Abstract
The electronic reporting system can alleviate the problems in terms of efficiency, content confidentiality, and reporter privacy imposed in the traditional reporting system. Relying on anonymity, the privacy of reporters can be protected, but the authentication of reporters with fake names should also be maintained. If authenticated anonymity is guaranteed, the reporters may still conduct misbehaviors such as submitting fake reports after the authentication. To address the above dilemma, we propose to apply a proxy signature to achieve authenticated anonymity and employ blockchain to maintain anonymity yet guarantee traceability for reporters’ misbehaviors. We also propose a new proxy signature scheme in this paper by module lattice for postquantum security. The extensive analysis justified our proposed scheme is secure and manageable.
1. Introduction
Unlike the traditional offline reporting method, where reporting letter is written by a reporter and sent to the relevant department, the electronic reporting system is more convenient and efficient. Anyone can report some content about anyone to a special department at any time anywhere. However, electronic reporting usually meets with some security problems as follows: to protect the identity of reporters, reporters usually must be anonymous. A dilemma thus arises in how to authenticate the reporter whose names are fake; if they can be authenticated in a fake name, also called authenticated anonymity, they may further report fake information. Hence, traceability should also be guaranteed.
We observe that current research have not extensively addressed the above dilemma. Or only solve one-half of the problem, either (authenticated) anonymity or traceability. In this paper, we try to solve both “birds’’ together with one stone. More specifically, we apply a proxy signature to achieve authenticated anonymity and we employ blockchain to obtain traceability.
Proxy signature is a kind of advanced digital signature, to which the proxy signer is delegated to generate the signature on behalf of the original signer. The reporter can send his message to a reputable third party to check, and the third-party delegate to generate the signature based on his own report message.
Blockchain presents the properties of immutability, distribution, and nonrepudiation. The reporter is a node of the blockchain, which only communicates with the trusted third party. If a malicious node wants to forge a reporting message, it is easy to find out by blockchain. According to the properties of proxy signature and blockchain, we can use them to guarantee that every reporter is honest and the reporting message is credible.
In this paper, we design this electronic reporting scheme with privacy protection based on proxy signature and blockchain. The contributions of this paper are as follows:(i)We apply proxy signature and blockchain technology for building a decentralized electronic reporting scheme. At the same time, our proposed scheme can achieve auditable yet authenticated anonymity, that is, preserve the reporter’s privacy, authenticate anonymous reporters upon reporting, and trace misbehaviors of anonymous reporters.(ii)We propose a new postquantum proxy signature based on the module lattice and provide the complete correctness analysis.
The rest of the paper is organized as follows: Related and required background information is briefly introduced in Section 2 and Section 3. In Section 4, we describe both the system models and the adversary models. We illustrate our proposed scheme in Section 5 and evaluate its security and efficiency in Section 6. Finally, we conclude this paper in Section 7.
2. Related Works
In 1996, Mambo, Usuda, and Okamoto [1, 2] proposed the idea and algorithm of proxy signature in the ACM CCS96 conference. Proxy signatures are now widely used in blockchain technology. Wang et al. [3] proposed a proxy signature mechanism based on the ElGamal algorithm in order to address the problem that the signature power of nodes cannot be transferred to blockchains, which is suitable for the management model of Sharing energy storage (SES) on blockchains. Shen et al. [4] proposed a lightweight threshold certificate authority framework LTCA by devising a threshold proxy signature, where the proxy signing key is issued by a coalition of a threshold number of certificate authorities (CAs) playing the roles of authorized nodes in the consortium blockchain. Then based on the proposed LTCA, an efficient privacy-preserving location-based service protocol (PPVC) is contrived to protect each vehicle’s conditional identity privacy with a moderate cost. Pawlak et al. [5], based on the multiproxy signature technology, used the idea of a multi-intelligence system and intelligent agents and proposed a blockchain-based Internet voting system with end-to-end verifiable and auditable implementation. On the one hand, many other theoretical schemes about the proxy signature have been proposed [6–8]. On the other hand, blockchain, as a novel distributed consensus scheme, also plays a great role in various fields [9–12]. Besides, there are also other similar works [14, 15, 26, 28, 29].
In recent years, e-government has been stepping into the relationship between the government and citizens in many countries [16, 17]. It has become a powerful assistant for the government to serve the people. Among them, e-reporting has beaten traditional reporting with absolute advantages of convenience and security and has become the main way for citizens to exercise their reporting rights. The research on electronic reporting is constantly updated and improved with the development of the Internet. Wang et al. [18] first proposed the concept of a blockchain-based anonymous reporting mechanism (BB2AR), and on this basis, they proposed and implemented a BB2AR scheme based on elliptic curve public key cryptosystem. Adeshina and Ojo [19] proposed a new secure reporting system based on bit commitment. The scheme keeps the reporter’s privacy in an ordinary routine, but the anonymity can be removed by a trusted thirty party (TTP) with the cooperation from the electronic reporting center (EIC). Wang et al. [20] have come up with ReportCoin, a blockchain-based incentive anonymous reporting system that ensures the confidentiality of user identities and the reliability of reporting messages. Most of the existing electronic reporting schemes use group signature or ring signature, which are designed with the anonymity of the reporter as the necessary requirement. The related works are illustrated in Table 1.
To sum up, we combined several advantages of existing research work and designed a new electronic reporting scheme to meet the requirements of unforgeability and immutability.
3. Preliminaries
3.1. Proxy Signature
Proxy signature was first proposed by Mambo, Usuda, and Okamoto [12] in 1996. Proxy signature is a special signature scheme, in which the original signer grants his signature right to the proxy signer, and the proxy signer can generate a valid digital signature on behalf of the original signature. A proxy signature algorithm usually has the following five steps:(1)Initialization: generating the key and other parameters required for proxy signature according to the algorithm.(2)Parameter transfer: the original signer calculates the parameters that the proxy signer requires for signing and secretly transmits them to the proxy signer.(3)Verification of signing right: the proxy signer verifies the parameters he received. If the verification is successful, the signing process can start. If the verification fails, the original signer can be required to perform the first two steps again or the proxy singer can terminate the signing process.(4)Proxy signature: the proxy signer uses his or her signing power to generate a valid proxy signature for the message.(5)Signature verification: the party receiving the message verifies if the proxy signature is valid.
3.2. Lattice
Lattice cryptosystem is an antiquantum computing cryptosystem based on NP-hard problems. Lattice theory was initially used in cryptanalysis until Ajtai first proved the difficulty of lattice problems [21] and proposed lattice cryptography with Dwork [22].
Our scheme’s security is based on the hardness of the module version of the Short Integer Solution (MSIS) and Learning With Errors problem (MLWE). The distribution of MLWE is randomly distributed a pair from . is chosen uniformly from , and where and . The MLWE is commanded to recover , while giving lots of samples from the MLWE distribution. It is stated that recovering is impossible, though given and where , where is a secure parameter. The MSIS problem is that given and where , to find a short nonzero preimage in the lattice which satisfies and . However, it is also impossible to find an efficient preimage in polynomial time.
3.3. Blockchain
Blockchain development began between 2007 and 2009. It is the underlying technology of Bitcoin, known as the “public ledger for storing cryptocurrencies.” In fact, although blockchain appeared with Bitcoin, its development not only enhances the value of Bitcoin but also occupies a place for itself in the Internet field. Blockchain has many significant advantages: Distributed storage: blockchain enables credit-based peer-to-peer transactions in distributed systems where nodes do not need to trust each other. Immutable: the attacker’s control of a single node cannot affect the block data of other nodes and the entire network, and the cost of a successful attack is very high. Openness: any data content and operation behavior of blockchain are publicly accessible to all nodes in the network.
4. Problem Formulation
4.1. Problem Statement
Reporting is one of the important ways for citizens to participate in politics, and it is also an important way to protect social fairness and civil rights. However, the traditional reporting way is not secure and secret for the reporter since the privacy of the reporter is easy to be exposed by going to the prosecution center or writing a reporting letter. Thus, anonymous reporting is a good way to protect reporters. It would be complicated and inconvenient if the reporting message is false since anyone can easily report without exposing their identity. To deal with this kind of reporting clutter, we can use the blockchain.
Blockchain provides the platform for everyone to join in politics with an equal chance. Users in blockchain can use the assumed name to report the bad people since blockchain has the property of anonymity. To reduce the above kind of reporting clutter, we design a reporting system using the proxy signature based on the blockchain. We randomly predetermined several proxy signers. Only the message signed from them can be verified and then be trusted by the prosecution center. Besides, considering the continuous development of quantum technology, we design a module-lattice-based proxy signature for our reporting system.
4.2. System Model
Our reporting scheme is deployed in the blockchain system. Users in the blockchain play 4 roles: reporter, proxy signer, electronic reporting box, and reporting center.
Reporting center is one special node in the blockchain system and is the trusted third party. Reporting center is voted by all users in the blockchain using the Raft algorithm [27] (Raft is a consensus algorithm for managing a replicated log). Reporting center records the reporter’s reporting signature and her/his own privacy in case of the malicious user interferes with the normal operation of the reporting system. When the user provides false reporting information, she/he will be found out by reporting center according to the ever records, and reporting center will broadcast her/his identity and remove her/him. Besides, reporting center also masters the right of permitting the electronic reporting box to verify the signature.
The electronic reporting box is predetermined by reporting center, and one reporting system only has one reporting box. The reporting box collects the reporting signatures and verifies their validity. When one user in this blockchain is reported more than half of the ordinary users (ordinary users do not contain the nodes of reporting box, reporting center, and proxy signer), the reporting box will broadcast her/his crime and remove her/him from the blockchain.
Proxy signer is the blockchain’s user whose reporting box and reporting center both trust. A complete reporting system usually has more than one proxy signer, but to explain the process of our scheme for convenience, we suppose only one proxy signer in this system. The proxy signer first authenticates the reporter’s identity and then signs for the reporting message if authentication passes.
The reporter can be any of the rest users in the blockchain and can report anyone she/he thinks is a bad guy. The reporter communicates with the proxy signer and authentic herself/himself, and after receiving the proxy signature from the proxy signer, she/he should submit her/his privacy and signature to the reporting center.
The overall structure is illustrated in Figure 1.
4.3. Adversary Model
For the traditional reporting system, the following risks often exist:(1)Suppose that an adversary attacks the system, which could lead to the loss of the reporter’s privacy(2)The proxy signature may not be the reporter’s real proxy signature(3)Suppose that a malicious user who reports good people, i.e., submits a false reporting message to the proxy signer
However, our proposed scheme can avoid these risks perfectly, and we will give a detailed security analysis in Section 6.
5. Proposed Scheme
5.1. Overview
Our scheme contains four parts: system initialization, proxy reporting procedure, reporting recording, and verification.
For the first step, system initialization, by taking secure parameters as input, users in this system obtain their own public keys and secret keys. In the proxy reporting procedure, a reporter from these members first selects a generally trusted proxy signer and communicates with her/him. Then, the proxy signer completes the authentication of the reporter and generates the proxy signature. The proxy signer sends the proxy signature to the electronic reporting box and the reporter afterward. After receiving the signature, the reporter encrypts her/his privacy (secret key and real name) and signature by the public key of a trusted third party, reporting center, and sends the ciphertext with the time stamp to this trusted third party as the record. The electronic reporting box records the current time after receiving the signature from the proxy signer and verifies whether this signature is valid or not. If the signature is valid, the reporting message will be recorded.
The above participants, including the reporter, the proxy signer, the electronic box, and reporting center, are all in the blockchain system such that our scheme can resist various adversary attacks. With the trusted third party participating, our scheme can trace the attacks from the malicious users while protecting the reporter’s privacy (reporter is allowed to use assumed name to join the proxy signing interaction) in the reporting procedure, and the more detailed analysis is stated in the next section. Considering the future network environment and the improvement of the quantum technique, we design a new proxy signature scheme based on the module lattice.
According to the table of related work, we compare our work with these works. Our scheme uses blockchain technology to ensure that the honest reporter in our system can be protected and the malicious reporter can be traced. However, all these works cannot achieve this destination. Our scheme uses the proxy signature to achieve the electronic reporting, but works [3–5, 16, 20] use other signature types. The most important thing is that our scheme can resist the attack from the quantum adversary while no one else can.
5.2. System Initialization
Since our scheme is based on the module lattice, by taking the secure parameter as input, the procedure first generates the system parameters, such as , and the system functions, such as HighBits() and LowBits(). After obtaining the necessary information, users in our scheme (including the reporter, proxy signer, the electronic reporting box, and “reporting center”) can use them to generate their public keys and secret keys. The key generation algorithm KeyGen() is illustrated in Algorithm 1. It first generates a matrix , each of which is a polynomial in the ring . For the value of and , they are restricted tightly in [24]. The secret keys and are sampled randomly, and each coefficient of these key vectors is an element from . The size of each coefficient is . According to the hard assumptions MLWE, the public key is computed as . Then, users broadcast their public key in the blockchain. The public key and secret key can be used to encrypt/decrypt the transiting message among all users and sign/verify for the reporting message.
|
5.3. Proxy Signing Procedure
Suppose user is a reporter, user is the proxy signer, user is the electronic reporting box, and user is the “reporting center,” and the notations are listed in Table 2:
The proxy signing procedure contains 3 parts: identity authentication, proxy signing, and signature return and is introduced in Figure 2:(i)Identity Authentication. The reporter first randomly selects a vector denoted by where each coefficient of should be less than . Then, he computes as the temporary key, and in order to be convenient and suitable for the next steps, he uses the function HighBits() to extract the high-order bits of , named as . should satisfy the equation where . The reporter hashes the value of as the challenge which consists of 60’s . For the size of the challenge, consider that at most contains 60’s . To make a complete identified authentication, the reporter should “mix” the challenge with her/his own secret key . However, since , the size of is less than . is the maximum coefficient value of . Thus, the above condition can be written as . The authentication requirement is , but has the limited range of size where . Besides, to achieve the following authentication, another limitation should be admitted, i.e., the low-order bits of ’s coefficients should be less than ; otherwise, it will leak the information of the secret key. If the size check passed, the reporter sends to the proxy signer. After receiving these information, the proxy signer identifies the reporter by using the function HighBits(). If the reporter’s identity is confirmed, the proxy signing will be carried out next.(ii)Proxy Signing. The proxy signer makes as to participate in the following signing procedure. Similar as the above process, the proxy signer computes as the signing temporary key and takes the high-order bits of . is hashed from and the signing message . Since the hash function of the signing procedure is the same as the identity authentication’s, the size of is also less than , and the maximum coefficient value of also is written as where . Thus, the potential signature is constructed by . In order to protect the secret key and make the signature independent of the secret key, and also which confirms that the signature can be verified validity.(iii)Signature Return. After passes the size check, the proxy signer obtains the proxy signature and sends it to the reporter and the electronic reporting box.
It is stated that to protect privacy, the information should be encrypted by using the destination’s public key during the interaction.
5.4. Reporting Record
After receiving the proxy signature, to record this reporting behavior in case of malicious reporting (since the reporter is able to use the assumed name to accomplish the reporting), the reporter should send her/his own secret key and her/his real name with the signature to the trusted third party, named as reporting center. The reporting center stores the information secretly and only broadcasts malicious user’s real identity if he tells lies in reporting procedure.
Besides, the electronic reporting box receives the signature and matches it to the previously broadcast public key. The reporting box records the signature with its corresponding public key and waits for permission to verify the reporting center. If the reporting box has not received permission to verify for a long time (The time is set according to the blockchain latency), he will abandon this signature and mark this proxy signer. If the amount of marked users is over the half users of this system, this proxy signer will be broadcast as a malicious user and removed.
5.5. Verification
The electronic reporting box first communicates with the reporting center to confirm whether this signature has been registered or not. The verification is operated by the reporting box after getting permission from the reporting center and is illustrated in Algorithm 2. The reporting box first checks the size of and verifies whether the signature is changed or not during the transmission. According to and , it can be written as follows.
|
Thus, it is clear that
Because and the coefficients of are less than , adding other low-order coefficients cannot cause a big effect in high-order bits. Therefore, the above equations can be written as follows:
If the hash value of and the signing message is equal to signature’s , the signature is not changed during the transmission and is verified validity. Up to here, the reporting box has verified that the signature is generated by the proxy signer and will verify whether the real signer of the signature is the reporter or not.
The verifying process is similar to the above. The reporting box writes as the result of . In the function HighBits(), cannot affect the result of the computation. can be approximately seen as , in other words, . Therefore, use the reporter’s public key to identify who the real signer is. Since and refer to the above equations, it is clear that
Besides, since the coefficients of are less than , adding other low-order bits cannot influence the high-order’s. According to the above analysis, if , it can prove that the reporter is the real signer, and the signing message can be accepted by the reporting box while the one-time proxy reporting procedure ends up.
The electronic reporting box verifies the proxy signatures from the proxy signer and collects the reporting message if signatures are valid. For the person who is reported, suppose that she/he is user , she/he will not be removed from this blockchain system right away. Only when the amount of signing message is over the half of the blockchain system users, the reporting center will broadcast the message “User is the traitor, do not trust her/him” and remove user right away.
6. Security Analysis
According to the adversary model, our scheme can resist these risks:(1)Suppose an adversary who wants to steal the privacy of the reporter. Since the reporter should send reporting center her/his privacy with the signature to register herself/himself, wants to steal some information from the transmission. However, our scheme state that any transiting message should be encrypted by using receiver’s public key, and the public key is generated based on the hard assumption of MLWE while the encryption in our scheme is Crystals-Kyber [25], one of the Round 3 NIST public-key encryption submissions (Because the main idea of our work is the reporting system designing, the encryption process is omitted). The above encrypted algorithm has postquantum property. Although can intercept the ciphertext, she/he is not able to obtain the real message without the reporting center’s private key or using modern technology. For the reporting center, she/he is the trusted third party, and only she/he can have access to visit the records of reporter’s privacy so that cannot get the reporter’s privacy there. Thus, our scheme can avoid the risk of reporter’s privacy leakage.(2)Another risk is that the signature misses the required authentication, which means that the signature may not be the reporter’s real proxy signature. Suppose that the proxy signer is malicious, she/he sends a false signature and claims that the signature is entrusted by the reporter, i.e., she/he frame the reporter. Because of the procedure of report recording, our scheme can prevent this risk. In our scheme, the proxy signer should also send the signature back to the reporter so that the reporter will not get the signature if she/he has not submitted the requirement of reporting signature to the proxy signer. Thus, when the proxy signer sends the signature to the electronic reporting box, the framed user will not send her/his privacy information to the reporting center such that the reporting center will not send the permission of verifying to the electronic reporting box and the verifying process will not start. If reporting box does not receive permission to verify for a long time, she/he will mark the proxy signer. When the amount of this proxy signer’s marks is over the established domain (here, we set the domain value as half of the system’s users), this proxy signer will be removed. Another case is the user impersonates others to communicate with the proxy signer. However, it is impossible since strict identity authentication is implemented during the interaction and the user cannot obtain other’s secret key. Therefore, our scheme can prevent users from being framed.(3)Suppose a malicious user submits a false reporting message to the proxy signer. Although the false reporting message can finally be signed by the proxy signer, people reported will be removed only when the amount of reporting messages from different users is over no less than half of all users. Besides, once the reporting message needs to be broadcast after the signature is verified validity, other people will know who has been reported and they can dispute this message with the reporting center if people reported are not bad. If half of the users raise disputes for this reporting message, reporting center will search the signature records to find out the reporter. The reporter can use the assumed name to report others, but she/he has to send his private information (including her/his real name) to reporting center so that reporting center can trace her/his identity and broadcast it. That is, our scheme can find out the malicious user.
7. Conclusions
In this paper, we propose a decentralized electronic reporting scheme based on proxy signature and blockchain and provide the system model of our scheme. To resist the future quantum attack, we propose a new proxy signature based on the module lattice. While preserving the reporter’s privacy, our scheme can trace the malicious users at the same time, which greatly improves the usability of our scheme. Besides, we give a detailed security analysis for the adversary model. In the future, we will improve our proposed system efficiency and make the comparison with other electronic reporting systems. [13–15, 23].
Data Availability
The signature data and the code used to support the findings of this study are available from the corresponding author upon request.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
The research was financially supported by the Foundation of Yunnan Key Laboratory of Blockchain Application Technology (Nos. 202105AG070005 and YNB202103), the National Natural Science Foundation of China (No. 61972366), the Provincial Key Research and Development Program of Hubei (No. 2020BAB105), and the Foundation of Guizhou Provincial Key Laboratory of Public Big Data (No. 2019BDKFJJ003 and 2019BDKFJJ011).