996 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO.

6, NOVEMBER/DECEMBER 2019

Block Design-Based Key Agreement for

Group Data Sharing in Cloud Computing
Jian Shen , Member, IEEE, Tianqi Zhou , Debiao He , Yuexin Zhang,
Xingming Sun, Senior Member, IEEE, and Yang Xiang , Senior Member, IEEE

Abstract—Data sharing in cloud computing enables multiple participants to freely share the group data, which improves the efficiency
of work in cooperative environments and has widespread potential applications. However, how to ensure the security of data sharing
within a group and how to efficiently share the outsourced data in a group manner are formidable challenges. Note that key agreement
protocols have played a very important role in secure and efficient group data sharing in cloud computing. In this paper, by taking
advantage of the symmetric balanced incomplete block design (SBIBD), we present a novel block design-based key agreement
protocol that supports multiple participants, which can flexibly extend the number of participants in a cloud environment according to
the structure of the block design. Based on the proposed group data sharing model, we present general formulas for generating the
common conference key K for multiple participants. Note that by benefiting from the ðv; k þ 1; 1Þ-block design, the computational
complexity of the proposed protocol linearly increases with the number of participants and the communication complexity is greatly
reduced. In addition, the fault tolerance property of our protocol enables the group data sharing in cloud computing to withstand
different key attacks, which is similar to Yi’s protocol.

Index Terms—Key agreement protocol, symmetric balanced incomplete block design (SBIBD), data sharing, cloud computing

Ç
1 INTRODUCTION

C LOUD computing and cloud storage have become hot

topics in recent decades. Both are changing the way we
live and greatly improving production efficiency in some
cloud. In [1], [2], [3], several schemes were proposed to pre-
serve the privacy of the outsourced data. The above
schemes only considered security problems of a single data
areas. At present, due to limited storage resources and the owner. However, in some applications, multiple data own-
requirement for convenient access, we prefer to store all ers would like to securely share their data in a group man-
types of data in cloud servers, which is also a good option ner. Therefore, a protocol that supports secure group data
for companies and organizations to avoid the overhead sharing under cloud computing is needed.
of deploying and maintaining equipment when data are A key agreement protocol is used to generate a common
stored locally. The cloud server provides an open and con- conference key for multiple participants to ensure the secu-
venient storage platform for individuals and organizations, rity of their later communications, and this protocol can be
but it also introduces security problems. For instance, a applied in cloud computing to support secure and efficient
cloud system may be subjected to attacks from both mali- data sharing. Since it was introduced by Diffie-Hellman in
cious users and cloud providers. In these scenarios, it is their seminal paper [4], the key agreement protocol has
important to ensure the security of the stored data in the become one of the fundamental cryptographic primitives.
The basic version of the Diffie-Hellman protocol provides an
 J. Shen is with the School of Computer and Software, Nanjing University efficient solution to the problem of creating a common secret
of Information Science and Technology, Nanjing 210044, China, and the key between two participants. In cryptography, a key agree-
State Key Laboratory of Information Security, Institute of Information ment protocol is a protocol in which two or more parties can
Engineering, Chinese Academy of Sciences, Beijing 100093, China.
agree on a key in such a way that both influence the outcome.
E-mail: [email protected].
 T. Zhou and X. Sun are with the School of Computer and Software, Nanj- By employing the key agreement protocol, the conferees can
ing University of Information Science and Technology, Nanjing 210044, securely send and receive messages from each other using
China. E-mail: [email protected], [email protected]. the common conference key that they agree upon in advance.
 D. He is with the State Key Laboratory of Software Engineering, Computer
School, Wuhan University, Wuhan 430072, China, and the State Key Lab- Specifically, a secure key agreement protocol ensures that the
oratory of Cryptology, Beijing 100878, China. E-mail: [email protected]. adversary cannot obtain the generated key by implementing
 Y. Zhang is with the School of Information Technology, Deakin Univer- malicious attacks, such as eavesdropping. Thus, the key
sity, Burwood, Vic 3125, Australia. E-mail: [email protected]. agreement protocol can be widely used in interactive com-
 Y. Xiang is with the Digital Research & Innovation Capability Platform,
Swinburne University of Technology, John Street, Hawthorn, Vic 3122, munication environments with high security requirements
Australia. E-mail: [email protected]. (e.g., remote board meetings, teleconferences, collaborative
Manuscript received 27 Mar. 2017; revised 29 June 2017; accepted 3 July workspaces, radio frequency identification [5], cloud com-
2017. Date of publication 12 July 2017; date of current version 8 Nov. 2019. puting and so on).
(Corresponding author: Yang Xiang.) The Diffie-Hellman key agreement [4] provides a way to
For information on obtaining reprints of this article, please send e-mail to:
[email protected], and reference the Digital Object Identifier below. generate keys. However, it does not provide an authentica-
Digital Object Identifier no. 10.1109/TDSC.2017.2725953 tion service, which makes it vulnerable to man-in-the-middle
1545-5971 ß 2017 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See ht_tp://www.ieee.org/publications_standards/publications/rights/index.html for more information.

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
SHEN ET AL.: BLOCK DESIGN-BASED KEY AGREEMENT FOR GROUP DATA SHARING IN CLOUD COMPUTING 997

attacks. This situation can be addressed by adding some cannot access the original outsourced data (i.e., they
forms of authentication mechanisms to the protocol, as pro- only obtain some unintelligible data). Therefore, the
posed by Law et al. in [6]. In addition, the Diffie-Hellman proposed key agreement protocol can support secure
key agreement can only support two participants. Subse- and efficient group data sharing in cloud computing.
quently, to solve the different key attacks from malicious Notably, the above contributions substantially widen the
conferees, who attempt to deliberately delay or destroy the field of applications of the key agreement protocol by apply-
conference, Yi proposed an identity-based fault-tolerant con- ing an SBIBD with high security and flexibility. Moreover,
ference key agreement in [7]. Currently, many researches the communication complexity is reduced without intro-
have been devoted to improving the security and communi- ducing extra computational complexity. Specifically, pffiffiffi the
cation efficiency of the key agreement protocol, which is cov- communication complexity of our protocol is Oðn nÞ, and
ered in the literature [8], [9], [10], [11]. Note that in Chung the computational complexity is Oðnm2 Þ. Here, n is the
and Bae’s paper [12] and Lee et al.’s paper [13], block design number of participants, and m is the extension degree of the
is utilized in the design of an efficient load balance algorithm finite field F pm , which is the space for rational points in a
to maintain load balancing in a distributed system. Inspired supersingular elliptic curve.
by [12] and [13], we introduce the symmetric balanced
incomplete block design (SBIBD) in designing the key agree- 1.2 Organization
ment protocol to reduce the complexity of communication The remainder of this paper is organized as follows. Sec-
and computation. As far as we know, the work to design the tion 2 introduces related works. Section 3 briefly presents
key agreement protocol with respect to the SBIBD is novel preliminaries and the system model. Section 4 describes
and original. the algorithm for constructing the SBIBD and depicts the
group data sharing model. Section 5 shows the block
1.1 Main Contributions design-based key agreement protocol with the general for-
In this paper, we present an efficient and secure block mulas for calculating the common conference key for mul-
design-based key agreement protocol by extending the tiple participants. Sections 6 and 7 present the security and
structure of the SBIBD to support multiple participants, performance analyses, respectively. Finally, conclusions
which enables multiple data owners to freely share the out- are drawn in Section 8. To understand our protocol well,
sourced data with high security and efficiency. Note that the detailed process of the key agreement with multiple
the SBIBD is constructed as the group data sharing model to participants and a concrete example with 31 participants
support group data sharing in cloud computing. Moreover, are provided in the Appendix, which can be found on
the protocol can provide authentication services and a fault the Computer Society Digital Library at http://doi.
tolerance property. The main contributions of this paper are ieeecomputersociety.org/10.1109/TDSC.2017.2725953.
summarized as follows.

1. Model of group data sharing according to the structure of 2 RELATED WORKS

the SBIBD is constructed. In this paper, a group data It is well known that data sharing in cloud computing can
sharing model is established based on the definition provide scalable and unlimited storage and computational
of the SBIBD, which can be used to determine the way resources to individuals and enterprises. However, cloud
of communication among the participants. Regarding computing also leads to many security and privacy con-
mathematical descriptions of the structure of the cerns, such as data integrity, confidentiality, reliability, fault
SBIBD, general formulas for computing the common tolerance and so on. Note that the key agreement protocol is
conference key for multiple participants are derived. one of the fundamental cryptographic primitives, which
2. Fault detection and fault tolerance can be provided in the can provide secure communication among multiple partici-
protocol. The presented protocol can perform fault pants in cloud environments.
detection to ensure that a common conference key is In [14] and [15], based on symmetric-key cryptography,
established among all participants without failure. several schemes were proposed to enable efficient encryp-
Moreover, in the fault detection phase, a volunteer tion of the outsourced data. However, encryption keys
will be used to replace a malicious participant to should be transmitted in a secure channel, which is not possi-
support the fault tolerance property. The volunteer ble in practice, particularly in the open cloud environment.
enables the protocol to resist different key attacks [7], Since it was introduced in [16], resistance to compromised
which makes the group data sharing in cloud com- keys has been taken into consideration, which is an impor-
puting more secure. tant issue in the context of cloud computing. Note that cloud
3. Secure group data sharing in cloud computing can be sup- storage auditing with verifiable outsourcing of key updates
ported by the protocol. According to the data sharing paradigm was proposed by Yu et al. in [17] to achieve resis-
model applying the SBIBD, multiple participants can tance to compromised keys. In this paradigm, the third party
form a group to efficiently share the outsourced data. auditor (TPA) takes responsibility for the cloud storage
Subsequently, each group member performs the key auditing and key updates. In particular, the TPA is responsi-
agreement to derive a common conference key to ble for the selection and distribution of the key. The key
ensure the security of the outsourced group data. Note downloaded from the TPA can be used by the client to
that the common conference key is only produced by encrypt files that he will upload to the cloud. In contrast, the
group members. Attackers or the semi-trusted cloud generation and distribution of the key is based on a central-
server has no access to the generated key. Thus, they ized model in [17], which not only imparts a burden to the

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
998 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO. 6, NOVEMBER/DECEMBER 2019

TPA but also introduces some security problems. In [18], a many pattern, the many-to-many pattern in group
key agreement algorithm was exploited by De Capitani di data sharing provides higher efficiency in the envi-
Vimercati et al. to achieve data access when data are con- ronment of cooperative storage.
trolled by multiple owners. Therefore, the key agreement 3. The key agreement protocol is based on a decentral-
protocol can be applied in group data sharing to solve related ized model, where a trusted third party is not
security problems in cloud computing. required. This means that every data owner in a
Following the first pioneering work for key agreement [4], group fairly contributes and determines the common
many works have attempted to provide authentication serv- conference key such that the outsourced data are
ices in the key agreement protocol. In [19], a public key controlled by all the data owners within a group.
infrastructure (PKI) is used to circumvent man-in-the-mid- Therefore, we design a block design-based key agreement
dle attacks. However, these protocols are not suitable for protocol for data sharing in cloud computing. First, we pro-
resource-constrained environments since they require exe- pose an algorithm to construct the ðv; k þ 1; 1Þ-design. Then,
cutions of time-consuming modular exponentiation opera- with respect to the mathematical description of the structure
tions. Key agreement protocols that use elliptic curve of the ðv; k þ 1; 1Þ-design, general formulas for generating
cryptography (ECC) have been proposed in [20], [21]. These the common conference key K for multiple participants are
protocols are more efficient than the protocols that resort to derived. Namely, the proposed protocol supports multiple
the PKI because point additions or multiplications in elliptic participants. We believe that our contributions can widen
curves are more efficient compared with the modular expo- the application scope of the key agreement protocol in cloud
nentiation. Moreover, based on the difficulty of solving the computing employing an SBIBD.
elliptic curve discrete logarithm problem (ECDLP), proto-
cols that use ECC are more secure. 3 PRELIMINARIES AND SYSTEM MODEL
To avoid the requirement of the public key certificate, in 3.1 Cryptographic Bilinear Maps
1984, identity-based cryptography (IBC) was proposed by Modified Weil pairing [10] is an example of a cryptographic
Shamir [22]. However, it was not until 2001 that the first bilinear map. One way to construct this map is described as
practical IBC scheme [10] was proposed by Boneh and follows. Let p be a prime such that p ¼ 6q  1 for some
Franklin. Due to the strict security proof and high efficiency, prime q and E be a supersingular elliptic curve defined by
this scheme has received widespread recognition in aca- the Weierstrass equation y2 ¼ x3 þ 1 over Fp . The group of
demic fields. In the same year, a popular proof model for rational points EðFp Þ ¼ fðx; yÞ 2 Fp  Fp : ðx; yÞ 2 Eg forms
group key establishment was proposed by Bresson a cyclic group of order p þ 1. Furthermore, because
et al. [23]. In this protocol, to manage the complexity of defi- p þ 1 ¼ 6q for some prime q, the group of points of order q
nitions and proofs for the authenticated group Diffie-Hell- in EðFp Þ forms a cyclic subgroup, denoted as G1 . Further
man key exchange, a formal model was presented, where discussion of the Weil pairing is shown in the literature [8].
two security goals of the group Diffie-Hellman key
exchange were addressed. However, some security proper- Definition 1. Let G be a generator of G1 , and let G2 be the sub-
ties are missing in [23], which are essential for preventing group of Fp2 containing all elements of order q. A modified
malicious protocol participants. Weil pairing is a map e^ : G1  G1 ! G2 , which has the follow-
Note that all the above protocols have been proven and ing properties for points in EðFp Þ:
analyzed for security, but some of them can only be applied 1. Bilinear: For any P; Q 2 G1 and a; b 2 Z, we have
to the key agreement between two entities and need a large e^ðaP; bQÞ ¼ e^ðP; QÞab .
amount of resources to perform calculations. Recently, an 2. Non-degenerate: If P is a generator of G1 , then
identity-based authenticated key agreement protocol was e^ðP; PÞ 2 Fp2 is a generator of G2 . In other words,
proposed by Shen et al. in [9], which improves the efficiency e^ðP; PÞ 6¼ 1.
of the conference key agreement and provides entity 3. Non-commutative: For any P; Q 2 G1 , P 6¼ Q,
authentication services. However, there are some obstacles e^ðP; QÞ 6¼ e^ðQ; PÞ.
in Shen et al.’s protocol [9] in real applications. One is that 4. Computable: Given P; Q 2 G1 , there exists an efficient
the protocol only discusses a specific situation when the algorithm to compute eðP; QÞ.
number of conferees is exactly 7. The other is that the proto- 5. For any P 1 ; P 2 ; Q1 ; Q2 2 G1 , we have
col does not discuss the general situation and does not pro- e^ðP 1 þ P 2 ; Q1 Þ ¼ e^ðP 1 ; Q1 Þ  e^ðP 2 ; Q1 Þ
vide the key agreement process for multiple participants, e^ðP 1 ; Q1 þ Q2 Þ ¼ e^ðP 1 ; Q1 Þ  e^ðP 1 ; Q2 Þ
which makes the protocol lack flexibility and practicability.
Motivated by the above observation, the key agreement 3.2 Security Assumption
protocol is applicable to support data sharing in cloud com- Security is one of the most essential conditions that a good
puting for the following reasons. cryptographic algorithm or protocol should first meet. Stud-
ies on safety issues can boil down to the security model. The
1. The generation of a common conference key is per- attacker’s ability and the goal of security achieved can be
formed in a public channel, which is suitable for well reflected by the correct and appropriate security
cloud computing environments. model. In this paper, we use the security model defined in
2. The key agreement protocol can support and pro- the literature [9]. Note that the security of our protocol relies
vide secure data sharing for multiple data owners on a variant of the computational Diffie-Hellman (CDH)
within a group, where the data sharing follows a assumption: the bilinear Diffie-Hellman (BDH) assumption,
many-to-many pattern. Compared with the one-to- which is defined as follows. According to the proof in [9],

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
SHEN ET AL.: BLOCK DESIGN-BASED KEY AGREEMENT FOR GROUP DATA SHARING IN CLOUD COMPUTING 999

the presented protocol can resist both passive attacks and

active attacks. Many formal security analyses of the key
agreement protocol can be found in the literature [11].
Definition 2. In ðG1 ; G2 ; e^Þ, the BDH problem is defined as fol-
lows. Given G 2 G1 and ðG; aG; bG; cGÞ for some a; b; c 2 Zq ,
compute W ¼ e^ðG; GÞabc 2 G2 [10].
An algorithm A is said to have advantage " in solving the
BDH problem in ðG1 ; G2 ; e^Þ if
Pr½AðG; aG; bG; cGÞ ¼ e^ðG; GÞabc   ";

where " > 0 and the probability is based on the random

choice of a; b; c 2 Zq , the random choice of G 2 G1 and the
random bits of A.
The BDH assumption states that no polynomial time
algorithm A has an advantage of at least " in solving the
Fig. 1. System model of data sharing in cloud computing.
BDH problem in ðG1 ; G2 ; e^Þ, which means that this advan-
tage is negligible.
3.4 System Model and Adversary Model
3.3 Block Design and ðv; k þ 1; 1Þ-Design 3.4.1 System Model
In combinatorial mathematics, a block design is a set together The system model of our group data sharing scheme in
with a family of subsets whose members are chosen to satisfy cloud computing is illustrated in Fig. 1. A TPA, cloud and
some set of properties that are deemed useful for a particular users are involved in the model, where the TPA is responsi-
application. Definition 3 defines the balanced incomplete ble for cloud storage auditing, fault detection and generat-
block design (BIBD) in detail below [12], [13], [24]. ing the system parameters. The cloud, who is a semi-trusted
Definition 3. Let V ¼ f0; 1; 2 . . . v  1g be a set of v elements party, provides users with data storage services and down-
and B ¼ fB0 ; B1 ; B2 . . . Bb1 g be a set of b blocks, where Bi is load services. Users can be individuals or staff in a com-
a subset of V and jBi j ¼ k. For a finite incidence structure pany. To work together, they form a group, upload data to
s ¼ ðV; BÞ, if s satisfies the following conditions, then it is a the cloud server and share the outsourced data with the
BIBD, which is called a ðb; v; r; k; Þ-design. group members. In practice, users can be mobile Android
devices, mobile phones, laptops, nodes in underwater sen-
1. Each element of V appears in exactly r of the b blocks. sor networks and so forth.
2. Every two elements of V appear simultaneously in Moreover, the group data sharing model is based on the
exactly  of the b blocks. SBIBD, where a trusted third party is not required. The
3. Parameters k and v of V meet the condition of k < v. construction of the SBIBD group data sharing model is
Thus, no block contains all the elements of the set V . described in detail in Section 4. With respect to this model,
4. Parameters b and v of V meet the condition of b  v. all the participants exchange messages from intended enti-
The case of equality is called a symmetric design. ties according to the structure of the SBIBD to determine a
common conference key. In addition to participants, vol-
Here, v is the number of elements of V , b denotes the
unteers and adversaries are also included in the presented
number of blocks, k implies the number of elements in each
protocol, and all of them run as a probabilistic polynomial-
block, and r and  are the parameters of the design. For a
time Turing machine. Two types of adversaries may be
ðb; v; r; k; Þ-design, if the condition of k ¼ r and b ¼ v holds,
involved in the protocol: passive adversaries and active
it is a symmetric balanced incomplete block design (SBIBD).
adversaries. A passive adversary is a person who attempts
It is also called a ðv; k; Þ-design. In this paper, we require a
to learn information about the conference key by eaves-
ðv; k þ 1; 1Þ-design to construct our group data sharing
dropping on the multicast channel, whereas an active
decentralized model, where k is a prime number and  ¼ 1.
adversary is a person who attempts to impersonate a par-
The reason for why the ðv; k þ 1; 1Þ-design is chosen will be
ticipant or disrupt a conference. Note that the generation
shown in detail in Section 4. Moreover, in the BIBD and the
and update of the key are accomplished by the partici-
SBIBD, these five parameters are not all independent: b and
pants. Moreover, with the fault tolerance property of our
r are determined by v, k and . Two basic equations con-
protocol, the participants are able to ascertain the correct-
necting these parameters in the BIBD and the SBIBD are
ness of the common conference key. Since the storage
bk ¼ vr and ðv  1Þ ¼ rðk  1Þ.
auditing can follow the state of the art auditing protocols
Note that information exchange in our key agreement
(e.g., [25] ), we only focus on the design of group data
protocol is based on the ðv; k þ 1; 1Þ-design. Consequently,
sharing scheme in cloud computing in the paper.
each participant can determine the intended message
receivers or message senders based on the group data shar-
ing model constructed by the ðv; k þ 1; 1Þ-design. 3.4.2 Adversary Model
In Section 5 will be noted that information exchange in our The adversary model determines the capabilities and possi-
key agreement protocol is based on the ðv; k þ 1; 1Þ-design ble actions of the attacker. Similar to [11], [26] and [27], the
and the detailed processes are described. adversary model is defined as follows.

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
1000 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO. 6, NOVEMBER/DECEMBER 2019

1. The adversary reveals a long-term secret key of a participants are involved in this structure, we can decide
participant in a conference and then impersonates which participant should be contained in the 3rd column of
others to this participant. the 8th block by computing
2. The adversary reveals some previous session keys
and then learns the information about the session B7;2 ¼ jk þ 1 þ MODk ði  j þ ðj  1Þbði  1Þ=kcÞ
key of a fresh participant. Consequently, the adver- ¼ 2  3 þ 1 þ MOD3 ð7  2 þ ð2  1Þbð7  1Þ=3cÞ
sary can impersonate the fresh participant with the ¼ 7 þ MOD3 ð5 þ 1  2Þ
session key to others.
¼ 7 þ 1 ¼ 8:
3. The adversary reveals the long-term keys of one or
more participants in the current run. Then, the
Therefore, from the above calculation, it is concluded
adversary attempts to learn the previous session key.
that participant8 is contained in the 3rd column of the 8th
4. A malicious participant chooses different sub keys,
block. Here, participanti represents the ith participant.
generates different signatures and broadcasts the
Note that Algorithm 1 is an optimization of the algo-
messages to the corresponding participants, which
rithm in [12] and the proof of the correctness follows the
makes the conference key derived by different par-
same lines than the proof in [12] and [13]. The structure
ticipants distinct.
created by Algorithm 1 can be proven to satisfy the condi-
4 THE CONSTRUCTION OF THE GROUP DATA tions of the ðv; k þ 1; 1Þ-design, which means that each
participant of V appears exactly k þ 1 times in B and that
SHARING MODEL each pair of participants of V appears exactly once in B.
To support a group data sharing scheme for multiple partic- These properties can be utilized to design the group data
ipants applying an SBIBD, we design an algorithm to con- sharing model, which can diminish the communication
struct the ðv; k þ 1; 1Þ-design. Moreover, the constructed cost of the proposed protocol. The detailed process of the
ðv; k þ 1; 1Þ-design requires some transformations to estab- protocol and the corresponding performance analysis
lish the group data sharing model such that v participants based on the model can be found in Sections 5 and 7,
can perform the key agreement protocol. respectively.

4.1 Construct the ðv; k þ 1; 1Þ-Design

Algorithm 1. Generation of a ðv; k þ 1; 1Þ-Design
In our group data sharing model, the parameters of the
SBIBD have some specific meanings. In a ðv; k þ 1; 1Þ-design, for i ¼ 0; i k; i þ þ do
v denotes the number of participants and the number of for j ¼ 0; j k; j þ þ do
blocks. Every block embraces k þ 1 participants, and every if j ¼¼ 0 then
Bi;j ¼ 0;
participant appears k þ 1 times in these v blocks. Further-
else
more, every two participants appear simultaneously in
Bi;j ¼ ik þ j;
exactly one of the v blocks. Following papers [12] and [13],
end if
Algorithm 1 is designed to construct the structure of a end for
ðv; k þ 1; 1Þ-design. First, a prime number k is selected. Then, end for
the number of participants is determined by the value of k, for i ¼ k þ 1; i k2 þ k; i þ þ do
which is computed as v ¼ k2 þ k þ 1.1 Finally, according to for j ¼ 0; j k; j þ þ do
Definition 3, V ¼ f0; 1; 2; . . . ; v  1g represents the set of v if j ¼¼ 0 then
participants, whereas B ¼ fB0 ; B1 ; B2 ; . . . ; Bv1 g implies v Bi;j ¼ bði  1Þ=kc;
blocks constituted by these v participants. Note that the block else
is defined as Bi ¼ fBi;0 ; Bi;1 ; Bi;2 ; . . . ; Bi;k g, which means Bi;j ¼ jk þ 1 þ MODk ði  j þ ðj  1Þbði  1Þ=kcÞ;
each block embraces k þ 1 participants, and Bi;j denotes end if
which participant is contained in the jth column of the ith end for
block. Sometimes we will consider blocks organized as a end for
matrix in which column j is composed by elements Bi;j for
i ¼ 0; 1; 2; . . . ; k and row i is composed by elements Bi;j for
j ¼ 0; 1; 2; . . . ; k. The structure of the ðv; k þ 1; 1Þ-design is
Definition 4. In our ðv; k þ 1; 1Þ-design of an SBIBD, a sector is a
collection of blocks defined by Sx ¼ fBi : Bi;0 ¼ xg for x ¼ 0; 1;
constructed by Algorithm 1, which outputs numbers Bi;j for
2; . . . ; k. Sector S0 ¼ fB0 ; B1 ; B2 ; . . . ; Bk g is formed by k þ 1
i ¼ 0; 1; . . . ; k2 þ k and j ¼ 0; 1; . . . ; k.
blocks, and sector Sj ¼ fBkjþ1 ; Bkjþ2 ; Bkjþ3 ; . . . ; Bkðjþ1Þ g is
In Algorithm 1, the notation MODk represents the modu-
formed by k blocks for j ¼ 1; 2; 3; . . . ; k.
lar operation that takes the class residue as an integer in the
For example, in a ðv; k þ 1; 1Þ-design, S1 ¼ fBkþ1 ;
range 0; 1; 2; . . . ; k  1. Based on Algorithm 1, we can create
the structure of a ðv; k þ 1; 1Þ-design that involves v partici- Bkþ2 ; . . . ; B2k g.
pants. Moreover, Algorithm 1 can directly determine which Lemma 1. In S0 with ðk þ 1Þ  ðk þ 1Þ elements, element 0
participant should be involved in each block. For example, appears k+1 times in the first column of S0 , and the remaining
taking the ð13; 4; 1Þ-design into consideration, where 13 k2 þ k elements f1; 2; . . . ; k2 þ kg appear exactly once in S0 in
order.
1. From here to the end of the paper, the value of v is v ¼ k2 þ k þ 1
and ðv; k þ 1; 1Þ-design is used to represent ðk2 þ k þ 1; k þ 1; 1Þ-design Proof. According to Algorithm 1, when i ¼ 0; 1; . . . ; k, if j ¼ 0,
for brevity. then Bi;j ¼ 0. Therefore, element 0 appears k þ 1 times in

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
SHEN ET AL.: BLOCK DESIGN-BASED KEY AGREEMENT FOR GROUP DATA SHARING IN CLOUD COMPUTING 1001

the k þ 1 blocks (i.e., B0;0 ; B1;0 ; . . . ; Bk;0 ) of S0 . If j 6¼ 0, then

Bi;j ¼ ik þ j, which implies that Bi;jþ1 ¼ Bi;j þ 1ðfor j ¼
0; 1; . . . ; k  1Þ and Biþ1;1 ¼ Bi;k þ 1ðfor i ¼ 0; 1; . . . ; k  1Þ.
Given Bi;j ¼ 0, we have the progression B0;0 ; B0;1 ;
B0;2 ; . . . ; B0;k ; B1;1 ; B1;2 ; . . . ; B1;k ; B2;1 ; B2;2 ; . . . ; B2;k ; . . . ;
Bk;1 ; Bk;2 ; . . . ; Bk;k is the arithmetic progression 0; 1; 2; 3;
4; . . . ; k2 þ k. It is concluded that the remaining k2 þ k
elements f1; 2; . . . ; k2 þ kg appear exactly once in S0 in
order. u
t
In any sector Sx with k or k þ 1 blocks, the first element of
each block has the same value as x. Based on Lemma 1, in
sector S0 , the first element of these k þ 1 blocks is 0. Then, in
the last k2 blocks, Bi;j ¼ bði  1Þ=kc if j ¼ 0. Based on Defini-
Fig. 2. The reconstruction process of B to E.
tion 4, the index of each sector is x ¼ bi  1=kc, which is
equal to Bi;j . Therefore, the first element of each block has
Bi;j ¼ xk þ 1; xk þ 2; . . . ; xk þ k, which is equal to the
the same value as bði  1Þ=kc, namely, x.
index set of the k blocks in Sx . u
t
Lemma 2. In sector Sx ðx 6¼ 0Þ, except for the first element of
each block that are the same, the set of the other k2 elements is 4.2 Design of the Group Data Sharing Model
equal to V  B0 . Through Algorithm 1, the structure B of the ðv; k þ 1; 1Þ-design
is constructed for v participants, which satisfies the properties
Proof. Based on Definition 4, in Sx , the first element of each of an SBIBD. However, to generate a common conference key
block has the same value as x. Then, according to Algo- for the v participants, the structure of the ðv; k þ 1; 1Þ-design
rithm 1, the remaining k2 elements of Sx are calculated as should have the property that each block Bi embraces
Bi;j ¼ jk þ 1 þ MODk ði  j þ ðj  1Þbði  1Þ=kcÞ. participanti . Here, Bi is the ith block of the structure of the
Due to the property of the modular arithmetic and ele- ðv; k þ 1; 1Þ-design, and the order of the appearance of these v
mentary properties of floor function, the values of these blocks is represented by i. Note that the structure B con-
k2 elements are between k þ 1 and k2 þ k and these k2 structed by Algorithm 1 does not have the required property.
values are distinct. Note that V ¼ f0; 1; . . . ; k2 þ kg and Thus, some transformations of the structure of B are needed.
B0 ¼ f0; 1; . . . ; kg. Therefore, the set of the other k2 ele- Based on Lemma 1, Lemma 3, and Definition 4, the v blocks
ments in Sx is equal to V  B0 ¼ fk þ 1; k þ 2; . . . ; ; k2 þ kg. of B can be reconstructed to derive a new structure E of
In addition, the detailed proof for the fact that the val- the ðv; k þ 1; 1Þ-design such that each block Et embraces
ues of these k2 elements are between k þ 1 and k2 þ k participantt . Notably, the adjustment of the structural order
and these k2 values are distinct is given as follows. among blocks in the block design does not affect its character-
For a given value between k þ 1 and k2 þ k, say k þ n istics and this transformed structure E is therefore a standard
for 1 n k2 we look for an index j, 0 j k such that one in the theory of SBIBDs. Algorithm 2 can be employed to
k þ n is in sector Sx for a fixed x ¼ 0; 1; 2 . . . ; k. On the accomplish the reconstruction of B to E after the structure of
other hand sector Sx ¼ fBkxþ1 ; Bkxþ2 ; Bkxþ3 ; . . . ; Bkðxþ1Þ g, B is created by Algorithm 1. During the reconstruction pro-
then we also look for m and j, 1 m k such that cess, a flag bit for each block Bi is required to indicate whether
Bkxþm;j ¼ k þ n.  We obtain jk þ 1 þ MODk ðkx þ m  j þ Bi is transformed. The flag bit is denoted as Bi ½flag, which is
ðj  1ÞÞ kxþm1 k Þ ¼ k þ n and then MODk ðm  j þ ðj  0 if Bi has not been transformed and is 1 otherwise. The
1ÞxÞ ¼ k þ n  jk  1 must be a number in the range detailed reconstruction process is given as follows. To make
0; 1; 2 . . . ; k  1, that is, 0 k þ n  jk  1 < k obtaining the process from B to E clear, a concrete example is shown in
0 1 þ n1 k  j < 1 and then j  1
n1
k < j equivalent Fig. 2. In Fig. 2, a ð13; 4; 1Þ-design is constructed by Algorithm 1
to j  1 ¼ k . We can
n1
  conclude that the value j is first, which is depicted on the left of Fig. 2. Then, Algorithm 2
unique and j ¼ 1 þ n1 k . From the value of j, with three steps is used to accomplish the reconstruction of B
MODk ðm  j þ ðj  1ÞxÞ ¼ k þ n jk  1 and taking into to E. Note that the transformed structure of E is shown on
account that 1 m k  1, we can obtain a unique pos- the right of Fig. 2.
sible value m  1 ¼ MODk ðð1  jÞx þ j þ n  2Þ, that is Step 1. Step 1 describes transformations of the first k þ 1
m ¼ 1 þ MODk ðð1  jÞx þ j þ n  2Þ. u
t blocks of fS0 ; S1 ; S2 ; . . . ; Sk g in B to the first k þ 1 blocks in
Lemma 3. In sector Sx ðx 6¼ 0Þ with k blocks, the set of the k ele- E. Here, B0 needs no transformations; thus, we have
ments of the xth column is equal to the index set of the k blocks E0 ¼ B0 . Based on Definition 4, in any sector Sx of B, the
in Sx . first element of each block has the same value as x. To sat-
isfy the property that each block Et embraces participantt ,
Proof. According to Definition 4, in Sx , the index set of k the first block of fS1 ; S2 ; . . . ; Sk g of B will be transformed to
blocks is fxk þ 1; xk þ 2; . . . ; xk þ kg. Then, elements of the E1 to Ek blocks of E. Consequently, the results of trans-
the xth column of Sx are computed as Bi;j ¼ jk þ formations in step 1 are E0 ¼ B0 and Et ¼ Btkþ1 ; ð1 t kÞ.
1 þ MODk ði  j þ ðj  1Þbði  1Þ=kcÞ. The xth column of For example, in Fig. 2, the first elements of the first block in
Sx means that j ¼ x. Therefore, Bi;j ¼ xk þ 1 þ MODk ði  S1 , S2 , and S3 in B are 4,7, and 10, respectively, which are
x þ ðx  1Þbði  1Þ=kcÞ. Based on the modular arithmetic, marked with a red color. The results of the transformations
when i takes a value of the set ½xk þ 1; xk þ k, we have of step 1 in Fig. 2 are E0 ¼ B0 , E1 ¼ B4 , E2 ¼ B7 and

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
1002 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO. 6, NOVEMBER/DECEMBER 2019

E3 ¼ B10 . It is clearly observed from Fig. 2 that the first k þ 1 but also satisfies the property that each block Et contains
blocks of E have the property that 0 2 E0 , 1 2 E1 , 2 2 E2 , participantt . Hence, the reconstructed E can be used to
and 3 2 E3 . design the group data sharing model. Based on this model,
the key agreement protocol can be processed by v partici-
Algorithm 2. The Reconstruction of B pants and a common conference key can be derived. More-
E0 ¼ B0 ; (step 1) over, the structure of E should be determined by
for t ¼ 1; t k; t þ þ do mathematical descriptions to derive general formulas to
Et ¼ Btkþ1 ; (step 1) compute the common conference key for each participant.
Btkþ1 ½flag ¼ 1; In summary, based on Algorithm 1, mathematical descrip-
EEt;t ¼ BbðEt;t 1Þ=kc ; (step 2) tions of the structure of B can be deduced first. Then, to
Btkþ1 ½flag ¼ 1; derive the mathematical descriptions of the structure of E,
end for the functional relationships of the transformations of B to E
for i ¼ k þ 1; i k2 þ k; i þ þ do should be determined. Based on Algorithm 2, the transfor-
if Bi ½flag 6¼ 1 then mations of B to E can be divided into four different cases.
EBi;bði1Þ=kc ¼ Bi ; (step 3) In the following four different cases, t denotes the index of
end if the block of E, m implies the mth column of one block of E,
end for and Et;m indicates which participant is contained in the mth
column of the tth block in E.
Step 2. Transformations of step 2 are based on Lemma 1;
Case 1. E0 ¼ B0 ¼ f0; 1; . . . ; kg
in S0 with ðk þ 1Þðk þ 1Þ elements, element 0 appears k þ 1
Case 2. 0 m k; 1 t k
times in the first column of S0 and the remaining k2 þ k ele-
ments f1; 2; . . . ; k2 þ kg appear exactly once in S0 in order. Et;m ¼ Btkþ1;m
To satisfy the property that each block Et embraces 
t; ðm ¼ 0Þ
participantt , the k blocks of B1 ; B2 ; . . . ; Bk in B will be trans- ¼
mk þ 1 þ MODk ðt  1Þðm  1Þ; ðm > 0Þ
formed to the intended k blocks of E. Note that the index of
the k blocks of E is determined by the xth element of the Case 3. 0 m k; t ¼ Ei;i ; ð1 i kÞ
first block of Sx ðx 6¼ 0Þ in B, which is equal to Et;t ð1 t kÞ
of E. The results of the transformations in step 2 are Et;m ¼ Bbðt1Þ=kc;m

EEt;t ¼ BbðEt;t 1Þ=kc ð1 t kÞ. For example, in Fig. 2, the xth 0; ðm ¼ 0Þ
¼
element of the first block of Sx ðx 6¼ 0Þ in B is 4, 8, 11, respec- bðt  1Þ=kck þ m; ðm > 0Þ
tively, which is marked with a green color. The results of
the transformations of step 2 in Fig. 2 are E4 ¼ B1 , E8 ¼ B2 Case 4. 0 m k; t ¼ Bi;x ; ðt 6¼ Ei;i Þ
and E11 ¼ B3 . It is clearly observed from Fig. 2 that the Et;m ¼ Bkðxþ1Þþr;m
Et;t ð1 t kÞ blocks of E have the property that 4 2 E4 , 
x; ðm ¼ 0Þ
8 2 E8 , and 11 2 E11 . ¼
mk þ 1 þ MODk ðmx  x  m þ rÞ; ðm > 0Þ
Step 3. The transformations of step 3 are based on
Lemma 3; in sector Sx ðx 6¼ 0Þ with k blocks, the set of the k Case 1 and Case 2 correspond to step 1 of Algorithm 2, Case
elements of the xth column is equal to the index set of the k 3 corresponds to step 2 of Algorithm 2, and Case 4 corre-
blocks in Sx . In step 3, the remaining k  1 blocks of each sponds to step 3 of Algorithm 2. In Case 1, the structure of E0
sector Sx ðx 6¼ 0Þ in B are transformed to the intended is directly described by B0 , which is f0; 1; . . . ; kg. Since in
k  ðk  1Þ blocks of E. Note that the index of the k  ðk  1Þ step 1 and step 2 of Algorithm 2, the index of B is a function
blocks of E is determined by the xth column of the remain- of
 the index  of E, namely, tk þ 1 is a function of t,
ing k  1 blocks of sector Sx ðx 6¼ 0Þ in B. Hence, ðEt;t  1Þ=k is a function of Et;t . The transformations of B
Bi;x ðk þ 1 i k2 þ 2Þ is used as the index of E. The results to E can be directly determined by the functional relation-
of the transformations in step 3 are EBi;x ¼ Bi ðk þ 1 ships between the index of B and the index of E. Thus, the
i k2 þ k; Bi;x 6¼ Et;t ð1 t kÞÞ, where Bi belongs to the mathematical descriptions in Case 2 and Case 3 can easily be
xth sector in B. According to Definition 4, the Bi block in B obtained by Algorithm 1. However, in step 3 of Algorithm 2,
belongs to the bði  1Þ=kc sector in B; thus, in step 3 of Algo- the index of B is not a function of the index of E, namely, i
rithm 2, x is denoted as bði  1Þ=kc. The k Et;t ð1 t kÞ is not a function of Bi;x . According to Algorithm 1, the index
blocks of Sx ðx 6¼ 0Þ in B have been transformed in step 2; Bi;x ðk þ 1 i k2 þ kÞ of E in step 3 of Algorithm 2 is calcu-
therefore, the k blocks need no transformations in step 3. lated as Eq. (1), where x and k are known and the index
For example, in Fig. 2, the xth column of the k  1 blocks Bi;x ðk þ 1 i k2 þ kÞ of E is a function of the index i of B
of sector Sx is f5; 6g; f9; 7g; f12; 10g, respectively, which is
marked with a white color. The results of the transfor- Bi;j ¼ xk þ 1 þ MODk ði  x þ ðx  1Þbði  1Þ=kcÞ: (1)
mations of step 3 in Fig. 2 are fE5 ¼ B5 ; E6 ¼ B6 g, fE9 ¼
B8 ; E7 ¼ B9 g, fE12 ¼ B11 ; and E10 ¼ B12 g. It is clearly Let t ¼ Bi;x ðk þ 1 i  k2 þ kÞ, according to [28], the values
observed from Fig. 2 that the Bi;x ðk þ 1 i k2 þ k; Bi;x 6¼ i in Eq. (1) are i ¼ k t1
k þ r, where r ¼ 2; 3; 4; . . . ; k  1; k
Et;t ð1 t kÞÞ blocks of E have the property that 5 2 E5 , and the index i of B is a function ofthe index t ¼ Bi;x of  E.
6 2 E6 , 9 2 E9 , 7 2 E7 , 12 2 E12 , and 10 2 E10 . According to Definition 4, in B, x ¼ t1
k . Thus, i ¼ k t1
k þr
By Algorithm 2, the structure of E is reconstructed, which is equivalent to
not only conforms to the properties of a ðv; k þ 1; 1Þ-design i ¼ kx þ r: (2)

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
SHEN ET AL.: BLOCK DESIGN-BASED KEY AGREEMENT FOR GROUP DATA SHARING IN CLOUD COMPUTING 1003

TABLE 1
The Structure of E of a ðv; k þ 1; 1Þ-Design

E0 ¼ f0; 1; . . . ; kg
E1 ¼ f1; k þ 1; 2k þ 1 þ MODk ð0  ð2  1ÞÞ; . . . ; k2 þ 1g
E2 ¼ f2; k þ 1; 2k þ 1 þ MODk ð1  ð2  1ÞÞ; . . . ; k2 þ 1 þ
MODk ð1  ðk  1ÞÞg
E3 ¼ f3; k þ 1; 2k þ 1 þ MODk ð2  ð2  1ÞÞ; . . . ; k2 þ 1 þ
MODk ð2  ðk  1ÞÞg
...
Ek ¼ fk; k þ 1; k2 þ 1 þ MODk ððk  1Þð2  1ÞÞ; . . . ; k2 þ 1 þ
MODk ðk  1Þ2 g
EE1;1 ¼ f0; k þ 1; k þ 2; . . . ; k þ kg
Et ¼ f1; k þ 1 þ MODk ðr  1Þ; . . . ; k2 þ 1 þ MODk ðkx  x  k þ rÞg
EE2;2 ¼ f0; 2k þ 1; 2k þ 2; . . . ; 2k þ kg
Et ¼ f2; k þ 1 þ MODk ðr  1Þ; . . . ; k2 þ 1 þ MODk ðkx  x  k þ rÞg Fig. 3. ð13; 4; 1Þ-design group data sharing model.
...
EEk;k ¼ f0; k2 þ 1; k2 þ 2; . . . ; k2 þ kg
5 A BLOCK DESIGN-BASED KEY AGREEMENT
Et ¼ fk; k þ 1 þ MODk ðr  1Þ; . . . ; k2 þ 1 þ MODk ðk2  2k þ rÞg
PROTOCOL
5.1 Initial Phase
Based on Eq. (2), the mathematical descriptions in Case 4 are In the protocol, a TPA takes responsibility for generating
derived to describe the structure of the k  1 blocks of some system parameters and distributing the private key
Sx ðx 6¼ 0Þ in E. Note that r has k  1 different values, which for all participants. In the key generation phase of the proto-
describes the structure of the ðk  1Þ blocks of Sx in Et . col, the TPA publishes fp; q; G1 ; G2 ; G; e^; Ppub ; H1 ; H2 g but
The structure of E of a ðv; k þ 1; 1Þ-design can be keeps his private key s 2 Zq secret. Here, p and q are two
described in detail based on the mathematical descriptions prime numbers, and G; G1 ; G2 and e^ are the parameters of
in Case 1, Case 2, Case 3 and Case 4, which is illustrated in the Weil pairing, which are defined in Definition 1. In addi-
Table 1. In Table 1, the index of E is between 0 and k2 þ k, tion, H1 and H2 are two hash functions, which map its arbi-
and which participant is contained in the mth column in Et trary length to a nonzero point of G1 and nonzero integer,
can be determined by the mathematical descriptions in the respectively. In our block design-based key agreement pro-
four different cases. A concrete example can be found in tocol, participanti ’s public key and private key are mapped
Appendix, available in the online supplemental material, as H1 ðIDi Þ and S i ¼ sH1 ðIDi Þ, respectively. Here,
where the structure of E of a ð31; 6; 1Þ-design is constructed. IDi 2 f0; 1g is the identity for participanti . Moreover, to
In our protocol, two rounds are required to generate a provide authentication, based on the RSA cryptographic
common conference key. In each round, every participant algorithm, the TPA selects a public key ei and a private key
will receive messages from their intended participants. The di for each participant and distributes ðei ; nÞ to all the partic-
group data sharing model can determine which participants ipants, where n is the product of two large prime numbers.
are the intended message senders of participanti . The group Subsequently, participant i computes Yi ¼ H2 ðIDi Þ, Xi ¼
data sharing model is established as follows. If j 2 Ei , ðYi Þdi and keeps ðdi ; Xi Þ secret.
participantj is the intended message sender of participanti
in Round 1. If i 2 Ej , participantj is the intended message 5.2 Key Agreement Phase
sender of participanti in Round 2. Based on the group data In the key agreement phase, two rounds are required for
sharing model, every participant can receive messages from generating a common conference key for multiple partici-
their 2k intended message senders after two rounds of the pants, and the way of message exchanges is with respect to
key agreement. For example, in Fig. 3, the ð13; 4; 1Þ-design the group data sharing model established by the structure
group data sharing model is established by the structure of E of the ðv; k þ 1; 1Þ-design.
E of a ð13; 4; 1Þ-design. Based on the group data sharing Round 1. In Round 1, a random number ri is chosen as a
model in Fig. 3, 13 participants are involved, where each secret key and Mi ¼ e^ðG; ei ri S i Þ is calculated by each partic-
participant has 2  3 intended message senders. Taking ipant, which contributes to generating a common confer-
participant0 into consideration, the intended message send- ence key among all participants. Then, Yi ¼ H2 ðIDi Þ,
ers of participant0 in Round 1 are 1, 2, 3, whereas the Ti ¼ Xi  e^ðG; wi ri S i Þ and a time stamp ti are used to support
d
intended message senders of participant0 in Round 2 are 4, authentication services, where Xi ¼ Yi i , wi ¼ H2 ðMi; ti Þ.
8, 11. Moreover, for participanti , the messages sending from Subsequently, participanti receives message Dj ¼ fYj ;
his 2k intended message senders can generate the common ðMj Þei ; Tj ; tj g from participantj in the case that j 2 Ei . In
conference key for himself. addition, according to the property that each block Ei con-
After the construction of the group data sharing model, tains participanti , we have i 2 Ei . However, participanti
the block design-based key agreement protocol is designed does not have to receive a message from himself. Therefore,
for data sharing in cloud computing, which is described in participanti receives message Dj ¼ fYj ; ðMj Þei ; Tj ; tj g from
detail in Section 5. participantj in the case that j 2 Ei ðj 6¼ iÞ. According to the

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
1004 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO. 6, NOVEMBER/DECEMBER 2019

four mathematical descriptions of the structure of E of a required that each participant receives messages from
ðv; k þ 1; 1Þ-design, the key agreement phase in Round 1 is the remaining k2 þ k participants. Based on the group
divided into four cases. data sharing model, every participant receives k mes-
Case 1: Participant0 needs to receive messages from sages from their intended participants in each round. In
participantj ð1 j kÞ. Round 1, participanti receives k secret messages Mj
Case 2: For participanti ði kÞ, they need to receive mes- from participantj in the case that j 2 Ei ðj 6¼ iÞ. In Round
sages from participantj ðj ¼ mk þ 1 þ MODk ði  1Þðm  1Þ; 2, participanti receives k secret messages Cj;i from
j 6¼ iÞ. participantj in the case that i 2 Ej ðj 6¼ iÞ. Furthermore,
Case 3: For participanti ði ¼ Em;m Þ, they need to receive based on Eq. (4), each Cj;i contains k secret messages
messages from participant0 and participantj ðj ¼ bði  1Þ=kc Mx of k participants. Thus, every participant receives k2
k þ m; j 6¼ iÞ. messages in Round 2. In summary, participanti receives
Case 4: For the remaining k2  k participants, they need to k2 þ k messages after two rounds of key agreement.
receive messages from participantbði1Þ=kc and participant According to Definition 3, in a ðv; k þ 1; 1Þ-design, every
j; ðj ¼ mk þ 1 þ MODk ðmx  x  m þ rÞ; j 6¼ iÞ, where r ¼ pair of two elements appears simultaneously in exactly
2; 3; 4; . . . ; k  1; k. one of the b blocks; here, v ¼ b. Therefore, the k2 þ k
After every participant receives k messages contributed messages of each participant are not repeated. For
to generate a common conference key from their intended participanti , he obtains messages from ðparticipant0 ; . . . ;
message senders, Eq. (3) is calculated by participanti to participanti1 ; participantiþ1 ; . . . ; participantv1 Þ without
decrypt the messages redundancy, which contribute to generating a common
conference key. u
t
 d
Mj ¼ ðMj Þei i ; j 2 Ei  fig; (3)
Theorem 2. In our protocol, participanti can authenticate their
e w
where di is the secret key of participanti . To authenticate counterparts if the condition of Tj j =Mj j ¼ Yj holds.
e w
participantj ’s identity, participanti computes Tj j =Mj j . If the Proof. According to Definition 1, we have
e w
condition of ¼ Yj holds, participanti can authenti-
Tj j =Mj j
cate participantj , where wj ¼ H2 ðMj; tj Þ. In addition, Eq. (4) e w ðXj  e^ðG; wj rj Sj ÞÞej
Tj j =Mj j ¼ wj
is used to derive Ci;j , which will be used in Round 2 to gener- e^ðG; ej rj Sj Þ
ate a common conference key for participantj e
Xj j  e^ðG; wj ej rj Sj Þ
Y ¼ :
e^ðG; wj ej rj Sj Þ
Ci;j ¼ Mx (4)
x2Ei fjg
Here, wj ¼ H2 ðMj; tj Þ is computed by participantj ,
Round 2: Participanti receives message E j;i ¼ fYj ; while wj ¼ H2 ðMj; tj Þ is computed by participanti . In
ðCj;i Þei ; ðMj Þei ; Tj ; tj g from participantj in the case that addition, according to Euler’s Theorem, we have
e d e w
i 2 Ej , where Cj;i is used to generate a common conference Xj j ¼ ðYj j Þej ¼ Yj . The equality is held between Tj j =Mj j
key. In fact, every Cj;i contributes k messages for and Yj if wj ¼ wj . Note that the wj calculated by
participanti to generate a common conference key. Similar participantj and the wj calculated by participanti are
e w
to Round 1, participanti verifies the equation Tj j =Mj j ¼ Yj equal only if the message is actually sent from
to support authentication services. If the equation holds, participantj . An adversary that has no access to rj and S j
participanti can authenticate participantj ’s identity, but not could not derive Mj ¼ e^ðG; ej rj Sj Þ. Therefore, if the equa-
e w
vice versa. Subsequently, for participanti , the common con- tion Tj j =Mj j ¼ Yj holds, participanti can authenticate
ference key is computed as that the message is actually transmitted from participantj
0 1 in Round 1 and Round 2. u
t
Y
K ¼ Mi @ Cj;i A If all participants follow the protocol, they can form a
j such that i2Ej data sharing group, derive a common conference key and
0 1
Y ascertain its correctness. To facilitate understanding, the
¼ e^ðG; ei ri S i Þ  @ Cj;i A (5) detailed process for computing the common conference key
j such that i2Ej for multiple participants based on a ðv; k þ 1; 1Þ-design is
! illustrated in Appendix A, available in the online supple-
X
v1
¼ e^ G; ei ri S i : mental material. In addition, a concrete example of the pro-
i¼0 tocol can be found in Appendix B, available in the online
supplemental material, where 31 participants are involved.
Theorem 1. According to the presented block design-based key
agreement protocol, a common conference key is derived for
5.3 Fault Detection Phase
multiple participants in the same group.
In practice, we cannot guarantee that all participants in the
Proof. The conference key agreement requires all conferees group are honest. The existence of malicious participants
to obtain messages from the others. In the group data can seriously destroy the conference. In Yi’s protocol [7], an
sharing model of the ðv; k þ 1; 1Þ-design, v participants attack from malicious participants is called a different key
are involved in a group, where v ¼ k2 þ k þ 1. It is attack. In different key attacks, a malicious participant

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
SHEN ET AL.: BLOCK DESIGN-BASED KEY AGREEMENT FOR GROUP DATA SHARING IN CLOUD COMPUTING 1005

chooses different sub keys, generates different signatures key is derived among all the honest participants in a group.
and broadcasts different messages to different participants Following the proof of Theorem 3, the presented protocol
such that the signatures of malicious participants are valid can resist different key attacks and support the fault toler-
and malicious participants can be authenticated by other ance property.
participants. In addition, the different sub keys make differ-
Theorem 3. In fault detection phase, an honest participant will
ent participants derive different conference keys, which may
not be removed by the TPA and a malicious participant who
lead to serious damage of the conference and make the proto-
attempts to delay or destroy the conference will be removed by
col invalid. Therefore, the fault detection phase is added to
the TPA.
prevent different key attacks from malicious participants.
The role of the TPA in the fault detection phase is to Proof. For an honest participant participanth , two situations
ensure that each participant only generates a unique sub should be taken into consideration. The first is that
Qv1
key and to prevent the conference from being delayed or participanth finds Kg 6¼ i¼0 Ai . Subsequently, the fault
destroyed by malicious participants. In our protocol, detection phase begins, and the fault report
IDTPA 2 f0; 1g represents the identity of the TPA. In the ini- ðN; IDh ; rh ; Mx ; x 2 Eh  hÞ of participanth is sent to the
tial phase of the protocol, the TPA needs to select one more TPA. Due to the honesty of participanth , there exists
integer g 2 Zq and each participanti needs to submit participanti such that either Mgi 6¼ Ai or Mi 6¼ Mi .
Ai ¼ Mgi to the TPA. After all the participants generate a Therefore, participanti is detected as a malicious partici-
common conference key following the protocol, the TPA pant. The second is that participanth is asked to submit
broadcasts fN; IDTPA ; Ai j0 i v  1g among all partici- ðN; IDh ; rh ; Mx ; x 2 Eh  hÞ to the TPA. Because of the
pants, where N ¼ H2 ðID1 ; ID2 ; . . . ; IDv ; ID1 ; IDTPA ; tÞ is an honesty of participanth , the TPA finds Mgh ¼ Ah and
unique serial number for this conference and Ai denotes the Mh ¼ Mh . In conclusion, an honest participant will never
verified unique sub key of all participants. Then, every par- be removed by the TPA.
ticipant verifies the authenticity of the common conference Qv1 For a malicious participant participantm who attempts
key K by checking whether the equation Kg ¼ i¼0 Ai to delay or destroy the conference, three cases where
holds. If the equation does not hold for some participants, participantm attempts to sabotage the conference should
some malicious participants are involved in the group and be taken into consideration. The first case is that
the fault detection phase begins. Otherwise, a common con- participantm delays submitting a required message or
ference key is established among all participants. keeps sending invalid messages to the TPA. In this case,
In the fault detection phase,
Q participantj , who finds that participantm will be removed from the conference if the
the above equation Kg ¼ v1 i¼0 Ai does not hold, needs to failure occurrence exceeds a threshold t or participantm
send a fault report ðN; IDj ; rj ; Mx ; x 2 Ej  jÞ to the TPA. did not resend the report within ~t. The second case is
The fault report contains the secret key of participantj and that participantm deliberately sends a fault report
the messages M he received from the intended participants. ðN; IDm ; rm ; Mx ; x 2QEm  mÞ to the TPA. In this case,
Then, the TPA checks whether Mgj ¼ e^ðG; ej rj S j Þg ¼ Aj the TPA finds Kg 6¼ v1 i¼0 Ai , and all the remaining partic-
holds. If not, the message that participantj sends to other ipants have to send a fault report to the TPA. However, if
participants is different from the message that participantj Mi ¼ Mi holds for all the remaining participants,
submits to the TPA. Thus, participantj has to resend the participantm is detected as malicious and removed by
fault report in a period of time ~t. Note that participantj the TPA. The third case is that participantm performs the
should be removed from the conference if the failure occur- different key attack. Participantm selects two different
rence of participantj exceeds a threshold t or participantj sub keys rm and rm and submits a false message to the
did not resend the report within ~t. Here, t represents the TPA. Due to the different sub keys of participantm , the
tolerable number of errors. In this case, participantj is either common conference key generated from different partici-
a malicious participant or undergoes a denial of service pants is distinct. In this case, there is at least one Mgm not
attack. Otherwise, the fault detection should be processed equal Qto Am since rm 6¼ rm . Participanti who detects
among all the remaining participants. v1
Kg 6¼ i¼0 Ai will report this fault to the TPA. Then,
When the fault detection phase is conducted by all the
participantm is required to submit ðN; IDm ; rm ; Mx ; x 2
remaining participants, every participant except participantj
Em  mÞ. Because Mm calculated by participantm does
should send ðN; IDi ; ri ; Mx ; x 2 Ei  iÞ to the TPA. Then,
not equal Mm received from other participants,
the TPA checks whether Mgi ¼ e^ðG; ei ri S i Þg ¼ Aj holds. If
participantm is detected as a malicious participant. u
t
not, participanti has to resend the fault report in a period of
time ~t. Similar to participantj , participanti should be According to Theorem 3, an honest participant will not be
removed from the conference if the failure occurrence of removed from the conference, whereas a malicious partici-
participanti exceeds a threshold t or participanti did not pant will be detected and removed from the conference. In
resend the report within ~t. Otherwise, the TPA checks addition, after some malicious participants are removed
whether Mi ¼ e^ðG; ei ri S i Þ calculated by participanti is equal from the conference, the common conference key could not
to Mi received from participanty ði 2 Ey ðy 6¼ iÞÞ. If not, be derived because some messages are missing for generat-
participanti is a malicious participant. If yes for all the ing the conference key. Then, the positions of malicious par-
remaining participants, participantj is a malicious partici- ticipants should be replaced by volunteers to ensure that the
pant. The TPA removes the malicious participant and denial protocol performs well. A volunteer is a participant in a con-
of service participant, and the protocol restarts. After the ference who helps real participants complete some calcula-
fault detection phase, an authenticated common conference tions and transfer information. Moreover, during the key

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
1006 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO. 6, NOVEMBER/DECEMBER 2019

agreement process, Mi of the volunteer is set as 1, which can Theorem 4. If the condition of Xi poly Yi holds for all
make our protocol perform well. Therefore, the protocol can participanti , then X poly Y .
not only resist different key attacks from malicious partici- P
pants but also provide the property of fault tolerance. Proof. Let Xi ¼ fG; PPUB ; H2 ðIDi Þ; e^ðG; ei ri S i Þg and
The proposed protocol can effectively support secure and Yi ¼ fG; PPUB ; H2 ðIDi Þ; yi g.
efficient group data sharing in cloud computing, which is X
described as follows. In the initial phase, the system parame- X ¼ ðG; PPUB ; H2 ðIDi Þ; e^ðG; ei ri S i Þj0 i v  1Þ
X
ters are generated by the TPA. Then, the TPA distributes the ¼ ðG; PPUB ; H2 ðID0 Þ . . . H2 ðIDv1 Þ; e^ðG; e0 r0 S 0 Þ
parameters to the clients who want to achieve data sharing X
. . . e^ðG; ev1 rv1 S v1 ÞÞ
in the cloud. In the key agreement phase, in Round 1, each
client in the same group selects a secret key ri and calculates Y
v1

Mi ¼ e^ðG; ei ri S i Þ. In addition, Yi ¼ H2 ðIDi Þ, Ti ¼ Xi  e^ðG; wi ri S i Þ ¼ Xi

i¼0
and a time stamp ti are used to support authentication serv-
d
ices, where Xi ¼ Yi i and wi ¼ H2 ðMi; ti Þ. Subsequently, Y ¼ ðG; PPUB ; H2 ðIDi Þ; yj0 i v  1; y 2 Zq Þ
each client receives messages Dj ¼ fYj ; ðMj Þei ; Tj ; tj g from Y
v1
their intended counterparts based on the structure of the ¼ Y i:
SBIBD. In Round 2, each client receives messages E j;i ¼ i¼0

fYj ; ðCj;i Þei ; ðMj Þei ; Tj ; tj g from their intended counterparts.

According to Theorem 1, after the two rounds of information Due to the discrete logarithm problem over elliptic
exchange, every client within a group generates a common curves being hard when p is more than 512-bits long and
conference key. In a group, the correctness and validity of the BDH assumption, we have Xi poly Yi . Thus,
Qv1 Qv1
the common conference key are guaranteed by the fault tol- i¼0 X i poly i¼0 Y i . It implies that X poly Y . u
t
erance property of the protocol. In addition, the clients in the
group can dynamically update the key by restarting the pro- 6.2 Security Against Active Attacks
tocol. In Sections 6 and 7, the presented protocol has already In an active attack, an adversary not only learns information
been proven to be secure against both passive attacks and about the conference key but also replays, forges and delays
active attacks, and the communication complexity and p theffiffiffi the messages. To resist active attacks, desired properties for
computational complexity of our protocol is only Oðv vÞ a practical key agreement protocol typically include the
2
and Oðvm Þ, respectively. following.
Key Comprise Impersonation. Our protocol can withstand
6 SECURITY ANALYSIS the key comprise impersonation attack, in which the adver-
sary impersonates a legal conferee (e.g., participantj ) to
The security of our protocol is based on the ECDLP [29] and participanti with the long-term secret key (S i ) of
the BDH assumption [10]. In this section, we prove that our participanti . In our protocol, long-term secret keys of partici-
protocol is secure against passive attacks and active attacks. pants are independent of each other with respect to real iden-
tities of participants. Therefore, with the long-term secret key
6.1 Security Against Passive Attacks (S i ), the adversary still cannot learn any information about
In our protocol with v participants, a participant and a vol- long-term secret keys of other participants. In addition, sig-
unteer in the protocol are a probabilistic polynomial-time natures produced by participants are tied with a time stamp.
Turing machine, as is an adversary. A passive adversary is Thus, the adversary cannot be authenticated by replaying
the person who attempts to learn information about the con- the signature of a legal participant later. Moreover, the signa-
ference key by eavesdropping on the multicast channel. ture of participanti is encrypted by his public key ei . Since no
Note that an adversary has access to the system parameters polynomial algorithm has been found for solving the factori-
fG; PPUB ; H2 ðIDi Þj0 i v  1g and the public key ðei ; nÞ zation problem, the adversary having no access to di cannot
for participanti . In contrast, the secret key di for participanti forge or decrypt the signature of a legal participant.
cannot be deduced since it is hard to solve the integer factor- Known Session Key. The known session key prevents the
ization problem. In addition, the ephemeral key ri for session key held by a fresh participant [11] from being
participanti is prevented from the adversary due to the compromised by an adversary, even if the adversary has
ECDLP and the BDH assumption. According to [10], if learned some previous session keys. In the presented
X poly Y , then the presented protocol is secure against pas- protocol, the ephemeral secret key ri is selected by
sive attacks. X poly Y represents thatPtwo tuples of random participanti in each session randomly, which makes every
variables X ¼ fG; PPUB ; H2 ðIDi Þ; e^ðG; ei ri S i Þj0 i v  1g value of ri equally P likely. Therefore, session keys calcu-
and Y ¼ fG; PPUB ; H2 ðIDi Þ; yj0 i v  1; y 2 Zq g are poly- lated as K ¼ e^ðG; v1 i¼0 ei ri S i Þ are independent in each ses-
nomially indistinguishable, where y 2 Zq is a randomly sion such that the adversary cannot learn any information
chosen number. More precisely, if X poly Y , for all polyno- about the session key of a fresh participant. He cannot do
mial time distinguishers, the probability of distinguishing any better than a guess.
X and Y is smaller than 12 þ QðlÞ1
for all polynomials QðlÞ [30]. Perfect Forward Security. A protocol offers perfect forward
Here, l 2 Z þ is a security parameter in our key agreement security if the compromising of long-term keys (S i ) during
protocol, which can determine the size of p defined in Defi- the communication among multiple participants cannot
nition 1. All algorithms run in probabilistic polynomial time result in the compromising of the previous session key (Kpre ).
with l as an input. In our protocol, the previous session key is computed as

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
SHEN ET AL.: BLOCK DESIGN-BASED KEY AGREEMENT FOR GROUP DATA SHARING IN CLOUD COMPUTING 1007

! e
X
v1 3k modular exponentiations are required to obtain Mj ; Tj j ;
wj
Kpre ¼ e^ G; ei ri pre S i : Mj for the purpose of providing authentication services.
i¼0
Therefore, in Round 2, the number of modular exponentia-
Even if the long-term keys (S i ) are compromised by an tions is Mi ¼ 4k. In terms of communication overhead,
adversary, the adversary who has no access to the previous every participant needs to receive k messages in each
ephemeral secret key (ri pre ) cannot generate the previous round based on the group data sharing model of a
session key. Note that the security of the previous ephem- ðv; k þ 1; 1Þ-design. Thus, the number of message exchanges
eral key (ri pre ) is based on the ECDLP and the BDH of participanti is 2k.
assumption. Therefore, the presented protocol provides per- In our protocol, the calculation of the point multiplica-
fect forward security. tion, the pairing computation and the modular exponentia-
Different Key Attacks. In accordance with Theorem 3, in tion is over the supersingular elliptic curve, which is
the fault detection phase, a malicious participant who defined in Definition 1. Thus, the computational complexi-
attempts to delay or destruct the conference will be ties of the point multiplications and the pairing computa-
removed from the conference by the TPA. Therefore, the tion are OðmÞ and Oðm2 Þ, respectively. Here, m is the
proposed protocol can resist different key attacks. extension degree of the finite field F pm .
Key Confirmation. If a participant is assured that its coun- Essentially, in the presented protocol with v participants,
terparts actually have possession of a particular secret key, the total numbers of point multiplications and Weil pairing
the protocol provides key confirmation. In our protocol, computations in the protocol are P ¼ 2v and W ¼ 2v, respec-
with respect to the fault detection phase in Section 5, each tively. Additionally, the total number of modular exponen-
participant can ensure that its counterparts actually have tiations is M ¼ 7kv. The communication complexity and the
possession of a common conference key K. Therefore, the computational complexity in the protocol are OðvkÞ and
presented protocol can provide key confirmation. Oð2vm2 þ 2vmÞ, respectively. Moreover, in accordance with
Moreover, the presented protocol can resist denial of ser- the basic equation of a BIBD defined in Definition 3, we have
vice attacks. In the fault detection phase, a participant ðv  1Þ ¼ rðk  1Þ. Note that the presented protocol is based
should be removed by the TPA if he did not resend the fault on the ðv; k þ 1; 1Þ-design of p anffiffiffi SBIBD. Thus, we have  ¼ 1
report within ~t or the failure occurrence exceeds a thresh- and r ¼ k. In this case, k v. Therefore,
pffiffiffi the communica-
old t. Note that the presented protocol is contributory. tion complexity of our protocol is Oðv vÞ, and the computa-
Unlike the El Gamal one-pass protocol where only one of tional complexity is Oðvm2 Þ. Note that compared to the
the parties contributes a fresh exponent, each participant in protocol in paper [9], our protocol is more efficient since we
our protocol equally contributes to the common conference adopt the ðv; k þ 1; 1Þ-design of an SBIBD such that  can
key and guarantees the freshness of the key. reach its minimum value of one ( ¼ 1), where  is a parame-
ter in the SBIBD. Inffi paper [9], when  > 1, k is approxi-
pffiffiffiffiffi
7 PERFORMANCE ANALYSIS AND EVALUATION mately equal to vpand ffiffiffiffiffiffi the communication complexity of
7.1 Performance Analysis the protocol is Oðv vÞ. In addition, one more modular
Generally, the performance of a key agreement protocol con- exponentiation is required for each participant. The detailed
sists of communicational and computational efficiency. In comparison results are shown in Table 2.
each round of our protocol, each participant has to receive k
messages from the intended k participants according to a 7.2 Performance Evaluation
ðv; k þ 1; 1Þ-design of the SBIBD. Then, each participant has To study the performance of our scheme, we provide an
to perform some operations such as point multiplications, experimental evaluation of the proposed scheme.2 Our
pairing computations, and so forth. Computational complex- experiments are simulated by using C programming lan-
ity is composed of pairing computations, point multiplica- guage with the pairing-based cryptography (PBC) library
tions and modular exponentiations, whereas communication and the GUN multiple precision arithmetic (GMP) library
complexity is composed of the number of participants and on a VMware Workstation machine with Intel Core i5-3210
the number of message exchanges. processors running at 2.50 GHz and 2G memory, Ubuntu
Let Pi denote the total point multiplications of 12.04 X64.
participanti , Mi represent the total modular exponentiations The simulation consists of two parts. In the first part, we
of participanti and Wi imply the total Weil pairings com- present a comparative simulation analysis between Yi’s
puted by participanti . In Round 1, participanti needs scheme [7] and our scheme with respect to the time cost for
to compute ei ri S i , wi ri S i and two Weil pairings Mi ¼ each participant in different phases, which is illustrated in
e^ðG; ei ri S i Þ, e^ðG; wi ri S i Þ. Thus, we have Pi ¼ 2, Wi ¼ 2. After Fig. 4. It can be seen that the time cost increases with the
receiving some messages from participantj , participanti number of participants. On the one hand, simulation results
 d in Figs. 4a and 4b indicate that our scheme is much more
decrypts Mj ¼ ðMj Þei i ; j 2 Ei  fig by his secret key di .
The number of messages received by participanti is k.
Hence, k modular exponentiations are needed, namely, 2. Source codes of the simulation have been uploaded to
IEEE Xplore + Code Ocean. They are named as
Mi ¼ k. Furthermore, participanti needs to compute 2k “Efficiency comparison for different phases (v2)” with DOI
e w
modular exponentiations Tj j and Mj j for the purpose of “10.24433/CO.eea19cea-ca33-4f3c-b641-f46fb7b79253”,
ensuring his counterparts. In summary, in Round 1, “Efficiency comparison for multiple participants (v2)” with DOI
e “10.24433/CO.a433f2e9-2003-45d1-b519-98bf3aec28dc”, and
Mi ¼ 3k. In Round 2, to obtain Cj;i ¼ ðCj;ii Þdi , participanti “Efficiency comparison for different simulation times (v2)” with DOI
needs to compute k modular exponentiations. In addition, “10.24433/CO.6b08d728-fc8b-4af7-8f1d-cae7c28af097”.

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
1008 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO. 6, NOVEMBER/DECEMBER 2019

TABLE 2
Comparison Results

Yi’s protocol Shen et al.’s protocol Our protocol

Type of msgs distribution Broadcast Multicast Multicast
Type of communication model Centralized Decentralized Decentralized
The number of participants n 7 n
No. of Weil pairing computation
per participanti 2ðn  1Þ 2 2
No. of point multiplication
per participanti 6 2 2
No. of modular exponentiation pffiffiffiffiffiffi pffiffiffi
per participanti 2n 7n n 7n n
pffiffiffiffiffiffi pffiffiffi
Total computation cost 2n2 ðWi Þ þ 7nðPi Þ þ 2nðMi Þ 2nðWi Þ þ 2nðPi Þ þ ð7n n þ nÞðMi Þ 2nðWi Þ þ 2nðPi Þ þ 7n nðMi Þ
pffiffiffiffiffiffi pffiffiffi
Communication complexity Oðn2 Þ Oðn nÞ Oðn nÞ
Computational complexity Oðn2 m2 Þ Oðnm2 Þ Oðnm2 Þ

n: Participant’s number, m: Extension degree of the finite field F pm ; Pi : Point multiplications of participanti , Mi : Modular exponentiations of participanti ,
Wi : Weil pairings computed by participanti , : Parameter in the SBIBD.

Fig. 4. Efficiency comparison for different phases.

efficient than Yi’s scheme in both initial phase and key computational cost of Yi’s scheme continuously increases
agreement phase. On the other hand, in Fig. 4c, the time with the growth of the participant’s number n, while the
cost of our scheme is slightly higher than that of Yi’s computational cost of our scheme increases slightly with a
scheme. The reason is that, for each participant, 4 point mul- prime number k (Here, n ¼ k2 þ k þ 1). It is concluded that
tiplications are required in Yi’s scheme, while k modular our scheme is much more efficient than Yi’s scheme, which
exponentiations are required in our scheme during the makes our scheme more practical for key agreement in the
authentication phase. However, we argue that, in terms of cloud environment. In addition, in Fig. 6, we present the
the total computational cost for each participant, our efficiency comparison of Yi’s scheme and our scheme with
scheme is much more efficient than Yi’s scheme, which is different simulation times, where the participants number
illustrated in Fig. 5. is fixed as 133. Note that taking advantage of the SBIBD in
In the second part, we focus on analyzing the total our scheme, k ¼ 11 when the participant’s number is 133.
computational cost for each participant of Yi’s scheme and First, in the initial phase, Yi’s scheme requires to compute 2
our scheme with respect to different participants and differ- point multiplications and 132 weil pairings, while our
ent simulation times. It is clearly seen from Fig. 5 that our scheme only needs 2 point multiplications, 2 weil pairings
scheme is superior to Yi’s scheme. Note that the and 11 modular exponentiations. Second, in the key

Fig. 5. Efficiency comparison for multiple participants. Fig. 6. Efficiency comparison for different simulation times.

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
SHEN ET AL.: BLOCK DESIGN-BASED KEY AGREEMENT FOR GROUP DATA SHARING IN CLOUD COMPUTING 1009

agreement phase, Yi’s scheme requires 132 weil pairings, [4] W. Diffie and M. E. Hellman, “New directions in cryptography,”
IEEE Trans. Inf. Theory, vol. IT-22, no. 6, pp. 644–654, Nov. 1976.
while our scheme only needs 33 modular exponentiations. [5] J. Shen, H. Tan, S. Moh, I. Chung, and J. Wang, “An efficient RFID
Finally, in the authentication phase, Yi’s scheme requires 4 authentication protocol providing strong privacy and security,”
point multiplications, while our scheme needs 33 modular J. Internet Technol., vol. 17, no. 3, 2016, Art. no. 2.
exponentiations. Through the simulation, we can conclude [6] L. Law, A. Menezes, M. Qu, J. Solinas, and S. Vanstone, “An effi-
cient protocol for authenticated key agreement,” Des. Codes Cryp-
that the time cost of our scheme is much smaller than that of tography, vol. 28, no. 2, pp. 119–134, 2010.
Yi’s scheme with different simulation times. In addition, it [7] X. Yi, “Identity-based fault-tolerant conference key agreement,”
is easily observed that the performance of our scheme is IEEE Trans. Depend. Secure Comput., vol. 1, no. 3, pp. 170–178, Jul.–
Sep. 2004.
more stable than Yi’s scheme. [8] R. Barua, R. Dutta, and P. Sarkar, “Extending joux’s protocol to
multi party key agreement (extended abstract),” in Proc. 4th Int.
8 CONCLUSION Conf. Cryptology India, 2003, pp. 205–217.
[9] J. Shen, S. Moh, and I. Chung, “Identity-based key agreement pro-
As a development in the technology of the Internet and tocol employing a symmetric balanced incomplete block design,”
cryptography, group data sharing in cloud computing has J. Commun. Netw., vol. 14, no. 6, pp. 682–691, 2012.
opened up a new area of usefulness to computer networks. [10] B. Dan and M. Franklin, “Identity-based encryption from the weil
pairing,” SIAM J. Comput., vol. 32, no. 3, pp. 213–229, 2003.
With the help of the conference key agreement protocol, the [11] S. Blakewilson, D. Johnson, and A. Menezes, “Key agreement pro-
security and efficiency of group data sharing in cloud com- tocols and their security analysis,” in Proc. IMA Int. Conf. Cryptog-
puting can be greatly improved. Specifically, the outsourced raphy Coding, 1997, pp. 30–45.
[12] I. Chung and Y. Bae, “The design of an efficient load balancing
data of the data owners encrypted by the common conference algorithm employing block design,” J. Appl. Mathematics Comput.,
key are protected from the attacks of adversaries. Compared vol. 14, no. 1, pp. 343–351, 2004.
with conference key distribution, the conference key agree- [13] O. Lee, S. Yoo, B. Park, and I. Chung, “The design and analysis of
ment has qualities of higher safety and reliability. However, an efficient load balancing algorithm employing the symmetric
balanced incomplete block design,” Inf. Sci., vol. 176, no. 15,
the conference key agreement asks for a large amount of pp. 2148–2160, 2006.
information interaction in the system and more computa- [14] R. Curtmola, J. Garay, S. Kamara, and R. Ostrovsky, “Searchable
tional cost. To combat the problems in the conference key symmetric encryption: Improved definitions and efficient con-
structions,” J. Comput. Secur., vol. 19, no. 5, pp. 79–88, 2011.
agreement, the SBIBD is employed in the protocol design. [15] N. Cao, C. Wang, M. Li, K. Ren, and W. Lou, “Privacy-preserving
In this paper, we present a novel block design-based key multi-keyword ranked search over encrypted cloud data,” IEEE
agreement protocol that supports group data sharing in Trans. Parallel Distrib. Syst., vol. 25, no. 1, pp. 222–233, Jan. 2014.
cloud computing. Due to the definition and the mathemati- [16] J. Yu, K. Ren, C. Wang, and V. Varadharajan, “Enabling cloud
storage auditing with key-exposure resistance,” IEEE Trans. Inf.
cal descriptions of the structure of a ðv; k þ 1; 1Þ-design, Forensics Secur., vol. 10, no. 6, pp. 1167–1179, Jun. 2015.
multiple participants can be involved in the protocol and [17] J. Yu, K. Ren, and C. Wang, “Enabling cloud storage auditing with
general formulas of the common conference key for verifiable outsourcing of key updates,” IEEE Trans. Inf. Forensics
participanti are derived. Moreover, the introduction of vol- Secur., vol. 11, no. 6, pp. 1362–1375, Jun. 2016.
[18] S. D. C. D. Vimercati, S. Foresti, S. Jajodia, S. Paraboschi, and
unteers enables the presented protocol to support the fault P. Samarati, “Encryption policies for regulating access to outsourced
tolerance property, thereby making the protocol more prac- data,” ACM Trans. Database Syst., vol. 35, no. 2, pp. 78–78, 2010.
tical and secure. In our future work, we would like to [19] H. Guo, Z. Li, Y. Mu, and X. Zhang, “Cryptanalysis of simple
three-party key exchange protocol,” Comput. Secur., vol. 27,
extend our protocol to provide more properties (e.g., ano- no. 1/2, pp. 16–21, 2008.
nymity, traceability, and so on) to make it appliable for [20] Z. Tan, “An enhanced three-party authentication key exchange
a variety of environments. protocol for mobile commerce environments,” J. Commun., vol. 5,
no. 5, pp. 436–443, 2010.
[21] Y. M. Tseng, “An efficient two-party identity-based key exchange
ACKNOWLEDGMENTS protocol,” Informatica, vol. 18, no. 1, pp. 125–136, 2007.
The authors would like to thank the editors and anonymous [22] A. Shamir, “Identity-based cryptosystems and signature
schemes,” in Proc. Workshop Theory Appl. Cryptographic Techn.,
reviewers for their constructive feedback and insightful 1985, vol. 21, no. 2, pp. 47–53.
suggestions that helped to significantly improve the quality [23] E. Bresson, O. Chevassut, D. Pointcheval, and J. J. Quisquater,
of this work. This work is supported by the National Science “Provably authenticated group Diffie-Hellman key exchange,”
ACM Trans. Inf. Syst. Secur., vol. 10, no. 3, pp. 89–92, 2001.
Foundation of China under Grant No. 61672295, No. [24] D. R. Stinson, Combinatorial Designs: Constructions and Analysis.
61373169, No. 61572379, No. 61501333 and No. U1405254, Berlin, Germany: Springer, 2007.
the State Key Laboratory of Information Security under [25] J. Shen, J. Shen, X. Chen, X. Huang, and W. Susilo, “An efficient
Grant No. 2017-MS-10, the 2015 Project of six personnel in public auditing protocol with novel dynamic structure for cloud
data,” IEEE Trans. Inf. Forensics Secur., vol. 12, no. 10, pp. 2402–2415,
Jiangsu Province under Grant No. R2015L06, the CICAEET Oct. 2017, doi: 10.1109/TIFS.2017.2705620.
fund, and the PAPD fund. [26] B. Lamacchia, K. Lauter, and A. Mityagin, “Stronger security of
authenticated key exchange,” in Proc. Int. Conf. Provable Secur.,
REFERENCES 2007, pp. 1–16.
[27] O. Hasan, L. Brunie, E. Bertino, and N. Shang, “A decentralized
[1] L. Zhou, V. Varadharajan, and M. Hitchens, “Cryptographic role- privacy preserving reputation protocol for the malicious adversar-
based access control for secure cloud data storage systems,” IEEE ial model,” IEEE Trans. Inf. Forensics Secur., vol. 8, no. 6, pp. 949–
Trans. Inf. Forensics Secur., vol. 10, no. 11, pp. 2381–2395, 962, Jun. 2013.
Nov. 2015. [28] L.-K. Hua, Introduction to Number Theory. Berlin, Germany:
[2] F. Chen, T. Xiang, Y. Yang, and S. S. M. Chow, “Secure cloud Springer, 2012.
storage meets with secure network coding,” in Proc. IEEE Conf. [29] W. Stallings, “Cryptography and network security: Principles and
Comput. Commun., 2014, pp. 673–681. practice,” Int. Ann. Criminology, vol. 46, no. 4, pp. 121–136, 2008.
[3] D. He, S. Zeadally, and L. Wu, “Certificateless public auditing [30] M. Steiner, G. Tsudik, and M. Waidner, “Key agreement in
scheme for cloud-assisted wireless body area networks,” IEEE Syst. dynamic peer groups,” IEEE Trans. Parallel Distrib. Syst., vol. 11,
J., vol. PP, no. 99, pp. 1–10, 2015, doi: 10.1109/JSYST.2015.2428620. no. 8, pp. 769–780, Aug. 2000.

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.
1010 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 16, NO. 6, NOVEMBER/DECEMBER 2019

Jian Shen received the ME and PhD degrees in Xingming Sun received the BS degree in mathe-
computer science from Chosun University, South matics from Hunan Normal University, China, in
Korea, in 2009 and 2012, respectively. Since late 1984, the ME degree in computing science from
2012, he has been a professor with Nanjing Uni- the Dalian University of Science and Technology,
versity of Information Science and Technology, China, in 1988, and the PhD degree in computing
Nanjing, China. His research interests include science from Fudan University, China, in 2001.
public key cryptography, secure data sharing, He is currently a professor in the School of Com-
and data auditing in cloud. He is a member of the puter and Software, Nanjing University of Infor-
IEEE. mation Science and Technology, China. His
research interests include network and informa-
tion security, digital watermarking, digital foren-
sic, database security, and natural language processing. He is a senior
Tianqi Zhou received the BE degree from the member of the IEEE.
Nanjing University of Information Science and
Technology, Nanjing, China, in 2016. She is
currently working toward the postgraduate at Yang Xiang received the PhD degree in com-
the School of Nanjing University of Information puter science from Deakin University, Australia.
Science and Technology, Nanjing, China. Her He is currently a dean at the Digital Research &
research interests include computer and network Innovation Capability Platform, Swinburne Uni-
security, security systems, and cryptography. versity of Technology. He is the director of the
Network Security and Computing Lab (NSCLab).
His research interests include network and sys-
tem security, distributed systems, and network-
ing. In particular, he is currently leading his team
developing active defense systems against large-
Debiao He received the PhD degree in applied
mathematics from the School of Mathematics and scale distributed network attacks. He is the chief
Statistics, Wuhan University, Wuhan, China, in investigator of several projects in network and system security, funded
2009. Currently, he is a professor with the State by the Australian Research Council (ARC). He has published more than
Key Laboratory of Software Engineering, Com- 130 research papers in many international journals and conferences,
puter School, Wuhan University. His research such as the IEEE Transactions on Computers, the IEEE Transactions
on Parallel and Distributed Systems, the IEEE Transactions on Informa-
interests include cryptography and information
tion Security and Forensics, and the IEEE Journal on Selected Areas in
security, in particular, cryptographic protocols.
Communications. Two of his papers were selected as the featured
articles in the April 2009 and the July 2013 issues of the IEEE Transac-
tions on Parallel and Distributed Systems. He has published two books,
Software Similarity and Classification (Springer) and Dynamic and
Advanced Data Mining for Progressing Technological Development
Yuexin Zhang received the BS degree from the (IGI-Global). He has served as the program/general chair for many inter-
Department of Physics and Electronic Information
national conferences such as ICA3PP 12/11, IEEE/IFIP EUC 11, IEEE
Engineering, Inner Mongolia Normal University,
TrustCom 13/11, IEEE HPCC 10/09, IEEE ICPADS 08, and NSS 11/10/
China, in 2010 and the MS degree from the School 09/08/07. He has been the PC member for more than 60 international
of Mathematics and Computer Science, Fujian conferences in distributed systems, networking, and security. He serves
Normal University, China, in 2013. He is currently as the associate editor of the IEEE Transactions on Computers, the
working toward the PhD degree in computer sci- IEEE Transactions on Parallel and Distributed Systems, Security
ence at Deakin University, Melbourne, Australia.
and Communication Networks (Wiley), and the editor of the Journal
His research focuses on network security.
of Network and Computer Applications. He is the coordinator, Asia for
IEEE Computer Society Technical Committee on Distributed Processing
(TCDP). He is a senior member of the IEEE.

" For more information on this or any other computing topic,

please visit our Digital Library at www.computer.org/publications/dlib.

Authorized licensed use limited to: St Martin's Engineering College. Downloaded on June 08,2022 at 07:39:40 UTC from IEEE Xplore. Restrictions apply.