A secure data sharing scheme based on broadcast signcryption in data center

TL;DR

This paper introduces a secure data sharing method for data centers that improves efficiency and security using broadcast signcryption and ciphertext retrieval techniques.

Contribution

A novel broadcast signcryption scheme with multi-ciphertext equality test for secure and efficient data sharing in data centers.

Findings

The proposed scheme ensures confidentiality and unforgeability using broadcast signcryption.

Multi-ciphertext equality test enables efficient ciphertext retrieval on cloud servers.

The scheme shows 20% higher computational efficiency than existing methods when handling 100 receivers.

Abstract

In today’s digital age, data centers have become one of the most important infrastructures in businesses and organizations. They store and manage critical enterprise data and resources, as well as being the core support for business operations. However, as data centers grow and expand, cybersecurity has become an important challenge. In order to efficiently retrieve ciphertexts and achieve secure communication between data center and data user, this article proposes a multi-ciphertext equality test broadcast signcryption scheme. The scheme uses broadcast signcryption technology to ensure the confidentiality and unforgeability of messages, and uses multi-ciphertext equality test to achieve efficient retrieval of ciphertexts on cloud servers. Based on the hypothesis of difficult problems, the security of the scheme has been proven under the random oracle model. Numerical analysis shows that our work has relatively high computational and communication efficiency, when the number of receivers is 100, the computational efficiency of our scheme has increased by more than 20% compared to the existing schemes and is suitable for data communication in data center.

Figures

The network architecture of the data center.

The attack of data communication.

The system model of scheme.

The time of signcryption.

The time of unsigncryption.

The time of equality test.

The size of ciphertext.

Full text

Introduction

In today’s information age, massive amounts of information flood into terminal devices every day, resulting in the problem of digital devices storing and calculating the received massive data. Data centers have become the infrastructure for storing and managing data in the digital age. The network architecture of the data center is shown in Fig 1. During the process of data transmission, data centers face many security issues such as data leakage, unauthorized access, and illegal operations. Security is the core of data center construction, and ensuring the security control of physical space and network is the cornerstone of guaranteeing the stable operation of data centers. Fig 2 shows the hacker attack paths that exist in data communication. After the sensors transmit the collected data to the data center, there may be malicious attackers attacking sensitive data in data communication.

The network architecture of the data center.

The attack of data communication.

To protect data privacy and achieve information security, data owner encrypts sensitive information and stores it in the cloud server, which poses a challenge for cloud server to perform calculations on encrypted data. To resist honest and curious cloud servers and various malicious attacks from external sources, scholars have proposed the concept of searchable encryption, the data owner only needs to encrypt the message once to achieve the function of multiple receivers searching simultaneously. However, searchable encryption only applies to ciphertext encrypted with the same public key. In order to address the limitations of searchable encryption, scholars have proposed the concept of equality test [1], which can retrieve ciphertexts encrypted with different public keys. Equality test has also been well applied in practical environments, as it is possible to retrieve ciphertexts encrypted with different public keys, and equality test has also been well applied in practical environments. Zhao et al. [2] proposed a dual server uncertified public key encryption scheme that supports authorization equality test in bilinear groups, providing confidentiality protection for outsourced ciphertexts and authentication tokens, and can resist internal keyword guessing attacks. Yuan et al. [3] proposed an image centric privacy protection architecture for social discovery services, which allows people to find friends with similar interests by testing the similarity of encrypted images. Zhao et al. [4] proposed an authorization equality test scheme for identity based cryptographic systems, which allows servers to test whether two different ciphertexts encapsulate the same message. Additionally, it supports different authorization methods to enhance privacy. However, the equality test in the above scheme only targets two ciphertexts. In order to improve the retrieval efficiency of ciphertexts, we propose a broadcast signcryption scheme with multi-ciphertext equality test in data center.

Our contributions

– The scheme realizes data confidentiality, unforgeability and receiver’s identity anonymity. We use hybrid signcryption to ensure data security and achieve secure communication between data center and data user. The data receivers do not know each other’s identities, ensuring the anonymity of the receivers.– Our proposed scheme carries out multi-ciphertext equality test to implement efficient retrieval of ciphertexts. When data users need to retrieve ciphertexts, they upload trapdoors to the cloud server, which performs multi-ciphertext equality test based on the trapdoors.– Our proposed work has higher computation efficiency than existing schemes and implement a lightweight broadcast signcryption scheme. We use hybrid signcryption to ensure data security while also improving the efficiency of algorithms in the data center.

Organization

The article is organized as follows. The Related works section summarizes the related work. The Preliminaries section introduces the preliminary work. The proposed scheme section presents the scheme structure and correctness. The Security proof section proves the security of our work. The Performance evaluation section shows the performance evaluation. Finally, we conclude this work in the Conclusion section.

Related works

Yang et al. [1] first proposed Public Key Encryption with support for equality test(PKEET), and provided a specific scheme that anyone can check whether the messages of any two ciphertexts are the same without decrypting. In order to meet different privacy needs, Tang [5] introduces agents in the PKEET, only authorized users can perform equality test. Ma et al. [6] further limit the scope of authorization to only designated agents authorized by the user who can access the user’s confidential information, they also proposed a PKEET scheme that implemented four types of authorization strategies. Wu et al. [7] proposed an efficient identity based scheme with bilinear pairing, which reduces the time-consuming function computation and each trapdoor can only be used to perform equality test on specific keywords. However, the above scheme only compare two ciphertexts and have lower efficiency. In order to settle above problems, Susilo et al. [8] proposed an encryption scheme that supports multi ciphertext equality test, which can be used to test the relationship between multiple messages. Each ciphertext can be assigned a number s, allowing cloud servers to only perform equality test on that ciphertext with other s–1 ciphertexts. Unfortunately, the above PKEET schemes only ensure the confidentiality of information, but cannot guarantee unforgeability of data. In order to achieve both confidentiality and unforgeability of sensitive data within a single time unit, scholars have proposed a signcryption scheme [9–11]. For the reason that settle various hacker attacks and guarantee data security in different cryptosystems communication, heterogeneous signcryption scheme [12–14] have been proposed to meet sensitive information’s confidentiality and unforgeability during data transmission. However, the above works suitable for one to one transmission environment. To meet the requirements of one to many communication, Yu et al. [15] proposed a provably secure multi receiver implicit certificate based signcryption scheme based on implicit certificate cryptosystem and polynomial interpolation evaluation for one to many communication in edge computing. Wang et al. [16] proposed a secure certificate free multi receiver signature scheme to address the security issues of remote downlink control command multicast in advanced metering infrastructure. This scheme not only ensures the confidentiality, integrity, and unforgeability of commands sent by power companies, but also prevents the identity of smart meters receiving commands from being leaked. In order to improve the computational efficiency of the scheme. Shen et al. [17] proposed a lightweight uncertified data secure transmission protocol in wireless body area network environments. Zhang et al. [18] proposed a multi-receiver conditional anonymous signcryption scheme in the internet of vehicles, the scheme use attributed-based and signcryption achieve security of sensitive data. Zhang et al. [19] utilized signcryption and blockchain designed secure generic communication framework. Zhu et al. [20] used lattice-based and proxy signature proposed a proxy signcryption scheme, which have strong identifiability and defeat quantum attack. Niu et al. [21] proposed broadcast signcryption scheme to addressed the data security issues in wireless sensor network.Tanveer et al. [22] have presented a chaotic map-based authenticated data sharing framework for the IoT-enabled cloud storage environment. This scheme uses chaotic map, hash functions and encryption algorithm to ensure the confidentiality, integrity and authentication of data. Tanveer et al. [23] have presented an access control scheme based on an authenticated encryption algorithm. The schemes use an authenticated encryption algorithm, called elliptic curve cryptography, and hash function to achieve data sharing. However, above schemes do not implement the retrieval function for ciphertext. Table 1 summarizes some literatures mentioned above. In order to guarantee sensitive information security while also achieve multi-ciphertext retrieval, we propose the broadcast signcryption scheme used certificateless cryptography and multi-ciphertext equality test.

Table 1: Summarized literature.

Preliminaries

System model

The scheme defines four entities: Key Generation Center (KGC), data center, cloud server, and data receiver. Firstly, KGC initializes the system and generates public and partial private keys for data center and receivers. Then, the data center signcrypts the data information, generates ciphertext, and uploads it to the cloud server. The cloud server broadcasts the ciphertext to the data receivers. Finally, the data receiver verifies and decrypts the ciphertext. When the data receiver wants to retrieve the ciphertext, they upload a trapdoor to the cloud server, which executes an equality test algorithm to retrieve the ciphertext. The system model is shown in Fig 3. The definition of our proposed work includes the five algorithms as follows:

The system model of scheme.

Setup: KGC carries out this algorithm, inputs the security parameters λ, and outputs system public parameters Pars, retain master key MSK.Keygen: Users (data center and receivers) and KGC jointly implement the algorithm, given the user’s identities U, public parameters Pars and master key MSK, generate the user’s public PKi and private keys SKi.Signcrypt: The data center implements this algorithm, inputs public parameters Pars, messages set M, the data center’s private key SKs and receiver’s public key PKi, and outputs ciphertext δ.Unsigncrypt: Data receiver carrys out the algorithm, given ciphertext δ, data center’s public key PKs and receiver’s private key SKi. Receiver checks whether the ciphertext is valid. If the message is unforgeable, it decrypts the ciphertext with its own private key to obtain the plaintext.Equality test: Given $[eqn]$ ciphertexts, the maximum number of ciphertexts that can be equality test with each ciphertext is $[eqn]$ − 1. Data receiver uploads the trapdoor tki to the cloud server, which performs equality test on the ciphertexts to achieve efficient retrieval of ciphertexts.

Security model

For polynomial adversary $[eqn]$ , if the following game cannot be won with a non negligible probability, the proposed work meet indistinguishability under the chosen ciphertext attack (IND-CCA) security, existential unforgeability of chosen message attack (EUF-CMA) security, and anonymity indistinguishability under the chosen ciphertext attack (ANON-IND-CCA) security. Adversary $[eqn]$ and challenger $[eqn]$ as follows:

Game 1. IND-CCA security

Setup: $[eqn]$ generates the system master MSK key and public parameters Pars, sends Pars to $[eqn]$ , and retains MSK.

Phase 1: $[eqn]$ selects the target identity set $[eqn]$ and sends it to the adversary, who initiates a series of adaptive queries.

Challenge: $[eqn]$ selects two challenge messages and sends them to the challenger. $[eqn]$ selects $[eqn]$ and returns the ciphertext δ to $[eqn]$ .

Phase 2: $[eqn]$ initiates a series of inquiries to $[eqn]$ as Phase 1, except uses $[eqn]$ , interact $[eqn]$ and $[eqn]$ executes unsigncryption query.

Guess: $[eqn]$ outputs $[eqn]$ , if $[eqn]$ , the adversary wins the game. The adversary’s advantage is: $[eqn]$ $[eqn]$ − $[eqn]$ .

Definition 1. In polynomial time, if no adversary $[eqn]$ can win Game 1 with an undeniable advantage, then the scheme satisfies IND-CCA security.

Game 2. EUF-CMA security

Setup: $[eqn]$ generates the system master key and system public parameters, sends the system public parameters to the $[eqn]$ , and retains the system master key.

Query: $[eqn]$ initiates a series of adaptive queries, and $[eqn]$ responds to the queries.

Forgery: $[eqn]$ outputs a forged ciphertext CT  of the message m . If CT  is valid, $[eqn]$ wins Game 2.

Definition 2. In polynomial time, if no adversary $[eqn]$ can win Game 2 with an undeniable advantage, then the scheme satisfies EUF-CMA security.

Game 3. ANON-IND-CCA security

Setup: $[eqn]$ generates the system master MSK key and public parameters Pars, sends Pars to $[eqn]$ , and retains MSK.

Phase 1: $[eqn]$ selects the target identity $[eqn]$ and sends it to $[eqn]$ , who initiates a series of adaptive queries.

Phase 2: $[eqn]$ initiates a series of inquiries to $[eqn]$ as Phase 1, except uses $[eqn]$ , $[eqn]$ and $[eqn]$ executes unsigncryption query.

Challenge: $[eqn]$ selects multiple challenge messages and sends it to the challenger. $[eqn]$ selects $[eqn]$ and returns the ciphertext δ to $[eqn]$ .

Guess: $[eqn]$ outputs $[eqn]$ , if $[eqn]$ , the adversary wins the game. The adversary’s advantage is: $[eqn]$ $[eqn]$ − $[eqn]$ .

Definition 3. In polynomial time, if no adversary $[eqn]$ can win Game 3 with an undeniable advantage, then the scheme satisfies ANON-IND-CCA security.

The proposed scheme

This section mainly introduces the specific algorithm of the proposed scheme. In order to achieve secure communication and efficient retrieval of ciphertext, a broadcast signcryption scheme with multi-ciphertext equality test is proposed. Table 2 shows the notation of the scheme. The scheme consists of the following five algorithms:

Table 2: Notations.

Setup: This algorithm is executed by KGC. Enter the security parameter λ, KGC outputs the system’s public parameters, and retains the master key.

• Given a cyclic additive group G of prime order p, where $[eqn]$ ;- Define five hash functions: $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , where ψ is key space;- KGC randomly selects $[eqn]$ as master key, computes $[eqn]$ , outputs $[eqn]$ , retains s, where (Enc, Dec) are encryption and decryption algorithm.

Keygen: This algorithm is executed by data users and KGC. KGC generates partial private key and sends it to data users, who verify the legality of the partial private keys and calculate private key.

• Given data users set $[eqn]$ , each data user randomly selects $[eqn]$ as secret value, computes $[eqn]$ and sends to KGC;- KGC selects $[eqn]$ , computes $[eqn]$ , public key $[eqn]$ , partial private key $[eqn]$ , and sends $[eqn]$ , di to data users;- Data users verify the legitimacy of partial private keys by checking whether equation $[eqn]$ holds true. If the equation holds true, computes private key $[eqn]$ , otherwise the algorithm is aborted.

Signcryption: This algorithm is executed by the data center. Given the system’s public parameters, message set, and data receiver identity, the data center outputs ciphertext.

• Inputs Pars, $[eqn]$ , data center randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ ;- Rnomly selects $[eqn]$ , computes $[eqn]$
• Computes $[eqn]$ , sets $[eqn]$ , where Γ is a mapping table from $[eqn]$ to [1,n], computes key $[eqn]$ , where $[eqn]$ , ciphertext $[eqn]$ , CT = {W,Cj}, $[eqn]$ , $[eqn]$ ;- Given that the number of ciphertexts for equality test with each ciphertext is l, computes coefficients $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , generates polynomial $[eqn]$ , randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , outputs ciphertext $[eqn]$ .

Unsigncryption: This algorithm is executed by the data receiver. After receiving the broadcast ciphertext from the cloud server, the data receiver decrypts ciphertext using the private key and verifies the unforgeability using data center’s public key.

• Inputs receiver’s SKi and data center’s PKs, receiver computes $[eqn]$ , $[eqn]$ , and checks $[eqn]$ whether holds;- If equation holds, computes $[eqn]$ ⋅ $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , decrypts and obtains message $[eqn]$ .

Equality-test: This algorithm is executed by cloud server. The cloud server performs multi-ciphertext equality test based on the trapdoor of receivers to achieve the function of retrieving ciphertext.

• Given λ ciphertexts, the maximum number of ciphertext that can be equality test with each ciphertext is $[eqn]$ , receiver uploads trapdoor $[eqn]$ to cloud server, cloud server computes $[eqn]$ ;- From $[eqn]$ can be obtain $[eqn]$
• Set $[eqn]$ , where $[eqn]$ , $[eqn]$ $[eqn]$ , the system of equations has a unique solution $[eqn]$ ;- Checks equation $[eqn]$ whether holds,if holds,outputs 1, otherwise, outputs 0.

Correctness:

(1) To verify the legality of partial private keys, it is necessary to prove the following equation holds true:

$[eqn]$

(2) To prove the correctness of the signature, it is necessary to verify the following equation holds true:

$[eqn]$

(3) By the following calculation get $[eqn]$ :

$[eqn]$

From $[eqn]$ compute $[eqn]$ , obtain message $[eqn]$ .

(4) To prove the correctness of the equality test, it is necessary to verify that the following system of equations has a unique solution:

$[eqn]$

$[eqn]$ , so the system of equation has unique solution, $[eqn]$ hold.

Security proof

Define two types of adversaries: $[eqn]$ and $[eqn]$ , where adversary $[eqn]$ is a malicious user who can replace the user’s public key but cannot access the master key, and adversary $[eqn]$ is a malicious KGC who is allowed to access the system’s master key but cannot replace the user’s public key. The scheme has been proven to be safe under the random oracle model.

Theorem 1. If no $[eqn]$ wins Game 1 with non-negligible advantage, then the scheme has IND-CCA security.

Proof. $[eqn]$ and $[eqn]$ interact as follows:

Setup: $[eqn]$ sets $[eqn]$ , and sends public parameters Pars to $[eqn]$ .

Phase 1: $[eqn]$ selects sender’s identity $[eqn]$ , n receiver’s identities $[eqn]$ and send to $[eqn]$ , $[eqn]$ creates a empty list Li and $[eqn]$ interact as follows:

H1 query: Given IDi, challengr $[eqn]$ checks list L1 whether exist $[eqn]$ , if exist, returns $[eqn]$ , otherwise, randomly selects $[eqn]$ and stores tuple $[eqn]$ in L1;

H2 query: Given $[eqn]$ , challenger $[eqn]$ checks list L2 whether exist $[eqn]$

$[eqn]$ , if exist, $[eqn]$ returns $[eqn]$ , otherwise, $[eqn]$ randomly selects $[eqn]$ , stores $[eqn]$ in L2;

H3 query: Given $[eqn]$ , $[eqn]$ checks list L3 whether exist $[eqn]$ , if exist, returns $[eqn]$ , otherwise, randomly selects $[eqn]$ , stores $[eqn]$ in list L3;

Key query: Given IDi, $[eqn]$ checks list LU whther exist $[eqn]$ , if exist, returns public key PKi to $[eqn]$ , otherwise, randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , sets $[eqn]$ and updates LU, sends PKi to $[eqn]$ .

Secret-value query: Given IDi, $[eqn]$ checks list LU whether exist $[eqn]$ , if $[eqn]$ , returns $[eqn]$ , otherwise, outputs $[eqn]$ .

Public key replace query: Input $[eqn]$ , $[eqn]$ checks list LU whether exist $[eqn]$ , if exist, $[eqn]$ uses $[eqn]$ repalces PKi, otherwise, uses IDi initiates public key replace query.

Signcryption query: Given identites set $[eqn]$ , message $[eqn]$ , if $[eqn]$ , challenger $[eqn]$ randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , stores $[eqn]$ and $[eqn]$ in L3, otherwise, $[eqn]$ uses $[eqn]$ executes signcryption algorithm, generates ciphertext $[eqn]$ and sends to adversary $[eqn]$ .

Unsigncryption query: Given IDs, IDi, δ, challenger $[eqn]$ computes K = s ⋅ P  +  $[eqn]$ , searches by (IDi,K) for $[eqn]$ , computes $[eqn]$ to adversary $[eqn]$ .

Challenge: $[eqn]$ selects two message sets of equal length $[eqn]$ , $[eqn]$ and sends to $[eqn]$ , $[eqn]$ randomly selects $[eqn]$ , $[eqn]$ , computes $[eqn]$ , $[eqn]$ , outputs challenge ciphertext $[eqn]$ to adversary $[eqn]$ .

Phase 2: $[eqn]$ initiates the same query to $[eqn]$ as phase 1, but can’t uses $[eqn]$ , $[eqn]$ and $[eqn]$ executes unsigncryption algorithm.

Guess: $[eqn]$ outputs the guess result $[eqn]$ , if $[eqn]$ , adversary $[eqn]$ wins the game. If $[eqn]$ wins the game with non-negligible advantage, must have the right ti, and uses $[eqn]$ initiates H2 query to make $[eqn]$ . $[eqn]$ as a solution to the CDH difficulty problem, the probability of $[eqn]$ wins Game 1 is: $[eqn]$ .

Theorem 2. If no $[eqn]$ wins Game 1 with non-negligible advantage, then the scheme has IND-CCA security.

Proof. $[eqn]$ and $[eqn]$ interact as follows:

Setup: $[eqn]$ sets $[eqn]$ , sends public parameters Pars to $[eqn]$ .

Phase 1: It is the same as Theorem 1 except public key repalce query. Given IDi, $[eqn]$ checks list LU whether exist $[eqn]$ , if exist, returns PKi to $[eqn]$ , otherwise, randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , sets $[eqn]$ , and updates LU, sends PKi to $[eqn]$ .

Phase 2: $[eqn]$ initiates the same query to $[eqn]$ as phase 1, but can’t uses $[eqn]$ , $[eqn]$ and $[eqn]$ executes unsigncryption algorithm.

Guess: $[eqn]$ outputs the guess result $[eqn]$ , if $[eqn]$ , $[eqn]$ wins the game. If adversary $[eqn]$ wins the game with non-negligible advantage, must have the right ti and uses $[eqn]$ initiates H2 query to make $[eqn]$ . $[eqn]$ as a solution to the CDH difficulty problem, the probability of $[eqn]$ wins Game 1 is: $[eqn]$ .

Theorem 3. If no adversary $[eqn]$ wins Game 2 with non-negligible advantage,the scheme satisfies the EUF-CMA security.

Proof. $[eqn]$ and $[eqn]$ interact as follows:

Setup: $[eqn]$ sets master key $[eqn]$ , and sends public parameters Pars to $[eqn]$ .

Phase 1: $[eqn]$ can adaptively initiate queries, similar to phase 1 and 2 in Theorem 1, excepts key query and secret-value query.

key query: Given identity IDi, challenegr $[eqn]$ checks whether $[eqn]$ exist in LU. If exist, $[eqn]$ returns PKi to $[eqn]$ , otherwise, $[eqn]$ randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , sets $[eqn]$ and updates LU, sends PKi to $[eqn]$ .

secrect-value query: Given IDi, $[eqn]$ checks whther LU exist in $[eqn]$ , if exist, sets $[eqn]$ , $[eqn]$ returns $[eqn]$ to $[eqn]$ . Otherwise, $[eqn]$ randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , updates L1 and LU, sends $[eqn]$ to $[eqn]$ .

forge: Adversary $[eqn]$ outputs forge ciphertext $[eqn]$ . If a key query with the same identity is queried first, subsequent key queries with the same identity will change the corresponding public key due to changes in the secret value generated by the user. Therefore, the ciphertext forged by the adversary $[eqn]$ is invalid.

Theorem 4. If no adversary $[eqn]$ wins Game 2 with non-negligible advantage, the scheme satisfies the EUF-CMA security.

Proof. $[eqn]$ and $[eqn]$ interact as follows:

Setup: $[eqn]$ sets master key $[eqn]$ , sends Pars to $[eqn]$ .

Phase 1: $[eqn]$ can adaptively initiate queries, similar to phase 1 and 2 in Theorem 2, excepts key query and secret-value query.

key query: Given identity IDi, challenger $[eqn]$ checks whether $[eqn]$ exist in LU. if exist, $[eqn]$ returns PKi to $[eqn]$ , otherwise, $[eqn]$ randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , sets $[eqn]$ and updates LU, sends PKi to $[eqn]$ .

secret-value query: Given IDi, $[eqn]$ checks whether LU exist in $[eqn]$ . if exist, sets $[eqn]$ , $[eqn]$ returns $[eqn]$ to $[eqn]$ , otherwise, $[eqn]$ randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , updates L1 and LU, sends $[eqn]$ to $[eqn]$ .

Forge: Adversary $[eqn]$ outputs a forge ciphertext $[eqn]$ . If a key query with the same identity is queried first, subsequent key queries with the same identity will change the corresponding public key due to changes in the secret value generated by the user. Therefore, the ciphertext forged by the adversary $[eqn]$ is invalid.

Theorem 5. If no adversary $[eqn]$ wins Game 3 with non-negligible advantage, the scheme satisfies the ANON-IND-CCA security.

Proof. Given a CDH difficulty problem, $[eqn]$ and $[eqn]$ interact as follows:

Phase 1: $[eqn]$ randomly selects $[eqn]$ and sends to $[eqn]$ , $[eqn]$ initiates the same query as theorem 1.

Phase 2: $[eqn]$ initiates the same query as phase 1, but can’t uses $[eqn]$ , $[eqn]$ and $[eqn]$ initiates unsigncryption query. $[eqn]$ randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , sets $[eqn]$ and updates L1, LU, then sends PKi to $[eqn]$ .

Challenge: $[eqn]$ selects m messages $[eqn]$ , n identities $[eqn]$ and sends to $[eqn]$ . If $[eqn]$ , challenger returns $[eqn]$ , otherwise, randomly selects $[eqn]$ , $[eqn]$ , sets $[eqn]$ , and computes K = s ⋅ $[eqn]$ , $[eqn]$ . Generates challenge ciphertext $[eqn]$ and sends to $[eqn]$ .

Guess: $[eqn]$ outputs the result of guess $[eqn]$ . If $[eqn]$ , $[eqn]$ wins the game, if adversary wins the game with non-negligible advantage, must have ti and uses $[eqn]$ initiates H2 query to make $[eqn]$ . Outputs $[eqn]$ as a solution to the CDH problem the probability of $[eqn]$ wins Game 3 is: $[eqn]$ .

Theorem 6. If no adversary $[eqn]$ wins Game 3 with non-negligible advantage,the scheme satisfies the ANON-IND-CCA security.

Proof. Given a CDH difficulty problem, $[eqn]$ and $[eqn]$ interact as follows:

Phase 1: $[eqn]$ randomly selects $[eqn]$ and sends to $[eqn]$ , $[eqn]$ initiates the same query as theorem 2.

Phase 2: $[eqn]$ initiates the same query as phase 1, but can’t uses $[eqn]$ , $[eqn]$ and $[eqn]$ initiates unsigncryption query. $[eqn]$ randomly selects $[eqn]$ , computes $[eqn]$ , $[eqn]$ , $[eqn]$ , sets $[eqn]$ and updates L1, LU, sends PKi to $[eqn]$ .

Challenge: $[eqn]$ selects m messages $[eqn]$ , n identities $[eqn]$ and sends to $[eqn]$ . If $[eqn]$ , challenger returns $[eqn]$ . Otherwise, $[eqn]$ randomly selects $[eqn]$ , $[eqn]$ and sets $[eqn]$ , computes $[eqn]$ , $[eqn]$ . $[eqn]$ generates challenge ciphertext $[eqn]$ and sends to $[eqn]$ .

Guess: $[eqn]$ outputs the result of guess $[eqn]$ . If $[eqn]$ , $[eqn]$ wins the game, if adversary wins the game with non-negligible advantage, must have ti and uses $[eqn]$ initiates H2 query to make $[eqn]$ . Outputs $[eqn]$ as a solution to the CDH problem the probability of $[eqn]$ wins Game 3 is: $[eqn]$ .

Performance evaluation

We compared the functionality and analyzed the computational efficiency of the proposed scheme in this paper with the exisiting work. Numerical analysis was conducted on the execution time of algorithms in each stage of the scheme on the Linux operating system using PBC library [62] and C language.

Functional Comparison

Table 3 compares the functional differences between existing signcryption schemes and the scheme proposed in this paper. Reference [12] proposes a heterogeneous signcryption scheme for wireless body area networks in a heterogeneous environment from IBC to PKI, which addressed the security issues in data transmission. However, the scheme is not suitable for one to many broadcasting environments. Although reference [15] achieves one to many broadcast communication security, this scheme does not support ciphertext retrieval. Reference[24] implements classification management of ciphertexts using equality test, but only compares two ciphertexts, which is inefficient, and the scheme has the problem of key leakage. We proposed the broadcast signcryption scheme achieves multi-ciphertext retrieval functions while ensuring confidentiality and unforgeability during data transmission, making it suitable for data centers.

Table 3: Functional comparison.

Experimental analysis

We compared the efficiency of the existing scheme with the scheme proposed in this paper, and our experiment is run under a Linux operation system using a pairing-based cryptography library with Type-A bilinear pairing parameters.

Table 4 shows the definition represented by each character. The computation overhead of signcryption, unsigncryption and equality test as shown in Table 5. Table 6 presents the key and ciphertext memory space of schemes. The computation and communication costs increase with the increase of the number of receivers.

Table 4: Character definition.

Table 5: Computation costs.

Table 6: Communication costs.

In the signcryption, unsigncryption and equality test stage, the computational efficiency of the proposed scheme in this paper is optimal compared with schemes [12,15,24]. When the number of receivers is 100, as presented in Fig 4, our scheme’s signcryption algorithm has increased computational efficiency by 58%, 35%, 70% respectively compared to exisited schemes. The unsigncryption computational time of the proposed work has increased by 71%, 10%, 67% respectively compared to above schemes as shown in Fig 5. It can be seen from Fig 6 that the efficiency of the proposed work has improved to 21% and 35% respectively compared to schemes [12,24] in equality test. As shown in Fig 7, Our scheme requires less ciphertext storage space than scheme [12], and higher rates than schemes [15] and [24]. Although the communication overhead of our scheme is not the lowest, it is a reasonable cost paid to improve computational efficiency.

The time of signcryption.

The time of unsigncryption.

The time of equality test.

The size of ciphertext.

Conclusion

This paper proposes a secure data sharing scheme based on broadcast signcryption that supports multi-ciphertext equality test addressing security issues such as privacy data leakage. By combining broadcast signcryption and equality test techniques, the scheme ensures the confidentiality and unforgeability of privacy data. When data users want to retrieve ciphertext, they upload a trapdoor to the cloud server, which executes equality test algorithm to achieve efficient retrieval of ciphertext. The security of the scheme has been proven based on difficult problems in the random oracle model, and numerical experiment analysis have shown that the scheme has relatively low computational overhead and certain advantages in data center. Compared to some existing schemes, signcryption, unsigncryption, equality test algorithm of our scheme’s computational efficiency is superior, increasing by over 35%, 10% and 20% when the number of receivers is 100. While our scheme’s ciphertext storage overhead is not optimal, its computational efficiency is. In future work, we will focus on designing a broadcast signcryption scheme for heterogeneous communication environments and work to reduce storage overhead while maintaining high computational efficiency.