CS authentication of our proposed system is $E^{LN-to-CS}$. We have:

$\displaystyle Pr[E^{H_{SK}}]$ $\displaystyle=Pr[E^{H_{SK}}\wedge
E^{Test(LN)}]\ $ $\displaystyle+Pr[E^{H_{SK}}\wedge E^{Test(CS)}\wedge E^{(LN-
to-CS)}]\ $ $\displaystyle+Pr[E^{H_{SK}}\wedge E^{Test(CS)}\wedge\neg E^{(LN-
to-CS)}]\geq\epsilon/2$

and

$\displaystyle Pr[E^{H_{SK}}\wedge E^{Test(LN)}]$
$\displaystyle+Pr[E^{H_{SK}}\wedge E^{Test(CS)}\wedge\neg E^{(LN-to-CS)}]\ $
$\displaystyle\geq\frac{\epsilon}{2}-Pr[E^{H_{SK}}\wedge E^{Test(CS)}\wedge
E^{(LN-to-CS)}]\ $ $\displaystyle\geq\frac{\epsilon}{2}-Pr[E^{(LN-to-CS)}]$

As the events $E^{Test(CS)}\wedge\neg E^{(LN-to-CS)}$ and $E^{Test(LN)}$ are
equivalent, we have:

$\displaystyle Pr[E^{H_{SK}}\wedge E^{Test(LN)}]$
$\displaystyle\geq\frac{1}{2}\left(\frac{\epsilon}{2}-Pr[E^{(LN-to-
CS)}]\right)$

Therefore, we conclude that:

$\displaystyle Pr[t=H_{5}(ID_{LN}||ID_{CS}||T_{CS}||X||Y)|X,Y]\geq\epsilon$

Lemma 8.7 shows that $Pr[E^{LN-to-CS}]$ is negligible. Then, we obtain:

$\displaystyle Pr[t=H_{5}(ID_{LN}||ID_{CS}||T_{CS}||X||Y)|X,Y]\geq\epsilon$

Suppose $X=xP$ and $Y=yP$, where $x,y\in\mathbb{Z}_{q}^{*}$. On the given CDH
assumption tuple $<X,Y>=<xP,yP>$, $Adv$ must be able to compute $K=xY=yX=xyP$.
$C$ uses $A$ to solve the CDH problem with a non-negligible advantage
$\epsilon_{0}\geq\frac{1}{2}\left(\frac{\epsilon}{2}-Pr[E^{LN-to-CS}]\right)$
to solve it. Therefore, we have proven that our proposed IBAAKA scheme is AKA-
secure. ∎

####  7.3.3 Security Discussion

The proposed IBAAKA protocol achieves the following security properties:

  * •

Mutual authentication. In our proposed scheme, LN computes the
$\mathbb{G}_{SL}=x(R_{CS}+H_{1}(ID_{CS}||R_{CS})P_{0})$,
$h=H_{2}(ID_{LN}||R_{LN}||T_{LN}||X)$ and $k=s_{LN}+xh$ using its private key
$s_{LN}$ and encrypts
$W=H_{3}(\mathbb{G}_{L}N)\oplus(ID_{LN}||R_{LN}||T_{LN}||X||k)$. No one other
than LN could have knowledge of its private key. The CS then computes the
decryption key $\mathbb{G}_{CS}=s_{CS}X$ and decrypts $W$ using key
$\mathbb{G}_{CS}$ as
$ID_{LN}||R_{LN}||T_{LN}||X||k=H_{3}(\mathbb{G}_{CS})\oplus W$. Now, CS
verifies the authenticity of LN by checking whether the equation
$kP\overset{?}{=}R_{LN}+H_{1}(ID_{LN}||R_{LN})P_{0}+hX$ holds. On CS side, CS
compute sets $Y=yP$ and $t=H_{5}(ID_{LN}||ID_{CS}||T_{CS}||X||Y)$,
$key_{CS}=ytX$ and $SK_{CS}=H_{6}(key_{CS}||ID_{LN}||ID_{CS}||Y||X)$. LN
checks the timestamp $T_{CS}$ and check whether the equation
$t\overset{?}{=}H_{5}(ID_{LN}||ID_{CS}||T_{CS}||X||Y)$ holds and computes the
session key as $key_{LN}=xtY$ and
$SK_{LN}=H_{6}(key_{LN}||ID_{LN}||ID_{CS}||Y||X)$. In addition, Theorem 8.9
proves mutual authentication of the proposed IBAAKA scheme for WBAN.
Therefore, the protocol provides mutual authentication.

  * •

User anonymity. User anonymity ensures that the user’s real identity remains
hidden except for the CS and NM. In our proposed scheme, LN’s identity
$ID_{LN}$ is encrypted in login parameters $W$. To reveal the real identity of
the LN, the adversary has to generate the CS’ private key $s_{CS}$, equivalent
to solving the CDH problem. Thus, an adversary could not identify the real
identity of LN. Thus, the protocol achieves sensor/LN anonymity.

  * •

Session key security. In an authentication phase of the proposed anonymous
authentication protocol, LN and CS agreed on the shared session key SK. The
session key security depends on the ECDL problem and ensures that the session
key will not be broken.

  * •

Untraceability. In the proposed protocol, the exchange parameters that is
$<W,X>$ and $<t,T_{CS},Y>$ are based on the random numbers $x$ and $y$.
Therefore, each new session entity chooses unique $x$ and $y$, so these
parameters are different for each session. For two different session
parameters, the adversary $A$ cannot find any relationship among these
parameters nor trace the sensor activity. Therefore, the proposed scheme
achieves the untraceability property.

  * •

Perfect forward secrecy. Suppose adversary $A$ has the private key of LN and
CS and also $A$ has the intercepted message $<W,X>$ and $<t,T_{CS},Y>$. From
these given parameters, an adversary could not compute the random numbers x
and y to get the session key
$SK=SK_{CS}=H_{5}(key_{CS}||ID_{LN}||ID_{CS}||Y||X)=SK_{LN}=H_{5}(key_{LN}||ID_{LN}||ID_{CS}||Y||X)$,
an adversary requires $key_{CS}=ytX$ or $key_{LN}=xtY$ which is hard to
compute if he/she does not know the random element $x$ and $y$. Therefore,
under the CDH assumption, the proposed scheme provides forward-perfect
secrecy.

  * •

Stolen verifier attack. The CS has not any information related to any LN for
mutual authentication. So, there is no information to be stolen. Thus, the
scheme is secure against the stolen verifier attack.

  * •

LN Impersonation attack. To impersonate a sensor LN, the adversary must
generate an actual login parameter $<W,X>$, such that W is encryption of
$(ID_{LN}||R_{LN}||T_{LN}||X||k)$ and $k$ is signature on
$ID_{LN}||R_{LN}||T_{LN}||X$ using LN’s private key $s_{LN}$. It is hard for
an adversary to produce the same signature without LN’s private key; hence it
cannot impersonate the leaf node LN.

  * •

CS impersonation attack. To login the phase, LN encrypts
$(ID_{LN}||R_{LN}||T_{LN}||X||k)$ using $\mathbb{G}_{LN}$ which is derived
from the random of LN and CS’s identity. Without knowing CS’s private key
$s_{CS}$, the adversary cannot decrypt the $ID_{LN}$ and $X$ from the login
parameters. Thus, he cannot generate the correct value of $t$. Thus, the
adversary cannot impersonate the CS.

  * •

Man-in-the-middle attack. In our proposed protocol, CS decrypts the login
parameter W using its private key to authenticate the leaf node’s ID. By doing
so, CS extracts the LN’s identity $ID_{LN}$ and $R_{LN}$. Without knowing the
private key of CS, it is hard for an adversary to produce the message by
itself. Therefore, the protocol is secure against the man-in-the-middle (MITM)
attack.

Security comparison. Table 7.1 compares the proposed IBAAKA scheme and other
related schemes such as Liu et al. scheme [117], He et al. scheme [67], Wang
and Zhang’s [164], Jiang et al. scheme [75] and Jia et al. scheme [74] in
terms of security properties. We denote “Y” and “N” to represent whether the
protocol fulfils the corresponding security property. Table 7.1 shows that the
proposed IBAAKA scheme achieves the required security properties.

Table 7.1: Security Comparison Security requirements | [117] | [67] | [164] | [75] | [74] | IBAAKA
---|---|---|---|---|---|---
MA | N | N | N | Y | Y | Y
User anonymity | N | N | Y | Y | Y | Y
Session key security | Y | Y | Y | Y | Y | Y
Untraceability | N | Y | Y | Y | Y | Y
Perfect forward | N | Y | Y | Y | Y | Y
Probable security | N | Y | Y | Y | Y | Y
MITM attack | Y | Y | Y | Y | Y | Y
Impersonation attack | N | Y | N | Y | Y | Y
Key replacement | N | N | N | N | Y | Y
User revocation | N | N | N | N | N | Y

####  7.3.4 Performance Evaluation of OR-3PID-KAP

We now compare our proposed protocol with other related schemes [170] and
[171] in terms of computational cost (in operations), execution cost (in ms)
and bandwidth cost (in Bytes). To achieve 1024-bit RSA level security for
pairing-based cryptosystem, we found that the TinyPBC library, which has an
efficient implementation over binary fields $F_{(}2^{m})$ with 80-bit security
[172] which is written in C language and running on TinyOS operating system
and MICAs sensor user. MICA has only 4KB RAM, 128KB ROM, and an
8-bit/7.3828-MHz ATmega128L microcontroller. The running cost of operations
and their notations are shown in Table 7.2.

Table 7.2: Notation and Execution time of pairing-related operations on MICAs [172] Operations | Notation | Execution cost (sec)
---|---|---
Hash-to-Point | H | 0.89
Point Compression | PC | 0.38
Point Decompression | PD | 0.38
Scalar point multiplication | E | 2.45
Pairing | P | 5.32

We ignore the computation cost of the hash function operation as it takes less
comparison cost than bilinear pairing operations. We focus on pairing
operations, scalar multiplication on an elliptic curve, and scalar
multiplication on pairing for approximation performance. We then examine the
comparison of our scheme with related schemes in terms of computational cost
(running in a sec),

Table 7.3: Computational and execution cost comparison of our proposed scheme with other related schemes Schemes | Computational Cost | Execution cost (sec) | Bandwidth (Bytes) | #Round
---|---|---|---|---
[170] | $2P+7E+2Ex$ | 38.43 | (2*80+16)/8 = 22 | 6
[171] | $P+5E+Ex$ | 22.89 | (2*80+16)/8 = 22 | 6
Our Scheme | $P+E$ | 7.77 | (2*80+16)/8 = 22 | 1

In Table 7.3, the reader can see that the proposed scheme takes only two
multiplication operations on an elliptic curve executed in (5.32 +2.45) = 7.77
sec while [[170] and [171] take 38.43 sec and 22.89 sec respectively. That
means our proposed scheme is 20.21% and 33.94% of [170] and [171]
respectively, in terms of computational running time.

We assume the size of the user identity is 16-bit and the order of the
elliptic curve group is 80-bit. As shown in Table 7.3, we show that similar to
[170] and [171], our proposed scheme consumes (2*80+16)/8 = 22 bytes of
channel bandwidth during the key establishment completion. Further, it can be
seen that our protocol completes in one round while [170] and [171] take six
rounds.

Table 7.4: Security comparison of the proposed scheme with other schemes

Schemes | PS@ | PFS# | MA## | MIMAR@@ | KCIR& | KCR∗ | KSKS& | UKR${}^{\&}\&$
---|---|---|---|---|---|---|---|---
[170] | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\checkmark$ | $\checkmark$ | $\checkmark$
[171] | $\checkmark$ | $\times$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\checkmark$
Our Scheme | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\checkmark$

@One Provable security, #perfect forward security, ## Mutual authentication,
@@ man-in-the-middle attack resilience, & key compromised impersonation
resilience, ∗key control resilience. &known session key security.
${}^{\&}\&$unknown key share resilience

Table 7.4 compares our scheme with [170] and [171] in terms of the following
security notions: Provable security, PFS: perfect forward security, mutual
authentic-cation, man-in-middle attack resilience, key compromised
impersonation resilience, key control resilience, the known session key
security, unknown key share resilience. Similar [170] and [171], our protocol
also achieves all security notions.

####  7.3.5 Performance Evaluation of IBAAKA

This section illustrates the performance of the proposed IBAAKA scheme for
WBAN systems in the cloud environment and compares it with other related
systems such as Liu et al. scheme [117], He et al. scheme [67], Wang and
Zhang’s [164], Jiang et al. scheme [75] and Jia et al. scheme [74], in terms
of computational cost and communication cost. To simulate the proposed IBAAKA
schemes, we experiment on Acer E5-573-5108 laptop with Intel(R) Core(TM)
i5-5200U<EMAIL_ADDRESS>GHz and 8 GB RAM on Window 10. We consider the evaluation of
operations on super-singular curve $y^{2}+y=x^{3}+x$ having embedding degree 4
and use the eta pairing $\eta_{T}:E(F_{2^{271}})\times
E(F_{2^{271}})\rightarrow E(F_{2^{4.271}})$. To analyse the performance of the
proposed scheme, we take the following cryptographic operations: scalar
multiplication on an elliptic curve, point addition on an elliptic curve,
pairing operation on two points on an elliptic curve, pairing exponentiation,
map-to-point hash function, modular inversion and modular-multiplication
operations, which we represented by $T_{SM},T_{A},T_{P},T_{E}$, $T_{H}$,
$T_{I}$ and $T_{M}$ respectively. We run the various cryptographic operations
over a bilinear pairing group and consider the average of 10 succeeding
results using the PBC library [121]. We estimated that
$1T_{P}=3T_{SM}=87T_{M}$, $T_{E}=21T_{M}$, $T_{H}=23T_{M}$, $T_{I}=11.6T_{M}$,
and $T_{A}=0.12T_{M}$. Table 7.5 abstracts the notations and computation cost
(in msec) of required cryptographic operations.

Table 7.5: Notations and computation cost (in msec) of different cryptographic operations Operations | Notation | Execution time (ms)
---|---|---
Modular multiplication | $T_{M}$ | 0.027
ECC-based multiplication | $T_{S}M$ | 0.304
ECC-based Point addition | $T_{A}$ | 0.001
Exponentiation | $T_{E}$ | 0.297
Inversion | $T_{I}$ | 0.008
Map-to-point hash | $T_{H}$ | 0.319
Bilinear pairing | $T_{P}$ | 2.373
Table 7.6: Computational cost (in msec): comparative summary Schemes Computational cost (msec) Schemes | Sensor/Client/LN | Application provider/CS
---|---|---
[117] |  $4T_{SM}+1T_{E}$ (1.513) |  $1T_{SM}+1T_{P}+1T_{E}$ (2.974)
[67] |  $4T_{SM}+1T_{H}$ (1.535) |  $4T_{SM}+2T_{P}+1T_{H}$ (6.281)
[164] |  $3T_{SM}+1T_{P}+2T_{H}$ (3.923) |  $2T_{SM}+1T_{P}+2T_{H}$ (3.618)
[74] |  $4T_{SM}+1T_{E}$ (1.513) |  $4T_{SM}+2T_{P}+2T_{E}$ (6.556)
[153] |  $3T_{SM}+1T_{M}$ (0.939) |  $6T_{SM}+1T_{M}$ (1.851)
[132] |  $3T_{SM}+2T_{M}$ (0.966) |  $4T_{SM}+2T_{A}$ (1.218)
Our |  $3T_{SM}+2T_{M}$ (0.966) |  $5T_{SM}$ (1.52)

Now, we evaluate the computational cost of our proposed IBAAKA protocol and
other related schemes such as Liu et al. scheme [117], He et al. scheme [67],
Wang and Zhang’s [164], Jiang et al. scheme [75], Jia et al. scheme [74] and
[132] schemes, as shown in Table 7.6. The table shows that on the
client/sensor side, Liu et al. scheme [117] needs 1.513 ms, He et al. scheme
[67] needs 1.535ms, Wang et al. scheme [164] needs 3.923 ms, Jia et al. scheme
[74] needs 1.513 ms, Sowjanya et al. scheme [153] needs 0.939 ms, and
Nikooghadam et al. [132] needs 0.966 ms while the proposed IBAAKA protocol
needs 0.966 ms. On the application provider/CS side, Liu et al. scheme [117]
needs 2.974 ms, He et al. scheme [67] needs 6.281ms, Wang et al. scheme [164]
needs 3.618 ms, Jia et al. scheme [74] needs 6.556 ms, Sowjanya et al. scheme
[153] needs 1.218 ms, and Nikooghadam et al. [132] needs 1.52 ms while the
proposed IBAAKA protocol needs 1.52 ms. The total computation costs of Liu et
al. [117], He et al. [67], Wang et al. [164], Jia et al. [74], Sowjanya et al.
[153] and Nikooghadam et al. [132] and the proposed IBAAKA schemes are 4.487
ms, 7.816 ms, 7.451 ms, 8.069 ms, 2.79 ms, 2.184 ms and 2.486 ms,
respectively. Thus, our proposed protocol has the least computation cost on
the sensor side than other protocols, shown in Table 7.6 anf Figure (7.3).

In order to achieve a trusted tight level of security, we consider the
supersingular curve $E(\mathbb{F}_{p})$ of order $q$ over a finite field
$\mathbb{F}_{p}$, where $p$ and $q$ are two prime numbers, such that $|p|$
=512 and $|q|$=160 bits, respectively. The size of $\mathbb{G}_{1}$,
$\mathbb{G}_{2}$ and $\mathbb{Z}_{q}$ are 1024, 512 and 160 bits respectively.
For evaluating communication overhead, we consider the size of timestamp and
identity as 2 bytes, i.e., $|T|$ = $|ID|$ =16 bits. Therefore, Liu et al.
scheme [117] requires transmitting 3408 bits, He et al.’s scheme [67] requires
transmitting 4288 bits, Wang et al.’s scheme [164] requires transmitting 3296
bits, Jiang et al.’s scheme [75], requires to transmit 2424 bits, Jia et al.’s
scheme [74] requires to transmit 5328 bits, and our scheme requires to
transmit 3440 bits during authentication (see in Table 7.7) and Figure (7.4).

Figure 7.3: Computational cost comparison of proposed IBAAKA with other related schemes Figure 7.4: Communication cost comparison of proposed IBAAKA scheme with other schemes Table 7.7: Computational cost (in msec): comparative summary Schemes | Computational cost (msec)
---|---
[117] |  $1|T|+3|\mathbb{G}_{1}|+2|\mathbb{Z}_{q}|$ (3408)
[67] |  $1|ID|+1|T|+4|\mathbb{G}_{1}|+1|\mathbb{Z}_{q}|$ (4288)
[164] |  $1|ID|+3|T|+3|\mathbb{G}_{1}|+1|\mathbb{Z}_{q}|$ (3296)
[74] |  $1|ID|+2|T|+5|\mathbb{G}_{1}|+1|\mathbb{Z}_{q}|$ (5328)
[153] |  $3|T|+6|\mathbb{G}_{1}|+3|\mathbb{Z}_{q}|$ (6672)
[132] |  $2|T|+3|\mathbb{G}_{1}|+1|\mathbb{Z}_{q}|$ (3264)
Our |  $1|ID|+2|T|+3|\mathbb{G}_{1}|+2|\mathbb{Z}_{q}|$ (3440)

###  7.4 Summary

In this chapter, we have presented two key authenticated agreement protocols
that are designed specifically for the WBAN system operating in a cloud-
assisted environment. The first protocol we proposed is a three-party
authenticated key agreement protocol that facilitates the computation of a
secret shared key between three leaf nodes within the WBAN network. The second
protocol we proposed is an efficient identity-based anonymous authentication
and key agreement (IBAAKA) scheme that enables mutual authentication between
the leaf node and cloud server and facilitates the generation of a session key
between them. Our proposed IBAAKA scheme guarantees the anonymity of the
user’s identity except for the network manager in the registration phase. We
have conducted a comprehensive security analysis of our protocols, and we have
shown that they are secure under the random oracle model and CDH assumption.
When compared to other existing protocols, our schemes have the least
computation cost and comparable communication cost. Therefore, our protocols
offer a highly efficient solution for authenticated key agreements in the WBAN
system, which is of utmost importance in ensuring the security and privacy of
the users’ sensitive health data.

[75mm] Cultivation of mind should be the ultimate aim of human existence.
Bhimrao Ramji Ambedkar

##  Chapter 8 Conclusion

In this thesis, we survey the mathematics underlying elliptic curves and
paring-friendly elliptic curves and their benefits in several emerging
internet technology. In particular, we discussed that the most famous families
of pairing-friendly elliptic curves, such as BN, BLS12, BLS24, KSS16, and
KSS18, are vulnerable to the recent Tower Number Field Sieve (TNFS) and its
variants attack. Therefore, we compared and estimated the practical security
of several families of pairing-friendly curves. We found those families of
curves better than BN, KSS, and BLS in terms of the required key size.

After investigating the pairing-friendly curves, we discussed the key-escrow
and its by-product problems associated with identity-based cryptosystems, one
of the widely accepted applications of pairing-based cryptosystems. We gave an
overview of solutions to these problems and proposed an efficient and secure
key issuing scheme. Thereby, demonstrating that they are feasible to escrow-
free identity-based encryption that is secured against confidentiality and
escrow-free identity-based signature scheme that is forgeable secured.

We further discussed the security inconsistencies of the electronic voting
system (EVS) and proposed two efficient identity-based blind signature (IDBS)
schemes: IDBS-I and IDBS-II, secured against the existential forgery attack.
We design a state-of-the-art End-to-End verifiable internet voting (E2E-VIV)
system whose security is defined by the IDBS-II scheme. The performance
analysis demonstrated that the E2E-VIV system is efficient and secured against
the required security goals on comparing the related schemes. It also allows
batch verifiability to verify multiple ballots and vote ballots
simultaneously.

In the subsequent work of the thesis, we discussed data outsourcing on cloud
storage, wherein we found that it is challenging to audit the integrity of
data on cloud storage for resource-constraint devices. Therefore, we presented
an identity-based blind signature with a message recovery (IDBS-MR) scheme and
formulated its security. The system is secured against an existential forgery
attack under the adaptive chosen message and ID attacks (EF-ID-CMA) and ECDL
problems. Further, we have presented a privacy-preserving data outsourcing
mechanism that audits the integrity of stored data for resource-limited
devices in cloud computing using the proposed IDBS-MR scheme.

Additionally, we discussed some security issues associated with two emerging
areas: video-on-demand streaming with an untrusted service provider and the
eHealth care system. We presented an escrow-free identity-based signcryption
(EF-IDSC) to address the first issue and implement a secure peer-to-peer
video-on-demand (P2P-VoD) streaming system, whose security is based on the
proposed EF-IDSC scheme. To address the latter issue, we proposed escrow-free
identity-based aggregated signcryption (EF-IDASC) schemes and implemented a
secure cloud-assisted healthcare system that achieves public verifiability
based on the IDASC scheme. Both systems are secured toward confidentiality and
forgeability attacks.

Finally, we proposed two identity-based authenticated key agreement protocols
to obtain a secure session key in the health care system. In this work, we
have first proposed a one-round, three-party authenticated ID-based key
agreement protocol (OR-3PID-KAP) whose security is based on solving ECDLP and
BDHP. Compared to the related schemes, the proposed system has the least
computational cost, bandwidth cost, and message exchange. Second, we proposed
an identity-based anonymous authentication and key agreement (IBAAKA) protocol
for WBAN in the cloud-assisted environment, which achieves mutual
authentication and user anonymity.

###  8.1 Contribution in COVID-19

An emerging infectious disease, coronavirus disease 2019 (COVID-19), has been
reported in Wuhan, China, and subsequently spread worldwide within a couple of
months. We have observed that the rate of infected patients is overwhelmed by
the limited medical institutions, which can be addressed and solved using
emerging digital technologies. Inspired by this problem, we have worked on
COVID-19 and proposed a state-of-art privacy-preserving medical data-sharing
system based on Hyperledger Fabric (MedHypChain) and regularised it to
implement the patient-centred interoperability healthcare system. We have
analyzed the performance of MedHypChain in three metrics (latency time,
execution time, and throughput) for up to 20 permissioned nodes. At last, we
compare MedHypChain with new blockchain-based healthcare systems in terms of
time, communication, and high-level security features and found that
MedHypChain achieves all security features. Here, we give a brief overview of
the model.

####  8.1.1 Network Model

Our proposed MedHypChain system consists of the following participants:
Network Administrator (NA), Client, Personal Digital Assistant (PDA),
Permissioned Peer (PP), and Tracing Agent (TA).

  * •

NA: It is a trusted entity responsible for registering other participants in
the network. Any Client, PDA, or PP must obtain credentials (key information)
from NA before joining the proposed network. NA will play the same role as MSP
in Hyperledger Fabric but does not manage peers’ identities.

  * •

Client: A client is a user or organization who wishes to use the ledger
service. Each client owns the credential obtained from NA for achieving
secure, anonymous, and traceable data.

  * •

PDA. It is a centralized device (e.g., smartphone) with adequate computation
power and storage but is not trustworthy as it is easy for any adversary to
retrieve the patient’s sensitive data by physically stealing the phone or
statistical attack on it. It can collect the data from the client securely,
verify it without knowing anything about the data, and aggregate it in its
storage. Besides, the PDA installed a fabric software development kit (SDK)
that allows it to interact with the Fabric blockchain and provides a simple
API to query data from the ledger and submit the transition to a ledger.

  * •

PP: The authorized entities responsible for managing, processing, and
maintaining transactions. We adopt execute-order-validate architecture and
classify it into Endorsing and ordering peer (E&OP) and committing peer (CP).
The E&CP is accountable for endorsing the transaction using chaincode (smart
contract) and updating the block in the ledger notifying the user, while OP is
accountable for ordering the endorsed transactions PBFT consensus protocol.

  * •

TA: It is a trusted entity and is accountable for tracking users’ malicious
behaviour and revocation. It possesses the account’s address and password
$(add_{t},pwd_{t})$ and the private key $sk_{t}$ corresponding to its identity
$ID_{t}$. Also, it has an extra tracing key to accomplish its responsibility.

####  8.1.2 System Components

The main idea of the proposed MedHypChain model is to design a platform for
patient-centric health record sharing in the COVID-19 crisis among the
participants anonymously, securely, accurately and efficiently. We employ a
permissioned blockchain via Hyperledger that will preserve the privacy and
confidentiality of data by adopting suitable encryption and access control
schemes.

The proposed MedHypChain model mainly consists of the following phases:
Initialization, Registration, Transaction, Transition, Chaining and Tracing,
as defined below.

  * •

$(msk,pp)\leftarrow Initialization(1^{k})$. This initialization phase will
respond to a public parameter $pp$ and master key msk according to the input
security parameter $k$.

  * •

($add_{i},psw_{i},sk_{i})\leftarrow Registeration(msk,pp,ID_{i})$It allows the
participants to registers their account address $add_{i}$ and account password
$pwd_{i}$. Also, it generates a private key $sk_{i}$ corresponding to the
participant’s $ID_{i}$.

  * •

$(\sigma_{p},Cx,add_{p})\leftarrow TranPrsl(data,pws_{s},sk_{s},RS)$. It
signcrypts data using the sender’s private key $sk_{s}$ and set of recipient
identities $RS={ID_{1},ID_{2},...,ID_{n}}$ and outputs the signcrypted data
Cx.

  * •

$\\{0\text{abort},1/(\sigma_{e},Tx,add_{e})\\}\leftarrow
Endorse(\sigma_{p},Cx,add_{p},pws_{e})$. This phase allows the PP to
unsigncrypt the transaction $C_{x}$ using his private key $sk_{pp}$
corresponding to identity $ID_{pp}\in RS$, validate the transaction $Tx$ using
$add_{p}$, sign it with its private key $pwd_{p}$.

  * •

$\\{0,1\\}\leftarrow Ordering(\sigma_{e},Tx,add_{e})$. It verifies the
signature $\sigma_{e}$ using $add_{e}$, validates the transaction using the
PBFT consensus mechanism, and orders the valid transaction $Tx$.

  * •

Commit&Update(Tx). It validates each transaction in a block, updates the
blocks in the ledger and notifies the sender.

  * •

$ID\leftarrow Tracing(sk_{ta},Tx)$. This allows TA to trace the actual
identity of any malicious transaction. It takes TA private key $sk_{ta}$,
malicious transaction $Tx$ and outputs the user’s identity $ID_{i}$.

####  8.1.3 Regulation of MedHypChain for Patient-Centred Interoperability

Here, we will discuss how the proposed MedHypChain regularizes constructing a
private patient-centred care blockchain network in which the data as a
transaction is accessible to authorized MS. The proposed patient-centred
interoperability healthcare system consists of four participants: NA, Patient,
and medical server (MS) implemented under the framework of the proposed
MedHypChain. The NA is the same in MedHypChain, and the patient and MS are the
two organizations that interoperability manages the patient PHI, record in the
ledger, and share over MedHypChain. A patient is a person who has been seen as
a symptom of coronavirus or a quarantined person who has a chance of disease.
Each patient is surrounded by WBAN, which comprises various tiny sensors with
limited battery life and storage space, installed on/outside the patient’s
body (wearable sensors) or deployed in the patient’s tissues (implanted
sensors). It collects the patient’s PHI data, and due to a limited
broadcasting range, it stores PHI in a personal assisted device (PDA). For
simplicity, we use smartphones as PDAs with the same functionality as the
given PDA in MedHypChain, a network coordinator that helps WBAN communicate
with the blockchain network. The MS is a device in the medical institution
which can access the patient’s PHI and diagnoses the patient’s diseases based
on their resulting PHI.

Each patient manages two blockchains: patient-data blockchain $B_{1}$, and
patient-prescription blockchain $B_{2}$. The first blockchain $B_{1}$ is
created by the patient that contains the patient’s health-related information,
such as a patient’s PHI, his identity, and the physician’s name. The
blockchain $B_{2}$ is created by the MS that contains the patient’s diagnosis-
related information, such as the identity of the physician assigned, PHI, and
prescription details. Similarly, MS maintains each patient’s blockchains
$B_{1}$ and $B_{2}$. The MS will access the patient’s PHI data if the patient
allows MS to access blockchain $B_{1}$. It will process the data on its server
and diagnose a patient remotely. On the flip side, patients via PDA will
access the blockchain $B_{2}$ and read the prescription Pr if the patient is
allowed to access blockchain $B_{1}$. The working of patient-centred health
interoperability is defined as follows.

A patient is surrounded by a WBAN, which includes various wearable, implanted,
or off-body sensors, each capable of sensing, processing, sampling, and
communicating the medical signal to the recipient. For instance, an EEG sensor
senses brain electrical activity and a breathing sensor senses respiration.
Various sensors sense the patient’s body and obtain the PHI $data_{i}$. Any
sensor (leader) aggregates the PHI data as $data=\sum data_{i}$ and retrieves
the current value of vrs from the world state that is maintained by its PDA
and proposes a transaction $Tx_{P}$ as
$Tx_{P}=(vrs+1)|(|data|)|RS|(|RW|)|CID||ESign_{pws_{s}}(data,vrs+1)||add_{s}$
via Transaction proposal. The sensor sends the transaction $Cx$ to the PDA,
where the PDA verifies the data via EVer and keeps the health data encrypted
so that PDA cannot access the data. PDA broadcasts $Cx$ to E&CP for endorsing
Endorsement. Now, E&CP runs the Inspection and ordering algorithm to validate
and order the transaction. If the transaction is valid, E&CP forwards the
transaction to PDA. The PDA passes the transaction to E&CP for validating the
transaction via Committing transaction. After commitment, E&CP appends the
block to the blockchain and notifies the PDA. In this way, patient PHI is
stored in the channel blockchain.

MS will access the transaction from the patient-created permissioned
blockchain if the patient permits. MS will access data and examine the PHI
data based on their experience. MS will suggest a prescription Pr (which
includes the instruction to the sensor to actuate as per their command) and
create a transaction Cx using the Transaction algorithm. Like patients, MS
will make their permissioned blockchain that blocks transactions. Each
transaction
$Cx=(vrs+1)|(|Pr|)|data|(|RS||RW|)|CID||ESign_{(}pws_{m})(data,vrs+1)||add_{m}$
is created under MS’s private key $sk_{m}$, similar to the patient side, which
consists of prescription Pr and patient’s PHI data. Accordingly, the
transaction is endorsed by E&CP via Endorsement, ordered by OP via Inspection
and order, and updated by CP via Committing in the blockchain. During
blockchain creation, if any participant doubts any illegal transaction in the
network, he can request the TA, where TA will trace the participant’s original
identity for an unlawful transaction via the Tracing algorithm.

Due to the lack of pages, we give only an overview of the model in this
chapter. The complete implementation is given in the full paper.

###  8.2 Future Directions

In the future, I am interested in working in post-quantum cryptography and
secure computation techniques (for example, homomorphic encryption and secure
multi-party computation).

  1. 1.

Post-quantum cryptography: Several scientists and researchers are developing
quantum-based computers that utilize quantum-mechanical phenomena like
superposition and entanglement. These computers have the potential to perform
complex computations incredibly quickly, such as solving number theory-based
mathematical problems using Shor’s algorithm. However, current quantum
computers lack the processing power to attack any real cryptographic systems.
Even so, researchers are continuously working on constructing and implementing
new algorithms for quantum computers, making it crucial to create a secure
cryptosystem against these attacks. This is where post-quantum cryptography
comes in. Post-quantum cryptography is a public-key cryptosystem that is
considered to be secure against attacks by quantum computers. Examples of
post-cryptosystem include lattice-based cryptosystems and NTRU. I am very
interested in working with the lattice-based cryptosystem after I complete my
PhD.

  2. 2.

Secure computation: I am also fascinated by the fields of Secure Multi-Party
Computation (MPC) and Homomorphic Encryption in the realm of cryptosystems.
MPC allows multiple parties to collaborate on computations without revealing
their inputs, making it ideal for secure voting and contract signing.
Meanwhile, Homomorphic Encryption enables computations on encrypted data,
which helps audit data on sensitive information. These areas interest me
greatly, and I am excited to contribute to their progress and explore their
potential.

## References

  * Abdulla and Bakiras [2019] Ahmed Khalil Abdulla and Spiridon Bakiras.  Hitc: Data privacy in online social networks with fine-grained access control.  In _Proceedings of the 24th ACM Symposium on Access Control Models and Technologies_ , pages 123–134, 2019.
  * Adida [2008] Ben Adida.  Helios: Web-based open-audit voting.  In _USENIX security symposium_ , volume 17, pages 335–348, 2008.
  * Al-Riyami and Paterson [2003] Sattam S Al-Riyami and Kenneth G Paterson.  Certificateless public key cryptography.  In _International conference on the theory and application of cryptology and information security_ , pages 452–473. Springer, 2003.
  * Ateniese et al. [2007] Giuseppe Ateniese, Randal Burns, Reza Curtmola, Joseph Herring, Lea Kissner, Zachary Peterson, and Dawn Song.  Provable data possession at untrusted stores.  In _Proceedings of the 14th ACM conference on Computer and communications security_ , pages 598–609, 2007.
  * Barbosa and Farshim [2008] Manuel Barbosa and Pooya Farshim.  Certificateless signcryption.  In _Proceedings of the 2008 ACM symposium on Information, computer and communications security_ , pages 369–372, 2008.
  * Barbulescu and Duquesne [2019] Razvan Barbulescu and Sylvain Duquesne.  Updating key size estimations for pairings.  _Journal of Cryptology_ , 32(4):1298–1336, 2019\.
  * Barreto and Naehrig [2005] Paulo SLM Barreto and Michael Naehrig.  Pairing-friendly elliptic curves of prime order.  In _International workshop on selected areas in cryptography_ , pages 319–331. Springer, 2005.
  * Barreto et al. [2002] Paulo SLM Barreto, Ben Lynn, and Michael Scott.  Constructing elliptic curves with prescribed embedding degrees.  In _International Conference on Security in Communication Networks_ , pages 257–267. Springer, 2002.
  * Barreto et al. [2003] Paulo SLM Barreto, Ben Lynn, and Michael Scott.  On the selection of pairing-friendly groups.  In _International workshop on selected areas in cryptography_ , pages 17–25. Springer, 2003.
  * Bellare et al. [2000] Mihir Bellare, David Pointcheval, and Phillip Rogaway.  Authenticated key exchange secure against dictionary attacks.  In _International conference on the theory and applications of cryptographic techniques_ , pages 139–155. Springer, 2000.
  * Bertino et al. [2004] Elisa Bertino, Barbara Carminati, Elena Ferrari, Bhavani Thuraisingham, and Amar Gupta.  Selective and authentic third-party distribution of xml documents.  _IEEE Transactions on Knowledge and Data Engineering_ , 16(10):1263–1278, 2004.
  * Boneh [1998] Dan Boneh.  The decision diffie-hellman problem.  In _International Algorithmic Number Theory Symposium_ , pages 48–63. Springer, 1998.
  * Boneh and Franklin [2001] Dan Boneh and Matt Franklin.  Identity-based encryption from the weil pairing.  In _Annual international cryptology conference_ , pages 213–229. Springer, 2001.
  * Boneh et al. [2001] Dan Boneh, Ben Lynn, and Hovav Shacham.  Short signatures from the weil pairing.  In _International conference on the theory and application of cryptology and information security_ , pages 514–532. Springer, 2001.
  * Bowe et al. [2017] Sean Bowe, Ariel Gabizon, and Ian Miers.  Scalable multi-party computation for zk-snark parameters in the random beacon model.  _IACR Cryptol. ePrint Arch._ , 2017:1050, 2017.
  * Brezing and Weng [2005] Friederike Brezing and Annegret Weng.  Elliptic curves suitable for pairing based cryptography.  _Designs, Codes and Cryptography_ , 37(1):133–141, 2005.
  * Cao et al. [2008] Xuefei Cao, Weidong Kou, Lanjun Dang, and Bin Zhao.  Imbas: Identity-based multi-user broadcast authentication in wireless sensor networks.  _Computer communications_ , 31(4):659–667, 2008\.
  * Cao et al. [2010] Xuefei Cao, Weidong Kou, and Xiaoni Du.  A pairing-free identity-based authenticated key agreement protocol with minimal message exchanges.  _Information Sciences_ , 180(15):2895–2903, 2010\.
  * Cerveró et al. [2014] M Àngels Cerveró, Víctor Mateu, Josep M Miret, Francesc Sebé, and Javier Valera.  An efficient homomorphic e-voting system over elliptic curves.  In _International Conference on Electronic Government and the Information Systems Perspective_ , pages 41–53. Springer, 2014.
  * Chaum et al. [2008] David Chaum, Aleks Essex, Richard Carback, Jeremy Clark, Stefan Popoveniuc, Alan Sherman, and Poorvi Vora.  Scantegrity: End-to-end voter-verifiable optical-scan voting.  _IEEE Security & Privacy_, 6(3):40–46, 2008\.
  * Chaum et al. [2009] David Chaum, Richard T Carback, Jeremy Clark, Aleksander Essex, Stefan Popoveniuc, Ronald L Rivest, Peter YA Ryan, Emily Shen, Alan T Sherman, and Poorvi L Vora.  Scantegrity ii: End-to-end verifiability by voters of optical scan elections through confirmation codes.  _IEEE transactions on information forensics and security_ , 4(4):611–627, 2009.
  * Chaum [1981] David L Chaum.  Untraceable electronic mail, return addresses, and digital pseudonyms.  _Communications of the ACM_ , 24(2):84–90, 1981\.
  * Chen et al. [2014] Chin-Ling Chen, Yu-Yi Chen, Jinn-Ke Jan, and Chih-Cheng Chen.  A secure anonymous e-voting system based on discrete logarithm problem.  _Applied Mathematics & Information Sciences_, 8(5):2571, 2014.
  * Chen et al. [2002] Liqun Chen, Keith Harrison, David Soldera, and Nigel P Smart.  Applications of multiple trust authorities in pairing based cryptosystems.  In _International Conference on Infrastructure Security_ , pages 260–275. Springer, 2002.
  * Chen et al. [2015a] Peixin Chen, Xiaofeng Wang, and Jinshu Su.  An escrow-free hierarchical identity-based signature model for cloud storage.  In _International Conference on Algorithms and Architectures for Parallel Processing_ , pages 633–647. Springer, 2015a.
  * Chen et al. [2015b] Peixin Chen, Xiaofeng Wang, and Jinshu Su.  T-hibe: a trustworthy hibe scheme for the osn privacy protection.  In _2015 International Symposium on Security and Privacy in Social Networks and Big Data (SocialSec)_ , pages 72–79. IEEE, 2015b.
  * Chen et al. [2015c] Peixin Chen, Xiaofeng Wang, Baokang Zhao, Jinshu Su, and Ilsun You.  Removing key escrow from the lw-hibe scheme.  In _International Conference on Algorithms and Architectures for Parallel Processing_ , pages 593–605. Springer, 2015c.
  * Chen et al. [2015d] Peixin Chen, Xiaofeng Wang, Baokang Zhao, Hao Sun, Jinshu Su, and Ilsun You.  An escrow-free hierarchical identity-based signature scheme from composite order bilinear groups.  In _2015 10th International Conference on Broadband and Wireless Computing, Communication and Applications (BWCCA)_ , pages 364–369. IEEE, 2015d.
  * Chen et al. [2016] Peixin Chen, Jinshu Su, Baokang Zhao, Xiaofeng Wang, and Ilsun You.  An escrow-free online/offline hibs scheme for privacy protection of people-centric sensing.  _Security and Communication Networks_ , 9(14):2302–2312, 2016.
  * Chillotti et al. [2016] Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachène.  A homomorphic lwe based e-voting scheme.  In _Post-Quantum Cryptography_ , pages 245–265. Springer, 2016.
  * Chondros et al. [2016] Nikos Chondros, Bingsheng Zhang, Thomas Zacharias, Panos Diamantopoulos, Stathis Maneas, Christos Patsonakis, Alex Delis, Aggelos Kiayias, and Mema Roussopoulos.  D-demos: A distributed, end-to-end verifiable, internet voting system.  In _2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS)_ , pages 711–720. IEEE, 2016.
  * Choon and Cheon [2003] Jae Cha Choon and Jung Hee Cheon.  An identity-based signature from gap diffie-hellman groups.  In _International workshop on public key cryptography_ , pages 18–30. Springer, 2003.
  * Chung and Wu [2009] Yu-Fang Chung and Zhen-Yu Wu.  Approach to designing bribery-free and coercion-free electronic voting scheme.  _Journal of Systems and Software_ , 82(12):2081–2090, 2009.
  * Chung et al. [2007] Yu Fang Chung, Kuo Hsuan Huang, Feipei Lai, and Tzer Shyong Chen.  Id-based digital signature scheme on the elliptic curve cryptosystem.  _Computer Standards & Interfaces_, 29(6):601–604, 2007.
  * Cocks and Pinch [2001] Clifford Cocks and RGE Pinch.  Identity-based cryptosystems based on the weil pairing.  _Unpublished manuscript_ , 170, 2001.
  * Cortier and Smyth [2013] Véronique Cortier and Ben Smyth.  Attacking and fixing helios: An analysis of ballot secrecy.  _Journal of Computer Security_ , 21(1):89–148, 2013.
  * Debiao et al. [2011] He Debiao, Chen Jianhua, and Hu Jin.  An id-based proxy signature schemes without bilinear pairings.  _Annals of telecommunications-annales des télécommunications_ , 66(11-12):657–662, 2011.
  * Deswarte et al. [2003] Yves Deswarte, Jean-Jacques Quisquater, and Ayda Saïdane.  Remote integrity checking.  In _Working conference on integrity and internal control in information systems_ , pages 1–11. Springer, 2003.
  * Diao et al. [2013] Lijuan Diao, Junzhong Gu, and I-Ling Yen.  A new proxy blind signature scheme with message recovery.  _Information Technology Journal_ , 12(21):6159, 2013.
  * Diffie and Hellman [1976] Whitfield Diffie and Martin Hellman.  New directions in cryptography.  _IEEE transactions on Information Theory_ , 22(6):644–654, 1976.
  * Dong et al. [2014] Guofagn Dong, Fei Gao, Wenbo Shi, and Peng Gong.  An efficient certificateless blind signature scheme without bilinear pairing.  _Anais da Academia Brasileira de Ciências_ , 86(2):1003–1011, 2014.
  * Dryło [2011] Robert Dryło.  On constructing families of pairing-friendly elliptic curves with variable discriminant.  In _International conference on cryptology in india_ , pages 310–319. Springer, 2011.
  * Dupont et al. [2005] Régis Dupont, Andreas Enge, and François Morain.  Building curves with arbitrary small mov degree over finite prime fields.  _Journal of Cryptology_ , 18(2):79–89, 2005.
  * ElGamal [1985] Taher ElGamal.  A public key cryptosystem and a signature scheme based on discrete logarithms.  _IEEE transactions on information theory_ , 31(4):469–472, 1985.
  * Elkamchouchi and Abouelseoud [2008] Hassan M Elkamchouchi and Yasmine Abouelseoud.  A new blind identity-based signature scheme with message recovery.  _IACR Cryptol. ePrint Arch._ , 2008:38, 2008.
  * Eslami and Pakniat [2014] Ziba Eslami and Nasrollah Pakniat.  Certificateless aggregate signcryption: Security model and a concrete construction secure in the random oracle model.  _Journal of King Saud University-Computer and Information Sciences_ , 26(3):276–286, 2014.
  * Fiandrotti et al. [2015] Attilio Fiandrotti, Rossano Gaeta, and Marco Grangetto.  Simple countermeasures to mitigate the effect of pollution attack in network coding-based peer-to-peer live streaming.  _IEEE Transactions on Multimedia_ , 17(4):562–573, 2015.
  * Fotiadis and Konstantinou [2018] Georgios Fotiadis and Elisavet Konstantinou.  Generating pairing-friendly elliptic curve parameters using sparse families.  _Journal of Mathematical Cryptology_ , 12(2):83–99, 2018.
  * Fotiadis and Konstantinou [2019] Georgios Fotiadis and Elisavet Konstantinou.  Tnfs resistant families of pairing-friendly elliptic curves.  _Theoretical Computer Science_ , 800:73–89, 2019.
  * Fotiadis and Martindale [2018] Georgios Fotiadis and Chloe Martindale.  Optimal tnfs-secure pairings on elliptic curves with even embedding degree.  _Cryptology ePrint Archive_ , 2018.
  * Freeman [2006] David Freeman.  Constructing pairing-friendly elliptic curves with embedding degree 10\.  In _International Algorithmic Number Theory Symposium_ , pages 452–465. Springer, 2006.
  * Freeman et al. [2010] David Freeman, Michael Scott, and Edlyn Teske.  A taxonomy of pairing-friendly elliptic curves.  _Journal of cryptology_ , 23(2):224–280, 2010\.
  * Frey et al. [1999] Gerhard Frey, Michael Muller, and H-G Ruck.  The tate pairing and the discrete logarithm applied to elliptic curve cryptosystems.  _IEEE Transactions on Information Theory_ , 45(5):1717–1719, 1999.
  * Fujioka et al. [1992] Atsushi Fujioka, Tatsuaki Okamoto, and Kazuo Ohta.  A practical secret voting scheme for large scale elections.  In _International Workshop on the Theory and Application of Cryptographic Techniques_ , pages 244–251. Springer, 1992.
  * Gabizon [2019] Ariel Gabizon.  On the security of the bctv pinocchio zk-snark variant.  _IACR Cryptol. ePrint Arch._ , 2019:119, 2019.
  * Galbraith et al. [2007] Steven D Galbraith, James F McKee, and Paula C Valença.  Ordinary abelian varieties having small embedding degree.  _Finite Fields and Their Applications_ , 13(4):800–814, 2007.
  * Galindo et al. [2006] David Galindo, Javier Herranz, and Eike Kiltz.  On the generic construction of identity-based signatures with additional properties.  In _International Conference on the Theory and Application of Cryptology and Information Security_ , pages 178–193. Springer, 2006.
  * Gao et al. [2012] Wei Gao, Guilin Wang, Xueli Wang, and Fei Li.  Round-optimal id-based blind signature schemes without ros assumption.  _Journal of Communications_ , 2012.
  * Gazzoni Filho and Barreto [2006] Décio Luiz Gazzoni Filho and Paulo Sérgio Licciardi Messeder Barreto.  Demonstrating data possession and uncheatable data transfer.  _IACR Cryptol. ePrint Arch._ , 2006:150, 2006.
  * Gentry [2003] Craig Gentry.  Certificate-based encryption and the certificate revocation problem.  In _International Conference on the Theory and Applications of Cryptographic Techniques_ , pages 272–293. Springer, 2003.
  * Gorbenko and Hanzia [2017] Ivan Gorbenko and Roman Hanzia.  Examination and implementation of the fast method for computing the order of elliptic curve.  _Eastern European Journal of Advanced Technologies_ , 2 (9):11–21, 2017.
  * Guillevic [2020] Aurore Guillevic.  A short-list of pairing-friendly curves resistant to special tnfs at the 128-bit security level.  In _IACR International Conference on Public-Key Cryptography_ , pages 535–564. Springer, 2020.
  * Guillevic and Singh [2021] Aurore Guillevic and Shashank Singh.  On the alpha value of polynomials in the tower number field sieve algorithm.  _Mathematical Cryptology_ , 1(1):1–39, 2021.
  * Guillevic et al. [2020] Aurore Guillevic, Simon Masson, and Emmanuel Thomé.  Cocks–pinch curves of embedding degrees five to eight and optimal ate pairing computation.  _Designs, Codes and Cryptography_ , pages 1–35, 2020.
  * Han and Chang [2005] Song Han and Elizabeth Chang.  A pairing-based blind signature scheme with message recovery.  _International Journal of Information Technology_ , 2(4):187–192, 2005.
  * He et al. [2011] Debiao He, Jianhua Chen, and Rui Zhang.  An efficient identity-based blind signature scheme without bilinear pairings.  _Computers & Electrical Engineering_, 37(4):444–450, 2011.
  * He et al. [2016] Debiao He, Sherali Zeadally, Neeraj Kumar, and Jong-Hyouk Lee.  Anonymous authentication for wireless body area networks with provable security.  _IEEE Systems Journal_ , 11(4):2590–2601, 2016\.
  * Hubbers et al. [2005] Engelbert Hubbers, Bart Jacobs, and Wolter Pieters.  Ries-internet voting in action.  In _29th Annual International Computer Software and Applications Conference (COMPSAC’05)_ , volume 1, pages 417–424. IEEE, 2005.
  * Islam and Biswas [2011] Sk Hafizul Islam and GP Biswas.  A more efficient and secure id-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem.  _Journal of Systems and Software_ , 84(11):1892–1898, 2011.
  * Islam and Obaidat [2015] SK Hafizul Islam and Mohammad S Obaidat.  Design of provably secure and efficient certificateless blind signature scheme using bilinear pairing.  _Security and Communication Networks_ , 8(18):4319–4332, 2015.
  * Islam et al. [2016] SK Hafizul Islam, Ruhul Amin, GP Biswas, Mohammad S Obaidat, and Muhammad Khurram Khan.  Provably secure pairing-free identity-based partially blind signature scheme and its application in online e-cash system.  _Arabian Journal for Science and Engineering_ , 41(8):3163–3176, 2016.
  * James et al. [2017] Salome James, T Gowri, GV Babu, and P Vasudeva Reddy.  Identity-based blind signature scheme with message recovery.  _International Journal of Electrical & Computer Engineering (2088-8708)_, 7(5), 2017.
  * James et al. [2018] Salome James, NB Gayathri, and P Vasudeva Reddy.  Pairing free identity-based blind signature scheme with message recovery.  _Cryptography_ , 2(4):29, 2018.
  * Jia et al. [2019] Xiaoying Jia, Debiao He, Neeraj Kumar, and Kim-Kwang Raymond Choo.  A provably secure and efficient identity-based anonymous authentication scheme for mobile edge computing.  _IEEE Systems Journal_ , 14(1):560–571, 2019\.
  * Jiang et al. [2016a] Qi Jiang, Xinxin Lian, Chao Yang, Jianfeng Ma, Youliang Tian, and Yuanyuan Yang.  A bilinear pairing based anonymous authentication scheme in wireless body area networks for mhealth.  _Journal of medical systems_ , 40(11):231, 2016a.
  * Jiang et al. [2016b] Qi Jiang, Jianfeng Ma, and Fushan Wei.  On the security of a privacy-aware authentication scheme for distributed mobile cloud computing services.  _IEEE systems journal_ , 12(2):2039–2042, 2016b.
  * Joaquim et al. [2013] Rui Joaquim, Paulo Ferreira, and Carlos Ribeiro.  Eviv: An end-to-end verifiable internet voting system.  _Computers & Security_, 32:170–191, 2013.
  * Joux [2000] Antoine Joux.  A one round protocol for tripartite diffie–hellman.  In _International algorithmic number theory symposium_ , pages 385–393. Springer, 2000.
  * Joux and Nguyen [2003] Antoine Joux and Kim Nguyen.  Separating decision diffie–hellman from computational diffie–hellman in cryptographic groups.  _Journal of cryptology_ , 16(4):239–247, 2003\.
  * Juels and Kaliski Jr [2007] Ari Juels and Burton S Kaliski Jr.  Pors: Proofs of retrievability for large files.  In _Proceedings of the 14th ACM conference on Computer and communications security_ , pages 584–597, 2007.
  * Kachisa et al. [2008] Ezekiel J Kachisa, Edward F Schaefer, and Michael Scott.  Constructing brezing-weng pairing-friendly elliptic curves using elements in the cyclotomic field.  In _International Conference on Pairing-Based Cryptography_ , pages 126–135. Springer, 2008.
  * Kar [2013] Jayaprakash Kar.  Provably secure identity-based aggregate signcryption scheme in random oracles.  _IACR Cryptol. ePrint Arch._ , 2013:37, 2013.
  * Karati et al. [2018a] Arijit Karati, SK Hafizul Islam, and GP Biswas.  A pairing-free and provably secure certificateless signature scheme.  _Information Sciences_ , 450:378–391, 2018a.
  * Karati et al. [2018b] Arijit Karati, SK Hafizul Islam, and Marimuthu Karuppiah.  Provably secure and lightweight certificateless signature scheme for iiot environments.  _IEEE Transactions on Industrial Informatics_ , 14(8):3701–3711, 2018b.
  * Kim and Barbulescu [2016] Taechan Kim and Razvan Barbulescu.  Extended tower number field sieve: A new complexity for the medium prime case.  In _Annual International Cryptology Conference_ , pages 543–571. Springer, 2016.
  * Kim and Jeong [2017] Taechan Kim and Jinhyuck Jeong.  Extended tower number field sieve with application to finite fields of arbitrary composite extension degree.  In _IACR International Workshop on Public Key Cryptography_ , pages 388–408. Springer, 2017.
  * Kiyomura et al. [2017] Yutaro Kiyomura, Akiko Inoue, Yuto Kawahara, Masaya Yasuda, Tsuyoshi Takagi, and Tetsutaro Kobayashi.  Secure and efficient pairing at 256-bit security level.  In _International Conference on Applied Cryptography and Network Security_ , pages 59–79. Springer, 2017.
  * Koblitz [1987] Neal Koblitz.  Elliptic curve cryptosystems.  _Mathematics of computation_ , 48(177):203–209, 1987.
  * Kumar [2019] Mahender Kumar.  Aor-id-kap: An authenticated one-round identity-based key agreement protocol for wireless sensor network.  _computational intelligence in sensor networks_ , pages 427–454, 2019\.
  * Kumar [2020] Mahender Kumar.  Cryptanalysis and improvement of anonymous authentication for wireless body area networks with provable security.  _Cryptology ePrint Archive_ , 2020.
  * Kumar and Chand [2019] Mahender Kumar and Satish Chand.  Eski-ibe: Efficient and secure key issuing identity-based encryption with cloud privacy centers.  _Multimedia Tools and Applications_ , 78(14):19753–19786, 2019.
  * Kumar and Chand [2020a] mahender Kumar and Satish Chand.  A secure and efficient cloud-centric internet of medical things-enabled smart healthcare system with public verifiability.  _IEEE Internet of Things Journals_ , early access, 2020a.
  * Kumar and Chand [2020b] Mahender Kumar and Satish Chand.  Escrow-less identity-based signature scheme with outsourced protection in cloud computing.  _Wireless Personal Communications_ , 114:3115–3136, 2020b.
  * Kumar and Chand [2020c] Mahender Kumar and Satish Chand.  A lightweight cloud-assisted identity-based anonymous authentication and key agreement protocol for secure wireless body area network.  _IEEE Systems Journal_ , 15(2):2779–2786, 2020c.
  * Kumar and Chand [2020d] Mahender Kumar and Satish Chand.  A pairing-less identity-based blind signature with message recovery scheme for cloud-assisted services.  In _Information Security and Cryptology: 15th International Conference, Inscrypt 2019, Nanjing, China, December 6–8, 2019, Revised Selected Papers 15_ , pages 419–434. Springer, 2020d.
  * Kumar and Chand [2020e] Mahender Kumar and Satish Chand.  Secp2pvod: A secure peer-to-peer video-on-demand system against pollution attack and untrusted service provider.  _Multimedia Tools and Applications_ , 79:6163–6190, 2020e.
  * Kumar and Katti [2016] Mahender Kumar and CP Katti.  An efficient id-based partially blind signature scheme and application in electronic-cash payment system.  _Accent. Trans. Inf. Secur_ , 2(6):36–42, 2016\.
  * Kumar and Saxena [2018a] Mahender Kumar and PC Saxena.  One-round authenticated identity-based tri-partite key agreement protocol for internet of things based sensors.  In _Proceedings of 3rd International Conference on Internet of Things and Connected Technologies (ICIoTCT)_ , pages 26–27, 2018a.
  * Kumar and Saxena [2018b] Mahender Kumar and P.C. Saxena.  Pairing-free authenticated identity-based two-party key agreement protocol for resource-constraint devices.  In _2018 International Conference on Futuristic Trends in Network and Communication Technologies_ , volume 958, pages 425–440. Spriger, 2018b.
  * Kumar et al. [2017a] Mahender Kumar, Chittaranjan Padmanabha Katti, and Prem Chandra Saxena.  A secure anonymous e-voting system using identity-based blind signature scheme.  In _International conference on information systems security_ , pages 29–49. Springer, 2017a.
  * Kumar et al. [2017b] Mahender Kumar, CP Katti, and PC Saxena.  An identity-based blind signature approach for e-voting system.  _International Journal of Modern Education and Computer Science_ , 9(10):47, 2017b.
  * Kumar et al. [2017c] Mahender Kumar, CP Katti, and PC Saxena.  A new blind signature scheme using identity-based technique.  _Int. J. Control Theory Appl_ , 10(15):36–42, 2017c.
  * Kumar et al. [2017d] Mahender Kumar, CP Katti, and PC Saxena.  An untraceable identity-based blind signature scheme without pairing for e-cash payment system.  In _International Conference on Ubiquitous Communications and Network Computing_ , pages 67–78. Springer, 2017d.
  * Kumar et al. [2020] Mahender Kumar, Satish Chand, and Chittaranjan Padmanabha Katti.  A secure end-to-end verifiable internet-voting system using identity-based blind signature.  _IEEE Systems Journal_ , 14(2):2032–2041, 2020\.
  * Kusters et al. [2012] Ralf Kusters, Tomasz Truderung, and Andreas Vogt.  Clash attacks on the verifiability of e-voting systems.  In _2012 IEEE Symposium on Security and Privacy_ , pages 395–409. IEEE, 2012.
  * Lai et al. [2017] Jianchang Lai, Yi Mu, and Fuchun Guo.  Efficient identity-based online/offline encryption and signcryption with short ciphertext.  _International Journal of Information Security_ , 16(3):299–311, 2017.
  * Lee et al. [2004] Byoungcheon Lee, Colin Boyd, Ed Dawson, Kwangjo Kim, Jeongmo Yang, and Seungjae Yoo.  Secure key issuing in id-based cryptography.  In _Proceedings of the second workshop on Australasian information security, Data Mining and Web Intelligence, and Software Internationalisation-Volume 32_ , pages 69–74, 2004.
  * Lee and Park [2009] Hyang-Sook Lee and Cheol-Min Park.  Generating pairing-friendly curves with the cm equation of degree 1.  In _International Conference on Pairing-Based Cryptography_ , pages 66–77. Springer, 2009.
  * Li et al. [2009] Chun-Ta Li, Min-Shiang Hwang, and Yan-Chi Lai.  A verifiable electronic voting scheme over the internet.  In _2009 Sixth International Conference on Information Technology: New Generations_ , pages 449–454. IEEE, 2009.
  * Li et al. [2012] Fagen Li, Muhammad Khurram Khan, Khaled Alghathbar, and Tsuyoshi Takagi.  Identity-based online/offline signcryption for low power devices.  _Journal of Network and Computer Applications_ , 35(1):340–347, 2012.
  * Li et al. [2017a] Fagen Li, Yanan Han, and Chunhua Jin.  Certificateless online/offline signcryption for the internet of things.  _Wireless Networks_ , 23(1):145–158, 2017a.
  * Li et al. [2015] Jiguo Li, Jingjing Zhao, and Yichen Zhang.  Certificateless online/offline signcryption scheme.  _Security and Communication Networks_ , 8(11):1979–1990, 2015.
  * Li et al. [2019] Jing Li, Xianmin Wang, Zhengan Huang, Licheng Wang, and Yang Xiang.  Multi-level multi-secret sharing scheme for decentralized e-voting in cloud computing.  _Journal of Parallel and Distributed Computing_ , 130:91–97, 2019.
  * Li et al. [2017b] Xiong Li, Jieyao Peng, Saru Kumari, Fan Wu, Marimuthu Karuppiah, and Kim-Kwang Raymond Choo.  An enhanced 1-round authentication protocol for wireless body area networks with user anonymity.  _Computers & Electrical Engineering_, 61:238–249, 2017b.
  * Li et al. [2017c] Yuanlong Li, Fang Qi, and Zhe Tang.  An efficient hierarchical identity-based encryption scheme for the key escrow.  In _International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage_ , pages 108–120. Springer, 2017c.
  * Liu et al. [2018] Dengzhi Liu, Jian Shen, Yuling Chen, Chen Wang, Tianqi Zhou, and Anxi Wang.  Privacy-preserving data outsourcing with integrity auditing for lightweight devices in cloud computing.  In _International conference on information security and cryptology_ , pages 223–239. Springer, 2018.
  * Liu et al. [2013] Jingwei Liu, Zonghua Zhang, Xiaofeng Chen, and Kyung Sup Kwak.  Certificateless remote anonymous authentication schemes for wirelessbody area networks.  _IEEE Transactions on parallel and distributed systems_ , 25(2):332–342, 2013.
  * Liu et al. [2010] Joseph K Liu, Joonsang Baek, and Jianying Zhou.  Online/offline identity-based signcryption revisited.  In _International conference on information security and cryptology_ , pages 36–51. Springer, 2010.
  * López-García et al. [2014] Lourdes López-García, Luis J Dominguez Perez, and Francisco Rodríguez-Henríquez.  A pairing-based blind signature e-voting scheme.  _The Computer Journal_ , 57(10):1460–1471, 2014\.
  * Luo et al. [2014] Ming Luo, Min Tu, and Jianfeng Xu.  A security communication model based on certificateless online/offline signcryption for internet of things.  _Security and Communication Networks_ , 7(10):1560–1569, 2014.
  * Lynn [2007] Ben Lynn.  Pbc library-pairing-based cryptography.  _http://crypto. stanford. edu/pbc/_ , 2007.
  * Lynn [2010] Ben Lynn.  The pairing-based cryptography (pbc) library, 2010.
  * Malone-Lee [2002] John Malone-Lee.  Identity-based signcryption.  _IACR Cryptol. ePrint Arch._ , 2002:98, 2002.
  * Mao [2006] Jian Mao.  Linkability analysis of some blind signature schemes.  In _International Conference on Computational and Information Science_ , pages 556–566. Springer, 2006.
  * Mbiang et al. [2020] Narcisse Bang Mbiang, Diego De Freitas Aranha, and Emmanuel Fouotsa.  Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level.  _International Journal of Applied Cryptography_ , 4(1):45–59, 2020.
  * Menezes et al. [2016] Alfred Menezes, Palash Sarkar, and Shashank Singh.  Challenges with assessing the impact of nfs advances on the security of pairing-based cryptography.  In _International Conference on Cryptology in Malaysia_ , pages 83–108. Springer, 2016.
  * Menezes et al. [1993] Alfred J Menezes, Tatsuaki Okamoto, and Scott A Vanstone.  Reducing elliptic curve logarithms to logarithms in a finite field.  _iEEE Transactions on information Theory_ , 39(5):1639–1646, 1993.
  * Miller [1985] Victor S Miller.  Use of elliptic curves in cryptography.  In _Conference on the theory and application of cryptographic techniques_ , pages 417–426. Springer, 1985.
  * Miyaji et al. [2001] Atsuko Miyaji, Masaki Nakabayashi, and Shunzou Takano.  New explicit conditions of elliptic curve traces for fr-reduction.  _IEICE transactions on fundamentals of electronics, communications and computer sciences_ , 84(5):1234–1243, 2001\.
  * Mu and Varadharajan [1998] Yi Mu and Vijay Varadharajan.  Anonymous secure e-voting over a network.  In _Proceedings 14th Annual Computer Security Applications Conference (Cat. No. 98EX217)_ , pages 293–299. IEEE, 1998.
  * Mykletun et al. [2006] Einar Mykletun, Maithili Narasimha, and Gene Tsudik.  Authentication and integrity in outsourced databases.  _ACM Transactions on Storage (TOS)_ , 2(2):107–138, 2006.
  * Nikooghadam and Amintoosi [2020] Mahdi Nikooghadam and Haleh Amintoosi.  A secure and robust elliptic curve cryptography-based mutual authentication scheme for session initiation protocol.  _Security and Privacy_ , 3(1):e92, 2020.
  * Niu et al. [2017] Shufen Niu, Zhenbin Li, and Caifen Wang.  Privacy-preserving multi-party aggregate signcryption for heterogeneous systems.  In _International Conference on Cloud Computing and Security_ , pages 216–229. Springer, 2017.
  * Omala et al. [2016] Anyembe Andrew Omala, Niyifasha Robert, and Fagen Li.  A provably-secure transmission scheme for wireless body area networks.  _Journal of medical systems_ , 40(11):247, 2016\.
  * Pang et al. [2009] HweeHwa Pang, Jilian Zhang, and Kyriakos Mouratidis.  Scalable verification for outsourced dynamic databases.  _Proceedings of the VLDB Endowment_ , 2(1):802–813, 2009.
  * Pantazis et al. [2012] Nikolaos A Pantazis, Stefanos A Nikolidakis, and Dimitrios D Vergados.  Energy-efficient routing protocols in wireless sensor networks: A survey.  _IEEE Communications surveys & tutorials_, 15(2):551–591, 2012.
  * Paterson [2002] Kenneth G Paterson.  Cryptography from pairings: a snapshot of current research.  _Information Security Technical Report_ , 7(3):41–54, 2002.
  * Pointcheval and Stern [2000] David Pointcheval and Jacques Stern.  Security arguments for digital signatures and blind signatures.  _Journal of cryptology_ , 13(3):361–396, 2000\.
  * Popoveniuc and Hosp [2006] Stefan Popoveniuc and Ben Hosp.  An introduction to punchscan.  In _IAVoSS workshop on trustworthy elections (WOTE 2006)_ , pages 28–30. Robinson College United Kingdom, 2006.
  * Porkodi et al. [2011] Chinniah Porkodi, Ramalingam Arumuganathan, and Krishnasamy Vidya.  Multi-authority electronic voting scheme based on elliptic curves.  _IJ Network Security_ , 12(2):84–91, 2011.
  * Rivest et al. [1978] Ronald L Rivest, Adi Shamir, and Leonard Adleman.  A method for obtaining digital signatures and public-key cryptosystems.  _Communications of the ACM_ , 21(2):120–126, 1978\.
  * Ryan et al. [2009] Peter YA Ryan, David Bismark, James Heather, Steve Schneider, and Zhe Xia.  Prêt à voter: a voter-verifiable voting system.  _IEEE transactions on information forensics and security_ , 4(4):662–673, 2009.
  * Saeed et al. [2018] Mutaz Elradi S Saeed, Qingyin Liu, GuiYun Tian, Bin Gao, and Fagen Li.  Hoosc: heterogeneous online/offline signcryption for the internet of things.  _Wireless Networks_ , 24(8):3141–3160, 2018.
  * Sahana et al. [2019] Subhas Chandra Sahana, Manik Lal Das, and Bubu Bhuyan.  A provable secure key-escrow-free identity-based signature scheme without using secure channel at the phase of private key issuance.  _Sādhanā_ , 44(6):132, 2019.
  * Scott and Barreto [2006] Michael Scott and Paulo SLM Barreto.  Generating more mnt elliptic curves.  _Designs, Codes and Cryptography_ , 38(2):209–217, 2006.
  * Scott and Guillevic [2018] Michael Scott and Aurore Guillevic.  A new family of pairing-friendly elliptic curves.  In _International Workshop on the Arithmetic of Finite Fields_ , pages 43–57. Springer, 2018.
  * Selvi et al. [2009] S Sharmila Deva Selvi, S Sree Vivek, J Shriram, S Kalaivani, and C Pandu Rangan.  Identity based aggregate signcryption schemes.  In _International Conference on Cryptology in India_ , pages 378–397. Springer, 2009.
  * Selvi et al. [2010] S Sharmila Deva Selvi, S Sree Vivek, and C Pandu Rangan.  Identity based online/offline signcryption scheme.  _IACR Cryptol. ePrint Arch._ , 2010:376, 2010.
  * Shamir [1984] Adi Shamir.  Identity-based cryptosystems and signature schemes.  In _Workshop on the theory and application of cryptographic techniques_ , pages 47–53. Springer, 1984.
  * Shi et al. [2015] Wenbo Shi, Neeraj Kumar, Peng Gong, Naveen Chilamkurti, and Hangbae Chang.  On the security of a certificateless online/offline signcryption for internet of things.  _Peer-to-Peer Networking and Applications_ , 8(5):881–885, 2015.
  * Shim [2014] Kyung-Ah Shim.  S2drp: Secure implementations of distributed reprogramming protocol for wireless sensor networks.  _Ad Hoc Networks_ , 19:1–8, 2014.
  * Shim et al. [2013] Kyung-Ah Shim, Young-Ran Lee, and Cheol-Min Park.  Eibas: An efficient identity-based broadcast authentication scheme in wireless sensor networks.  _Ad Hoc Networks_ , 11(1):182–189, 2013.
  * Sowjanya et al. [2020] K Sowjanya, Mou Dasgupta, and Sangram Ray.  An elliptic curve cryptography based enhanced anonymous authentication protocol for wearable health monitoring systems.  _International Journal of Information Security_ , 19(1):129–146, 2020.
  * Sun et al. [2008a] Dongdong Sun, Xinyi Huang, Yi Mu, and Willy Susilo.  Identity-based on-line/off-line signcryption.  In _2008 IFIP international conference on network and parallel computing_ , pages 34–41. IEEE, 2008a.
  * Sun et al. [2008b] Dongdong Sun, Yi Mu, and Willy Susilo.  A generic construction of identity-based online/offline signcryption.  In _2008 IEEE International Symposium on Parallel and Distributed Processing with Applications_ , pages 707–712. IEEE, 2008b.
  * Tanaka and Nakamula [2008] Satoru Tanaka and Ken Nakamula.  Constructing pairing-friendly elliptic curves using factorization of cyclotomic polynomials.  In _International Conference on Pairing-Based Cryptography_ , pages 136–145. Springer, 2008.
  * Tian et al. [2009] Xiu-Xia Tian, Hong-Jiao Li, Jian-Ping Xu, and Yong Wang.  A security enforcement id-based partially blind signature scheme.  In _2009 International conference on web information systems and mining_ , pages 488–492. IEEE, 2009.
  * Tsai and Lo [2015] Jia-Lun Tsai and Nai-Wei Lo.  A privacy-aware authentication scheme for distributed mobile cloud computing services.  _IEEE systems journal_ , 9(3):805–815, 2015.
  * Tseng et al. [2019] Yi-Fan Tseng, Chun-I Fan, and Ching-Wen Chen.  Top-level secure certificateless signature scheme in the standard model.  _IEEE Systems Journal_ , 13(3):2763–2774, 2019\.
  * Ullah et al. [2019] Subhan Ullah, Lucio Marcenaro, and Bernhard Rinner.  Secure smart cameras by aggregate-signcryption with decryption fairness for multi-receiver iot applications.  _Sensors_ , 19(2):327, 2019.
  * Vassil et al. [2016] Kristjan Vassil, Mihkel Solvak, Priit Vinkel, Alexander H Trechsel, and R Michael Alvarez.  The diffusion of internet voting. usage patterns of internet voting in estonia between 2005 and 2015.  _Government Information Quarterly_ , 33(3):453–459, 2016.
  * Verheul [2016] Eric R Verheul.  Practical backward unlinkable revocation in fido, german e-id, idemix and u-prove.  _IACR Cryptol. ePrint Arch._ , 2016:217, 2016.
  * Verma and Singh [2017] Girraj Kumar Verma and BB Singh.  Efficient identity-based blind message recovery signature scheme from pairings.  _IET Information Security_ , 12(2):150–156, 2017\.
  * Wang and Zhang [2015] Chunzhi Wang and Yanmei Zhang.  New authentication scheme for wireless body area networks using the bilinear pairing.  _Journal of medical systems_ , 39(11):136, 2015\.
  * Wang et al. [2010] Cong Wang, Qian Wang, Kui Ren, and Wenjing Lou.  Privacy-preserving public auditing for data storage security in cloud computing.  In _2010 proceedings ieee infocom_ , pages 1–9. Ieee, 2010.
  * Wang and Ma [2013] Ding Wang and Chun-Guang Ma.  Cryptanalysis of a remote user authentication scheme for mobile client–server environment based on ecc.  _Information Fusion_ , 14(4):498–503, 2013.
  * Wang et al. [2018] Haizhou Wang, Xingshu Chen, Wenxian Wang, and Mei Ya Chan.  Content pollution propagation in the overlay network of peer-to-peer live streaming systems: modelling and analysis.  _IET Communications_ , 12(17):2119–2131, 2018\.
  * Wang et al. [2016] Hao Wang, Zhen Liu, Zhe Liu, and Duncan S Wong.  Identity-based aggregate signcryption in the standard model from multilinear maps.  _Frontiers of Computer Science_ , 10(4):741–754, 2016.
  * Wu et al. [2014] Zhen-Yu Wu, Ju-Chuan Wu, Sung-Chiang Lin, and Charlotte Wang.  An electronic voting mechanism for fighting bribery and coercion.  _Journal of network and computer applications_ , 40:139–150, 2014.
  * Xiong et al. [2012] Hu Xiong, Zhong Chen, and Fagen Li.  Provably secure and efficient certificateless authenticated tripartite key agreement protocol.  _mathematical and Computer Modelling_ , 55(3-4):1213–1221, 2012.
  * Xiong et al. [2013] Hu Xiong, Zhong Chen, and Fagen Li.  New identity-based three-party authenticated key agreement protocol with provable security.  _Journal of Network and Computer Applications_ , 36(2):927–932, 2013.
  * Xiong et al. [2010] Xiaokang Xiong, Duncan S Wong, and Xiaotie Deng.  Tinypairing: A fast and lightweight pairing-based cryptographic library for wireless sensor networks.  In _2010 IEEE Wireless Communication and Networking Conference_ , pages 1–6. IEEE, 2010.
  * Yamamoto et al. [2007] Go Yamamoto, Satoshi Oda, and Kazumaro Aoki.  Fast integrity for large data.  In _Proc. ECRYPT Workshop Software Performance Enhancement for Encryption and Decryption_ , pages 21–32, 2007.
  * Yang and Chang [2009] Jen-Ho Yang and Chin-Chen Chang.  An id-based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem.  _Computers & security_, 28(3-4):138–143, 2009\.
  * Yang et al. [2019] Wenjie Yang, Shangpeng Wang, Wei Wu, and Yi Mu.  Top-level secure certificateless signature against malicious-but-passive kgc.  _IEEE Access_ , 7:112870–112878, 2019.
  * Yang et al. [2016] Xu Yang, Xinyi Huang, and Joseph K Liu.  Efficient handover authentication with user anonymity and untraceability for mobile cloud computing.  _Future Generation Computer Systems_ , 62:190–195, 2016\.
  * Yang et al. [2018] Xuechao Yang, Xun Yi, Surya Nepal, Andrei Kelarev, and Fengling Han.  A secure verifiable ranked choice online voting system based on homomorphic encryption.  _IEEE Access_ , 6:20506–20519, 2018.
  * Yin and Liang [2015] Aihan Yin and Hongchao Liang.  Certificateless hybrid signcryption scheme for secure communication of wireless sensor networks.  _Wireless Personal Communications_ , 80(3):1049–1062, 2015.
  * Yoon and Yoo [2009] Eun-Jun Yoon and Kee-Young Yoo.  Robust id-based remote mutual authentication with key agreement scheme for mobile devices on ecc.  In _2009 International Conference on Computational Science and Engineering_ , volume 2, pages 633–640. IEEE, 2009.
  * Zacharias [2016] Thomas Zacharias.  _The DEMOS family of e-voting systems: End-to-end verifiable elections in the standard model_.  PhD thesis, E$\theta$$\nu$$\iota$$\kappa$ó $\kappa$$\alpha$$\iota$ K$\alpha$$\pi$o$\delta$$\iota$$\sigma$$\tau$$\rho$$\iota$$\alpha$$\kappa$ó $\Pi$$\alpha$$\nu$$\varepsilon$$\pi$$\iota$$\sigma$$\tau$$\acute{\eta}$$\mu$$\iota$o A$\theta$$\eta$$\nu$$\acute{\omega}$$\nu$ (EK$\Pi$A). $\Sigma$$\chi$o$\lambda$$\acute{\eta}$ $\Theta$$\varepsilon$$\tau$$\iota$$\kappa$$\acute{\omega}$$\nu$ E$\pi$$\iota$$\sigma$$\tau$$\eta$$\mu$$\acute{\omega}$$\nu$ …, 2016.
  * Zagórski et al. [2013] Filip Zagórski, Richard T Carback, David Chaum, Jeremy Clark, Aleksander Essex, and Poorvi L Vora.  Remotegrity: Design and use of an end-to-end verifiable remote voting system.  In _International Conference on Applied Cryptography and Network Security_ , pages 441–457. Springer, 2013.
  * Zhang et al. [2016] Aiqing Zhang, Lei Wang, Xinrong Ye, and Xiaodong Lin.  Light-weight and robust security-aware d2d-assist data transmission protocol for mobile-health systems.  _IEEE Transactions on Information Forensics and Security_ , 12(3):662–675, 2016.
  * Zhang and Kim [2002] Fangguo Zhang and Kwangjo Kim.  Id-based blind signature and ring signature from pairings.  In _International Conference on the Theory and Application of Cryptology and Information Security_ , pages 533–547. Springer, 2002.
  * Zhang and Sun [2013] Jianhong Zhang and Zhibin Sun.  An id-based server-aided verification short signature scheme avoid key escrow.  _Journal of information science and engineering_ , 29(3):459–473, 2013.
  * Zhang et al. [2012] Yunmei Zhang, Joseph K Liu, Xinyi Huang, Man Ho Au, and Willy Susilo.  Efficient escrow-free identity-based signature.  In _International Conference on Provable Security_ , pages 161–174. Springer, 2012.
  * Zhao [2014] Zhenguo Zhao.  An efficient anonymous authentication scheme for wireless body area networks using elliptic curve cryptosystem.  _Journal of medical systems_ , 38(2):13, 2014\.
  * Zheng [1997] Yuliang Zheng.  Digital signcryption or how to achieve cost (signature & encryption) cost (signature)+ cost (encryption).  In _Annual international cryptology conference_ , pages 165–179. Springer, 1997.
  * Zhou [2018] Caixue Zhou.  Comments on “light-weight and robust security-aware d2d-assist data transmission protocol for mobile-health systems”.  _IEEE Transactions on Information Forensics and Security_ , 13(7):1869–1870, 2018.
  * Zhou [2019] Caixue Zhou.  An improved lightweight certificateless generalized signcryption scheme for mobile-health system.  _International Journal of Distributed Sensor Networks_ , 15(1):1550147718824465, 2019.