The Internet of Things (IoT) has seamlessly integrated into our daily lives, transforming industries and urban infrastructure with its interconnected smart systems. However, the widespread interconnection of IoT devices and the rapid growth of data volume pose significant challenges to the security and efficiency of communication systems. To tackle these problems, named data networking (NDN) has gained recognition as an innovative content-centric communication framework, distinguished by its unique strengths [1,2]. Departing from conventional address-centric network models, NDN adopts a data-centric paradigm enabled by name-driven routing protocols, delivering superior flexibility, scalability, and native security features. In short, NDN shifts the model from host-to-host communication, like the current Internet Protocol (IP), to a data-centric model where users request content by name. However, integrating NDN and IoT contexts introduces multifaceted security complexities. Recall that data is the core resource of NDN-IoT applications, necessitating robust protective measures to safeguard its security. In real-world scenarios, however, data frequently traverses insecure public networks, and faces numerous security threats [3,4]. A key security requirement involves verification mechanisms where data receivers must validate the source’s trustworthiness and confirm the data integrity throughout its transmission path [5]. In addition, an observer in NDN may be able to monitor which content names are being requested, potentially revealing sensitive information. Therefore, user’s privacy should also not be ignored.

Digital signatures is an essential cryptographic mechanism for guaranteeing both data integrity and source authentication. Moreover, in high-throughput applications such as vehicular ad hoc networks and named data networking (NDN) networks, there are a large number of digital signatures that require efficient validation, which puts higher performance requirements on digital signatures. The aggregate signature scheme, initially put forward by Boneh et al. [6], presents an optimal solution by enabling the compression of n individual signatures into one consolidated form. This approach facilitates batch verification while significantly reducing bandwidth consumption.

Boneh et al.’s framework relies on public key infrastructure (PKI), and its actual deployment faces challenges due to the substantial overhead associated with key management. Alternative aggregate signature schemes using identity-based cryptography have emerged [7] to address PKI’s limitations; however, identity-based setting suffers from the inherent key-escrow issue. The certificateless paradigm [8] elegantly resolves both concerns by employing a hybrid key generation model: the key generation center (KGC) supplies partial secret information while users independently select additional secret components, with public keys derived from the user’s public information [9]. Due to its merits, recent years have witnessed significant academic interest in certificateless aggregate signature (CLAS) schemes for IoT applications [10,11].

Here, we introduce some required preliminaries, such as notations and elliptic curve discrete logarithm problem (ECDLP).

As shown in Fig. 1, there are several entities in [23]. The KGC is responsible for building the system. An end device (ED) can register as a producer or consumer in the network system by interacting with KGC. Acting as a vital element for secure data forwarding, the NDN router checks the integrity of data packets during transmission. It conducts signature verification on the embedded producer details within the data packets. Moreover, it supports batch processing of multiple signatures from multiple end devices. As a data requester, the consumer can send Interest packets to request needed data or services. In addition, the producer, which corresponds to the producer entity in NDN, is in charge of generating data in the NDN-IoT environment. It employs sensor devices to gather information like soil moisture levels, vehicle locations, and indoor temperatures.

The CLAS scheme proposed by Wang et al. [23] mainly formed by the following algorithms: System Setup, Device Pseudonym Generation, Device Keys Generation, Signing, Single Signature Verification, and Aggregated Signature Verification. We now briefly review their algorithms to support our analysis. 1.

System Setup: Taking a security parameter ζ as input, the KGC sets up the system as below: (a)

Define an q-order cyclic group G=⟨P⟩.

In [23], a verifier checks a received signature through the equation ViP=Ui+hi(3)(Ki+hi(2)Pkgc). However, due to the lack of binding between Ki and hi(2), a ℱ1 attacker can use the algebraic relationship in the equation to bypass the KGC’s private key α (corresponding to Pkgc).

To patch this vulnerability, our improvement is as follows: 1.

The algorithms System Setup and Device Pseudonym Generation are the same as the original scheme.

Following Wang et al.’s proof approach in [23], the modified scheme can be easily proven to be secure. To avoid a lot of repetitive proof work, we omit the proof process here. Compared to the original scheme, the improvement adds one point multiplication, one point addition, and a general hash operation. This is acceptable since the modification achieves greater security.

This section analyzes the performance of our design by comparing its computational and communication costs with recent schemes in [17,22,23]. We adopt the experiment parameters provided in [23] for our analysis, which was tested on a Raspberry Pi 3B+ device under the Curve25519 elliptic curve, achieving 128-bit security level. Specifically, the running time for different operations is as follows: general hash Th=0.0729 ms, point addition operation Tpa=0.1652 ms, and point multiplication operation Tpm=23.4405 ms.

Computational costs. Taking the algorithm Signing in our improved scheme as an example, it executes one point multiplication operation and one general hash operation to generate the signature. Hence, the total computational cost is Tpm+Th=23.5134 ms. Similarly, we count the cost for the remaining schemes and record the computational costs in Table 2.

In Signing, the cost of our design is the same as that of [23] and lower than that of [17] (i.e., 23.6592 ms) and [22] (i.e., 23.5863 ms). In Verification, the schemes in [17,22] require a relatively high computational cost. Though the cost of our scheme is slightly higher than that of [23], the gap between them is quite small (i.e., 0.1652 ms). In addition, as can be seen from the table and Fig. 3, our scheme achieves the smallest computational cost in Aggregate Verification. Therefore, our scheme has better security and desirable computational cost.

Communication costs. Based on the above curve parameters, the length of G and Zq∗ can be represented by 32 bytes and 32 bytes, respectively [26,27]. We assume that the size of both the identity and the timestamp is 4 bytes. In our design, the signer needs to send {PIDi,PKi,mi,σi,ti} to the verifier, where PIDi={AIDi2,Ti}, PKi=(Xi,Ri), and σi=(Ui,Vi). Since Xi,Ri,Ui∈G and AIDi2,Vi∈Zq∗, the cost is 3|G|+2|Zq∗|+8=32×5+8=168 bytes. Similarly, Table 2 counts the communication costs of these schemes. The above results indicate that the communication cost required for the scheme in [17] is 200 bytes, while other schemes, including ours, only require 168 bytes.

In summary, our improved scheme not only has better security but also has desirable computational and communication costs.

In this effort, we explored the security vulnerability of a very recent CLAS scheme in [23] proposed for NDN-IoT environments. By presenting a specific Type 1 attack, our analysis demonstrates how attackers can use their scheme to forge legitimate signatures for fraudulent environmental data. This manipulation allows malicious actors to deceive consumers, thereby guiding them to make wrong decisions. In view of this, we have systematically examined the root causes behind the vulnerability in [23] and proposed an improved CLAS design to secure NDN-IoT applications. We proved its security based on the cryptographic assumption, and analyzed its performance. The performance comparison results showed that our improved scheme not only has better security but also has desirable computational and communication costs. Finally, as an additional contribution, we analysed the security vulnerability of a very recent CLAS scheme in [22] and proposed targeted countermeasures to enhance its security.