table 1. Notations used in PF-CLAS scheme.

https://doi.org/10.1371/journal.pone.0268484.t001

  • System Initialization (1k) → (params): Given the security parameter , MS performs the following procedures:
    1. Selects an additive group G of order q and its generator P.
    2. Selects as the master secret key at random and computes Ppub = sP as the master public key.
    3. Selects hash functions: , and .
    4. Publishes params = {P, G, q, Ppub, H, Hi, i = 1,2,3} as the system parameter and keeps s secretly.
  • Generate-PPK (params, s, RIDi) → (PIDi, di): Given s, RIDi and params, MS performs the following procedures:
    1. Selects randomly and calculates Ri = ri P.
    2. Computes PIDi = RIDi⊕H(ri Ppub, Ti), where Ti is the valid time period of PIDi.
    3. Computes li = H1(Ri, PIDi, Ppub), di = (ri + sli) mod q.
    4. Sets Di = (di, Ri) as the private key and sends (Di, PIDi) to MSNi through secure channels.
  • Generate-PK/SK (params, PIDi, di) → (pki, ski): Given params, PIDi and di, MSNi performs the following procedures:
    1. Verifies whether the equation di P = Ri + li Ppub holds, if it holds, MSNi accepts the private key di. Otherwise, it needs to reapply to MS for the partial private key.
    2. Selects randomly and calculates Xi = xi P.
    3. Sets pki = (Ri, Xi) as its own public key and ski = (di, xi) as its own private key.
  • Generate-Signature (params, PIDi, pki, ski, mi, ti) → (σi): Given params, PIDi, pki, ski, a message mi and timestamp ti, MSNi performs the following procedures:
    1. Chooses randomly and calculates Yi = yi P.
    2. Calculates and bi = H3(PIDi, mi, ti, pki).
    3. Calculates wi = [ai yi + bi(di + xi)] mod q.
    4. Outputs σi = (Yi, wi) and transmits (σi, mi, ti, pki) to CH through public channels.
  • Verify-Signature (params, pki, {mi, ti})→ VALID or INVALID: Given params, pki and a set of message signature pairs (mi, σi), CH performs the following procedures:
    1. Computes li = H1(Ri, PIDi, Ppub), ai = H2(PIDi, mi, ti, Yi, pki) and bi = H3(PIDi, mi, ti, pki).
    2. Verifies whether the equation Wi−ai Yi = bi(Xi + Ri + li Ppub) holds, if it holds, CH outputs VALID and accepts the signature. Otherwise, CH outputs INVALID and rejects the signature.
  • Generate-AS (params, pki, {mi, ti, σi}1 ≤ i ≤ n) → (σ): Given params and a set of message signature pairs (mi, σi), CH performs the following procedures:
    1. Computes .
    2. Computes .
    3. Computes .
    4. Outputs an aggregate signature σ = (A, w) and transmits (σ, mi, ti, pki) to MS through public channels.
  • Verify-AS (params, {mi, ti}1 ≤ i ≤ n, σ) → VALID or INVALID: Given params, pki, {mi, ti}1 ≤ i ≤ n and σ, MS performs the following procedures:
    1. Computes li = H1(Ri, PIDi, Ppub), ai = H2(PIDi, mi, ti, Yi, pki) and bi = H3(PIDi, mi, ti, pki), where 1 ≤ i ≤ n.
    2. Checks whether the equation holds. If it holds, MS outputs VALID and accepts the aggregate signature σ. Otherwise, MS outputs INVALID and rejects the aggregate signature σ.

Cryptanalysis of PF-CLAS schemes

In this section, we first describe the detailed process of malicious MSNi attacks, and then show the reason why this scheme cannot resist this type of attack. Finally, we present methods to withstand malicious MSNi attacks.

Forgery attacks from malicious MSNi

Although malicious MSNi hardly gets the master key s, it can replace the public key pki. In addition, if malicious MSNi eliminates li Ppub by replacing the public key pki, then it will bypass the system master key s to forge a valid signature. Malicious MSNi can forge the valid signature on any stochastically chosen message that satisfies the condition . The concrete descriptions are shown below.

  1. Public Key Replacement: Malicious MSNi executes the following procedures to replace the original public key pki.
    1. Selects and randomly.
    2. Calculates and , where PIDi and Ppub are public.
    3. Computes to replace Xi and sets as the new public key.
  2. Forgery: Malicious MSNi executes the following procedures to forge the signature .
    1. Chooses and computes .
    2. Computes , and .
    3. Sets as the forged signature and sends to CH.
  3. Verification: CH executes the following procedures to check the validity of the forged signature .
    1. Calculates , and .
    2. Checks whether the equation holds. If the equation holds, CH takes over the forged signature. Otherwise, malicious MSNi fails to forge the signature.
  4. Correctness of the Forged Signature: The validity of forged signature is supported by the verifiable equation.

Comments on the reason for malicious MSNi attacks

Although Zhan et al.’s scheme [31] has strived to solve the vulnerabilities of Liu et al.’s scheme in [30], it still suffers from malicious MSNi attacks. In Zhan et al.’s PF-CLAS scheme [31], there’s no connection between di and Xi, which is the main reason why malicious MSNi can succeed in launching public key replacement attacks. The partial private key is defined as di = ri+ sli in the literature [31], where li = H1(Ri, PIDi, Ppub). We can easily find that hash function li does not contain the public key Xi, implying that the change of Xi cannot influence the partial private key di. Hence, malicious MSNi can bypass di by replacing Xi with . To avoid the public key replacement attacks launched by malicious MSNi, we only need to add the element Xi to hash functions li in Generate-PPK algorithm. After modification, it is obvious that the equation di P = Ri + li Ppub will not be valid if the public key Xi is replaced by adversaries, where li = H1(Ri, PIDi, Ppub, Xi).

Improved PF-CLAS scheme

In this section, we devise an improved PF-CLAS scheme to avoid malicious MSNi attacks in HWMSNs. The detailed algorithms are shown as follows.

  • System Initialization (1k)→(params): Given the security parameter , MS performs the following procedures:
    1. Selects an additive group G of order q and its generator P.
    2. Selects as the master secret key at random and computes Ppub = sP as the master public key.
    3. Selects hash functions: , , and .
    4. Publishes params = {P, G, q, Ppub, H, Hi, i = 1,2,3} as the system parameter and keeps s secretly.
  • Generate-SV (params)→(xi, Xi): Given params, MSNi performs the following procedures:
    1. Selects randomly and calculates Xi = xi P.
    2. Transmits Xi to MS through public channels.
  • Generate-PPK (params, s, RIDi, Xi)→(PIDi, di): Given s, RIDi and params, MS performs the following procedures:
    1. Selects randomly and calculates Ri = ri P.
    2. Computes PIDi = RIDi⊕H(ri Ppub, Ti), li = H1(Ri, PIDi, Ppub, Xi) and di = (ri + sli) mod q.
    3. Sets Di = (di, Ri) as the private key and sends (Di, PIDi) to MSNi through secure channels.
  • Generate-PK/SK (params, PIDi, di)→(pki, ski): Given params, PIDi and di, MSNi performs the following procedures:
    1. Verifies whether the equation di P = Ri + li Ppub holds, if it holds, MSNi accepts the private key di. Otherwise, it needs to reapply to MS for the partial private key.
    2. Sets pki = (Ri, Xi) as its own public key and ski = (di, xi) as its own private key.
  • Generate-Signature (params, PIDi, pki, ski, mi, ti)→(σi): Given params, PIDi, pki, ski, a message mi and timestamp ti, MSNi performs the following procedures:
    1. Chooses randomly and calculates Yi = yi P.
    2. Calculates bi = H2(PIDi, mi, ti, pki, Yi) and wi = [yi + bi(di + xi)] mod q.
    3. Outputs σi = (Yi, wi) and transmits (σi, mi, ti, pki) to CH through public channels.
  • Verify-Signature (params, pki, {mi, ti}) → VALID or INVALID: Given params, pki and a set of message signature pairs (mi, σi), CH performs the following procedures:
    1. Computes li = H1(Ri, PIDi, Ppub, Xi), bi = H2(PIDi, mi, ti, pki, Yi).
    2. Verifies whether the equation Wi−Yi = bi(Xi + Ri + li Ppub) holds, if it holds, CH outputs VALID and accepts the signature. Otherwise, CH outputs INVALID and rejects the signature.
  • Generate-AS (params, pki, {mi, ti, σi}1 ≤ i ≤ n, pkver)→(σ): Given params, pkver and the tuple (σi, mi, ti), CH performs the following procedures:
    1. Computes .
    2. Outputs an aggregate signature σ = (Y1, Y2, …, Yn, w) and transmits (σ, mi, ti, pki) to MS through public channels.
  • Verify-AS (params, {mi, ti}1 ≤ i ≤ n, σ, skver)→ VALID or INVALID: Given params, pki, {mi, ti}1 ≤ i ≤ n and σ, MS performs the following procedures:
    1. Computes li = H1(Ri, PIDi, Ppub, Xi) and bi = H2(PIDi, mi, ti, pki, Yi).
    2. Checks whether the equation holds. If it holds, MS outputs VALID and accepts σ. Otherwise, MS outputs INVALID and rejects σ.

Correctness

Given params, pki, {mi, ti}1 ≤ i ≤ n and σi, the validity of the following equation is checked by CH.

Given params, pki, {mi, ti}1 ≤ i ≤ n and σ, the validity of the following equation is checked by MS.

Security analysis

In this section, we give Theorem 1 and Theorem 2 to prove that our improved PF-CLAS scheme can resist malicious MSNi attacks and malicious MS attacks.

Theorem 1: If (malicious MSNi) can successfully forge the signature in polynomial time with the non-negligible probability ε1, then there will be a challenger ζ1 that can work out the ECDLP with the probability , where e, , qs, qppk, qv are the natural logarithm base and the most times of Hash Query, Signature Query, PPK Query, SV Query.

Proof: The challenger ζ1 is a solver of the ECDLP. Given the tuple (P, Ppub = sP)∈G×G, the goal of ζ1 is to calculate .

Setup: ζ1 performs System Initialization algorithm to generate params and s. ζ1 sends params to and keeps s secretly.

Query Phase: The challenger ζ1 cannot get the identity PIDi which is selected by . Therefore, ζ1 guesses a random identity as the identity, where ζ1 can correctly guess with probability .

  • H1 Query: ζ1 creates an empty list1. When receiving a query H1(Ri, PIDi, Ppub, Xi) from , if there is a tuple (Ri, PIDi, Ppub, Xi, li) in the list1, ζ1 will return li to ; Otherwise, ζ1 selects at random and adds the tuple (Ri, PIDi, Ppub, Xi, li) into list1. Finally, ζ1 returns li to .
  • H2 Query: ζ1 creates an empty list2. When receiving a query H2(mi, PIDi, ti, pki, Yi) from , if there is a tuple (mi, PIDi, ti, pki, Yi, bi) in the list2, ζ1 will return bi to ; Otherwise, ζ1 selects at random and adds the tuple (mi, PIDi, ti, pki, Yi, bi) into list2. Finally, ζ1 returns bi to .
  • SV Query: ζ1 creates an empty list3. When receiving a query about the secret value of MSNi from , if there is xi in the list3, ζ1 will return xi to ; Otherwise, ζ1 selects at random and adds xi into list3. Finally, ζ1 returns xi to .
  • PPK Query: ζ1 creates an empty list4. When receiving a query about the partial private key of MSNi with PIDi from , if there is a tuple (Ri, PIDi, di) in the list4, ζ1 will return (Ri, di) to ; Otherwise, ζ1 queries the corresponding tuple (Ri, PIDi, Ppub, Xi, li) of MSNi with PIDi ∈ list1, selects at random, computes Ri = di P − li Ppub and adds the tuple (Ri, PIDi, di) into list4. Finally, ζ1 returns (Ri, di) to .
  • PK Query: ζ1 creates an empty list5. When receiving a query about the public key of MSNi with PIDi from , if there is a tuple (Ri, PIDi, Xi) in the list5, ζ1 will return (Ri, Xi) to ; Otherwise, ζ1 performs following steps.
    1. If , ζ1 selects at random, computes Xi = xi P and Ri = di P − li Ppub. Then, ζ1 adds the tuple (Ri, PIDi, Xi) into list5 and returns (Ri, Xi) to .
    2. If , ζ1 selects at random, computes Xi = xi P and Ri = ri P. Then, ζ1 sets di as ⊥ and adds the tuple (Ri, PIDi, Xi) into list5. Finally, it returns (Ri, Xi) to .
  • PK Replacement Query: When selects a new public key and sends to ζ1. When receiving a query about the public key replacement of MSNi with PIDi from , ζ1 updates list5 and records this replacement.
  • Signature Query: ζ1 creates an empty list6. When receiving a query about the signature of MSNi with PIDi from , if there is a tuple (mi, PIDi, xi, ωi) in the list6, ζ1 selects at random, computes Yi = yi P, bi = H2(PIDi, mi, ti, Yi, pki) and wi = yi + bi(xi + di) mod q. Then ζ1 returns (Yi, wi) to ; Otherwise, ζ1 selects at random, computes Yi = wi P−bi(Xi + Ri + li Ppub) and adds the tuple (Yi, wi) into list6. Finally, ζ1 returns (Yi, wi) to .

Forgery: After polynomial bounded times of queries, outputs forged signature under the tuple . According to the forking lemma [32], generates another forged signature . Therefore, according to the equation and the equation , s can be obtained as a valid solution. Otherwise, ζ1 cannot handle the ECDLP.

In order to succeed in forging a signature, the outputs of ζ1 need to satisfy the following conditions:

  1. T1: ζ1 has never aborted the process of quering;
  2. T2: ζ1 has never aborted the process of forging the signature;
  3. T3: is a valid signature.

According to the above conditions, we can get that Pr[T1] ≥ 1 − c, and . Consequently, the probability that ζ1 can work out the ECDLP is .

Theorem 2: If (malicious MS) can successfully forge the signature in polynomial time with the non-negligible probability ε2, then there will be a challenger ζ2 that can work out the ECDLP with the probability , where e, , qs, qv are the natural logarithm base and the most times of Hash Query, Signature Query, SV Query.

Proof: The challenger ζ2 is a solver of the ECDLP. Given the tuple (P, Xi = xi P) ∈ G × G, the goal of ζ2 is to calculate .

Setup: ζ2 performs System Initialization algorithm to generate params and s. ζ2 sends params and s to .

Query Phase: The challenger ζ2 cannot get the identity PIDi which is selected by . Therefore, ζ2 guesses a random identity as the identity, where ζ2 can correctly guess with probability .

  • H1 Query: ζ2 creates an empty list1. When receiving a query H1(Ri, PIDi, Ppub, Xi) from , if there is a tuple (Ri, PIDi, Ppub, Xi, li) in the list1, ζ2 will return li to ; Otherwise, ζ2 selects at random and adds the tuple (Ri, PIDi, Ppub, Xi, li) into list1. Finally, ζ2 returns li to .
  • H2 Query: ζ2 creates an empty list2. When receiving a query H2(mi, PIDi, ti, pki, Yi) from , if there is a tuple (mi, PIDi, ti, pki, Yi, bi) in the list2, ζ2 will return bi to ; Otherwise, ζ2 selects at random and adds the tuple (mi, PIDi, ti, pki, Yi, bi) into list2. Finally, ζ2 returns bi to .
  • SV Query: ζ2 creates an empty list3. When receiving a query about the secret value of MSNi from , if there is xi in the list3, ζ2 will return xi to ; Otherwise, ζ2 selects at random and adds the tuple xi into list3. Finally, ζ2 returns xi to .
  • PK Query: ζ2 creates an empty list4. When receiving a query about the public key of MSNi with PIDi from , if there is a tuple (Ri, PIDi, Xi) in the list4, ζ2 will return (Ri, Xi) to ; Otherwise, ζ2 performs following steps.
    1. If , ζ2 selects at random, computes Xi = xi P and Ri = di P−li Ppub. Then, ζ2 adds the tuple (Ri, PIDi, Xi) into list4 and returns (Ri, Xi) to .
    2. If , ζ2 selects at random, computes Xi = xi P and Ri = ri P. Then, ζ2 sets di as ⊥ and adds the tuple (Ri, PIDi, Xi) into list4. Finally, it returns (Ri, Xi) to .
  • Signature Query: ζ2 creates an empty list5. When receiving a query about the signature of MSNi with PIDi from , if there is a tuple (mi, PIDi, xi, ωi) in the list5, ζ2 selects at random, computes Yi = yi P, bi = H2(PIDi, mi, ti, Yi, pki) and wi = yi + bi(xi + di) mod q. Then ζ2 returns (Yi, wi) to ; Otherwise, ζ2 selects at random, computes Yi = wi P−bi(Xi + Ri + li Ppub) and adds the tuple (Yi, wi) into list5. Finally, ζ2 returns (Yi, wi) to .

Forgery: After polynomial bounded times of queries, outputs forged signature under the tuple . According to the forking lemma [32], generates another forged signature . Therefore, according to the equation and the equation , xi can be obtained as a valid solution. Otherwise, ζ2 cannot handle the ECDLP.

In order to succeed in forging a signature, the outputs of ζ2 need to satisfy the following conditions:

  1. T1: ζ2 has never aborted the process of quering;
  2. T2: ζ2 has never aborted the process of forging the signature;
  3. T3: is a valid signature.

According to the above conditions, we can get that Pr[T1]≥1−c, and . Consequently, the probability that ζ2 can work out the ECDLP is .

Other security analysis

  1. Message authentication and integrity: According to Theorem 1 and Theorem 2, neither Type I nor Type II attackers can pass the verification by forging a signature.
  2. Anonymity: In the improved PF-CLAS scheme, PIDi is the pseudo identity of MSNi, where PIDi = RIDi⊕H(ri Ppub, Ti). Any adversary cannot extract the real identity of MSNi. Hence, our scheme provides strong anonymity.
  3. Traceability: If MSNi transmits illegal information, MS can track abnormal MSNi and extract its real identity by computing RIDi = PIDi⊕H(sRi), where sRi = ri Ppub.

Performance evaluation

In this section, we will provide the performance analysis in terms of computational overhead, communication overhead, and security features. In the meantime, the efficiency of the improved scheme will be compared with the related schemes [15, 24, 25, 27, 29, 33, 34]. We utilize MIRACL library to simulate cryptographic operations on a Windows 10 laptop with an Intel i7–1195G7 @2.9 GHz processor and 8 GB of memory. The measured runtime of different operations is shown in Table 2.

thumbnail
Download:
Table 2. Runtime of cryptographic operations.

https://doi.org/10.1371/journal.pone.0268484.t002

Computational overhead

As is described in Table 3, we mainly count the computational overhead of Generate-Signature algorithm, Verify-Signature algorithm, Generate-AS algorithm, and Verify-AS algorithm. In Xu et al.’s scheme [15], the computational overhead of the single signing and verification is ≈ 143.7864 ms. Similarly, Kumar et al.’s scheme [25], Liu et al.’s scheme [27], and Shen et al.’s scheme [34] need 38.724 ms, 21.444ms, 36.1212 ms, respectively. As is shown in Fig 2 the computational overhead of the above schemes is extremely high. The root cause is that these schemes all use bilinear pairing and map-to-point hash operations to construct the signature. Hence, we use pairing-free operations to improve the efficiency of the improved PF-CLAS scheme. In literatures [24, 29, 33], their schemes also don’t use bilinear pairings. Hence, they only need 3.9545 ms, 5.4841 ms, 4.1793 ms, respectively. The computational overhead of the single signing and verification only needs 3.9545ms, which saves 97.2%, 89.8%, 81.6%, 27.9%, 5.4%, 89.1% of the computational overhead than Xu et al.’s scheme [15], Kumar et al.’s scheme [25], Liu et al.’s scheme [27], Gayathri et al.’s scheme [29], Verma et al.’s scheme [33], Shen et al.’s scheme [34]. In the aggregate signing and aggregate verification phases, we set the number of signatures participating in the aggregation as n = 50. Since references [15, 24] have no connection with the aggregate signature, we don’t describe them too much. As is shown in Fig 3, the computational overhead of the aggregate signing and verification of Kumar et al.’s scheme [25], Liu et al.’s scheme [27], Gayathri et al.’s scheme [29], Verma et al.’s scheme [33], Shen et al.’s scheme [34] is 422.0506 ms, 147.9858 ms, 95.5493 ms, 85.9013 ms, 472.56 ms, respectively. Our improved PF-CLAS scheme needs 88.0328 ms, which saves 79.2%, 41%, 7.9%, 27.9%, 5.4%, 81.4% than Kumar et al.’s scheme [25], Liu et al.’s scheme [27], Gayathri et al.’s scheme [29], Shen et al.’s scheme [34]. Although the total computational overhead of Verma et al.’s scheme [33] is basically the same as our scheme, Verma et al.’s scheme [33] cannot achieve secure communication. Hence, the computational overhead of our improved PF-CLAS scheme reaches the upstream level of the relevant schemes.

thumbnail
Download:
Fig 2. Computational overhead of the single signing and verification.

https://doi.org/10.1371/journal.pone.0268484.g002

thumbnail
Download:
Fig 3. Computational overhead of the aggregate signing and aggregate verification.

https://doi.org/10.1371/journal.pone.0268484.g003

thumbnail
Download:
Table 3. Comparison of computational overhead.

https://doi.org/10.1371/journal.pone.0268484.t003

Communication overhead

As shown in Table 4, we list parameters and length specifications for pairing-based and ECC-based schemes [29]. In addition, the size of the group is 160 bits in our scheme. In [15, 25, 27, 34], the communication overhead of the single signature is 1024 bits, 2048 bits, 2048 bits, and 2048 bits, respectively, because all the elements of σi belong to G1. In our improved PF-CLAS, we set σi as (Yi, wi), where Yi ∈ G, . Compared with the schemes [15, 24, 25, 27, 29, 34], the communication overhead of the single signature in our scheme is reduced by 53.1%, 40%, 76.57%, 76.57%, 25%, 76.57%. As is described in Fig 4, it is obvious that our scheme has higher efficiency than the above schemes in the single signature phase. Since references [15, 24] have no connection with the aggregate signature, we don’t describe them too much in the aggregate signature phase. In the meantime, we can know from Fig 5 that the communication overhead of the aggregate signatures in our scheme is lower than Kumar et al.’s scheme [25] and Shen et al.’s scheme [34] with the increase of the number of medical sensor nodes. Although Liu et al.’s scheme [27] and Gayathri et al.’s scheme [29] have lower communication overhead than our scheme, their schemes have serious security flaws. As shown in Table 5, even though our scheme has the same communication overhead as Verma et al.’s scheme [33], their scheme cannot meet the security requirements of HWMSNs. Therefore, our scheme has certain advantages in terms of communication overhead.

thumbnail
Download:
Fig 4. Communication overhead of single signatures.

https://doi.org/10.1371/journal.pone.0268484.g004

thumbnail
Download:
Fig 5. Communication overhead of aggregate signatures.

https://doi.org/10.1371/journal.pone.0268484.g005

thumbnail
Download:
Table 4. Length of parameters in bilinear pairing and ECC.

https://doi.org/10.1371/journal.pone.0268484.t004

thumbnail
Download:
Table 5. Comparison of communication overhead and security features.

https://doi.org/10.1371/journal.pone.0268484.t005

Security features

As shown in Table 5, Xu et al.’s scheme [15], Xu et al.’s scheme [24], Kumar et al.’s scheme [25], Verma et al.’s scheme [33], and Shen et al.’s scheme [34] don’t consider the anonymity of patients’ identities and tracing of malicious medical sensor nodes, which are unsuitable for HWMSNs scenarios. Although Liu et al.’s scheme [27] and Gayathri et al.’s scheme [29] can meet the security requirements of HWMSNs, these schemes have security drawbacks that cannot withstand Type I and Type II attacks. The proposed scheme has been proved that resist Type I and Type II attacks under the random oracle model. Besides, our scheme is able to realize anonymity and traceability, which is more practical in HWMSNs.

Conclusion

In this paper, we found that Zhan et al.’s PF-CLAS scheme [31] cannot withstand malicious MSNi attacks. In the meantime, we showed the reason why this scheme was vulnerable to malicious MSNi attacks. It is obvious that Zhan et al.’s scheme cannot guarantee the identity privacy of patients and secure transmission of medical data. Hence, we gave methods to fix the vulnerability and constructed an improved PF-CLAS scheme that could ensure provable security. In addition, the performance evaluation indicated that our improved scheme can realize privacy preservation and secure communication at low overhead. In the future, how to combine blockchain and edge computing technologies to design a more lightweight and secure CLAS scheme for HWMSNs is still an interesting problem.

Supporting information

S1 Data. Runtime of cryptographic operations.

https://doi.org/10.1371/journal.pone.0268484.s001

(XLS)

S2 Data. Comparison of computational overhead.

https://doi.org/10.1371/journal.pone.0268484.s002

(XLS)

Acknowledgments

We thank the anonymous reviewer for your review and approval.

References

  1. 1. Hossain ME, Khan A, Moni MA, Uddin S. Use of electronic health data for disease prediction: A comprehensive literature review. IEEE/ACM transactions on computational biology and bioinformatics. 2019;18(2):745–758.
  2. 2. Masud M, Gaba GS, Alqahtani S, Muhammad G, Gupta BB, Kumar P, et al. A Lightweight and Robust Secure Key Establishment Protocol for Internet of Medical Things in COVID-19 Patients Care. IEEE Internet of Things Journal. 2021;8(21):15694–15703.
  3. 3. Vijayakumar P, Obaidat MS, Azees M, Islam SH, Kumar N. Efficient and secure anonymous authentication with location privacy for IoT-based WBANs. IEEE Transactions on Industrial Informatics. 2019;16(4):2603–2611.
  4. 4. Xu Z, He D, Kumar N, Choo K-KR. Efficient certificateless aggregate signature scheme for performing secure routing in VANETs. Security and Communication Networks. 2020;2020(2):1–12.
  5. 5. Kumar M, Chand S. A lightweight cloud-assisted identity-based anonymous authentication and key agreement protocol for secure wireless body area network. IEEE Systems Journal. 2021;15(2):2779–2786.
  6. 6. Jegadeesan S, Azees M, Sekar A, Al-Turjman F. Lightweight Privacy and Confidentiality Preserving Anonymous Authentication Scheme for WBANs. IEEE Transactions on Industrial Informatics. 2022;18(5): 3484–3491.
  7. 7. Ye X, Xu G, Cheng X, Li Y, Qin Z. Certificateless-based anonymous authentication and aggregate signature scheme for vehicular ad hoc networks. Wireless Communications and Mobile Computing. 2021;2021(5):1–16.
  8. 8. Odelu V, Saha S, Prasath R, Sadineni L, Conti M, Jo M. Efficient privacy preserving device authentication in WBANs for industrial e-health applications. Computers & Security. 2019;83:300–312.
  9. 9. Al-Ayyoub M, AlZu’bi S, Jararweh Y, Shehab MA, Gupta BB. Accelerating 3D medical volume segmentation using GPUs. Multimedia Tools and Applications. 2018;77(4):4939–4958.
  10. 10. Al-Qerem A, Alauthman M, Almomani A, Gupta B. IoT transaction processing through cooperative concurrency control on fog–cloud computing environment. Soft Computing. 2020;24(8):5695–5711.
  11. 11. Gupta BB, Li K-C, Leung VC, Psannis KE, Yamaguchi S. Blockchain-assisted secure fine-grained searchable encryption for a cloud-based healthcare cyber-physical system. IEEE/CAA Journal of Automatica Sinica. 2021;8(12):1877–1890.
  12. 12. Nguyen GN, Le Viet NH, Elhoseny M, Shankar K, Gupta B, Abd El-Latif AA. Secure blockchain enabled Cyber–physical systems in healthcare using deep belief network with ResNet model. Journal of Parallel and Distributed Computing. 2021;153:150–160.
  13. 13. Mirsadeghi F, Rafsanjani MK, Gupta BB. A trust infrastructure based authentication method for clustered vehicular ad hoc networks. Peer-to-Peer Networking and Applications. 2021;14(4):2537–2553.
  14. 14. Vijayakumar P, Pandiaraja P, Karuppiah M, Deborah LJ. An efficient secure communication for healthcare system using wearable devices. Computers & Electrical Engineering. 2017;63:232–245.
  15. 15. Xu Z, Luo M, Kumar N, Vijayakumar P, Li L. Privacy-protection scheme based on sanitizable signature for smart mobile medical scenarios. Wireless Communications and Mobile Computing. 2020;2020(1):1–10.
  16. 16. Boneh D, Gentry C, Lynn B, Shacham H. Aggregate and verifiably encrypted signatures from bilinear maps. International conference on the theory and applications of cryptographic techniques. 2003:416-432.
    • 17. Lysyanskaya A, Micali S, Reyzin L, Shacham H, editors. Sequential aggregate signatures from trapdoor permutations. International Conference on the Theory and Applications of Cryptographic Techniques. 2004:74-90.
      • 18. Cheon JH, Kim Y, Yoon HJ. A new ID-based signature with batch verification. Cryptology EPrint Archive. 2004: 131.
      • 19. Lin X, Sun X, Ho PH, Shen X. GSIS: A Secure and Privacy-Preserving Protocol for Vehicular Communications. IEEE Transactions on Vehicular Technology. 2007;56(6):3442–3456.
      • 20. Gong Z, Long Y, Hong X, Chen K. Two certificateless aggregate signatures from bilinear maps. Eighth ACIS International Conference on Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed Computing. 2007:188-193.
        • 21. Ma D. Practical forward secure sequential aggregate signatures. Proceedings of the 2008 ACM symposium on Information, computer and communications security. 2008:341–352.
        • 22. Chen J, Yue H, Huang Z. Secure certificate-based aggregate signature scheme. Computer Engineering and Applications. 2013;49(21):60–64.
        • 23. Xu Z, He D, Vijayakumar P, Choo K-KR, Li L. Efficient NTRU lattice-based certificateless signature scheme for medical cyber-physical systems. Journal of medical systems. 2020;44(5):1–8. pmid:32189085
        • 24. Xu Z, Luo M, Vijayakumar P, Peng C, Wang L. Efficient certificateless designated verifier proxy signature scheme using UAV network for sustainable smart city. Sustainable Cities and Society. 2022;80:103771.
        • 25. Kumar P, Kumari S, Sharma V, Sangaiah AK, Wei J, Li X. A certificateless aggregate signature scheme for healthcare wireless sensor network. Sustainable Computing: Informatics and Systems. 2018;18:80–89.
        • 26. Wu L, Xu Z, He D, Wang X. New certificateless aggregate signature scheme for healthcare multimedia social network on cloud environment. Security and Communication Networks. 2018;2018:1–13.
        • 27. Liu J, Cao H, Li Q, Cai F, Du X, Guizani M. A large-scale concurrent data anonymous batch verification scheme for mobile healthcare crowd sensing. IEEE Internet of things Journal. 2018;6(2):1321–1330.
        • 28. Zhang Y, Shu J, Liu X, Jin L, Dong Z. Comments on “A Large-Scale Concurrent Data Anonymous Batch Verification Scheme for Mobile Healthcare Crowd Sensing”. IEEE Internet of Things Journal. 2019;6(1):1287–1290.
        • 29. Gayathri N, Thumbur G, Kumar PR, Rahman MZU, Reddy PV. Efficient and secure pairing-free certificateless aggregate signature scheme for healthcare wireless medical sensor networks. IEEE Internet of Things Journal. 2019;6(5):9064–9075.
        • 30. Liu J, Wang L, Yu Y. Improved security of a pairing-free certificateless aggregate signature in healthcare wireless medical sensor networks. IEEE Internet of Things Journal. 2020;7(6):5256–5266.
        • 31. Zhan Y, Wang B, Lu R. Cryptanalysis and improvement of a pairing-free certificateless aggregate signature in healthcare wireless medical sensor networks. IEEE Internet of Things Journal. 2021;8(7):5973–5984.
        • 32. Pointcheval D, Stern J. Security proofs for signature schemes. International conference on the theory and applications of cryptographic techniques. 1996: 387-398.
          • 33. Verma GK, Kumar N, Gope P, Singh B, Singh H. SCBS: A Short Certificate-Based Signature Scheme With Efficient Aggregation for Industrial-Internet-of-Things Environment. IEEE Internet of Things Journal. 2021;8(11):9305–9316.
          • 34. Shen L, Ma J, Liu X, Wei F, Miao M. A secure and efficient ID-based aggregate signature scheme for wireless sensor networks. IEEE Internet of Things Journal. 2016;4(2):546–54.