An Obfuscatable Aggregatable Signcryption Scheme for Unattended Devices in IoT Systems

Signcryption is a cryptographic technique for simultaneously performing both digital signature and data encryption. It is effective for protecting the confidentiality and unforgeability of communications in Internet of Things (IoT) systems, especially when a number of generated ciphertexts can be aggregated into a compact form. However, device capture attacks are commonly threatening the implementations of signcryption on unattended devices by enabling an attacker to extract the cryptographic key from a captured device. Motivated by this issue, we propose a novel and specialized obfuscatable aggregatable signcryption scheme (OASC) together with an obfuscator for the signcryption algorithm, which has been designed by taking into account that the computational and communication costs should be sufficiently small (light-weighted) to fit applications in resource-constrained embedded devices. The proposed obfuscator can protect signcryption programs from key-extraction attacks by transforming the programs into unintelligible obfuscated programs. To the best of our knowledge, this is the first OASC in the community. The scheme’s security features with respect to obfuscation, confidentiality, and unforgeability have been theoretically proved. Moreover, in comparison with other (nonobfuscatable) aggregatable signcryption schemes, the scheme’s computational efficiency is positioned at a medium level while the communication cost is also relatively small, with extra unique security features benefiting from obfuscation. Experiments on different devices indicated that the proposed scheme performs reasonably well as expected. The scheme is widely applicable for various scenarios of IoT, where information is sent from unattended leaf nodes to a sink point.