A Provably Secure Revocable ID-Based Authenticated Group Key Exchange Protocol with Identifying Malicious Participants

Abstract

The existence of malicious participants is a major threat for authenticated group key exchange (AGKE) protocols. Typically, there are two detecting ways (passive and active) to resist malicious participants in AGKE protocols. In 2012, the revocable identity- (ID-) based public key system (R-IDPKS) was proposed to solve the revocation problem in the ID-based public key system (IDPKS). Afterwards, based on the R-IDPKS, Wu et al. proposed a revocable ID-based AGKE (RID-AGKE) protocol, which adopted a passive detecting way to resist malicious participants. However, it needs three rounds and cannot identify malicious participants. In this paper, we fuse a noninteractive confirmed computation technique to propose the first two-round RID-AGKE protocol with identifying malicious participants, which is an active detecting way. We demonstrate that our protocol is a provably secure AGKE protocol with forward secrecy and can identify malicious participants. When compared with the recently proposed ID/RID-AGKE protocols, our protocol possesses better performance and more robust security properties.

1. Introduction

In the past, group-oriented applications, such as collaboration works and teleconference, were popularly and widely used in the Internet. Authenticated group key exchange (AGKE) protocol [1] is a cryptographic primitive which provides secure group communications for users in cooperative and distributed applications. During executing the protocol, group participants not only cooperatively generate a common key which is used to encrypt the transmitted messages but also authenticate the participants’ identities.

The existence of malicious participants is a major threat for AGKE protocols. The goal of malicious participants is to disturb the establishing of common keys. Hence, how to resist malicious participants in AGKE protocols becomes a critical research. Typically, there are two detecting ways to resist malicious participants. (I) Passive detection [2–4]: it involves an explicit key confirmation approach in AGKE protocols. The resulted protocols only detect the existence of malicious participants and an additional round is required. (II) Active detection [5, 6]: it adopts a noninteractive confirmed computation technique into AGKE protocols. The resulted protocols can identify the identities of malicious participants without additional round. However, the computational cost of active detection is time-consuming than the one of passive detection.

Quite recently, the revocable identity- (ID-) based public key system (R-IDPKS) was proposed to solve the revocation problem of users in the ID-based public key system (IDPKS). The concept of IDPKS was introduced by Shamir [7] in 1984 and was practiced by Bonch and Franklin [8] in 2001. Indeed, they [8] had suggested a solution that the private key generator (PKG) renews these nonrevoked users’ private keys periodically to answer the revocation problem in the IDPKS. The approach can be used to revoke the compromised or misbehaving users. Nevertheless, the heavy workload arose from the PKG for renewing users’ private keys periodically.

In 2008, Boldyreva et al. [9] proposed a revocable ID-based encryption (RIBE) scheme by using binary tree. Their scheme can reduce the PKG’s workload mentioned in the Boneh-Franklin solution [8]. However, this scheme is based on a weak security model called the relaxed selective-ID model [10]. In 2009, Libert and Vergnaud [11] relied on Boldyreva et al.’s RIBE to present a secure RIBE scheme under an adaptive-ID model. Recently, Seo and Emura [12] demonstrated Boldyreva et al.’s scheme [9] is vulnerable to decryption key exposure and then proposed a provably secure tree based RIBE scheme. Subsequently, Seo and Emura [13] presented a hierarchical RIBE scheme to solve the open problem mentioned in [11].

In 2011, Tseng and Tsai [14] proposed a practical RIBE scheme over a public channel. The key construction of the Tseng-Tsai scheme is different from the previous schemes [9, 11–13]. In [14], each user’s private key consists of a fixed initial private key and an update key, where the update key is renewed along with the current period. For an honest (nonrevoked) user, the PKG periodically issues new update key and sends it to the user via a public channel. Upon receiving the new updating key, the user can renew her/his private key by herself/himself. To revoke a malicious user, the PKG only stops issuing the new update key in current period. Thus, the user cannot compute the newest private key. In other words, she/he cannot execute any cryptographic behaviors in later periods. Later on, several revocable ID-based cryptographic schemes based on the Tseng-Tsai R-IDPKS [14] were presented such as encryption [15], signature [16, 17], authenticated group key exchange (AGKE) [4], and signcryption [18].

In 2012, Wu et al. [4] proposed the first provably secure revocable ID-based AGKE (RID-AGKE) protocol. Their protocol adopted a passive detecting way to resist malicious participants. However, it requires three rounds and cannot identify the identities of malicious participants. In this paper, we fuse the key construction of Tseng-Tsai R-IDPKS [14] and a noninteractive confirmed computation technique [6] to present a two-round RID-AGKE protocol with identifying malicious participants. In our protocol, each group participant can confirm whether the broadcast values are correctly computed by other participants. Based on the detecting approach, our protocol can easily identify the participants who maliciously broadcast the incorrect values to disturb the common key establishing. The framework and security notions for RID-AGKE protocols are defined to formalize possible threats and attacks. We demonstrate the security of our protocol in the random oracle model [19] and under two mathematical assumptions (the computational Diffie-Hellman and the decisional bilinear Diffie-Hellman). Finally, we make the comparisons between our protocol and the recently proposed ID/RID-AGKE protocols to show the advantages of the proposed protocol.

The rest of this paper is organized as follows. We briefly review the concepts of bilinear pairings and related mathematical problems in Section 2. The security model and notions of RID-AGKE are presented in Section 3. We propose a concrete RID-AGKE protocol in Section 4. Security analysis of the proposed RID-AGKE protocol is demonstrated in Section 5. We make the performance analysis and comparisons in Section 6. Conclusions are drawn in Section 7.

2. Preliminaries

In this section, we briefly review the properties of bilinear pairings and related mathematical problems. For the details, a reader can refer to [8, 20, 21] for full descriptions.

2.1. Bilinear Pairings

Let 𝐺₁ and 𝐺₂ be two groups of a large prime order 𝑞, where 𝐺₁ is an additive cyclic group and 𝐺₂ is a multiplicative cyclic group. A bilinear pairing 𝑒 is a map defined by 𝑒∶𝐺₁×𝐺₁→𝐺₂ and satisfies the following three conditions.(1)Bilinearity: for all 𝑃,𝑄∈𝐺₁ and 𝑎,𝑏∈𝑍_𝑞, 𝑒(𝑎𝑃,𝑏𝑄)=𝑒(𝑃,𝑄)^𝑎𝑏.(2)Nondegeneracy: there exist 𝑃,𝑄∈𝐺₁ such that 𝑒(𝑃,𝑄)≠1.(3)Computability: for all 𝑃,𝑄∈𝐺₁, there exists an algorithm to compute 𝑒(𝑃,𝑄).

2.2. Mathematical Hard Problems and Assumptions

Here, we present two mathematical hard problems and define the corresponding assumptions as follows.(1)Computational Diffie-Hellman (CDH) problem: given 𝑃,𝑎𝑃,𝑏𝑃∈𝐺₁ for some 𝑎,𝑏∈𝑍_𝑞^∗, the CDH problem is to compute 𝑎𝑏𝑃∈𝐺₁.(2)Decisional bilinear Diffie-Hellman (DBDH) problem: given 𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃,𝑑𝑃∈𝐺₁ for some 𝑎,𝑏,𝑐,𝑑∈𝑍_𝑞^∗, the DBDH problem is to distinguish (𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃,𝑑𝑃,𝑒(𝑃,𝑃)^𝑎𝑏𝑐 from (𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃,𝑑𝑃,𝑒(𝑃,𝑃)^𝑑).

Definition 1 (CDH assumption). Given 𝑃,𝑎𝑃,𝑏𝑃∈𝐺₁ for some 𝑎,𝑏∈_𝑅𝑍_𝑞^∗, there does not exist a probabilistic polynomial-time algorithm 𝐴 with a nonnegligible probability to compute 𝑎𝑏𝑃∈𝐺₁. The advantage of 𝐴 within running time 𝑡 is defined as 𝐴𝑑𝑣_𝐶𝐷𝐻(𝑡)=Pr[𝐴(𝑃,𝑎𝑃,𝑏𝑃)=𝑎𝑏𝑃∣𝑃,𝑎𝑃,𝑏𝑃∈𝐺₁].

Definition 2 (DBDH assumption). Given 𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃,𝑑𝑃∈𝐺₁ for some 𝑎,𝑏,𝑐,𝑑∈_𝑅𝑍_𝑞^∗, there does not exist a probabilistic polynomial-time algorithm 𝐴 with nonnegligible probability to distinguish (𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃,𝑑𝑃,𝑒(𝑃,𝑃)^𝑎𝑏𝑐) from (𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃,𝑑𝑃,𝑒(𝑃,𝑃)^𝑑). The advantage of 𝐴 within running time 𝑡 is defined as 𝐴𝑑𝑣_{𝐷𝐵𝐷𝐻}(𝑡)=Pr[𝐴(𝑒(𝑃,𝑃)^𝑎𝑏𝑐,𝑒(𝑃,𝑃)^𝑑)=1∣𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃,𝑑𝑃∈𝐺₁].

3. Model and Notions

In this section, we define the model and notions for RID-AGKE protocol. Note that some of the following definitions and notations are referred to in [4, 6, 22–24].

Initialization. The initialization of RID-AGKE protocol has three algorithms.

(1) Setup Algorithm. This algorithm is a probabilistic algorithm which takes as input a security parameter 𝑘 and a total number 𝑧 of periods. It returns a system private key 𝑠 and public parameters param. Note that the whole life time of the system is divide into distinct periods 1,2,…,𝑧. Here, param is made public.

(2) Initial Key Extract Algorithm. This algorithm is a deterministic algorithm which takes as input the system private key 𝑠 and a participant’s identity 𝐼𝐷. It returns the participant’s initial private key 𝐷𝐼𝐷.

(3) Key Update Algorithm. This algorithm is a deterministic algorithm which takes as input the system private key 𝑠, a participant’s identity 𝐼𝐷, and a period index 𝑗, where 1≤𝑗≤𝑧. It returns the participant’s update key 𝑇𝐼𝐷_𝑗.

Here, note that the participant’s private key for period 𝑗 is defined by 𝐷𝐼𝐷_𝑗=𝐷𝐼𝐷+𝑇𝐼𝐷_𝑗.

Related Notions. For simplicity, there is a fixed set 𝐺={𝑈₁,𝑈₂,…,𝑈_𝑛} with polynomial size of potential participants. Assume that each participant 𝑈_𝑖 has a unique identity 𝐼𝐷_𝑖∈{0,1}^∗. Any subset of 𝐺 may run a RID-AGKE protocol many times (possibly concurrently) in some period index 𝑗 to establish a group session key, where 1≤𝑗≤𝑧 and 𝑧 is a total number of periods. Note that the set of participants’ identities, 𝐈𝐃={𝐼𝐷₁,𝐼𝐷₂,…,𝐼𝐷_𝑛} is known by all participants (including adversary).

An instance 𝑡 of participant 𝑈 in period 𝑗 is denoted by Π_𝑈^𝑗(𝑡), where 𝑡 is a positive integer. Each instance Π_𝑈^𝑗(𝑡) has associated with seven variables as follows.(i)𝑠𝑡𝑎𝑡𝑒_𝑈^𝑗(𝑡): it presents the current state of instance Π_𝑈^𝑗(𝑡).(ii)𝑎𝑐𝑐_𝑈^𝑗(𝑡) and 𝑡𝑒𝑟𝑚_𝑈^𝑗(𝑡): they take Boolean values to demonstrate whether Π_𝑈^𝑗(𝑡) has accepted or terminated. Informally, we say that an instance has accepted meaning that it does not detect any incorrect behavior. An instance is called terminating if it has sent and received messages. Note that a terminated instance may also possibly accept.(iii)𝑢𝑠𝑒𝑑_𝑈^𝑗(𝑡): it indicates whether Π_𝑈^𝑗(𝑡) is used in a RID-AGKE protocol.(iv)𝑝𝑖𝑑_𝑈^𝑗(𝑡): the partner ID of instance Π_𝑈^𝑗(𝑡) is a set which contains the identities of participants in the group with whom Π_𝑈^𝑗(𝑡) wants to establish a group session key (including 𝑈 itself).(v)𝑠𝑖𝑑_𝑈^𝑗(𝑡): the session ID of instance Π_𝑈^𝑗(𝑡) is a concatenation of all messages sent and received by the instance in a given execution of RID-AGKE protocol.(vi)𝑠𝑘_𝑈^𝑗(𝑡): a group session key which is accepted by instance Π_𝑈^𝑗(𝑡).

In the following definitions, we will only focus on the three variables 𝑝𝑖𝑑_𝑈^𝑗(𝑡), 𝑠𝑖𝑑_𝑈^𝑗(𝑡), and 𝑠𝑘_𝑈^𝑗(𝑡). The remaining variables will be left implicit. We say that two instances Π_𝑈^𝑗(𝑡) and Π_𝑈^𝑗(𝑣)_′ are partnered if (1) they have accepted the same group session key; (2) 𝑠𝑖𝑑_𝑈^𝑗(𝑡)=𝑠𝑖𝑑_𝑈^𝑗(𝑣)_′; and (3) 𝑝𝑖𝑑_𝑈^𝑗(𝑡)=𝑝𝑖𝑑_𝑈^𝑗(𝑣)_′.

Adversarial Model. An adversary 𝐴 can be viewed as a probabilistic polynomial-time algorithm. Here, we assume that 𝐴 can potentially control all communications in a RID-AGKE protocol. The interaction between 𝐴 and instances of participants in the protocol is modeled by the following oracles.(i)Execute (𝑉,𝑗): when 𝐴 makes Execute query on (𝑉,𝑗), it executes the RID-AGKE protocol between the unused instances of participants in 𝑉 for period index 𝑗 and then returns a transcript of the execution, where 𝑉 is a subset of 𝐺. Here, Execute query is used to model passive attacks.(ii)Inextract (𝐼𝐷_𝑈): when 𝐴 makes Initial key extract query on identity 𝐼𝐷_𝑈, it generates an initial private key 𝐷𝐼𝐷_𝑈 corresponding to 𝐼𝐷_𝑈 and returns it to 𝐴, where 𝐼𝐷_𝑈∉𝐈𝐃.(iii)Kupdate (𝐼𝐷_𝑈,𝑗): when 𝐴 makes Key update query on (𝐼𝐷_𝑈,𝑗), it generates an update key 𝑇𝐼𝐷_𝑈,𝑗 corresponding to (𝐼𝐷_𝑈,𝑗) and returns it to 𝐴, where 𝐼𝐷_𝑈∉𝐈𝐃 and 𝑗 is a period index.(iv)Send (𝑈,𝑗,𝑡,𝑀): when 𝐴 makes Send query on (𝑈,𝑗,𝑡,𝑀), it sends message 𝑀 to instance Π_𝑈^𝑗(𝑡) and then returns the reply generated by this instance according to procedures of RID-AGKE protocol.(v)Reveal (𝑈,𝑗,𝑡): when 𝐴 makes Reveal query on (𝑈,𝑗,𝑡), it returns a group session key 𝑠𝑘_𝑈^𝑗(𝑡) for a terminated instance Π_𝑈^𝑗(𝑡). Here, Reveal query is used to model known session key attacks.(vi)Corrupt (𝐼𝐷_𝑈,𝑗): when 𝐴 makes Corrupt query on (𝐼𝐷_𝑈,𝑗), it returns a private key 𝐷𝐼𝐷_𝑈,𝑗 of 𝐼𝐷_𝑈 in period 𝑗. Note that Corrupt query models the corruption of this participant at a time in which it is not currently executing the protocol. We say that a participant 𝑈 is honest if and only if no Corrupt query has been made by 𝐴.(vii)Test (𝑈,𝑗,𝑡,): at any time, the adversary 𝐴 makes Test query only once to this oracle during 𝐴’s execution. In this moment, a random coin 𝑏∈{0,1} is selected. If 𝑏=1, a group session key 𝑠𝑘_𝑈^𝑗(𝑡) is retuned. Otherwise, a random value is retuned. Here, Test query is used to model the semantic security of group session key.

According to the above adversarial model, we define two types of adversaries. A passive adversary is allowed to make Execute, Reveal, Corrupt, and Test queries. An active adversary is allowed to make the above all queries. In order to get more precise analysis, we still use Execute query though it can be substituted by making Send query repeatedly.

Remark 3. According to the adversarial model above, the adversary 𝐴 can compute the participant 𝑈’s private key 𝐷𝐼𝐷_𝑈,𝑗=𝐷𝐼𝐷_𝑈+𝑇𝐼𝐷_𝑈,𝑗 for period index 𝑗 while 𝐴 makes both Initial key extract query on 𝐼𝐷_𝑈 and Key update query on (𝐼𝐷_𝑈,𝑗) simultaneously. Hence, we disallow 𝐴 to make both queries in the same time.

Correctness. 𝐴 RID-AGKE protocol is called correct if the following three conditions hold.(1)All participants are honest and all messages are delivered honestly.(2)𝑎𝑐𝑐_𝑈^𝑗(𝑡)=𝑎𝑐𝑐_𝑈^𝑗(𝑣)_′ = “True” and 𝑠𝑘_𝑈^𝑗(𝑡)=𝑠𝑘_𝑈^𝑗(𝑣)_′.(3)𝑠𝑖𝑑_𝑈^𝑗(𝑡)=𝑠𝑖𝑑_𝑈^𝑗(𝑣)_′and 𝑝𝑖𝑑_𝑈^𝑗(𝑡)=𝑝𝑖𝑑_𝑈^𝑗(𝑣)_′ for all participants 𝑈,𝑈^′∈𝑉⊆𝐺 with instances Π_𝑈^𝑗(𝑡) and Π_𝑈^𝑗(𝑣)_′.

Freshness. We say that an instance Π_𝑈^𝑗(𝑡)is called fresh (or called holding a fresh group session key 𝑠𝑘_𝑈^𝑗(𝑡)) if the following three conditions hold.(1)Π_𝑈^𝑗(𝑡) has accepted a group session key 𝑠𝑘_𝑈^𝑗(𝑡).(2)Neither Π_𝑈^𝑗(𝑡) nor its partners have been made Reveal query.(3)No Corrupt query has been made on 𝐼𝐷_𝑉∈𝑝𝑖𝑑_𝑈^𝑗(𝑡) before Send query to Π_𝑈^𝑗(𝑡) or Send query to Π_𝑈^𝑗(𝑣)_′, where 𝐼𝐷_𝑈′∈𝑝𝑖𝑑_𝑈^𝑗(𝑡).

Here, we assume all instances are fresh. Note that the notion of freshness is defined appropriately for the purpose of forward secrecy.

Secure RID-AGKE. A secure RID-AGKE protocol contains the following four parts.

(1) Freshness.

(2) Security of RID-AGKE Protocol. The security of RID-AGKE protocol is defined in the following game played between an active adversary 𝐴 and a set of instances:(a)initialization: the system private key, public parameters, and participants’ private keys are generated in this phase;(b)query: A may make different types of queries to oracles and gets back the answers corresponding to the RID-AGKE protocol;(c)guess: finally, the adversary 𝐴 outputs its guess for the coin 𝑏 in Test query and terminates.

In this game, the goal of 𝐴 is to distinguish a group session key from a random value. Let Succ be the event that 𝐴 correctly guesses the coin 𝑏 in Test query. The advantage of 𝐴 in attacking a RID-AGKE protocol Ψ is defined by 𝐴𝑑𝑣_𝐴,Ψ(𝑘)=|2⋅Pr[𝑆𝑢𝑐𝑐]−1|. We say that the protocol Ψ is secure, if the advantage 𝐴𝑑𝑣_𝐴,Ψ(𝑘) is negligible.

(3) Forward Secrecy. We say that a RID-AGKE protocol Ψ provides forward secrecy. It means that though an adversary 𝐴 obtains participants’ private keys in Ψ, the previous establishing group session keys is preserved. The advantage of 𝐴 in attacking the protocol Ψ within running time 𝑡 is defined by 𝐴𝑑𝑣^{𝑅𝐼𝐷𝐴𝐺𝐾𝐸-}_Ψ^𝑓𝑠(𝑡,𝑞_𝑒𝑥,𝑞_𝑠), where 𝑞_𝑒𝑥 and 𝑞_𝑠 are the maximum numbers of making Execute and Send queries, respectively.

(4) Authentication. We say that a RID-AGKE protocol Ψ provides implicit key authentication if all participants in Ψ are guaranteed that nobody other than their partners can learn the session key. In other words, any adversary should not learn the key. Note that this security property does not guarantee that the partners have computed the key.

Malicious Participant. A participant 𝑈_𝑚 is called malicious in a RID-AGKE protocol Ψ if he is a legal participant but is fully controlled by adversary. The goal of malicious participant is to disturb the group key establishing in Ψ.

4. Concrete Protocol

In this section, we propose a concrete RID-AGKE protocol with identifying malicious participants. Our protocol fuses the Tseng-Tsai R-IDPKS [14] and a noninteractive confirmed computation technique [6]. In the initialization phase, given a security parameter 𝑘 and a total number 𝑧 of periods, a private key generator (PKG) executes Setup algorithm to generate the system private key 𝑠 and the public parameters 𝑝𝑎𝑟𝑎𝑚={𝐺₁,𝐺₂,𝑒,𝑞,𝑃,𝑃_𝑝𝑢𝑏,𝐻₁,𝐻₂,𝐻₃,𝐻₄} defined in Notations section at the end of the paper.

When a participant 𝑈 with identity 𝐼𝐷_𝑈∈{0,1}^∗ wants to obtain her/his initial private key 𝐷𝐼𝐷_𝑈, the PKG runs Initial key extract algorithm to compute 𝐷𝐼𝐷_𝑈=𝑠⋅𝐻₁(𝐼𝐷_𝑈)=𝑠⋅𝑄𝐼𝐷_𝑈 and returns it to 𝑈 via a secure channel. For a nonrevoked participant 𝑈 with identity 𝐼𝐷_𝑈 in time period 𝑗, the PKG runs Key update algorithm to compute her/his update key 𝑇𝐼𝐷_𝑈,𝑗=𝑠⋅𝐻₂(𝐼𝐷_𝑈,𝑗)=𝑠⋅𝑅𝐼𝐷_𝑈,𝑗 and returns it to 𝑈 via a public channel, where 1≤𝑗≤𝑧. Hence, any nonrevoked participant 𝑈 can update her/his private key 𝐷𝐼𝐷_𝑈,𝑗=𝐷𝐼𝐷_𝑈+𝑇𝐼𝐷_𝑈,𝑗 by itself in period 𝑗.

Let 𝐺={𝑈₁,𝑈₂,…,𝑈_𝑛} be a set of participants who want to establish a group session key 𝑆𝐾_𝑗 in period 𝑗. We assume that each 𝑈_𝑖 has a unique identity 𝐼𝐷_𝑖∈{0,1}^∗ as public key and 𝑈_𝑖’s private key is 𝐷𝐼𝐷_𝑖,𝑗=𝐷𝐼𝐷_𝑖+𝑇𝐼𝐷_𝑖,𝑗 for period 𝑗. Note that the indices are subject to modulo 𝑛; that is, 𝑈_𝑛+1 and 𝑈₀ denote 𝑈₁ and 𝑈_𝑛, respectively. Finally, 𝑚∈{0,1}^∗ is a preknown common message by all participants. The details of proposed RID-AGKE protocol are described as follows.

Round 1. Each participant 𝑈_𝑖 randomly selects a secret value 𝑎_𝑖∈𝑍_𝑞^∗ and computes 𝑃_𝑖=𝑎_𝑖⋅𝑃, ℎ_𝑖=𝐻₃(𝐼𝐷_𝑖,𝑃𝐼𝐷_𝑗,𝑗,𝑚,𝑃_𝑖), and 𝑉_𝑖=𝐷𝐼𝐷_𝑖,𝑗+𝑎_𝑖⋅ℎ_𝑖⋅𝑃_𝑝𝑢𝑏, where 𝑃𝐼𝐷_𝑗 denotes the concatenation of all participants’ identities in period 𝑗; that is, 𝑃𝐼𝐷_𝑗=𝐼𝐷₁‖𝐼𝐷₂‖⋯‖𝐼𝐷_𝑛. Finally, each 𝑈_𝑖 broadcasts (𝐼𝐷_𝑖,𝑗,𝑃_𝑖,𝑉_𝑖) to other participants.

Round 2. Upon receiving (𝐼𝐷_𝑖−1,𝑗,𝑃_𝑖−1,𝑉_𝑖−1) and (𝐼𝐷_𝑖+1,𝑗,𝑃_𝑖+1,𝑉_𝑖+1), each 𝑈_𝑖 first verifies them by checking 𝑒𝑃,_{𝑘∈{−1,1}}𝑉_𝑖+𝑘?=𝑒𝑃_𝑝𝑢𝑏,_{𝑘∈{−1,1}}𝐻₁𝐼𝐷_𝑖+𝑘+𝐻₂𝐼𝐷_𝑖+𝑘,𝑗+ℎ_𝑖+𝑘⋅𝑃_𝑖+𝑘, (1) where ℎ_𝑖+𝑘=𝐻₃(𝐼𝐷_𝑖+𝑘,𝑃𝐼𝐷_𝑗,𝑗,𝑚,𝑃_𝑖+𝑘). If the verification is true, each 𝑈_𝑖 uses her/his secret value 𝑎_𝑖 to compute 𝐷_𝑖=𝑒(𝑎_𝑖⋅(𝑃_𝑖+1−𝑃_𝑖−1),𝑃_𝑝𝑢𝑏). Then, 𝑈_𝑖 randomly selects a value 𝑟_𝑖∈𝑍_𝑞^∗ and computes a tuple (𝐼𝐷_𝑖,𝑗,𝐷_𝑖,𝛼_𝑖,𝛽_𝑖,𝛾_𝑖), where 𝛼_𝑖=𝑟_𝑖⋅𝑃, 𝛽_𝑖=𝑟_𝑖⋅(𝑃_𝑖+1−𝑃_𝑖−1), 𝛾_𝑖=𝑟_𝑖⋅𝑃_𝑖+𝑤_𝑖⋅𝑎_𝑖⋅𝑃_𝑝𝑢𝑏, 𝑤_𝑖=𝐻₄(𝐼𝐷_𝑖‖𝑃𝐼𝐷_𝑗‖𝑗‖𝐷_𝑖‖𝑆_𝑗,𝑃_𝑖+1−𝑃_𝑖−1,𝛼_𝑖,𝛽_𝑖), and 𝑆_𝑗=𝑃₁‖𝑃₂‖⋯‖𝑃_𝑛. Finally, 𝑈_𝑖 sends this tuple to all other participants.

Group Key Computation. Upon receiving all (𝐼𝐷_𝑘,𝑗,𝐷_𝑘,𝛼_𝑘,𝛽_𝑘,𝛾_𝑘) for 𝑘=1,2,…,𝑛 except 𝑖, each 𝑈_𝑖 verifies them by checking 𝑒𝑃,^𝑛_{𝑘=1,𝑘≠𝑖}𝛾_𝑘=^𝑛_{𝑘=1,𝑘≠𝑖}𝑒𝑃_𝑘,𝛼_𝑘+𝑤_𝑘⋅𝑃_𝑝𝑢𝑏,𝑒𝑃_𝑘+1−𝑃_𝑘−1,𝛾=_𝑘^?𝑒𝛽_𝑘,𝑃_𝑘⋅𝐷^𝑤𝑘_𝑘. (2) If the two verifications hold, 𝑈_𝑖 can confirm that each 𝐷_𝑘 is computed by 𝑈_𝑘 using her/his secret 𝑎_𝑘 honestly for 𝑘=1,2,…,𝑛 except 𝑖. Finally, in period 𝑗, each participant 𝑈_𝑖 can compute the group session key 𝑆𝐾_𝑗=𝑒(𝑎_𝑖⋅𝑃_𝑖−1,𝑃_𝑝𝑢𝑏)^𝑛⋅𝐷_𝑖^𝑛−1⋅𝐷^𝑛−2_𝑖+1⋯𝐷_𝑖−2.

Identifying Malicious Participant. When a malicious participant 𝑈_𝑚 tries to send a wrong tuple (𝐼𝐷_𝑚,𝐷_𝑚,𝑗,𝛼_𝑚,𝛽_𝑚,𝛾_𝑚) to disrupt the establishment of group session key, he will be identified as a malicious participant by using the following two verifying equations: 𝑒(𝑃,𝛾_𝑘)=^?𝑒(𝑃_𝑘,𝛼_𝑘+𝑤_𝑘⋅𝑃_𝑝𝑢𝑏) and 𝑒(𝑃_𝑘+1−𝑃_𝑘−1,𝛾_𝑘)=^?𝑒(𝛽_𝑘,𝑃_𝑘)⋅𝐷^𝑤𝑘_𝑘. Later on, 𝑈_𝑚 will be deleted from the participant set 𝐺 and other honest participants may rerun the protocol.

5. Security Analysis

In this section, we prove the security of the proposed RID-AGKE protocol in the random oracle model [19] and under the CDH and DBDH assumptions.

ID and Forgery Attacks

Theorem 4. The proposed RID-AGKE protocol is secure against ID and forgery attacks.

Proof. Note that we adopt a revocable ID-based signature (RIDS) scheme [16] in Round 1 and a pairing-based signature scheme [6] in Round 2, respectively. The two signature schemes had been proven secure against ID and forgery attacks for single signature and multiple signatures with batch verification. Therefore, the proposed RID-AGKE protocol Ψ is secure against ID and forgery attacks.
Secure RID-AGKE Providing Forward Secrecy. Now, we demonstrate that the proposed RID-AGKE protocol Ψ is a secure RID-AGKE providing forward secrecy. Note that we use a similar technique in [3, 4, 6] to prove Theorem 5.

Theorem 5. Assume that four hash functions 𝐻₁, 𝐻₂, 𝐻₃, and 𝐻₄ are random oracles. Then, the proposed RID-AGKE protocol Ψ is a secure RID-AGKE providing forward secrecy under the decisional bilinear Diffie-Hellman (DBDH) and the computational Diffie-Hellman (CDH) assumptions. Concretely, 𝐴𝑑𝑣^{𝑅𝐼𝐷𝐴𝐺𝐾𝐸-}_Ψ^𝑓𝑠𝑡,𝑞_𝑒𝑥,𝑞_𝑠≤2𝑛𝑞_𝑒𝑥⋅𝐴𝑑𝑣_{𝐷𝐵𝐷𝐻}(𝑡)+𝐴𝑑𝑣_Ψ^{𝑓𝑜𝑟𝑔𝑒}(𝑡), (3) where 𝑞_𝑒𝑥 and 𝑞_𝑠 are total numbers of making Execute and Send queries, respectively. Note that 𝐴𝑑𝑣_Ψ^{𝑓𝑜𝑟𝑔𝑒}(𝑡) denotes the advantage of any forgers successfully attacking the protocol Ψ.

Proof. Assume that 𝐴 is an active adversary in attacking the proposed RID-AGKE protocol Ψ with a nonnegligible advantage. Now, we consider the two possible cases. The first case is that 𝐴 with the advantage can impersonate a participant (i.e., forging authentication transcripts). Another case is that 𝐴 with the advantage can break the protocol Ψ without modifying any transcripts.
Case  1. We assume that the adversary 𝐴 with an adaptive impersonation ability can break the RID-AGKE protocol Ψ. Using 𝐴, we would like to construct a forger 𝐹 which can return valid signature tuples (𝐼𝐷,𝑗,𝑎𝑃,𝑉) and (𝐼𝐷,𝑗,𝐷,𝛼,𝛽,𝛾) with respect to the proposed protocol Ψ as follows. The forger 𝐹 first generates all needed system parameters and keys. Then, 𝐹 simulates the oracle queries made by 𝐴. This simulation is called perfect indistinguishable from 𝐴’s oracle queries except that 𝐴 makes Corrupt query on (𝐼𝐷,𝑗), where 𝑗 is a period index. If it occurs, 𝐹 fails and stops. Otherwise, when 𝐴 generates two signature tuples (𝐼𝐷,𝑗,𝑎𝑃,𝑉) and (𝐼𝐷,𝑗,𝐷,𝛼,𝛽,𝛾), 𝐹 returns the tuples (𝐼𝐷,𝑗,𝑎𝑃,𝑉) and (𝐼𝐷,𝑗,𝐷,𝛼,𝛽,𝛾). Let Forge be the event that the adversary 𝐴 successfully generates two valid signature tuples. Then, the probability that 𝐹 successfully returns two valid signature tuples is bounded by Pr_𝐴[𝐹𝑜𝑟𝑔𝑒]≤𝐴𝑑𝑣^{𝑓𝑜𝑟𝑔𝑒}_𝐹,Ψ(𝑡)≤𝐴𝑑𝑣_Ψ^{𝑓𝑜𝑟𝑔𝑒}(𝑡).
Case  2. We assume that the adversary 𝐴 can break the proposed RID-AGKE protocol without modifying any transcripts. We first focus on the case that 𝐴 makes Execute query once on (𝐼𝐷₁,𝐼𝐷₂,…,𝐼𝐷_𝑛,𝑗) and then extends this to the case that 𝐴 makes multiple Execute queries, where the number of participants 𝑛 and period 𝑗 are selected by 𝐴. The real execution of Ψ is given by𝐺𝑝𝑎𝑟𝑎𝑚=¹,𝐺₂,𝑒⟵PKG;𝑃⟵𝐺₁;𝑠⟵𝑍_𝑞^∗;𝑃_𝑝𝑢𝑏=𝑠⋅𝑃;𝑄𝐼𝐷₁,…,𝑄𝐼𝐷_𝑛,𝑅𝐼𝐷_1,𝑗,…,𝑅𝐼𝐷_𝑛,𝑗⟵𝐺₁;𝐷𝐼𝐷_1,𝑗=𝑄𝐼𝐷₁+𝑅𝐼𝐷_1,𝑗⋅𝑠,…,𝐷𝐼𝐷_𝑛,𝑗=𝑄𝐼𝐷_𝑛+𝑅𝐼𝐷_𝑛,𝑗𝐺⋅𝑠∶₁,𝐺₂,𝑒,𝑃,𝑃_𝑝𝑢𝑏,𝑎,𝑃𝐼𝐷𝑅𝑒𝑎𝑙=¹,…,𝑎_𝑛,ℎ₁,…,ℎ_𝑛,𝑟₁,…,𝑟_𝑛,𝑤₁,…,𝑤_𝑛⟵𝑍_𝑞^∗;𝑃₁=𝑎₁𝑃,…,𝑃_𝑛=𝑎_𝑛𝑃;𝑉₁=𝐷𝐼𝐷_1,𝑗+𝑎₁ℎ₁𝑃_𝑝𝑢𝑏,…,𝑉_𝑛=𝐷𝐼𝐷_𝑛,𝑗+𝑎_𝑛ℎ_𝑛𝑃_𝑝𝑢𝑏;𝐷₁=𝑒(𝑃₂−𝑃_𝑛,𝑃_𝑝𝑢𝑏)^𝑎1,…,𝐷_𝑛=𝑒(𝑃₁−𝑃_𝑛−1,𝑃_𝑝𝑢𝑏)^𝑎𝑛;𝛼₁=𝑟₁𝑃,…,𝛼_𝑛=𝑟_𝑛𝑃;𝛽₁=𝑟₁𝑃₂−𝑃_𝑛,…,𝛽_𝑛=𝑟_𝑛𝑃₁−𝑃_𝑛−1;𝛾₁=𝑟₁𝑃₁+𝑤₁𝑎₁𝑃_𝑝𝑢𝑏,…,𝛾_𝑛=𝑟_𝑛𝑃_𝑛+𝑤_𝑛𝑎_𝑛𝑃_𝑝𝑢𝑏;𝑇=𝑃₁,…,𝑃_𝑛,𝑉₁,…,𝑉_𝑛,𝐷₁,…,𝐷_𝑛,𝛼₁,…,𝛼_𝑛,𝛽₁,…,𝛽_𝑛,𝛾₁,…,𝛾_𝑛;𝑆𝐾_𝑗=𝑒(𝑎₁𝑃_𝑛,𝑃_𝑝𝑢𝑏)^𝑛⋅𝐷₁^𝑛−1⋅𝐷₂^𝑛−2⋯𝐷_𝑛−1∶𝑗,𝑇,𝑆𝐾_𝑗, (4)where 𝑇 denotes the transcript and 𝑆𝐾_𝑗 is the group session key for period 𝑗.
In Real, each 𝐷_𝑖=𝑒(𝑃_𝑖+1−𝑃_𝑖−1,𝑃_𝑝𝑢𝑏)^𝑎𝑖=𝑒(𝑎_𝑖𝑃_𝑖+1,𝑃_𝑝𝑢𝑏)/𝑒(𝑎_𝑖𝑃_𝑖−1,𝑃_𝑝𝑢𝑏)=𝑒(𝑎_𝑖𝑎_𝑖+1𝑃,𝑃_𝑝𝑢𝑏)/𝑒(𝑎_𝑖−1𝑎_𝑖𝑃,𝑃_𝑝𝑢𝑏). by the bilinear pairing operations. We can use a random value 𝑑_1,2∈𝑍_𝑞^∗ to substitute 𝑎₁⋅𝑎₂. Thus, a new distribution 𝐹𝑎𝑘𝑒₁ is obtained as follows:𝐹𝑎𝑘𝑒₁=𝑑_1,2,𝑎₁,…,𝑎_𝑛,ℎ₁,…,ℎ_𝑛,𝑟₁,…,𝑟_𝑛,𝑤₁,…,𝑤_𝑛⟵𝑍_𝑞^∗;𝑃₁=𝑎₁𝑃,…,𝑃_𝑛=𝑎_𝑛𝑉𝑃;₁=𝐷𝐼𝐷_1,𝑗+𝑎₁ℎ₁𝑃_𝑝𝑢𝑏,…,𝑉_𝑛=𝐷𝐼𝐷_𝑛,𝑗+𝑎_𝑛ℎ_𝑛𝑃_𝑝𝑢𝑏;𝐷₁=𝑒𝑑_1,2𝑃,𝑃_𝑝𝑢𝑏𝑒𝑎_𝑛𝑎₁𝑃,𝑃_𝑝𝑢𝑏,𝐷₂=𝑒𝑎₂𝑎₃𝑃,𝑃_𝑝𝑢𝑏𝑒𝑑_1,2𝑃,𝑃_𝑝𝑢𝑏,…,𝐷_𝑛=𝑒𝑎_𝑛𝑎₁𝑃,𝑃_𝑝𝑢𝑏𝑒𝑎_𝑛−1𝑎_𝑛𝑃,𝑃_𝑝𝑢𝑏;𝛼₁=𝑟₁𝑃,…,𝛼_𝑛=𝑟_𝑛𝑃;𝛽₁=𝑟₁𝑃₂−𝑃_𝑛,…,𝛽_𝑛=𝑟_𝑛𝑃₁−𝑃_𝑛−1;𝛾₁=𝑟₁𝑃₁+𝑤₁𝑎₁𝑃_𝑝𝑢𝑏,…,𝛾_𝑛=𝑟_𝑛𝑃_𝑛+𝑤_𝑛𝑎_𝑛𝑃_𝑝𝑢𝑏;𝑇=𝑃₁,…,𝑃_𝑛,𝑉₁,…,𝑉_𝑛,𝐷₁,…,𝐷_𝑛,𝛼₁,…,𝛼_𝑛,𝛽₁,…,𝛽_𝑛,𝛾₁,…,𝛾_𝑛;𝑆𝐾_𝑗=𝑒(𝑎₁𝑃_𝑛,𝑃_𝑝𝑢𝑏)^𝑛⋅𝐷₁^𝑛−1⋅𝐷₂^𝑛−2⋯𝐷_𝑛−1∶𝑗,𝑇,𝑆𝐾_𝑗. (5)
Note that 𝐴 can obtain all private keys 𝐷𝐼𝐷_𝑖,𝑗 and hash values ℎ_𝑖 by making Corrupt and Hash queries. It means that 𝐴 can compute all 𝑎_𝑖⋅𝑃_𝑝𝑢𝑏=ℎ_𝑖⁻¹⋅(𝑉_𝑖−𝐷𝐼𝐷_𝑖,𝑗) for 𝑖=1,2,…,𝑛. Since the discrete logarithm assumption in 𝐺₁ is intractable, 𝐴 cannot obtain some information about 𝑎_𝑖 from 𝑎_𝑖⋅𝑃_𝑝𝑢𝑏 for 𝑖=1,2,…,𝑛.
In the following claim, we want to show that to distinguish two distributions Real from 𝐹𝑎𝑘𝑒₁ can be reduced to solve the decisional bilinear Diffie-Hellman (DBDH) problem. Let 𝜀(𝑡)=𝐴𝑑𝑣_{𝐷𝐵𝐷𝐻}(𝑡).
Claim. For any algorithm 𝐴 with running time 𝑡, we have Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝑅𝑒𝑎𝑙𝐴𝑗,𝑇,𝑆𝐾_𝑗=1−Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝐹𝑎𝑘𝑒₁𝐴𝑗,𝑇,𝑆𝐾_𝑗(𝑡).=1≤𝜀 (6)
Proof. As mentioned above, each 𝐷_𝑖=𝑒(𝑎_𝑖𝑎_𝑖+1𝑃,𝑃_𝑝𝑢𝑏)/𝑒(𝑎_𝑖−1𝑎_𝑖𝑃,𝑃_𝑝𝑢𝑏)=𝑒(𝑃,𝑃_𝑝𝑢𝑏)^{𝑎𝑖𝑎𝑖+1}𝑒(𝑃,𝑃_𝑝𝑢𝑏)^{𝑎𝑖−1𝑎𝑖}. Here, we use Γ_𝑖,𝑖+1 to substitute 𝑒(𝑃,𝑃_𝑝𝑢𝑏)^{𝑎𝑖𝑎𝑖+1} and then each 𝐷_𝑖 can be written into Γ_𝑖,𝑖+1/Γ_{𝑖−1,𝑖} for 𝑖=1,2,…,𝑛. Hence, the group session key 𝑆𝐾_𝑗 also can be written into (Γ_𝑛,1)^𝑛⋅𝐷₁^𝑛−1⋅𝐷₂^𝑛−2⋯𝐷_𝑛−1, where (Γ_𝑛,1)^𝑛=𝑒(𝑃,𝑃_𝑝𝑢𝑏)^{𝑛𝑎𝑛𝑎1}=𝑒(𝑎₁𝑃_𝑛,𝑃_𝑝𝑢𝑏)^𝑛.
To solve the DBDH problem, we use a technique to dispose the related parameter. Considering the following algorithm 𝐷 which inputs 𝑃_𝑎=𝑎𝑃,𝑃_𝑏=𝑏𝑃, and 𝑃_𝑐=𝑐𝑃∈𝐺₁ for some 𝑎,𝑏,𝑐∈_𝑅𝑍_𝑞^∗. 𝐷 first generates (𝑗,𝑇,𝑆𝐾_𝑗) according to the distribution 𝐷𝑖𝑠𝑡¹. Then, 𝐷 runs 𝐴(𝑗,𝑇,𝑆𝐾_𝑗) and outputs whatever 𝐴 outputs. The distribution 𝐷𝑖𝑠𝑡¹ is defined as follows:𝐷𝑖𝑠𝑡¹=𝑎₁,…,𝑎_𝑛,ℎ₁,…,ℎ_𝑛,𝑢₁,…,𝑢_𝑛−2,𝑟₁,…,𝑟_𝑛,𝑤₁,…,𝑤_𝑛⟵𝑍_𝑞^∗;𝑃₁=𝑎₁𝑃,…,𝑃_𝑛=𝑎_𝑛𝑃;𝑉₁=𝐷𝐼𝐷_1,𝑗+𝑎₁ℎ₁𝑃_𝑝𝑢𝑏,…,𝑉_𝑛=𝐷𝐼𝐷_𝑛,𝑗+𝑎_𝑛ℎ_𝑛𝑃_𝑝𝑢𝑏;Γ_1,2=𝑔_𝑠𝑎𝑏∈𝐺₂,Γ_2,3=𝑒𝑃_𝑏,𝑃_𝑝𝑢𝑏^𝑢1,Γ_𝑖,𝑖+1=𝑒𝑃,𝑃_𝑝𝑢𝑏^{𝑢𝑖−2𝑢𝑖−1}Γfor𝑖=3to𝑛−1_𝑛,1=𝑒(𝑃_𝑎,𝑃_𝑝𝑢𝑏)^𝑢𝑛−2;𝐷₁=Γ_1,2Γ_𝑛,1,…,𝐷_𝑛=Γ_𝑛,1Γ_{𝑛−1,𝑛};𝛼₁=𝑟₁𝑃,…,𝛼_𝑛=𝑟_𝑛𝑃;𝛽₁=𝑟₁𝑃₂−𝑃_𝑛,…,𝛽_𝑛=𝑟_𝑛𝑃₁−𝑃_𝑛−1;𝛾₁=𝑟₁𝑃₁+𝑤₁𝑎₁𝑃_𝑝𝑢𝑏,…,𝛾_𝑛=𝑟_𝑛𝑃_𝑛+𝑤_𝑛𝑎_𝑛𝑃_𝑝𝑢𝑏;𝑇=𝑃₁,…,𝑃_𝑛,𝑉₁,…,𝑉_𝑛,𝐷₁,…,𝐷_𝑛,𝛼₁,…,𝛼_𝑛,𝛽₁,…,𝛽_𝑛,𝛾₁,…,𝛾_𝑛;𝑆𝐾_𝑗=(Γ_𝑛,1)^𝑛⋅𝐷₁^𝑛−1⋅𝐷₂^𝑛−2⋯𝐷_𝑛−1∶𝑗,𝑇,𝑆𝐾_𝑗. (7)Note that this distribution depends on 𝑃_𝑎, 𝑃_𝑏, and 𝑃_𝑐.
By the above distribution 𝐷𝑖𝑠𝑡¹, let Γ_1,2=𝑒(𝑃,𝑃_𝑝𝑢𝑏)^𝑎𝑏=𝑒(𝑃,𝑃)^𝑠𝑎𝑏. Then, we can obtain another distribution called 𝐷𝑖𝑠𝑡¹_{𝐷𝐵𝐷𝐻}. Obviously, 𝐷𝑖𝑠𝑡¹_{𝐷𝐵𝐷𝐻} is identical to Real because 𝑆𝐾_𝑗=Γ_𝑛,1Γ_1,2Γ_2,3⋯Γ_{𝑛−2,𝑛−1}Γ_{𝑛−1,𝑛}=𝑒(𝑃_𝑎,𝑃_𝑝𝑢𝑏)^𝑢𝑛−2⋅𝑒(𝑃,𝑃)^𝑠𝑎𝑏⋅𝑒𝑃_𝑏,𝑃_𝑝𝑢𝑏^𝑢1⋯𝑒𝑃,𝑃_𝑝𝑢𝑏^{𝑢𝑛−4𝑢𝑛−3}⋅𝑒(𝑃,𝑃_𝑝𝑢𝑏)^{𝑢𝑛−3𝑢𝑛−2}=𝑒(𝑃,𝑃)^{𝑠𝑢𝑛−2𝑎+𝑠𝑎𝑏+𝑠𝑏𝑢1+⋯+𝑠𝑢𝑛−4𝑢𝑛−3+𝑠𝑢𝑛−3𝑢𝑛−2}. (8)
Similarly, let Γ_1,2=𝑒(𝑃_𝑐,𝑃_𝑝𝑢𝑏)=𝑒(𝑃,𝑃)^𝑠𝑐 for some 𝑐≠𝑎𝑏∈𝑍_𝑞^∗. Then, we can obtain another distribution called 𝐷𝑖𝑠𝑡¹_{𝑅𝑎𝑛𝑑𝑜𝑚}. Obviously, 𝐷𝑖𝑠𝑡¹_{𝑅𝑎𝑛𝑑𝑜𝑚} is identical to 𝐹𝑎𝑘𝑒₁ because 𝑆𝐾_𝑗=Γ_𝑛,1Γ_1,2Γ_2,3⋯Γ_{𝑛−2,𝑛−1}Γ_{𝑛−1,𝑛}=𝑒(𝑃_𝑎,𝑃_𝑝𝑢𝑏)^𝑢𝑛−2⋅𝑒(𝑃,𝑃)^𝑠𝑐⋅𝑒𝑃_𝑏,𝑃_𝑝𝑢𝑏^𝑢1⋯𝑒𝑃,𝑃_𝑝𝑢𝑏^{𝑢𝑛−4𝑢𝑛−3}⋅𝑒(𝑃,𝑃_𝑝𝑢𝑏)^{𝑢𝑛−3𝑢𝑛−2}=𝑒(𝑃,𝑃)^{𝑠𝑢𝑛−2𝑎+𝑠𝑐+𝑠𝑏𝑢1+⋯+𝑠𝑢𝑛−4𝑢𝑛−3+𝑠𝑢𝑛−3𝑢𝑛−2}. (9) Therefore, we have Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝑅𝑒𝑎𝑙𝐴𝑗,𝑇,𝑆𝐾_𝑗=1−Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝐹𝑎𝑘𝑒₁𝐴𝑗,𝑇,𝑆𝐾_𝑗(𝑡).=1≤𝜀 (10)
This completes the proof of claim.
Using the same process in 𝐹𝑎𝑘𝑒₁, we can define other distributions 𝐹𝑎𝑘𝑒_𝑖 for 𝑖=2,3,…,𝑛. By a similar approach in claim, we can obtain the following n-1 equations in (11) for any adversary 𝐴 with running time 𝑡Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝐹𝑎𝑘𝑒₁𝐴𝑗,𝑇,𝑆𝐾_𝑗=1−Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝐹𝑎𝑘𝑒₂𝐴𝑗,𝑇,𝑆𝐾_𝑗(𝑡),⋮=1≤𝜀Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝐹𝑎𝑘𝑒_𝑛−1𝐴𝑗,𝑇,𝑆𝐾_𝑗=1−Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝐹𝑎𝑘𝑒_𝑛𝐴𝑗,𝑇,𝑆𝐾_𝑗(𝑡).=1≤𝜀 (11) This implies Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝑅𝑒𝑎𝑙𝐴𝑗,𝑇,𝑆𝐾_𝑗=1−Pr𝑗,𝑇,𝑆𝐾_𝑗⟵𝐹𝑎𝑘𝑒_𝑛𝐴𝑗,𝑇,𝑆𝐾_𝑗(𝑡).=1≤𝑛⋅𝜀 (12)
In 𝐹𝑎𝑘𝑒_𝑛, the values 𝑑_1,2,𝑑_2,3,…,𝑑_{𝑛−1,𝑛},𝑑_𝑛,1 are constrained by 𝑇 according to the following 𝑛 equations: log_𝑔𝐷₁=𝑠⋅𝑑_1,2−𝑑_𝑛,1,log_𝑔𝐷₂=𝑠⋅𝑑_2,3−𝑑_1,2,…,log_𝑔𝐷_𝑛=𝑠⋅𝑑_𝑛,1−𝑑_{𝑛−1,𝑛}, (13) where 𝑔=𝑒(𝑃,𝑃). Since 𝑆𝐾_𝑗 can be expressed as 𝑒(𝑃,𝑃)^{𝑠𝑑1,2+𝑠𝑑2,3+⋯+𝑠𝑑𝑛,1}, we can obtain log_𝑔𝑆𝐾_𝑗=𝑠𝑑_1,2+𝑠𝑑_2,3+⋯+𝑠𝑑_𝑛,1. Because 𝑠𝑑_1,2+𝑠𝑑_2,3+⋯+𝑠𝑑_𝑛,1 is linear and independent from the set {log_𝑔𝐷_𝑖=𝑠⋅(𝑑_𝑖,𝑖+1−𝑑_{𝑖−1,𝑖})∣𝑖=1,2,…,𝑛}, it implies that 𝑆𝐾_𝑗 is independent for the transcript 𝑇. In other words, for any adversary 𝐴Pr𝑗,𝑇,𝑆𝐾_𝑗,0⟵𝐹𝑎𝑘𝑒_𝑛,𝑆𝐾_𝑗,1⟵𝐺₂∣𝐴𝑗,𝑇,𝑆𝐾_𝑗,𝑏{=1=1,𝑏⟵0,1}2. (14) Therefore, the advantage of 𝐴 on the event ¬𝐹𝑜𝑟𝑔𝑒 is bounded by 2𝑛⋅𝐴𝑑𝑣_{𝐷𝐵𝐷𝐻}(𝑡). Combining the two cases, the advantage of 𝐴 is bounded by 𝐴𝑑𝑣^{𝑅𝐼𝐷𝐴𝐺𝐾𝐸-}_Ψ^𝑓𝑠𝑡,1,𝑞_𝑠≤2𝑛⋅𝐴𝑑𝑣_{𝐷𝐵𝐷𝐻}(𝑡)+𝐴𝑑𝑣_Ψ^{𝑓𝑜𝑟𝑔𝑒}(𝑡). (15) Finally, a standard hybrid argument immediately demonstrates that 𝐴𝑑𝑣^{𝑅𝐼𝐷𝐴𝐺𝐾𝐸-}_Ψ^𝑓𝑠𝑡,𝑞_𝑒𝑥,𝑞_𝑠≤2𝑛𝑞_𝑒𝑥⋅𝐴𝑑𝑣_{𝐷𝐵𝐷𝐻}(𝑡)+𝐴𝑑𝑣_Ψ^{𝑓𝑜𝑟𝑔𝑒}(𝑡)for𝑞_𝑒𝑥>1. (16)

Under the decisional bilinear Diffie-Hellman (DBDH) assumption, the advantage 𝐴𝑑𝑣_{𝐷𝐵𝐷𝐻}(𝑡) is negligible. By Theorem 4, the advantage 𝐴𝑑𝑣_Ψ^{𝑓𝑜𝑟𝑔𝑒}(𝑡) is also negligible. Hence, we can obtain that the advantage 𝐴𝑑𝑣^{𝑅𝐼𝐷𝐴𝐺𝐾𝐸-}_Ψ^𝑓𝑠(𝑡,𝑞_𝑒𝑥,𝑞_𝑠) is negligible according to the result in Theorem 5. It implies that the proposed RID-AGKE protocol Ψ is a secure RID-AGKE providing forward secrecy.

Identifying Malicious Participant

Theorem 6. The proposed RID-AGKE protocol can identify malicious participants.

Proof. Note that in Round 2 a noninteractive confirmed computation technique is involved in adopted pairing-based signature scheme. The security of confirmed computation had been proven in [6]. Concretely, each participant 𝑈_𝑖 can confirm the broadcasted value 𝐷_𝑘 is computed by 𝑈_𝑘 using her/his secret 𝑎_𝑘 after passing two verifying equations for 𝑘=1,2,…,𝑛 except 𝑖. Hence, if there is a participant 𝑈_𝑚 who broadcasts a wrong 𝐷_𝑚 to disturb the group session key establishing, he will be identified as a malicious participant. In other words, the proposed RID-AGKE protocol can identify malicious participants by using the confirmed computation technique.

6. Performance Analysis and Comparisons

For convenience to evaluate the computational cost, we focus on the time-consuming pairing-based operations as follows:(i)𝑇𝐺_𝑒: the time of executing a bilinear map operation 𝑒∶𝐺₁×𝐺₁→𝐺₂;(ii)𝑇𝐺_𝑚𝑢𝑙: the time of executing a point scalar multiplication operation in 𝐺₁;(iii)𝑇𝐺_𝐻: the time of executing a map-to-point hash function 𝐻₁,𝐻₂∶{0,1}^∗→𝐺₁;(iv)𝑇_𝑒𝑥𝑝: the time of executing a modular exponentiation operation over a finite field 𝐹_𝑝, where 𝑝 is a large prime number;(v)𝑇_𝑖𝑛𝑣: the time of executing a modular multiplicative inverse operation over a finite field 𝐹_𝑝, where 𝑝 is a large prime number.

Here, we first analyze the computational cost of our protocol. In Round 1, 2𝑇𝐺_𝑚𝑢𝑙 is required to compute (𝑃_𝑖,𝑉_𝑖). In Round 2, each participant requires 3𝑇𝐺_𝑒+7𝑇𝐺_𝑚𝑢𝑙+4𝑇𝐺_𝐻 to verify (𝐼𝐷_𝑖+𝑘,𝑗,𝑃_𝑖+𝑘,𝑉_𝑖+𝑘) for 𝑘∈{−1,1} and to generate (𝐷_𝑖,𝛼_𝑖,𝛽_𝑖,𝛾_𝑖). In the group key computation phase, (3𝑛−1)𝑇𝐺_𝑒+𝑛𝑇𝐺_𝑚𝑢𝑙+(𝑛−1)𝑇_𝑒𝑥𝑝 is required to verify all (𝐼𝐷_𝑖,𝑗,𝐷_𝑖,𝛼_𝑖,𝛽_𝑖,𝛾_𝑖) and to compute a group key 𝑆𝐾_𝑗. Note that to evaluate 𝑆𝐾_𝑗=𝑒(𝑎_𝑖⋅𝑃_𝑖−1,𝑃_𝑝𝑢𝑏)^𝑛⋅𝐷_𝑖^𝑛−1⋅𝐷^𝑛−2_𝑖+1⋅⋅⋅𝐷_𝑖−2 is required 𝑇𝐺_𝑒+𝑇𝐺_𝑚𝑢𝑙 since 𝑆𝐾_𝑗=𝐴_𝑖−1⋅𝐴_𝑖⋅𝐴_𝑖+1⋯𝐴_𝑖−2, where 𝐴_𝑖−1=𝑒(𝑎_𝑖⋅𝑃_𝑖−1,𝑃_𝑝𝑢𝑏), 𝐴_𝑖=𝐴_𝑖−1⋅𝐷_𝑖, 𝐴_𝑖+1=𝐴_𝑖⋅𝐷_𝑖+1,…, and 𝐴_𝑖−2=𝐴_𝑖−3⋅𝐷_𝑖−2. As a result, each participant requires (3𝑛+2)𝑇𝐺_𝑒+(𝑛+9)𝑇𝐺_𝑚𝑢𝑙+4𝑇𝐺_𝐻+(𝑛−1)𝑇_𝑒𝑥𝑝 in our protocol.

In Table 1, we compare our RID-AGKE protocol with four previously proposed AGKE protocols which include Tseng’s AGKE protocol [25], Choi et al.’s ID-AGKE protocol [26], Wu et al.’s ID-AGKE protocol [6], and Wu et al.’s RID-AGKE protocol [4] in terms of the public key setting, number of rounds, computational cost, and security properties. One recent non-ID-based and non-RID-based AGKE protocol with identifying malicious participants was proposed by Tseng [25]. Since Tseng’s protocol is based on the ElGmal system [29], each participant must verify the other participants’ certificates for participant authentication. It will increase the required computational costs for verifying certificates, besides (8𝑛−2)𝑇_𝑒𝑥𝑝+(𝑛+1)𝑇_𝑖𝑛𝑣. On the contrary, Choi et al.’s ID-AGKE [26], Wu et al.’s ID-AGKE [6], Wu et al.’s RID-AGKE [4], and our protocol rely on the IDPKS system [8] or the R-IDPKS system [14]. Thus, they need not manage and verify the participants’ certificates. However, Choi et al.’s ID-AGKE [26] suffered from an insider colluding attack demonstrated by Wu and Tseng [27].

Table 1 

Comparisons between our protocol and the previously proposed AGKE protocols.

For Wu et al.’s ID-AGKE [6], Wu et al.’s RID-AGKE [4], and our protocol, they are provably secure and are able to resist malicious participants. It is easy to see that our protocol is more efficient than Wu et al.’s ID-AGKE [6] even though both protocols can identify malicious participants via confirmed computation approach. More importantly, Wu et al.’s ID-AGKE protocol [6] does not provide a solution to revoke the compromised or misbehaving user in the group. It is very serious because these revoked participants should not be allowed to establish a common key with other legal (nonrevoked) participants. In another aspect, Wu et al.’s RID-AGKE [4] is a three-round protocol and adopts explicit key confirmation approach to resist malicious participants. Though their protocol can detect the existence of malicious participants, it cannot still identify malicious participant. Our proposed RID-AGKE is a two-round protocol and provides an active detection mechanism to identify malicious participants. According to Table 1, the advantage of our protocol is demonstrated.

7. Conclusions

In this paper, we have fused the Tseng-Tsai R-IDPKS system and a noninteractive confirmed computation technique to propose the first RID-AGKE protocol with identifying malicious participants. The framework and security notions for RID-AGKE protocols have been defined to formalize the possible threats and attacks. When compared with the recently proposed ID/RID-AGKE protocols resistant to malicious participants, our protocol has better performance and provides an active detection way to identify malicious participants. In the random oracle model and under two mathematical assumptions (CDH and DBDH), we have proven that the proposed protocol is a secure RID-AGKE protocol with forward secrecy and identifying malicious participants.

Notations

𝑒:	A bilinear map, 𝑒∶𝐺1×𝐺1→𝐺2, defined in Section 2.1
𝑠:	The system private key, 𝑠∈𝑍𝑞∗
𝑃:	A generator of group 𝐺1
𝑃𝑝𝑢𝑏:	The system public key, 𝑃𝑝𝑢𝑏=𝑠⋅𝑃
𝐼𝐷𝑖:	The identity of participant 𝑈𝑖
𝐷𝐼𝐷𝑖:	The participant 𝑈𝑖’s initial private key
𝑇𝐼𝐷𝑖,𝑗:	The participant 𝑈𝑖’s update key for period 𝑗
𝐷𝐼𝐷𝑖,𝑗:	The participant 𝑈𝑖’s private key for period 𝑗, 𝐷𝐼𝐷𝑖,𝑗=𝐷𝐼𝐷𝑖+𝑇𝐼𝐷𝑖,𝑗
𝐻1:	A map-to-point hash function, 𝐻1∶{0,1}∗→𝐺1
𝐻2:	A map-to-point hash function, 𝐻2∶{0,1}∗→𝐺1
𝐻3:	A hash function, 𝐻3∶{0,1}∗×𝐺1→𝑍𝑞
𝐻4:	A hash function, 𝐻4∶{0,1}∗×𝐺31→𝑍𝑞.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

The authors thank the referees for their valuable comments and constructive suggestions. This research was partially supported by Shenzhen Peacock Project of China (no. KQC201109020055A) and Shenzhen Strategic Emerging Industries Program of China (no. ZDSY20120613125016389).