Definition 1. Let G₁, G₂, and G_T be three multiplicative cyclic groups of a prime order q. Assume that a mapping $$ is an asymmetric bilinear map. Then, the map $$ satisfies the following properties.

• (1)

  Bilinearity: $$ for g₁ ∈ G₁, g₂ ∈ G₂, and $$

• (2)

  Nondegeneracy: $$ for some g₁ ∈ G₁ and g₂ ∈ G₂

• (3)

  Computability: $$ can be efficiently computed for g₁ ∈ G₁, g₂ ∈ G₂

Definition 2. On inputting a tuple $$, we say that the BDH problem holds if no algorithm $$ has nonnegligible advantage in computing $$. The advantage can be denoted as $$.

Theorem 5. If the BDH assumption holds, the proposed RIBEET scheme satisfies the IND-ID-CCA security in the security game. More precisely, suppose that $$ is a PPT type 1 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm $$ to solve the BDH problem with the advantage

Proof. An algorithm $$ is constructed to solve the BDH problem. The algorithm $$ is given a BDH tuple $$ which is defined in Section 2. The algorithm $$ can be seen as a challenger to find the answer of the BDH problem. The answer A = $$ can be found by interacting with the PPT type I adversary $$ in the following security game.

• (1)

  Setup: the challenger $$ utilizes the BDH tuple to set $$ and then generates the public system parameters $$, where H_i is a random oracle for i = 1, 2, ⋯, 8. In addition, the system life time SLT = {T₀, T₁, ⋯, T_t} can be generated by the challenger $$. Then, $$ gives $$ the public system parameters PSP and system life time SLT. Here, the adversary $$ can issue queries to each random oracle as follows

  • (a)

    H₁query(ID): $$ can utilize ID to obtain a response to the random oracle H₁ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₁ which is composed of tuples, and the format of the tuple is 〈ID, U_ID, u, rb〉. The response is acquired from the ListH₁ which is initially empty and can be updated by the following steps

    • (i)

      $$ returns U_ID as the response if ID exists in a tuple 〈ID, U_ID, u, rb〉 from the ListH₁

• (ii)

  Otherwise, $$ picks a random value $$ and a random bit rb ∈ {0, 1} to compute

• (b)

  H₂query(ID): $$ can utilize ID to obtain a response to the random oracle H₂ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₂ which is composed of tuples, and the format of the tuple is 〈ID, V_ID, v, rb〉. The response is acquired from the ListH₂ which is initially empty and can be updated by the following steps:

• (a)

  $$ returns V_ID as the response if ID exists in a tuple 〈ID, V_ID, v, rb〉 from the ListH₂

• (b)

  Otherwise, $$ picks a random value $$ and utilizes ID to find rb in the ListH₂. Then, $$ computes

• (c)

  H₃query(ID, T): $$ can utilize (ID, T) to obtain a response to the random oracle H₃ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₃ which is composed of tuples, and the format of the tuple is 〈ID, T, U_IDT, η〉. The response is acquired from the ListH₃ which is initially empty and can be updated by the following steps

• (i)

  $$ returns U_IDT as the response if (ID, T) exists in a tuple 〈ID, T, U_IDT, η〉 from the ListH₃

• (ii)

  Otherwise, $$ picks a random value $$ to compute $$. Then, $$ adds the tuple 〈ID, T, U_IDT, η〉 to the ListH₃ and returns U_IDT to $$

• (d)

  H₄query(ID, T): $$ can utilize (ID, T) to obtain a response to the random oracle H₄ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₄ which is composed of tuples, and the format of the tuple is 〈ID, T, V_IDT, ζ〉. The response is acquired from the ListH₄ which is initially empty and can be updated by the following steps

• (i)

  $$ returns V_IDT as the response if (ID, T) exists in a tuple 〈ID, T, V_IDT, ζ〉 from the ListH₄

• (ii)

  Otherwise, $$ picks a random value $$ to compute $$. Then, $$ adds the tuple 〈ID, T, V_IDT, ζ〉 to the ListH₄ and returns V_IDT to $$

• (e)

  H₅query(W, CT₁, CT₂): $$ can utilize (W, CT₁, CT₂) to obtain a response to the random oracle H₅ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₅ which is composed of tuples, and the format of the tuple is 〈W, CT₁, CT₂, ω〉. The response is acquired from the ListH₅ which is initially empty and can be updated by the following steps

• (i)

  $$ returns ω as the response if (W, CT₁, CT₂) exists in a tuple 〈W, CT₁, CT₂, ω〉 from the ListH₅

• (ii)

  Otherwise, $$ picks a random value ω ∈ {0, 1}^λ+l and adds the tuple 〈W, CT₁, CT₂, ω〉 to the ListH₅. Then, $$ returns ω to $$

• (f)

  H₆query(M): $$ can utilize M to obtain a response to the random oracle H₆ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₆ which is composed of tuples, and the format of the tuple is 〈M, Q〉. The response is acquired from the ListH₆ which is initially empty and can be updated by the following steps

• (i)

  $$ returns Q as the response if M exists in a tuple 〈M, Q〉 from the ListH₆

• (ii)

  Otherwise, $$ picks a random point Q ∈ G₂ and adds the tuple 〈M, Q〉 to the ListH₆. Then, $$ returns Q to $$

• (g)

  H₇query(M, V): $$ can utilize (M, V) to obtain a response to the random oracle H₇ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₇ which is composed of tuples, and the format of the tuple is 〈M, V, γ〉. The response is acquired from the ListH₇ which is initially empty and can be updated by the following steps

• (i)

  $$ returns γ as the response if (M, V) exists in a tuple 〈M, V, γ〉 from the ListH₇

• (ii)

  Otherwise, $$ picks a random value $$ and adds the tuple 〈M, V, γ〉 to the ListH₇. Then, $$ returns γ to $$

• (h)

  H₈query(N): $$ can utilize N to obtain a response to the random oracle H₈ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₈ which is composed of tuples, and the format of the tuple is 〈N, S〉. The response is acquired from the ListH₈ which is initially empty and can be updated by the following steps

• (i)

  $$ returns S as the response if N exists in a tuple 〈N, S〉 from the ListH₈

• (ii)

  Otherwise, $$ picks a random point S ∈ G₂ and adds the tuple 〈N, S〉 to the ListH₈. Then, $$ returns S to $$

• (2)

  Phase 1: the adversary $$ can, respectively, utilize ID, (ID, T), (ID, T, CT) and (ID, T) to issue the InitialKey query, Timekey query, Decryption query, and Trapdoor query. The response to each query can be obtained as follows

• (a)

  InitialKey query(ID): $$ utilizes ID to issue the query, while $$, respectively, finds the corresponding tuples 〈ID, U_ID, u, rb〉 and 〈ID, V_ID, v, rb〉 from the ListH₁ and the ListH₂ according to ID. If rb = 1, $$ interrupts this game. If rb = 0, $$ use u and v to define $$. Then $$ returns IK_ID as the user initial key to $$

• (b)

  Timekey query(ID, T): $$ utilizes (ID, T) to issue the query, while $$, respectively, finds the corresponding tuples 〈ID, T, U_IDT, η〉 and 〈ID, T, V_IDT, ζ〉 from the ListH₃ and the ListH₄ according to (ID, T). $$ use η and ζ to define $$. Then, $$ returns TK_ID as the user time key to $$

• (c)

  Decryption query(ID, T, CT): $$ utilizes (ID, T, CT) to issue the query, while $$, respectively, finds the corresponding tuples 〈ID, U_ID, u, rb〉, 〈ID, V_ID, v, rb〉, 〈ID, T, U_IDT, η〉, and 〈ID, T, V_IDT, ζ〉 from the ListH₁, ListH₂, ListH₃, and the ListH₄ according to ID and T. The response of this query is acquired from these lists by performing the following tasks

• (i)

  If rb = 0, $$, respectively, uses ID and (ID, T) to run InitialKeyquery and Timekey query to obtain IK_ID and TK_ID. Then, $$ utilizes IK_ID, TK_ID, and CT to run the Decryption algorithm to produce the message M which is sent to $$

• (ii)

  If rb = 1, $$ utilizes CT₁ and CT₂, which are from CT = (CT₁, CT₂, CT₃, CT₄), to find the corresponding tuple 〈W, CT₁, CT₂, ω〉 from the ListH₅. Then, M^′||V^′ = CT₃ ⊕ ω can be computed by using CT₃ and ω. Further, $$ utilizes M^′ and V^′ to find the corresponding tuples 〈M, V, γ〉 from the ListH₇ and 〈M, Q〉 from the ListH₆. Obviously, γ and Q can be obtained. If S can be found in the corresponding tuple 〈N, S〉 from the ListH₈ such that CT₄ = Q^γ · S holds, $$ will confirm whether $$ holds. If $$, the message M^′ is sent to $$

• (d)

  Trapdoor query(ID, T): $$ utilizes (ID, T) to issue the query, while $$, respectively, uses ID and (ID, T) to run InitialKey query and Timekey query to obtain IK_ID = (IK_ID1, IK_ID2) and TK_ID = (TK_ID1, TK_ID2). Then, $$ utilizes IK_ID2 and TK_ID2 to produce the trapdoor TD_ID = IK_ID2 · TK_ID2 which is sent to $$

• (3)

  Challenge: when the phase 1 is over, $$ outputs a tuple $$ as the target of the challenge. $$ utilizes ID^∗ to find the corresponding tuples 〈ID, U_ID, u, rb〉 from the ListH₁. If rb = 0, $$ interrupts this game. If rb = 1, $$ randomly selects $$ and V ∈ {0, 1}^l to run H₇ query with $$ and V. Then, γ can be obtained. $$ utilizes γ to set $$. In addition, $$ sets $$, while a random value CT₃ ∈ {0, 1}^λ+l and a random point $$ are chosen. Finally, the challenge ciphertext $$ is sent to $$

• (4)

  Phase 2: $$ can issue the same query as phase 1, but it must be under the condition of ID ≠ ID^∗ and CT ≠ CT^∗

• (5)

  Guess: $$ responds to $$ with a guess $$. If $$, $$ responds with failure and terminates. Otherwise, $$ wins the game. Then, $$ randomly selects a tuple $$ from the ListH₅ and calculates $$, where $$. Hence, $$ can output the BDH solution $$ due to $$

Theorem 6. If the BDH assumption holds, the proposed RIBEET scheme satisfies the IND-ID-CCA security in the security game. More precisely, suppose that $$ is a PPT type 2 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm $$ to solve the BDH problem with the advantage

Proof. An algorithm $$ is constructed to solve the BDH problem. The algorithm $$ is given a BDH tuple $$ which is defined in Section 2. The algorithm $$ can be seen as a challenger to find the answer of the BDH problem. The answer $$ can be found by interacting with the PPT type II adversary $$ in the following security game.

• (1)

  Setup: the challenger $$ utilizes the BDH tuple to set $$ and then generates the public system parameters $$, where H_i is a random oracle for i = 1, 2, ⋯, 8. In addition, the system life time SLT = {T₀, T₁, ⋯, T_t} can be generated by the challenger $$. Then, $$ gives $$ the public system parameters PSP and system life time SLT. Here, the adversary $$ can issue queries to each random oracle as follows

• (a)

  H₁query(ID): $$ can utilize ID to obtain a response to the random oracle H₁ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₁ which is composed of tuples, and the format of the tuple is 〈ID, U_ID, u〉. The response is acquired from the ListH₁ which is initially empty and can be updated by the following steps

• (i)

  $$ returns U_ID as the response if ID exists in a tuple 〈ID, U_ID, u〉 from the ListH₁

• (ii)

  Otherwise, $$ picks a random value $$ to compute $$. Then, $$ adds the tuple 〈ID, U_ID, u〉 to the ListH₁ and returns U_ID to $$

• (b)

  H₂query(ID): $$ can utilize ID to obtain a response to the random oracle H₂ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₂ which is composed of tuples, and the format of the tuple is 〈ID, V_ID, v〉. The response is acquired from the ListH₂ which is initially empty and can be updated by the following steps

• (i)

  $$ returns V_ID as the response if ID exists in a tuple 〈ID, V_ID, v〉 from the ListH₂

• (ii)

  Otherwise, $$ picks a random value $$ to compute $$. Then, $$ adds the tuple 〈ID, V_ID, v〉 to the ListH₂ and returns V_ID to $$

• (c)

  H₃query(ID, T): $$ can utilize (ID, T) to obtain a response to the random oracle H₃ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₃ which is composed of tuples, and the format of the tuple is 〈ID, T, U_IDT, η, rb〉. The response is acquired from the ListH₃ which is initially empty and can be updated by the following steps

• (i)

  $$ returns U_IDT as the response if (ID, T) exists in a tuple 〈ID, T, U_IDT, η, rb〉 from the ListH₃

• (ii)

  Otherwise, $$ picks a random value $$ and a random bit rb ∈ {0, 1} to compute

  $$ (13)

• (d)

  H₄query(ID, T): $$ can utilize (ID, T) to obtain a response to the random oracle H₄ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₄ which is composed of tuples, and the format of the tuple is 〈ID, T, V_IDT, ζ, rb〉. The response is acquired from the ListH₄ which is initially empty and can be updated by the following steps

• (i)

  $$ returns V_IDT as the response if (ID, T) exists in a tuple 〈ID, T, V_IDT, ζ, rb〉 from the ListH₄

• (ii)

  Otherwise, $$ picks a random value $$ and utilizes (ID, T) to find rb in the ListH₄. Then, $$ computes

  $$ (14)

• (e)

  H₅query(W, CT₁, CT₂): $$ can utilize (W, CT₁, CT₂) to obtain a response to the random oracle H₅ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₅ which is composed of tuples, and the format of the tuple is 〈W, CT₁, CT₂, ω〉. The response is acquired from the ListH₅ which is initially empty and can be updated by the following steps

• (i)

  $$ returns ω as the response if (W, CT₁, CT₂) exists in a tuple 〈W, CT₁, CT₂, ω〉 from the ListH₅

• (ii)

  Otherwise, $$ picks a random value ω ∈ {0, 1}^λ+l and adds the tuple 〈W, CT₁, CT₂, ω〉 to the ListH₅. Then, $$ returns ω to $$

• (f)

  H₆query(M): $$ can utilize M to obtain a response to the random oracle H₆ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₆ which is composed of tuples, and the format of the tuple is 〈M, Q〉. The response is acquired from the ListH₆ which is initially empty and can be updated by the following steps

• (i)

  $$ returns Q as the response if M exists in a tuple 〈M, Q〉 from the ListH₆

• (ii)

  Otherwise, $$ picks a random point Q ∈ G₂ and adds the tuple 〈M, Q〉 to the ListH₆. Then, $$ returns Q to $$

• (g)

  H₇query(M, V): $$ can utilize (M, V) to obtain a response to the random oracle H₇ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₇ which is composed of tuples, and the format of the tuple is 〈M, V, γ〉. The response is acquired from the ListH₇ which is initially empty and can be updated by the following steps

• (i)

  $$ returns γ as the response if (M, V) exists in a tuple 〈M, V, γ〉 from the ListH₇

• (ii)

  Otherwise, $$ picks a random value $$ and adds the tuple 〈M, V, γ〉 to the ListH₇. Then, $$ returns γ to $$

• (h)

  H₈query(N): $$ can utilize N to obtain a response to the random oracle H₈ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₈ which is composed of tuples, and the format of the tuple is 〈N, S〉. The response is acquired from the ListH₈ which is initially empty and can be updated by the following steps

• (i)

  $$ returns S as the response if N exists in a tuple 〈N, S〉 from the ListH₈

• (ii)

  Otherwise, $$ picks a random point S ∈ G₂ and adds the tuple 〈N, S〉 to the ListH₈. Then, $$ returns S to $$

• (2)

  Phase 1: the adversary $$ can, respectively, utilize ID, (ID, T), (ID, T, CT), and (ID, T) to issue the InitialKey query, Timekey query, Decryption query, and Trapdoor query. The response to each query can be obtained as follows

• (a)

  InitialKey query(ID): $$ utilizes ID to issue the query, while $$, respectively, finds the corresponding tuples 〈ID, U_ID, u〉 and 〈ID, V_ID, v〉 from the ListH₁ and the ListH₂ according to ID. $$ use u and v to define $$. Then, $$ returns IK_ID as the user initial key to $$

• (b)

  Timekey query(ID, T): $$ utilizes (ID, T) to issue the query, while $$, respectively, finds the corresponding tuples 〈ID, T, U_IDT, η, rb〉 and 〈ID, T, V_IDT, ζ, rb〉 from the ListH₃ and the ListH₄ according to (ID, T). If rb = 1, $$ interrupts this game. If rb = 0, $$ use η and ζ to define $$. Then, $$ returns TK_ID as the user time key to $$

• (c)

  Decryption query(ID, T, CT): $$ utilizes (ID, T, CT) to issue the query, while $$, respectively, finds the corresponding tuples 〈ID, U_ID, u〉, 〈ID, V_ID, v〉, 〈ID, T, U_IDT, η, rb〉, and 〈ID, T, V_IDT, ζ, rb〉 from the ListH₁, ListH₂, ListH₃, and ListH₄ according to ID and T. The response of this query is acquired from these lists by performing the following tasks

• (i)

  If rb = 0, $$, respectively, uses ID and (ID, T) to run InitialKeyquery and Timekey query to obtain IK_ID and TK_ID. Then, $$ utilizes IK_ID, TK_ID, and CT to run the Decryption algorithm to produce the message M which is sent to $$

• (ii)

  If rb = 1, $$ utilizes CT₁ and CT₂, which are from CT = (CT₁, CT₂, CT₃, CT₄), to find the corresponding tuple 〈W, CT₁, CT₂, ω〉 from the ListH₅. Then, M^′||V^′ = CT₃ ⊕ ω can be computed by using CT₃ and ω. Further, $$ utilizes M^′ and V^′ to find the corresponding tuples 〈M, V, γ〉 from the ListH₇ and 〈M, Q〉 from the ListH₆. Obviously, γ and Q can be obtained. If S can be found in the corresponding tuple 〈N, S〉 from the ListH₈ such that CT₄ = Q^γ · S holds, $$ will confirm whether $$ holds. If $$, the message M^′ is sent to $$

• (1)

  Trapdoor query(ID, T): $$ utilizes (ID, T) to issue the query, while $$, respectively, uses ID and (ID, T) to run InitialKey query and Timekey query to obtain IK_ID = (IK_ID1, IK_ID2) and TK_ID = (TK_ID1, TK_ID2). Then, $$ utilizes IK_ID2 and TK_ID2 to produce the trapdoor TD_ID = IK_ID2 · TK_ID2 which is sent to $$

• (3)

  Challenge: when phase 1 is over, $$ outputs a tuple $$ as the target of the challenge. $$ utilizes (ID^∗, T^∗) to find the corresponding tuples 〈ID, T, U_IDT, η, rb〉 from the ListH₃. If rb = 0, $$ interrupts this game. If rb = 1, $$ randomly selects $$ and V ∈ {0, 1}^l to run H₇ query with $$ and V. Then, γ can be obtained. $$ utilizes γ to set $$. In addition, $$ sets $$, while a random value CT₃ ∈ {0, 1}^λ+l and a random point $$ are chosen. Finally, the challenge ciphertext $$ is sent to $$

• (2)

  Phase 2: $$ can issue the same query as phase 1, but it must be under the condition of ID ≠ ID^∗ and CT ≠ CT^∗

• (3)

  Guess: $$ responds to $$ with a guess $$. If $$, $$ responds with failure and terminates. Otherwise, $$ wins the game. Then, $$ randomly selects a tuple $$ from the ListH₅ and outputs the BDH solution $$ due to $$

The security analysis is similar to Theorem 5. We obtain that $$’s advantage to solve the BDH problem is $$

Theorem 7. If the BDH assumption holds, the proposed RIBEET scheme satisfies the OW-ID-CCA security in the security game. More precisely, suppose that $$ is a PPT type 3 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm $$ to solve the BDH problem with the advantage

Proof. An algorithm $$ is constructed to solve the BDH problem. The algorithm $$ is given a BDH tuple $$ which is defined in Section 2. The algorithm $$ can be seen as a challenger to find the answer of the BDH problem. The answer $$ can be found by interacting with the PPT type III adversary $$ in the following security game.

• (i)

  Setup: The challenger $$ utilizes the BDH tuple to set $$, and then generates the public system parameters $$, where H_i is a random oracle for i = 1, 2, ⋯, 8. In addition, the system life time SLT = {T₀, T₁, ⋯, T_t} can be generated by the challenger $$. Then $$ gives $$ the public system parameters PSP and system life time SLT. Here, the adversary $$ can issue queries to each random oracle as below

• (a)

  H₁query(ID): $$ answers $$ in the same form as the proof of Theorem 5

• (b)

  H₂query(ID): $$ can utilize ID to obtain a response to the random oracle H₂ from the challenger $$. To obtain the response, $$ maintains a list, called ListH₂ which is composed of tuples, and the format of the tuple is 〈ID, V_ID, v, rb〉. The response is acquired from the ListH₂ which is initially empty and can be updated by the following steps

• (i)

  $$ returns V_ID as the response if ID exists in a tuple 〈ID, V_ID, v, rb〉 from the ListH₂

• (ii)

  Otherwise, $$ picks a random value $$ and utilizes ID to find rb in the ListH₂. Then $$ computes $$ and adds the tuple 〈ID, V_ID, v, rb〉 to ListH₂. $$ returns V_ID to $$

• (c)

  H₃ − H₈ queries: $$ answers $$ in the same form as the proof of Theorem 5

• (ii)

  Phase 1: The adversary $$ can, respectively, utilize ID, (ID, T), (ID, T, CT) and (ID, T) to issue the InitialKey query, Timekey query, Decryption query and Trapdoor query. The response to each query can be obtained as follows

• (1)

  InitialKey query (ID): $$ answers $$ in the same form as the proof of Theorem 5

• (2)

  Timekey query (ID, T): $$ answers $$ in the same form as the proof of Theorem 5

• (3)

  Decryption query (ID, T, CT): $$ utilizes (ID, T, CT) to issue the query, while $$, respectively, finds the corresponding tuples 〈ID, U_ID, u, rb〉, 〈ID, V_ID, v, rb〉, 〈ID, T, U_IDT, η〉 and 〈ID, T, V_IDT, ζ〉 from the ListH₁, ListH₂, ListH₃ and the ListH₄ according to ID and T. The response of this query is acquired from these lists by performing the following tasks

• (i)

  If rb = 0, $$, respectively, uses ID and (ID, T) to run InitialKeyquery and Timekey query to obtain IK_ID and TK_ID. Then $$ utilizes IK_ID, TK_ID and CT to run Decryption algorithm to produce the message M which is sent to $$

• (ii)

  If rb = 1, $$ utilizes CT₁ and CT₂, which are from CT = (CT₁, CT₂, CT₃, CT₄), to find the corresponding tuple 〈W, CT₁, CT₂, ω〉 from the ListH₅. Then M^′||V^′ = CT₃ ⊕ ω can be computed by using CT₃ and ω. Further, $$ utilizes M^′ and V^′ to find the corresponding tuples 〈M, V, γ〉 from the ListH₇ and 〈M, Q〉 from the ListH₆. Obviously, γ and Q can be obtained. After that, $$ utilizes ID and (ID, T) to run InitialKey query and Timekey query to obtain IK_ID2 and TK_ID2 and computes $$. If S can be found in the corresponding tuple $$ from the ListH₈ such that CT₄ = Q^γ · S holds, $$ will confirm whether $$ holds. If $$, the message M^′ is sent to $$

• (d)

  Trapdoor query (ID, T): $$ utilizes (ID, T) to issue the query, while $$, respectively, uses ID and (ID, T) to run InitialKey query and Timekey query to obtain IK_ID = (IK_ID1, IK_ID2) and TK_ID = (TK_ID1, TK_ID2). Then $$ utilizes IK_ID2 and TK_ID2 to produce the trapdoor TD_ID = IK_ID2 · TK_ID2 which is sent to $$

• (e)

  Challenge: When the phase 1 is over, $$ outputs a tuple 〈ID^∗, T^∗, M^∗〉 as the target of the challenge. $$ utilizes ID^∗ to find the corresponding tuples 〈ID, U_ID, u, rb〉 from the ListH₁ If rb = 0, $$ interrupts this game. If rb = 1, $$ randomly selects V ∈ {0, 1}^l to run H₇ query with M^∗ and V. Then γ can be obtained. $$ utilizes γ to set $$ and find $$ and $$ to get Q and S such that $$. In addition, $$ sets $$, while a random value CT₃ ∈ {0, 1}^λ+l is chosen. Finally, the challenge ciphertext $$ is sent to $$

• (f)

  Phase 2: $$ can issue the same query as the phase 1, but it must be under the condition of ID ≠ ID^∗ and CT ≠ CT^∗

• (g)

  Guess: $$ responds to $$ with a guess M^′ ∈ {0, 1}^λ. If M^′ ≠ M, $$ responds with failure and terminates. Otherwise, $$ wins the game. Then $$ randomly selects a tuple $$ from the ListH₅, and outputs the BDH solution A = $$ due to $$

The security analysis is similar to Theorem 5. We obtain that $$’s advantage to solve the BDH problem is $$.

Theorem 8. If the BDH assumption holds, the proposed RIBEET scheme satisfies the OW-ID-CCA security in the security game. More precisely, suppose that $$ is a PPT type 4 adversary who has at least ε advantage to break the RIBEET scheme. Then, there exists an algorithm $$ to solve the BDH problem with the advantage.

Proof. An algorithm $$ is constructed to solve the BDH problem. The algorithm $$ is given a BDH tuple $$ which is defined in Section 2. The algorithm $$ can be seen as a challenger to find the answer of the BDH problem. The answer $$ can be found by interacting with the PPT type IV adversary $$ in the following security game.

• (i)

  Setup: The challenger $$ utilizes the BDH tuple to set $$, and then generates the public system parameters $$, where H_i is a random oracle for i = 1, 2, ⋯, 8. In addition, the system life time SLT = {T₀, T₁, ⋯, T_t} can be generated by the challenger $$. Then $$ gives $$ the public system parameters PSP and system life time SLT. Here, the adversary $$ can issue queries to each random oracle as below

• (a)

  H₁ − H₃ queries: $$ answers $$ in the same form as the proof of Theorem 6

• (b)

  H₄ − H₈ queries: $$ answers $$ in the same form as the proof of Theorem 5

• (ii)

  Phase 1: The adversary $$ can, respectively, utilize ID, (ID, T), (ID, T, CT) and (ID, T) to issue the InitialKey query, Timekey query, Decryption query and Trapdoor query. The response to each query can be obtained as follows

• (a)

  InitialKey query (ID): $$ answers $$ in the same form as the proof of Theorem 6

• (b)

  Timekey query (ID, T): $$ answers $$ in the same form as the proof of Theorem 6

• (c)

  Decryption query (ID, T, CT): $$ answers $$ in the same form as the proof of Theorem 7

• (d)

  Trapdoor query (ID, T): $$ answers $$ in the same form as the proof of Theorem 7

• (1)

  Challenge: When the phase 1 is over, $$ outputs a tuple 〈ID^∗, T^∗, M^∗〉 as the target of the challenge. $$ utilizes (ID^∗, T^∗) to find the corresponding tuples 〈ID, T, U_IDT, η, rb〉 from the ListH₃ If rb = 0, $$ interrupts this game. If rb = 1, $$ randomly selects V ∈ {0, 1}^l to run H₇ query with M^∗ and V. Then γ can be obtained. $$ utilizes γ to set $$ and find $$ and $$ to get Q and S such that $$. In addition, $$ sets $$, while a random value CT₃ ∈ {0, 1}^λ+l is chosen. Finally, the challenge ciphertext $$ is sent to $$

• (2)

  Phase 2: $$ can issue the same query as the phase 1, but it must be under the condition of ID ≠ ID^∗ and CT ≠ CT^∗

• (3)

  Guess: $$ responds to $$ with a guess M^′ ∈ {0, 1}^λ. If M^′ ≠ M, $$ responds with failure and terminates. Otherwise, $$ wins the game. Then $$ randomly selects a tuple $$ from the ListH₅, and outputs the BDH solution A = $$ due to $$

The security analysis is similar to Theorem 5. We obtain that $$’s advantage to solve the BDH problem is $$.

Theorem 9. The proposed RIBEET scheme is secure for brute force attacks if the discrete logarithm problem is hard.

Proof. As mentioned in the concrete RIBEET scheme, the public system parameters are PSP = {q, G₁, G₂, G_T, $$, g₁, g₂, P_pub, H₁, H₂, H₃, H₄, H₅, H₆, H₇, H₈}, the system life time is SLT = {T₀, T₁,⋯, T_t} and the master private key is mpk = s. Based on the discrete logarithm problem, we ensure that the adversary cannot recover the master private key mpk = s form P_pub = $$. In addition, the security of the user initial key IK_ID and user time key TK_ID is also based on the discrete logarithm problem due to IK_ID = (IK_ID1, IK_ID2) = (H₁(ID)^mpk, H₂(ID)^mpk) = (H₁(ID)^s, H₂(ID)^s) and TK_ID = (TK_ID1, TK_ID2) = (H₃(ID, T)^mpk, H₄(ID, T)^mpk) = (H₃(ID, T)^s, H₄(ID, T)^s). Hence, the proposed RIBEET scheme can resist brute force attacks.