Sana Belguith
email: belguith.sana@gmail.com

Nesrine Kaaniche
email: nesrine.kaaniche@telecom-sudparis.eu

Mohamed Mohamed
email: mmohamed@us.ibm.com

Giovanni Russello
email: g.russello@auckland.ac.nz

Coop-DAAB: cooperative attribute based data aggregation for internet of things applications

Keywords: IoT data aggregation, IoT applications, Resource-constrained devices, Constant size attribute based signcryption

come

Introduction

The Internet of Things (IoT) applications are deployed in several fields such as health care, smart cities, smart monitoring [START_REF] Atwady | A survey on authentication techniques for the internet of things[END_REF][START_REF] Coates | Internet of things for buildings monitoring: Experiences and challenges[END_REF]. IoT systems connect loosely defined objects, gateways and services that may exchange data about peoples' body state, life events, habits, location or professional information. In most of the cases, this data is sensitive and should be processed and managed with high security measures. Security management in IoT is a big challenge as sensitive data are shared by a huge number of distributed services and devices. To face the exponential growth of data being generated by IoT devices and to efficiently ensure their collection, aggregation and sharing, fog and cloud computing are usually used to assist IoT devices since these latters are resource constrained. Although the usage of these environments has clear benefits, it brought new security and privacy threats as the data might be outsourced to untrusted environments. To countermeasure these threats, the data is usually obfuscated before being outsourced. In addition, the collected data from different IoT devices is generally aggregated to considerably save the energy resources and extend the lifetime of the IoT devices. However, the aggregation affects the security properties that might be provided by the protection schemes. For instance, the data needs to be authenticated at the aggregation phase to ensure that it is outsourced from benign devices while preserving their privacy.

Several works have been proposed to ensure data authentication based on signature schemes. However, these techniques are usually combined with encryption to provide data contents' secrecy. This combination incurs heavy computation and communication overhead due to the cumulative costs of encryption and signature. Signcryption [START_REF] Zheng | Digital signcryption or how to achieve cost (signature & encryption) ¡ cost (signature)+ cost (encryption)[END_REF] has been proposed by Zheng et al. as a cryptographic mechanism combining signature and encryption in only one phase. Signcryption allows an entity to encrypt and sign the ciphertext while incurring reduced computation costs compared to executing the encryption and the signature algorithms separately.

Attribute based signcryption (ABSC) is a signcryption primitive that ensures fine grained access control, data origin authenticity and data confidentiality thanks to the combination of attribute based encryption and signature in one logic step. Similar to other attribute based techniques, ABSC introduces one main drawback related to high computation and storage costs which depends on the size of used access policies. To mitigate this limitation, thus, attribute based signcryption schemes with constant computation costs and ciphertext sizes have been proposed [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF].

Contributions -This paper extends our previous work [START_REF] Belguith | C-absc: Cooperative attribute based signcryption scheme for internet of things applications[END_REF] and it introduces Coop-DAAB, a cooperative privacy preserving attribute based signcryption mechanism based on the constant-size attribute based signcryption (ABSC) technique [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF]. As such, our Coop-DAAB construction consists on performing the combined signing and encrypting processes of a set of data devices' inputs in a secure collaborative manner. The main idea behind Coop-DAAB relies on the distribution of the signcrypting operation among different devices, with respect to selected sub-sets of a general access predicate. That is, each device signcrypts its input data and sends the partial signcrypted information to an untrusted aggregator. This latter is capable of decrypting the received data only if a sufficient number of IoT devices cooperates.

Paper organizationsection 2 introduces potential applications while identifying major security requirements. Section 3 introduces the network model and details Coop-DAAB concrete construction. The security analysis of Coop-DAAB is discussed in section 4. Finally, performances analysis is detailed in section 5 and related work is discussed in Section 6 before concluding in section 7.

Motivating Applications and Requirements

The deployment of IoT devices is gaining an expanding interest in our daily life. Indeed, IoT networks consist in interconnecting several smart and resource constrained devices to enable advanced services. Security management in IoT is a big challenge as personal data are shared by a huge number of distributed services and devices. As reducing the amount of transmitted data can effectively save energy, aggregation services are generally applied to derive succinct contents. This technique can be an alternative that aims at providing security enhancement while reducing processing and communication overheads in several applications, namely vehicular networks, mobile crowd sensing and service level agreement monitoring.

Intelligent Transport Systems (ITSs) -In ITSs, connected cars are responsible for continuously publishing data related to their location and traffic status among the network. These broadcasted data need to be genuine in order to avoid injecting false data in the network. However, ensuring data authentication should not lead to a privacy leakage of personal data. To fulfill tis trade-off, collected data should be authenticated using privacy preserving techniques. The most prominent C-ITS solutions today allows the detection of traffic jam based on received data from the connected vehicles. Each connected car sends a set of collected data information, based on embedded sensors, to a central node. This latter needs to make sure that the received data are authentic. Then, to decrypt data, the aggregator merges received data from different devices and decrypts the contents to monitor the state of the road and supply the centralized infrastructure with necessary information.

Mobile Crowd Sensing -The popularity of increasingly capable human carried mobile devices such as smartphones and smart-watches involved several embedded sensors. This led to the appearance of the Mobile Crowd Sensing (MCS) paradigm. MCS is a sensing paradigm able to outsource collected data by sensors to a group of participating users, namely (crowd) workers. MCS is mainly based on the use of mobiles devices and their resources. Thus, data aggregation can be an efficient technique to ensure data collection while saving costs at the crowd worker side. Obviously, privacy preservation of the participating entities and data authentication should be considered in such environment to ensure the collection of benign data.

SLA Monitoring -Service Level Agreements (SLAs) are widely used to describe the agreements between customers and service providers regarding the quality of the provided services [START_REF] Kaaniche | Security sla based monitoring in clouds[END_REF]. To measure the providers compliance to the SLA, monitoring tools should be setup to collect specific metrics that can quantify the Quality of Service (QoS). These monitoring mechanisms should run continuously or periodically but in either cases can generate huge amounts of data. Eventually, this data is shared with other components responsible for performing analysis, reporting and executing SLA enforcement measures. The amounts of monitoring data can be huge and sending it through the wire can be an overkill for any system. Moreover, in most of the cases, this data is confidential and should be processed in a secure manner. Consequently, monitoring modules can act as an aggregator to reduce the amount of generated data. And to protect data from any tampering, they should be collected, authenticated and aggregated before being used by SLA services to estimate the QoS.

As described above, it is clear that designing a secure, privacy preserving and efficient data aggregation solution, for IoT applications has a high importance. The proposed scheme must fulfill the following properties:

-data confidentialitythe proposed aggregation mechanism should protect data contents from being accessed by unauthorized users. -data origin authenticitythe aggregation scheme needs to ensure that data are created by authorized entities. -privacythe secrecy of devices' access pattern must be protected. Indeed, the aggregator must be able to verify data origin authenticity without leaking extra information about signing devices. -low computation and storage costslow processing complexities and storage costs need to be provided, by the proposed mechanism mainly for resource-constrained devices.

3

Coop-DAAB: Cooperative Attribute based Data Aggregation Scheme

In this section, we expose our network model then we present a general overview of Coop-DAAB. Finally, we detail the different phases of the proposed solution.

Network Model

Coop-DAAB network model relies on five different actors: an attribute authority, an administrator, a set of IoT devices {d i } {i=1,••• ,M } , a set of gateway aggregating entities {Gw j } {j=1,••• ,L} and a selected IoT trusted node. These different entities are shown in Figure 1 and defined as follows:

-attribute authority AA -is responsible for bootstrapping the whole system in the initialization phase. We assume that AA is a trusted entity. It also issues certified attributes and related secret keys for the aggregating gateways and IoT devices. -administrator admin -is the system administrator responsible for generating the general access predicates used to encrypt data contents. In addition, admin generates the signing access predicate submitted to the IoT devices to sign the collected data. -aggregating entity (Gw) -is considered as a local network gateway. It is responsible of collecting, deciphering and verifying the authenticity of data contents.

Overview

In this paper, we design a new cooperative privacy preserving encryption scheme, for IoT signed data contents, denoted by Coop-DAAB with constant ciphertext size. Our proposal relies on the constant size attribute based signcryption proposed by Belguith et al. [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF], which has been extended to support collaborative encryption of a set of data inputs, collected by IoT devices and gathered by an aggregator with respect to his granted privileges.

Our proposed Coop-DAAB construction involves three phases, namely, Sys Init, Data SignCrypt and Data Agg.

During the first Sys Init phase, three randomized algorithms are executed. First, the attribute authority AA performs the stp and keygen algorithms to generate the global public parameters and derive secret keys associated with each involved entity's attributes (i.e., IoT device, gateway). In addition, the system administrator executes accgen algorithm to generate the general access signing and enciphering predicates, denoted by Γ s and Γ e .

The second phase occurs periodically, such that each involved IoT device d i has to signcrypt its collected data content and independently sends the resulting signcrypted information to the aggregating gateway. Note that the time period T is specified by the system administrator, during the Sys Init phase. For the second Data SignCrypt phase, two algorithms are performed, namely enc and sign, by each involved IoT device. For this purpose, a trusted selected IoT device (d s ) periodically assigns to each involved IoT node a sub-access predicate. That is, the general enciphering access predicate is split by d s into a set of dummy and genuine sub-access predicates. Note that a dummy access predicate refers to an access predicate such that the aggregating gateway Gw does not satisfy the required threshold (i.e., generally, the aggregator does not have any required attributes), while for a genuine access predicate, the gateway may have some of the required attributes.

Coop-DAAB Phases

This section details the Coop-DAAB main phases and their algorithms.

Sys Init Phase

This first phase includes three randomized algorithms defined as follows:

stp -the setup algorithm is executed by the attribute authority AA. The stp is responsible for generating the public parameters pp and the master secret key msk while taking as input security parameter ξ. For this purpose, the trusted authority defines a bilinear setting (ê, G 1 , G 2 , G, g, h) of prime order p such that ê :

G 1 × G 2 → G, g ∈ G 1 and h ∈ G 2 .
In addition, It specifies an encoding function τ such that τ : U → (Z/pZ) * , where U is the attribute universe of cardinal n. The function τ is chosen such that for each encoded attribute values τ (a) = x are pairwise different. Then, the stp algorithm selects a set D = {d 1 , ..., d n-1 } consisting of n -1 pairwise different elements of (Z/pZ) * (i.e; dummy users), which must also be different to the values τ (a i ), for all a i ∈ U. Note that for any integer i lower or equal to n -1, we denote as D i the set {d 1 , ..., d i }. Finally, the stp algorithm computes u defined as u = g α•γ and outputs the global public parameters pp as follows:

pp = {G 1 , G 2 , G, ê, h, u, {h αγ i } {i=0,••• ,2n-1} , D, τ, ê(g α , h)}
The master key is set to be msk = (g, α, γ) where α, γ are two values randomly selected from (Z/pZ) * . -keygen -the attribute authority executes the keygen algorithm once it receives a key generation request from any participating entity (i.e; IoT device, aggregating gateway). We denote by E, any participating entity, such that E ∈ {d, Gw}. The keygen algorithm takes as input the participating entity's set of attributes, denoted by A E and the master key of the attributes authority msk and generates the corresponding secret key sk E . For any subset A E ⊂ U of attributes associated with E, keygen picks a random value r E ∈ (Z/pZ) * and derives the secret key as follows:

sk E = ({g r E γ+τ (a) } a∈A E , {h r E γ i } i=0,••• ,m-2 , h r E -1 γ ) = (sk E1 , sk E2 , sk E3 )
Remark 1. Communication overhead optimization for IoT devices' key distribution -Considering resource constraints of IoT devices, in terms of storage, processing and communications, our Coop-DAAB scheme assumes that IoT devices are pre-configured with corresponding secret keys. That is, the IoT device's manufacturer is responsible for contacting the attribute authority to physically embed the secret keys into the IoT device.

accgen -the system administrator runs the accgen algorithm. It takes as input the attributes universe U and outputs the time period T , the access signing predicate Γ s and the general access enciphering predicate Γ e . Recall that T permits to regulate processing and transmitting signcrypted contents by IoT devices, periodically. Each access predicate is represented by a set of attributes S ∈ U and a threshold value t, such that at least t attributes need to be satisfied by an IoT device to sign or encrypt a data message. In the following, we denote by Γ s = (S s , t s ) the access signing predicate, mainly used by IoT devices to prove the authenticity of their data contents, and Γ e = (S e , t e ) the access enciphering predicate, mainly used by the aggregating gateway to decipher the resulting data contents.

Data SignCrypt phase

The second phase occurs periodically, such that each involved IoT device d i has to signcrypt its collected data content and independently sends the resulting signcrypted information to the aggregating gateway. Recall that a trusted selected IoT device d s periodically assigns to each involved IoT node a sub-access predicate. That is, the general enciphering access predicate Γ e is divided into a set of dummy and genuine sub-access predicates such that:

Γ e = {{γ g,di } i=1,••• ,k , {γ d,di } i=k+1,••• ,l }
l represents the number of all participating IoT devices, k is randomly selected by d s and represents the number of IoT devices that are assigned genuine access predicates such that they have to encipher and sign a neutral group element 1 G , while the remaining l -k devices are assigned dummy access predicates such that they encipher and sign their collected data contents 5 . This phase consists of two randomized algorithms, performed by each involved IoT device, detailed hereafter:

enc -this algorithm takes as input a message m i and the assigned sub-access tree γ F,di , where F = 0 presents a genuine sub-access predicate and F = 1 denotes a dummy sub-access predicate. It outputs the encrypted message C di . Note that each sub-access predicate is presented as γ F,di = (S F , t F ), where S F is the set of required deciphering attributes by γ F,di , |S F | = s F is the number of attributes of S F and t F is the threshold value w.r.t. γ F,di . First, the device d i picks a random κ i ∈ (Z/pZ) * and computes the enciphered message C di defined as

C di = (C 1,i , C 2,i , C 3,i
), defined as follows:

   C 1,i = (g α•γ ) -κi C 2,i = h κiα• a∈S F (γ+τ (a)) d∈D n+t F -1-s F (γ+d) C 3,i = ê(g, h) α•(κi+mi) • f (m i ) = K i • f (m i )
where f is a bijective and semi-homomorphic function that is specified by admin (i.e; f depends on the use case), supporting the following property:

i f (m i ) = f ( i m i ).
For example, f may be the exponential function exp, where i exp(m i ) = exp( i (m i )).

sign -this algorithm is performed by the IoT device d i to sign his encrypted data input, with respect to Γ s = (S s , t s ), defined by the system administrator, where S s ⊂ U is an attribute set of size s = |S s | such that 1 ≤ t s ≤ |S s |.

Let A di be the subset of attribute set related to the signing IoT device where

|A di ∩ S s | = t s .
For this purpose, each device d i uses his secret key sk di and the aggregate algorithm aggreg [6]6 to output a signature σ di . Indeed, d i first computes T 1,di such as:

T 1,di = aggreg({g r d i γ+τ (a) , τ (a)} a∈A d i ) = g r d i a∈A d i (γ+τ (a))
Then, d i defines the polynomial P (A d i ,Ss) (γ) such as:

P (A d i ,Ss) (γ) = 1 γ ( a∈Ss∪Dn+t s-1-s \A d i (γ + τ (a)) -B 1,di ) Where B 1,di = a∈Ss∪Dn+t s-1-s \A d i τ (a)
Afterwards, using the element sk di 2 , the signcrypting device d i derives B 2,di as follows:

B 2,di = h r d i P (A d i ,Ss) (γ)/B 1,d i
In the sequel, d i generates the signature σ di = (σ 1,i , σ 2,i , σ 3,i ) defined as:

     σ 1,i = T 1,di • g m i a∈A d i (γ+τ (a)) σ 2,i = sk di 3 • B 2,di • h miP (A d i ,Ss) (γ)/B 1,d i σ 3,i = ê(g α , h) mi
Finally, the signcrypting IoT device d i outputs the signcryption of the message m i as follows:

Σ i = (C di , σ di , B 1,i )
Remark 2. Processing cost optimization for IoT devices' encryption and signature algorithms -Considering resource constraints of IoT devices, in terms of storage and processing, our Coop-DAAB scheme assumes that several elementary functions (i.e., computation of signcrypted message elements based on public parameters, such as

P (A d i ,Ss) (γ), C 2,i κi -1
, • • • ) are outsourced to a semi-trusted device, with sufficient computation capacities [START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF]. As such, only a few number of exponentiations and multiplication is required by each single IoT device.

3.3.3

Data Agg phase The Data Agg phase involves four algorithms, executed by the aggregating gateway Gw, defined as follows:

vrfchunk -before starting the aggregation process, Gw has to verify that each received signcrypted message m i has been correctly signed by a related device d i . The vrfchunk algorithm takes as input the set of received signcrypted messages {Σ i } {i=1,••• ,l} and the public parameters pp. It outputs a boolean value b ∈ {0, 1}, where 0 means reject and 1 means accept. For this purpose, the aggregating gateway Gw has to check the following equality:

σ 3,i ? = ê(u -1 , σ 2,i ) • ê(g α , h) -1 • ê(σ 1 B 1,i 1,i , h α• a∈Ss ∪D n+ts-1-s (γ+τ (a)) ) (1)
Note that the aggregating gateway Gw performs the following algorithms of Data Agg phase relying on correctly signed data contents. That is, Gw withdraws inaccurate signatures.

agg -this algorithm takes as input the set of signcrypted data chunks

{Σ i } {i∈[1,l]} ,
         C 1 = l i=1 C 1,i C 2 = l i=1 C 2,i C 3 = l i=1 C 3,i = l i=1 K i • f (m i ) σ 3 = l i=1 σ 3,i
dec -This algorithm is executed by the aggregating gateway. It takes as input the aggregated signcrypted message Σ, the set of attributes A Gw , the secret key sk Gw of the aggregating gateway and the enciphering access predicate Γ e . It outputs the message M , such that M = l i=1 m i . Indeed, any aggregating gateway Gw having a set of attributes A Gw where |A Gw ∩ S e | = t e can verify and decrypt the signcrypted message under the access policy Γ e = (S e , t e ). Then, for all a ∈ A Gw , Gw has to aggregate its secret keys related to the required attributes such as:

A 2 = aggreg({g r Gw γ+τ (a) , τ (a)} a∈A Gw ) = g r Gw a∈A Gw (γ+τ (a)) (2)
Afterwards, Gw defines the polynomial P A Gw (γ) such as:

P A Gw (γ) = 1 γ ( a∈Se∪Dn+t e -1-se \A Gw (γ + τ (a)) -B Gw )
where

B Gw = a∈Se∪Dn+t e-1-se \A Gw τ (a)
Afterwards, Gw uses the aggregated secret key A 2 and the sk E Gw key element to compute:

[ê(C 1 , h r Gw P A Gw (γ) ) • ê(A 2 , C 2 )] 1 B Gw = e(g, h) ( l i=1 κi•α)•r Gw
Then, the aggregating gateway Gw deduces the deciphering key K = l i=1 K i such as:

K = ê(C 1 , sk Gw3 ) • σ 3 • ê(g, h) l i=1 κi•r Gw •α = ê(g, h) α•( l i=1 mi+κi)
Finally, the aggregating gateway Gw recovers the message M = l i=1 m i as follows:

M = f -1 ( C 3 K ) = f -1 (f ( l i=1 m i )) = l i=1 m i
vrfd -to verify the authenticity of the signature of the resulting message M , the gateway Gw uses the retrieved message M and the aggregated σ 3 . That is, Gw verifies the correctness of following equality:

σ 3 ? = ê(g α , h) M (3)
In this section, we analyse the security resistance of the proposed cooperative aggregation scheme Coop-DAAB with respect to the threat model presented in section 4.1 while proving the fulfillment of the security challenges defined in Section 2.

Threat model

In order to design a relevant aggregation scheme to secure IoT assisted applications, we define two potential attackers: malicious IoT external device and honest but curious aggregating gateway, defined as follows:

honest but curious aggregating gateway -this aggregating gateway is honest in term of executing the protocols included in our proposed Coop-DAAB scheme. However, it may be curious about the participating entities sensitive data.

malicious IoT device -this IoT device may be an external device trying to access aggregated data, to forge the signed data contents or to transmit false inputs. This adversary aims at persuading the gateway that he is a genuine IoT user.

Confidentiality

In our proposed Coop-DAAB scheme, data are encrypted before being stored using an attribute based signcryption scheme. Therefore, the secrecy of data is inherited from the used ABSC scheme.

Theorem 1. Coop-DAAB ensures the secrecy of both encrypted data chunks and aggregated data contents.

Sketch of Proof -the proof of Theorem 1 is twofold. First, the secrecy of signcrypted data contents depends on the security of the signcryption algorithm used to encrypt data chunks provided by IoT devices. Thus, Coop-DAAB inherits the indistinguishability property from [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF], such that if a malicious attacker knows some data about the plaintext, it can not leak information about the ciphertext. Note that in ABSC schemes, the adversary may try to overcome the indistinguishability property using his own attributes or by colluding with other compromised users. Indeed, similar to [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF], in Coop-DAAB the users secret keys are randomised using the r E value which is unique for each participating entity. This stops the collusion attacks as users can not put their secret keys together and override their access rights. In addition, sub-access encrypting predicates used to encrypt data chunks are not communicated to the aggregator Gw. Furthermore, Gw's attributes do not satisfy sub-access policies used for encrypting genuine data contents phase thanks to the use of dummy sub-access polices. Consequently, an aggregator cannot deduce data chunk content.

Second, the secrecy of resulting aggregated contents depends on the consistency of the aggregating algorithm agg, such that aggregated data contents are only accessed by the authorized aggregator. Indeed, the general enciphering access predicate is published by the system administrator to the involved aggregating entities. As such, thanks to the use of the ABSC scheme, data are only accessed by users whose attributes match the defined access policy [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF].

Privacy

Theorem 2. Coop-DAAB ensures the privacy property, such that signing attributes are indistinguishable against a curious aggregating entity. Sketch of Proof -the proof of Theorem 2 states that an aggregating entity cannot guess which attributes have been used to signcrypt the data chunk. That is, let us consider a signing IoT device d, holding two different sets of attributes A d,1 and A d,2 , that both satisfy a fixed access predicate Γ * = (S * , t * ). Thus, d randomly selects a set A d,b , where b ∈ {1, 2} to sign a data message m, chosen by a malicious entity. As

|A d,b ∩ S * | = |A d,1 ∩ S * | = |A d,2 ∩ S * | = t * ,
we deduct that the two signatures computed with respect to the two set of attributes A d,1 and A d,2 have similar distribution. Moreover, the used signcryption scheme [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF] is demonstrated to be privacy preserving in the standard model. That is, while signing data, the identity of the signcrypting entity and its set of attributes are kept hidden from any verifying entity. Thus, Coop-DAAB guarantee that the applied signature does not leak any extra information about the signing entity neither its signing attributes except what can be already inferred from the used signing access policy.

Access Control to Data

Theorem 3. Coop-DAAB provides an access to authenticated data contents. Sketch of Proof -the resistance of Coop-DAAB against unauthorized access to data relies on the correctness of the aggregation agg and decryption dec algorithms, as detailed in Lemma 1 and Lemma 2. In addition, the support of data origin authentication is provided by the correctness of the signing algorithm sign (c.f., Lemma 3) and its resistance against forgery attacks (c.f., Lemma 4).

Lemma 1. Correctness of the aggregation of data chunks algorithm agg -The correctness of the aggregation of received signcrypted data chunks is detailed hereafter.

         C 1 = l i=1 (g α•γ ) -κi C 2 = l i=1 h κiα• a∈S F (γ+τ (a)) d∈D n+t F -1-s F (γ+d) C 3 = l i=1 ê(g, h) α•(κi+mi) • f (m i ) σ 3 = l i=1 ê(g α , h) mi          C 1 = (g α•γ ) -l i=1 κi C 2 = h l i=1 κiα• a∈Se (γ+τ (a)) d∈D n+te -1-se (γ+d) C 3 = ê(g, h) α• l i=1 (κi+mi) • f ( l i=1 m i ) σ 3 = ê(g α , h) l i=1 (mi)
Lemma 2. Correctness of the decryption algorithm dec -After aggregating its secret key relying on Equation 2, the aggregator calculates the decryption key K by executing the following equations: ê(g, h)

l i=1 κi•r Gw •α = (ê(C 1 , h r Gw P A Gw (γ) )) • ê(A 2 , C 2 )) a∈Se ∪D n+te-1-se \A Gw τ (a) ê(g, h) l i=1 κi•α = ê(C 1 , h r Gw -1 γ )ê(g, h) l i=1 κi•r Gw •α ê(g, σ 3 ) = ê(g, h α• l i=1 mi ) = ê(g, h) α• l i=1 mi
Finally, the aggregator may decrypt the message as follows:

M = f -1 ( C 3 ê(g, h) α• l i=1 mi • ê(g, h) α• l i=1 κi) ) = f -1 ( C 3 K ) = f -1 (f ( l i=1 m i )) = l i=1 m i
Lemma 3. Correctness of the signature verification algorithms vrfchunk and vrfd -First, the correctness of the algorithm vrfchunk relies on the correctness of Equation 4. In the following, we set the quantities = ê(u

-1 , σ 2,i )•ê(g α , h) -1 • ê(σ 1 B 1,i 1,i , h α• a∈Ss∪D n+ts-1-s
(γ+τ (a)) ) and τ γ (a) = γ +τ (a). The aggregating entity has to check if σ 3,i is equal to such as:

= ê(u -1 , σ 2,i ) • ê(g α , h) -1 (4)
•ê(σ

1 B 1,i 1,i , h α• a∈Ss∪D n+ts-1-s (τγ (a)) ) = ê(g -αγ , h r d i -1 γ • h (r d i +mi)P (A d i ,Ss) (γ)/B 1,d i ) •ê(g α , h) -1 • ê(σ 1 B 1,i 1,i , h α• a∈Ss ∪D n+ts-1-s (τγ (a)) ) = ê(g -α , h (r d i +mi) a∈Ss∪D n+ts -1-s \A d i (τγ (a)) ) •ê(g, h) α(1-r d i ) • ê(g α , h (r d i +mi) ) • ê(g α , h) -1 •ê(σ 1 B 1,i 1,i , h α• a∈Ss∪D n+ts-1-s (τγ (a)) ) = ê(g -α , h r d i +m i B 1,d i a∈Ss∪D n+ts-1-s \A d i τγ (a)
)ê(g α , h) mi

•ê(g

r d i +m i B 1,d i a∈A d i (τγ (a)) , h α• a∈Ss∪D n+ts -1-s (τγ (a)) ) = σ 3,i
Second, the correctness of the signature verification vrfd of the resulting aggregated data is based on the correctness of Equation 3. Such that, the aggregating entity relies on the received message M = l i=1 (m i ), to check that

σ 3 = ê(g α , h) l i=1 (mi) = ê(g α , h) M .
Lemma 4. Unforgeability of the signing algorithm sign -As our Coop-DAAB is based on [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF], it supports the unforgeability property of the signing algorithm, such that a malicious external device cannot provide a valid signcrypted data message as it does not satisfy the signing predicate Γ s . Indeed, thanks to the randomization of the secret keys, unauthorized entities can not pool their attributes together to sign the data chunks. Thus, only authorized devices can generate genuine signcrypted data chunks.

Performance Analysis

In this analysis we compare the computation and the storage overheads of the closely related attribute based signature schemes. In most ABSC schemes, the size of a signcrypted data grows along with the size of the encryption access policies [START_REF] Gagne | Threshold attribute-based signcryption[END_REF]13]. As Coop-DAAB relies on the constant ciphertext size ABSC scheme introduced in [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF], it presents an efficient aggregation scheme in terms of processing and storage overheads. Indeed, as shown by Table 1, our contribution introduces a ciphertext size which is independent from the size of the used access policy. s denote both the size of the signing policy and the encryption policy. te and ts, O(M ) and m respectively define the encryption threshold, the signing threshold value, the size of the plaintext message M and the cardinal of the attributes' universe U. nE presents the cardinal of the set of attributes of the user. E1, E2, ET represent exponentiation cost in G1, G2, GT , while τp is the cost of a pairing operation.

Attribute based techniques have been implemented in resources-constrained devices in several research works [START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF][START_REF] Guo | Psad: A privacy-preserving social-assisted content dissemination scheme in dtns[END_REF]. Based on our on going-implementation, we deduce that in Data SignCrypt phase, the computation overhead raises linearly with the size of the access signing predicate (t s ) (c.f., Figure 3), due to the execution of aggreg [START_REF] Delerablée | Dynamic threshold public-key encryption[END_REF] during the sign algorithm. Similarly, dec computation cost grows linearly with the size of the access enciphering predicate t e . The algorithms vrfchunk, agg, enc and vrfd is independent of the sizes of the encryption and signing access policy. Recall that agg algorithm only involves multiplications which requires a negligible computation cost compared to pairing and exponentiation times. Shi et al. [START_REF] Shi | Privacy-preserving aggregation of time-series data[END_REF] have proposed a privacy preserving aggregation technique. In this scheme, an aggregator is able to collect participants' data and run statistics over them without learning private information about each participant.

In [START_REF] Lu | A lightweight privacypreserving data aggregation scheme for fog computing-enhanced iot[END_REF], the authors design a data aggregation scheme adapted for fog computing systems. This solution relies on the use of the Chinese Remainder Theorem to aggregate received data from different parties. This scheme applies one-way hash chain to ensure data origin authentication. In the same vein, Lyu et al. proposed PPFA, a Privacy Preserving Fog-enabled Aggregation for smart grid environments [START_REF] Lyu | Ppfa: Privacy preserving fog-enabled aggregation in smart grid[END_REF]. Their construction relies on fog nodes computation resources to perform heavy computation-consuming functions. Later, Hu et al. introduced a privacy preserving data aggregation scheme for IoT applications [START_REF] Hu | An efficient privacy-preserving data aggregation scheme for iot[END_REF]. The proposed scheme relies on Secure Multiparty Computation (SMC) techniques, such that each device has to first divide sensory data, locally keeps one piece, and sends the remaining pieces to other group devices. Then each IoT device adds the received shares and the held piece together to get immediate result. The [START_REF] Hu | An efficient privacy-preserving data aggregation scheme for iot[END_REF] construction provides heavy computation and costs. Hence, it makes it unsuitable for resource-constrained devices. Recently, in 2018, a lightweight aggregation signature scheme for IoT environments have been proposed in [START_REF] Kaâniche | Secure sharing of personal health records in cloud computing: ciphertext-policy attribute-based signcryption[END_REF]. This scheme is based on the use of a set homomorphic signature scheme to aggregate received signed data from IoT devices without learning secret keys of each participant. However, data are transmitted in clear text, between the different involved devices.

Signcryption schemes are generally considered as a logic combination of encryption and signature schemes that enables a data owner to encrypt and sign data in one step. This cryptographic technique allows data origin authentication as the receiver verifies the data owner signature before decrypting. Attribute based signcryption schemes have been introduced by Gagné et al. [START_REF] Gagne | Threshold attribute-based signcryption[END_REF], in 2010. This first proposed construction combines attribute based encryption and signature schemes, based on the same access structure. As such, data secrecy and data origin authentication and flexible fine-grained access control features are provided. Nevertheless, Gagné et al. construction suffers from an important communication overhead that increases dependently with the number of attributes involved in the access structure. Recently, Belguith et al. introduced a constantsize threshold attribute based signcryption, referred to as t-ABSC, for cloud applications [START_REF] Belguith | Constant-size threshold attribute based signcryption for cloud applications[END_REF]. The proposed construction ensures both fine-grained access control and data origin authentication, thanks to the usage of two different access policies, assigned respectively to the enciphering and signing process. As such, users' privacy and outsourced data confidentiality are ensured. In addition, the size of signcrypted messages does not depend on the number of attributes involved in the threshold access structure, which makes t-ABSC scheme suitable for bandwidth-limited applications and resource-constrained devices.

Several security and privacy concerns have raised, due to the emergence of Cloud assisted IoT applications, considered as highly dynamic and distributed environments. This lead us to design a new cryptographic mechanism to ensure cooperative data aggregation for IoT applications while preserving devices' privacy, thanks to the attractive properties of attribute based cryptographic techniques. The proposed Coop-DAAB scheme enables an edge device, i.e., aggregator to collect sensory data from different IoT devices and verify their authenticity using an attribute based signcryption scheme. The privacy of involved IoT devices is ensured, thanks to the intrinsic properties of the signing procedure, as it does not reveal more information other than the accuracy of data integrity verification. Furthermore, compared to most closely related work, Coop-DAAB is suitable for resource-constrained devices based on an ongoing implementation of the proposed construction and a detailed theoretical performance analysis w.r.t. computational, communication and storage costs. The analysis clearly shows that the size of the signcrypted data does not depend on the number of attributes involved in the threshold access structure.

Fig. 1 .

 1 Fig. 1. Network Model

  where l is the number of participating IoT devices 7 . It outputs an aggregated signcrypted data message Σ w.r.t. a global message M = l i=1 (m i ), as follows:

  As such, when an IoT device d i is assigned a dummy access predicate, denoted by γ d,di , it has to encipher and sign its collected data content. And, when assigned a genuine access predicate, denoted by γ g,di , it enciphers and signs a neutral group element 1 G . Afterwards, each IoT device d i sends the signcrypted result to the aggregating node. During the Data Agg phase, the aggregating gateway Gw gathers signcrypted data contents from involved IoT devices. Note that the aggregating gateway ignores assigned sub-access predicates, and is only aware of the general enciphering access predicate Γ

e , published by the system administrator. During this phase, four different algorithms are run by the aggregating gateway Gw, namely vrfchunk, agg, dec and vrfd algorithms. As such, Gw first verifies signed data chunks based on vrfchunk algorithm. Then, it merges the received signcrypted results, in order to generate a global ciphertext, based on the agg algorithm, deciphers the resulting global ciphertext, relying on dec algorithm and checks the authenticity of the received global data content, based on vrfd algorithm.

Table 1 .

 1 Features, Computation and Storage Costs Comparison of ABSC Schemes

	Scheme	Type	Access Policy	Key size	Signcryption size	Signcrypt time	Unsigncrypt time
	[13]	CP-ABE	Monotone	ls + 2, le + 2	O(ls) + O(le)	τp + ET + E1(3 + le + 3ls)	τp(3ls + 5) + 2lsET + 2lsE1
	[7]	CP-ABE	Threshold	3le, 2ls	O(M ) + O(le) + O(ls) E1(2O(M ) + mle + 4le + 3 + ls) 2E1 + τp(2t + 2 + ls) + tET
	[16]	KP-ABE	Monotone	m + ls, m + le	8	E1(10 + le + 4ls)	6τp + E1(le + 3le)
	Coop-DAAB CP-ABE Aggregate-Threshold nE + m + 1	8	E1(ts + 2) + 2E2 + 2ET	E1te + 7τp + 2ET

Assigning sub-access dummy and genuine predicates may be set via activating a flag F , where F = 0 presents a genuine sub-access predicate and F = 1 denotes a dummy sub-access predicate

Coop-DAAB relies on the aggregate algorithm aggreg introduced by Delerablee et al.[START_REF] Herranz | Constant size ciphertexts in threshold attribute-based encryption[END_REF].

For ease of presentation, we consider that all received signcrypted contents are correctly verified.

Related WorkIoT networks consist in interconnecting several smart and resource constrained devices to enable advanced services. Data aggregation has been widely explored, yet, few research works have focused on data aggregation in IoT networks while considering data secrecy and privacy preserving requirements.

The performances of attribute based techniques have been studied in several research works especially in IoT applications [START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF][START_REF] Guo | Psad: A privacy-preserving social-assisted content dissemination scheme in dtns[END_REF]. Our ongoing implementation of the Coop-DAAB's Proof of Concept (PoC) consists in evaluating the execution costs of the most known elementary cryptographic functions while performed in different IoT devices as presented in [START_REF] Belguith | Phoabe: Securely outsourcing multi-authority attribute based encryption with policy hidden for cloud assisted iot[END_REF]. To evaluate the performances of Coop-DAAB, we executed three main cryptographic operations in different types of IoT devices, namely bilinear maps and exponentiation functions (cf. Figure 2).