Abstract

Fog computing extends the cloud computing to the network edge and allows deploying a new type of semioffline services, which can provide real-time transactions between two entities, while the central cloud server is offline and network edge devices are online. For an e-payment system and e-voting with such feature, proxy blind signature is a cornerstone to protect users’ privacy. However, the signature based on number theorem, such as hard mathematical problems on factoring problem, discrete logarithm problem, and bilinear pairings, cannot defeat quantum computers attack. Meanwhile, these schemes need to depend on complex public key infrastructure. Thus, we construct an identity-based proxy blind signature scheme based on number theorem research unit lattice, which can defeat quantum computers attack and does not need to depend on public key infrastructure. The security of the proposed scheme is dependent on Ring-Small Integer Solution problem over number theorem research unit lattice. The proposed scheme meets the properties of blind signature and proxy signature. Then we compare the proposed scheme with other existing proxy blind signature schemes; the result shows that the proposed scheme outperforms ZM scheme except in proxy signer’s signature size and can be more secure than TA scheme and MMHP scheme.

1. Introduction

Fog computing was initially introduced by Cisco, which can overcome cloud computing’s disadvantages, such as non-real-time service and long delay [13]. More specifically, fog computing adds a new layer between cloud server and terminal user [4, 5]; that is, fog servers can be access point, base station, router, or mobile equipment [69]. Thus, the semioffline e-payment system can be deployed by utilizing the advantages of fog computing model [10, 11].

In order to defend user’s privacy in offline e-payment system, blind signature (BS) is crucial for that it never permits signer to sign on a plaintext before knowing its content [12]. Therefore, BS can protect user privacy during the transactions [13] instead of encrypting the data and searching on the ciphertext [14]. However, this system is deployed in real environment; it will use distributed architecture [15]. The original signer should authorize an agent to sign for himself. Then a proxy signature (PS) should be used in e-payment system, since proxy signer can satisfy this requirement [16]. Combining those two types of schemes together, a new proxy blind signature (PBS) was proposed, which meets the properties of those two signature schemes. After that, many PBS schemes were constructed by scholars.

However, most of the PBS schemes are based on number theory, such as discrete logarithm problem (DLP) and bilinear pairings. These schemes are considered to be insecure to resist the quantum computer attack. Therefore, the e-payment and e-voting systems in the cloud still face the threat from quantum computer attack [17]. Meanwhile, these schemes need to rely on complex public key infrastructure (PKI) [18, 19]. In conclusion, these schemes based on number theorem cannot defeat the quantum computers attack according to the recent research results.

Therefore, the lattice-based PBS schemes become one alternative solution, since they are sufficient enough and able to resist quantum computer attack [20, 21]. Besides, if lattice-based PBS schemes can combine with identity-based cryptography (called IDPBS), they can overcome the shortcomings of traditional PBS schemes, such as relying on complex PKI [22]. Meanwhile, they can transfer less data than biological recognition methods during the transactions [23, 24].

Zhu et al. presented a new lattice-based BS [20], which can be secure enough for cloud services. However, this scheme has to be combined with proxy signature in practice. Combining BS scheme and IDPS scheme, we initially present an IDPBS on number theorem research unit lattice (IDPBS-NTRU), which can defeat quantum computer attack.

(1) Inspired by [25], a new IDPBS-NTRU scheme is proposed based on NTRU lattice, which can make semioffline e-payment and e-voting systems deployed in fog computing model secure enough to resist quantum computer attack.

(2) The proposed IDPBS-NTRU scheme is proven to be secure. That is, the proposed scheme is correct, blind, unforgeable, verifiable, strong identifiable, strong undeniable, and key-dependent.

(3) The proposed IDPBS-NTRU is compared with the existing IDPBS schemes in terms of performances. The result shows that it outperforms the ZM scheme except in proxy signer’s signing key size, and it is more secure than TA and MMHP schemes.

The paper is introduced as follows. Section 2 introduces the background knowledge about NTRU lattice and main key technology. Section 3 introduces the security model for IDPBS. Section 4 shows that the proposed IDPBS is proven to be secure and it is compared with other IDPBS schemes in terms of performances. At last, Section 5 draws the conclusions.

IDPBS Schemes Based on DLP. In 2011, Beura et al. proposed a new proxy blind signature based on DLP; their scheme satisfies the properties of blind signature and proxy signature. This scheme is more secure and efficient than factoring signature schemes [26]. To improve the efficiency, Tan et al. introduced a couple of PBS schemes; both of them were constructed on Schnorr blind signature. However, Sun et al. pointed that both of them were not unforgeable and unlinkable [27]. However, in 2014, Wang and Liao proved that the schemes proposed by Oo et al. and Beura et al. did not satisfy unlinkability [28]. In 2013, Tan proposed a PBS based on DLP, which did not depend on PKI [29] and was proven to be secure in the random oracle [30]. However, most of these schemes are dependent on PKI and are not strictly proven to be secure.

IDPBS Schemes Based on Bilinear Pairings. In 2003, Zhang et al. proposed a new proxy blind signature based on bilinear pairings, which satisfies distinguishability, verifiability, strong nonforgeability, strong identifiability, strong nondeniability, and prevention of misuse. Meanwhile, this scheme did not depend on public key infrastructure (PKI) [31]. Later, Li et al. introduced a new PBS, which was also constructed on bilinear pairings; it was independent of PKI [32]. However, these schemes are inefficient and are not proven to be secure.

IDPBS Schemes Based on Lattice. In 2014, Zhang and Ma initially proposed a proxy blind signature on lattice; it does not need to depend on PKI; its security is based on short integer solution problem. However, this scheme is still inefficient. [33].

3. Preliminaries

In the beginning, we will define the denotations that will be used all over the paper in Denotations.

3.1. NTRU Lattice and Rejection Sampling on Lattice

Definition 1 (NTRU lattice). The notations are defined as , and mod ; after that, the NTRU lattice can be defined as . That is, is on behalf of a full-rank lattice whose basis is , denotes a unit matrix, denotes a null matrix, and denotes an anticirculant matrix .

Definition 2 (- on NTRU lattice). Small and  can be sampled from (); then and can be obtained by using Algorithm   in [25]. Therefore, R-SIS on NTRU means finding satisfying mod and .

Theorem 3 (rejection sampling theorem). denotes one subset of , the norms of ’s elements are less than constant , , (M is invariable), and is a probability distribution. Two algorithms are as follows: One isThe other isThen the distribution of first algorithm will not exceed the second one’s statistical distance . Moreover, The first one will export something with probability at least .

3.2. The Definitions of IDPBS Scheme

An IDPBS consists of seven algorithms [12, 36, 37]. TTP will execute to produce public parameters and keys [29, 38, 39]. The formal definition is presented as follows (Algorithm 1):(i) outputs and .(ii) outputs for and ( or ).(iii) outputs for .(iv)Proxy blind signature: interacts with according to the following protocol:(1): blinds to by using and then sends to .(2): signs on using and sends the signature to .(3): unblinds by using and outputs the blind signature .(v): if are valid, the algorithm outputs true. Otherwise it outputs false.

,
proxy signer
Blind (user):
Proxy Signature (proxy signer):
Unblind (user):
Proxy Verify:

An IDPBS scheme should meet the following six properties. The details can be seen in [20, 33, 4042].

(1) Blindness. are denoted as an adversary who can control the proxy signer. chooses two messages and . Then a random bit is chosen in the game. and are randomly denoted as and . These two messages are, respectively, used as two user’s inputs. After that, will adaptively and parallelly interact with two honest users according to the signature protocol. Finally, two users output and respectively. Then and ordered by and are delivered to ; after that, will output .

(2) One More Unforgeability. can generate a legal proxy instead of . However, and all the other entities fail to generate a legal signature. The game is presented as follows [33]: , the advantage of , is denoted as success probability in Algorithm 3. If no adversary can win Algorithm 3 at minimum with negligible probability in time , then it satisfies one more unforgeability [31].

(3) Verifiability. can check whether is delegated by .

(4) Strong Identifiability. Any can determine ’s identity once he receives the proxy signature tuple.

(5) Strong Undeniability. cannot refuse to admit it once he creates the proxy signature .

(6) Key Dependence. can sign on a message if and only if he has the authorization from .

4. Proposed IDPBS-NTRU Scheme

Here, we introduce a novel IDPBS-NTRU , which can be seen in Algorithm 4. The details are as follows.

(1) . , , and . If . If . can be obtained as below [25].

The algorithm takes samples and from . Here, , , , and . After that, the algorithm can get according to the equation . Given and , can be obtained from according to Babai algorithm [43]. Then there exists . If , then the algorithm outputs system parameters ; the master private-key  msk and master public-key are as follows:

(2) , msk. The algorithm executes (4) to get an -dimension matrix ; then the algorithm executes (6) and outputs according to corresponding [25].

(3) . is denoted as a warrant. will execute this algorithm to generate a valid delegation.(i)The algorithm chooses at random.(ii)The algorithm executes (6) to get an -dimension matrix .(iii)The algorithm executes (7) and (8) to generate valid delegations and . Here, the algorithm uses the rejection sampling theorem to keep the delegation independent on ’s secret keys and .(iv) sends to .

(4) . is a plaintext. will execute this algorithm to generate a blind message, which needs to be signed by .(i)The algorithm will randomly select .(ii)The algorithm executes (9) to get an -dimension .(iii)The algorithm executes (10) to blind .(iv) sends to a proxy signer .

(5) . The proxy signer will execute this algorithm to sign on the blinded message.(i)The algorithm validates whether (11) and (12) are true. If either is false, aborts the algorithm. Otherwise, it continues.(ii)The algorithm will execute (13) and (14). Here, the rejection sample theory is used to keep the proxy signatures and independent on ’s secret keys and .(iii)The algorithm outputs the tuple .

(6) . will execute the algorithm to unblind the proxy signature.(i)The algorithm executes (15) to unblind the proxy signature tuple.(ii) outputs the signature tuple .

(7) . will execute this algorithm to validate whether the signature tuple satisfies (16). If all the equations mentioned above are true, the signatures are valid. Otherwise, they are invalid.

5. Security and Performance Comparison

5.1. Security

(1)

Theorem 4 (correctness). The IDPBS-NTRU scheme is correct.

Proof. According to the construction of our IDPBS scheme, we can getTherefore, .Thus, .

(2)

Theorem 5 (blindness). The IDPBS-NTRU scheme satisfies blindness.

Proof. As shown in Algorithm 2, A random bit which is kept secret from . Then chooses two messages and . and are randomly denoted as and . and are the inputs of two honest users, respectively. adaptively and parallelly interacts with two honest users, respectively. Finally, these two honest users output and , respectively. The sequence and ordered by and will be sent to . will output a bit .
In the process of signature protocol, all intermediate results do not depend on ; thus it is enough to analyze , , , , , , , , and .
To , the statistical distance is presented as follows:

,
, are respectively ’s output
if   and   then
else
end if
return true iff
,
is the successful interaction number between and
return true iff
for and
and
proxy signer
Blind (user ):
Proxy Signature (proxy signer ):
Unblind (user ):
if
output true, otherwise false

Since is chosen at random, next we obtain the equations and . Therefore, we obtain .

In the same way, we can obtain , , , , , , , and . Therefore, cannot distinguish among , , , , , , , , and ; that is, can win this experiment with probability 1/2. Thus, the theorem is proven.

We denote , , , , , and as the cost functions of , , hash oracle, extract Oracle, DG oracle, and signature oracle, respectively, as a nonnegligible probability, as a polynomial time algorithm, and as a polynomial time forger.

(3)

Theorem 6 (one more unforgeability). If   is able to generate a legal IDPBS signature with in successfully, after at most times queries, respectively, to hash, extract, DG, and blind signature oracles, then R- can be solved by with probability at least in time .

Proof. We suppose that is able to generate an IDPBS signature successfully with ; we are able to construct to calculate ’s solution. The interaction environment can be simulated as follows.
Setup. selects and , , and at random. Next calculates and delivers to .
Queries on Oracle. To reply to oracle’s query, creates one null list . Once obtains one , will query . If there is a consistent with the query, will return . Otherwise, will select a random . At last, will return to and save to .
Queries on Oracle. To reply to ’s queries, creates a list ; is initialized null. When receives an , will query . If there is one corresponding value , will return . Else will choose one at random. Finally, will return to and save to .
Oracle Queries. When queries a private key related to one , will recover the corresponding from . Next will run ; will return to and save the tuple to .
Oracle Queries. When requests the delegation queries, will verify whether has been queried for or oracle. If it has been queried, will obtain from . Else will simulate oracle and get a new private key. Next will execute and to get a legal delegation signature and save to .
Signature Oracle Queries. queries the signing oracle for , , , , , and . will verify whether has been queried for or oracle. If it has been queried, will obtain from . Else will simulate the oracle and get a new private key. Next will execute queries and then obtain from . Then will execute and to get a valid signature and save to .
Output. At last, will output one forged signature on , , , and for the first time. will rewind to the point where and are queried for ; next will get a valid tuple once again.
Thus, are able to solve - problem. will compute , , and . Next will verify whether . If , we can obtain . After that, is a solution to -. Similarly, we can obtain that is a solution to -.
After that, we begin to analyze ’s advantages. As mentioned above, will win this game if has already forged a valid and and . The simulation of the oracle fails if causes inconformity. Then is able to solve - with probability at minimum [25]; here, ; it is clear that . Therefore, we can prove the theorem.
(4) Verifiability. Once receiving , will execute to check whether and are true. If both are true, the proxy signer is delegated by to sign on .
(5) Strong Identifiability. After receiving , can confirm ’s identity in accordance with ; thus the IDPBS-NTRU scheme satisfies strong identifiability.
(6) Strong Undeniability. and are signed by using ’s secret keys and ; they will only be known by ; thus cannot refuse his signature once he signed; thus the IDPBS-NTRU scheme satisfies strong undeniability.
(7) Key Dependence. and on warrant are signed by ’s secret keys and ; they are only known by ,;   has no legal right to sign on a message before he is authorized by ; thus the IDPBS-NTRU scheme satisfies key dependence.

5.2. Performance

In this section, we compare the performance of IDPBS-NTRU with other IDPBS schemes. is written as security parameter, we denote ’s signature size and signing-key size as OSS and OSK, respectively. ’s signature size and signing key size are denoted as PSS and PSK, respectively. In ZM scheme [33], the parameters satisfy and . In TA [34] and MMHP [35] schemes, the security parameter is equal to .

In Table 1, we compute the signature size and signing key size for and . It is clear to draw a conclusion that our proxy signer’s OSS, OSK, and PSK are smaller than ZM, TA, and MMHP schemes, our PSS is larger than ZM scheme, our PSS is smaller than TA scheme and MMHP scheme, and our OSS, OSK, PSK, and PSS are larger than TA and MMHP schemes. However, TA scheme and MMHP scheme are based on DLP; they are considered as not secure to resist the quantum computer attack. So our scheme can be more secure than them.

6. Conclusions

In this work, we present an IDPBS-NTRU scheme by using NTRU lattice; this scheme plays an important role in offline e-payment system, which can be deployed in fog computing model. We demonstrate that IDPBS-NTRU is efficient and secure. In addition, our IDPBS-NTRU’s OSS, OSK, and PSK are smaller than ZM scheme and safer than TA and MMHP schemes. The proposed scheme is constructed based on NTRU lattice, which has the advantages of NTRU lattice. In the future, we will continue to construct a partial IDPBS scheme based on lattice.

Denotations

:Original signer
:Proxy signer
:A user
:A certifier
:Trusted third party
:System parameters
:Master key
:Master public-key
:Master secret-key
:User’s identity
:Secret key related to a user
:Warrant
:A message
:A blinded message
:A blind factor
:Delegation
:Blind signature
:A ring
:A polynomial in
:A polynomial in
:The asymptotic lower bound
:A polynomial function related to
:An adversary
:A challenger
:A constant
:Security parameter.

Conflicts of Interest

The authors declare that there are no conflicts of interest regarding the publication of this paper.

Acknowledgments

This research is supported by the National Natural Science Foundation of China (no. U1636213).