Fine-Grained and Flexible Dual Authentication for IoT-Connected Healthcare Sensor Networks

1. Introduction

Healthcare sensor networks are increasingly built from wearable sensors, mobile medical terminals, home gateways, edge devices, cloud services, and hospital information systems. These connected sensing environments enable continuous physiological monitoring, teleconsultation, emergency triage, and data-driven diagnosis, but they also enlarge the attack surface: health data and diagnosis messages may traverse heterogeneous sensing devices, edge gateways, cloud servers, and multiple medical institutions before reaching the final verifier. Therefore, authentication mechanisms for IoT-connected healthcare must protect both data integrity and personal privacy while remaining efficient enough for resource-constrained sensors, gateways, and mobile medical devices.

Internet of Things (IoT) is dramatically changing the way we live through a variety of applications such as smart city, smart transportation and connected healthcare [1]. As a vital application of IoT, IoT-connected healthcare is proposed to improve the efficiency of health systems and reduce health costs [2]. Users can monitor their health status in real-time and enjoy teleconsultation with web-connected wearable devices. IoT-connected healthcare allows users to obtain the diagnosis from the medical institutions anytime and anywhere, which brings certain protection to the health of residents. Despite the aforementioned advantages, IoT-connected healthcare poses numerous security challenges. IoT-connected healthcare is considered as an on-demand service, i.e., it provides health services only to users who subscribe to and pay for it. Therefore, the medical institutions need to verify the validity of the user’s identity after receiving the request. In most of existing authentication schemes for IoT-connected healthcare, users need to sign the health data with a signing key bounded to their identity. This severely exposes the information of users’ identity. Moreover, such schemes only consider the authentication of the user. In reality, however, authenticating the source of data for remote diagnosis is just as important. Only a diagnosis from the legitimate medical institutions is credible. In some cases, the source of the diagnosis also reveals the patient’s privacy to some extent. For instance, the adversary could infer that the patient might suffer from reproductive diseases based on the diagnosis from the reproductive surgeon. Normally, a patient with reproductive disease does not want other people to know about it. The rapid development of IoT-connected healthcare is making this an increasingly common problem. Therefore, the implementation of dual authentication for privacy protection in IoT healthcare networks is a very important problem of concern. Signing the data with a pseudonym before uploading it to the network is one of the potential solutions to the above problem. The health data, such as Health Level Seven (HL7) [3], contains the identifier, gender and birthdate of the user. As shown in Figure 1, a user signs the health data that is removed the personal information with a pseudonym. Then, the user uploads the signed data to the network. Using only one or a few of pseudonyms is unable to realize the privacy-preserving of the user’s identity. Therefore, the user needs to save numerous pseudonyms in advance, but it causes a serious storage burden. After receiving the signed health data, the medical institutions first verify whether the user is valid. In order to authenticate users, the medical institutions need to pre-store the mapping between all possible pseudonyms and all user identities it served. Clearly, such an approach is impractical. This is because the number of users needed to be served is extremely large. Another problem caused by this solution is that medical institutions are unable to make an accurate diagnosis according to the health data included no user’s personal information, such as age, gender, etc. As shown in Figure 1, medical institutions need to sign their diagnosis with pseudonyms and then send the signed diagnosis to users. In the same vein, users need to pre-store the mappings between all possible pseudonyms and all candidate medical institutions’ identities. This imposes the heavy storage burden on resource-constrained users that far exceeds their capacities. This results in the user being unable to authenticate the medical institutions exactly. The adversary may successfully pretend to be a legitimate medical institutions and give the malicious diagnosis, which may endanger the user’s life. Besides, in reality, the diagnosis is not only accessible to the user, but also to authorized family members and friends. Furthermore, the health data should be accessed by multiple authorized medical institutions for better treatment. Considering the above limitations, three questions naturally arise:

• Is there any approach that enables the signature exposing no information of signer’s identity while the signer does not need to save numerous pseudonyms?
• Whether any method exists to allow someone other than the signer to modify the signed data non-interactively without changing the data source?
• Whether any method exists to allow the signer specify who can modify the signed data and which parts of the data can be modified through a fine-grained access control policy?

Our Contribution. In order to address above problems in IoT-connected healthcare sensor networks, we propose a fine-grained and flexible dual authentication scheme that can be deployed over wearable-sensor, mobile-health, and edge-assisted medical communication networks. The scheme treats sensor gateways, edge nodes, and mobile medical terminals as potentially resource-constrained communication and verification participants: they may forward, verify, or help process authenticated healthcare data, but they should not learn users’ or medical institutions’ private identities. Considering that healthcare sensors and edge gateways have limited computation and energy budgets, we further design a verifiable outsourced authentication scheme that outsources the time-consuming pairing operations to two mutually distrusted cloud servers.

In addition, to realize a fine-grained privacy-preserving dual authentication scheme for IoT-connected healthcare sensor networks, we propose a new attribute-based sanitizable signature (ABSS). Our main contributions are summarized as below:

• Fine-grained Access Control: Users and medical institutions can specify who can modify the data and which parts of the data they sign can be modified through a fine-grained access control policy. Only authorized entities can modify the permitted parts of the signed data.
• Privacy Preserving: In our scheme, to hide the identity, the user and the medical institutions sign the data with a fresh related signing key each time, which belongs to the same equivalence class. Unauthorized entities without the corresponding trapdoor cannot link these different keys, i.e., unauthorized entities cannot trace the original signer and modifier of the signed data. Thus, the transmitted data do not reveal user’s personal information.
• Transparency: Authorized entity can sign the modified data in a non-interactive way, and the signature is difficult to distinguish from the original signature.
• Accountability: Neither the original signer (the user or the medical institutions) nor the authorized modifier can accuse the other’s signature. Only authorized entities can trace to the malicious signer or the modifier accurately.
• Friendly to Resource-Constrained Sensors and IoT Nodes: We further design a verifiable outsourced authentication scheme for IoT-connected healthcare sensor networks. In this scheme, the time-consuming pairing operations are outsourced to two cloud servers that are mutually distrusted. In this way, the verification process only needs six multiplication operations, which is friendly to resource-constrained users, wearable devices, sensor gateways, and edge relay nodes.

In addition, the signed data contains a timestamp to ensure accurate treatment and prevent replay attacks. On the theoretical side, we present a new ABSS based on Ciphertext- Policy Attribute-Based Encryption (CP-ABE) and Signature with Flexible Public Key (SFPK). In ABSS, the original signer can specify the modifiable part of the data and the user who can modify the signed data through a fine-grained access control policy. ABSS supports the privacy-preserving of signer’s identity. Only authorized users can track signers and modifiers of signature data and modify the parts of the data that are allowed to be modified. Encouragingly, ABSS has shorter signature and key lengths and more efficient signature and signature changes than the most advanced policy-based sanitizable signature (P3S) [4], as shown in Table 1.

1.1. Related Work

The first sanitizable signature scheme is proposed by Ateniese et al. [5] in 2005. However, this scheme did not provide the complete definition and security proof of the sanitizable signature. Next, Brzuska et al. [6] solved the above problems. Canard et al. [7] introduced the definition and general construction of a trapdoor sanitizable signature. Then, the definition of the other accountable trapdoor sanitizable signature was proposed by Lai et al. [8] which is based on the chameleon hash. However, the above two schemes did not give the detailed parameters of a sanitizable signature scheme. Then, many sanitizable signature schemes are presented [9, 10]. Firstly, we want to address the problem of the privacy-preserving dual authentication for IoT-connected healthcare by using one of the above sanitizabe signature schemes. Unfortunately, none of above schemes are suitable for IoT-healthcare because none of them support fine-grained control of candidate sanitizers and accountability for malicious users. Attribute-based cryptography schemes [11–15] can help solve the above problem. The ABS proposed by Maji et al. [14] and Li et al. [16] satisfy the safety under the generic group model and the safety under the random prediction model, respectively. However, none of the above ABSs supports expressive access structure.The non-monotone access structure supports expressive access. Based on this property, Okamoto and Takashima [17] proposed an ABS scheme that exploits non-monotonic access structure. Next, several ABS schemes are proposed [18–20]. None of the users in the above ABS scheme can modify the data and update the signature in the name of the data owner. Sanitizable signature schemes [4, 21–23] can solve the problem. The scheme in [22] did not introduce attribute based disinfectable signatures in detail, while the scheme proposed in [21] did not back expressive access structure.The scheme proposed by [23] did not achieve the traceability of the signer. The scheme in [4], the number of signed data blocks is certain and the inadmissible block set requires to be saved. In a real IoT-connected healthcare environment, identities of users and medical institutions should be fully protected.

However, none of the above schemes can realize the privacy-preserving of the signer’s identity in a setting where healthcare data may be forwarded through wearable sensors, IoT devices, edge nodes, cloud services, and medical institutions. This paper proposes a fine-grained privacy-preserving dual authentication scheme to secure users’ personal information in IoT-connected healthcare sensor networks. Based on Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Signature with Flexible Public Key (SFPK), an attribute-based sanitizable signature is designed.

1.2. Organization

This paper is organized as follows. We concisely review the fundamental knowledge related to this paper in Section 2. In Section 3, we give the system model and security model definitions. In Section 4, we characterize the proposed scheme. In Section 5, we analyze the security and performance of the proposed scheme. Finally, we conclude the paper in Section 6.

2. Materials and Methods

Using the PDF skill for formula-sensitive reconstruction. In this paper, in addition to common cryptographic tools, Prime Order Bilinear Groups, Monotone Span Program, Ciphertext-Policy Attribute-Based Encryption ($\mathsf{CP}-\mathsf{ABE}$), Non-Interactive Zero-Knowledge Proof (NIZK), Signatures with Flexible Public Keys ($\mathsf{SFPK}$), and Programmable Hash Functions ($\mathsf{PHF}$) are also used.

2.1. Prime Order Bilinear Groups

Let $\Phi \left(1^{\lambda }\right)$ be a function with security parameter $\lambda$ as input and output a tuple

$$(p,G,G_1,G_T,\widehat{e}),$$

where G, $G_1$, and $G_T$ are three multiplicative cyclic groups with prime order p. A mapping

$$\widehat{e}:G\times G_1\to G_T$$

is called a bilinear mapping if it satisfies the following properties:

• Bilinearity: For all $u\in G$, $v\in G_1$, and $a,b\in {\mathbb{Z}}_p$,

  $$\widehat{e}(u^a,v^b)=\widehat{e}(u^b,v^a)=\widehat{e}{(u,v)}^{ab}.$$
• Non-degeneracy: For all $u\in G$ and $v\in G_1$, $\widehat{e}(u,v)\ne 1$.
• Computability: For all $u\in G$ and $v\in G_1$, $\widehat{e}(u,v)$ can be efficiently computed.

2.2. Monotone Span Program

A monotone span program can be represented by a triad $\mathcal{M}=(F,M,f)$, where F is a field, M is an $a\times b$ matrix, and

$$f:\{1,\dots ,a\}\to \{p_1,\dots ,p_n\}.$$

The elements of the matrix M are all taken from the field F. The sub-matrix $M_B$ with $B\subseteq \{p_1,\dots ,p_n\}$ is accepted if the rows of $M_B$ span the vector $(1,0,\dots ,0)$.

2.3. Ciphertext-Policy Attribute-Based Encryption

Definition: Ciphertext-Policy Attribute-Based Encryption ($\mathsf{CP}-\mathsf{ABE}$).

The $\mathsf{CP}-\mathsf{ABE}$ primitive consists of the following four algorithms:

• $\mathsf{CP}-\mathsf{ABE}.Setup\left(1^{\lambda }\right)$ takes the security parameter $\lambda$ as input and outputs the public parameter $p{p}_{\mathsf{CP}-\mathsf{ABE}}$ and the master secret key $ms{k}_{\mathsf{CP}-\mathsf{ABE}}$.
• $\mathsf{CP}-\mathsf{ABE}.Encrypt(p{p}_{\mathsf{CP}-\mathsf{ABE}},A,m)$ takes the public parameter $p{p}_{\mathsf{CP}-\mathsf{ABE}}$, the access policy A, and the message m as input, and outputs the ciphertext $C_{\mathsf{CP}-\mathsf{ABE}}$.
• $\mathsf{CP}-\mathsf{ABE}.KeyGen(ms{k}_{\mathsf{CP}-\mathsf{ABE}},S)$ takes the master secret key $ms{k}_{\mathsf{CP}-\mathsf{ABE}}$ and the set of attributes S as input, and outputs the secret key $s{k}_{\mathsf{CP}-\mathsf{ABE}}$ for S.
• $\mathsf{CP}-\mathsf{ABE}.Decrypt(p{p}_{\mathsf{CP}-\mathsf{ABE}},C_{\mathsf{CP}-\mathsf{ABE}},s{k}_{\mathsf{CP}-\mathsf{ABE}})$ takes the public parameter $p{p}_{\mathsf{CP}-\mathsf{ABE}}$, the ciphertext $C_{\mathsf{CP}-\mathsf{ABE}}$, and the secret key $s{k}_{\mathsf{CP}-\mathsf{ABE}}$ as input, and outputs the message $m^{\prime }$.

The detailed definition of correctness and formal security proof of $\mathsf{CP}-\mathsf{ABE}$ are given in [25].

2.4. Non-Interactive Zero-Knowledge Proof (NIZK)

Let

$$L=\{x\mid \exists \omega :R(x,\omega )=1\},$$

where L is an NP-language with associated witness relation R. A non-interactive proof system $\Omega$ for the language L consists of the following three algorithms:

• ${Setup}_{\Omega }\left(1^{\lambda }\right)$ takes the security parameter $\lambda$ as input and outputs the common reference string $cr{s}_{\Omega }$.
• ${Prove}_{\Omega }(cr{s}_{\Omega },x,\omega )$ takes $cr{s}_{\Omega }$, the statement x, and the corresponding witness $\omega$ as input, and outputs the proof $\pi$.
• ${Verify}_{\Omega }(cr{s}_{\Omega },x,\pi )$ takes $cr{s}_{\Omega }$, the statement x, and the proof $\pi$ as input, and outputs 1 if $\pi$ is valid; otherwise, it outputs 0.

2.5. Signature with Flexible Public Key

Definition: Signature with Flexible Public Keys ($\mathsf{SFPK}$).

This type of signature contains the following eight algorithms:

• $\mathsf{SFPK}.Setup\left(1^{\lambda }\right)$ inputs the security parameter $\lambda$ and outputs the public reference string $\rho$, which is then used as the default input to subsequent algorithms.
• $\mathsf{SFPK}.KGen(1^{\lambda },\omega )$ inputs the security parameter $\lambda$ and the random coins $\omega$, and outputs the public/private key pair $\{p{k}_{\mathsf{SFPK}},s{k}_{\mathsf{SFPK}}\}$.
• $\mathsf{SFPK}.TKGen(1^{\lambda },\omega )$ inputs the security parameter $\lambda$ and the random coins $\omega$, and outputs the public/private key pair $\{p{k}_{\mathsf{SFPK}},s{k}_{\mathsf{SFPK}}\}$ and the trapdoor $\delta$.
• $\mathsf{SFPK}.Sign(s{k}_{\mathsf{SFPK}},m)$ inputs the signing key $s{k}_{\mathsf{SFPK}}$ and the message $m\in {\{0,1\}}^{*}$, and outputs the signature $\sigma$.
• $\mathsf{SFPK}.ChkRep(\sigma ,p{k}_{\mathsf{SFPK}}^{\prime })$ outputs 1 if $p{k}_{\mathsf{SFPK}}^{\prime }\in {\left[p{k}_{\mathsf{SFPK}}\right]}_R$; otherwise, it outputs 0.
• $\mathsf{SFPK}.ChgPK(p{k}_{\mathsf{SFPK}},r)$ inputs the public key $p{k}_{\mathsf{SFPK}}$, which is a delegate of the equivalence class ${\left[p{k}_{\mathsf{SFPK}}\right]}_R$, and random coins r, and outputs a different delegate $p{k}_{\mathsf{SFPK}}^{\prime }\in {\left[p{k}_{\mathsf{SFPK}}\right]}_R$.
• $\mathsf{SFPK}.ChgSK(s{k}_{\mathsf{SFPK}},r)$ inputs the secret key $s{k}_{\mathsf{SFPK}}$, which is a delegate of the equivalence class ${\left[s{k}_{\mathsf{SFPK}}\right]}_R$, and random coins r, and outputs a different delegate $s{k}^{\prime }\in {\left[s{k}_{\mathsf{SFPK}}\right]}_R$.
• $\mathsf{SFPK}.Verify(p{k}_{\mathsf{SFPK}},m,\sigma )$ inputs the public key $p{k}_{\mathsf{SFPK}}$, the message m, and the signature $\sigma$, and outputs 1 if the signature is valid; otherwise, it outputs 0.

The scheme [26] defines the correctness and a formal security proof of $\mathsf{SFPK}$ in detail.

2.6. Programmable Hash Functions

A programmable hash function ($\mathsf{PHF}$) [27] consists of the following two PPT algorithms:

• $K_{\mathsf{PHF}}\leftarrow \mathsf{PHF}.Gen\left(1^{\lambda }\right)$ inputs the security parameter $\lambda$ and outputs the key $K_{\mathsf{PHF}}$.
• $y\in G_1\leftarrow \mathsf{PHF}.Eval(K_{\mathsf{PHF}},X)$ inputs the key $K_{\mathsf{PHF}}$ and $X\in {\{0,1\}}^{\ell \left(\lambda \right)}$, and deterministically outputs the hash value y, where $\ell \left(\lambda \right)$ represents the length of $\lambda$.

3. System Model and Security Model

3.1. System Model

As shown in Figure 2, the system model of the proposed scheme is organized for an IoT-connected healthcare sensor-network scenario and contains four types of entities: users, sensor/edge relay nodes, the trusted authority (TA), and medical institutions. The same cryptographic framework can also be deployed in other mobile IoT systems with similar security requirements.

• Users: Users collect health data through wearable or portable IoT devices. A user may be malicious in the sense that an unauthorized user may attempt to impersonate a legitimate subscriber of a remote diagnosis service. Multiple IoT devices owned by the same user correspond to the same set of keys. Before transmission, the user removes personal information from the collected health data, specifies which medical institutions may modify the signed data and which parts may be modified, and signs the transmitted health data with a fresh related signing key.
• Sensor/edge relay nodes: Wearable sensors, home gateways, mobile medical terminals, and edge relay nodes provide sensing, communication, relay, and lightweight verification support between users and medical institutions, especially in continuous monitoring, emergency response, rural coverage, temporary medical service, and public-safety healthcare scenarios. These nodes are not assumed to be fully trusted with identity information. They may forward signed health data, help perform verification, or interact with outsourced cloud servers, but they should not be able to infer the identities of users or medical institutions from transmitted signatures.
• Trusted Authority: The TA is considered honest. It generates signing private keys for users and medical institutions, and issues attributes and attribute keys to all entities other than itself. The TA also supports the traceability function required for accountability.
• Medical Institutions: Medical institutions are semi-honest. They can add or remove users’ personal information from signed data when they are authorized by the access control policy, generate diagnoses based on the recovered medical context, and sign diagnoses with fresh related signing keys. A valid signature generated after authorized modification is indistinguishable from an original signature.

The workflow is as follows. First, a user collects health data via wearable or portable sensing devices and removes personal information to obtain transmitted health data. The user signs the transmitted health data with a fresh related signing key and a fine-grained access control policy. The signed data can then be forwarded through sensor gateways or edge relay nodes to medical institutions. Only authorized medical institutions with the corresponding trapdoor can link the user’s different signing keys and trace the user’s identity. After receiving signed health data, an authorized medical institution verifies the data source, restores necessary personal information, and generates an accurate diagnosis. The medical institution then signs the diagnosis with a fresh related signing key and specifies a new access control policy for subsequent modification. When the diagnosis is transmitted back through the healthcare sensor network, authorized medical institutions can remove the user’s personal information and generate a new indistinguishable signature. Finally, the user verifies the medical institution’s identity and accepts the diagnosis only if the verification succeeds.

3.2. Design Goals

To realize fine-grained and flexible privacy-preserving dual authentication for IoT-connected healthcare sensor networks, our scheme aims to achieve the following goals.

• Fine-grained Access Control: Users and medical institutions can determine which entities may modify the signed data and which parts of the signed data may be modified through a specified fine-grained access control policy. Authorized entities can generate a new signature for modified data in a non-interactive manner, and the new signature is indistinguishable from the original signature.
• Privacy Preserving: The personal information of users and medical institutions should remain hidden during transmission through sensor, IoT, edge, and cloud communication channels.
• Transparency: The signature of modified data generated by authorized entities is indistinguishable from the signature of the original data.
• Accountability: Neither the original signer nor the authorized modifier can falsely accuse the other of signing. Authorized entities can trace malicious signers or modifiers accurately.
• Sensor/IoT Friendliness: The authentication mechanism should reduce online verification overhead so that sensor gateways, wearable devices, mobile medical terminals, and other resource-constrained IoT entities can participate in secure healthcare data exchange.

3.3. Definition

Definition: Fine-Grained and Flexible Privacy-Preserving Dual Authentication Scheme for IoT-Connected Healthcare Sensor Networks.

A fine-grained and flexible privacy-preserving dual authentication scheme for IoT-connected healthcare sensor networks contains seven algorithms, namely Setup, KGenS, KGenA, Sign, SignChg, Verify, and Trace, which are described as follows:

• $(msk,mpk)\leftarrow Setup\left(1^{\lambda }\right)$: TA runs the setup algorithm, inputs the security parameter $\lambda$, and outputs the public/private key pair $(mpk,msk)$.
• $(sk,pk)\leftarrow KGenS(msk,mpk)$: TA runs the key generation algorithm for signers, inputs $(mpk,msk)$, and outputs the signer’s signing public/private key pair $(pk,sk)$.
• $(s{k}_S,s{k}_A,p{k}_A)\leftarrow KGenA(msk,mpk,S)$: TA runs the key generation algorithm for all entities, inputs $(mpk,msk)$ and the entity-owned attribute set S, and outputs the private attribute key $s{k}_S$ and the public/private key pair $(s{k}_A,p{k}_A)$ of the entity.
• $\sigma \leftarrow Sign(mpk,sk,A,m)$: Users or medical institutions run the signing algorithm, input $mpk$, the private signing key $sk$, the access control policy A, and the message m, and output a valid signature $\sigma$.
• ${\sigma }^{\prime }\leftarrow SignChg(mpk,\sigma ,m^{\prime },s{k}_S)$: Authorized entities run the signature modification algorithm, input $mpk$, the previous signature $\sigma$, the modified message $m^{\prime }$, and the private attribute key $s{k}_S$, and output a new signature ${\sigma }^{\prime }$ for the modified message.
• $b\leftarrow Verify(mpk,\sigma ,m,pk)$: Anyone can run the verification algorithm with input $mpk$, $\sigma$, m, and the signer’s public key $pk$. The algorithm outputs 1 if the signature is valid; otherwise, it outputs 0.
• $ID\leftarrow Trace(mpk,\sigma ,{\pi }_{\mathrm{ABSS}})$: Authorized entities run the trace algorithm with input $mpk$, $\sigma$, and the proof ${\pi }_{\mathrm{ABSS}}$, and output the identity $ID$ of the last signer.

3.4. Security Model

Definition: Fine-grained Access Control.

We consider two adversaries with formal descriptions of the fine-grained access control of signed data. Adversary $A_1$ does not own the set of attributes that satisfies the access control policy, while adversary $A_2$ attempts to edit the inadmissible parts of the signed data. We introduce two games between the challenger C and adversaries $A_1$ and $A_2$.

For $A_1$, challenger C generates $(msk,mpk)$ by running $Setup\left(1^{\lambda }\right)$, stores $msk$ locally, and sends $mpk$ to $A_1$. In the query phase, $A_1$ may adaptively issue KGenA, Sign, SignChg, Verify, and Trace queries. In particular, for KGenA queries, $A_1$ queries the authorized entity’s key for

$$\left(\right(mpk,msk),S)\mathrm{with}A\left(S\right)=0,$$

and C returns $s{k}_S$ and $(p{k}_A,s{k}_A)$ by running $KGenA(msk,mpk,S)$. For signing and changing queries, C returns $\sigma$ or ${\sigma }^{\prime }$ by running the corresponding algorithms, and for verification and tracing queries, C returns the output of Verify or Trace.

In the challenge phase, $A_1$ adaptively selects an unauthorized attribute set S such that $A\left(S\right)=0$, generates the challenged signature ${\sigma }^{*}$ for the challenged message $m^{*}$ by running SignChg, and returns $(S,m^{*},{\sigma }^{*})$ to C. In the verify phase, $A_1$ makes polynomially many queries and obtains

$$Q={\{s{k}_S,S,m_i,A_i,{\sigma }_i\}}_{i=1}^{\left|Q\right|}$$

through L queries. Challenger C runs $Verify(mpk,pk,m^{*},{\sigma }^{*})$ and outputs a bit $b_0$. If $b_0=1$, C checks whether there exists $i\in \left[\right|Q\left|\right]$ such that ${\sigma }^{*}$ is accepted while $A\left(S\right)=0$. If such an i exists, C outputs $b_1=1$; otherwise, C outputs $b_1=0$. The advantage of $A_1$ is $Pr[b_1=1]$. If for any polynomial-time adversary $A_1$,

$$Pr[b_1=1]<{\displaystyle \frac{1}{poly\left(n\right)}}$$

for sufficiently large n, the proposed scheme satisfies signature unforgeability against unauthorized modification.

For $A_2$, the setup and query phases are the same. In the challenge phase, $A_2$ adaptively selects an attribute set S such that $A\left(S\right)=1$, and generates the challenged signature ${\sigma }^{*}$ for the challenged message $m^{*}$ by SignChg, where $m^{*}$ does not include all inadmissible blocks. It sends $(S,m^{*},{\sigma }^{*})$ to C. After polynomially many queries, $A_2$ obtains

$$Q={\{s{k}_S,S,m_i,A_i,{\sigma }_i\}}_{i=1}^{\left|Q\right|}.$$

Challenger C runs $Verify(mpk,pk,A,m^{*},{\sigma }^{*})$ and outputs $b_0$. If $b_0=1$, C checks whether there exists $i\in \left[\right|Q\left|\right]$ such that $m^{*}$ does not contain all inadmissible blocks. If so, C outputs $b_1=1$; otherwise, it outputs $b_1=0$. The advantage of $A_2$ is $Pr[b_1=1]$. If for any polynomial-time adversary $A_2$,

$$Pr[b_1=1]<{\displaystyle \frac{1}{poly\left(n\right)}}$$

for sufficiently large n, the proposed scheme satisfies the unforgeability of the signature.

Definition: Transparency.

Claiming that a fine-grained and flexible dual authentication scheme for IoT-connected healthcare sensor networks enables transparency if the PPT adversary cannot distinguish, with non-negligible probability, between the signature of the modified data generated by the authorized entity and the signature of the original signer.

Definition: Privacy Preserving.

We say a fine-grained and flexible dual authentication scheme for IoT-connected healthcare sensor networks achieves privacy preserving if no PPT adversary can obtain the user’s personal information from the transmitted data.

Definition: Accountability.

We say a fine-grained and flexible dual authentication scheme for IoT-connected healthcare sensor networks supports accountability if authorized entities can trace to the original signer or the latest modifier’s identity of the data from any valid signature with non-negligible probability.

4. The Proposed Scheme

4.1. Overview

In an IoT-connected healthcare sensor-network deployment, wearable sensors, home gateways, mobile terminals, and edge nodes may relay signed health data from users to medical institutions, support emergency medical communication, and help perform lightweight verification before data are forwarded. Such sensing and edge nodes are useful for continuous monitoring, coverage extension, and mobility, but they should not expose patient identity, medical-institution identity, or the linkage between multiple signatures generated by the same entity. Therefore, the cryptographic layer must simultaneously support privacy-preserving dual authentication, fine-grained modification authorization, and efficient verification.

To realize fine-grained and flexible dual authentication for IoT-connected healthcare sensor networks, we first try out the idea from recent work P3S [4] to allow the authorized medical institutions to add and remove the user’s personal information for the signed data and generate a new indistinguishable signature for the modified data. However, the direct use of the P3S [4] severely exposes the identities of users and medical institutions. This is due to two ineluctable reasons: 1) the signing key used by the original signer is tied to his/her identity. 2) P3S contains a public key encryption, whose key is also bound to the identity. Therefore, P3S is ill-suited for privacy-preserving healthcare sensor networks, which require users’ and medical institutions’ identity to be hidden during transmission through sensor, edge, and cloud channels. To solve the mentioned problems, we design a new attribute-based sanitizable signature (ABSS) based on Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Signature with Flexible Public Key (SFPK). The general construction of ABSS as shown in Table 2. In ABSS, the signer (user or medical institutions) signs the data using different keys each time, which belong to the same equivalence class. Only authorized entities with the corresponding trapdoor can link these different keys. Therefore, ABSS supports the privacy-preserving of the signer’s identity. ABSS also supports fine-grained access control and accountability as P3S [4]. Encouragingly, ABSS has small signature and key lengths and less computational overhead for signing and signature changing compare with the state-of-the-art P3S [4]. Further, we propose a fine-grained and flexible dual authentication scheme for IoT-connected healthcare sensor networks based on the proposed ABSS. In our scheme, the user and the medical institutions sign the data with a fresh related signing key each time and specify which one can modify the data and which parts of their signed data can be modified through a specified fine-grained access control policy. The transmitted data contain no personal information even when they pass through sensor gateways, edge nodes, or cloud servers. Authorized medical institutions can add or remove the user’s personal information into the signed data (the transmitted health data or the transmitted diagnosis), and non-interactively generate the new indistinguishable signature for the modified data. Our scheme supports accountability, i.e. authorized entities can trace to the original signer and the modifier of the signed data. In addition, the signed health data and diagnoses contain timestamps to ensure accurate treatment and against replay attacks. The following subsections describe the proposed scheme in detail.

4.2. Description of the Proposed Scheme

A fine-grained and flexible dual authentication scheme for IoT-connected healthcare sensor networks includes seven algorithms. Table 2 gives the generic construction of ABSS based on $\mathsf{CP}-\mathsf{ABE}$, $\mathsf{SFPK}$, NIZK, and $\mathsf{PHF}$.

• Setup. $(msk,mpk)\leftarrow Setup\left(1^{\lambda }\right)$. Let

  $$\widehat{e}:G_1\times G_2\to G_T$$

  be a bilinear pairing, where $G_1$, $G_2$, and $G_T$ are three multiplicative cyclic groups with prime order p, and $g_1$ and $g_2$ are generators of $G_1$ and $G_2$, respectively. TA randomly chooses

  $$(a_1,a_2,b_1,b_2)\leftarrow {\mathbb{Z}}_p^{*},(d_1,d_2,d_3)\leftarrow {\mathbb{Z}}_p,$$

  selects a random string $\rho$, and obtains $cr{s}_{\Omega }\leftarrow {Setup}_{\Omega }\left(1^{\lambda }\right)$. It then computes

  $$\begin{array}{cccc}\hfill H_1& =g_2^{a_1},\hfill & \hfill H_2& =g_2^{a_2},\hfill \\ \hfill T_1& =\widehat{e}{(g_1,g_2)}^{d_1{a}_1+d_3},\hfill & \hfill T_2& =\widehat{e}{(g_1,g_2)}^{d_2{a}_2+d_3}.\hfill \end{array}$$
  Finally, TA outputs

  $$\begin{array}{cc}\hfill mpk& =(g_2,H_1,H_2,T_1,T_2),\hfill \\ \hfill msk& =(g_1,g_2,a_1,a_2,b_1,b_2,g_1^{d_1},g_1^{d_2},g_1^{d_3}).\hfill \end{array}$$
• KGenS. $(sk,pk)\leftarrow KGenS(msk,mpk)$. TA first computes

  $$K_{\mathsf{PHF}}\leftarrow \mathsf{PHF}.Gen\left(\lambda \right),$$

  randomly selects $A,B,C,D,X\leftarrow G_1$ and $z\leftarrow {\mathbb{Z}}_p^{*}$, and computes

  $$h\leftarrow \widehat{e}(X^z,g_2).$$
  It outputs

  $$sk=(z,X),pk=(A,B,C,D,h,K_{\mathsf{PHF}}).$$
• KGenA. $(s{k}_S,s{k}_A,p{k}_A)\leftarrow KGenA(msk,mpk,S)$. TA first selects $r_1,r_2\leftarrow {\mathbb{Z}}_p$ and computes

  $$s{k}_0=(g_2^{b_1{r}_1},g_2^{b_2{r}_2},g_2^{r_1+r_2}).$$
  For $at\in S$ and $s=1,2$, it computes

  $$s{k}_{at,s}=H{\left(at1s\right)}^{b_1{r}_1/a_s}·H{\left(at2s\right)}^{b_2{r}_2/a_s}·H{\left(at3s\right)}^{(r_1+r_2)/a_s}·g_1^{{\sigma }_{at}/a_s},$$

  where ${\sigma }_{at}\leftarrow {\mathbb{Z}}_p$ and $H:{\{0,1\}}^{*}\to G_1$. TA sets

  $$s{k}_{at}=(s{k}_{at,1},s{k}_{at,2},g_1^{-{\sigma }_{at}}).$$
  For $s=1,2$, TA computes

  $$s{k}_s^{\prime }=g_1^{d_s}·H{\left(011s\right)}^{b_1{r}_1/a_s}·H{\left(012s\right)}^{b_2{r}_2/a_s}·H{\left(013s\right)}^{(r_1+r_2)/a_s}·g_1^{k/a_s},$$

  where $k\leftarrow {\mathbb{Z}}_p$, and sets

  $$s{k}^{\prime }=(s{k}_1^{\prime },s{k}_2^{\prime },g_1^{d_3}·g_1^{-k}).$$
  The entity computes $y=f\left(x\right)$, where f is a one-way function and x is a random number in $G_1$, sends y to TA, and proves to TA that it owns x by zero knowledge. Finally, TA outputs

  $$s{k}_S=(s{k}_0,{\left\{s{k}_{at}\right\}}_{at\in S},s{k}^{\prime }),(s{k}_A=x,p{k}_A=y).$$
• Sign. $\sigma \leftarrow Sign(mpk,sk,A,m)$. The user or medical institution computes

  $$\delta \leftarrow (d,g_2^{y_2},g_2^a,g_2^b,g_2^c,(g_2^{{\mu }_0},g_2^{{\mu }_1},\dots ,g_2^{{\mu }_{\lambda }})),$$

  where $\omega$ is a random coin, $a,b,c,d,y_2\leftarrow {\mathbb{Z}}_p^{*}$, and ${\mu }_i\leftarrow {\mathbb{Z}}_p$ for $i\in \{0,\dots ,\lambda \}$. It selects $n\leftarrow {\mathbb{Z}}_p^{*}$ and computes

  $$p{k}^{\prime }=(A^n,B^n,C^n,D^n,h^n,K_{\mathsf{PHF}}^n),s{k}^{\prime }=(z,X^n).$$
  Similarly, it selects $n^{\prime }\leftarrow {\mathbb{Z}}_p^{*}$ and obtains

  $$p{k}^{\prime \prime }=(A^{n^{\prime }},B^{n^{\prime }},C^{n^{\prime }},D^{n^{\prime }},h^{n^{\prime }},K_{\mathsf{PHF}}^{n^{\prime }}),s{k}^{\prime \prime }=(z,X^{n^{\prime }}).$$
  Then it computes $C_{\mathsf{CP}-\mathsf{ABE}}\leftarrow \mathsf{CP}-\mathsf{ABE}.Encrypt(s{k}_{\mathsf{SFPK}}^{\prime },\delta ,r)$. Specifically, it randomly chooses $s_1,s_2\leftarrow {\mathbb{Z}}_p$ and computes

  $$c{t}_0=(H_1^{s_1},H_2^{s_2},g_2^{s_1+s_2}),$$

  $$c{t}_{i,l}=H{\left(f\left(i\right)l1\right)}^{s_1}·H{\left(f\left(i\right)l2\right)}^{s_2}·{\displaystyle \prod _{j=1}^{n_2}}{\left[H{\left(0jl1\right)}^{s_1}·H{\left(0jl2\right)}^{s_2}\right]}^{M_{i,j}},$$

  where $(M,f)$ is a monotone span program corresponding to the access structure, M has $n_1$ rows and $n_2$ columns, $i=1,\dots ,n_1$, and $l=1,2,3$. It computes

  $$c{t}^{\prime }=T_1^{s_1}·T_2^{s_2}·(s{k}_{\mathsf{SFPK}}^{\prime }\parallel \delta \parallel r),$$

  and outputs

  $$C_{\mathsf{CP}-\mathsf{ABE}}=(c{t}_0,c{t}_1,\dots ,c{t}_{n_1},c{t}^{\prime }).$$
  Next, it computes

  $${\mathsf{Sig}}^1\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime }}(p{k}^{\prime },p{k}^{\prime \prime },m,C_{\mathsf{CP}-\mathsf{ABE}},\pi +r,y_1+r),$$

  where $\pi \leftarrow {Prove}_{\Omega }(cr{s}_{\Omega },x,st)$ and $st$ is the statement. It chooses $r^{\prime }\leftarrow {\mathbb{Z}}_p^{*}$ and computes

  $${\mathsf{Sig}}^1=\left(X^y·{\left(H_{K_{\mathsf{PHF}}}(m\parallel C_{\mathsf{CP}-\mathsf{ABE}}\parallel \pi +r\parallel y_1+r)\right)}^{r^{\prime }},g_1^{r^{\prime }},g_2^{r^{\prime }}\right).$$
  In the same vein, it computes

  $${\mathsf{Sig}}^2\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime \prime }}(H(i\parallel U_A),i\parallel U_A,t,y+r,H\left(m\right),A),$$

  where $U_A$ represents a collection of message blocks that are not allowed to be modified and t represents the expiration time of the signature. Finally, it outputs

  $$\sigma =\{C_{\mathsf{CP}-\mathsf{ABE}},{\mathsf{Sig}}^1,{\mathsf{Sig}}^2,A\}.$$
• SignChg. ${\sigma }^{\prime }\leftarrow SignChg(mpk,\sigma ,m^{\prime },s{k}_S)$. The authorized entity computes

  $$(s{k}^{\prime },r,\delta )\leftarrow \mathsf{CP}-\mathsf{ABE}.{Decrypt}_{s{k}_{\mathsf{CP}-\mathsf{ABE}}}\left(C_{\mathsf{CP}-\mathsf{ABE}}\right).$$
  Let $v={\left\{v_i\right\}}_{i\in \{1,2,\dots ,n_2\}}$ satisfy $M·v=(1,0,\dots ,0)$. The authorized entity computes

  $$\begin{array}{cc}\hfill num=& c{t}^{\prime }·\widehat{e}\left(\prod _{v_i\in \{1,\dots ,n_2\}}c{t}_{v_i,1}^{v_i},s{k}_{0,1}\right)·\widehat{e}\left(\prod _{v_i\in \{1,\dots ,n_2\}}c{t}_{v_i,2}^{v_i},s{k}_{0,2}\right)\hfill \\ & ·\widehat{e}\left(\prod _{v_i\in \{1,\dots ,n_2\}}c{t}_{v_i,3}^{v_i},s{k}_{0,3}\right),\hfill \end{array}$$

  and

  $$\begin{array}{cc}\hfill den=& \widehat{e}\left(s{k}_1^{\prime }·\prod _{v_i\in \{1,\dots ,n_2\}}s{k}_{f\left(i\right),1}^{v_i},c{t}_{0,1}\right)·\widehat{e}\left(s{k}_2^{\prime }·\prod _{v_i\in \{1,\dots ,n_2\}}s{k}_{f\left(i\right),2}^{v_i},c{t}_{0,2}\right)\hfill \\ & ·\widehat{e}\left(s{k}_3^{\prime }·\prod _{v_i\in \{1,\dots ,n_2\}}s{k}_{f\left(i\right),3}^{v_i},c{t}_{0,3}\right).\hfill \end{array}$$
  It outputs

  $$(s{k}^{\prime },r,\delta )=num/den.$$
  The authorized entity computes

  $${\mathsf{Sig}}^{1\prime }\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime }}(p{k}^{\prime },p{k}^{\prime \prime },m^{\prime },C_{\mathsf{CP}-\mathsf{ABE}},{\pi }^{\prime }+r,y^{\prime }+r),$$

  where $y^{\prime }=f\left(x^{\prime }\right)$ and ${\pi }^{\prime }$ is a proof of $x^{\prime }$. Finally, it outputs

  $${\sigma }^{\prime }=\{C_{\mathsf{CP}-\mathsf{ABE}},{\mathsf{Sig}}^{1\prime },{\mathsf{Sig}}^2,A\}.$$
• Verify. $b\leftarrow Verify(mpk,\sigma ,m,pk)$. The verifier first computes $H\left(m\right)$ and checks whether it is equal to $H\left(m\right)$ in ${\mathsf{Sig}}^2$. If so, the verifier checks whether $y+r$ in ${\mathsf{Sig}}^2$ is equal to the corresponding value in ${\mathsf{Sig}}^1$. If the checks pass, it returns

  $$b\leftarrow \mathsf{SFPK}.Verify(p{k}^{\prime },p{k}^{\prime \prime },m,\sigma );$$

  otherwise, it returns ⊥. If $H\left(m\right)$ is not equal to $H\left(m\right)$ in ${\mathsf{Sig}}^2$, the verifier computes $H(i\parallel U_A)$ and checks whether it equals $H(i\parallel U_A)$ in ${\mathsf{Sig}}^2$, and then checks whether $y+r$ in ${\mathsf{Sig}}^2$ equals the corresponding value in ${\mathsf{Sig}}^1$. If all checks pass, it returns b; otherwise, it returns ⊥.
• Trace. $ID\leftarrow Trace(mpk,\sigma ,{\pi }_{\mathrm{ABSS}})$. If

  $$1\leftarrow {Verify}_{\Omega }(cr{s}_{\Omega },st,\pi ),$$

  the algorithm returns the identity $ID$ corresponding to y; otherwise, it returns ⊥.

4.3. A Verifiable Outsourced Authentication Scheme

The most time-consuming operation in the proposed scheme is the pairing operation in the Verify algorithm. To make the scheme more user-friendly for resource-constrained entities, we present a verifiable outsourced authentication scheme that retains the advantages of the above scheme while allowing time-consuming pairing operations to be outsourced to two mutually distrusted cloud servers [28]. The verifiable outsourced authentication scheme differs only in the following two algorithms.

• Pre-computation. $\tau \leftarrow \mathsf{PreC}\left(q\right)$ is performed offline by the entity. The entity randomly selects q integers ${\alpha }_1,\dots ,{\alpha }_q\in {\mathbb{Z}}_p$ and computes

  $${\beta }_{j1}={\alpha }_j{g}_1,{\beta }_{j2}={\alpha }_j{g}_2,j=1,\dots ,q.$$
  It computes $\widehat{e}(g_1,g_2)$ and stores $\widehat{e}(g_1,g_2)$ and ${\{{\alpha }_j,{\beta }_{j1},{\beta }_{j2}\}}_{j=1,\dots ,q}$ locally. For vector generation, the entity selects a set E such that $\left|E\right|=k$ and $E\subseteq \{1,\dots ,q\}$. For each $j\in E$, it randomly chooses ${\chi }_j\in \{1,\dots ,v-1\}$, where v is a small integer and $v>1$, and computes

  $$x_1=\sum _{j\in E}{\alpha }_j{\chi }_{j}modp.$$
  If $x_1=0modp$, it repeats the operation; otherwise, it computes

  $$x_1{g}_1=\sum _{j\in E}{\chi }_j{\beta }_{j1}.$$
  In the same vein, it computes $(x_3,x_3{g}_1)$, $(x_4,x_4{g}_2)$, $(x_7,x_7{g}_1)$, and $(x_8,x_8{g}_2)$. It randomly selects $x_2,x_5,x_6\leftarrow {\mathbb{Z}}_p^{*}$ and computes

  $$x_1^{-1}{x}_2{g}_2,x_1{x}_2^{-1}{x}_5{g}_1,x_1^{-1}{x}_6{g}_2,\widehat{e}{(g_1,g_2)}^{x_7{x}_8},\widehat{e}{(g_1,g_2)}^{x_5+x_6-x_2}.$$
  Finally, it stores

  $$\begin{array}{cc}\hfill \tau =& (x_1{g}_1,x_3{g}_1,x_7{g}_1,x_1^{-1}{x}_2{g}_2,x_1{x}_2^{-1}{x}_5{g}_1,x_4{g}_2,\hfill \\ & x_1^{-1}{x}_6{g}_2,\widehat{e}{(g_1,g_2)}^{x_7{x}_8},\widehat{e}{(g_1,g_2)}^{x_5+x_6-x_2},x_8{g}_2).\hfill \end{array}$$
• Outsourced verification. $b\leftarrow Verify(mpk,\sigma ,m,pk,\tau )$. When the verifier runs $\mathsf{SFPK}.Verify(p{k}^{\prime },p{k}^{\prime \prime },m,\sigma )$, the pairing operations can be outsourced to two cloud servers $U_1$ and $U_2$. Let

  $${\mathsf{Sig}}^1=(X^z·{\left(H_{K_{\mathsf{PHF}}}\left(m\right)\right)}^n,g_1^n,g_2^n).$$
  The verifier needs to check

  $$\widehat{e}(g_1^n,g_2)=\widehat{e}(g_1,g_2^n).$$
  To outsource $\widehat{e}(g_1^n,g_2)$, the verifier sends

  $$g_1^n+x_1{g}_1,g_2+x_1^{-1}{x}_2{g}_2,x_3{g}_1,x_4{g}_2$$

  to $U_1$. Then $U_1$ computes

  $${\alpha }_1=\widehat{e}(g_1^n+x_1{g}_1,g_2+x_1^{-1}{x}_2{g}_2),{\alpha }_2=\widehat{e}(x_3{g}_1,x_4{g}_2),$$

  and sends ${\alpha }_1$ and ${\alpha }_2$ to the verifier. The verifier sends

  $$\begin{array}{cc}& g_1^n+x_1{x}_2^{-1}{x}_5{g}_1,-x_1^{-1}{x}_2{g}_2,-x_1{g}_1,g_2+x_1^{-1}{x}_6{g}_2,\hfill \\ & x_3{g}_1,x_4{g}_2,x_7{g}_1,x_8{g}_2\hfill \end{array}$$

  to $U_2$. Then $U_2$ computes

  $$\begin{array}{cc}\hfill {\alpha }_1^{\prime }& =\widehat{e}(g_1^n+x_1{x}_2^{-1}{x}_5{g}_1,-x_1^{-1}{x}_2{g}_2),\hfill \\ \hfill {\alpha }_2^{\prime }& =\widehat{e}(-x_1{g}_1,g_2+x_1^{-1}{x}_6{g}_2),\hfill \\ \hfill {\alpha }_3^{\prime }& =\widehat{e}(x_3{g}_1,x_4{g}_2),\hfill \\ \hfill {\alpha }_4^{\prime }& =\widehat{e}(x_7{g}_1,x_8{g}_2),\hfill \end{array}$$

  and sends $({\alpha }_1^{\prime },{\alpha }_2^{\prime },{\alpha }_3^{\prime },{\alpha }_4^{\prime })$ to the verifier. The verifier checks whether

  $${\alpha }_2={\alpha }_3^{\prime },\widehat{e}{(g_1,g_2)}^{x_7{x}_8}={\alpha }_4^{\prime }.$$
  If the checks hold, the verifier sets

  $$\widehat{e}(g_1^n,g_2)={\alpha }_1{\alpha }_1^{\prime }{\alpha }_2^{\prime }\widehat{e}{(g_1,g_2)}^{x_5+x_6-x_2}.$$
  In the same vein, the verifier obtains $\widehat{e}(g_1,g_2^n)$ and checks whether

  $$\widehat{e}(g_1^n,g_2)=\widehat{e}(g_1,g_2^n)$$

  holds. It also checks whether

  $$\widehat{e}(X^z·{\left(H_{K_{\mathsf{PHF}}}\left(m\right)\right)}^n,g_2)=h·\widehat{e}({\left(H_{K_{\mathsf{PHF}}}\left(m\right)\right)}^n,g_2^n)$$

  holds. If the above equations hold, the verifier outputs 1; otherwise, it outputs 0. Therefore, after outsourcing one pairing operation, the verifier only needs to perform three modular multiplication operations, and the whole verification process only needs six multiplication operations.

5. Results

5.1. Security Analysis

In this section, we analyze the security of the proposed healthcare sensor-network authentication scheme in terms of fine-grained access control, transparency, privacy preserving, and accountability.

Theorem 1

(Fine-Grained Access Control). For two PPT adversaries $A_1$ and $A_2$, it is computationally infeasible to generate a valid signature for the modified data. Here, $A_1$ represents unauthorized entities that possess an attribute set S such that $A\left(S\right)=0$, and $A_2$ updates the parts of the signed data that are not allowed to be modified.

Proof. 

To prove this theorem, we define two games between a challenger C and PPT adversaries $A_1$ and $A_2$.

Game 1.

The setup and query phases are as in the security model. Next, $A_1$ adaptively chooses an unauthorized entity’s attribute set S such that $A\left(S\right)=0$. $A_1$ attempts to generate the challenged signature ${\sigma }^{*}$ for the modified data $m^{*}$ by running SignChg. Finally, $A_1$ sends $(S,m^{*},{\sigma }^{*})$ to C.

Analysis.

Assume that $A_1$ wins Game 1 with non-negligible probability, i.e., the challenged signature ${\sigma }^{*}$ passes the Verify algorithm. According to the security of $\mathsf{SFPK}$ [26], $A_1$ must know the private signing key $s{k}^{\prime }$ if it wants to generate a valid signature pair for modified data. This means that $A_1$ can correctly decrypt the ciphertext $C_{\mathsf{CP}-\mathsf{ABE}}$ to obtain $s{k}^{\prime }$. In other words, an unauthorized entity with attribute set S and $A\left(S\right)=0$ can correctly decrypt the ciphertext, which contradicts the security of $\mathsf{CP}-\mathsf{ABE}$ [25]. Therefore, $A_1$ is computationally infeasible to generate a valid signature for the modified data.

Game 2.

The setup and query phases are again as in the security model. Next, $A_2$ adaptively chooses an entity’s attribute set S such that $A\left(S\right)=1$. $A_2$ attempts to generate the challenged signature ${\sigma }^{*}$ for the modified data $m^{*}$ by running SignChg. The modified data $m^{*}$ does not contain all inadmissible blocks. Finally, $A_2$ sends $(S,m^{*},{\sigma }^{*})$ to C.

Analysis.

Assume that $A_2$ wins Game 2 with non-negligible probability, i.e., the challenged signature ${\sigma }^{*}$ passes the Verify algorithm. In Verify, the challenger computes $H(i\parallel U_A)$ and checks whether it equals the corresponding $H(i\parallel U_A)$ in ${\mathsf{Sig}}^2$. Thus, $A_2$ needs to forge a valid signature

$${\mathsf{Sig}}^{2\prime }\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime \prime }}(H^{\prime }(i^{\prime }\parallel U_A^{\prime }),i^{\prime }\parallel U_A^{\prime },t,y+r,H\left(m\right),A)$$

for the modified data $m^{*}$. Because $m^{*}$ does not contain all inadmissible blocks, the security of $\mathsf{SFPK}$ [26] implies that the probability of forging ${\mathsf{Sig}}^{2\prime }$ without the private signing key $s{k}^{\prime \prime }$ is negligible. Therefore, $A_2$ is computationally infeasible to generate a valid signature for the modified data. Hence, the proposed scheme achieves fine-grained access control. □

Theorem 2

(Transparency). For any PPT adversary, it is computationally infeasible to distinguish the modified signature from the original signature.

Proof. 

The original signature $\sigma$ and the signature ${\sigma }^{\prime }$ for the modified data are

$$\sigma =\left\{\begin{array}{c}A;\hfill \\ C_{\mathsf{CP}-\mathsf{ABE}}\leftarrow \mathsf{CP}-\mathsf{ABE}.Encrypt(s{k}^{\prime },\delta ,r);\hfill \\ {\mathsf{Sig}}^1\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime }}(p{k}^{\prime },p{k}^{\prime \prime },m,C_{\mathsf{CP}-\mathsf{ABE}},\pi +r,y+r);\hfill \\ {\mathsf{Sig}}^2\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime \prime }}(H(i\parallel U_A),i\parallel U_A,t,y+r,H\left(m\right),A),\hfill \end{array}\right.$$

and

$${\sigma }^{\prime }=\left\{\begin{array}{c}A;\hfill \\ C_{\mathsf{CP}-\mathsf{ABE}}\leftarrow \mathsf{CP}-\mathsf{ABE}.Encrypt(s{k}^{\prime },\delta ,r);\hfill \\ {\mathsf{Sig}}^{1\prime }\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime }}(p{k}^{\prime },p{k}^{\prime \prime },m^{\prime },C_{\mathsf{CP}-\mathsf{ABE}},{\pi }^{\prime }+r,y^{\prime }+r);\hfill \\ {\mathsf{Sig}}^2\leftarrow \mathsf{SFPK}.{Sign}_{s{k}^{\prime \prime }}(H(i\parallel U_A),i\parallel U_A,t,y+r,H\left(m\right),A).\hfill \end{array}\right.$$

The only difference between $\sigma$ and ${\sigma }^{\prime }$ is that ${\mathsf{Sig}}^1$ and ${\mathsf{Sig}}^{1\prime }$ have different values. However, ${\mathsf{Sig}}^1$ and ${\mathsf{Sig}}^{1\prime }$ are both outputs of $\mathsf{SFPK}.{Sign}_{s{k}^{\prime }}(·)$ and belong to the same distribution. Therefore, for any PPT adversary, it is computationally infeasible to distinguish the signature of modified data from the signature of original data, and the scheme achieves transparency in healthcare sensor-network data transmission. □

Theorem 3

(Privacy Preserving). In the proposed scheme, the transmitted data contains no personal information of users or medical institutions.

Proof. 

The user removes personal information before signing and uploading health data, so the transmitted health data contains no user’s personal information. In the Sign and SignChg algorithms, the user or medical institution uses a fresh signing key each time. Thus, no one can trace the signer or modifier from the original signature and the modified-data signature except authorized entities. Authorized medical institutions also remove the user’s personal information from the signed diagnosis before uploading it. Therefore, the signed diagnosis contains no user’s personal information, and the scheme achieves privacy preservation. □

Theorem 4

(Accountability). In the proposed scheme, only authorized entities can extract the last modifier’s identity from any valid signature, and the original signer cannot accuse the authorized entities, or vice versa, of signing.

Proof. 

The signature contains the blinded proof $\pi +r$. Only authorized entities can correctly decrypt

$$C_{\mathsf{CP}-\mathsf{ABE}}=\mathsf{CP}-\mathsf{ABE}.Encrypt(s{k}^{\prime },\delta ,r)$$

to obtain the blinding factor r. Thus, authorized entities can recover

$$\pi =(\pi +r)+(-r),y=(y+r)+(-r).$$

Because y corresponds to the entity identity, authorized entities can obtain the identity of the signer or modifier. To prevent authorized entities from impersonating the original signer, the verifier first computes $H\left(m\right)$ in Verify and checks whether it equals $H\left(m\right)$ in ${\mathsf{Sig}}^2$. If they are not equal, the data has been modified. The verifier then checks whether $y+r$ in ${\mathsf{Sig}}^2$ equals the corresponding value in ${\mathsf{Sig}}^1$. If they are equal, the modifier is trying to impersonate the original signer, so the verifier returns ⊥. Therefore, only authorized entities can extract the last modifier’s identity from any valid signature, and neither party can falsely accuse the other of signing. □

5.2. Performance Evaluation

In this section, we first compare the functionality of the proposed scheme with several related schemes, and then perform an experimental analysis of the computational burden of our scheme and the related schemes [4, 5, 23].

5.3. Functionality Comparison

We compare the functionality of the proposed scheme with the related schemes [4, 6, 9, 16, 17, 21–23]. As shown in Table 3, only our scheme satisfies all the following properties: fine-grained access control, unforgeability, transparency, accountability, privacy-preserving and friendly to resource-constrained users. The remaining schemes are all unfriendly to resource-constrained users where schemes [16], [17] and [22] do not support transparency, and only scheme [4] supports accountability except our scheme.

5.4. Performance Analysis and Comparison

5.4.1. The Comparison of Storage Space

We define the following notations for the comparison. Let $L(·)$ denote the length of the input element. Let $N=p_1·p_2$, where $p_1$ and $p_2$ are two prime numbers. Let $e_1$ be a random number such that $e_1=1mod(p_1-1)(p_2-1)$, and let $e_2$ be a number such that $e_1·e_2=1mod(p_1-1)(p_2-1)$. Let $n_1$ and $n_2$ denote the row and column numbers of the monotonic span matrix of the access control policy A, respectively. Let $s{k}_{DS}$ and $S_{DS}$ denote the private signing key and the signature of the standard digital signature scheme.

The concrete instantiation of the standard digital signature is not given in [4]. Here, p is the large prime number used in [4] and $\pi$ is a proof. Finally, $\left|S\right|$ denotes the number of attributes in the attribute set S. From Table 4, the scheme in [5] has the shortest signing-key length, while our scheme has the shortest signature length. Schemes in [5] and [23] cannot support fine-grained access control. Our scheme has smaller key length and signature length compared with the scheme in [4], since $L\left(S_{DS}\right)+L\left(p\right)+L\left(\pi \right)\ge 2L\left(G\right)$ generally. Hence, in terms of storage space overhead, our scheme is efficient.

5.4.2. The Comparison of Computation Overhead

In this subsection, we set the number of users from 50 to 500 and the health-data size from 0 to 50 MB, and conduct the performance evaluation. We further compare our scheme with the schemes in [4,5,23]. The simulation experiments were written in C++ with Pairing-based Cryptography (PBC) version 0.5.14 [29] and GNU Multiple Precision Arithmetic (GMP) [30]. The desktop was equipped with an Intel Core (TM) i5-4300 CPU @ 2.13 GHz and 8.0 GB RAM, and the size of elements in ${\mathbb{Z}}_p^{*}$ was 160 bits. The KGenS, Sign, SignChg, and Verify phases were evaluated while the health-data size ranged from 0 to 50 MB and $N_U$ ranged from 50 to 500, where $N_U$ denotes the number of users. When $N_U$ ranges from 50 to 500, the computational time of KGenS has a linear relationship with $N_U$ and is independent of the health-data size, as shown in Figure 3. Let $N_S$ denote the number of signatures. When $N_S$ ranges from 50 to 500, the computational times of Sign, SignChg, and Verify also have linear relationships with $N_S$, as shown in Figure 3. For the performance comparison, Figure 4 shows that, when $N_S$ ranges from 0 to 200, the KGenS algorithms of the schemes in [4] and [23] vary from 0 ms to 88.59 ms, while [5] varies from 0 ms to 20.45 ms and our scheme varies from 0 ms to 22.34 ms. The Sign algorithms of [4] and [23] vary from 0 ms to 0.128 s and 0.119 s, respectively, while [5] varies from 0 ms to 0.025 s. For SignChg, the schemes in [4] and [23] vary from 0 ms to 0.109 s and 0.096 s, respectively, while [5] and our scheme vary from 0 ms to 0.042 s and 0 ms to 0.089 s, respectively. For Verify, the schemes in [23] and [5] vary from 0 ms to 8.04 ms and 6.02 ms, respectively, [4] varies from 0 ms to 4.32 ms, and the proposed scheme takes the shortest time because it outsources the time-consuming pairing operations to two cloud servers. As a result, the verifier only needs to perform three multiplication operations for each pairing operation, which is particularly useful when verification is performed by sensor gateways, mobile edge devices, or wearable healthcare terminals with limited computation and energy budgets.

6. Conclusions

In this paper, we proposed a fine-grained and flexible dual authentication scheme for IoT-connected healthcare sensor networks. The proposed scheme supports fine-grained access control, allowing users and medical institutions to specify who can modify signed data and which parts may be modified through a fine-grained access control policy. The scheme also supports privacy preserving and accountability: transmitted healthcare data contain no personal information, and only authorized entities can trace the modifier and the original signer of signed data. These properties are important when health data and diagnoses are forwarded through wearable sensors, sensor gateways, edge nodes, cloud servers, and multiple medical institutions. To further reduce the computational overhead for resource-constrained sensor and IoT participants, we proposed a verifiable outsourced authentication scheme that outsources expensive pairing operations to two mutually distrusted cloud servers. In this way, the verification process only needs to perform six multiplication operations. Therefore, the proposed scheme provides a lightweight privacy-preserving authentication layer for trustworthy healthcare sensing and medical data exchange.