Due to the important role of health data stored in WBANs in medical treatment, researchers must address security issues in WBANs before truly developing them. Recently, people have proposed some secure WBANs schemes from different perspectives. It’s worth mentioning that Hu et al. [13] described an approach to preserve the user and WBAN’s communication. Their proposal is attribute-based encryption (ABE) [14]. But ABE couldn’t be the best option due to its expensive cryptographic operations. These expensive activities are a challenge for sensor nodes with limited resources [15,16]. Rehman et al. [17] proposed an efficient lightweight key agreement and authentication scheme for WBAN. Their scheme has shown effectiveness in resisting various known network attacks, such as sensor node simulation attacks, but still has significant computational overhead.

Wu et al. [18] proposed a lightweight dual-factor authentication scheme for WBANs. Their scheme claims to be resistant to internal attacks, offline guessing attacks and session key leakage attacks, but the scheme cannot guarantee forward security. Signing first and then encrypting is a traditional solution. This scheme is inefficient because the calculation time and communication consumption are equal to the sum of signature consumption and encryption consumption. To address the problem of the traditional scheme’s low efficiency, the initial signcryption scheme proposed by Zheng [19] has demonstrated that signcryption consumption is significantly less than the total signature and encryption consumption. At once, the signcryption scheme reduces the computational complexity and communication demands during data transmission by a significant amount.

Tan et al. [20] designed an identity-based signcryption scheme for WBANs. Unlike traditional PKI, which requires a certificate to associate an identity with the public key, IBC eliminates complex certificate management. The user’s public key is generated from identity information, including id numbers, phone numbers, and so on. A trusted third party that generates a user’s private key is referred to as a private key generator (PKG). IBC is perfectly suited for resource-constrained WBANs, and because PKG has the private key of every user, IBC will inevitably encounter key escrow problems [21,22]. Liu et al. [23] designed the authentication scheme for WBANs using CLC. Every user must be authorized to gain access to health data stored on servers. The advantage of Liu’s scheme is the use of CLC, and there is no public key certificate problem or key escrow problem [24,25]. The CLC still requires KGC, which is tasked with creating a partial private key from the master key and an individual’s identification. The user then creates a secret value and mixes it with a partial private key to create the complete private key [26]. Because KGC lacks the secret value, it couldn’t obtain a complete private key. So, the key escrow issue is overcome.

To ensure integrity, non-repudiation, confidentiality, and authentication during the communication process, this article provides an effective CP-HRSC system from the WBANs in CLC to an Internet server in PKI. Compared to current schemes [27], this paper’s solution not just to guarantees a greater level of security and reduces computation and communication costs.

This paper aims to design an efficient CP-HRSC scheme for WBANs. This paper’s goal is not only to solve the above-mentioned problems, but also to reduce the computational and communication cost in a way that provides integrity and confidentiality. In addition, this paper’s solution adopts heterogeneous systems and ring signcryption technologies, which are better suited for transmitting data in WBANs. WBANs represent the sender and servers represent the receiver. This paper’s contributions are listed below: (1)

This article provides a heterogeneous signcryption scheme between the WBANs and server, in which the server is in PKI and the WBANs are in CLC. CLC could solve the limitations of key escrow problems in IBC and public key certificate management in PKI.

The remainder of the paper is structured as follows: Section 2 describes the network model and security requirements. A CP-HRSC scheme is proposed in Section 3. In Section 4, this article analyzes the security and performance of the scheme. The application of this paper’s scheme is shown in Section 5. Finally, the conclusion is described in Section 6.

Fig. 1 depicts the conventional WBANs model. Most of the network model is made up of three objects: patients, service providers (SP), and users (e.g., a hospital, a nurse, a doctor, a research institution, etc.). The WBANs consist of a controller and several sensor nodes [30,31]. The sensors and controller can communicate with each other, and the controller can also communicate with the Internet to transmit patients’ medical data to the server. If a user wishes to access patients’ health records, the server must provide permission. When a user wishes to obtain WBAN’s monitoring data, it must first submit a query message to the server. The server then verifies whether or not the user is permitted to access the WBANs. If so, the server transmits the gathered information to the user in a safe manner. If not, it will be rejected.

Five security features (anonymity, confidentiality, integrity, non-repudiation, and authentication) must be satisfied by the sensors and server. The confidentiality of query messages keeps them secret from everyone except for the sender and receiver. Authentication guarantees that just those who have been granted permission can view the medical data stored in the WBANs. Integrity ensures that a user’s query message was not modified by unauthorized users. Non-repudiation prevents users from denying their true identity. So, once a user has already sent a request message to WBANs, this activity cannot be denied.

Suppose that there are two groups, G1 and G2 in existence. G1 is an additive group, while G2 is multiplicative group that has the same prime order p, P is the generator of G1. This article states that e:G1×G1→G2 has the common attributes: a.

Bilinearity: ∀r,c∈Zp∗, ∀K,M∈G1, e(rK,cM)=e(K,M)rc.

This paper’s scheme’s security is dependent just on the difficulty of the following CDH problem. Offered G1 of order p prime and P, CDH problem in G1 is to calculate mnP offered (P,mP,nP).

Definition 1. If no adversary 𝒜 can solve (ϵ,t)-CDH problem in t-polynomial time with an advantage of at least ϵ, then CDH assumption holds.

A basic CP-HRSC system comprises eight algorithms listed below. (1)

Setup: It is an initialization algorithm run by PKG. The input is the algorithm’s parameter k. The output consists of a master key s and system parameter params with Ppub.

These algorithms should fulfill the CP-HRSC stability condition. If σ=SC(m,SIDs,L,pkr), then m=USC(σ,L,xr).

CP-HRSC scheme should comply with confidentiality (IND-CCA2) and unforgeability (EUF-CMA). To suit CP-HRSC, this article slightly modifies the [32] concepts.

Definition 2. A CP-HRSC scheme is (ϵ,t,qu)-IND-CCA2 secure if no probabilistic t-polynomial time adversary 𝒜 has advantage at least ϵ after at most qu in the confidentiality game.

Definition 2 grasps the insider security for confidentiality of signcryption since 𝒜 knows all senders’ private keys. The insider security ensures the forward security of the signcryption scheme, i.e., confidentiality is kept in case the sender’s private key is disclosed.

This article takes into consideration the game for both adversary 𝒜 and challenger 𝒞 for confidentiality.

Initial: Assuming a secure parameter k, 𝒞 executes Setup algorithm and passes params along to 𝒜.

Phase 1: 𝒜 executes a limited amount of queries that are polynomially constrained. (1)

Partial private key extraction queries: 𝒜 selects ID and sends it to 𝒞. 𝒞 executes the CLC-PPKE algorithm and sends DID to 𝒜.

Challenge: The conclusion of phase 1 is determined by 𝒜.𝒜 creates two plaintexts of identical (m1,m2) and identities L∗={ID1∗,ID2∗,ID3∗,…,IDn−1∗,IDn∗}, the sender’s IDs∗ and the receiver’s IDr∗ that it desires to be challenged on. Keep in mind that during phase 1, IDr∗ should never be sent in response to a key extraction query. 𝒞 picks an unpredictable bit β∈{0,1}, then calculates σ∗=SC(mβ,L∗,sIDs∗,IDs∗,pkIDs∗,IDr∗), that is then passed to 𝒜.

Phase 2: Similar to phase 1, 𝒜 can consider an adaptive amount of polynomially bounded enquires. To gain access to the m, it cannot do key extraction query on IDr or unsigncryption query on (σ∗,L∗,IDs,IDr) until pkIDs has been refreshed during the challenge phase.

Guess: 𝒜 generates β, if β′=β, then 𝒜 wins game.

The benefit for 𝒜 is given by Advantage(𝒜)=|2(Pr[β′=β]−1/2)|, in which Pr[β′=β] stands for such possibility which β′=β.

Definition 3. If no probability t-polynomial time adversary can acquire a minimum of ϵ in confidentiality game by performing at more than private key extraction queries qppk, public key replacement queries qpkr, key extraction queries qk, SC queries qsc, USC queries qusc, the CP-HRSC technique is considered (ϵ,t,qppk,qpkr,qk,qsc,qusc)-Type-I-EUF-CMA secure. Since the adversary knows the private keys of all senders, the above definition covers insider security for SC confidentiality. Confidentiality even though the sender’s private key has been damaged because of the forward security provided by the SC method, which is guaranteed by insider security.

Since the senders are part of the CLC environment, designers must take into account two categories of adversaries to ensure unforgeability. Type-I adversary represents an opponent who does not have access to s of KGC. It can replace users’ pk with other (legal) pk of its choosing. Type-II opponent represents a trusted and inquisitive KGC with knowledge of its master private key. However, it isn’t a solution for the user’s public key.

Take into consideration how the unforgeability game that 𝒞 and 𝒜ℐ play against one another.

Initial: Using the security parameter k, 𝒞 executes Setup procedure and passes results to 𝒜ℐ in the form of params.

Attack: 𝒜ℐ executes a number of inquiries that have a polynomially constrained execution, similar to the confidentiality game.

Forgery: 𝒜ℐ exports σ∗ and L∗={ID1∗,ID2∗,…,IDn∗}, IDs, IDr and is effective if such prerequisites are satisfied: (1)

USC(σ∗,IDs,pkIDs,sIDr,IDr)=m∗.

The possibility that 𝒜ℐ will emerge victorious can be seen to be its advantage.

Definition 4. If no probability t-polynomial time adversary 𝒜ℐℐ can acquire a minimum of ϵ in an unforgeability game by performing at more than qpk, SC queries qsc, then the CP-HRSC technique is considered (ϵ,t,qpk,qsc)-Type-II-EUF-CMA secure.

In the end, let’s think about a unforgeability game that 𝒞 and an adversary of Type-II play against one another.

Initial: 𝒞 executes the Setup procedure with k and provides 𝒜ℐℐ with params and s.

Attack: 𝒜ℐℐ executes a polynomially bounded number of inquiries, public key queries and SC queries similar to the confidentiality game. In addition, the qppk, qpkr, and qusc are unnecessary because 𝒜ℐℐ can perform these tasks on their own.

Forgery: 𝒜ℐℐ exports σ∗ and L∗={ID1∗,ID2∗,…,IDn∗}, IDs, IDr and is effective if such prerequisites are satisfied: (1)

USC(σ∗,IDs,pkIDs,sIDr,IDr)=m∗.

The possibility that 𝒜ℐℐ will emerge victorious can be seen to be its advantage.

Definition 5. If an adversary who is not a member of the sender group is unable to identify the real sender with a probability greater than the random chance for any set of n identities, m and σ, then the CP-HRSC scheme is completely anonymous for that set of inputs. In this way, the adversary has a probability of 1/n in identifying the original sender.

To build a practical CP-HRSC scheme, this article adopts Chow’s scheme [29] and employs subsequent eight algorithms.

Setup: Given k, the PKG chooses G1 and G2 of prime order p (with G1 additive and G2 multiplicative), P, e:G1×G1→G2, and hash functions H1:{0,1}∗→G1, H2:{0,1}∗→Zp∗ and H3:{0,1}∗→{0,1}α+γ. Here, α indicates the amount of bits in the message that must be delivered, and γ indicates the amount of data required to express a feature of G1. PKG chooses s∈Zp∗ randomly and computes Ppub=sP. PKG publishes params={G1,G2,p,e,α,γ,P,Ppub,Hi(i=1,2,3)} and guarantees s secrets.

CLC-PPKE: User submits ID to the PKG. The PKG computes QID=H1(ID) and sends DID=sQID to user.

CLC-SVS: The user with ID chooses xID∈Zp∗ as secret value.

CLC-PKS: The above algorithm provides the user with the whole private key SID=(xID,DID) only when given it DID and xID.

CLC-PKG: Given xID, the algorithm computes PKID=xIDP.

PKI-KE: Receiver chooses a random xr∈Zp∗ as private key skr and sets pkr=xrP.

SC: Consider the sender group L={ID1,ID2,…,IDn} with n identities. To submit m to a receiver with pkr on behalf of L, the real sender indexed by s (IDs) performs subsequent operations: (1)

Select r∈Zp∗ at random, calculate F=rP.

USC: The receiver with xr executes subsequent actions upon receiving σ=(F,U1,U2,…,Un,z) and L={ID1,ID2,…,IDn}: (1)

Compute w=H3(F,pkr,pks,xrpks).

This is where this article demonstrates that the current proposal is correct. As F=rP, rpkr=rxrP=xrF. Because of V=(hs+r)DIDs, so

e(P,V)=e(P,(hs+r)DIDs)=e(P,(hs+r)sQIDs)=e(Ppub,rQIDs+hsQIDs).

Moreover, since Us=rQIDs−∑j=1,j≠sn(Uj+hjQIDj), so e^(P,V)=e^(Ppub,hsQIDs+Us+∑j=1,j≠sn(Uj+hjQIDj)=e^(Ppub,∑j=1n(Uj+hjQIDj)).

Going to the follow Theorems 1 and 2, this article demonstrates that the suggested CP-HRSC scheme meets the standards for secrecy, anonymity, and unforgeability. This was achieved by adhering to the reasoning process that began with Theorem 1.

Theorem 1. (Confidentiality) In ROM, if 𝒜 has a non-negligible benefit ϵ against by IND-CCA2 security of this paper’s CP-HRSC scheme when trying to run in a time step t and going to perform qu and qHj to hash function Hj(j=1,2,3), then there appears to exist 𝒞 that can solve CDH problem with an additional benefit in time t′<t+O(qH3+qu)tp, where tp represents the expense of pairing computation. The above algorithm could solve the CDH problem with a benefit ϵ′>ϵ(1−qu2k).

Proof. Therefore, in the demonstration, this article would then illustrate what 𝒞 are using 𝒜 as just a subprogram to overcome random instances (P,aP,bP) from both CDH problems.

Initial: 𝒞 provides 𝒜 with master secret key η, params with Ppub=ηP and pkr. Here η is selected at random by 𝒞, it simulates the private key of recipient.

Phase 1: 𝒞 assumes the role of 𝒜’s opponent with in secrecy play described in Section 3. 𝒞 maintains Lj(j=1,2,3) to emulate, correspondingly, the hash function Hj(j=1,2,3). Remember that 𝒞 must keep the same behavior as well as prevent accidents. It is this paper’s belief that 𝒜 will enquire about H1(ID) first before using ID for other queries.

𝒞 checks whether the list L1 appears to include pair (IDj,ej) when 𝒜 tries to apply an H1 query on IDj. (1)

H1 queries: 𝒞 checks whether the list L1 appears to include pair (IDj,ej) when 𝒜 tries to apply an H1 query on IDj. One if the matching pair has been discovered, 𝒞 comes back ej to 𝒜. If not, 𝒞 selects e∈Zp∗, adds (IDj,e) into L1, and gets back eP to 𝒜.

Challenge: 𝒜 produces (m0,m1) as well as identities denoted by L. 𝒞 begins by selecting U and z at random from G1 and G2, respectively. 𝒞 next the transmits 𝒜 the challenge ciphertext after establishing F=aP.

Phase 2: Similar as phase 1, 𝒜 is able to adaptively ask the polynomially bounded amount of qusc to acquire the proper plaintext, but it is unable to ask a query on (σ,L). 𝒞 continues to employ identical methods from phase 1 when responding to 𝒜’s queries.

Guess: 𝒜 generates β′, and 𝒞 will not pay attention to it.

Unless 𝒜 executes H3 query on (F∗,pkr,bF∗), the simulation is flawless. If this tuple is absent from the list L3, 𝒜 will gain no advantage. But even so, whether this situation arises, the first phase of simulating H3 will lead to 𝒞 finding a solution to the CDH issue. During entire phase, its likelihood of failure for qusc seems to be no higher than qu/2k.

Theorem 2. (Unforgeability) This paper’s scheme fulfills the EUF-CMA security requirements in ROM while also satisfying CDH assumptions.

Proof. This theorem’s proof can be found in Lemmas 1 and 2, which are listed in the previous sentence.

Lemma 1. In the ROM, there exists 𝒞 that could resolve CDH problem with an advantage ϵ′⩾ϵ1en(nqk+n)n(1−qs(qs+qH2)2k) in a time O(t) if 𝒜ℐ has ϵ against Type-I-EUF-CMA security of this paper’s CP-HRSC scheme when running in t and performing qk, qs, and qHj.

Proof. Within that demonstration, this article would then illustrate what 𝒞 could use 𝒜ℐ as its own function call to rectify random instance (P,aP,bP) of CDH problems. This will be done by using the example given below.

Initial: 𝒞 provides 𝒜ℐ with params having Ppub=aP, xr of the recipient, and the public key pkr=xrP. Then, xr is selected at random from Zp∗ by 𝒞. It should be noted that 𝒞 doesn’t have access to the value of one that imitates s used by PKG.

Attack: Inside the unforgeability game described in Section 4, 𝒞 acts as an imitation of the challenger 𝒜ℐ faced. 𝒞 retains Lj(j=1,2,3) in order to imitate respective hash functions Hj(j=1,2,3). 𝒞 should keep the same pace and stay away from collisions. This paper is working under the assumption that (1) H1 queries are separate from one another and (2) 𝒜ℐ will first request H1(ID) and then use the ID in those other queries. (1)

H1 queries: 𝒜ℐ selects an identify IDj and provides it to 𝒞. Then, 𝒞 chooses a bit μ∈{0,1} with probabilities of 0 (ρ) and 1 (1−ρ). (The value of ρ would be defined at a point later.) When μ=0, 𝒞 selects ej at random and returns H1(IDj)=ejP, 𝒞 selects at random ej∈Zp∗ and returns H1(IDj)=ejbP. In both instances, (IDj,ej,μ) must be included to L1.

Forgery: 𝒜ℐ outputs σ=(F∗,U1∗,U2∗,…,Un∗,z∗) and L∗={ID1∗,ID2∗,ID3∗,…,IDn−1∗,IDn∗}.

Similar to [33], this proof is completed using forking derivation for ring signature. If 𝒜ℐ generates valid signature during t with a non-negligible advantage ϵ≥7CnqH2/2k, this paper can create 𝒜ℐ′ that generates (m∗,U1∗,U2∗,…,Un∗,V∗) and (m∗,U1∗,U2∗,…,Un∗,V¯∗) during time 2t with probability ϵ′≥ϵ2/66CnqH2 such that hs=h¯s=H2(m∗,F∗,Us∗,L∗) for s∈{1,2,3,…,n} and hj≠h¯j=H2(m∗,F∗,Uj∗,L∗) for each j∈{1,2,3,…,n}∖{s}. Here CnqH2 represents the number of n-permutations of qH2 factors, CnqH2=qH2×(qH2−1)×…×(qH2−n+1).

Using 𝒜ℐ′ generated from 𝒜ℐ, the CDH issue may be resolved through calculating abP=es−1(hs−h¯s)−1(V∗−V¯∗), in which es has been obtained from L1 besides searching for (IDs,es,μ).

This paper will now calculate ρ’s value. The possibility that 𝒞 will succeed in at least all qk is no greater than ρqk. During the forgery phase, this paper needs to make sure that 𝒜ℐ hasn’t made qk for any identity in L∗. The probability is equal to (1−ρ)n. This simulation has a probability of ρqk(1−ρ)n that 𝒞 would then succeed. This value reaches its maximum at ρ¯=qk/(qk+n). Using this ρ¯, (qkqk+n)qk(1−qkqk+n)n=1(1+nqk)qknn(nqk+n)n.

Moreover, using limλ→0(1+λ)1/λ=e, this paper finds that 1(1+nqk)qkn≥1e for extremely large qk. Therefore, the possibility that 𝒞 wins in virtual competition is at least 1en(nqk+n)n.

And if 𝒞 has a collision on H2, then all qsc could fail for 𝒞, making that possibility H2 is qs(qs+qH2)/2k.

Therefore, ϵ′⩾ϵ1en(nqk+n)n(1−qs(qs+qH2)2k).

Lemma 2. In the ROM, there exists 𝒞 that could resolve the CDH problem with an advantage ϵ′⩾ϵ1en(nqk+n)n(1−qsqH22k) in a time O(t), if 𝒜ℐℐ has ϵ against Type-II-EUF-CMA security of this paper’s CP-HRSC scheme when running in t and performing qk, qs, and qHj.

Proof. Within that demonstration, this paper would then illustrate what 𝒞 could use 𝒜ℐℐ as its own function call to rectify random instance (P,aP,bP) of CDH problem. This will be done by using the example given below.

Initial: 𝒞 provides 𝒜ℐℐ with params by setting Ppub=sP and pkr=bP. 𝒞 chooses s at random. Furthermore, 𝒞 obtains public/private key pair (pkr∗,skr∗) of recipient by executing the PKI-KG algorithm and sending them to 𝒜ℐℐ. 𝒞 then selects challenge identity ID∗∈{0,1}∗ at random and provides it to 𝒜ℐℐ.

Attack: 𝒞 simulates the opponent of 𝒜ℐℐ in Type-II-EUF-CMA game. 𝒞 maintains Lj(j=1,2,3) to imitate relevant hash functions Hj(j=1,2,3). 𝒞 also keeps an initially empty list Lk to store public key information. And this paper presumes H1 queries are distinct and 𝒜ℐℐ would then request H1 prior to using ID in subsequent queries. (1)

H1 queries: When 𝒜ℐℐ submits an H1 query on IDj, 𝒞 verifies if L1 contains a pair (IDj,ej). When matching pair is discovered, 𝒞 gets back ej to 𝒜ℐℐ. If not, 𝒞 selects e∈Zp∗, adds (IDj,e) into L1, and gets back eP to 𝒜ℐℐ.

Forgery: 𝒜ℐℐ outputs σ∗=(F∗,U1∗,U2∗,U3∗,…,Un−1∗,Un∗,z∗) and L∗={ID1∗,ID2∗,…,IDn∗}. It’s indeed simple to demonstrate that 𝒜ℐℐ will be unaware that σ∗ isn’t valid deniable authenticator for ski and receiver unless it asks for H3(F,riaP,bP,riabP). The solution to the CDH problem could be added to L3. Then 𝒞 looks up L3 for tuples of (F,riaP,bP,K). 𝒞 examines both of them to evaluate whether or not e(riP,K)=e(riaP,bP). If the condition is satisfied, 𝒞 will come to a halt and will output the solution K=abP to the CDH problem. 𝒞 will fail and come to a stop if there is no such tuple that satisfies equality.