This article has been accepted for publication in a future issue of this journal, but has not been
fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
Transactions on Industrial Informatics
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019
Efficient and Robust Certificateless Signature for
Data Crowdsensing in Cloud-assisted Industrial IoT
Yinghui Zhang, Member, IEEE, Robert H. Deng, Fellow, IEEE, Dong Zheng, Jin Li, Pengfei Wu, and Jin Cao
Abstract—With the digitalization of various industries, the
combination of cloud computing and the Industrial Internet of
Things (IIoT) has become an attractive data processing paradigm.
However, cloud-assisted IIoT still has challenging issues including
authenticity of data, untrustworthiness of third parties, and
system robustness and efficiency. Recently Karati et al. [1]
proposed a lightweight certificateless signature (CLS) scheme for
cloud-assisted IIoT, that was claimed to address both authenticity
of data and untrustworthiness of third parties. In this paper, we
demonstrate that the CLS scheme fails to achieve the claimed
security properties by presenting four types of signature forgery
attacks. We also propose a robust certificateless signature (RCLS)
scheme to address the aforementioned challenges. Our RCLS only
needs public channels and is proven secure against both public
key replacement attacks and malicious-but-passive third parties
in the standard model. Performance evaluation indicates that
RCLS outperforms other CLS schemes and is suitable for IIoT.
Index Terms—Industrial Internet of Things; Cloud computing,
Certificateless signature; Signature forgery attack; Crowdsens-
ing; Robustness.
I. Introduction
HE rapid technological advancements in the Internet
T of Things (IoT) and cloud computing are expected to
play an important promoting role in creating a smart world.
According to Gartner [2], it is estimated that by 2020, the
number of worldwide connected things will amount to 20.4
billion and the business IoT endpoint spending will reach
almost $3 trillion. In particular, the combination of cloud
computing and the industrial IoT (IIoT) has been recognized
as a promising solution to transform the operation of exist-
ing industrial systems which involves industrial production,
logistics, storage and marketing [3]. The ultimate goal of
cloud-assisted IIoT is to enable various industries to obtain
competitive advantages.
However, cloud-assisted IIoT still has several fundamental
and challenging issues including the authenticity of data, the
Y. Zhang is with the National Engineering Laboratory for Wireless Security,
Xi’an University of Posts & Telecommunications, Xi’an 710121, China;
and the School of Information Systems, Singapore Management University,
Singapore (Corresponding author. E-mail: yhzhaang@163.com).
R. H. Deng is with the School of Information Systems, Singapore Man-
agement University, Singapore (E-mail: robertdeng@smu.edu.sg).
D. Zheng is with the National Engineering Laboratory for Wireless Security,
Xi’an University of Posts & Telecommunications, Xi’an 710121, China; and
Westone Cryptologic Research Center, Beijing 100070, China (Corresponding
author. E-mail: zhengdong@xupt.edu.cn).
J. Li is with the School of Computer Science, Guangzhou University,
Guangzhou 510006, China. (E-mail: jinli71@gmail.com).
P. Wu is with the School of Software and Microelectronics, Peking
University, Beijing 102600, China (E-mail: wpf9808@163.com).
J. Cao is with the State Key Laboratory of Integrated Services Networks,
School of Cyber Engineering, Xidian University, Xian 710126, China (E-mail:
caoj897@gmail.com).
1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
1
untrustworthiness of involved third parties, and the robustness
and efficiency of the system 1 . Because essential information
extracted from IIoT data usually plays an important role in
improving enterprises’ operation and even is related to the
lives of front-line workers, if used by consumers, erroneous
or tampered data will produce misleading information and
hence may lead to disastrous results [4]. Accordingly, it is
indispensable to efficiently ensure the authenticity of collected
IIoT data before analyzing and processing the data. It should
be noted that the dynamic deployment of the IIoT system
and the massiveness and resource constraints of diverse IIoT
devices obsolete energy-intensive authentication mechanisms
relying on trustworthy third parties. In particular, the property
of no secure channel should be realized in the IIoT system in
that the system scalability is indispensable for practicality.
As promising cryptographic primitives, the public key cryp-
tosystem (PKC) and the identity-based cryptosystem (IBC)
[5] are two possible solutions to data authentication in IIoT.
However, PKC suffers from severe performance bottlenecks
due to burdensome public key certificate management. In
addition, the complicated validation process of public keys
could quickly drain the resource of a constrained IIoT device.
In IBC, the cost and complexity of the system are drastically
reduced by removing the need of users’ public key certificates.
To be precise, certificates are only needed for a trusted author-
ity called key generation center (KGC) who is responsible for
issuing private keys to users. Nevertheless, IBC is still not
suitable for IIoT because of an inherent trust issue known
as “key escrow problem”, which means the private key of a
user is known to KGC. To tackle this problem, Al-Riyami
and Paterson [6] proposed a new cryptosystem referred to as
certificateless public key cryptography (CL-PKC). In CL-PKC,
a user’s private key is a combination of some contribution
of KGC and a user-chosen secret, and hence the key escrow
problem can be solved. It is noted that the combination method
against key replacement attacks is not to directly prove the
authenticity of a public key based on a certificate. On the
contrary, it is guaranteed in CL-PKC that even if a malicious
user successfully replaces a victim’s public key with his own
choice, he still cannot forge a valid signature. As a kind of
CL-PKC, certificateless signature (CLS) can be used to check
data authenticity in IIoT. For one thing, the unique security
and performance requirements of the IIoT system mentioned
above eliminate both PKC and IBC because of burdensome
key management and the key escrow problem. For another,
CLS-enabled systems enjoy the benefit of lightweight key
management. Specifically, CLS can work just like an identity-
1 Robustness means that no secure channel is required in the system.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
Transactions on Industrial Informatics
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019 2

based signature scheme by including the public key as part of the importance of data security in the enabling technologies
a signature message, but it is free of the key-escrow problem. such as cloud computing, IoT and IIoT [12]. Zhang et al.
proposed two blockchain-based fair payment protocols called
BPay [13] and BCPay [14] for outsourcing services in cloud
computing. The protocol BPay [13] is compatible with the
Processing
Storage Bitcoin blockchain and the performance remains to be im-
Third Party Analysis Verification
proved. At the cost of losing the compatibility with the Bitcoin
blockchain, the protocol BCPay [14] is very efficient in terms
Secure Channel

(Authentic) Data
Public Channel

Cloud Service Provider

RCLS Joining
CLS Joining

of the computation cost and the number of transactions. These

Crowdsensing Data in IIoT
two protocols can be adopted to enable trustworthy keyword
search over cloud encrypted data with two-side verifiability
[15]. Shu et al. [16] presented a privacy-preserving task recom-
Verification
Services
mendation scheme in cloud computing environment. Zhang et
Smart Things
al. [17] realized attribute privacy protection and fast decryption
Industrial Research
for outsourced data security in mobile cloud computing. Since
the introduction of CLS for solving the key escrow problem in
Industrial Devices Mounted
Sensors Industrial Ap
Applications the ID-based setting [6], many research efforts have focused on
IIoT Data Owner IIoT Data Consumer the design and analysis of CLS. Huang et al. [18] pointed out
that the scheme [6] is vulnerable to key replacement attacks
Fig. 1. The system model of data crowdsensing in cloud-assisted IIoT.
launched by any malicious third party (e.g. Type I adversary).
However, very recently Karati et al. [1] pointed out that They also developed an improved CLS scheme in [18], which
most of the existing CLS schemes are designed based on map- is proven secure in ROM. Zhang et al. [19] proposed a CLS
to-point (MTP) hash functions and the random oracle model scheme based on bilinear pairings, which achieves a tight
(ROM), of which the implementation difficulty and proba- security reduction in ROM. Yeh et al. [20] proposed a CLS
bilistic nature make the scheme impractical. Furthermore, the scheme for smart objects in the IoT scenario. It is claimed
authors [1] proposed a CLS scheme without MTP and ROM that the scheme is secure in ROM against both the Type I
to enable data authentication in IIoT. As illustrated in Figure and Type II adversaries. However, Jia et al. [21] showed that
1, the authors [1] considered a typical cloud-assisted IIoT an adversary can impersonate the key generation center and
enabled data crowdsensing system. The system consists of four malicious users as Type I adversaries can successfully launch
types of entities: a third party, IIoT data owners (DOs), IIoT public key replacement attacks in [20]. Furthermore, Jia et al.
data consumers (DUs) and a cloud service provider (CSP). [21] proposed an improved scheme and proved its security in
The third party is a malicious-but-passive KGC [6], [7] and ROM. To date, there have been numerous CLS schemes [22],
it helps DOs and DUs to join the system. DOs outsource [23], [24], [25], [26] proved secure in ROM. However, once
the crowdsensing IIoT data from various industrial devices to instantiated with concrete hash functions, random oracles may
CSP. CSP either stores the data for sharing among DOs and make the schemes insecure.
DUs or processes the data to extract valuable information for Yum and Lee [27] proposed a generic CLS construction
DUs. In any case, the authenticity of the collected IIoT data by combining any standard signature scheme with any ID-
should be checked such that erroneous or tampered data are based signature scheme. However, Hu et al. [28] showed
removed. The authors [1] claimed that their solution efficiently that the construction [27] is insecure against the Type I
addresses both authenticity of data and untrustworthiness of adversary. Liu et al. [29] proposed the first concrete CLS
the third party in cloud-assisted IIoT. Specifically, the authors scheme in the standard model. However, the malicious-but-
proved that the CLS scheme is secure against the Type I passive attack launched by the Type II adversary is not taken
adversary and the Type II adversary in the standard model into consideration. Many other schemes in the standard model
under the Bilinear Strong Diffie-Hellman (BSDH) assumption can be found in the literature [30], [31], [32], [33], [34],
[8] and the Extended Bilinear Strong Diffie-Hellman (EBSDH) [35], [36], [37]. However, the schemes [29], [30], [31] are
assumption [9], respectively.2 However, after a close look at vulnerable to the Type I adversary [38]. The scheme [32]
their scheme, we find that the scheme suffers from four types fails to resist both the Type I and Type II adversary [37]. In
of signature forgery attacks and hence fails to achieve the [33], [34], [37], the authors did not provide a formal security
claimed security properties. In addition, the CLS scheme is proof against the Type II adversary in the standard model. The
not robust because of the use of a secure channel between the schemes [29], [35], [36] suffer from bad efficiency in terms of
third party and DOs. the computation cost. To improve efficiency, Karati et al. [1]
proposed a CLS scheme without MTP and ROM. However, we
will show the scheme still suffers from severe security flaws.
A. Related Work
Data crowdsensing plays an essential role in digitalization B. Our Contributions
of various industries [10], [11], which makes people aware of Aiming to simultaneously address several fundamental and
2 In the supplemental material, we demonstrate an inaccuracy of [1] that the challenging issues in cloud-assisted IIoT, including the authen-
EBSDH assumption and the BSDH assumption are equivalent. ticity of data, the untrustworthiness of third parties, and the

1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
Transactions on Industrial Informatics
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019 3

robustness and efficiency of the system, we make two-fold parameters params and a master secret key msk. The
contributions: details are as follows:
For one thing, we demonstrate that the most recent CLS – KGC first chooses a bilinear map ê : G1 × G1 → G2 ,
scheme due to Karati et al. [1] fails to achieve the claimed where G1 and G2 are cyclic multiplicative groups of
security properties. the same prime order p. It also picks a hash function
• We present four types of signature forgery attacks on the H : {0, 1}∗ → Z∗p .
CLS scheme [1]. The attack I is mounted by the Type I – Furthermore, KGC chooses y ∈R Z∗p as its private key
adversary based on public key replacement. The attack II and calculates the corresponding public key YKGC =
is from the Type II adversary, that is, the malicious-but- gy1 , where g1 is a generator of G1 . It also computes
passive KGC. Both the attack III and the attack IV can g2 = ê(g1 , g1 )y .
be launched by any entity without replacing public keys – Finally, KGC keeps msk = y private and publishes
and accessing the master secret key.
params = ⟨G1 , G2 , p, ê, g1 , g2 , YKGC , H⟩.
• We also identify certain other disadvantages of the CLS
scheme [1]. • Set-Partial-Private-Key(params, msk, IDi ): The partial
For another, we propose a robust certificateless signature private key generation algorithm is run by KGC to
(RCLS) scheme without MTP and ROM to address the generate a partial private key Di for the user with identity
aforementioned challenges in cloud-assisted IIoT. Our RCLS IDi . Given params, msk and IDi received from the user,
scheme is characterized by the following attractive features. KGC does the following:
• We prove that RCLS is secure against the above four – KGC first computes hi = H(IDi ), and then chooses
attacks in the standard model under the Strong Diffie- ri ∈R Z∗p , computes
Hellman (SDH) assumption [39]. y·hi
h +ri +y
• Our RCLS is robust in that no secure channel is required. yi = g1i and Ri = gr1i . (1)
Performance evaluation and comparisons indicate that the – Furthermore, KGC sets Di = ⟨yi , Ri ⟩ and securely
RCLS scheme outperforms other CLS schemes and is sends it to the user IDi .
suitable for IIoT.
Remark 1: After receiving Di from KGC, the user IDi
believes that Di is valid if and only if Equation (2) holds.
C. Organization ( )
ê (g1 , YKGC )hi = ê yi , gh1i · Ri · YKGC . (2)
The rest of the paper is organized as follows. We review
Karati et al.’s CLS scheme [1] in Section II. The proposed • Set-Secret-Value(params, Di ): Given params and Di , the
signature forgery attacks are presented in Section III. In Sec- secret value generation algorithm is run by the corre-
tion IV, we describe the proposed RCLS scheme together with sponding user IDi to generate its own secret value S Ki .
its security results. Performance evaluation and comparisons Concretely, the user IDi chooses ci , xi ∈R Z∗p and sets
are given in Section V. Finally, concluding remarks are made S Ki = ⟨ci , xi , Ri ⟩.
in Section VI. Besides, the involved complexity assumptions, • Set-Public-Key(params, S Ki , Di ): Given params, S Ki
the consistency analysis of the attack III and IV, an inaccuracy and Di , the public key generation algorithm is run by the
of [1] and the detailed security proofs of RCLS are given in corresponding user IDi to generate its own public key Yi .
the Supplemental Material. To be specific, the user IDi sets Yi = ⟨Yi,1 , Yi,2 ⟩, where
1

Yi,1 = yi i and Yi,2 = gc2i .

x
II. Review of Karati et al.’s CLS Scheme
• CLS-Sign(params, S KS , m): Given params, S KS and a
TABLE I message m ∈ Z∗p , the certificateless signature generation
Notations used in the Karati et al.’s CLS scheme.
algorithm is performed by the signatory with identity IDS
Notation Description to generate a signature σ on m. Specifically, the signatory
r ∈R S The element r is randomly chosen from the set S . does the following:
s1 ∥ s2 The bit concatenation of two strings s1 and s2 .
G1 , G2 Cyclic multiplicative groups of the same prime order p. – The signatory computes hS = H(IDS ).
g1 A generator of G1 .
IDi The identity of the user indexed by i. – It then chooses t ∈R Z∗p , computes σ1 = gt2 and
Di = ⟨yi , Ri ⟩ The partial private key of the user IDi .
S Ki (resp. Yi ) The private (resp. public) key of the user IDi . ( )( cS −t) xS
σ = ⟨σ1 , σ2 ⟩ A CLS signature. σ2 = gh1S · RS · YKGC m .
– Finally, the signatory sets σ = ⟨σ1 , σ2 ⟩ and sends
(m, σ) together with IDS and YS to the verifier.3
A. Karati et al.’s CLS Scheme • CLS-Verify(params, IDS , YS , m, σ): Given params, IDS ,
We first summarize the involved notations in Table I, and YS , m and σ, the certificateless signature verification
then briefly review Karati et al.’s CLS scheme [1]. algorithm is performed by the verifier below.
• Setup(k): Given a security parameter k, the system setup 3 If the signing result is outsourced to the CSP by the signatory, the verifier
algorithm is performed by KGC to generate system public can retrieve it from the CSP.

1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
Transactions on Industrial Informatics
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019
– The verifier computes hS = H(IDS ).
– It outputs VALID to indicate that σ is a valid signature
of m from IDS if and only if Equation (3) holds.
Otherwise, it returns INVALID.
 1 hS
 Y m 
 S ,2  ( )
  = ê YS ,1 , σ2 . (3)
σ1 
B. Claimed Security Properties
In this section, we first review the adversary model used in
[1] and then describe the claimed security properties.
1) Adversary Model for Certificateless Signature: In Karati
et al.’s CLS scheme [1], the security proof is based on the
adversary model defined in [6], [18], which is also used in
our security analysis. Specifically, two types of adversary with
distinct capabilities are considered.
• Type I Adversary: This type of adversary can mount
public key replacement attacks even if it does not have
knowledge of the master secret key.
• Type II Adversary: This type of adversary has knowl-
edge of the master secret key but cannot mount public
key replacement attacks.
Note that both Type I adversaries and Type II adversaries can
mount other attacks, such as the attack III and the attack IV
given in Section III-D and Section III-E, respectively. There-
fore, in our security analysis, we need to show RCLS can resist
Type I adversaries and Type II adversaries simultaneously.
2) Security Statements: The CLS scheme in [1] is claimed
to be secure against the Type I adversary (see Theorem 1 in
Section IV of [1]) and the Type II adversary (see Theorem 2
in Section IV of [1]) in the standard model under the BSDH
assumption and the EBSDH assumption, respectively. Due to
space limitation, we present the involved assumptions in the
Supplemental Material A.
III. Security Analysis of Karati et al.’s CLS Scheme
In this section, we first give an overview of attacks on the
CLS scheme, and then illustrate the details. We also identify
other disadvantages of [1].
A. Overview of Attacks
According to the details of the algorithms Set-Secret-Value
and Set-Public-Key, we know that for a user with identity IDi ,
the secret value is S Ki = ⟨ci , xi , Ri ⟩ and the public key is Yi =
⟨Yi,1 , Yi,2 ⟩. In particular, Yi,2 = gc2i is determined only by the
1 1) Get a valid tuple ⟨IDi , Yi , m, σ⟩ by eavesdropping on the
secret component ci which is not involved in Yi,1 = yi i . Most
x
importantly, for a given message m ∈ Z∗p , the corresponding
signature is σ = ⟨σ1 , σ2 ⟩. Note that σ1 is used to introduce
ci
randomization to the signature and σ2 = ∆( m −t) xi , where ∆ =
gh1i ·Ri ·YKGC is a constant. Therefore, given a previous signature
message ⟨IDi , Yi , m, σ⟩, it is possible for Type I adversaries to
randomly change the message m and correspondingly make
a replacement to Yi,2 such that m ci
is constant. In this case, a
Type I adversary can forge IDi ’s signature on any randomly
1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
4
chosen message, which corresponds to the scenario of Attack
I in Section III-B.
On the other hand, for Type II adversaries, public key
replacement is not allowed and hence m ci
in σ2 cannot be
changed. In addition, the secret component xi is unknown to
Type II adversaries. Consequently, if a Type II adversary aims
to forge Di ’s signature, it has to update the random value
t involved in σ2 . According to Equation (3), corresponding
update should be made to σ1 = gt2 . In other words, the Type
1
II adversary has to compute g2i which is used to change σ1
x
to σ∗1 . Because g2 = ê(g1 , g1 )y , the adversary only needs to
y
1
compute g1i . Particularly, the public component Yi,1 = yi i and
x x
y·hi
h +ri +y
yi = g1i . (4)
It follows from Equation
y
(4) that the Type II adversary is
capable of computing g1i in that it knows hi = H(IDi ), ri and
x
y. Therefore, the Type II adversary can forge IDi ’s signature
on a previous message, which corresponds to the scenario of
Attack II in Section III-C.
Finally, because ∆, ci and xi are constant, it is possible to
forge IDi ’s signature even if public key replacement is not
allowed and the master secret key cannot be accessed.
Any entity can forge IDi ’s signature by adopting the idea of
component-wise multiplication based on two or more previous
signature messages of IDi , which corresponds to the scenario
of Attack III in Section III-D. In particular, any entity can
also forge IDi ’s signature on any randomly chosen message by
adopting the idea of exponentiation re-randomization, which
corresponds to the scenario of Attack IV in Section III-E.
Remark 2: Both the Type I adversary and Type II adversary
can also launch the attack III and IV. However, to reflect the
different points, we assume the Type I adversary and Type II
adversary do not perform the procedures of attack III and IV
during the attack I and II. Furthermore, if a scheme is said
to be secure against both the Type I adversary and Type II
adversary, it can resist four attacks simultaneously.
B. Attack I: Forgery Attacks based on Public Key Replacement
Suppose a user (not KGC) with identity ID j ( j , i) intends
to forge IDi ’s signature. As shown in Figure 2, given a valid
signature message ⟨IDi , Yi , m, σ⟩ from IDi , for any randomly
chosen IIoT data m∗ ∈R Z∗p with m∗ , m, ID j can forge a
signature message ⟨IDi , Yi∗ , m∗ , σ⟩ by replacing the public key
of IDi . The details are as follows.
Forgery Attack I: ID j performs the following procedures.
public channel between IDi and the verifier. We know
Yi = ⟨Yi,1 , Yi,2 ⟩, σ = ⟨σ1 , σ2 ⟩ and
 h
 Yi,2 m1  i
  = ê (Yi,1 , σ2 ) .
σ1 
(5)
2) Choose m∗ ∈R Z∗p as IIoT data, where m∗ , m.
m∗
3) Set Yi∗ = ⟨Yi,1
∗ ∗
, Yi,2 ∗
⟩, where Yi,1 ∗
= Yi,1 and Yi,2 = Yi,2m .
∗ ∗
4) Send ⟨IDi , Yi , m , σ⟩ to the verifier.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
Transactions on Industrial Informatics
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019 5

Forgery Attack I 1) Get a valid tuple ⟨IDi , Yi , m, σ⟩ by eavesdropping on the

public channel between IDi and the verifier. We know
Yi = ⟨Yi,1 , Yi,2 ⟩, σ = ⟨σ1 , σ2 ⟩ and
 h
 Yi,2 m1  i
 = ê (Yi,1 , σ2 ) .
Adversary

σ1 
(7)
Eavesdrop

2) Choose x∗ ∈R Z∗p , and compute hi = H(IDi ),

hi + ri + y ( ai x
)∗
Verifier
ai = mod p, ∆i,1 = ê g1 , Yi,1 . (8)
The input and output of algorithms hi
Public channels
3) Set σ∗1 = σ1 · ∆−1 ∗
i,1 and σ2 = σ2 · ∆i,2 , where
Fig. 2. The scenario of attack I. ( ) x∗
∆i,2 = gh1i · Ri · YKGC . (9)
4) Send ⟨IDi , Yi , m, σ∗ ⟩ to the verifier, where σ∗ = ⟨σ∗1 , σ∗2 ⟩.
Verification: The forged signature message ⟨IDi , Yi∗ , m∗ , σ⟩
can be verified by the verifier as follows. Verification: The forged signature message ⟨IDi , Yi , m, σ∗ ⟩
can be verified by the verifier as follows.
1) Compute hi = H(IDi ).
2) Output VALID to indicate that σ is a valid signature of 1) Compute hi = H(IDi ).
m∗ from IDi if and only if Equation (6) holds. Otherwise, 2) Output VALID to indicate that σ∗ is a valid signature of m
it returns INVALID. from IDi if and only if Equation (10) holds. Otherwise,
it returns INVALID.
 ∗ 1 hi  h
 Yi,2 m∗  ( )  Yi,2 m1  i
  ∗
 σ1  = ê Yi,1 , σ2 . (6)   = ê (Yi,1 , σ∗2 ) .
σ∗1 
(10)

Correctness: It follows from Equation (5) that Equation (6) Correctness: It follows from Equation (7)-(9) that Equation
holds. In fact, (10) holds. In fact,

 ∗ 1 hi  m1 hi 
 Yi,2 m1
hi

 h  h
 Yi,2 m1  i  Yi,2 m1  i h
 Yi,2 m∗  Y  ( )
  =  i,2  = ê (Yi,1 , σ2 ) = ê Y ∗ , σ2 . 
σ∗1
 = 
σ1 · ∆−1
 = 
σ1 
 · ∆ i
i,1
 σ1   σ1  i,1 i,1
( ) ( ( ) ∗ ) hi ( ∗ )
ai x
= ê Yi,1 , σ2 ê g1 , Yi,1 = ê Yi,1 , σ2 · g1x ·(hi +ri +y)
( ) ( )
= ê Yi,1 , σ2 · ∆i,2 = ê Yi,1 , σ∗2 .
C. Attack II: Forgery Attacks from Malicious-but-Passive KGC
In this case, the adversary is a malicious but passive KGC
who wants to forge signatures of users. Suppose KGC intends
to forge IDi ’s signature and hence it keeps the random value D. Attack III: Forgery Attacks from Anyone (based on Two
ri as a preparation, where ri is chosen in the generation of the Previous Signature Messages)
partial private key Di according to Equation (1). As shown Based on the attack III, anyone including IIoT users and
in Figure 3, given a valid signature message ⟨IDi , Yi , m, σ⟩ KGC can act as an adversary to forge signatures of the CLS
from IDi , msk, ri and Di = ⟨yi , Ri ⟩, the adversary can forge a scheme. As shown in Figure 4, given two valid signature
signature message ⟨IDi , Yi , m, σ∗ ⟩. The details are as follows. messages ⟨IDi , Yi , m(1) , σ(1) ⟩ and ⟨IDi , Yi , m(2) , σ(2) ⟩ from IDi
with m(1) + m(2) , 0, anyone can forge a signature message
⟨IDi , Yi , m∗ , σ∗ ⟩ as follows.
Forgery Attack II
Forgery Attack III: The adversary does the following:
1) Get two tuples ⟨IDi , Yi , m(1) , σ(1) ⟩ and ⟨IDi , Yi , m(2) , σ(2) ⟩
KGC
Malicious but Passive by eavesdropping on the public channel between IDi and
the verifier. We know Yi = ⟨Yi,1 , Yi,2 ⟩, σ(1) = ⟨σ(1) (1)
1 , σ2 ⟩,
(2) (2)
Eavesdrop
σ = ⟨σ1 , σ2 ⟩ and
(2)

  hi   hi
 Yi,2 m(1)
1
 ( )  Yi,2 m(2)
1
 ( )
Verifier  (1)  = ê Yi,1 , σ(1)
2


,  (2)  = ê Yi,1 , σ(2)
2 . (11)
The input and output of algorithms σ1 σ 1
Public channels
2) Set m∗ = m(1) m(2)
m(1) +m(2)
and σ∗ = ⟨σ∗1 , σ∗2 ⟩, where
Fig. 3. The scenario of attack II.
σ∗1 = σ(1) (2) ∗ (1) (2)
1 · σ1 , σ2 = σ2 · σ2 . (12)
Forgery Attack II: The adversary does the following: 3) Send ⟨IDi , Yi , m∗ , σ∗ ⟩ to the verifier.

1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
Transactions on Industrial Informatics
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019 6

m m
3) Set σ∗ = ⟨σ∗1 , σ∗2 ⟩, where σ∗1 = σ1m and σ∗2 = σ2m .
∗ ∗
Forgery Attack III
4) Send ⟨IDi , Yi , m∗ , σ∗ ⟩ to the verifier.
Verification: The forged signature message ⟨IDi , Yi , m∗ , σ∗ ⟩
can be verified by the verifier as follows.
Adversary
1) Compute hi = H(IDi ).
2) Output VALID to indicate that σ∗ is a valid signature
Eavesdrop

of m∗ from IDi if and only if Equation (15) holds.

Otherwise, it returns INVALID.
Verifier
The input and output of algorithms  1 hi
 Y m∗ 
Public channels
 i,2  ( ∗)
 ∗  = ê Yi,1 , σ2 . (15)
Fig. 4. The scenario of attack III.
σ1

Correctness: It follows from Equation (14) that Equation

Verification: The forged signature message ⟨IDi , Yi , m∗ , σ∗ ⟩ (15) holds. Due to space limitation, please refer to the Sup-
can be verified by the verifier as follows. plemental Material B for details.
1) Compute hi = H(IDi ).
2) Output VALID to indicate that σ∗ is a valid signature Remark 3 (Other Disadvantages): Due to space limitation,
of m∗ from IDi if and only if Equation (13) holds. please refer to the Supplemental Material C for details.
Otherwise, it returns INVALID.
 h
 Yi,2 m1∗  i ( ) IV. RCLS: Robust Certificateless Signature for IIoT
 ∗  = ê Yi,1 , σ∗2 . (13)
σ1
A. Challenge and Main Idea
Correctness: It follows from Equation (11) and Equation
(12) that Equation (13) holds. Due to space limitation, please In Karati et al.’s CLS scheme [1], for a given message m,
refer to the Supplemental Material ?? for details. the signature generated by IDi with public key Yi = ⟨Yi,1 , Yi,2 ⟩
is σ = ⟨σ1 , σ2 ⟩, as shown in Section II-A, where σ1 = gt2 and
cS
σ2 = ∆( m −t) xS with ∆ = gh1i · Ri · YKGC .
E. Attack IV: Forgery Attacks from Anyone (based on Any
Based on the analysis in Section III-A, to resist attack I, we
Previous Signature Message)
can bind Yi,2 with IDi and σ2 simultaneously.ci
To
x
defeat attack
As shown in Figure 5, given a valid signature message −t i
II, IDi can change σ2 from ∆( m −t) xi to ∆( m ) ci , which makes
ci

⟨IDi , Yi , m, σ⟩ from IDi , for any randomly chosen IIoT data the adversary fail to compute corresponding σ1 . Attackc III can
m∗ ∈R Z∗p with m∗ , m, anyone can forge a signature message i −m·t xi
be easily resisted by changing σ2 from ∆( m −t) xi to ∆( m ) ci ,
ci

⟨IDi , Yi , m∗ , σ∗ ⟩. The details are as follows.

which makes it impossible to get a suitable message. However,
the above improvements fail to resist attack IV in that it
Forgery Attack IV
can avoid the involvement of secret ci by re-randomizing the
exponentiations in σ1 and σ2 simultaneously.
In order to defeat attack I, II, III and IV simultaneously,
Adversary we introduce the idea of partial private key generation into
Eavesdrop
the short signature scheme [39], which does not need MTP
hash functions and is proven existentially unforgeable against
chosen-message attacks in the standard model. On the other
Verifier
hand, in order to achieve robustness by eliminating secure
The input and output of algorithms channels, the idea of key exchange is exploited in the par-
Public channels tial private key generation. To improve the computation and
storage performance, we present our RCLS scheme based on
Fig. 5. The scenario of attack IV. the elliptic curve analogue of [39].

Forgery Attack IV: The adversary does the following: TABLE II

1) Get a valid tuple ⟨IDi , Yi , m, σ⟩ by eavesdropping on the Notations used in Our RCLS.
public channel between IDi and the verifier. We know Notation Description
Yi = ⟨Yi,1 , Yi,2 ⟩, σ = ⟨σ1 , σ2 ⟩ and G1 (resp. G2 ) A cyclic additive (resp. multiplicative) group of prime order p.
A generator of G1 .
 h P
 Yi,2 m1  i uski /upki The user side secret/public key of IDi .
  = ê (Yi,1 , σ2 ) . pski /ppki The partial private/public key of IDi .
σ1 
(14) ski /pki The secret/public key of IDi .
σ = ⟨t, δ⟩ A RCLS signature.

2) Choose m∗ ∈R Z∗p as IIoT data, where m∗ , m.

1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019
B. Design Details of RCLS
For ease of reference, we first list some notations in Table
II, which are used in RCLS. Then, RCLS is described in detail.
• Setup(k): As shown in Figure 6, given a security parame-
ter k, the system setup algorithm is performed by KGC to
generate system public parameters params and a master
secret key msk. For simplicity, params is not reflected in
Figure 6. The details are as follows:
(4) Set-Full-Secret-Key
(2) Set-User-Side-Secret-Key
User
(5) Set-Full-Public-Key
The input and output of algorithms
Fig. 6. The procedures of system setup and key generation.
– KGC first chooses a bilinear map ê : G1 × G1 →
G2 , where G1 is a cyclic additive group and G2 is
a cyclic multiplicative group, with the same prime
order p. It also picks three collision-resistant hash
functions H0 : G1 → Z∗p , H1 : {0, 1}ℓID × G21 → Z∗p
and H2 : {0, 1}∗ × {0, 1}ℓID → Z∗p , where ℓID is the bit
length of a user identity.
– Furthermore, KGC chooses s ∈R Z∗p as its private key
and calculates the corresponding public key PKGC =
sP, where P is a generator of G1 . It also computes
Y = ê(P, P).
– Finally, KGC keeps msk = s private and publishes
params = ⟨G1 , G2 , p, ê, P, PKGC , Y, H0 , H1 , H2 ⟩.
• Set-User-Side-Secret(params): The user-side secret val-
ue generation algorithm is run by users. Given params,
a user with identity IDi chooses xi ∈R Z∗p and computes
Xi = xi P. It then sets uski = xi and upki = Xi .
• Set-Partial-Private-Key(params, msk, IDi , upki ): The al-
gorithm is run by KGC to generate a partial private key
pski and the corresponding partial public key ppki for
users. As shown in Figure 6, given params, msk, and IDi ,
upki received from the user, KGC does the following:
– KGC chooses ri ∈R Z∗p , and computes Ri = ri P, h1,i =
H1 (IDi ∥ Xi ∥ Ri ) and ki = ri +s·h1,i +H0 (sXi ) mod p.
– Then, KGC returns ppki = Ri and pski = ki through
public channels.
• Set-Full-Secret-Key(params, IDi , uski , upki , pski , ppki ):
The algorithm is performed by a user to generate its full
secret key ski . Given params, IDi , uski , upki , pski and
ppki , the corresponding user IDi does the following:
– IDi computes di = ki − H0 (xi PKGC ) mod p.
– It computes h1,i = H1 (IDi ∥ Xi ∥ Ri ) and checks
if Equation (16) holds. It it holds, IDi believes that
1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Industrial Informatics
7
pski is valid and proceeds. Otherwise, IDi applies a
partial private key from KGC again.
di P = Ri + h1,i PKGC . (16)
– IDi keeps ski = ⟨xi , di ⟩.
• Set-Full-Public-Key(params, upki , ppki ): Upon receiv-
ing params, upki and ppki , the user runs the full public
key generation algorithm to generate its own full public
key pki . To be specific, the user IDi outputs pki = ⟨Xi , Ri ⟩.
(1) Setup
• RCLS-Sign(params, IDS , skS , m): As illustrated in Fig-
ure 7, given params, IDS , skS and a message m ∈ {0, 1}∗ ,
the certificateless signature generation algorithm is per-
formed by the signatory with identity IDS to generate a
KGC
signature σ on m. The signatory does the following:
RCLS-Sign RCLS-Verify
(3) Set-Partial-Private-Key
A public channel
Signatory CSP Verifier
The input and output of algorithms
A public channel
Fig. 7. The procedures of signing and verification.
– The signatory computes h2,S = H2 (m ∥ IDS ).
– It then chooses t ∈R Z∗p , and computes
( )
δ = xS · t + dS + h2,S −1 P.
– Finally, the signatory sets σ = ⟨t, δ⟩ and sends (m, σ)
together with IDS and pkS to the verifier.
• RCLS-Verify(params, IDS , pkS , m, σ): As shown in Fig-
ure 7, given params, IDS , pkS , m and σ, the certificate-
less signature verification algorithm is run by the verifier.
– The verifier computes h1,S = H1 (IDS ∥ XS ∥ RS ) and
h2,S = H2 (m ∥ IDS ).
– It outputs VALID to indicate that σ is a valid signature
of m from IDS if and only if Equation (17) holds.
Otherwise, it returns INVALID.
( )
ê δ, tXS + RS + h1,S PKGC + h2,S P = Y. (17)
C. Consistency of RCLS
The proposed RCLS scheme achieves consistency because
Equation (17) holds. In fact,
( )
ê δ, tXS + RS + h1,S PKGC + h2,S P
( ( ) )
= ê δ, xS · t + rS + s · h1,S + h2,S P
(( )−1 ( ) )
= ê xS · t + dS + h2,S P, xS · t + dS + h2,S P = Y.
D. Security Results
In this section, we show that RCLS can resist both Type
I and Type II adversaries under the SDH assumption. Due
to space limitation, please refer to the Supplemental Material
A for detailed SDH assumption. In addition, please refer to
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019
the Supplemental Material D for proofs of Theorem 1 and
Theorem 2.
Theorem 1: For an adversary of Type I, RCLS is existential-
ly unforgeable against chosen-message attacks in the standard
model under the (q s + 1)-SDH assumption, where q s is the
number of signing queries made by the adversary.
Theorem 2: For Type II adversaries, RCLS is existentially
unforgeable against chosen-message attacks in the standard
model under the (q s + 1)-SDH assumption.
V. Performance Evaluation
Although substantial research has been done on the design
and analysis of CLS for secure data crowdsensing in cloud and
IoT enabled applications, only schemes [1], [27], [29], [30],
[31], [32], [33], [34], [35], [36], [37] are developed in the
standard model. Furthermore, in [27], [29], [30], [31], [32],
[33], [35], [36], both the space and time complexities are not
constant and usually lead to large public parameters and heavy
computation time. Therefore, as shown in Table III, we only
compare the CLS schemes in [1], [34], [37] and our RCLS in
terms of security properties and efficiency. In Table III, we de-
note by T p , T e , T spm and T pm the time cost of a bilinear pairing,
an exponentiation, a simultaneous point multiplication, and a
point multiplication, respectively. The symbol ℓ p represents
the bit length of the group order p. Obviously, the scheme [1]
suffers from security flaws. Particularly, only RCLS realizes
robustness and it is most efficient according to the computation
cost and signature length. For convenience of observation,
we implement our RCLS and the scheme [37] (CLS-YW14)
and [34] (CLS-CT16) on a XiaoMi 5s Mobile Phone (with
2.15 GHz Qualcomm Snapdragon 821 CPU, 4 GB RAM
memory, and OS Android 7.0) based on the Java Pairing Based
Cryptography Library (JPBC) 2.0.0 [40]. In our experiments,
Type A1 pairings are exploited which are constructed on the
curve y2 = x3 +x over the field F p with p having length of 1024
bit. As shown in Figure 8, the computation cost comparison
is made based on the signing time and the verification time in
Figure 8(a) and Figure 8(b), respectively. To clearly present
the computation cost, the vertical axis adopts the log scale.
It easily follows that RCLS is very efficient in terms of the
computation cost.
TABLE III
Comparisons of CLS schemes in the standard model
Computation Cost† Security Against
Schemes Signature Size
Signing Verification Type I
[1] 3T e T p + 2T e 2ℓ p
[37] 3T e 6T p + T e 3ℓ p
[34] 6T e 4T p + 2T e 4ℓ p
Our RCLS T pm T p + T spm + T pm 2ℓ p
† in CRYPTO. Springer, 2007, pp. 430–447.
For the sake of simplicity, pre-computation is not considered in the comparison.
VI. Conclusions and Future Work
Aiming to ensure the data crowdsensing security in cloud-
assisted IIoT, we analyzed the security of a CLS scheme with-
out MTP and ROM, and showed that four types of signature
forgery attacks exist and hence the scheme fails to achieve
the claimed security properties. Furthermore, we proposed a
1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Industrial Informatics
8
102 102
CLS-YW14
CLS-CT16
CLS-YW14
CLS-CT16
Our RCLS Our RCLS
The Computation Time (ms)
The Computation Time (ms)
101
101
100
100
10-1
1 20 40 60
The Number of Signatures
80 100 1 20 40 60
The Times of Verification
80 100
(a) Signing Time (b) Verification Time
Fig. 8. The computation cost comparison.
robust certificateless signature scheme without MTP and ROM
to address the typical data authenticity challenges in cloud-
assisted IIoT. Finally, our security and performance analysis
showed that RCLS is secure and efficient. In future research,
it would be interesting to design efficient and privacy-aware
RCLS schemes for cloud-assisted IIoT application scenarios.
Acknowledgment
The authors would like to thank the editors and anonymous
referees for their invaluable suggestions. This research is
supported by National Key R&D Program of China (No.
2017YFB0802000), the AXA Research Fund, National Nat-
ural Science Foundation of China (No. 61772418, 61602378,
61402366), and Natural Science Basic Research Plan in
Shaanxi Province of China (No. 2018JZ6001, 2015JQ6236),
and the Youth Innovation Team of Shaanxi Universities.
Yinghui Zhang is supported by New Star Team of Xi’an
University of Posts & Telecommunications (2016-02).
References
[1] A. Karati, S. H. Islam, and M. Karuppiah, “Provably secure and
lightweight certificateless signature scheme for iiot environments,” IEEE
Transactions on Industrial Informatics, vol. 14, no. 8, pp. 3701–3711,
2018.
[2] Gartner. (2017) Gartner says 8.4 billion connected “things” will be in
use. [Online]. Available: https://www.gartner.com/newsroom/id/3598917
[3] L. Da Xu, W. He, and S. Li, “Internet of things in industries: A survey,”
IEEE Transactions on industrial informatics, vol. 10, no. 4, pp. 2233–
2243, 2014.
[4] X. Li, J. Niu, M. Z. A. Bhuiyan, F. Wu, M. Karuppiah, and S. Kumari,
“A robust ecc-based provable secure authentication protocol with privacy
preserving for industrial internet of things,” IEEE Transactions on
Industrial Informatics, vol. 14, no. 8, pp. 3599–3609, 2018.
[5] A. Shamir, “Identity-based cryptosystems and signature schemes,” in
CRYPTO. Springer, 1984, pp. 47–53.
[6] S. S. Al-Riyami and K. G. Paterson, “Certificateless public key cryp-
tography,” in ASIACRYPT. Springer, 2003, pp. 452–473.
Robustness
Type II [7] M. H. Au, Y. Mu, J. Chen, D. S. Wong, J. K. Liu, and G. Yang,
× × × “Malicious kgc attacks in certificateless cryptography,” in ASIACCS.
X X ×
X X × ACM, 2007, pp. 302–311.
X X X [8] V. Goyal, “Reducing trust in the pkg in identity based cryptosystems,”
[9] A. Karati and G. Biswas, “Efficient and provably secure random oracle-
free adaptive identity-based encryption with short-signature scheme,”
Security and Communication Networks, vol. 9, no. 17, pp. 4060–4074,
2016.
[10] Z. Bi, L. Da Xu, and C. Wang, “Internet of things for enterprise systems
of modern manufacturing,” IEEE Transactions on industrial informatics,
vol. 10, no. 2, pp. 1537–1546, 2014.
[11] I. J. Vergara-Laurens, L. G. Jaimes, and M. A. Labrador, “Privacy-
preserving mechanisms for crowdsensing: Survey and research chal-
lenges,” IEEE Internet of Things Journal, vol. 4, no. 4, pp. 855–869,
2017.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TII.2019.2894108, IEEE
Transactions on Industrial Informatics
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2019
[12] M. Ma, D. He, N. Kumar, K.-K. R. Choo, and J. Chen, “Certificateless
searchable public key encryption scheme for industrial internet of
things,” IEEE Transactions on Industrial Informatics, vol. 14, no. 2,
pp. 759–767, 2018.
[13] Y. Zhang, R. H. Deng, X. Liu, and D. Zheng, “Outsourcing service fair
payment based on blockchain and its applications in cloud computing,”
IEEE Transactions on Services Computing, Online, 2018.
[14] Y. Zhang, R. H. Deng, X. Liu, and D. Zheng, “Blockchain based efficient
and robust fair payment for outsourcing services in cloud computing,”
Information Sciences, vol. 462, pp. 262–277, 2018.
[15] Y. Zhang, R. H. Deng, J. Shu, K. Yang, and D. Zheng, “TKSE: Trust-
worthy keyword search over encrypted data with two-side verifiability
via blockchain,” IEEE Access, vol. 6, pp. 31077–31087, 2018.
[16] J. Shu, X. Jia, K. Yang, and H. Wang, “Privacy-preserving task recom-
mendation services for crowdsourcing,” IEEE Transactions on Services
Computing, Online, 2018.
[17] Y. Zhang, X. Chen, J. Li, D. S. Wong, H. Li, and I. You, “Ensuring
attribute privacy protection and fast decryption for outsourced data
security in mobile cloud computing,” Information Sciences, vol. 379,
pp. 42–61, 2017.
[18] X. Huang, W. Susilo, Y. Mu, and F. Zhang, “On the security of cer-
tificateless signature schemes from asiacrypt 2003,” in CANS. Springer,
2005, pp. 13–25.
[19] Z. Zhang, D. S. Wong, J. Xu, and D. Feng, “Certificateless public-key
signature: security model and efficient construction,” in ACNS. Springer,
2006, pp. 293–308.
[20] K.-H. Yeh, C. Su, K.-K. R. Choo, and W. Chiu, “A novel certificateless
signature scheme for smart objects in the internet-of-things,” Sensors,
vol. 17, no. 5, pp. 1–17, 2017.
[21] X. Jia, D. He, Q. Liu, and K.-K. R. Choo, “An efficient provably-secure
certificateless signature scheme for internet-of-things deployment,” Ad
Hoc Networks, vol. 71, pp. 78–87, 2018.
[22] K. Choi, J. Park, J. Hwang, and D. Lee, “Efficient certificateless
signature schemes,” in ACNS. Springer, 2007, pp. 443–458.
[23] X. Huang, Y. Mu, W. Susilo, D. S. Wong, and W. Wu, “Certificateless
signatures: new schemes and security models,” The computer journal,
vol. 55, no. 4, pp. 457–474, 2011.
[24] R. Tso, X. Yi, and X. Huang, “Efficient and short certificateless
signature,” in CANS. Springer, 2008, pp. 64–79.
[25] D. He, B. Huang, and J. Chen, “New certificateless short signature
scheme,” IET Information Security, vol. 7, no. 2, pp. 113–117, 2013.
[26] A. Karati, S. H. Islam, and G. Biswas, “A pairing-free and provably
secure certificateless signature scheme,” Information Sciences, vol. 450,
pp. 378–391, 2018.
[27] D. H. Yum and P. J. Lee, “Generic construction of certificateless
signature,” in ACISP. Springer, 2004, pp. 200–211.
[28] B. C. Hu, D. S. Wong, Z. Zhang, and X. Deng, “Key replacement attack
against a generic construction of certificateless signature,” in ACISP.
Springer, 2006, pp. 235–246.
[29] J. K. Liu, M. H. Au, and W. Susilo, “Self-generated-certificate public
key cryptography and certificateless signature/encryption scheme in the
standard model,” in ASIACCS. ACM, 2007, pp. 273–283.
[30] H. Xiong, Z. Qin, and F. Li, “An improved certificateless signature
scheme secure in the standard model,” Fundamenta Informaticae,
vol. 88, no. 1-2, pp. 193–206, 2008.
[31] Y. Yuan, D. Li, L. Tian, and H. Zhu, “Certificateless signature scheme
without random oracles,” in ISA. Springer, 2009, pp. 31–40.
[32] Y. Yu, Y. Mu, G. Wang, Q. Xia, and B. Yang, “Improved certificateless
signature scheme provably secure in the standard model,” IET Informa-
tion Security, vol. 6, no. 2, pp. 102–110, 2012.
[33] Y.-H. Hung, S.-S. Huang, Y.-M. Tseng, and T.-T. Tsai, “Certificateless
signature with strong unforgeability in the standard model,” Informatica,
vol. 26, no. 4, pp. 663–684, 2015.
[34] S. Canard and V. C. Trinh, “An efficient certificateless signature scheme
in the standard model,” in ICISS. Springer, 2016, pp. 175–192.
[35] W. Yang, J. Weng, W. Luo, and A. Yang, “Strongly unforgeable cer-
tificateless signature resisting attacks from malicious-but-passive kgc,”
Security and Communication Networks, vol. 2017, pp. 1–8, 2017.
[36] K.-A. Shim, “A new certificateless signature scheme provably secure
in the standard model,” IEEE Systems Journal, 2018. Available online:
http://dx.doi.org/10.1109/JSYST.2018.2844809
[37] Y. Yuan and C. Wang, “Certificateless signature scheme with security
enhanced in the standard model,” Information Processing Letters, vol.
114, no. 9, pp. 492–499, 2014.
[38] Q. Xia, C. X. Xu, and Y. Yu, “Key replacement attack on two certifi-
cateless signature schemes without random oracles,” Key Engineering
Materials, vol. 439, pp. 1606–1611, 2010.
1551-3203 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
9
[39] D. Boneh and X. Boyen, “Short signatures without random oracles,” in
EUROCRYPT. Springer, 2004, pp. 56–73.
[40] A. D. Caro and V. Iovino, “jpbc: Java pairing based cryptography,” in
ISCC. IEEE, 2011, pp. 850–855.
Yinghui Zhang (M’18) is a professor of NELWS,
Xi’an University of Posts & Telecommunications
since 2018. He got his Ph.D degree in cryptography
from Xidian University, China, in 2013. He has pub-
lished over 80 research articles in ACM ASIACCS,
IEEE Transactions on Services Computing, Com-
puter Networks, IEEE Internet of Things Journal,
Computers & Security, etc. His research interests
include public key cryptography, cloud security, IoT
security and privacy, and wireless network security.
Robert H. Deng (F’16) is AXA Chair Professor of
Cybersecurity and Professor of Information Systems
in the School of Information Systems, Singapore
Management University since 2004. His research in-
terests include data security and privacy, multimedia
security, network and system security. He served/is
serving on the editorial boards of many international
journals in security, including the IEEE TIFS, IEEE
TDSC, and IEEE Security and Privacy Magazine.
He is a fellow of the IEEE.
Dong Zheng received his Ph.D. degree in communi-
cation engineering from Xidian University, China, in
1999. He was a Professor at the School of Informa-
tion Security Engineering, Shanghai Jiao Tong Uni-
versity. He is currently a Professor at NELWS, Xi’an
University of Posts & Telecommunications. He has
published over 100 research articles including CT-
RSA, IEEE Transactions on Industrial Electronics,
Information Sciences. His research interests include
cloud computing security, public key cryptography.
Jin Li is currently a professor of School of Comput-
er Science, Guangzhou University. He got his Ph.D
degree in information security from Sun Yat-sen
University at 2007. He served as a senior research
associate at Korea Advanced Institute of Technology
(Korea) and Illinois Institute of Technology (U.S.A.)
from 2008 to 2010, respectively. His research inter-
ests include secure cloud storage and outsourcing
computation.
Pengfei Wu received the B.Eng degree in software
engineering from Shandong University, Jinan, China,
in 2016. He is currently pursuing the Ph.D. degree of
information security in Peking University, Beijing,
China. His research interests include cloud security
and big data security.
Jin Cao received the B.S. and Ph.D. degrees from X-
idian University, in 2008 and 2015, respectively. He
has been an associate professor in the School of Cy-
ber Engineering, Xidian University, Xi’an Shaanxi,
China. His research interests include wireless net-
work security and cloud security.