A lattice-based efficient heterogeneous signcryption scheme for secure network communications

Abstract

Ensuring the security of transmitted content is an important task in network communication. Signcryption technology combines signature and encryption operations in a single step to achieve message authentication and confidentiality. In practical applications, users are usually in different cryptographic systems, the ordinary signcryption technology cannot realize communication between two different cryptographic systems. And the ciphertext structure of the existing signcryption schemes is relatively complex, signcryption is not efficient. Therefore, in order to solve the problem of efficient communication between different cryptosystems and ensure quantum security, this paper proposes a lattice-based efficient heterogeneous signcryption scheme for secure network communications. This signcryption scheme accomplishes signcryption through matrix operations and hash functions, which avoids complex signcryption structures, efficiently realizes bidirectional message communication between identity-based cryptosystems and certificateless cryptosystems.

1. Introduction

Research in the fields of cryptography and network security has greatly supported the development of network content transmission. Researchers are working on realizing secure network communication, such as in the fields of vehicle network, wireless networks and 5G [1,3,7]. Signature technology and encryption technology realize the secure transmission of network content. Signcryption technology combines digital signature and public key encryption to achieve encryption and signature operations at the same time. Signcryption technology was first proposed by Yuliang Zheng [14], which is significantly better than the method of signing first and then encrypting. Signcryption technology is widely used in the fields of IoT, blockchain and machine learning [4,11]. Through signcryption technology, the protection of transmitted content in machine learning is realized. Heterogeneous signcryption technology is the key technology to realize the content communication between two different systems, but most of the heterogeneous signcryption is based on the traditional PKI cryptosystem. The traditional PKI cryptosystem requires a trusted third party to issue a digital certificate to bind the user’s identity to the public key, which results in huge communication and storage costs. The emergence of identity-based cryptography (IBC) uses the user’s unique identity as the user’s public key and no longer requires a digital certificate. In 2003, a certificateless cryptosystem (CLC) was proposed. KGC is only used to generate the user’s partical private key, and the user’s complete private key is generated from the partical private key and the secret value selected by the user. Therefore, constructing a heterogeneous signcryption scheme based on a certificateless cryptosystem and an identity-based cryptosystem can not only realize message communication between different systems, but also improve system performance and scheme efficiency.

With the development of quantum computers, traditional signcryption schemes based on the decomposition of large integers and the difficulty of discrete logarithms have been unable to resist the attack of quantum algorithms. Since quantum algorithms for solving difficult problems on lattices in polynomial time have not yet been discovered, lattice-based cryptosystems are currently believed to be resistant to quantum attacks. In 2008, Gentry et al. proposed the GPV signature scheme and encryption scheme in the Reference [2], and proved their security based on the difficulty of the SIS problem and the LWE problem respectively. In 2014, Lu et al. proposed a signcryption scheme based on lattice [5], which has the advantage of resisting quantum computer attacks. In recent years, many researchers have studied signcryption schemes based on lattice. In 2019, Yang et al. proposed a heterogeneous signcryption scheme based on NTRU lattice [12], and proved its security under the random oracle model. But their research only achieved the one-way communication from PKI public key cryptosystem to identity-based cryptosystem. In 2021, Zhu et al. proposed an efficient identity-based proxy signcryption using lattice [15], which satisfies both IND-CCA security and EUF-CMA security. This scheme can only realize signcryption under the same identity-based cryptosystem. In 2022, Yu et al. proposed a certificateless anti-quantum ring signcryption for network coding [13], which has low communication cost. Most of the above researches can only realize one-way or same cryptosystem signcryption communication, and the ciphertext structure is relatively complex. In this paper, we combine lattice cryptography with heterogeneous signcryption scheme, and propose a lattice-based efficient heterogeneous signcryption scheme for secure network communications. The scheme improves the ciphertext structure while realizing the communication between certificateless cryptosystem and identity-based cryptosystem.

The contributions of this paper are as follows:

• In order to solve the problem of secure content transmission between different cryptosystems in network, this paper proposes a lattice-based efficient heterogeneous signcryption scheme, which realizes bidirectional content communication between certificateless cryptosystems and identity-based cryptosystems.

• In the proposed heterogeneous signcryption scheme for secure network communications, we generate the security key based on the lattice algorithm, generate the signcryption triple through the hash function and matrix operation. The scheme realizes the encryption of the message through XOR operation, avoids the complex signcryption operation, and improves the efficiency of the signcryption process.

The rest of the paper is organized as follows. In Section 2, we give the preliminaries. In Section 3, we describe the formal definition of the heterogeneous signcryption scheme model. In Section 4, we propose a lattice-based efficient heterogeneous signcryption scheme for secure network communications. In Section 5, we analyze the correctness of this scheme. Finally, we conclude this work in Section 6.

2. Preliminaries

2.1. Basic knowledge of lattice

This section gives the basic definitions of lattice and LWE distribution. In algebra, lattice is a subgroup of the set ${\mathit{R}}^{\mathit{n}}$ . The section gives the definition and two forms of lattice in cryptography. In 2005, Regev proved the worst-case hardness theorem for LWE problem [10]. The relevant definition of LWE distribution come from Peikert16 [9]. The specific definitions of lattice are given as follows.

Definition 1 (Lattices [6]).

Let $\mathit{B}=\{{\mathit{b}}_1\mathrm{,}\dots \mathrm{,}{\mathit{b}}_{\mathit{m}}\}\in {\mathit{R}}^{\mathit{m}\times \mathit{m}}$ be a matrix constructed by m linearly independent vectors $\{{\mathit{b}}_1\mathrm{,}{\mathit{b}}_2\mathrm{,}\dots \mathrm{,}{\mathit{b}}_{\mathit{m}}\}$ . The lattice L generated by B is the set $$\begin{array}{c}\mathrm{\Lambda }=\mathit{L}\mathrm{(}\mathit{B}\mathrm{)}=\{\mathit{B}\mathit{c}={\displaystyle \sum }_{\mathit{i}=1}^{\mathit{m}}{\mathit{c}}_{\mathit{i}}{\mathit{b}}_{\mathit{i}}|{\mathit{c}}_{\mathit{i}}\in \mathit{Z}\}\end{array}$$ Here ${\mathit{b}}_1\mathrm{,}\dots \mathrm{,}{\mathit{b}}_{\mathit{m}}$ constitutes a set of bases of the lattice Λ.

Definition 2.

Given a prime number q, a matrix $\mathit{A}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{m}}$ and $\mathit{u}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}}$ . Two special integer lattices are as follows: $$\begin{array}{l}{\mathrm{\Lambda }}_{\mathit{q}}^{\perp }\mathrm{(}\mathit{A}\mathrm{)}=\{\mathit{e}\in {\mathit{Z}}^{\mathit{m}}|\mathit{A}\mathit{e}=0mod\mathit{q}\}\\ {\mathrm{\Lambda }}_{\mathit{q}}^{\mathit{u}}\mathrm{(}\mathit{A}\mathrm{)}=\{\mathit{e}\in {\mathit{Z}}^{\mathit{m}}|\mathit{A}\mathit{e}=\mathit{u}mod\mathit{q}\mathrm{,}\mathit{u}\in {\mathit{Z}}^{\mathit{n}}\}\end{array}$$ where q is a prime number, $\mathit{A}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{m}}$ .

Definition 3 (LWE distribution).

For a vector $\mathit{s}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}}$ called the secret, the LWE distribution ${\mathit{A}}_{\mathit{s}\mathrm{,}\mathit{\chi }}$ over ${\mathit{Z}}_{\mathit{q}}^{\mathit{n}}\times {\mathit{Z}}_{\mathit{q}}$ is sampled by choosing $\mathit{a}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}}$ uniformly at random, choosing $\mathit{e}\leftarrow \mathit{\chi }$ , and outputting $\mathrm{(}\mathit{a}\mathrm{,}\mathit{b}=⟨\mathit{s}\mathrm{,}\mathit{a}⟩+\mathit{e}mod\mathit{q}\mathrm{)}$ .

2.2. Trapdoor generation and pre-image sampling algorithm

This section mainly introduces the trapdoor generation algorithm and the pre-image sampling algorithm proposed in the reference [8]. $\mathrm{TrapGen}$ is a trapdoor generation algorithm. This algorithm can generate a random matrix and the corresponding base. The trapdoor generation algorithm is mainly used to generate public parameters and master private keys. $\mathrm{SamplePre}$ is a pre-image sampling algorithm. This algorithm can generate a vector. Extending $\mathrm{SamplePre}$ algorithm, $\mathrm{SampleMat}$ can get a small matrix. The pre-image sampling algorithm is mainly used to generate private keys. The details are as follows.

Lemma 1 (Trapdoor generation algorithm).

For any integer $\mathit{n}\mathrm{>}0$ , $\mathit{q}\mathrm{>}1$ and $\mathit{m}=\mathit{O}\mathrm{(}\mathit{n}log\mathit{q}\mathrm{)}$ , there is a $\mathrm{TrapGen}\mathrm{(}{1}^{\mathit{n}}\mathrm{,}{1}^{\mathit{m}}\mathrm{,}\mathit{q}\mathrm{)}$ algorithm that outputs a matrix $\mathit{A}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{m}}$ and a set $\mathit{B}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{m}\times \mathit{m}}$ . The distribution of A is statistically uniform on ${\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{m}}$ , and B is a trapdoor basis of the lattice ${\mathrm{\Lambda }}_{\mathit{q}}^{\perp }\mathrm{(}\mathit{A}\mathrm{)}$ . In particular, $\mathit{A}\mathit{B}=0mod\mathit{q}$ , $\Vert \mathit{B}\Vert ⩽\mathit{O}\mathrm{(}\sqrt{\mathit{n}log\mathit{q}}\mathrm{)}$ .

Lemma 2 (Pre-image sampling algorithm).

For the matrix $\mathit{A}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{m}}$ , $\mathit{B}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{m}\times \mathit{m}}$ , the Gaussian parameter $\mathit{s}⩾\Vert \tilde{\mathit{B}}\Vert ·\mathit{\omega }\mathrm{(}\sqrt{log\mathit{n}}\mathrm{)}$ , and a random value $\mathit{y}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}}$ , there is a $\mathrm{Sample}Pr\mathit{e}\mathrm{(}\mathit{A}\mathrm{,}\mathit{B}\mathrm{,}\mathit{s}\mathrm{,}\mathit{y}\mathrm{)}$ algorithm that, outputs $\mathit{x}\in \{{\mathit{x}}_{\mathit{i}}\in {\mathit{Z}}^{\mathit{m}}\mathrm{,}\Vert {\mathit{x}}_{\mathit{i}}\Vert ⩽\mathit{s}\sqrt{\mathit{m}}\}$ , where obeys the Gaussian distribution ${\mathit{D}}_{{\mathrm{\Lambda }}_{\mathit{q}}^{\mathit{y}}\mathrm{(}\mathit{A}\mathrm{)}\mathrm{,}\mathit{s}}^{\mathit{m}}$ . In particular, $\mathit{f}\mathrm{(}\mathit{x}\mathrm{)}=\mathit{A}\mathit{x}=\mathit{y}mod\mathit{q}$ .

Lemma 3 (General pre-image sampling algorithm).

For the matrix $\mathit{A}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{m}}$ , $\mathit{B}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{m}\times \mathit{k}}$ , the Gaussian parameter $\mathit{s}⩾\Vert \tilde{\mathit{B}}\Vert ·\mathit{\omega }\mathrm{(}\sqrt{log\mathit{n}}\mathrm{)}$ , and a random value $\mathit{U}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{k}}$ , there exist a valid polynomial time $\mathrm{SampleMat}\mathrm{(}\mathit{A}\mathrm{,}\mathit{B}\mathrm{,}\mathit{s}\mathrm{,}\mathit{U}\mathrm{)}$ that outputs a matrix $\mathit{S}\in {\mathit{Z}}^{\mathit{m}\times \mathit{k}}$ . The matrix S is obtained in discrete Gaussian distribution ${\mathit{D}}_{{\mathrm{\Lambda }}_{\mathit{q}}^{\mathit{U}}\mathrm{(}\mathit{A}\mathrm{)}\mathrm{,}\mathit{s}}^{\mathit{m}}$ . In particular, $\mathit{A}\mathit{S}=\mathit{U}mod\mathit{q}$ .

2.3. Discrete Gaussian distribution from lattice

Definition 4 (Discrete Gaussian Distribution [8]).

For any $\mathit{c}\mathrm{>}0$ , real number $\mathit{\sigma }\mathrm{>}0$ , an m-dimensional lattice Λ, the discrete Gaussian distribution on lattice Λ is defined as $$\begin{array}{c}\forall \mathit{x}\in \mathrm{\Lambda }\mathrm{,}{\mathit{D}}_{\mathrm{\Lambda }\mathrm{,}\mathit{\sigma }\mathrm{,}\mathit{c}}\mathrm{(}\mathit{x}\mathrm{)}={\mathit{\rho }}_{\mathit{\sigma }\mathrm{,}\mathit{c}}\mathrm{(}\mathit{x}\mathrm{)}\mathrm{/}{\mathit{\rho }}_{\mathit{\sigma }\mathrm{,}\mathit{c}}\mathrm{(}\mathrm{\Lambda }\mathrm{)}\end{array}$$

3. Heterogeneous signcryption scheme model

The lattice-based efficient heterogeneous signcryption model in this paper mainly includes three entities: Certificateless Cryptosystem(CLC) user, Identity-based Cryptosystem(IBC) user, and key generation center(KGC). The model consists of eight algorithms, namely: Setup, CLC Partial Key Generation (CLCExtract), CLC Key Generation (CLCKeyGen), IBC Key Generation (IBCKeyGen), CLC-IBC Heterogeneous Signcryption (CLC-IBC HSC), CLC-IBC Heterogeneous Unsigncryption (CLC-IBC HUSC), IBC-CLC Heterogeneous Signcryption (IBC-CLC HSC) and IBC-CLC Heterogeneous Unsigncryption (IBC-CLC HUSC). The identity of CLC user is ${\mathrm{id}}_{\mathit{a}}$ , the identity of IBC user is ${\mathrm{id}}_{\mathit{b}}$ . The details are as follows:

$\mathrm{Setup}\mathrm{(}{1}^{\mathit{n}}\mathrm{)}\to \mathrm{param}\mathrm{,}\mathrm{MSK}$ : The system initialization algorithm generates system parameters $\mathrm{param}$ and master private key $\mathrm{MSK}$ .

$\mathrm{CLCExtract}\mathrm{(}\mathrm{param}\mathrm{,}\mathrm{MSK}\mathrm{,}{\mathrm{id}}_{\mathit{a}}\mathrm{)}\to \mathit{D}$ : The CLCExtract algorithm generates partial private key D.

$\mathrm{CLCKeyGen}\mathrm{(}\mathrm{param}\mathrm{,}{\mathrm{id}}_{\mathit{a}}\mathrm{,}\mathit{D}\mathrm{)}\to \mathrm{(}\mathit{T}\mathrm{,}{\mathit{S}}_{\mathit{a}}$ ): The CLCKeyGen algorithm generates public and private key pair $\mathrm{(}\mathit{T}\mathrm{,}{\mathit{S}}_{\mathit{a}}\mathrm{)}$ .

$\mathrm{IBCKeyGen}\mathrm{(}\mathrm{param}\mathrm{,}\mathrm{MSK}\mathrm{,}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\to {\mathit{S}}_{\mathit{b}}$ : The IBCKeyGen algorithm generates the private key ${\mathit{S}}_{\mathit{b}}$ .

CLC-IBC $\mathrm{HSC}\mathrm{(}{\mathit{S}}_{\mathit{a}}\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{,}\mathit{t}\mathrm{)}\to \mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ : CLC-IBC HSC algorithm generates the signcryption result $\mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ of the message t.

CLC-IBC $\mathrm{HUSC}\mathrm{(}{\mathit{S}}_{\mathit{b}}\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}\mathrm{,}\mathit{T}\mathrm{,}\mathrm{sign}\mathrm{)}\to \mathit{t}$ : If IBC user authentication is passed, CLC-IBC HUSC algorithm outputs the original message t. Otherwise, IBC user rejects it.

IBC-CLC $\mathrm{HSC}\mathrm{(}{\mathit{S}}_{\mathit{b}}\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}\mathrm{,}\mathit{T}\mathrm{,}\mathit{t}\mathrm{)}\to \mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ : IBC-CLC HSC algorithm generates the signcryption result $\mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ of the message t.

IBC-CLC $\mathrm{HUSC}\mathrm{(}{\mathit{S}}_{\mathit{a}}\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{,}\mathrm{sign}\mathrm{)}\to \mathit{t}$ : If CLC user authentication is passed, IBC-CLC HUSC algorithm output the original message t. Otherwise, CLC user rejects it.

4. Lattice-based efficient heterogeneous signcryption scheme for secure network communications

In this section, we propose a lattice-based efficient heterogeneous signcryption scheme for secure network communications. The section includes a communication model and a specific scheme. This section designs a secure communication model for certificateless cryptosystems and identity-based cryptosystems. The model can realize the bidirectional heterogeneous signcryption process of these two different systems. The specific scheme avoids the number of symmetric encryption operations and complex signcryption operations. By designing the ciphertext structure, the scheme reduces the number of ciphertexts and improves the efficiency of heterogeneous signcryption.

4.1. Communication model of heterogeneous signcryption schemes

In practical applications, when users are in different cryptographic systems, how to realize secure network communication between the different cryptographic systems has become the focus of attention. In this paper, we mainly focus on implementing secure network communication for certificateless cryptosystems and identity-based cryptosystems. The simple communication model is shown in the Fig. 1. In CLC system, D is the partial private key of CLC users, and ${\mathit{S}}_{\mathit{a}}$ is the private key of CLC users, which consists of D and the secret value C. In IBC system, ${\mathit{S}}_{\mathit{b}}$ is the private key of IBC user. This communication model can realize bidirectional communication between CLC-IBC and IBC-CLC.

Fig. 1.

Heterogeneous signcryption communication model.

4.2. Lattice-based efficient heterogeneous signcryption scheme

In the Lattice-based efficient heterogeneous signcryption scheme proposed in this paper, based on the signcryption scheme structure [15], we generate the master private key through the trapdoor generation algorithm on lattice. We generate the user private key through the pre-image sampling algorithm, and realize the signcryption process through matrix operation and hash operation.

In this section, we propose a lattice-based efficient heterogeneous signcryption scheme. This scheme has three entities: CLC user ${\mathrm{id}}_{\mathit{a}}$ , IBC user ${\mathrm{id}}_{\mathit{b}}$ , and the key generation center KGC. The specific heterogeneous signcryption scheme is as follows:

4.2.1. Setup

KGC chooses n as the system security parameter, the prime number $\mathit{q}⩾3$ , $\mathit{m}\mathrm{>}5\mathit{n}log\mathit{q}$ , the Gaussian parameter s, $\mathit{\sigma }=12\mathit{s}\mathit{\lambda }\mathit{m}$ . KGC chooses three hash functions: $$\begin{array}{}\text{(1)}& \mathit{H}:{\{0\mathrm{,}1\}}^{\ast }\to {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{k}}\text{(2)}& {\mathit{H}}_1:{\{0\mathrm{,}1\}}^{\ast }\to \{\mathit{c}:\mathit{c}\in {\{-1\mathrm{,}0\mathrm{,}1\}}^{\mathit{k}}\mathrm{,}\Vert \mathit{c}{\Vert }_1⩽\mathit{\kappa }\}\text{(3)}& {\mathit{H}}_2:{\{0\mathrm{,}1\}}^{\ast }\to {\mathit{Z}}_{\mathit{q}}^{\mathit{k}}\end{array}$$

KGC runs the algorithm $\mathrm{(}\mathit{A}\mathrm{,}\mathit{B}\mathrm{)}\leftarrow \mathrm{TrapGen}\mathrm{(}\mathit{n}\mathrm{,}\mathit{m}\mathrm{,}\mathit{q}\mathrm{)}$ . The public parameters are set to $\mathrm{param}=\{\mathit{A}\mathrm{,}\mathit{H}\mathrm{,}{\mathit{H}}_1\mathrm{,}{\mathit{H}}_2\}$ , and the master private key is $\mathrm{MSK}=\mathit{B}$ .

4.2.2. CLCExtract

CLC user ${\mathrm{id}}_{\mathit{a}}$ sends the partial private key request to the KGC. After receiving the user request, KGC runs the algorithm $\mathit{D}\leftarrow \mathrm{SampleMat}\mathrm{(}\mathit{A}\mathrm{,}\mathit{B}\mathrm{,}\mathit{s}\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}\mathrm{)}$ to generate the partial private key $\mathit{D}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{m}\times \mathit{k}}$ of CLC user ${\mathrm{id}}_{\mathit{a}}$ , where D satisfies $\mathit{A}\mathit{D}=\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}=\mathit{F}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{k}}$ . KGC sends the partial private key D to CLC user.

4.2.3. CLCKeyGen

After CLC user ${\mathrm{id}}_{\mathit{a}}$ receives the partial private key D, ${\mathrm{id}}_{\mathit{a}}$ randomly selects $\mathit{C}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{m}\times \mathit{k}}$ and sets it as the secret value. CLC user ${\mathrm{id}}_{\mathit{a}}$ calculates the public key $\mathit{T}=\mathit{A}\mathit{C}mod\mathit{q}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{k}}$ , the private key ${\mathit{S}}_{\mathit{a}}=\mathit{C}+\mathit{D}$ . $\mathrm{(}\mathit{T}\mathrm{,}{\mathit{S}}_{\mathit{a}}\mathrm{)}$ is the user’s public-private key pair.

4.2.4. IBCKeyGen

IBC user ${\mathrm{id}}_{\mathit{b}}$ sends the key generation request to KGC. After receiving the user ${\mathrm{id}}_{\mathit{b}}$ request, KGC runs the algorithm ${\mathit{S}}_{\mathit{b}}\leftarrow \mathrm{SampleMat}\mathrm{(}\mathit{A}\mathrm{,}\mathit{B}\mathrm{,}\mathit{s}\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{)}$ to generate the user’s private key ${\mathit{S}}_{\mathit{b}}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{m}\times \mathit{k}}$ , where ${\mathit{S}}_{\mathit{b}}$ satisfies $\mathit{A}{\mathit{S}}_{\mathit{b}}=\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\in {\mathit{Z}}_{\mathit{q}}^{\mathit{n}\times \mathit{k}}$ . KGC sends the private key ${\mathit{S}}_{\mathit{b}}$ to ${\mathrm{id}}_{\mathit{b}}$ .

4.2.5. CLC-IBC HSC

In this algorithm, CLC user ${\mathrm{id}}_{\mathit{a}}$ is the sender of the heterogeneous signcryption algorithm, and IBC user ${\mathrm{id}}_{\mathit{b}}$ is the receiver. $\mathit{t}\in {\{0\mathrm{,}1\}}^{\ast }$ is the message that needs to be signcrypted. CLC user ${\mathrm{id}}_{\mathit{a}}$ uses its own private key ${\mathit{S}}_{\mathit{a}}$ and the hash value $\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}$ of ${\mathrm{id}}_{\mathit{b}}$ to signcrypt. The specific process is as follows:

CLC user ${\mathrm{id}}_{\mathit{a}}$ randomly selects $\mathit{\beta }\leftarrow {\mathit{D}}_{\mathit{\sigma }}^{\mathit{m}}$ .

Calculates $\mathit{\phi }={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\beta }\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{)}$ , $\mathit{\eta }={\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{a}}\mathrm{)}\oplus \mathit{t}$ , $\mathit{\omega }={\mathit{S}}_{\mathit{a}}\mathit{\phi }+\mathit{\beta }$ .

Sends $\mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ as the signcrypted ciphertext with the probability of $\mathrm{(}\frac{{\mathit{D}}_{\mathit{\sigma }}^{\mathit{m}}\mathrm{(}\mathit{z}\mathrm{)}}{\mathit{M}{\mathit{D}}_{\mathit{\sigma }\mathrm{,}{\mathit{S}}_{\mathit{a}}\mathrm{,}\mathit{h}}^{\mathit{m}}\mathrm{(}\mathit{z}\mathrm{)}}\mathrm{,}1\mathrm{)}$ to IBC user ${\mathrm{id}}_{\mathit{b}}$ .

4.2.6. CLC-IBC HUSC

After IBC user ${\mathrm{id}}_{\mathit{b}}$ receives the signcrypted ciphertext, it uses its own private key ${\mathit{S}}_{\mathit{b}}$ , the CLC user’s public key ${\mathrm{id}}_{\mathit{a}}$ and the hash value $\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}$ of ${\mathrm{id}}_{\mathit{a}}$ to get the original message t. The specific process is as follows:

IBC user ${\mathrm{id}}_{\mathit{b}}$ calculates $\mathit{h}={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\omega }-\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{b}}\mathrm{)}$ .

Substitutes the calculated value h, ${\mathrm{id}}_{\mathit{b}}$ calculates $\mathit{t}={\mathit{H}}_2\mathrm{(}\mathit{h}\mathrm{,}\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\mathrm{)}\oplus \mathit{\eta }$ , and finally gets the original message t.

4.2.7. IBC-CLC HSC

In this algorithm, IBC user ${\mathrm{id}}_{\mathit{b}}$ is the sender of the heterogeneous signcryption algorithm, and CLC user ${\mathrm{id}}_{\mathit{a}}$ is the receiver. $\mathit{t}\in {\{0\mathrm{,}1\}}^{\ast }$ is the message that needs to be signcrypted. IBC user uses his private key ${\mathit{S}}_{\mathit{b}}$ , the CLC user’s public key T and the identity hash value $\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}$ for signcryption. The specific process is as follows:

IBC user ${\mathrm{id}}_{\mathit{b}}$ randomly selects $\mathit{\beta }\leftarrow {\mathit{D}}_{\mathit{\sigma }}^{\mathit{m}}$ .

Calculates $\mathit{\phi }={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\beta }\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}$ , $\mathit{\eta }={\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{b}}\mathrm{)}\oplus \mathit{t}$ , $\mathit{\omega }={\mathit{S}}_{\mathit{b}}\mathit{\phi }+\mathit{\beta }$ .

Sends $\mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ as the signcrypted ciphertext with the probability of $\mathrm{(}\frac{{\mathit{D}}_{\mathit{\sigma }}^{\mathit{m}}\mathrm{(}\mathit{z}\mathrm{)}}{\mathit{M}{\mathit{D}}_{\mathit{\sigma }\mathrm{,}{\mathit{S}}_{\mathit{b}}\mathrm{,}\mathit{h}}^{\mathit{m}}\mathrm{(}\mathit{z}\mathrm{)}}\mathrm{,}1\mathrm{)}$ to CLC user ${\mathrm{id}}_{\mathit{a}}$ .

4.2.8. IBC-CLC HUSC

After CLC user ${\mathrm{id}}_{\mathit{a}}$ receives the signcrypted ciphertext, it uses its own private key ${\mathit{S}}_{\mathit{a}}$ and the hash value $\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}$ of ${\mathrm{id}}_{\mathit{b}}$ to get the original message t. The specific process is as follows:

CLC user ${\mathrm{id}}_{\mathit{a}}$ calculates $\mathit{h}={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\omega }-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{a}}\mathrm{)}$ .

Substitutes the calculated value h, ${\mathrm{id}}_{\mathit{a}}$ calculates $\mathit{t}={\mathit{H}}_2\mathrm{(}\mathit{h}\mathrm{,}\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{)}\oplus \mathit{\eta }$ , and finally gets the original message t.

5. Correctness analysis

In this section, we present the proof process for the correctness of the lattice-based efficient heterogeneous signcryption scheme.

5.1. CLC-IBC heterogeneous signcryption correctness

When CLC user is the sender of the heterogeneous signcryption algorithm and IBC user is the receiver, after IBC user receives $\mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ , IBC user can recover $\mathit{A}\mathit{\beta }$ using the public key T and identity hash value $\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}$ . Referring to the key generation process in Section 4, the relationship between public and private key satisfies ${\mathit{S}}_{\mathit{a}}=\mathit{C}+\mathit{D}$ , $\mathit{A}\mathit{D}=\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}$ , $\mathit{A}\mathit{C}mod\mathit{q}=\mathit{T}$ , we can get: $$\begin{array}{}\text{(4)}& \begin{array}{l}\mathit{A}\mathit{\omega }-\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\mathit{\phi }\\ =\mathit{A}\mathrm{(}{\mathit{S}}_{\mathit{a}}\mathit{\phi }+\mathit{\beta }\mathrm{)}-\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\mathit{\phi }\\ =\mathit{A}{\mathit{S}}_{\mathit{a}}\mathit{\phi }+\mathit{A}\mathit{\beta }-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}\mathit{\phi }-\mathit{T}\mathit{\phi }\\ =\mathit{A}\mathit{\beta }+\mathit{A}\mathrm{(}\mathit{C}+\mathit{D}\mathrm{)}\mathit{\phi }-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}\mathit{\phi }-\mathit{T}\mathit{\phi }\\ =\mathit{A}\mathit{\beta }\end{array}\end{array}$$

IBC user ${\mathrm{id}}_{\mathit{b}}$ substitutes $\mathit{A}\mathit{\omega }-\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\mathit{\phi }=\mathit{A}\mathit{\beta }$ into the formula h, and ${\mathrm{id}}_{\mathit{b}}$ can verify h with $\mathit{A}{\mathit{S}}_{\mathit{b}}=\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}$ : $$\begin{array}{}\text{(5)}& \begin{array}{cc}\hfill \mathit{h}& ={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\omega }-\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{b}}\mathrm{)}\hfill \\ \hfill & ={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\beta }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{b}}\mathrm{)}\hfill \\ \hfill & ={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\beta }\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{)}\hfill \\ \hfill & =\mathit{\phi }\hfill \end{array}\end{array}$$

IBC user ${\mathrm{id}}_{\mathit{b}}$ substitutes $\mathit{h}=\mathit{\phi }$ into the formula ${\mathit{H}}_2\mathrm{(}\mathit{h}\mathrm{,}\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\mathrm{)}\oplus \mathit{\eta }$ : $$\begin{array}{}\text{(6)}& \begin{array}{l}{\mathit{H}}_2\mathrm{(}\mathit{h}\mathrm{,}\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{\left)}\mathrm{\right)}\oplus \mathit{\eta }\\ ={\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{\left)}\mathrm{\right)}\oplus \mathit{\eta }\\ ={\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathrm{(}\mathit{A}\mathit{D}+\mathit{A}\mathit{C}\mathrm{)}\mathrm{)}\oplus \mathit{\eta }\\ ={\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{a}}\mathrm{)}\oplus {\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{a}}\mathrm{)}\oplus \mathit{t}\\ =\mathit{t}\end{array}\end{array}$$

IBC user ${\mathrm{id}}_{\mathit{b}}$ recovers the message t through the XOR operation, and the correctness is verified.

5.2. IBC-CLC heterogeneous signcryption correctness

When IBC user ${\mathrm{id}}_{\mathit{b}}$ is the sender of the heterogeneous signcryption algorithm and CLC user ${\mathrm{id}}_{\mathit{a}}$ is the receiver, after CLC user receives the ciphertext $\mathrm{sign}=\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{\eta }\mathrm{,}\mathit{\omega }\mathrm{)}$ , CLC user can recover $\mathit{A}\mathit{\beta }$ using the identity hash $\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}$ of ${\mathrm{id}}_{\mathit{b}}$ . Referring to the key generation process in Section 4, the relationship satisfies $\mathit{A}{\mathit{S}}_{\mathit{b}}=\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}$ , we can get: $$\begin{array}{}\text{(7)}& \begin{array}{l}\mathit{A}\mathit{\omega }-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathit{\phi }\\ =\mathit{A}\mathrm{(}{\mathit{S}}_{\mathit{b}}\mathit{\phi }+\mathit{\beta }\mathrm{)}-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathit{\phi }\\ =\mathit{A}{\mathit{S}}_{\mathit{b}}\mathit{\phi }+\mathit{A}\mathit{\beta }-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathit{\phi }\\ =\mathit{A}\mathit{\beta }\end{array}\end{array}$$

CLC user ${\mathrm{id}}_{\mathit{a}}$ substitutes $\mathit{A}\mathit{\omega }-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathit{\phi }=\mathit{A}\mathit{\beta }$ into the formula h, and ${\mathrm{id}}_{\mathit{a}}$ can verify h with ${\mathit{S}}_{\mathit{a}}=\mathit{C}+\mathit{D}$ : $$\begin{array}{}\text{(8)}& \begin{array}{cc}\hfill \mathit{h}& ={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\omega }-\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{a}}\mathrm{)}\hfill \\ \hfill & ={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\beta }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{a}}\mathrm{)}\hfill \\ \hfill & ={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\beta }\mathrm{,}\mathit{A}\mathrm{(}\mathit{C}+\mathit{D}\mathrm{)}\mathrm{)}\hfill \\ \hfill & ={\mathit{H}}_1\mathrm{(}\mathit{A}\mathit{\beta }\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{a}}\mathrm{)}+\mathit{T}\mathrm{)}\hfill \\ \hfill & =\mathit{\phi }\hfill \end{array}\end{array}$$

CLC user ${\mathrm{id}}_{\mathit{a}}$ substitutes $\mathit{h}=\mathit{\phi }$ into the formula ${\mathit{H}}_2\mathrm{(}\mathit{h}\mathrm{,}\mathrm{(}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{)}\oplus \mathit{\eta }$ : $$\begin{array}{}\text{(9)}& \begin{array}{l}{\mathit{H}}_2\mathrm{(}\mathit{h}\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{)}\oplus \mathit{\eta }\\ ={\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{H}\mathrm{(}{\mathrm{id}}_{\mathit{b}}\mathrm{)}\mathrm{)}\oplus \mathit{\eta }\\ ={\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{b}}\mathrm{)}\oplus {\mathit{H}}_2\mathrm{(}\mathit{\phi }\mathrm{,}\mathit{A}{\mathit{S}}_{\mathit{b}}\mathrm{)}\oplus \mathit{t}\\ =\mathit{t}\end{array}\end{array}$$

CLC user ${\mathrm{id}}_{\mathit{a}}$ recovers the message t through the XOR operation, and the correctness is verified.

6. Conclusions

A lattice-based efficient heterogeneous signcryption scheme for secure network communications is proposed in this paper. In the scheme, the security key is generated based on the algorithm on lattice, the signcryption ciphertext is generated by the hash function and matrix operation, the encryption of the message is realized by the XOR operation. The scheme realizes the secure bidirectional content transmission of identity-based cryptosystem and certificateless cryptosystem, and also achieves quantum resistance. Compared with other heterogeneous signcryption schemes, the computational complexity of the signcryption process in this paper is lower, and the ciphertext structure is relatively simple. About the future work, we consider extending this scheme to machine learning or the Internet of Things to realize secure network communications between different systems in practical application.

Conflict of interest

The authors declare that there are no conflict of interests.