A Certificateless Aggregate Arbitrated Signature Scheme for IoT Environments

Abstract

The Internet of Things (IoT) environment consists of numerous devices. In general, IoT devices communicate with each other to exchange data, or connect to the Internet through a gateway to provide IoT services. Most IoT devices participating in the IoT service are lightweight devices, in which the existing cryptographic algorithm cannot be applied to provide security, so a more lightweight security algorithm must be applied. Cryptographic technologies to lighten and provide efficiency for IoT environments are currently being studied a lot. In particular, it is necessary to provide efficiency for computation at a gateway, a point where many devices are connected. Additionally, as many devices are connected, data authentication and integrity should be fully considered at the same time, and thus digital signature schemes have been proposed. Among the recently studied signature algorithms, the certificateless signature (CLS) based on certificateless public key cryptography (CL-PKC) provides efficiency compared to existing public key-based signatures. However, in CLS, security threats, such as public key replacement attacks and signature forgery by the malicious key generation center (KGC), may occur. In this paper, we propose a new signature scheme using CL-PKC in generating and verifying the signature of a message in an IoT environment. The proposed scheme is a certificateless aggregate arbitrated signature, and the gateway aggregates the signatures of messages generated by the device group to reduce the size of the entire signature. In addition, it is designed to be safe from security threats by solving the problems caused by public key replacement attacks and malicious KGC, and adding arbitrated signatures of the gateway to strengthen non-repudiation.

Cryptanalysis of a Certificateless Hybrid Signcryption Scheme and a Certificateless Encryption Scheme for Internet of Things

“…In wireless and mobile networks with limited storage and computing resources, certificateless cryptography has more advantages because of its low dependence on infrastructure and short security parameters. However, while achieving low computational costs, many certificateless schemes proposed in the Internet of things environment [17][18][19][20][21][22][23] cannot simultaneously provide provable security. Kumar et al [17] claimed that their newly proposed certificateless aggregate signature scheme is secure against both types of attackers.…”

“…Kasyoka et al [28] showed the security vulnerabilities of Wei and Ma's [19] signcryption scheme and proposed corresponding modifications to show how their scheme could be made more secure. Xu and Zeng [29] pointed out that the certificateless aggregate arbitrated signature scheme proposed by Lee et al [22] is not secure for type-1 attackers that can replace user public keys. ey also showed that Addobea et al's [23] offline-online certificateless signature scheme cannot achieve correctness.…”

Selected Papers from the First International Symposium on Future ICT (Future-ICT 2019) in Conjunction with the 4th International Symposium on Mobile Internet Security (MobiSec 2019)

“…The authors of [ 10 ] suggest a new signature method employing certificateless public key cryptography (CL-PKC) to produce and validate a message’s signature in an IoT environment. The advanced system is a certificateless aggregate arbitrated signature, and the gateway aggregates the signatures of messages created by the device group to lessen the volume of the whole signature.…”