💻 computer science

CPBS: A Collaborative Proxy Blind Signature Scheme with Threshold Authorization for Privacy-Preserving Medical IoT

The paper proposes CPBS, a collaborative proxy blind signature scheme that leverages a (t,n)-threshold mechanism to distribute trust among decentralized peer nodes for secure, privacy-preserving, and auditable data collection in resource-constrained Medical IoT networks, significantly reducing computational and communication overhead compared to existing centralized solutions.

Original authors: Jinnan Li, Qing Ye, Yi Yang, Qian Zhou, Zhimin Yuan, Shiwei Huo

Published 2026-06-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jinnan Li, Qing Ye, Yi Yang, Qian Zhou, Zhimin Yuan, Shiwei Huo

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "Overworked Butler" and the "Locked Diary"

Imagine a hospital where patients wear smartwatches that constantly track their heart rates and other vital signs. These devices are small, run on tiny batteries, and have very little computing power (like a basic calculator).

Currently, to keep this data safe and prove it hasn't been faked, the devices need to sign the data with a digital "seal." But doing this complex math is too heavy for these tiny devices; it would drain their batteries instantly.

So, doctors usually let a powerful "Butler" (a gateway computer) do the signing for them. But this creates two big problems:

The Trust Issue: If the Butler is a single person, they hold all the power. If they get hacked or decide to be dishonest, they could change the patient's data without anyone knowing. It's like giving one person the keys to the entire hospital.
The Privacy Issue: To sign the data, the Butler usually has to see the raw numbers (the patient's heart rate). This violates privacy. We want the Butler to stamp the envelope without ever reading the letter inside.

The Solution: CPBS (The "Group of Witnesses" System)

The authors propose a new system called CPBS. Think of it as a secure, collaborative way to sign medical data that solves the battery, privacy, and trust problems all at once.

Here is how it works, using a simple analogy:

1. The "Group of Witnesses" (Threshold Authorization)

Instead of one Butler having all the power, the authority to sign is split among a group of trusted people: the Patient, the Doctor, and the Ethics Committee.

The Analogy: Imagine a high-security vault that requires 3 out of 5 specific people to turn their keys simultaneously to open it.
How it works: The Patient, Doctor, and Committee don't sign the data themselves. Instead, they each give a tiny, secret "permission piece" (a share) to the Gateway. The Gateway can only sign the data if it collects enough pieces (e.g., 3 out of 5) from this group.
The Benefit: No single person can abuse the system. If the Doctor tries to sign fake data alone, the system won't let them. They need the others.

2. The "Magic Envelope" (Blind Signature)

Once the Gateway has the permission pieces, it needs to sign the patient's data. But the Gateway shouldn't see the actual heart rate numbers.

The Analogy: Imagine putting a letter inside a thick, opaque envelope that is also inside a special "magic box." You can shake the box and stamp it, but you cannot see the letter inside.
How it works: The patient's device puts the data in a "blinded" form (scrambled so the Gateway can't read it). The Gateway signs this scrambled version. Later, the Hospital Platform (the final receiver) can "unscramble" the signature to prove it's valid, but the Gateway never knew what the data actually said.
The Benefit: The Gateway does the heavy lifting of signing, but it remains completely blind to the patient's private medical history.

3. The "Public Ledger" (Blockchain Auditing)

To make sure no one cheats on the "Group of Witnesses" rule, the system uses a Blockchain.

The Analogy: Think of a public chalkboard in the town square where everyone writes down who gave permission to whom. Once written, no one can erase it or change it.
How it works: Every time the Patient, Doctor, and Committee give their "permission pieces," it is recorded on this unchangeable digital ledger. Anyone can check the ledger to see if the Gateway had the right to sign the data.
The Benefit: It creates a permanent, tamper-proof history of who authorized the data, ensuring accountability.

Why is this better? (The Results)

The paper tested this system against older methods and found:

Battery Life: The tiny medical devices (the smartwatches) do almost no heavy math. They just do simple "hashing" (like taking a fingerprint of the data). This saves up to 52% more computing power and 76% less communication data compared to old methods.
Security: The system mathematically proves that:
- The Gateway cannot fake a signature without the group's permission.
- The Gateway cannot figure out the patient's data from the signed message.
- Even if some members of the group are bad actors, they can't break the system unless they have enough people to reach the "threshold" (e.g., 3 out of 5).

Summary

CPBS is like a secure, collaborative voting system for medical data. It lets tiny devices offload the hard work to a powerful computer, but ensures that:

No one person can control the system (it needs a group vote).
The computer doing the work never sees the private data (it signs a "blind" envelope).
Everyone can check the public record to ensure the rules were followed.

This makes it perfect for a future where millions of medical devices need to send data securely without draining their batteries or leaking patient secrets.

Technical Summary: CPBS – A Collaborative Proxy Blind Signature Scheme for Privacy-Preserving Medical IoT

1. Problem Statement

The deployment of Medical Internet of Things (MIoT) networks faces a critical tension between the resource constraints of edge devices (wearable sensors, battery-powered monitors) and the stringent security requirements of medical data. Existing solutions for data integrity and authentication suffer from three primary deficiencies:

Excessive Terminal Burden: Traditional digital signature schemes require complex cryptographic operations (e.g., pairing, exponentiation) that exceed the computational and energy capabilities of miniaturized medical devices.
Key Compromise Risks: Frequent use of private keys on resource-constrained devices increases vulnerability to side-channel attacks. A compromised key allows attackers to forge medical data, posing direct threats to patient safety.
Centralized Authority and Lack of Collaboration: Current proxy signature schemes typically rely on a single centralized proxy node to authorize signatures. This creates a single point of trust and authority, conflicting with medical compliance mandates that often require joint consent from multiple stakeholders (patients, physicians, ethics committees). Furthermore, a single proxy can unilaterally tamper with data before signing, undermining data integrity.

2. Methodology

The authors propose CPBS (Collaborative Proxy Blind Signature), a scheme designed to decentralize authority, protect data privacy, and offload heavy computation from end devices. The system architecture involves five entities: Original Signers (patients, physicians, ethics committees), MIoT Sensing Devices, a Ward Monitoring Gateway, a Hospital Big Data Platform, and a Medical Consortium Blockchain.

The scheme operates in two distinct phases:

A. Offline Phase (Preprocessing)

This phase handles heavy cryptographic operations and authorization setup without requiring real-time participation from sensing devices.

System Initialization: Parameters are generated using bilinear pairings over elliptic curves.
Collaborative Delegation: Original signers utilize a $(t, n)$ $(t, n)$ -threshold secret sharing mechanism (based on Shamir's scheme and Boneh-Boyen signatures) to jointly authorize the Ward Monitoring Gateway.
- Signers generate authorization shares for a specific policy $M_w$ .
- The Gateway aggregates at least $t$ shares to reconstruct an authorization token.
- This process ensures that no single party can authorize the gateway alone, and the authorization record is immutably stored on a consortium blockchain for auditability.
Pre-computation: The Gateway and Hospital Platform pre-compute commitments and blinding parameters to facilitate lightweight online interactions.

B. Online Phase (Data Collection & Signing)

This phase is optimized for resource-constrained devices.

Data Processing: Sensing devices perform only lightweight operations: hashing the physiological data and symmetric encryption. They do not perform complex signing operations.
Blind Signing:
- The Gateway acts as a proxy signer. It interacts with the Hospital Big Data Platform (acting as the signature requester/verifier).
- The Hospital Platform blinds the data using random factors ( $\alpha, \beta$ ) before sending it to the Gateway.
- The Gateway, possessing the aggregated proxy key derived from the threshold authorization, generates a partial signature on the blinded data. Crucially, the Gateway never sees the raw plaintext.
- The Hospital Platform unblinds the partial signature to generate the final signature.
Verification: Any verifier can validate the signature using public keys and authorization records retrieved from the blockchain.

3. Key Contributions

The paper outlines three main contributions:

$(t, n)$ -Threshold Collaborative Proxy Blind Signature Protocol: A novel protocol where multiple original signers jointly authorize a proxy signer via secret sharing. This distributes trust, prevents single-point authority abuse, and ensures the proxy signer cannot learn the message content (blindness).
CPBS Scheme for MIoT: An implementation tailored for medical environments where patients, physicians, and ethics committees co-authorize a gateway. The scheme supports dynamic node management (revocation, onboarding) without changing public verification keys and integrates zero-knowledge proofs to defend against malicious authorization.
Formal Security and Performance Validation:
- Security: The scheme is proven to satisfy correctness, blindness, and existential unforgeability under the random oracle model, relying on the $q$ -SDH (Strong Diffie-Hellman) assumption.
- Efficiency: Experimental results demonstrate significant reductions in terminal overhead compared to existing proxy signature schemes.

4. Results

The authors conducted experiments comparing CPBS against three baseline schemes (Tang et al., Chen et al., and Wang et al.) using ECG data blocks.

Computational Overhead: CPBS reduces terminal computational overhead by up to 52.3% compared to existing schemes. This is achieved by offloading pairing and exponentiation operations to the offline phase and the gateway/platform.
Communication Overhead: The scheme reduces communication overhead by up to 76.8%. This is attributed to the separation of authorization (one-time) from signing (online), avoiding the multi-round interactions required by other threshold schemes.
Storage: While the scheme incurs linear storage growth on the hospital platform (due to per-block signatures for fine-grained auditing), the storage burden on IoT devices and original signers remains minimal (only private keys).
Blockchain Performance: Using Hyperledger Fabric, the authors report that authorization record commit latency ranges from 132.4 ms to 189.0 ms, and query latency is 18.6–23.8 ms, confirming that blockchain integration does not compromise overall system efficiency.

5. Significance

The paper positions CPBS as a comprehensive solution to the "trilemma" of MIoT security: balancing terminal efficiency, key security, and multi-party collaborative supervision.

Privacy Preservation: By integrating blind signatures, the scheme ensures that the proxy signer (Gateway) and auditors cannot access raw physiological data, addressing critical privacy concerns in medical monitoring.
Decentralized Trust: The threshold authorization mechanism eliminates the single point of failure and trust associated with centralized proxies, aligning with the multi-party consent requirements of medical ethics.
Auditability: The use of a consortium blockchain provides a tamper-proof, traceable record of authorization, enabling end-to-end accountability without relying on a trusted third party.
Practicality: The authors claim the scheme is particularly suitable for P2P MIoT environments where devices are resource-constrained, yet the data requires high-integrity verification and strict privacy guarantees.

The paper concludes that CPBS effectively shifts the computational burden away from edge devices to edge gateways and cloud platforms, enabling secure, privacy-preserving, and collaborative health monitoring. Future work is noted to focus on extending security guarantees against fully malicious adversaries and optimizing on-chain mechanisms for larger scales.