GRAAD: Group Anonymous and Accountable D2D Communication in Mobile Networks

TL;DR

This paper proposes new privacy-preserving authentication protocols for device-to-device communication in mobile networks, ensuring group anonymity, security, and accountability, with formal security proofs and practical evaluations.

Contribution

It introduces novel authenticated key exchange protocols for D2D communication that guarantee privacy, security, traceability, and are validated through formal proofs and real-device implementation.

Findings

Protocols achieve end-to-end security and accountability.

Formal security proofs validate protocol robustness.

Implementation demonstrates feasible computation costs.

Abstract

Device-to-Device (D2D) communication is mainly launched by the transmission requirements between devices for specific applications such as Proximity Services in Long-Term Evolution Advanced (LTE-A) networks, and each application will form a group of devices for the network-covered and network-absent D2D communications. Although there are many privacy concerns in D2D communication, they have not been well-addressed in current communication standards. This work introduces network-covered and network-absent authenticated key exchange protocols for D2D communications to guarantee accountable group anonymity, end-to-end security to network operators, as well as traceability and revocability for accounting and management requirements. We formally prove the security of those protocols, and also develop an analytic model to evaluate the quality of authentication protocols by authentication success rate in D2D communications. Besides, we implement the proposed protocols on android mobile devices to evaluate the computation costs of the protocols. We also evaluate the authentication success rate by the proposed analytic model and prove the correctness of the analytic model via simulation. Those evaluations show that the proposed protocols are feasible to the performance requirements of D2D communications.

Tables

Table 1. TABLE I: Notations

Notation	Description
${\text{UE}}_i$	user equipments $i$
eNB	evolved node B
HSS/AuC	home subscriber server/authentication center
${\mathrm{𝖨𝖣}}_i$	the real identities of ${\text{UE}}_i$
${\mathrm{𝖴𝖨𝖣}}_i$	the identity in IBE system
${\mathrm{𝖠𝖨𝖣}}_i$	the application identity of ${\text{UE}}_i$
${\mathrm{𝖦𝖨𝖣}}_i$	the group identity of ${\text{UE}}_i$
$K_i$	the shared secret key between ${\text{UE}}_i$ and HSS/AuC
$K_{\text{p}}$	the secret key only known by ProSe Function
$A{K}_i$	the authorization key of ProSe function for ${\text{UE}}_i$
$\mathrm{𝗉𝖺𝗋𝖺𝗆}$	the public parameters of an ID-based encryption
	system
$d_{\mathrm{𝖨𝖣}}$	the IBE private key corresponding to $\mathrm{𝖨𝖣}$
${𝖤}_{\text{IC}}(pk,ID,x)$	IND-CCA secure ID-based encryption with the
	system public key $pk$, the identity $ID$, and the input $x$
${𝖤}_{\text{S}}(K,x_1,x2,\cdots )$	symmetric Encryption with inputs $x_1,x_2,$ etc.
$𝒳=g^x,𝒴=g^y$	a Diffie-Hellman tuple [24], where $(x,y)\in {\mathbb{Z}}_p^2$
	and $g\in 𝔾$.
$𝖧(.)$, $f_0(.)$, ${𝖧}_1(.)$,${𝖧}_2(.)$	secure one-way hash functions, where $𝖧:{\{0,1\}}^{\ast }\to {\{0,1\}}^l$, $f_0:{\mathbb{Z}}_p^3\to {\{0,1\}}^l$,
	${𝖧}_1:{\{0,1\}}^{\ast }\to {𝔾}^{\ast }$, ${𝖧}_2:{𝔾}_T\to {\{0,1\}}^n$

Table 2. TABLE II: Computation Costs of the Proposed Schemes

	CN-GD2C	NA-GD2C	NA-GD2C (Traceability)
Costs	$T_{IBE}+2T_{𝖧}+2T_{{𝖤}_{\text{S}}}+T_{DH}$	$T_{IBE}+3T_{𝖧}$	$T_{KPE}+T_{KPD}+T_{LIN}+8T_{EXP}+3T_P+6T_{𝖧}+\left(2w\right)T_{mul}+\left(2w+2\right)T_{𝖧}$
Computation time ($w=10$)	1.5716 ms	0.824 ms	5.978 ms
Computation time ($w=50$)	1.5716 ms	0.824 ms	6.826 ms
Message Length	852-bit (${\mathrm{UE}}_i$) + 1832-bit (${\mathrm{UE}}_j$)	1066-bit (${\mathrm{UE}}_U$)+682-bit (${\mathrm{UE}}_V$)	3574-bit (${\mathrm{UE}}_U$)+ 3190-bit (${\mathrm{UE}}_V$)
\pbox16.5cm$T_{IBE}$: the computation time of BF-IBE encryption/decryption (with plaintext of 128-bit and group element of 170-bit)
$T_{DH}$: the computation time of Diffie-Hellman (with the prime of 1024-bit and the exponential of 160-bit)
$T_{{𝖤}_{\text{S}}}$: the computation time of symmetric encryption (AES)(with an input of 128-bit)
$T_{𝖧}$: the computation time of one-way hash function (SHA-256)(with an input of 128-bit)
$T_{KPE}$: the computation time of key-private encryption (with plaintext of 170-bit and public key of $3\times$170-bits)
$T_{KPD}$: the computation time of key-private decryption (with ciphertext of $2\times$170-bit)
$T_{LIN}$: the computaion time of Linear encryption/decryption (with plaintext of 170-bit, public key of $3\times$170-bit, and ciphertext of $3\times$170-bit)
$T_{EXP}$: the computation time of exponential operation in $𝔾$
$T_P$: the computation time of pairing
$T_{DH}$=0.74 ms, $T_{{𝖤}_{\text{S}}}=6.8\times {10}^{-3}ms$, $T_{𝖧}$=0.006 ms, $T_{EXP}$=0.37 ms, $T_{IBE}$=0.806 ms, $T_{KPE}$=$T_{KPD}$=2$T_{EXP}$= 0.74 ms, $T_{LIN}$=3$T_{EXP}$=1.11 ms, $T_P$=0.06 ms, $T_{mul}$=0.004 ms

Table 3. TABLE III: Comparisons on Security Properties

Properties	SeDS [19]	LSD [20]	Ours
Mutual Authentication	-	✓	✓
End-to-End Security	✓	?	✓
Pseudonymity	✓	✓	✓
Anonymity	x	✓	✓
Forward Secrecy	✓	?	✓
Network-absent D2D	x	?	✓
Group Anonymity	x	x	✓

Equations

$${\text{Adv}}_{\mathcal{A}}^{\text{MA}}=\mathrm{Pr}[\mathcal{A}\text{ accepted by }{\Pi }_{U,V}^{t_1}\text{ or }{\Pi }_{V,U}^{t,2}]$$

$${\text{Adv}}_{\mathcal{A}}^{\text{SK}}=\left\{\mathrm{Pr}[b=b^{\prime }]-1/2\right\}$$

$${\text{Adv}}_{\mathcal{A}}^{\text{anon\_id}}=\left\{\mathrm{Pr}[b=b^{\prime }]-1/2\right\}$$

$${\text{Adv}}_{\mathcal{A}}^{\text{anon\_group}}=\left\{\mathrm{Pr}[b=b^{\prime }]-1/2\right\}$$

$$\mathcal{R}=\frac{e^{-2{\lambda }_{rd}{\hat{T}}_s}(1-{\lambda }_t{\hat{T}}_s){\lambda }_{rd}}{{\lambda }_{rd}-{\lambda }_t(1-e^{-{\lambda }_{rd}{\hat{T}}_s})}.$$

$$\begin{array}{rl}\mathcal{R}=& \mathrm{Pr}[t_a\le t_{rd}]=\mathrm{Pr}[t_s\le t_{rd}-t_Q]\\ =& \mathrm{Pr}[t_a\le t_{rd}|t_{rd}\ge {\hat{T}}_s]\mathrm{Pr}[t_{rd}\ge {\hat{T}}_s]\\ & +\mathrm{Pr}[t_a\le t_{rd}|t_{rd}<{\hat{T}}_s]\mathrm{Pr}[t_{rd}<{\hat{T}}_s].\end{array}$$

$$\mathcal{R}=\mathrm{Pr}[t_a\le t_{rd}|t_{rd}\ge {\hat{T}}_s]\mathrm{Pr}[t_{rd}\ge {\hat{T}}_s].\text{vspace}-2mm$$

$$\begin{array}{rl}& \mathrm{Pr}[t_a\le t_{rd}|t_{rd}\ge {\hat{T}}_s]=\mathrm{Pr}[t_{rd}\ge t_Q+{\hat{T}}_s|t_{rd}\ge {\hat{T}}_s]\\ & ={\int }_0^{\infty }\left\{{\int }_{x+{\hat{T}}_s}^{\infty }{f}_{t_{rd}}(y)\mathrm{d}y\right\}{f}_{t_Q}(x)\mathrm{d}x\\ & ={\int }_0^{\infty }{e}^{-{\lambda }_{rd}(x+{\hat{T}}_s)}{f}_{t_Q}(x)\mathrm{d}x=e^{-{\lambda }_{rd}{\hat{T}}_s}{\int }_0^{\infty }{e}^{-{\lambda }_{rd}x}{f}_{t_Q}(x)\mathrm{d}x\\ & =e^{-{\lambda }_{rd}{\hat{T}}_s}{\mathcal{L}}_{t_Q}({\lambda }_{rd})\end{array}$$

$${\mathcal{L}}_{t_Q}({\lambda }_{rd})=\frac{(1-\rho ){\lambda }_{rd}}{{\lambda }_{rd}-{\lambda }_t+{\lambda }_t{\mathcal{L}}_{t_s}({\lambda }_{rd})}$$

$$\begin{array}{rl}{\mathcal{L}}_{t_s}({\lambda }_{rd})& ={\int }_{t=0}^{\infty }{e}^{-{\lambda }_{rd}t}{f}_{t_s}(t)\mathrm{d}t=e^{-{\lambda }_{rd}{\hat{T}}_s}.\end{array}$$

$$\begin{array}{r}\mathrm{Pr}[t_a\le t_{rd}|t_{rd}\ge {\hat{T}}_s]=\frac{e^{-{\lambda }_{rd}{\hat{T}}_s}(1-\rho ){\lambda }_{rd}}{{\lambda }_{rd}-{\lambda }_t(1-e^{-{\lambda }_{rd}{\hat{T}}_s})}.\end{array}$$

$$\begin{array}{rl}\mathrm{Pr}[t_{rd}\ge {\hat{T}}_s]& ={\int }_{\widehat{T_s}}^{\infty }{\lambda }_{rd}{e}^{-{\lambda }_{rd}x}\mathrm{d}x=e^{-{\lambda }_{rd}{\hat{T}}_s}.\end{array}$$

$$\mathcal{R}=\frac{e^{-\frac{2}{c_{rd}}}\left(\frac{1}{c_t}-1\right)}{\frac{1}{c_t}-\frac{1}{c_{rd}}\left(1-e^{-\frac{1}{c_{rd}}}\right)}.$$

$$\mathcal{R}=\frac{e^{-2{\hat{T}}_s\left({\lambda }_r+{\lambda }_{rd}\right)}{\left(1-{\lambda }_t{\hat{T}}_s\right)}^2{\lambda }_{rd}{\lambda }_r}{\left\{{\lambda }_{rd}-{\lambda }_t\left(1-e^{-{\lambda }_{rd}{\hat{T}}_s}\right)\right\}\left\{{\lambda }_r-{\lambda }_t\left(1-e^{-{\lambda }_r{\hat{T}}_s}\right)\right\}}.$$

$$\begin{array}{rl}\mathcal{R}& =\mathrm{Pr}\left[t_a\le t_{rd},t_a\le t_r\right]=\mathrm{Pr}\left[t_a\le t_{rd}\right]\mathrm{Pr}\left[t_a\le t_r\right]\end{array}$$

$$\begin{array}{rl}\mathrm{Pr}[t_a\le t_r|t_r\ge {\hat{T}}_s]& =\mathrm{Pr}[t_Q+{\hat{T}}_s\le t_r|t_r\ge T_s]\\ & =\mathrm{Pr}[t_Q\le t_r-{\hat{T}}_s|t_r-{\hat{T}}_s\ge 0]\\ & =\frac{e^{-2{\lambda }_r{\hat{T}}_s}(1-\rho ){\lambda }_r}{{\lambda }_r-{\lambda }_t(1-e^{-{\lambda }_r{\hat{T}}_s})}.\end{array}$$

$$\begin{array}{rl}\mathcal{R}& =\frac{e^{-2{\lambda }_{rd}{\hat{T}}_s}(1-\rho ){\lambda }_{rd}}{{\lambda }_{rd}-{\lambda }_t(1-e^{-{\lambda }_{rd}{\hat{T}}_s})}\times \frac{e^{-2{\lambda }_r{\hat{T}}_s}(1-\rho ){\lambda }_r}{{\lambda }_r-{\lambda }_t(1-e^{-{\lambda }_r{\hat{T}}_s})}\end{array}$$

$$\begin{array}{rl}\mathcal{R}& =\frac{e^{-2\left(\frac{1}{c_{rd}}+\frac{1}{c_r}\right)}\left(1-\frac{1}{c_t}\right)\frac{1}{c_{rd}}}{\frac{1}{c_{rd}}-\frac{1}{c_t}\left(1-e^{-\frac{1}{c_{rd}}}\right)}\times \frac{(1-\frac{1}{c_t})\frac{1}{c_r}}{\frac{1}{c_r}-\frac{1}{c_t}\left(1-e^{-\frac{1}{c_r}}\right)}.\end{array}$$

Full text

I Introduction

Due to the dramatic growth of the number of mobile devices, providing mobile communication services with higher throughput, lower traffic overhead, and lower energy consumption are challenges. Although LTE-A physical-layer provides even higher communication capability [1], the resource allocation in the evolved universal terrestrial radio access network (E-UTRAN) to high density mobile devices remains dilemma when the resource is limited. The 3rd generation partnership project (3GPP) proposes D2D communication service in LTE-A, called Proximity Service (ProSe) [2, 3] with three main purposes as follows: 1) the mobile network operator can offload traffic of E-UTRAN and Evolved Packet System (EPS) [4], which is the core network (CN) of the LTE-A system; 2) D2D communication may support social network service, information sharing, advertising, gaming, and conferencing services; and 3) the high availability of D2D communication can be used to support public safety services. Besides, security is essential to support the correctness of the functions and the availability for D2D communications.

In ProSe, D2D communication can be classified as the network-covered and network-absent according to whether its control components are connected to CN (covered) or not (absent). The authenticated key exchange (AKE) in ProSe have to consider the connectivity between user equipments (UEs) and CN and should provide security protection from various kinds of attacks. Certain security threats have been discussed in [5], i.e., eavesdropping between UEs, impersonation attack on UE or evolved NodeB (eNB), and active attack by injecting messages into traffic data or control data.

AKE guarantees the identification by mutual authentication and confidentiality of communication by key exchange in computer networks [6, 7, 8]. Additionally, the anonymous protection to user identity is critical due to the broadcast nature of wireless communications. This security requirement has been carefully deliberated in [9, 10, 11, 12, 13, 14, 15, 16, 17, 18]. In mobile networks, an UE should complete authentication for identity identification in advance of requesting for services when roaming to a foreign network (FN). The user anonymous authentication prevents eavesdroppers or/and FN from disclosing the real identities of UEs in every authentication session, whereby the locations of UEs (i.e., footprints) may be tracked.

Anonymity can be divided as two levels, partial user anonymity and full user anonymity. Partial user anonymous authentication conceals identities from eavesdroppers, excluding FNs [9, 10, 11] and full user anonymous authentication additionally considers FNs as eavesdroppers  [12, 13, 14, 15, 16, 18]. In case of full user anonymity, traceability and revocability are essential to support the permitted network operators to trace and revoke user identities for management purposes. Certain traceability and revocability techniques [12, 13, 18] have been introduced to cancel the anonymity protection in secure wireless communications.

The aforementioned studies provide elegant solutions to support anonymous and secure wireless communication between users and networks. For D2D communications, two secure D2D communication systems [19, 20] are proposed to support data sharing with distinct application scenarios. One [19] supports pseudonymity protection, where each real identity is replaced with a corresponding pseudo identity so that the sessions from the same device are traceable. The other [20] offers partial user anonymity, where system is able to trace the footprints of users.

Nevertheless, the new anonymity issue for the group information arises when direct communications between devices are launched for specific applications. In ProSe-enabled devices, the group is formed by devices using the same application. During the establishment of a D2D communication including device discovery procedure, the device, which initiates the D2D communication, needs to announce messages with an application identity so that it can be discovered by other devices in the same application group. Attackers may collect and analyze the application usage information and launch distributed denial-of-service (DDoS) attacks to specific groups or observe the behaviors of users in proximity for malicious purposes. Hence, group anonymous protection with traceability should be considered in D2D communication to protect the application information included in the announcing message need to be protected while establishing D2D communications.

End-to-end security is another required security property as devices exchange messages via D2D communications. This security property prevents system operators, who help to establish D2D communications, from eavesdropping exchanging messages between devices.

Security Difference. Compared to wireless communication, D2D communications additionally consider entity authentication without involving security infrastructure (i.e., authentication server), privacy protection against network infrastructure, group anonymity preventing from exposing group or application related identity, and end-to-end security among devices.

I-A Contributions

This work presents two group anonymous authenticated key exchange protocols for network-covered and network-absent D2D communications in mobile networks to support identity and group (application) anonymity, accountability (i.e., traceability and revocability), and end-to-end security against insider attacker (between devices). Specifically, we first propose the group-anonymous D2D communication with CN-assistance (CN-GD2C) protocol adopting identity-based encryption (IBE) against chosen ciphertext attacks (IND-CCA), Diffie-Hellman key exchange, symmetry-based encryption, and hash functions. We also propose the group-anonymous authenticated key exchange for network-absent D2D communication (NA-GD2C) protocol by utilizing the new proposed identity-based $k$-anonymity secret handshake scheme with the encryptions and proof technique by combining public-key encryptions (key-private encryption and Linear encryption) and zero-knowledge proof in the design. We then formally prove the security of these two protocols and develop an analytic model using queueing theory to evaluate authentication success rates of the proposed protocols and demonstrate the scalability and efficiency of the proposed protocols. We also implement the proposed protocols to estimate the computation costs on mobile devices, and obtain the authentication success rates by both simulation and analytic model.

The remainder of this paper is organized as follows. In Section II, we introduce the system and security models of D2D communication in mobile networks. In Section III, we propose group anonymous D2D communication protocols of network-covered and network-absent cases. The security analysis and performance evaluation on the proposed protocols are presented in Section IV and Section V, respectively. Finally, we conclude this work in Section VI.

II System and Security Models

This section introduces the system model including the functions of the system components and the operating procedures for secure D2D communications in ProSe [21, 22]. We then introduce the behaviors of the attackers, and propose the security model and its definitions of the proposed system.

II-A System Model and Security Requirements

II-A1 The System Model

In ProSe, there are two kinds of UEs, announcing UE (A-UE), who requests for establishing D2D communication, and monitoring UE (M-UE), who monitors the requests of D2D communications in proximity. In network-covered D2D communications, each UE shares long-term secret with authentication center/home subscriber server (AuC/HSS), which is response for the user subscription management, user authentication and session key management. When UEs establish D2D communication for ProSe, they can be either inside or outside of the coverage of CN. Each UE can access E-UTRAN via eNB in its coverage. Before establishing D2D communication, each A-UE and M-UE need to register to ProSe function to obtain the required parameters for D2D communication configuration.

In network-covered D2D communications, both A-UE and M-UE attach to CN for device discovery procedure with authentication and authorization. During a device discovery, the ProSe function will send authentication requests to AuC/HSS to authenticate participant devices. Once authentication requests are received, HSS/AuC will produce the corresponding authentication token for ProSe function to authenticate the UEs. By the aforesaid parameters from ProSe function, the A-UE can announce device discovery messages and be discovered by the M-UEs of the same application groups.

In network-absent D2D communications, HSS/AuC assigns each UE an identity with the corresponding private key of an IBE system for secure D2D communication. The identity is valid for a pre-defined duration and can be revoked as required. In both communication modes, the application identity of each UE for services are maintained by ProSe function.

II-A2 The Security Requirements

According to the system model, we analyze and propose the following security requirements that are urgently required in D2D communications.

• •

Authenticated key exchanged with end-to-end security: This is to guarantee the authentication of intended participants and confidentiality of the transmission between two UEs in ProSe. Typically, two parties achieve authenticated key exchange (AKE) with end-to-end secure communication based on a long-term secret only known by them. However, UEs only share long-term secret key with the HSS/AuC located in CN. Hence, AKE between two UEs needs the participation of the HSS/AuC and this leads the exchanged session key between two UEs will be known by the HSS/AuC. Namely, the communication between two UEs will be exposed to the CN. In the sense of D2D communications, communication confidentiality between two UEs should be guaranteed. Hence, ProSe needs to achieve authenticated key exchange with end-to-end security between two UEs.

• •

Identity and group anonymity: Identity anonymity is to guarantee that the identities of the participants in each AKE session are protected and cannot be linked between sessions to prevent outsider attackers from tracing the footprints of the participants. Besides that, group anonymity is also essential in ProSe since the usage of applications of UEs in ProSe is considered as sensitive information, which may be analyzed and utilized for disturbing services. Only two UEs in the same application group can successfully authenticate each other and exchange a session key. If two UEs belong to different groups, they are unable to learn identity and group information of each other in authentication [23]. Obviously, AKE with group anonymity also guarantees identity anonymity.

• •

Traceability and revocability: Traceability in group anonymous authentication guarantees the identity and group information of participants in every successful authentication session can be disclosed when the identities of UEs in ProSe are required for management or accounting purposes by CN. Only authorized entity, e.g., HSS/AuC or ProSe, can disclose the group and identity information. Revocability ensures the identity of every UE can be revoked to terminate D2D services.

II-B Security Models and Definitions

Figure 1 shows the attacker model of ProSe. An outsider attacker may eavesdrop the communications including the exchanged messages, the identity information, or the group information, between two UEs. It may break the confidentiality of communications, trace the footprints of UEs, or probe the using applications according to the group information. The outsider attacker may also impersonate as a legal user to pass the authentication and exchange a common session key with any legal user. Furthermore, a legal user can be an attacker to achieve mutual authentication and exchange a common session key with any user belonging to different group. Additionally, the ProSe function or HSS/AuC can be system attackers, who eavesdrop the exchanged messages between devices in D2D communications. This kind of attacker is commonly not considered by the security solutions in mobile networks. However, it makes sense to consider secure communication against the system attackers as the messages are merely exchanged between devices in D2D communications. Before defining the attackers, we define an authenticated key exchange protocol and the capabilities of attackers in the protocol as follows.

The proposed protocol is $\Pi$, and $\Pi_{U,V}^{t_{1}}$ and $\Pi_{V,U}^{t_{2}}$ are regarded as two instances to model two users $U$ and $V$ being the partners of each other in the communication session $t_{1}$ and $t_{2}$ of $\Pi$. We say that a matching conversation involving $\Pi_{U,V}^{t_{1}}$ and $\Pi_{V,U}^{t,2}$ if and only if $t_{1}=t_{2}$ and $U$ and $V$ are partners. The capability of an attacker can be captured by the following oracles.

• •

$\textbf{Execute}(\Pi_{U,V}^{t_{1}},\Pi_{V,U}^{t_{2}}):$ This oracle models a passive attacker, who can intercept all communications between $\Pi_{U,V}^{t_{1}}$ and $\Pi_{V,U}^{t_{2}}$.

• •

$\textbf{Send}(\Pi_{U,V}^{t_{1}},m):$ This oracle models an active attacker, who sends a message $m$ to $\Pi_{U,V}^{t_{1}}$.

• •

$\textbf{Reveal}(\Pi_{U,V}^{t_{1}}):$ This oracle models the exposure of the accepted session key of $U$ shared with its partner $V$ in the session $t_{1}$.

• •

$\textbf{Corrupt}(\Pi_{U,V}^{t_{1}}):$ This oracle models the exposure of the long-term secret key of $U$ during the session $t_{1}$ with its partner $V$.

• •

$\textbf{Test}(\Pi_{U,V}^{t_{1}}):$ When an attacker queries this oracle, it will return a real session key, accepted by $U$ with its partner $V$ in the session $t_{1}$, or a random string according to a random bit if the negotiation of the session key is complete. The query of this oracle is failed, if the session key is not negotiated.

• •

$\textbf{TestID}(\Pi_{U,V}^{t_{1}}):$ When an attacker queries this oracle, it will return the real identity of $U$ or a random string according to a random bit when $U$ and $V$ are accepted each other with a negotiated session key. The query of this oracle is failed, if the AKE is not fulfilled between $U$ and $V$.

• •

$\textbf{TestGroup}(\Pi_{U,V}^{t_{1}}):$ When an attacker queries this oracle, it will return the group information of $U$ or a random string according to a random bit when $U$ and $V$ are accepted each other with a negotiated session key. The query of this oracle is failed, if the AKE is not fulfilled between $U$ and $V$.

We then define the security of AKE in ProSe according to the discussed security requirements as follows.

Definition 1** (Mutul Authentication)**

There are a simulator $\mathcal{S}$, who simulates $\Pi_{U,V}^{t_{1}}$ or $\Pi_{V,U}^{t_{2}}$ by $\Pi$, and a probabilistic polynomial-time (PPT) attacker $\mathcal{A}$ of $\Pi$, who can query Execute and Send in polynomial time. After oracle queries, $\mathcal{A}$ sends a message to be accepted by $\Pi_{U,V}^{t_{1}}$ or $\Pi_{V,U}^{t_{2}}$ with the advantage as follows:

[TABLE]

The mutual authentication security of $\Pi$ is guaranteed for $U$ and $V$ if 1) $\Pi_{U,V}^{t_{1}}$ and $\Pi_{V,U}^{t_{2}}$ has a matching conversation with and are accepted by each other and 2) $\textbf{Adv}_{\mathcal{A}}^{\textrm{MA}}$ is negligible.

Definition 2** (Key Exchange against System Operator)**

$\mathcal{S}$* simulates $\Pi_{U,V}^{t_{1}}$ and $\Pi_{U,V}^{t_{2}}$ by $\Pi$ to interact with $\mathcal{A}$, who is either an outsider attacker or a system attacker (i.e., HSS/AuC or ProSe function), and can query Execute and Send in polynomial time. After oracle queries, $\Pi_{U,V}^{t_{1}}$ and $\Pi_{V,U}^{t_{2}}$ are accepted by each other with an exchanged session key $K_{U,V}$, $\mathcal{A}$ queries Test to obtain $K_{U,V}$ or a random string from $\Pi_{U,V}^{t_{1}}$ or $\Pi_{V,U}^{t_{2}}$ according to a random bit $b\in\{0,1\}$. Then, $\mathcal{A}$ outputs a guess $b^{\prime}\in\{0,1\}$ with the following advantage.*

[TABLE]

If $\textbf{Adv}_{\mathcal{A}}^{\textrm{SK}}$ is negligible, we say $\Pi$ achieves session key security.

Definition 3** (Identity Anonymity)**

$\mathcal{S}$* simulates $\Pi_{U,V}^{t_{1}}$ and $\Pi_{U,V}^{t_{2}}$ by $\Pi$ interacting with $\mathcal{A}$ and $\mathcal{A}$ can query Execute and Send in polynomial time. After oracle queries, $\Pi_{U,V}^{t_{1}}$ and $\Pi_{V,U}^{t_{2}}$ are accepted by each other, $\mathcal{A}$ queries TestID to obtain $\mathsf{ID}_{U}$ or $\mathsf{ID}_{V}$, or a random string from $\Pi_{U,V}^{t_{1}}$ or $\Pi_{V,U}^{t_{2}}$ according to a random bit $b\in\{0,1\}$. Then, $\mathcal{A}$ outputs a guess $b^{\prime}\in\{0,1\}$ with the following advantage.*

[TABLE]

If $\textbf{Adv}_{\mathcal{A}}^{\textrm{anon\_id}}$ is negligible, we say $\Pi$ achieves identity anonymity.

Definition 4** (Group Anonymity)**

The security of group anonymity is similar to that of identity anonymity. Instead, $\mathcal{A}$ queries TestGroup to obtain the group information or a random string from $\Pi_{U,V}^{t_{1}}$ or $\Pi_{V,U}^{t,2}$ according to $b\in\{0,1\}$. The advantage of guessing $b$ from the output $b^{\prime}\in\{0,1\}$ of $\mathcal{A}$ is as follows.

[TABLE]

If $\textbf{Adv}_{\mathcal{A}}^{\textrm{anon\_group}}$ is negligible, we say $\Pi$ achieves group anonymity.

III Proposed Group Anonymous D2D Communications

In this section, we propose two group anonymous schemes including the main building blocks for network-covered and network-absent cases.

III-A Preliminary

This section introduces the preliminaries of the proposed protocols.

III-A1 Bilinear Groups

We first define the used bilinear map operation [25, 26, 27, 28]. The bilinear maps is defined as $e:\mathbb{G}_{1}\times\mathbb{G}_{2}\rightarrow\mathbb{G}_{T}$, where all group $\mathbb{G}_{1}$, $\mathbb{G}_{2}$, and $\mathbb{G}_{T}$ are multiplicative and of prime order $p$. When $g_{1}$ is a generator of $\mathbb{G}_{1}$ and $g_{2}$ is a generator of $\mathbb{G}_{2}$, there exists a computable isomorphism $\psi$ from $\mathbb{G}_{2}$ to $\mathbb{G}_{1}$ such as $\psi(g_{1})=g_{1}$. The map $e$ has the following properties: 1) bilinearity: for all $u\in\mathbb{G}_{1}$, $b\in\mathbb{G}_{2}$, and $(a,b)\in\mathbb{Z}_{p}^{2}$, $e(u^{a},v^{b})=e(u,v)^{ab}$; and 2) non-degeneracy: $e(g_{1},g_{2})\neq 1$.

III-A2 Identity-based Encryption

The concept of identity-based encryption (IBE) is to eliminate the management costs of user certificates, i.e., verifying its correctness and its revocation. A usable IBE is first proposed by Boneh and Franklin [29] (BF-IBE) with IND-CCA in random oracle model. It consists of four algorithms as follows.

• •

Setup: This algorithm is given a security parameter $\kappa$ to generate a prime $p$ and two bilinear groups $\mathbb{G}$ and $\mathbb{G}_{T}$ such that a bilinear map $e:\mathbb{G}\times\mathbb{G}\rightarrow{}G_{T}$ holds. It then chooses a random generator $g\in{}\mathbb{G}$, sets $G_{pub}=g^{s}$ for a randomly selected $s\in\mathbb{Z}_{p}$, and chooses two cryptographic hash functions, $\mathsf{H}_{1}:\{0,1\}^{*}\rightarrow{}\mathbb{G}^{*}$ and $\mathsf{H}_{2}:\mathbb{G}_{T}\rightarrow\{0,1\}^{n}$ for some $n$. The message space is $\mathcal{M}=\{0,1\}^{n}$ and the ciphertext space is $\mathcal{C}=\mathbb{G}^{*}\times\{0,1\}^{n}$. The system parameters are $\mathsf{param}=\{p,\mathbb{G},\mathbb{G}_{T},e,n,g,G_{pub},\mathsf{H}_{1},\mathsf{H}_{2}\}$ and the master key of the system is $\mathsf{msk}=s$.

• •

Extract: This algorithm is given an identity $\mathsf{ID}\in\{0,1\}^{*}$ and computes the corresponding private key $d_{\mathsf{ID}}=Q_{\mathsf{ID}}^{s}$, where $Q_{\mathsf{ID}}=\mathsf{H}_{1}(\mathsf{ID})\in\mathbb{G}^{*}$.

• •

Encrypt: Given a message $M\in\mathcal{M}$ and the identity $\mathsf{ID}$ as the public key, this algorithm encrypts the message as $C=\{g^{r},M\oplus{}\mathsf{H}_{2}(g_{\mathsf{ID}}^{r})\}=\{U,V\}$, where $g_{\mathsf{ID}}=e(Q_{\mathsf{ID}},G_{pub})\in\mathbb{G}^{*}_{T}$ and $Q_{\mathsf{ID}}=\mathsf{H}_{1}(\mathsf{ID})\in\mathbb{G}^{*}$.

• •

Decrypt: Given a ciphertext $C$ encrypted by $\mathsf{ID}$ and the private key $d_{\mathsf{ID}}$, the algorithm decrypts the message by $M=V\oplus{}\mathsf{H}_{2}(e(d_{\mathsf{ID}},U))=M$.

Security of IBE. The notion of ciphertext indistinguishability for the security of public-key encryption has been introduced to make an attacker obtain no information of the plaintext from a given ciphertext [30]. A stronger security notion of IND-CCA is proposed to satisfy the security requirement of secure communication [31], where the attacker can decrypt any chosen ciphertexts other than the target ciphertext.

An IBE is IND-CCA secure if the advantage of any probabilistic polynomial-time (PPT) adversary, $\mathcal{A}$, in the following game is negligible:

1. $\mathcal{A}$ issues $m$ queries for the private keys $d_{\mathsf{ID}_{i_{1}}},...,d_{\mathsf{ID}_{i_{m}}}$ of $\mathsf{ID}_{i_{1}},...,\mathsf{ID}_{i_{m}}$;
2. $\mathcal{A}$ may make polynomial number of queries to a decryption oracle to obtain the corresponding plaintexts of the chosen ciphertext $C_{i}$ with $\mathsf{ID}_{i}$;
3. $\mathcal{A}$ outputs two chosen messages $(M_{1}$, $M_{2})$ and the target identity, which is not queried for the private key, and is given a challenge ciphertext $C^{*}=\textbf{Encrypt}(\mathsf{param},\mathsf{ID}^{*},M_{b})$ on message $M_{b}$ according to a random bit $b\in\{0,1\}$;
4. $\mathcal{A}$ makes another polynomial number of queries to extract the private keys and decrypt for the plaintexts by the given identities and ciphertexts (Restriction: The queried identites and ciphertexts should be different from $\mathsf{ID}^{*}$ and $C^{*}$); and 5) eventually, $\mathcal{A}$ outputs a bit $b^{\prime}\in\{0,1\}$. If $b=b^{\prime}$, $\mathcal{A}$ wins the game.

III-A3 Proof on Dual Encryptions

To support traceability of the group anonymous AKE in network-absent D2D communications, we will adopt the concept of proof on dual encryptions. The transcripts of each authentication session is anonymous to the outsiders, including ProSe function, as group anonymity is guaranteed. We leave a trapdoor for the ProSe function to open the messages of the session by encrypting the message in a session with the public key of each participant device and the public key of ProSe function and proving the encryptions on the same messages. Before introducing the proof on dual encryptions, we introduce two encryption algorithms, i.e., key-private and Linear public-key encryptions. The procedures of key-private encryption are as follows: 1) the public key and the private key of a user are given by $pk=(g,p,X)$ and $sk=(g,p,x)$, respectively, and 2) the ciphertext of the key-private encryption on a message $M$ becomes $C_{1}=(g^{y},M\cdot X^{y})=(Y,C)$. One can decrypt the message by $M=C/Y^{x}$.

The Linear encryption [25] is underlaid on the decision linear problem and shown as follows: 1) the public key and the private key of $T$ are given by $pk=(u,v,h)$ and $sk=(\hat{x},\hat{y})$, respectively, and 2) the ciphertext of the linear encryption on a message $M$ becomes $C_{2}=(M\cdot h^{\beta_{1}+\beta_{2}},u^{\beta_{1}},v^{\beta_{2}})=(\hat{C},T_{1},T_{2})$. One can decrypt the message by $M=\hat{C}/\left(T_{1}^{\hat{x}}\cdot{}T_{2}^{\hat{y}}\right)$.

The proof of dual encryptions, i.e., the key-private encryption and the linear encryption, and its verification can be done as the following two algorithms.

• •

EncProof$(C_{1},C_{2},\beta_{1},\beta_{2},y):$ First, the prover randomly selects $r_{\beta_{1}}$, $r_{\beta_{2}}$, and $r_{y}$, and computes $R_{1}\!=u\!^{r_{\beta_{1}}}$, $R_{2}\!=\!v^{r_{\beta_{2}}}$, and $R_{3}\!=\!e(h,g)^{r_{\beta_{1}}+r_{\beta_{2}}}\cdot e(X,g)^{-r_{y}}$. Then it computes $c\!=\!\mathsf{H}(C_{1},$ $C_{2},$ $R_{1},$ $R_{2},$ $R_{3},$ $T_{1},$ $T_{2},$ $X)$ and $s_{\beta_{1}}=r_{\beta_{1}}+c\beta_{1}$, $s_{\beta_{2}}=r_{\beta_{2}}+c\beta_{2}$, and $s_{y}=r_{y}+cy$. After that, the prover outputs $(c,s_{\beta_{1}},s_{\beta_{2}},s_{y},R_{1},R_{2},R_{3})$ as the proof to the verifier.

• •

EncVer$(C_{1},C_{2},c,s_{\beta_{1}},s_{\beta_{2}},s_{y},R_{1},R_{2},R_{3}):$ The verifier then checks if $C_{1}$ and $C_{2}$ are the ciphertexts on the same plaintext by $R_{1}=u^{s_{\beta_{1}}}\cdot T^{-c}_{1}$, $R_{2}=v^{s_{\beta_{2}}}\cdot T^{-c}_{2}$, $R_{3}=e(h,g)^{s_{\beta_{1}}+s_{\beta_{2}}}\cdot e(X,g)^{-s_{y}}\cdot e(C/\hat{C},g)^{c}$, and $c=\mathsf{H}(C_{1},C_{2},R_{1},R_{2},R_{3},T_{1},T_{2},X)$. If the equations hold, the ciphertexts produced by the prover are the encryptions on the same plaintext, and this algorithm outputs $\mathsf{true}$ or $\mathsf{false}$ otherwise.

III-B Key Management and User Registration

The key management of the proposed GRAAD inherits the key management of the conventional security architecture of LTE, where each $\textrm{UE}_{i}$ shares a long-term secret key $K_{i}$ with HSS/AuC after registration. In addition, the key management on UEs, ProSe function, and HSS/AuC for the security of ProSe is considered as shown in Fig. 2. On HSS/AuC, the real identity $\mathsf{ID}_{i}$, the corresponding application identity $\mathsf{AID}_{i}$ and the shared secret $K_{i}$ of each UE are stored. Additionally, the HSS/AuC generates a master secret key, $\mathsf{msk}=s$, for randomly selected $s\in\mathbb{Z}_{p}$ and the corresponding public parameters, $\mathsf{param}$, by Setup (as introduced in Sec. III-A2) to build an BF-IBE system. On the ProSe function, $\mathsf{AID}_{i}$ and the corresponding group identity $\mathsf{GID}_{i}$ of each UE are managed. Besides that, the ProSe function is associated a unique secret key $K_{\textrm{p}}$ and generates a public/private key pair of Linear encryption as $\{pk_{\textrm{P}}=(u,v,h),sk_{\textrm{P}}=(\hat{x},\hat{y})\}$. HSS/AuC issues each UEi a BF-IBE user private key $d_{\mathsf{ID}_{i}}=s\cdot{}Q_{\mathsf{UID}_{i}}$ by Extract in Sec. III-A2, where $Q_{\mathsf{UID}_{i}}=\mathsf{H}_{1}(\mathsf{UID}_{i})$ and $\mathsf{UID}_{i}=\mathsf{GID}_{i}||\mathsf{AID}_{i}$.

III-C Group Anonymous AKE for Network-covered D2D Communication (CN-GD2C)

The notations are introduced in Table I and the key management is introduced in Sec. III-B for the proposed protocol. The details of the proposed CN-GD2C protocol are as follows.

After negotiating the parameters for D2D communication, $\mathrm{UE}_{i}$ randomly selects a session identity $sid\in\mathbb{Z}_{p}$ and $(x_{i},r)\in\mathbb{Z}_{p}^{2}$. It then computes $\mathcal{X}=g^{x_{i}}$, $\delta_{i}=\mathsf{H}(AK_{i}\oplus{}sid)$ and $\mathcal{E}_{i}=\{g^{r},\mathsf{ID}_{i}\oplus{}\mathsf{H}_{2}(g_{\mathsf{TID}_{i}}^{r})\}$ and send them to $\mathrm{UE}_{j}$, where $\mathsf{TID}_{i}=\delta_{i}||\mathcal{X}||sid$ and $\mathcal{E}_{i}$ is the BF-IBE ciphertext. 2. 2.

$\mathrm{UE}_{2}$ keeps $\mathcal{X}$ and computes $\mathcal{Y}=g^{y_{j}}$, $\delta_{j}=\mathsf{H}(AK_{j}\oplus{}sid)$, and $\mathcal{E}_{j}=\{g^{r^{\prime}},\mathsf{ID}_{j}\oplus{}\mathsf{H}_{2}(g_{\mathsf{TID}_{j}}^{r^{\prime}})\}$ with randomly selected $y_{j},r^{\prime}$, where $\mathsf{TID}_{j}=\delta_{j}||\mathcal{Y}||sid$ and $\mathcal{E}_{j}$ is the BF-IBE ciphertext. It then sends $sid,\delta_{i},\delta_{j},\mathcal{E}_{i},\mathcal{E}_{j},\mathcal{X},\mathcal{Y}$ to HSS/AuC via eNB. 3. 3.

The HSS/AuC first decrypts $\mathcal{E}_{i}$ and $\mathcal{E}_{j}$ by $\mathsf{ID}_{i}=\mathcal{E}_{i,2}\oplus{}\mathsf{H}_{2}(e(d_{\mathsf{TID}_{i}},\mathcal{E}_{i,1}))$ and $\mathsf{ID}_{j}=\mathcal{E}_{j,2}\oplus{}\mathsf{H}_{2}(e(d_{\mathsf{TID}_{j}},\mathcal{E}_{j,1}))$, where $\mathsf{TID}_{i}=\delta_{i}||\mathcal{X}||sid$ and $\mathsf{TID}_{j}=\delta_{j}||\mathcal{Y}||sid$. $d_{\mathsf{TID}_{i}}$ and $d_{\mathsf{TID}_{j}}$ can be produced by the HSS/AuC with $\mathsf{msk}$. The HSS/AuC then finds the corresponding application identities $\mathsf{AID}_{i}$ and $\mathsf{AID}_{j}$ of $\mathsf{ID}_{i}$ and $\mathsf{ID}_{j}$ and sends $sid,\delta_{i},\delta_{j},\mathsf{AID}_{i},\mathsf{AID}_{j}$ to the ProSe function to check the group information. If $G(\mathsf{AID}_{i})=G(\mathsf{AID}_{j})$, then the ProSe function computes $ack_{i}=\mathsf{H}(AK_{i}\oplus{}sid\oplus{}\mathsf{true})$ and $ack_{j}=\mathsf{H}(AK_{j}\oplus{}sid\oplus{}\mathsf{true})$, where $G(\mathsf{AID})$ returns the belonging group of $\mathsf{AID}$ and $AK_{i}=\mathsf{AID}_{i}\oplus{}\mathsf{GID}_{i}\oplus{}K_{\textrm{P}}$. Once received $sid,ack_{i},ack_{j}$, and $\mathsf{true}$, the HSS/AuC confirms $\mathsf{AID}_{i}$ and $\mathsf{AID}_{i}$ belong to the same group and sends $\mathcal{E}^{\prime}_{i}=\mathsf{E}_{\text{S}}(K_{i},ack_{i}||(sid\oplus{}R))$ and $\mathcal{E}^{\prime}_{j}=\mathsf{E}_{\text{S}}(K_{j},ack_{j}||(sid\oplus{}R))$ to $\mathrm{UE}_{j}$. 4. 4.

$\mathrm{UE}_{j}$ first decrypts $\mathcal{E}^{\prime}_{i}$ with $K_{i}$ to obtain $ack_{i}||(sid\oplus{}R)$ and verify $ack_{i}\stackrel{{\scriptstyle?}}{{=}}\mathsf{H}(AK_{i}\oplus{}sid\oplus{}\mathsf{true})$. If so, $\mathrm{UE}_{j}$ extracts $R$ from $sid\oplus{}R$ and sends $\mathcal{E}^{\prime}_{i}$ to $\mathrm{UE}_{i}$. 5. 5.

$\mathrm{UE}_{i}$ decrypts $\mathcal{E}^{\prime}_{j}$ with $K_{j}$ to obtain $ack_{i}||(sid\oplus{}R)$ and verify $ack_{j}$ the same as the previous step. Then, $\mathrm{UE}_{i}$ extracts $R$ and sends $RES_{i}=\mathsf{E}_{\text{S}}(K_{i},R)$ to $\mathrm{UE}_{j}$. Once received $RES_{i}$, $\mathrm{UE}_{j}$ computes $RES_{j}=\mathsf{E}_{\text{S}}(K_{j},RES_{i}\oplus{}R)$ and sends to the HSS/AuC. 6. 6.

The HSS/AuC decrypts $RES_{j}$ with $K_{j}$ to obtain $RES_{i}\oplus{}R$. It then obtains $RES_{i}$ from $RES_{i}\oplus{}R$ by $R$ and decrypts $RES_{i}$ with $K_{i}$ to check if it is equal to $R$. If so, HSS/AuC sends $XRES_{i}=\mathsf{H}(K_{i},sid)$ and $XRES_{j}=\mathsf{H}(K_{j},sid)$ to $\mathrm{UE}_{j}$, and $\mathrm{UE}_{j}$ forwards $XRES_{i}$ to $\mathrm{UE}_{i}$. $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$ accept the authenticated key exchange session for the following D2D communication between them according the verification on $XRES_{i}$ and $XRES_{j}$. Finally, $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$ computes the same session key by $K_{ij}=\mathcal{Y}^{x_{i}}=g^{y_{j}\cdot{}x_{i}}=\mathcal{X}^{y_{j}}=g^{x_{i}\cdot{}y_{j}}$, respectively.

III-D Group-anonymous AKE for Network-absent D2D Communication (NA-GD2C)

This section presents a group anonymous AKE for network-absent D2D communication (NA-GD2C) protocol with traceability, where only two devices are involved in the protocol. Specifically, the objective of NA-GD2C protocol is to conceal the group information of both devices from outsiders and CN, except for a trusted authority that is granted to reveal the group information of users and not a part of CN. As the dispute is arisen in a session, designated authorities, i.e., ProSe function and HSS/AuC, can engage to trace the identities of the originators. Nonetheless, the identity of every UE is revocable by announcing the revoked identities in the system. The NA-GD2C protocol achieves the aforesaid goals based on the techniques of $k$-anonymous secret handshakes, identity-based encryption, and non-interactive zero-knowledge proof.

In the following subsections, we describe the design intuition of group anonymous protection based on $k$-anonymous secret handshakes and identity-based encryption. Then, we present the propose the NA-GD2C protocol based on the proposed group anonymous protection technique.

III-D1 Group anonymity by $k$-anonymous Secret Handshakes

The $k$-anonymous secret handshakes (SH) can achieve adjustable group anonymous authentication where the adversary exists with the probability of $\frac{1}{k}$ to identify the group information of given user pairs [32]. Moreover, the $k$-anonymous SH enjoys the property of revocability since it utilizes user certificates, which are reusable and can be revoked by announcing certificate revocation list (CRL). Compared to the unlinkable secret handshakes [33] by group signatures and group key agreement, $k$-anonymous SH needs less computation costs. SH supports each user to authenticate to the others according to the possessed group information but not identity information [23, 34, 32]. Namely, each user belonging to a group can only successfully authenticate to the other users in the same group. Otherwise, the authentication process does not leak any information to the counterpart or eavesdroppers who do not belong to the same group. However,the communication costs of $k$-anonymous SH is linear to the anonymity degree, i.e., $k$, for exchanging the public keys of selected user pairs in the protocol. Hence, this work shows an enhanced $k$-anonymous SH by applying identity-based encryption in the design. The public keys of the selected user pairs are replaced with the identities, which can be derived by constant number of variables, of them. We propose the following four functions to achieve $k$-anonymous SH with constant communication cost in the proposed NA-GD2C.

• •

gSelect$(\mathbf{G},U,w,N_{u},N_{v}):$ $\mathbf{G}$ is divided into $\{\mathbf{G}_{1}$,…,$\mathbf{G}_{w}\}$, where $\mathbf{G}_{z}=\{\mathbf{G}_{z_{0}},...,\mathbf{G}_{z_{\lceil m/(w-1)\rceil}}\}$, where $U\in\mathbf{G}_{i_{u}}$ for some $0\leq{}i\leq{}w-1$ and $0\leq{}u\leq{}m/(w-1)$. Set $\eta=f_{1}(N_{u},N_{v},0)$, $x=f_{1}(N_{u},N_{v},1,)$, and $y=u+r\cdot{}(m/w)$, where $r$ is randomly selected from $\{0,...,\lfloor(p+1)\cdot{}(w/m)\rfloor\}$, where $p$ is a large prime. Solve $\theta_{1}$ with $(y,\eta,x)$ such that $y=\eta{}\cdot{}x+\theta_{1}\mod p$. For $z=0$ to $w-1$ (except $z=i$), set $y=\eta\cdot{}f_{1}(N_{u},N_{v},1,z)+\theta_{1}\mod p$ and $s_{z}=y\mod m/w$. Then, compute $\sigma_{g}=\mathsf{H}(s_{0},...,s_{w-1})$ and output $(\theta_{1},\sigma_{g})$. ％％％％％％％％％％％％％％％％％％％％％％％％％％％％％％

• •

uSelect$(\bar{\textbf{G}},X,w,N_{u},N_{v}):$ $\bar{\mathbf{G}}$ is divided into $\{\bar{G}_{z_{s_{z}}}\}_{z=0}^{w-1}$, where $\bar{G}_{z_{s_{z}}}\in\mathbf{G}$ and $X$ is the $\lambda$-th member of $\bar{G}_{a_{s_{a}}}$ for some $0\leq{}a\leq{}w-1$ and $0\leq{}\lambda\leq{}|\bar{G}_{a_{s_{a}}}|-1$. Set $\eta=f_{1}(N_{u},N_{v},2)$ and $x=f_{1}(N_{u},N_{v},3,a,s_{a})$, and $y=\lambda+r\cdot{}|\bar{G}_{a_{s_{a}}}|$, where $r$ is selected randomly from $\{0,...,\lfloor(p+1)/|\bar{G_{a_{s_{a}}}}|\rfloor\}$. Solve $\theta_{2}$ with $(y,\eta,x)$ such that $y=\eta\cdot{}x+\theta_{2}\mod p$. For $z=0$ to $w-1$ (except $z=a$), set $y=\eta\cdot{}f_{1}(N_{u},N_{v},3,z,s_{z})+\theta_{2}\mod p$ and $\lambda_{z}=y\mod|\bar{G}_{z_{s_{z}}}|$. It then computes $\sigma_{u}=\mathsf{H}(\lambda_{0},...,\lambda_{w-1})$ and outputs $(\theta_{2},\sigma_{u})$.

• •

gSelectVer$(\mathbf{G},w,N_{u},N_{v},\theta_{1},\sigma_{g}):$ First, for $z=0$ to $w-1$, calculate $\eta=f_{1}(N_{u},N_{v},0)$, $y=\eta\cdot{}f_{1}(N_{u},N_{v},1,z)+\theta_{1}\mod p$, and $s_{z}=y\mod m/w$. After that, check whether $\sigma_{g}\stackrel{{\scriptstyle?}}{{=}}\mathsf{H}(s_{0},...,s_{w-1})$. If so, output $(s_{0},...,s_{w-1})$.

• •

uSelectVer$(\bar{\mathbf{G}},w,N_{u},N_{v},\theta_{2},\sigma_{u}):$ Parse $\bar{\mathbf{G}}$ as $\{\bar{G}_{z_{s_{z}}}\}_{z=0}^{w-1}$. Afterwards, for $z=0$ to $w-1$, calculate $\eta=f_{1}(N_{u},N_{v},2)$, $x=f_{1}(N_{u},N_{v},3,z,s_{z})$, $y=\eta\cdot{}x+\theta_{2}\mod p$, and $\lambda_{z}=y\mod|\bar{G}_{z_{s_{z}}}|$. Then, check whether $\sigma_{u}\stackrel{{\scriptstyle?}}{{=}}\mathsf{H}(\lambda_{0},...,\lambda_{w-1})$. If so, output $\{X_{z_{s_{z}},\lambda_{z}}\}_{z=0}^{w-1}$, where $X_{s_{s_{z}},lambda_{z}}$ denotes the $\lambda_{z}$-th user in $\bar{G}_{z_{s_{z}}}$.

These four functions are to guarantee the exchanged group and user information being selected randomly for $k$-anonymous protection in NA-GD2C.

III-D2 Proposed NA-GD2C Protocol

Let us consider $n$ UEs, $\mathbf{U}=\{\mathrm{UE}_{1},...,\mathrm{UE}_{n}\}$, that belong to $m$ different application groups, $\mathbf{G}=\{G_{1},...,G_{m}\}$, in D2D communication. For $\mathrm{UE}_{i}$ with an assigned identity $\mathsf{ID}_{i}$, the identity-based user private key $d_{\mathsf{ID}_{i}}$ is issued by HSS/AuC as introduced in Sec. III-B. Additionally, $\mathsf{ID}_{i}$ generates a public/private key pair, $(pk_{i},sk_{i})$, of key-private public key encryption as introduced in Sec. III-A3. Each UE belongs to one group only, and $G(U_{i})=G_{j}$ means the belonging group of $U_{i}$ is $G_{j}$.

We consider two UEs, an $\mathrm{UE}_{U}\in\mathbf{U}$ belongs to the group $G(\mathrm{UE}_{U})=G_{i_{s_{i}}}$ and an $\mathrm{UE}_{V}\in\mathbf{U}$ belongs to the group $G(\mathrm{UE}_{V})=G_{j_{s_{j}}}$. For D2D communication between $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$, they want to authenticate each other to check whether they are legal users and belong to the same group. The protocol of proposed group-anonymous D2D communication is shown in Fig. 3 and described as follows.

In the beginning, $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$ negotiate the parameters of D2D communication and exchange two random numbers $N_{U}$ and $N_{V}$ selected by them, respectively. Afterwards, $\mathrm{UE}_{U}$ generates $\theta_{1}$, $\theta_{2}$, $\sigma_{g}$, and $\sigma_{u}$ by $(\theta_{1},\sigma_{g})\!\leftarrow{}\!\textbf{gSelect}(\mathbf{G},\mathrm{UE}_{U},w,N_{U},N_{V})$ and $(\theta_{2},\sigma_{u})\!\leftarrow{}\!\textbf{uSelect}(\bar{\mathbf{G}},\mathrm{UE}_{U},w,N_{U},N_{V})$ and sends them to $\mathrm{UE}_{V}$, where gSelect and uSelect are introduced in Sec. III-D1. 2. 2.

$\mathrm{UE}_{V}$ generates $(s_{0},...,s_{w-1})\!\leftarrow{}\!\textbf{gSelectVer}(\bar{\mathbf{G}},w,$ $N_{u},$ $N_{v},$ $\sigma_{g})$, $\{U_{z_{s_{z}},\lambda_{z}}\}_{z=0}^{w-1}\!\leftarrow{}\!\textbf{uSelectVer}(\bar{\mathbf{G}},$ $V,$ $w,$ $N_{u},$ $N_{v},$ $\theta^{\prime}_{2},$ $\sigma^{\prime}_{u})$, and encrypts a randomly selected $\delta\in\mathbb{Z}_{p}$ and $pk_{V}$ as $\mathcal{E}_{V}=\{g^{r},(\delta||pk_{V})\oplus{}\mathsf{H}_{2}(g^{r}_{\tilde{\mathsf{ID}}_{U_{j_{s_{j}},\lambda_{j}}}})\}$, where $r\in\mathbb{Z}_{p}$ is selected at random. It then sends $(\theta^{\prime}_{2},\sigma^{\prime}_{u},\mathcal{E}_{V})$ to $\mathrm{UE}_{U}$. 3. 3.

$\mathrm{UE}_{U}$ generates $\{V_{z_{s_{z}},\lambda^{\prime}_{z}}\}_{z=0}^{w-1}\!\leftarrow{}\!\textbf{uSelectVer}(\bar{\mathbf{G}}$, $w,$ $N_{u},$ $N_{v},$ $\theta^{\prime}_{2},$ $\sigma^{\prime}_{u})$, and encrypts a randomly selected $\gamma\in\mathbb{Z}_{p}$ and $pk_{U}$ as $\mathcal{E}_{U}=\{g^{r^{\prime}},(\gamma||pk_{U})\oplus{}\mathsf{H}_{2}(g^{r^{\prime}}_{\tilde{\mathsf{ID}}_{V_{i_{s_{i}},\lambda^{\prime}_{i}}}})\}$. It then decrypts $\mathcal{E}_{V}$ by $\delta^{\prime}||pk_{V}^{\prime}=\mathcal{E}_{V,2}\oplus{}\mathsf{H}_{2}(e(d_{\tilde{\mathsf{ID}}_{U_{i_{s_{i}},\lambda_{i}}}},\mathcal{E}_{V,1}))$ to obtain $\delta^{\prime}$ and $pk^{\prime}_{V}$. Afterwards, $\mathrm{UE}_{U}$ computes $\sigma_{0}=f_{0}(\gamma,\delta^{\prime})$ and encrypts $\gamma$ with $pk_{\textrm{P}}$ and $pk_{U},sk_{U}$ as $C_{1,U}=(Y_{U},C_{U})=(g^{y},(\gamma||i_{U})\cdot{}X_{V}^{y})$ and $C_{2,U}=(T_{1,U},T_{2,U},\hat{C}_{U})=(u^{\beta_{1}},v^{\beta_{2}},(\gamma||i_{U})\cdot{}h^{\beta_{1}+\beta_{2}})$, where $i_{U}$ is the group index of $U$ such that $U\in{}G_{i_{U}}$. It then obtains $\pi_{U}=(c,s_{\beta_{1}},s_{\beta_{2}},s_{y},R_{1},R_{2},R_{3})$ by running $\textbf{EncProof}(C_{1,U},C_{2,U},\beta_{1},\beta_{2},y)$ as in Sec. III-A3 and sends $\mathcal{E}_{U},\sigma_{U},C_{1,U},C_{2,U},c,s_{\beta_{1}},s_{\beta_{2}},s_{y},R_{1},R_{2},$ and $R_{3}$ to $\mathrm{UE}_{V}$. 4. 4.

$\mathrm{UE}_{V}$ first decrypts $\mathcal{E}_{V}$ by $\gamma^{\prime}||pk_{U}=$ $\mathcal{E}_{U,2}\oplus{}$ $\mathsf{H}_{2}(e(d_{\tilde{\mathsf{ID}}_{V_{j_{s_{j}},\lambda_{j}}}},$ $\mathcal{E}_{U,1}))$ and checks if $\sigma_{U}\stackrel{{\scriptstyle?}}{{=}}f_{0}(\gamma^{\prime},\delta)$, $\mathsf{true}\stackrel{{\scriptstyle?}}{{=}}\textbf{EncVer}(C_{1,U},C_{2,U},c,s_{\beta_{1}},s_{\beta_{2}},s_{y},R_{1},R_{2},R_{3})$, and $\gamma^{\prime}||i_{U}\stackrel{{\scriptstyle?}}{{=}}C_{U}/Y_{U}^{x_{V}}$. If so, it accepts $\mathrm{UE}_{U}$ belonging to its group and computes $\sigma_{1}=f_{0}(\gamma^{\prime},\delta,1)$, $C_{1,V}=(Y_{V},C_{V})=(g^{y^{\prime}},(\delta||i_{V})\cdot{}X_{U}^{y^{\prime}})$, $C_{2,V}=(T_{1,V},T_{2,V},\hat{C}_{V})=(u^{\alpha^{\prime}},v^{\beta^{\prime}},(\delta||i_{V})\cdot{}h^{\alpha^{\prime}+\beta^{\prime}})$, and $\pi_{V}=(c,s^{\prime}_{\beta_{1}},s^{\prime}_{\beta_{2}},s^{\prime}_{y},R^{\prime}_{1},R^{\prime}_{2},R^{\prime}_{3})\!\leftarrow{}\!\textbf{EncProof}(C_{1,V},C_{2,V},\beta^{\prime}_{1},\beta^{\prime}_{2},y^{\prime})$, where $i_{V}$ is the group index of $V$ such that $V\in{}G_{i_{V}}$. After that, $\mathrm{UE}_{V}$ sends $\sigma_{1},C_{1,V},C_{2,V},c^{\prime},s^{\prime}_{\beta_{1}},s^{\prime}_{\beta_{2}},s^{\prime}_{y},R^{\prime}_{1},R^{\prime}_{2},$ and $R^{\prime}_{3}$ to $\mathrm{UE}_{U}$. 5. 5.

$\mathrm{UE}_{U}$ checks if $\sigma_{1}\stackrel{{\scriptstyle?}}{{=}}f_{0}(\gamma,\delta^{\prime},1)$, $\mathsf{true}\stackrel{{\scriptstyle?}}{{=}}\textbf{EncVer}(C_{1,V},C_{2,V},c^{\prime},s^{\prime}_{\beta_{1}},s^{\prime}_{\beta_{2}},s^{\prime}_{y},R^{\prime}_{1},R^{\prime}_{2},R^{\prime}_{3})$, and $\delta^{\prime}||i_{V}\stackrel{{\scriptstyle?}}{{=}}C_{V}/Y_{V}^{x_{U}}$. If so, it accepts $\mathrm{UE}_{V}$ belonging to its group and computes $\sigma_{2}=f_{0}(\gamma,\delta^{\prime},2)$. $\mathrm{UE}_{U}$ sends $\sigma_{2}$ to $\mathrm{UE}_{V}$. $\mathrm{UE}_{V}$ then checks the correctness of $\sigma_{2}$ and stores it. Finally, $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$ share the same session key $K_{U,V}=f_{0}(\gamma,\delta,3)$.

III-E NA-GD2C with Traceability

In case of dispute or management requirement, $\mathrm{UE}_{U}$ or $\mathrm{UE}_{V}$ sends $(\tilde{\mathsf{ID}}_{U_{i_{s_{i}},\lambda_{i}}},\tilde{\mathsf{ID}}_{V_{j_{s_{j}},\lambda_{j}}})$, $(\pi_{U},\pi_{V})$, and $\sigma_{1},\sigma_{2}$ to the ProSe function to prove the participation of $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$ in the specified D2D communication session as follows. The ProSe function first checks the correctness of $(C_{1,U},C_{2,U},C_{1,V},C_{2,V})$ by EncVer with $(\pi_{U},\pi_{V})$ as in Sec. III-A3. It then decrypts $C_{2,U}$ and $C_{2,V}$ to obtain $\gamma$ and $\delta$ by $\hat{C}_{U}/(T_{1,U}^{\hat{x}}\cdot{}T_{2,U}^{\hat{y}})$ and $\hat{C}_{V}/(T_{1,V}^{\hat{x}}\cdot{}T_{2,V}^{\hat{y}})$ to verify $\sigma_{0}$, $\sigma_{1}$ or $\sigma_{2}$.

III-F Membership Management

The membership of the proposed two protocols can be managed as follows. For CN-GD2C, once any member of an application group joins or leaves, the HSS/AuC and ProSe function will update the membership information. Since every authentication needs to interact with HSS/AuC and ProSe function, each membership update will immediately take effect in the following D2D authentication sessions. For NA-GD2C, every authentication uses the identities of UEs in different application groups. Hence, HSS/AuC will issue the corresponding user private key for each new UE, and revoke the identities of revoked UEs and list them on the revocation list in public. In summary, the costs of membership maintenance are both constants for CN-GD2C and NA-GD2C regardless of the number of groups and UEs in the system.

IV Security Analysis

In this section, we prove the security of the proposed protocols based on the security definition in Sec. II-B.

IV-A Security Analysis of CN-GD2C Protocol

In the network-covered D2D communications, traceability and revocability are readily guaranteed as all communications of UEs are performed under the control of CN. Hence, we prove that the proposed CN-GD2C protocol achieves the mutual authentication, secure key exchange for end-to-end security, and identity and group anonymity as follows.

Theorem 1

(Mutual Authentication) The proposed CN-GD2C protocol is a mutual authentication protocol between two UEs if $\mathsf{E}_{\text{S}}$ is a pesudorandom permutation and $\mathsf{H}$ is a pseudorandom function.

Proof:

The CN-GD2C achieves mutual authentication between $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$ by the verification of $(RES_{i},RES_{j})$ by HSS/AuC and that of $(\mathcal{E}^{\prime}_{i},\mathcal{E}^{\prime}_{j})$ and $(XRES_{i},XRES_{j})$ by $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$, respectively. We define $\mathbf{Adv}_{\mathcal{A}}^{auth}=\Pr[\mathbf{E}_{1}\vee{}\mathbf{E}_{2}\vee\mathbf{E}_{3}\vee\mathbf{E}_{4}\vee\mathbf{E}_{5}\vee\mathbf{E}_{6}]$, where $\mathbf{E}_{1}$ and $\mathbf{E}_{2}$ are the events that $\mathcal{A}$ successfully impersonates the HSS/AuC by sending a verifiable $\mathcal{E}^{\prime}_{i}$ and $\mathcal{E}^{\prime}_{j}$, $\mathbf{E}_{3}$ is the event that $\mathcal{A}$ successfully impersonates $\mathrm{UE}_{i}$ by sending a correct $RES_{i}$, $\mathbf{E}_{4}$ is the event that $\mathcal{A}$ impersonates $\mathrm{UE}_{j}$ by sending a correct $RES_{j}$, $\mathbf{E}_{5}$ and $\mathbf{E}_{6}$ are the events that $\mathcal{A}$ impersonates HSS/AuC by sending $XRES_{i}$ or $XRES_{j}$, accepted by $\mathrm{UE}_{i}$ or $\mathrm{UE}_{j}$, respectively. Here, $\Pr[\mathbf{E}_{1}\vee{}\mathbf{E}_{2}\vee\mathbf{E}_{3}\vee\mathbf{E}_{4}\vee\mathbf{E}_{5}\vee\mathbf{E}_{6}]\leq\Pr[\mathbf{E}_{1}]+\Pr[\mathbf{E}_{2}]+\Pr[\mathbf{E}_{3}]+\Pr[\mathbf{E}_{4}]+\Pr[\mathbf{E}_{5}]+\Pr[\mathbf{E}_{6}]$. Hence, we prove that the probabilities are negligible to guarantee that $\mathbf{Adv}_{\mathcal{A}}^{auth}$ is negligible for mutual authentication security as follows.

For the case of $\Pr[\mathbf{E}_{1}]$, we consider $\mathsf{E}_{\text{S}}$ as a pseudorandom permutation and the advantage $\epsilon$ of distinguishing a pseudorandom permutation and random permutation is negligible. A simulator $\mathcal{S}$ is given a function ${\mathsf{E}_{\text{S}}}_{b}$ by the challenger according to a random bit $b\in\{0,1\}$, where ${\mathsf{E}_{\text{S}}}_{0}$ is a pseudorandom permutation and ${\mathsf{E}_{\text{S}}}_{1}$ is a random permutation. $\mathcal{S}$ simulates the protocol and interacts with $\mathcal{A}$ by the given ${\mathsf{E}_{\text{S}}}_{b}$. We say that $\mathcal{A}$, acting as a HSS/AuC, can send out a correct $\mathcal{E}^{\prime}_{i}$ to be accepted by $\mathcal{S}$ with the probability $\epsilon^{\prime}$. Since the probability that $\mathcal{A}$ sends a correct $\mathcal{E}^{\prime}_{i}$ with a random permutation, i.e., ${\mathsf{E}_{\text{S}}}_{1}$, is negligible, $\mathcal{S}$ outputs a guess $b^{\prime}=1$ when $\mathcal{E}^{\prime}_{i}$ sent by $\mathcal{A}$ is accepted. Otherwise, $\mathcal{A}$ outputs $b^{\prime}=0$ or $b^{\prime}=1$ randomly. From the above, we have that $\Pr[b=b^{\prime}]=$ $\Pr[b=b^{\prime},b=0]+$ $\Pr[b=b^{\prime},b=1]=$ $\Pr[b=b^{\prime}|b=0]\Pr[b=0]$ + $\Pr[b=b^{\prime}|b=1]\Pr[b=1]=(\frac{1}{2}+\epsilon^{\prime})\frac{1}{2}+\frac{1}{2}\times\frac{1}{2}=$ $\frac{(1+\epsilon^{\prime})}{2}$. If $b=b^{\prime}$, ${\mathsf{E}_{\text{S}}}_{b}$ is distinguished. Obviously, $\epsilon\geq\Pr[b=b^{\prime}]-\frac{1}{2}=\frac{\epsilon^{\prime}}{2}$. Hence, $\epsilon^{\prime}$ is negligible since $\epsilon$ is also negligible based on pseudorandom permutation. We can prove $\Pr[\mathbf{E}_{2}]$, $\Pr[\mathbf{E}_{3}]$, $\Pr[\mathbf{E}_{4}]$, $\Pr[\mathbf{E}_{5}]$, and $\Pr[\mathbf{E}_{6}]$ are also negligible by the similar way. Based on the above proof, we conclude that $\mathbf{Adv}_{\mathcal{A}}^{auth}=\Pr[\mathbf{E}_{1}\vee{}\mathbf{E}_{2}\vee\mathbf{E}_{3}\vee\mathbf{E}_{4}\vee\mathbf{E}_{5}\vee\mathbf{E}_{6}]$ is negligible and mutual authentication between $\mathrm{UE}_{1}$ and $\mathrm{UE}_{2}$ holds. ∎

Theorem 2

(Secure Key Exchange) The proposed CN-GD2C protocol is an authenticated key exchange protocol between two UEs if Diffie-Hellman assumption holds.

Proof:

This proof is separated as two parts, session key security and known key security. Regarding the session key security of $K_{ij}$, it is based on the Decisional Diffie-Hellman (DDH) assumption, where a truly DDH tuple $(\mathcal{X}=g^{x},\mathcal{Y}=g^{y},K_{ij}=g^{xy})$ is indistinguishable from a random tuple $(g^{x},g^{y},g^{z})$. That is, the security of DDH assumption is reducible to the security of $K_{ij}$ as follows. One can construct a simulator $\mathcal{S}$ to simulate CN-GD2C by a given tuple $(g^{x},g^{y},g^{z})$, which is either a DDH or random tuple. If an adversary $\mathcal{A}$, interacting with $\mathcal{S}$, can distinguished the generated session key from a random string in the simulated protocol with an advantage of $\epsilon$. $\mathcal{S}$ is able to distinguish the given DDH tuple with an advantage of $\epsilon^{\prime}$. The probability of distinguishing the session key or a random string is $1/2+\epsilon$. The probability of distinguishing the DDH tuple from a random tuple by the guessing result from $\mathcal{A}$ is $(1+\epsilon)/2$. Obviously, $\epsilon^{\prime}$ is greater than or equal to $(1+\epsilon)/2$ and $\epsilon^{\prime}$ is negligible [24]. Hence, $\epsilon$ is also negligible.

In terms of known key security, we have to ensure that the DDH tuple $(\mathcal{X}=g^{x},\mathcal{Y}=g^{y})$ actually contributes to produce a unique session key $g^{xy}$ without any material injected [35]. Assume that there is no collusion with the CN and any adversary. $\mathcal{X}$ and $\mathcal{Y}$ are authenticated as shown in Theorem 1. Therefore, no adversary is able to change $\mathcal{X}$ and $\mathcal{Y}$ based on the security of mutual authentication. ∎

In the network-covered D2D communication, the anonymity between UE and CN is infeasible as all UEs are under the coverage of CN. However, in this case, it is important to guarantee the group anonymity between UEs, especially when they are in different groups. In the following theorem, we prove the partial group anonymity, i.e., that between UEs, of the CN-GD2C protocol.

Theorem 3

(Identity and Group Anonymity) The proposed CN-GD2C protocol is a identity and group anonymous protocol between $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$ if mutual authentication is guaranteed and BF-IBE is IND-CCA secure.

Proof:

Before proving group anonymity, we should prove identity anonymity of the CN-GD2C as the sufficient and necessary condition. The CN-GD2C guarantees identity anonymity based on the IND-CCA security of BF-IBF. Thus, we have to prove the identity anonymity of the CN-GD2C is reducible to the key-private security of BF-IBF. One can create $\mathcal{S}$, who is an attacker of the IND-CCA security of BF-IBE, simulates the CN-GD2C interacting with an identity anonymous attacker $\mathcal{A}$. A challenger $\mathcal{C}_{BF-IBE}$ of BF-IBE provides encryption and decryption oracles for the security game as defined in Definition 3. $\mathcal{S}$ can simulate CN-GD2C by generating all required secret keys, except the BF-IBE user private keys of $\Pi_{i,j}^{t_{1}}$ and $\Pi_{j,i}^{t_{2}}$.

We now prove the identity anonymity of $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$ by simulating CN-GD2C with $\mathcal{C}_{BF-IBE}$ and $\mathcal{A}$, respectively. First, we prove the identity anonymity of $\mathrm{UE}_{i}$ as follows. $\mathcal{S}$ selects two messages $\mathsf{ID}_{i,0}=\mathsf{ID}_{i}$ and a random string $\mathsf{ID}_{i,1}=\Re$ and send to $\mathcal{C}_{BF-IBE}$. $\mathcal{C}_{BF-IBE}$ then encrypts $\mathsf{ID}_{i,b}$ as $\mathcal{E}_{i}$ according to $b\in\{0,1\}$. $\mathcal{S}$ then simulates an AKE session of CN-GD2C with $\mathcal{E}_{i}$. After the simulation, $\mathcal{A}$ queries $\textbf{TestID}(\Pi_{i,j}^{s})$ to $\mathcal{S}$ and $\mathcal{S}$ returns $\mathsf{ID}^{\prime}_{i,b}$ according to a random bit $c\in\{0,1\}$, where $\mathsf{ID}^{\prime}_{i,0}=\mathsf{ID}_{i}$ and $\mathsf{ID}^{\prime}_{i,1}=\Re^{\prime}$, which is a random string. $\mathcal{A}$ outputs $c^{\prime}$ as the guess of $c$. If $c^{\prime}=c$, then $\mathcal{S}$ outputs $b=0$ or $b=1$ otherwise. The probability of breaking the IND-CCA security of BF-IBE is $\Pr[b=b^{\prime}]$ and can be rewritten as $\Pr[b=b^{\prime}]=\Pr[b=b^{\prime}|b=0]\Pr[b=0]+\Pr[b=b^{\prime}|b=1]\Pr[b=1]$. Under a real experiment $(b=0)$, $\mathcal{A}$ can win the game by successfully guessing $(c=c^{\prime})$ with probability $\frac{1}{2}+\epsilon^{\prime}$, where $\mathbf{Adv}_{\mathcal{A}}^{\mathsf{anon\_id}}=\epsilon^{\prime}$. $\mathcal{A}$ can only randomly guess $(c=c^{\prime})$ with probability $1/2$ under a random experiment, i.e., $\Pr[b=b^{\prime}|b=0]=\frac{1}{2}+\epsilon^{\prime}$ and $\Pr[b=b^{\prime}|b=1]=1/2$. Hence, $\Pr[b=b^{\prime}]=(\frac{1}{2}+\epsilon^{\prime})\frac{1}{2}+\frac{1}{2}\times\frac{1}{2}=(1+\epsilon^{\prime})/2$. Obviously, the probability of breaking IND-CCA security of BF-IBE is $\epsilon\geq{}\Pr[b=b^{\prime}]=\frac{1+\epsilon^{\prime}}{2}-\frac{1}{2}=\frac{\epsilon^{\prime}}{2}$. $\textbf{Adv}_{\mathcal{A}}^{\mathsf{anon\_id}}=\epsilon^{\prime}$ is negligible due to $\epsilon$ is negligible. The identity anonymity of $\mathrm{UE}_{j}$ can also be proven in the similar way as the above. Hence, the CN-GD2C is an identity anonymous AKE protocol for $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$.

The group anonymity is guaranteed since the group information of UEs is only known by the ProSe function. Besides that, the ProSe function will only check the group information for the valid UEs, who can send out $ack_{i}$ and $ack_{j}$, in each AKE session. The security of $ack_{i}$ and $ack_{j}$ depends on the authorization keys, $AK_{i}$ and $AK_{j}$, issued for $\mathrm{UE}_{j}$ and $\mathrm{UE}_{j}$, and the correctness of $\mathsf{AID}_{i}$ and $\mathsf{AID}_{j}$ depends on the trust of HSS/AuC to ProSe function. We can prove that $ack_{i}$ and $ack_{j}$ can only be sent out by the legal $\mathrm{UE}_{i}$ and $\mathrm{UE}_{j}$ based on the pseudorandom function assumption in the similar concept of the proof of Theorem 1. Hence, the identity anonymity is guaranteed to outsider attackers and the group anonymity to outsider attackers and the HSS/AuC. ∎

IV-B Security Analysis of NA-GD2C Protocol

In this section, we prove that the proposed NA-GD2C protocol achieves the mutual authentication, secure key exchange (for end-to-end security), group anonymity, and traceability and revocability.

Theorem 4

(Mutual Authentication) The proposed GD2C protocol is a mutual authentication protocol between two UEs if BF-IBE is IND-CCA secure.

Proof:

In NA-GD2C, $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$ verify $\sigma_{0}$ and $\sigma_{1}$ for mutual authentication. The functions, gSelect, gSelectVer, uSelect, and uSelectVer guarantee that the obtained user indices of $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$ will include the identity of each other. Hence, if $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$ are in the same group, they will select the identity of each other to encrypt $\delta$ and $\gamma$ randomly selected by $\mathrm{UE}_{V}$ and $\mathrm{UE}_{U}$, respectively. $\mathcal{S}$, who is an attacker of IND-CCA secure BF-IBE, simulates CN-GD2C interacting with the attacker $\mathcal{A}$ against mutual authentication. First, $\mathcal{S}$ simulates $\Pi_{U,V}^{s}$ as $\mathrm{UE}_{U}$ interacting with $\mathcal{A}$ impersonating $\mathrm{UE}_{V}$ by the BF-IBE ciphertext $\mathcal{E}_{U}$ on one of two submitted $\gamma$ and $\gamma^{*}$ to the challenger $\mathcal{C}$ of IND-CCA secure BF-IBE. $\mathcal{E}_{U}$ is produced according to a random bit $b\in\{0,1\}$. If $b=0$, $\mathcal{E}_{U}$ is the ciphertext of $\gamma$ or $\gamma^{*}$ otherwise. In the real experiment (i.e., $b=0$), $\mathcal{A}$ can successfully send out a correct $\sigma_{1}=f_{0}(\gamma,\delta^{\prime})$ with the probability of $\epsilon^{\prime}$. In the random experiment (i.e, $b=1$), $\mathcal{A}$ is with probability of $2^{-k}$ to produce $\sigma_{1}$ since $\gamma$ is never exposed to $\mathcal{A}$. The probability of break IND-CCA security of BF-IBE is $\epsilon\geq{}\Pr[b=b^{\prime}]=\Pr[b=b^{\prime}|b=0]\Pr[b=0]+\Pr[b=b^{\prime}|b=1]\Pr[b=1]=(\frac{1}{2}+\epsilon^{\prime})\frac{1}{2}+(\frac{1}{2}+\frac{1}{2^{k}}){}\frac{1}{2}$. Since $\epsilon$ is negligible based on IND-CCA security, $\epsilon^{\prime}=\textbf{Adv}_{\mathcal{A}}^{auth}$ is also negligible. We can also prove the impersonation of $\mathrm{UE}_{V}$ by $\mathcal{A}$ in the same notion as the above. Conclusively, $\mathcal{A}$ has only negligible probability to break mutual authentication in NA-GD2C based on IND-CCA secure BF-IBE. ∎

Theorem 5

(Secure Key Exchange) The proposed NA-GD2C protocol is a secure key exchange protocol between $\mathrm{UE}_{U}$ and $\mathrm{UE}_{V}$ if BF-IBE is IND-CCA secure.

Proof:

In the NA-GD2C protocol, the exchanged session key is $K_{U,V}=f_{0}(\gamma,\delta,3)$, where $\gamma$ and $\delta$ are authentic, and $f_{0}$ is a secure hash function and can be regarded as a pseudorandom function. Hence, in the case of unknown $\gamma$ and $\delta$, the session key is indistinguishable from truly random string of equal length. The security of pseudorandom function is reducible to the security of NA-GD2C protocol. Namely, one can build an algorithm to exploit the ability of $\mathcal{A}$ in the proposed NA-GD2C protocol to distinguish $\hat{\mathsf{H}}$ from a truly random function. If $\mathcal{A}$ can successfully distinguish the session key from a random string, one can also successfully distinguish $f_{0}$ from a truly random function. It means that the advantage of distinguishing $f_{0}$ from a truly random function is greater than or equal to the advantage of distinguishing the session key from a random string in the proposed NA-GD2C protocol. Here, the advantage of distinguishing $f_{0}$ from a truly random function is negligible, and consequently, that of distinguishing the session key from a random string is also negligible. ∎

Theorem 6

(Identity and Group Anonymity) The proposed NA-GD2C protocol is a $k$-anonymous authentication protocol if BF-IBE is IND-CCA secure.

Proof:

The identity and group information of two UEs are guaranteed based on the IND-CCA security of BF-IBE as the same concept in Theorem 3. Hence, the NA-GD2C achieves $k$ identity and group anonymity by perfectly hiding them in one of the $k$ selected groups and identities. ∎