New Certificateless Aggregate Signature Scheme for Healthcare Multimedia Social Network on Cloud Environment

Abstract

With the application of sensor technology in the field of healthcare, online data sharing in healthcare industry attracts more and more attention since it has many advantages, such as high efficiency, low latency, breaking the geographical location, and time constraints. However, due to the direct involvement of patient health information, the privacy and integrity of medical data have become a matter of much concern to the healthcare industry. To retain data privacy and integrity, a number of digital signature schemes have been introduced in recent years. Unfortunately, most of them suffer serious security attacks and do not perform well in terms of computation overhead and communication overhead. Very recently, Pankaj Kumar et al. proposed a certificateless aggregate signature scheme for healthcare wireless sensor network. They claimed that their signature scheme was able to withstand a variety of attacks. However, in this paper, we find that their scheme fails to achieve its purpose since it is vulnerable to signature forgery attack and give the detailed attack process. Then, we propose a new certificateless aggregate signature scheme to fix the security flaws and formally prove that our proposed scheme is secure under the computationally hard Diffie-Hellman assumption. Security analysis and performance evaluation demonstrate that the security of our proposal is improved while reducing the computation cost. Compared with Pankaj Kumar et al.'s scheme, our proposed scheme is more efficient and suitable for the healthcare wireless sensor networks (HWSNs) to maintain security at various levels.

A Short Server-Aided Certificateless Aggregate Multisignature Scheme in the Standard Model

“…Secret-key Public-key Signing Verifying [3] 1|G| 1|G| + 1| | 2|G| + + 3 3P + 1H [4] 1|G|+ 1| | 2| | 2|G| 2 + 2 ( + 3)exp + 2H [5] ( + 1)|G| 1|G|+ 1| | 2|G| 4 exp + 3 H 2 exp + 3P (3 + 1)H Ours 3|G|+ 1|G| 3|G|+ 1| | 3|G|+ (n + 3)|G| (2 + 9)exp + (2 + 1)H ( + 1)exp + 3P+(2 + 1)H time. Second, using direct approach [14,15], which leads to quite efficient resulted schemes (constant-size of both public parameters and signature, as well as efficient computing time); however these schemes are only secure under strong assumptions (generalization of the Diffie-Hellman exponent assumption, GDDHE assumption), although GDDHE assumption introduced by Boneh and Boyen at Eurocrypt'05 [16] now has been accepted widely by researchers [17][18][19][20][21][22].…”

“…In this scheme, each signer in an aggregating set signs a different message and then all those signatures are aggregated into a single short signature, which is called aggregate signature. As shown in [5,[23][24][25], aggregate signature can be applied well to several practical applications such as Bitcoin blockchain, Secure BGP protocol (SBGP) [26], Healthcare, and so on. Certificateless aggregate signature was first proposed in [27], since then it has been studied in numerous of papers such as [5,[28][29][30][31][32][33][34][35], to name a few.…”

“…As shown in [5,[23][24][25], aggregate signature can be applied well to several practical applications such as Bitcoin blockchain, Secure BGP protocol (SBGP) [26], Healthcare, and so on. Certificateless aggregate signature was first proposed in [27], since then it has been studied in numerous of papers such as [5,[28][29][30][31][32][33][34][35], to name a few. However, all of these schemes either are insecure [29,30,35] or suffer a drawback that the signature size is linear in the number of signers in the aggregating set [5,28,[31][32][33][34].…”

“…Moreover, all of these schemes need to use random oracle to prove the security. Very recently, the authors in [5] proposed a new certificateless aggregate scheme with short public parameters and achieving the highest level of security according to the classification given by Huang el al. [13] under a standard assumption.…”

“…Regarding security model, we only consider the selective model where adversary has to declare the identity of target user at the beginning of security game; the challenger thus does not need to guess the identity of target user at the beginning of security game. In scheme [4,5], the authors considered a more practical model, the adaptive model where adversary does not have to declare the identity of target user at the beginning of security game; however in their security proof, the challenger needs to guess in advance the identity of the target user at the beginning of security game; their schemes therefore lose a factor in the reduction to the corresponding assumptions. We also note that all of these schemes need to use random oracle to prove the security.…”