SDACS: Blockchain-Based Secure and Dynamic Access Control Scheme for Internet of Things

3.2.1. Basic Algorithms

3.2.2. Security Model

• Create-user query: ${\mathcal{A}}_I$ inputs a query $ID$, and $\mathcal{C}$ searches the user list ${\mathcal{L}}_u$ to confirm whether the user has been created. If so, $\mathcal{C}$ will return ${UPK}_{ID}$ to ${\mathcal{A}}_I$. Otherwise, $\mathcal{C}$ will execute a series of algorithms to create users. Then, $\mathcal{C}$ adds $(ID,PID,d_{ID},x_{ID},{UPK}_{ID})$ to ${\mathcal{L}}_u$, and sends ${UPK}_{ID}$ and $PID$ to ${\mathcal{A}}_I$. It is assumed that create-user query is always asked before other oracles.
• Hash query: ${\mathcal{A}}_I$ sends the relevant parameters to $\mathcal{C}$ to obtain the corresponding hash value.
• TCA partial private key query: ${\mathcal{A}}_I$ requests the TCA partial private key of the user, whose pseudonym is $PID$. In response, $\mathcal{C}$ searches list ${\mathcal{L}}_u$ and returns $d_{ID}$ to ${\mathcal{A}}_I$.
• User private key generation query: ${\mathcal{A}}_I$ requests the private key of the user, whose pseudonym is $PID$. The challenger $\mathcal{C}$ outputs the corresponding user private key $x$. If the public key is replaced and ${\mathcal{A}}_I$ does not provide the corresponding $x^{\prime }$, then $\perp$ is returned.
• User public key replacement query: For any user whose pseudonym is $PID$, the adversary ${\mathcal{A}}_I$ can choose a new public key $(x^{\prime },{UPK}^{\prime })$, and $\mathcal{C}$ will replace $(x,UPK)$ of the user. In addition, ${\mathcal{A}}_I$ may not provide $x^{\prime }$ corresponding to ${UPK}^{\prime }$. In this case, $x^{\prime }=\perp$ is returned.
• Message authentication encryption query: Challenger $\mathcal{C}$ runs the $AuEncrypt\left(\right)$ algorithm and outputs the message ciphertext, satisfying $Verify\left(PID,M,Cipher,pp,PK,{UPK}_{ID}\right)=1$, where ${UPK}_{ID}$ is the latest public key stored in ${\mathcal{L}}_u$.

• Create-user query: ${\mathcal{A}}_{II}$ takes as input a query $ID$, and $\mathcal{C}$ searches the user list ${\mathcal{L}}_u$ to confirm whether the user has been created. If so, $\mathcal{C}$ will return ${UPK}_{ID}$ to ${\mathcal{A}}_{II}$. Otherwise, $\mathcal{C}$ will execute a series of algorithms to create users. Then, $\mathcal{C}$ adds $(ID,PID,d_{ID},x_{ID},{UPK}_{ID})$ to ${\mathcal{L}}_u$, and sends ${UPK}_{ID}$ and $PID$ to ${\mathcal{A}}_{II}$. It is assumed that create-user query is always asked before other oracles.
• Hash query: ${\mathcal{A}}_{II}$ sends the relevant parameters to $\mathcal{C}$ to obtain the corresponding hash value.
• TCA partial private key query: ${\mathcal{A}}_{II}$ requests the TCA partial private key of the user, whose pseudonym is $PID$. In response, $\mathcal{C}$ searches list ${\mathcal{L}}_u$ and returns $d_{ID}$ to ${\mathcal{A}}_{II}$.
• User private key generation query: ${\mathcal{A}}_{II}$ requests the private key of the user, whose pseudonym is $PID$. The challenger $\mathcal{C}$ outputs the corresponding user private key $x$. If the public key is replaced and ${\mathcal{A}}_{II}$ does not provide the corresponding $x^{\prime }$, then $\perp$ is returned.
• User public key replacement query: For any user whose pseudonym is $PID$, the adversary ${\mathcal{A}}_{II}$ can choose a new public key $(x^{\prime },{UPK}^{\prime })$, and $\mathcal{C}$ will replace $(x,UPK)$ of the user. In addition, ${\mathcal{A}}_{II}$ may not provide $x^{\prime }$ corresponding to ${UPK}^{\prime }$. In this case, $x^{\prime }=\perp$ is returned.
• Message authentication encryption query: Challenger $\mathcal{C}$ runs the $AuEncrypt\left(\right)$ algorithm and outputs the message ciphertext, satisfying $Verify\left(PID,M,Cipher,pp,PK,{UPK}_{ID}\right)=1$, where ${UPK}_{ID}$ is the latest public key stored in ${\mathcal{L}}_u$.

3.3.1. Process 1: System Initialization and User Registration Process

3.3.2. Process 2: Data Encryption Process

3.3.3. Process 3: Blockchain Initialization Process

3.3.4. Process 4: Access Control Process

3.3.5. Process 5: Data Decryption Process

5.1.1. Proof of Correctness

(1)

Correctness of the message ciphertext

(2)

Correctness of message decryption

5.1.2. Proof of Security

• Create-user query: For the query with identity $ID$, $\mathcal{C}$ queries the list ${\mathcal{L}}_u$. If there is a corresponding entry in the list, ${UPK}_{ID}$ is returned. Otherwise, if $ID\ne {ID}_g$, $\mathcal{C}$ generates a pseudonym $PID$, randomly selects $d_{ID},h_1,x_{ID}\in Z_p^{*}$, calculates $R_{ID}=d_{ID}P-Q_2{h}_1,X_{ID}=x_{ID}P$, and sets $h_1=H_1\left(PID\right|\left|R_{ID}\right|\left|Q_2\right)$. If $ID={ID}_g$, $\mathcal{C}$ randomly selects $r_{ID},x_{ID},h_1\in Z_p^{*}$, and computes $R_{ID}=r_{ID}P,X_{ID}=x_{ID}P,h_1=H_1\left(PID\right|\left|R_{ID}\right|\left|Q_2\right)$. Finally, $\mathcal{C}$ sends ${UPK}_{ID}=(R_{ID},X_{ID})$ and pseudonym $PID$ to ${\mathcal{A}}_I$, and adds $(ID,PID,R_{ID},X_{ID},d_{ID},x_{ID},h_1)$ to the list ${\mathcal{L}}_u$.
• $H_1$ query: When receiving the query $H_1\left(PID\left|\left|R_{ID}\right|\right|Q_2\right)$ from ${\mathcal{A}}_I$, $\mathcal{C}$ queries the list ${\mathcal{L}}_1$. If $(PID,R_{ID},Q_2,h_1)$ is in the list, it returns $h_1$ to ${\mathcal{A}}_I$. Otherwise, $\mathcal{C}$ performs the create-user operation and extracts $h_1$ from ${\mathcal{L}}_u$ and returns it to ${\mathcal{A}}_I$.
• $H_2$ query: When receiving the query $H_2\left(m\right|\left|T\right|\left|PID\right|\left|Q_2\right|\left|R_{ID}\right|\left|X_{ID}\right)$ from ${\mathcal{A}}_I$, $\mathcal{C}$ queries the list ${\mathcal{L}}_2$. If the query value $(m,T,PID,Q_2,R_{ID},X_{ID},h_2)$ is in list, then $\mathcal{C}$ returns $h_2$ to ${\mathcal{A}}_I$. Otherwise, $\mathcal{C}$ randomly selects $h_2\in Z_p^{*}$ and sets $h_2=H_2\left(m\right|\left|T\right|\left|PID\right|\left|Q_2\right|\left|R_{ID}\right|\left|X_{ID}\right)$. Finally, $\mathcal{C}$ returns $h_2$ to ${\mathcal{A}}_I$.
• $H_3$ query: When receiving a request $H_3\left(V\right)$ from ${\mathcal{A}}_I$, $\mathcal{C}$ queries the list ${\mathcal{L}}_3$. If the query value $V$ exists in the list ${\mathcal{L}}_3$, it returns $h_3$ to ${\mathcal{A}}_I$. Otherwise, $\mathcal{C}$ selects the random number $h_3\in Z_p^{*}$, sets $h_3=H_3\left(V\right)$, and returns $h_3$ to ${\mathcal{A}}_I$.
• TCA partial private key query: When receiving the query $(PID,d_{ID})$ from ${\mathcal{A}}_I$, if $PID=P{ID}_g$, $\mathcal{C}$ returns $\perp$ and terminates the game. Otherwise, $\mathcal{C}$ searches list ${\mathcal{L}}_u$ and returns $d_{ID}$ to ${\mathcal{A}}_I$.
• User private key generation query: When receiving a request $(PID,x_{ID})$ from ${\mathcal{A}}_I$, $\mathcal{C}$ queries the list ${\mathcal{L}}_u$. If $(PID,x_{ID})$ is in the list, then it returns $x_{ID}$ to ${\mathcal{A}}_I$. Here, when the user’s public key is replaced and ${\mathcal{A}}_I$ does not provide the corresponding $x_{ID}$, the command to extract the user’s private key does not output the user’s private key.
• User public key replacement query: When receiving the query $(PID,R_{ID}^{\prime },X_{ID}^{\prime })$ from ${\mathcal{A}}_I$, $\mathcal{C}$ queries the list ${\mathcal{L}}_u$ and replaces the existing public key $(R_{ID},X_{ID})$ with $(R_{ID}^{\prime },X_{ID}^{\prime })$, where $x_{ID}$ is set to $\perp$.
• Message authentication encryption query: $\mathcal{C}$ checks whether these three tuples, $\left(PID,R_{ID},X_{ID},d_{ID},x_{ID},h_1\right)$, $\left(PID,R_{ID},Q_2,h_1\right),$ and $(m,T,PID,Q_2,R_{ID},X_{ID},h_2)$, are in the lists ${\mathcal{L}}_u,{\mathcal{L}}_1$, and ${\mathcal{L}}_2$, respectively.