# Pas: Privacy-Preserving Authentication Scheme Based on SDN for VANETs
## 6 Performance Analysis
### Computational Cost  
Computational cost refers to the total computation time required for authentication. Since the computational cost of bilinear pairing and point multiplication are thousands time of hash function: \(\{0,1\}\to Z_{q}^{*}\), we focus on such high computation operations. In order to get the computational cost of each cryptographic operations, we adopted the pairing-based cryptography library [35] that provides interfaces and classes to support cryptographic operations based on bilinear pairing. The benchmark includes: the hardware platform with 2.6 GHz Intel(R) Core(TM) i7-6700 HQ CPU, 2 GB RAM, operating system with Debian 9.4. The experiment adopted a bilinear map \(e:G_{1}\times G_{1}\to G_{T}\), where \(G_{1}\) is the additive group, \(G_{T}\) represents the multiplicative group, and the generator is \(P\). Equation \(y^{2}=x^{3}+x\ mod\ p\) defines the curve, where \(p\): 512 bits, and Solinas prime number \(q=\)160 bits. Table 3 shows the experiment results. For V2I anonymous authentication in EAAP, the vehicle is required to generate anonymous certificates. The vehicle first chooses temporary private keys \(r_{1},r_{2},\ldots,r_{l}\in Z_{q}^{*}\) and computes corresponding public keys \(Y_{k}=g_{2}^{r_{k}}\), where \(l\leq n,k=1,2,\ldots,l\), \(g_{2}\) is the public parameter. Then, the vehicle selects \(\mu,k_{1},k_{2}\in Z_{q}^{*}\) and generates its anonymous certificate: \(\gamma_{U}=B_{1}^{\mu}\), \(\gamma_{V}=T_{i}A_{1}^{\mu}\), \(\lambda=(\mu+r_{k})\ mod\ q\), \(\lambda_{1}=\gamma_{U}^{\mu+k_{1}}\), \(\lambda_{2}=\gamma_{U}^{\mu+k_{1}}/\gamma_{V}^{\mu+k_{2}}\), where \(B_{1}\), \(A_{1}\) are public parameters, and \(T_{i}\) is the vehicle authorization key (\(AK=(DID_{\mu},T_{i},E_{i})\)). Finally, the vehicle computes the challenger \(c=H(DID_{\mu}||A_{1}||B_{1}||E_{i}||\gamma_{U}||\gamma_{V}||Y_{k}||\lambda_{ 1}||\lambda_{2})\), \(\delta_{1}=(r_{k}-k_{1})\ mod\ q\), \(\delta_{2}=(r_{k}-k_{2})\ mod\ q\), anonymous certificate \(Cert_{k}=\{Y_{k}||E_{i}||DD_{\mu}||\gamma_{U}||\gamma_{V}||c||\lambda||\delta_{ 1}||\delta_{2}\}\), and signature of message \(M\): \(sig=g_{1}^{1/(r_{k}+H(M))}\). The vehicle sends \(M\), \(sig\), \(Y_{k}\), and \(Cert_{k}\) to the verifier. When getting the packet from the vehicle, the verifier derives \(N_{i}=E_{i}\cdot DID_{\mu}\), \(\lambda_{1}^{r}=\gamma_{U}^{\lambda}/\gamma_{U}^{\delta_{i}}\), \(\lambda_{2}^{\prime}=\gamma_{U}^{\lambda}\times\lambda_{V}^{\delta_{2}}/( \gamma_{U}^{\delta_{1}}\times\gamma_{V}^{\gamma})\). Then, \(c^{\prime}=H(DID_{\mu}||N_{i}||B_{1}||E_{i}||\gamma_{U}||\gamma_{V}||X_{1}^{ \prime}||\lambda_{2}^{\prime})\) are computed. If \(c^{\prime}==c\), the verifier verifies the signature: \(e(sig,Y_{k}\cdot g_{2}^{H(M)})==e(g_{1},g_{2})\). If it \begin{table}
\begin{tabular}{c c c} \hline \hline
**Symbol** & **Description** & **Time (ms)** \\ \hline \(T_{\text{ntp}}\) & Hash-to-point function & 4.06 \\ \(T_{\text{fp}}\) & Bilinear pairing function & 1.35 \\ \(T_{\text{pw}}\) & Point multiplication function & 1.77 \\ \(T_{\text{pre}}\) & Point exponentiation function & 1.74 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The execution time of pairing and element functions. holds, M will be accepted; otherwise, it will be rejected. Therefore, the computational cost of EAAP includes 14 point exponentiation operations and 2 bilinear pairing operations.