Aggregate Signature with Traceability of Devices Dynamically Generating Invalid Signatures

Abstract

Aggregate signature schemes enable us to aggregate multiple signatures into a single short signature. One of its typical applications is sensor networks, where a large number of users and devices measure their environments, create signatures to ensure the integrity of the measurements, and transmit their signed data. However, if an invalid signature is mixed into aggregation, the aggregate signature becomes invalid, thus if an aggregate signature is invalid, it is necessary to identify the invalid signature. Furthermore, we need to deal with a situation where an invalid sensor generates invalid signatures probabilistically. In this paper, we introduce a model of aggregate signature schemes with interactive tracing functionality that captures such a situation, and define its functional and security requirements and propose aggregate signature schemes that can identify all rogue sensors. More concretely, based on the idea of Dynamic Traitor Tracing, we can trace rogue sensors dynamically and incrementally, and eventually identify all rogue sensors of generating invalid signatures even if the rogue sensors adaptively collude. In addition, the efficiency of our proposed method is also sufficiently practical.

A \(\mathsf {multi\hbox {-}HKK}^+\)

Here, we give the description of $\mathsf {multi\hbox {-}HKK}^+$ that is constructed based on an ordinary aggregate signature scheme $\varSigma _{\mathrm {AS}}$ and a cover free family. Recall that a d-cover free family (d-CFF) $\mathcal {F}=(\mathcal {S},\mathcal {B})$ consists of a set $\mathcal {S}$ of m elements and a set $\mathcal {B}$ of n subsets of $\mathcal {S}$, where $d< m < n$, such that for any d subsets $B_{i_1}, \ldots , B_{i_d} \in \mathcal {B}$ and for all distinct $B \in \mathcal {B} \setminus \{B_{i_1}, \ldots , B_{i_d}\}$, it holds that $B \notin \bigcup _{j \in [d]} B_{i_j}$.

Let d be an integer such that there exists a prime $q=2d+1$. Let $\mathcal {F}=(\mathcal {S},\mathcal {B})$ be a d-CFF based on quadratic polynomials where $\mathcal {S}$ and $\mathcal {B}$ are defined as follows:

Figure 4 describes $\mathsf {multi\hbox {-}HKK}^+$ where $T_i=\{j\in \{0,\ldots ,q^{k+1}-1\} \mid f_j(x_i)=y_i\}$ ($i=0,\ldots ,q^2-1$).