On defining a group generator G , it takes a security parameter and outputs a description of a bilinear map group G = ( p , G , G T , e ) , where p is a prime, G and G T are multiplicative cyclic groups of order p, and e is a map e : G × G → G T , such that:

• Bilinearity: For all u , v ∈ G and ∀ a , b ∈ ℤ p , there has e ( u a , v b ) = e ( u , v ) a b .

• Non-degeneracy: For any generator g of G , e ( g , g ) ≠ 1 G T .

• Computability: ∀ u , v ∈ G , there exists an efficient algorithm to compute e ( u , v ) .

The decisional bilinear Diffie-Hellman (DBDH) problem is defined as follows.

Definition 1. (Decisional Bilinear Diffie-Hellman Problem). Given a group generator G , and its output G = ( p , G , G T , e ) . For a , b , c ∈ ℤ p , a generator g of G and ( g a , g b , g c ) , define whether Z = e ( g , g ) a b c or not. For a probabilistic polynomial time (PPT) adversary A , the advantage of solving the DBDH problem is:

A d v A D B D H = | P r [ A ( g , g a , g b , g c , e ( g , g ) a b c ) = 1 ] − P r [ A ( g , g a , g b , g c , Z ) = 1 ] | ,

where Z ← $ G T .

We say the DBDH problem holds in bilinear map G = ( p , G , G T , e ) if for any PPT adversary, the advantage of solving DBDH problem A d v A D B D H is negligible.

An identity-based homomorphic broadcast encryption (IBHBE) scheme is an identity-based encryption, which supports a set of receivers to decrypt ciphertext. Suppose that the message space is M , an identity-based broadcast encryption has four probability polynomial time (PPT) algorithms and one protocol:

• Setup ( λ ). It takes input a security parameter λ , and outputs the public parameter pp and a master secret key msk.

• Extract (msk, ID). It takes input a master secret key msk and an identity ID, and outputs a private key s k I D .

• Encrypt (pp, S, m). It takes input the public parameter pp, a receiver set S, and a message m, and outputs a ciphertext CT.

• Decrypt (pp, sk_ID, CT). It takes input the public parameter pp, a secret key , and a ciphertext CT, and outputs a message m.

• Eval (pp, CT₀, CT₁). By interacting with a receiver with identity I D ∈ S 0 ∩ S 1 , any entity can use the evaluation protocol to a helper value t for these two ciphertexts. Then the entity can use the helper value to calculate the two ciphertext into a new one, which is a valid ciphertext of the corresponding operation result of the two plaintexts of ciphertext.

Correctness. For all identity sets S 0 , S 1 , messages m 0 , m 1 , identity ID, if ( p p , m s k ) ← S e t u p ( λ ) , s k I D ← E x t r a c t ( m s k , I D ) , C T 0 ← E n c r y p t ( p p , S 0 , m 0 ) , and C T 1 ← E n c r y p t ( p p , S 1 , m 1 ) , there has

• If I D ∈ S 0 , then D e c r y p t ( p p , s k I D , C T 0 ) = m 0 .

• If I D ∈ S 0 ∩ S 1 , then D e c r y p t ( p p , s k I D , E v a l ( p p , C T 0 , C T 1 ; s k I D ) ) = m 0 + m 1 .

Security Model of IBBE. We consider IBBE under IND-CPA security model, which is captured in the following game (Figure 1).

Note that, in Challenge step, the adversary cannot choose a receiver set S * which contains any identity is queried in Phase 1. Similarly, in Phase 2, the adversary cannot launch Extraction Query on any identity belonged to the receiver set S * or any Helper Value Query on the challenge ciphertext.

Definition 2. We say an IBBE scheme Π is IND-CPA secure, if for any probabilistic polynomial time (PPT) adversary A , the advantage to win the IND-CPA Game A d v A , Π I N D - C P A is negligible; where,

A d v A , Π I N D − C P A = | P r [ b = b ′ ] − 1 2 | (1)

Our IBHBE scheme contains four PPT algorithm and a one-round protocol.

• Setup (λ): The algorithm takes input a security parameter λ , and outputs a bilinear map ( p , G , G T , e ) ← G ( λ ) . Here, p is a prime number, G and G T are p order multiplicative cyclic groups, and e is a bilinear map e : ( G , G ) → G T . Then, it randomly picks generator g ∈ G and α ∈ ℤ p , computes g 1 = g α . It also defines message space M = ℤ q and two secure hash functions H 1 : { 0 , 1 } * → G , H 2 : G T → ℤ q , where q is a prime number. Then it sets the master secret key m s k = α and opens the public parameter pp as ( p , G , G T , e , q , g , g 1 , H 1 , H 2 ) .

• Extract (msk, ID): For a system user with identity ID, the algorithm generates the user’s secret key as s k I D = H 1 ( I D ) m s k = H 1 ( I D ) α .

• Encrypt (pp, S, m): Any user can run the encryption algorithm. For a message m ∈ M and a receiver set S = { I D 1 , I D 2 , ⋯ , I D n } , the algorithm first chooses random number r ∈ ℤ p , and computes C = g r . Then for each I D i ∈ S , it computes t i = H 2 ( e ( H 1 ( I D i ) r , g 1 ) ) , F ( x ) = ∏ i = 1 n ( x − t i ) + m mod q . It computes the expansion formula of F ( x ) as F ( x ) = ∑ j = 0 n a j ⋅ x j mod q . Then the ciphertext is C T = ( C , A ) , where A is a vector,

A = ( a 0 , a 1 , ⋯ , a n ) (2)

• Decrypt (pp, sk_ID, CT): When decrypting ciphertext CT with the secret key s k I D , the algorithm first computes τ = H 2 ( e ( s k I D , C ) ) . Then it sets a vector T as

T = ( τ 0 , τ 1 , ⋯ , τ n ) . (3)

Finally, it outputs the message as m = A ⋅ T mod q .

• Eval (pp, CT₀, CT₁): Parse C T 0 and C 1 as ( C 0 , A 0 ) and ( C 1 , A 1 ) , which are encrypted under identity sets S 0 and S 1 respectively. Then, an external entity, such as a gateway, can generate a new ciphertext for a specified receiver with identity I D ∈ S 0 ∩ S 1 . This protocol is shown in Figure 2. Here, the operation ∘ means the hadamard product of two vectors. ( A ∘ B ) i = ( A i ⋅ B i ) .

As claimed in Section 2.3, the correctness of our IBHBE scheme has two aspects. Next we give the detailed proof.

Proof. The correctness proof is described as follows.

• For the first aspect, the condition to decrypt a ciphertext under identity set S 0 is that the receiver can computer a valid value x equaled one of t i . When a receiver with identity ID tries to decrypt a ciphertext C T 0 = ( C , A ) encrypted under identity set S 0 , it computes

τ = H 2 ( e ( s k I D , C ) ) = H 2 ( e ( H 1 ( I D ) α , g r ) ) = H 2 ( e ( H 1 ( I D ) r , g α ) ) = H 2 ( e ( H 1 ( I D ) r , g 1 ) ) .

If I D ∈ S 0 , the value τ must be one of t i to construct F ( x ) . Then we have

A ⋅ T = ∑ j = 0 n a j ⋅ τ j mod q = ∏ i = 1 n ( τ − t i ) + m mod q = m mod q

• Now we consider the second aspect. Suppose two ciphertexts C T 0 , C T 1 are encrypted under two identity sets S 0 , S 1 . If the receiver’s identity ID is in S 0 ∩ S 1 , then it can compute τ 0 and τ 1 which can be used to decrypt C T 0 and C T 1 respectively. Suppose the new ciphertext output from evaluation protocol is C T ′ = ( C 0 , A ′ ) . The receiver first computes τ = τ 0 , then decrypts the ciphertext by calculating

A ′ ⋅ T = ∑ j = 0 n a ′ j ⋅ τ j mod q = ∑ j = 0 n a 0 , j ⋅ τ 0 j + ∑ j = 0 n u 0 , j ⋅ τ 0 j mod q     /   / ( A ′ = A 0 + U , a ′ j = a 0 , j + u j ) = m 0 + ∑ j = 0 n a 1 , j ⋅ φ j ⋅ τ j mod q = m 0 + ∑ j = 0 n a 1 , j ⋅ ( φ ⋅ τ ) j mod q = m 0 + ∑ j = 0 n a 1 , j ⋅ τ j mod q     /   / ( φ = τ 0 − 1 ⋅ τ 1 ) = m 0 + m 1

Then we finish the correctness proof of our IBHBE scheme construction.

In this section, we give the formalized security proof of our IBHBE scheme under random oracle model.

Theorem 1. Suppose H₁ and H₂ are random oracles, and the DBDH problem holds, then our IBHBE construction is IND-CPA secure.

Proof. Suppose there exists a PPT adversary A has non-negligible advantage to win the IND-CAP game, then an other PPT adversary B can use A ’s ability to break the DBDH problem.

Note that, the first part of a valid ciphertext is a mask value of a valid ciphertext of Boneh and Franklin’s identity-based encryption scheme [9] . Since the scheme [9] is IND-CPA secure against PPT adversary, then the no one can distinguish random values between t_is, which are used to construct the function F ( x ) .

Now we focus on the elements of A . We have a 0 = ∑ i = 1 t ( − t i ) + m . As we already know t i is indistinguishable from random number. Therefore, no one can restore even one-bit information of m from a 0 since ∏ i = 1 n ( − t i ) is also random.