IBC in Mobile CrowdSensing

PEPSI

13年有一篇工作¹提到将 Identity-based Encryption 应用到 参与式无线感应网络（Participatory Sensing）之中，他们称之为 PEPSI （Privacy-Enhanced Participatory Sensing Infrastructure）。 什么是 Participatory Sensing ？

Participatory sensing allows cloud-based services to harvest and share dynamic information about environmental trends, such as ambient air quality, parking availabilities, earthquakes, consumer pricing information in offline market, and so on.

一个典型的 Participatory Sensing 场景包含下面几个参与者：

• Sensors
• Sensor Carriers
• Network Operators
• Queriers
• Service Providers

Participatory Sensing 与 WSN 的不同：

	Participaroty Sensing	Wireless Sensor Networks
Sensors	high-end mobile devices	low-cost, resource-constrained motes
Privacy Concerns	O	X

A.1 IBE

• $\mathsf{Setup}(1^\lambda)\to pk,msk$，pick random $x_1,x_2\in\mathbb{F}_q^*$，set $X_1 = g^{x_1}, X_2 = g^{x_2}$。$msk = (x_1, x_2)$，$pk = (q, \mathbb{G}, \mathbb{G}_T, g, e, \mathcal{M}, \mathcal{X}_1, \mathcal{X}_2, H, H')$，$H:\{0,1\}^* \to \mathbb{G}$，$H':\{0,1\}^* \to \mathcal{M}$
• $\mathsf{BlindExtract}(\mathsf{User}(pk, id) \leftrightarrow \mathsf{Auth}(msk))$，user with $id\in\{0,1\}^*$ sends $H(id)\cdot g^r$ to PKG, PKG returns $sk_1' = req^{x_1}, sk_2' = req^{x_2}$, user computes $sk_1 = \frac{sk_1'}{X_1^r}, sk_2 = \frac{sk_2'}{X_2^r}$
• $\mathsf{IBEnc}(pk, id, m)$, pick random $r$, computes $Z_1 = e(H(id), X_1)^r, Z_2 = e(H(id), X_2)^r$, $h = H'(id, g^r, Z_1, Z_2)$, $c= (g^r, h\oplus m)$
• $\mathsf{IBDec}(pk, sk_{id}, c)$, parse $c=(c_1, c_2)$, $Z_1 = e(sk_1, c_1)$, $Z_2 = e(sk_2, c_1)$, $h = H'(id, c_1, Z_1, Z_2)$, output $m = h\oplus c$

A.2 OPRF

伪随机函数的意义在于，给定你一个函数的输出，无法在多项式时间内判断这个输出是来自一个完全随机函数还是来自一个伪随机函数。 伪随机函数包含两个输入，一个是变量 $x$，一个是索引 $s$，即输出可以表示为 $f_s(x)$。

不经意的伪随机函数，简称 OPRF，是一个两方协议。发送方是隐私输入 $s$，接收方隐私输入 $x$，最终交互可得到 $f_s(x)$，而且双方都不知道其他的内容。

---

B.1 Overview

• RA runs the $\mathsf{Setup}$ algorithm to generate public parameters and secret keys
• queriers need to register to the RA and obtain the corresponding authorization (Query Authorization)
• queriers subscribe their queries to the SP (Query Subscription)
• MNs need to authenticate to the RA, and obtain identifier ID, a token allows them to announce data
• MNs upload encrypted reports to the SP (Data Report)
• SP blindly matches received reports with queries and forwards reports to interested queriers (Query Execution)

B.2 Algorithms Specification

RA 运行 $\mathsf{Setup}$ 算法，得到 $pk, msk, \mathsf{nonce}$，其中 nonce $z$ 满足 $h = g^z$。终端节点 $\mathcal{N}$ 开始进行注册，注册成功后 $\mathcal{N}$ 会收到 $(ID, z)$。请求方 $\mathcal{Q}$ 也需要进行注册，首先他需要进行认证，之后再进行订阅。$\mathcal{Q}$ 选择一个任意的标识符 $ID^*$，先哈希再承诺，如 $H_1(ID^*\cdot g^r)$，然后将它发送给 RA。RA 使用 $msk$ 计算出 $\mu_1' = (H_1(ID^*)\cdot g^r)^{x_1}$，$\mu_2' = (H_1(ID^*)\cdot g^r)^{x_2}$。最后 $\mathcal{Q}$ 得到 $(\mu_1', \mu_2')$，并移去盲因子，便可得到私钥 $\sigma_{ID^*} = (sk_1, sk_2)$。

终端 $\mathcal{N}$ 周期性地提交加密数据给 SP，即 $(T, CT)$，其中 $T$ 表示 tag，通过 $(ID, z)$ 来得到 $T = H_2(ID, h, Z_1, Z_2)$。它的作用是来生成加密密钥 $k = H_3 (ID, h, Z_1, Z_2)$。整个加密是使用对称加密算法。

---

1. E. D. Cristofaro and C. Soriente, “Extended Capabilities for a Privacy-Enhanced Participatory Sensing Infrastructure (PEPSI),” IEEE Transactions on Information Forensics and Security, vol. 8, no. 12, pp. 2021–2033, Dec. 2013, doi: 10.1109/TIFS.2013.2287092. ↩