 Research
 Open Access
 Published:
LacminCC: lightweight anonymous communication model in cloud computing
EURASIP Journal on Wireless Communications and Networking volume 2021, Article number: 120 (2021)
Abstract
With increasing application of cloud computing and big data technologies, a large amount of personal information is stored on the Internet, which raises the issue of privacy leakage. To protect people’s data privacy, this paper firstly presents a new anonymous IdentifyBased Encryption (IBE) scheme and gives the proof of its security under the Bilinear Diffie–Hellman Security Assumption. Then, by introducing the anonymous IBE scheme into anonymous communication fields, this paper introduces a new lightweight anonymous communication model for cloud computing, which guarantees the anonymity of system users and the security of messages in small groups. Our analysis shows that, the proposed communication model cannot only reduce memory consumption and improve message transmission efficiency, but also effectively resist trafficanalysis attacks, node eavesdropping, and finally achieve secure anonymous communication in cloud computing.
Introduction
With the widespread application of technologies such as big data [1], cloud computing [2], and the Internet of Things [3], a large amount of personal information has been stored on the Internet, which raises a higher level of requirements for privacy protection. As we have known, privacy protection not only protects the content of the messages, but also secures both parties’ identity, communication time, and communication paths. However, the existing encryption technologies [4] find it difficult to protect the communication participants’ private information such as identity, behaviour, and network address. Hackers use trafficanalysis attacks [5] to obtain identity information and communication relationships in the communication process, which leads to the privacy leakage of the users. Therefore, it is extremely important to construct an anonymous communication model and take certain measures to conceal the communication relationship in the communication streams, making it difficult for eavesdroppers to obtain contents and derive the relationship of the parties in the communication.
After the first paper on anonymous communication model was published in 1981 [6], many research efforts have been made in the field of anonymous communication. The existing research on anonymous communication can be divided into three categories. Firstly, Reed [7] proposed an onion routing. The message is encrypted and transmitted through a series of network nodes called onion routers, each of which “peels” away a single layer, uncovering the data’s next destination. When the final layer is decrypted, the message arrives at its destination, so each node cannot know the original and final message at the same time. The idea of onion routing has been extended to all directions. Hiller et al. used onion routing in the Internet of Things to protect the private sensitive information of data owners [8]. Raza uses onion routing to implement a distributed search engine [9]. On the basis of protecting data privacy, it provides more efficient search results with fewer search resources. In addition, onion routing is also used in the Internet of Vehicles to realize the anonymity of vehicles [10]. Onion routing achieves the anonymity of the sender [11], but it cannot resist traffic attacks [12, 13], exiting node vulnerability attacks [14], and other security problems [15]. Another idea is an anonymous communication model based on DCnet proposed by Chaum et al. [16]. The model defines an Nnumber group, and only one member is allowed to send messages in a given round. Messages are sent via broadcasting without the need for a trust centre [17]. However, since the encryption process requires the cooperation of all members, it is vulnerable to internal dishonest members, and it is easy to break the security of the model [18]. The last anonymous communication model based on a flooding algorithm, which uses flooding, epidemic and other algorithms for flooding [19, 20]. When the sender initiates an anonymous transmission, the path of the anonymous transmission is unclear [21]. Therefore, the adversary cannot distinguish where the next hop of the node will be [22]. This idea is widely applied to wireless sensors in the Internet of Things. But the main challenge for anonymous communication models based on the flooding algorithm is that the model will generate a large amount of network transmission traffic during the communication process [23] and has a great demand for network bandwidth. At the same time, the stability and reliability of system algorithms are not satisfactory.
Based on the above analysis, we find that the existing anonymous communication systems have demanding requirements for network bandwidth and memory and cannot guarantee stability and reliability. In this case, anonymous communication systems are used in small groups, which are not only inefficient and expensive, but also insecure. Therefore, the demand for lightweight anonymous communication systems for small groups is very immanent. For example, bidders need to hide their identities and whistleblowers need to protect their privacy. On the other hand, blockchain technology has made great progress in ensuring the integrity of data during transmission [24], extracting data [25], and detecting smart contract vulnerabilities [26]. Blockchain, as a distributed database, creates conditions for the development of anonymous communication in the Internet of Things, cloud computing and other technologies. For example: the lightweight anonymous communication system can be applied to information transmission between sensors and servers [27], as well as proprietary security protection in cloud services [28]. Nevertheless, there are few existing research studies on lightweight anonymous communication systems. For this purpose, the main contributions of this paper are as follows.

(1)
We propose the anonymous IBE (IdentifyBased Encryption) scheme to encrypt messages in the communication model, utilizing the advantages of the anonymous IBE scheme that has a high degree of ciphertext expansion and does not require certificate management. The anonymous IBE scheme can meet the conditions of anonymous communication on the basis of ensuring the security of the messages. In this paper, we also verify the correctness of the proposed scheme and prove its security under the Bilinear Diffie–Hellman Security Assumption.

(2)
We manage users using a grouping strategy, and users are automatically grouped after registration and updated within a certain period of time. Combined with the anonymous IBE scheme, grouping realizes that on the basis of ensuring security, it reduces the communication overhead of users and saves bandwidth in the communication process.

(3)
We design a lightweight anonymous communication model based on the proposed IBE scheme and grouping strategy, simultaneously implementing anonymity, efficiency and security. Analysis shows that the model can resist traffic analysis attacks on the basis of ensuring security and anonymity of the user communications, the model is also able to reduce memory and resource consumption.
The roadmap of this paper is as follows. Section 2 introduces the preliminary work of this project, such as bilinear groups, complexity assumptions, IBE and security model, etc. Section 3 describes our anonymous IBE scheme and proves its correctness and security. In Sect. 4, a lightweight anonymous communication model in cloud computing is proposed. We elaborate on the communication process of the entire model and how to achieve anonymous communication. Before summarising this paper in Sects. 6 and 5 analyses the performance of the proposed model in this paper.
Preliminary
Bilinear map
Let \(G_1\) and \(G_2\) be multiplicative cyclic groups of prime order p and g be a generator of \(G_1\). The bilinear map \(e: G_1 \times G_1 \rightarrow G_2\) has the following properties [29]:

(1)
Bilinearity: \(\forall P, Q \in G_1\) and \(\forall a, b \in Z_p\), we have \(e(P^a, Q^b) = e(P, Q)^{ab}\).

(2)
Nondegeneracy: \(\forall g \in G_1\), such that e(g, g) has order p, that is, e(g, g) is a generator of \(G_2\).

(3)
Computability: \(\forall P, Q \in G_1\), there is an algorithm that can compute e(P, Q) efficiently.
Bilinear Diffie–Hellman assumption
The BDH Bilinear Diffie–Hellman problem [30, 31] in \(G_1\) is as follows: Given a tuple \(g, g^\alpha , g^b, g^c \in G_1\) as input, output \(e(g, g)^{\alpha bc} \in G_2\). An algorithm \({\mathcal {A}}\) has advantage \(\varepsilon\) in solving BDH in \(G_1\) if
where the probability is over the random choice of \(\alpha , b, c\) in \(Z_p^*\) and the random bits used by \({\mathcal {A}}\). Similarly, an algorithm \({\mathcal {B}}\) that outputs \(b \in \left\{ 0, 1\right\}\) has advantage \(\varepsilon\) in solving the decision BDH problem in \(G_1\) if
where the probability is over the random choice of \(\alpha , b, c\) in \(Z_p^*\), the random choice of \(T \in G_2^*\), and the random bits of \({\mathcal {B}}\).
Definition 1
The (Decision) \((t, \varepsilon )\)BDH assumption holds in \(G_1\) if no ttime algorithm has advantage \(\varepsilon\) at least in solving the (Decision) BDH problem in \(G_1\).
Occasionally, we drop t and \(\varepsilon\) and refer to the BDH and Decision BDH assumptions in \(G_1\).
IBE scheme
In the IBE scheme, participants include users and private key generators (PKG). PKG is a trusted third party, which generates a private key based on the system master key and user identity. Subsequently, PKG distributes the private key to the corresponding users. Furthermore, the identity of the user makes IBE different from the public key of the traditional public key cryptosystem. Therefore, IBE is widely used for information security protection. An IdentityBased Encryption (IBE) scheme is a tuple of PPT (Probabilistic Polynomialtime) algorithms defined with respect to a message space \({\mathcal {M}}\), an identity space \({\mathcal {I}}\), and a ciphertext space \({\mathcal {C}}\) as follows:
Setup On input (in unary) a security parameter k, generate public parameters params and a master secret key MSK. And \({\mathcal {M}}, {\mathcal {C}}, params\) is public. MSK is kept by PKG.
Key generation On input a master secret key MSK and an identity \(ID \in {\mathcal {I}}\), derive and output a secret key \(d_{ID}\) for identity ID.
Encryption On input public parameters params, an identity \(ID \in {\mathcal {I}}\), and a message \(m \in {\mathcal {M}}\), output a ciphertext \(C \in {\mathcal {C}}\) that encrypts m under identity ID.
Decryption On input a secret key \(d_{ID}\) for identity \(ID \in {\mathcal {I}}\) and a ciphertext \(C \in {\mathcal {C}}\), output \(m'\) if C is a valid encryption under identity ID, output a failure symbol \(\perp\) otherwise.
Security model
Boneh and Franklin define chosen ciphertext security for IBE systems under a chosen identity attack [32, 33]. In their model, the adversary is allowed to adaptively choose the public key it wishes to attack (the public key on which it will be challenged). Informally, if the adversary cannot obtain the public key ID in the ciphertext and has the characteristics of indistinguishability under the chosen ciphertext attack, we believe that the scheme has ANONINDIDCCA (Anonymity and indistinguishability of identities under chosen ciphertext attack) security. More precisely, the security of anonymous IBE scheme is defined using the following game [34].
We define \({\mathcal {A}}\) as an adversary and \({\mathcal {B}}\) as a challenger.
Setup \({\mathcal {B}}\) runs setup, and forwards parameters to \({\mathcal {A}}\).
Phase 1 Proceeding adaptively, \({\mathcal {A}}\) issues queries \(q_1, \ldots , q_m\) where \(q_i\) is one of the following:
Key generation query \(\left\langle {ID_i} \right\rangle\): \({\mathcal {B}}\) runs \(Key\ generation\) on \(ID_i\) and forwards the resulting private key to \({\mathcal {A}}\).
Decryption query \(\left\langle {ID_i, C_i} \right\rangle\): \({\mathcal {B}}\) runs \(Key\ generation\) on \(ID_i\), decrypts \(C_i\) with the resulting private key, and sends the result to \({\mathcal {A}}\).
Challenge \({\mathcal {A}}\) submits two plaintexts \(m_0, m_1\) and two identities \(ID_0,ID_1\). \(ID_0,ID_1\) or their prefix cannot appear in any key generation query in Phase 1. \({\mathcal {B}}\) selects a random bit \(k,l \in \left\{ 0, 1\right\}\), sets \(C^*= Encrypt(params, ID_k, m_l)\), and sends \(C^*\) to \({\mathcal {A}}\) as its challenge ciphertext.
Phase 2 This is identical to Phase 1, except that \({\mathcal {A}}\) may not request the private key for \(ID_0, ID_1\) or the decryption of \(\left\langle {ID_0, C^*} \right\rangle ,\left\langle {ID_1, C^*} \right\rangle\).
Guess \({\mathcal {A}}\) submits a guess \(k', l' \in \left\{ 0, 1\right\}\). \({\mathcal {A}}\) wins if \(k' = k, l' =l\). We call an adversary \({\mathcal {A}}\) in the above game as an ANONINDIDCCA adversary. The advantage \(\varepsilon\) of an adversary A in this game is defined as \(\left {\Pr \left[ {k' = k \wedge l' = l} \right]  \frac{1}{4}} \right\).
Definition 2
An anonymous IBE system is \((t, q, \varepsilon )\)ANONINDIDCCA secure if all ttime ANONINDIDCCA adversaries making at most q queries have advantage at most \(\varepsilon\) in winning the above game.
Methods
Anonymous IBE scheme
Anonymous IBE scheme has a high degree of ciphertext expansion and does not require certificate management. In lightweight anonymous communication model based on the bulletin board, the improved anonymous IBE scheme can effectively guarantee that it will not disclose any identity information about the recipient in the ciphertexts and has ANONINDIDCCA security. In this section, we construct an efficient anonymous IBE scheme, compared with scheme [35], our scheme ciphertext is shorter, reduces the use of random numbers and has better communication overhead under the same security. At the end of the section, we prove its correctness and security.
Construction
Let \(G_1\) and \(G_2\) be multiplicative cyclic groups of prime order p and g be a generator of \(G_1\), \(e: G_1 \times G_1 \rightarrow G_2\) is the bilinear map.
Setup In order to generate security parameters, we randomly select \(\alpha \in Z_p^*\) and set \(g_1=g^{\alpha }, g_2 \in G_1\). The public parameters params and the secret master key MSK are given by
Key generation To generate private key \(d_{ID}\), we randomly select \(r \in Z_p^*\), input master secret key MSK and an identity \(ID \in Z_p^*\) and output
Encryption To encrypt a message \(m \in G_2\) under public key ID, pick a random \(t \in Z_p^*\) and we output
Decryption To decrypt a ciphertext \(C = \left( {{C_1},{C_2},{C_3}} \right)\) using private key \(d_{ID} = \left( {{d_1},{d_2}} \right)\), output
Proof of correctness
If C is a valid ciphertext encrypted with identity ID to message m, then the following expression can be verified:
So, there is \(m = {C_1} \cdot \frac{1}{{e\left( {{C_2},{d_1}} \right) e\left( {{d_2},{C_3}} \right) }}\).
Proof of security
Theorem 1
Assume that the DBDH (Decision Bilinear Diffie–Hellman) problem is hard, the proposed anonymous IBE scheme is \((t, q, \varepsilon )\)ANONINDIDCCA secure.
Proof
Assume \({\mathcal {A}}\) is an ANONINDIDCCA adversary, \({\mathcal {B}}\) is a challenger. At the beginning of the game, \({\mathcal {B}}\) is given a tuple \(\left( {g,{g^\alpha },{g^b},{g^c},T} \right) \in {G_1^5}\) to decide whether or not \(\text {T} = e{\left( {g,g} \right) ^{\alpha bc}}\).
Setup: \({\mathcal {B}}\) randomly generates security parameters. Let \({g_1} = {g^\alpha }, {g_2} = {g^b}\), the public parameters are \((g,{g_1},{g_2})\) which are assigned to \({\mathcal {A}}\).
\(Phase\ 1\):
Key generation query: \({\mathcal {A}}\) assigns identity \(ID \in Z_p^*\) to \({\mathcal {B}}\). \({\mathcal {B}}\) randomly chooses \(r \in Z_p^*\) and computes
Let \(r' = r  \frac{b}{{ID}}\), which is a valid private key, where
Decryption query: \({\mathcal {A}}\) assigns \(\left\langle {ID, C} \right\rangle\) to \({\mathcal {B}}\).
\({\mathcal {B}}\) first executes the key generation query to identity ID, then decrypts C with the private key of identity ID.
Challenge:
\({\mathcal {A}}\) chooses two messages \(m_0, m_1\) of the same length and two identities \(ID_0, ID_1\) to \({\mathcal {B}}\), where \(ID_0, ID_1\) or their prefix have not appeared in any key generation query in Phase 1.
\({\mathcal {B}}\) randomly selects \(k', l' \in \left\{ 0, 1\right\} , c \in Z_p^*\), and construct \(m_l\) as follows:
\(C = \left( {{C_1},{C_2},{C_3}} \right) =\left( {T{M_l},{g^c},g_1^{I{D_k} \cdot c}} \right)\). If \(\text {T} = e{\left( {g,g} \right) ^{\alpha bc}}\), we can obtain:
Therefore, C is a valid ciphertext.
\(Phase\ 2\): \({\mathcal {A}}\) executes key generation queries and decryption queries to \({\mathcal {B}}\) as in phase 1, except that the adversary may not request a private key for \(ID_0, ID_1\) or message \(m_0, m_1\).
Guess: \({\mathcal {A}}\) submits two guesses \(k', l' \in \left\{ 0, 1\right\}\). If \(k'=k, l'=l\), then \({\mathcal {B}}\) outputs 1 which means \(\text {T} = e{\left( {g,g} \right) ^{\alpha bc}}\), otherwise it outputs 0 which means \(\text {T} \ne e{\left( {g,g} \right) ^{\alpha bc}}\).
When \(\text {T} = e{\left( {g,g} \right) ^{\alpha bc}}\), then \({\mathcal {A}}\) must satisfy \(\left {\Pr \left( {k' = k \wedge l' = l} \right)  \frac{1}{4}} \right \ge \varepsilon\). When T is uniform, then \(\Pr \left( {k' = k \wedge l' = l} \right) = \frac{1}{4}\). Therefore, when \(\alpha , b, c, T\) are uniform, we have
This completes the proof of Theorem 1. \(\square\)
Lightweight anonymous communication model in cloud computing
In this section, we construct a lightweight anonymous communication model based on anonymous IBE scheme, which is introduced in Sect. 3.1. According to the IBE scheme, the sender uses the identity of the receiver to encrypt the message. After encryption, the user uploads the message to the bulletin board, and the user downloads the ciphertext on the bulletin board in groups. Only the real receiver can decrypt and obtain the message.
Before formally introducing the anonymous communication model, we first give the definition of the symbols used in the model. \(G_1\) and \(G_2\) are multiplicative cyclic groups of prime order p and g is a generator of \(G_1\). The map e is a bilinear map which satisfies \(e: G_1 \times G_1 \rightarrow G_2\). \(\alpha \in Z_p^*\) is the master key of PKG, \(g_2 \in G_1\) is randomly selected, and \(g_1=g^{\alpha }\) (Table 1).
Model initialization

(A)
Entities

(1)
The users. Users are very important to the system, and their privacy must be guaranteed. In order to meet the different needs of users, we have designed two encryption methods, which can meet two types of users:

(a)
Users who need to send information anonymously and are unwilling to disclose their identity to the recipient. For example, in tipoffs, the whistleblower does not want anyone to know his identity.

(b)
Users who need to disclose their identity to the recipient but do not want to inform other users of their identity. For example, in the bidding, the successful bidder needs to inform the bidding company of its identity so that it can continue to communicate after the bid, but it is not allowed to be known by other users in the system to prevent malicious competition.

(2)
Bulletin board. The bulletin board is provided for users to upload and download ciphertexts. More precisely, the sender uploads the ciphertext to the bulletin board, and the receiver downloads the ciphertexts from the bulletin board. The bulletin board is an intermediate source for communication, and there is no direct interaction between the users. Because there is no interaction between the users, the adversary cannot directly know the identities of the two communicating parties.

(3)
Private key generator (PKG). In this model, PKG generates the system’s master secret key, generates the user’s private key based on the user’s identity, and is also responsible for grouping users. In addition, PKG is credible in this model.

(B)
Grouping of users

(1)
Initialization. When a user enters the system, the system automatically distributes a unique and fixed identity \(ID (ID \in Z_p^*)\) to the user.

(2)
Grouping. PKG is responsible for grouping all the users and dividing the users into M groups, where each group is of N members. To prevent traffic analysis attacks, the number of N should be large enough. An ID corresponds to a unique group number i and a serial number j in the group (i, j are randomly selected, and \(0< i \le \mathrm{{M}},0 < j \le \mathrm{{N}}\)). We notate the user as \(ID_{ij}\), and every trusted user knows the identities and group numbers of other users in the system. Users need to obtain their own private keys before starting communication. PKG generates the system’s secret master key and the private key corresponding to each user. More specifically, PKG generates a random number \(r \in Z_p^*\), a public parameter of the system \(params = \left( {g,{g_1},{g_2}} \right)\). The private key \({d_{ij}}\) corresponding to the user \(ID_{ij}\) is as follows:
$$\begin{aligned} {d_{ij}} = \left( {{d_1},{d_2}} \right) = \left( {g_2^\alpha g_1^{I{D_{ij}} \cdot r},g_{}^{{{  }}r}} \right) \end{aligned}$$(13)After the private key is generated, PKG distributes the private key to the corresponding users.

(3)
Update users’ group. In consideration of the security of the model, when the number of the rounds of message delivery reaches a certain value, the private key’s update and the group’s update of the model are triggered. The process is as follows:
When the entire system transmits 1000 rounds of messages, PKG regenerates private keys for all the users to strengthen the security of the system and prevent it from being cracked by the adversary. When the entire system delivers 100 rounds of messages, PKG regroups all the users to strengthen the security of the system and prevent it from being cracked by the adversary.
Anonymous communication model
In this section, we introduce how the anonymous communication model implements the communication process. At this stage, users divide time slices to encrypt messages, upload ciphertext, download ciphertext, and decrypt ciphertext. During time \(T_1\), the sender encrypts the message to be sent. During time \(T_2\), all the users upload the ciphertext to the bulletin board. During time \(T_3\), users download the ciphertext and decrypt the downloaded ciphertext during time \(T_4\). The following includes the entire process.

(1)
During time \(T_1\), the sender encrypts message m using the recipient’s identity \(ID_{ij}\) as the public key.
All the users, who want to transfer information in the system, will encrypt messages m according to the identity of receiver \(ID_{ij}\) at \(T_1\) time. At the same time, the sender also knows the group number of the receiver. In order to save memory costs, we design \(C_1\) as the group number i where the receiver is located. This is conducive to uploading the ciphertext to the bulletin board, and the receiver can quickly filter out the ciphertext that needs to be downloaded.
If the sender wants the receiver to know his/her identity, he/she can encrypt the message m as follows:
Where \(t \in Z_p^*\) is randomly selected by the sender, \(ID_{ij}\) is the identity of the recipient, \({Sig{n_{sen{d_{I{D_{ij}}}}}}}\) is the signature of the sender’s identity and \(C_1 = i\), i is the group number of the receiver.
If the sender’s identity needs to be kept secret from the receiver, we use the following encryption:

(2)
During time \(T_2\), all the users in the system must send ciphertext C to the bulletin board.
All users, whether they wish to communicate or not, must send the ciphertexts to the bulletin board, and the upload process is completed in time \(T_2\). For users who want to send information, upload the ciphertexts within time \(T_2\). For security reasons, other users who need not communicate also complete the upload of a pseudociphertext within time \(T_2\).

(3)
During time \(T_3\), the users download the ciphertext C accordingly from the bulletin board.
After the ciphertexts have been uploaded to the bulletin board, all the users evaluate whether or not the \(C_1\) part of the ciphertexts is equal to their group number i, to determine whether to download the ciphertext. If \(C_i=i\), then the recipient must download this ciphertext to avoid missing the messages. The above process is completed during time \(T_3\).

(4)
During time \(T_4\), the user decrypts the downloaded ciphertext C with his/her private key \(d_{ij}\).
All the users use their private keys to decrypt the downloaded ciphertexts one by one. If the decryption is successful, then the real receiver can receive the message sent by the sender. The decryption process is as follows:
Figure 1 shows the process for the users and bulletin boards to transfer specific ciphertexts. During time \(T_2\), all the users upload messages to the bulletin board. The red line indicates this process. During time \(T_3\), the \(C_1\) part of the ciphertexts is equal to a group number in the model. As shown in Fig. 1, we assume \(C_1\) = 2, then all the users in the second group must download the ciphertexts to the local host, other groups will not download this ciphertext. This downloading process is indicated by the green line, and the black line indicates the available communication path in the model.
Experiments and results
In this section, we evaluate the performance of our model, which has been implemented in Python. All experiments are conducted on a PC with a CPU 2.30 GHz, 8 GB of RAM. We compare the anonymous performance of our lightweight anonymous communication model with several existing anonymous models [8, 19, 36] in Table 2. It can be seen from Table 2 that only our model achieves all the anonymities, whereas the other models cannot.
We evaluate the performance of our lightweight anonymous communication model, including the storage and communication costs. Table 3 shows that DCARPS has the smallest storage cost. However, it has the worst anonymity and security performance.
We assume that the communication cost of the whole network for message exchange is N. In addition, establishing pairwise keys for any two users has extra communication cost P, \(\gamma\) is the communication cost of ACK messages (\(\gamma\) is the communication cost to confirm the start of the message delivery).
Our communication model uses the user’s ID as the public key, so there is no need for paired secret key exchange. Similarly, according to our message delivery process, the sender does not need to send a confirmation message to the recipient before sending a message. So the communication cost of lightweight anonymous communication model is N (Table 4).
Through the above three tables, we find that our model achieves all three anonymities with low storage and computation costs.
Our model has no limit for the number of messages in a round, it is a significant advantage compared with other anonymous communication models which can send only one message in a round. For example, a user wants to communicate with more than one person, or more than one user wants to send message. In other anonymous communication models which limit the number of messages, users have to wait for several rounds. But, in our model, all users can send an arbitrary number of messages in a round. This property enhances the efficiency of communication and reduces the cost of communication. Figure 2 shows the communication consumption of our model and other anonymous communication model which limits the number of messages.
Discussion
Security analysis

(1)
Security of messages. The content of the message delivered by the user needs to be protected, which is the basic requirement of the security model. In our model, the information uploaded by users to the bulletin board is encrypted using an anonymous encryption scheme. We have verified its security in Sect. 3.1.3, this scheme cannot disclose any content about the user’s identity in the ciphertexts, and at the same time, it can also resist any CCA adversary.

(2)
Anonymity of messages.

(a)
Sender anonymity. In traditional public key cryptography, there is usually a public key infrastructure (PKI), and the sender needs to query the receiver’s public key before initiating the communication. In this process, the user performing the query operation may be the sender who wishes to initiate communication, and the public key to be queried may belong to the receiver.
In our model, the sender no longer needs to query the receiver’s public key, because the public key is the identity of the receiver that every user knows. We consider that all the users perform upload operations in time \(T_2\). The adversary cannot determine which users are the real senders through the traffic analysis attack, which can ensure the sender’s anonymity.

(b)
Recipient anonymity. The recipient anonymity is to ensure that others cannot evaluate whether or not the message has been received by a certain receiver. In addition, the model also needs to guarantee that during the encryption process, the adversary cannot extract the identity of the receiver.
In our model, the receiver’s identity is used as the public key, and the anonymous IBE scheme ensures that the adversary cannot extract the receiver’s identity from the ciphertexts. During time \(T_3\), all the members of the real receiver’s group download the ciphertexts. On the other hand, there are relatively many members in the group, and the adversary does not know which member of the group is the real receiver, thus ensuring the receiver’s anonymity.
Efficiency analysis
Our scheme has no limit on the number of ciphertexts that need to be sent in each round. Compared with the communication model that can only send one message in each round [16], the more messages we send in each round, the more efficient our model is. Similarly, compared to the anonymous communication model designed by Jiang et al. [27], our model manages users in groups. Before users download the ciphertexts, they need to be screened, which greatly reduces the number of ciphertexts that users download and need to decrypt. When delivering the same amount of messages, our solution saves time and memory on the basis of security.
Conclusion
In the past, the anonymous communication model had large requirements on network bandwidth and memory and could not guarantee stability and reliability. It is inefficient, costly, and insecure when an anonymous communication model is used in small groups. In this paper, we design a lightweight anonymous communication model in cloud computing, which is suitable for small and mediumsized groups. In the proposed model, we design an anonymous IBE scheme, modify the ciphertext structure, and simplify the encryption process while ensuring security. Furthermore, all the users are organised in groups and all the ciphertexts are filtered before the downloading practice. The operations reduce the workload of users to download the ciphertexts and the number of the decrypted ciphertexts. Analysis results show that the communication model has better performance while ensuring security and anonymity. The proposed anonymous communication model has good application prospects in cloud computing. For the future work, we will continue to optimize the proposed anonymous communication model and further apply it into cloud computing to solve the problem of privacy leakage.
Availability of data and materials
Data sharing is not applicable to this article as no datasets are generated or analyzed during the current study.
Abbreviations
 IBE:

Identifybased encryption
 DCARPS:

Destination controlled anonymous routing protocol for sensornets
 BDH problem:

Bilinear Diffie–Hellman problem
 DBDH problem:

Decision Bilinear Diffie–Hellman problem
 PKG:

Private key generators
 PPT algorithm:

Probabilistic polynomialtime algorithm
 MSK:

Master secret key
 ANONINDIDCCA:

Anonymity and indistinguishability of identities under chosen ciphertext attack
References
H. Liu, H. Kou, C. Yan, L. Qi, Keywordsdriven and popularityaware paper recommendation based on undirected paper citation graph. Complexity 2020, 2085638–1208563815 (2020)
S. Jegadeesan, M. Azees, P.M. Kumar, G. Manogaran, N. Chilamkurti, R. Varatharajan, C.H. Hsu, An efficient anonymous mutual authentication technique for providing secure communication in mobile cloud computing for smart city applications. Sustain. Cities Soc. 49, 101522 (2019)
H. Wang, S. Ma, H.N. Dai, M. Imran, T. Wang, Blockchainbased data privacy management with nudge theory in open banking. Future Gener. Comput. Syst. 110, 812–823 (2020)
M. Alloghani, M.M. Alani, D. AlJumeily, T. Baker, J. Mustafina, A. Hussain, A.J. Aljaaf, A systematic review on the status and progress of homomorphic encryption technologies. J. Inf. Secur. Appl. 48, 102362 (2019)
A. Bahramali, R. Soltani, A. Houmansadr, D. Goeckel, D. Towsley, Practical traffic analysis attacks on secure messaging applications (2020). arXiv preprint arXiv:2005.00508
D.L. Chaum, Untraceable electronic mail, return addresses, and digital pseudonyms. Commun. ACM 24(2), 84–90 (1981)
M.G. Reed, P.F. Syverson, D.M. Goldschlag, Anonymous connections and onion routing. IEEE J. Select. Areas Commun. 16(4), 482–494 (1998)
J. Hiller, J. Pennekamp, M. Dahlmanns, M. Henze, A. Panchenko, K. Wehrle, Tailoring onion routing to the internet of things: Security and privacy in untrusted environments. in 2019 IEEE 27th International Conference on Network Protocols (ICNP), pp. 1–12 (2019). IEEE
A. Raza, K. Han, S.O. Hwang, A framework for privacy preserving, distributed search engine using topology of DLT and onion routing. IEEE Access 8, 43001–43012 (2020)
M.S. Haghighi, Z. Aziminejad, Highly anonymous mobilitytolerant locationbased onion routing for VANETs. IEEE Internet Things J. 7(4), 2582–2590 (2019)
M. Ando, A. Lysyanskaya, E. Upfal, Practical and provably secure onion routing (2017). arXiv preprint arXiv:1706.05367
J. Pennekamp, J. Hiller, S. Reuter, W. la De Cadena, A. Mitseva, M. Henze, T. Engel, K. Wehrle, A. Panchenko, Multipathing traffic to reduce entry node exposure in onion routing. in 2019 IEEE 27th International Conference on Network Protocols (ICNP), pp. 1–2 (2019). IEEE
F. Rochet, O. Pereira, Dropping on the edge: flexibility and traffic confirmation in onion routing protocols. Proc. Privacy Enhancing Technol. 2018(2), 27–46 (2018)
E. Cambiaso, I. Vaccari, L. Patti, M. Aiello, Darknet security: a categorization of attacks to the tor network. in ITASEC (2019)
A. Iacovazzi, D. Frassinelli, Y. Elovici, The {DUSTER} attack: Tor onion service attribution based on flow watermarking with track hiding. in 22nd International Symposium on Research in Attacks, Intrusions and Defenses ({RAID} 2019), pp. 213–225 (2019)
C. David, The dining cryptographers problem: unconditional sender and recipient untraceability. J. Cryptol. 1(1), 65–75 (1988)
P. Kotzanikolaou, G. Chatzisofroniou, M. Burmester, Broadcast anonymous routing (BAR): scalable realtime anonymous communication. Int. J. Inf. Secur. 16(3), 313–326 (2017)
L. Barman, I. Dacosta, M. Zamani, E. Zhai, B. Ford, J.P. Hubaux, J. Feigenbaum, Prifi: A lowlatency localarea anonymous communication network (2017). arXiv: 1710.10237
S. Fatemeh, S. Milivoj, A.M. Rizwan, B. Michael, D. Claudia, A survey on routing in anonymous communication protocols. ACM Comput. Surv. (CSUR) 51(3), 1–39 (2018)
Z. Liu, Y. Liu, P. Winter, P. Mittal, Y.C. Hu, Torpolice: Towards enforcing servicedefined access policies for anonymous communication in the tor network. in 2017 IEEE 25th International Conference on Network Protocols (ICNP), pp. 1–10 (2017). IEEE
S. Chimkode, R. Sherikar, Privacy enhancing routing algorithm using backbone flooding schemes. Int. Res. J. Eng. Technol. (IRJET) 05(08), 1563–1566 (2018)
P. Xie, T. Fu, J. Guo, Q. Wang, LBS privacy preserving model and security analysis based on expanded anonymous server. J. Comput. 28(5), 155–161 (2017)
A. Gupta, M. Hussain, Distributed cooperative algorithm to mitigate hello flood attack in cognitive radio ad hoc networks (CRAHNS). in Proceedings of the First International Conference on Computational Intelligence and Informatics, pp. 255–263 (2017)
X. Xu, X. Zhang, H. Gao, Y. Xue, L. Qi, W. Dou, Become: blockchainenabled computation offloading for IOT in mobile edge computing. IEEE Trans. Ind. Inf. 16(6), 4187–4195 (2020)
P. Zheng, Z. Zheng, H. Dai, XblockETH: Extracting and exploring blockchain data from Ethereum. IEEE Open J. Comput. Soc. 1, 95–106 (2020)
W. Wang, J. Song, G. Xu, Y. Li, H. Wang, C. Su, Contractward: Automated vulnerability detection models for Ethereum smart contracts. IEEE Trans. Netw. Sci. Eng. (2020)
L. Jiang, T. Li, X. Li, M. Atiquzzaman, H. Ahmad, X. Wang, Anonymous communication via anonymous identitybased encryption and its application in IOT. Wirel. Commun. Mobile Comput. 2018, 1–8 (2018). https://doi.org/10.1155/2018/6809796
D. Antonela, D. Roger, E. Arthur, F. M, Addressing denial of service attacks on free and open communication on the internet. The Tor Project, Tech. Rep. (2018)
Y. Watanabe, K. Emura, J.H. Seo, New revocable ibe in primeorder groups: adaptively secure, decryption key exposure resistant, and with short public parameters. in Cryptographers Track at the RSA Conference, pp. 432–449 (2017)
B. Dan, F. Matt, Identitybased encryption from the weil pairing. in Annual International Cryptology Conference, pp. 213–229 (2001)
J. Antoine, A one round protocol for tripartite Diffie–Hellman. in International Algorithmic Number Theory Symposium, pp. 385–393 (2000). Springer
D. Boneh, C. Gentry, B. Waters, Collusion resistant broadcast encryption with short ciphertexts and private keys. in Annual International Cryptology Conference, vol. 3621, pp. 258–275 (2005). Springer
B. Dan, B. Xavier, G. EuJin, Hierarchical identity based encryption with constant size ciphertext. in Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 440–456 (2005). Springer
S. Katsumata, S. Yamada, Partitioning via nonlinear polynomial functions: more compact ibes from ideal lattices and bilinear maps. in International Conference on the Theory and Application of Cryptology and Information Security, pp. 682–712 (2016). Springer
B. Wang, X. Hong, An anonymous signature scheme in the standard model. J. Inf. Sci. Eng. 30(6), 2003–2017 (2014)
K. Mashal, K. Mungase, Secure anonymity communication protocol for wireless sensor network. Int. J. Sci. Res. 54(17), 580–585 (2016)
Acknowledgements
The authors thank the person who provided meticulous and valuable suggestions for improving the paper.
Funding
This study was funded by EU Horizon 2020 DOMINOES Project (Grant Number: 771066).
Author information
Authors and Affiliations
Contributions
FL, YW, and HJ developed the analytical derivations. FL designed and run the simulations. FL, XY, and ZW wrote the manuscript. FL, YW, and HJ proofread the manuscript. All authors read and approved the final manuscript.
Corresponding author
Ethics declarations
Competing interests
The authors declare that they have no competing interests.
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Li, F., Wang, Y., Ju, H. et al. LacminCC: lightweight anonymous communication model in cloud computing. J Wireless Com Network 2021, 120 (2021). https://doi.org/10.1186/s1363802101953z
Received:
Accepted:
Published:
DOI: https://doi.org/10.1186/s1363802101953z
Keywords
 Identifybased encryption
 Anonymous communication model
 Privacy protection
 Bilinear Diffie–Hellman Assumption
 Bilinear map