## 4 Privacy-Preserving Incentive Mechanism
### Privacy and Security Analysis  
To ensure that the proposed schemes can prevent privacy leaks and ensure consistency between the routes that vehicles choose and the ones they take, this section analyzes the potential privacy leaks in the scheme steps and discusses how malicious behavior can be managed in the incentive mechanism.  
First, the proposed schemes are privacy-preserving in both the collaborative routing and the route validation processes. In the collaborative routing scheme, \(\mathcal{L}^{R}\) and \(\mathcal{T}^{R}\) hide their real identities with pseudonyms when sending messages. Vehicles receiving messages only know that some vehicles are heading to _des_ but cannot connect these messages to nearby vehicles. Also, as the messages are kept off-chain, it is hard to connect the pseudonyms to real identities through pattern analysis. The messages sent to RSUs are aggregated information, \(n_{s}\). Therefore, no individual privacy information is leaked when RSUs compute optimal route flows. When computing updated routes and incentives thatfollow the MPC protocol, vehicles only send secret shares of their value of time to other vehicles, and outputs are generated by each vehicle using these shares. No meaningful information can be inferred from incomplete shares. In the on-chain incentive freezing process, incentives are sent to different multi-signature wallets. Note that \(\mathcal{S}\) of multi-signature wallets do not need to be the RSUs near the corresponding checkpoints (because verifying position proofs is a cryptographic process independent of the RSU position). Therefore, wallet addresses only provide random signers' public keys, which cannot be used for privacy pattern analysis. In route validation schemes, the pseudonyms of \(\mathcal{L}^{V}\) and \(\mathcal{T}^{V}\) are mixed with fake pseudonyms in position proofs, which provides additional privacy protections, as position proofs are sent to all RSUs for PBFT consensus. Before logging into the blockchain, the position proofs are hashed to ensure no position/route information can be inferred from pattern analysis of the information in the blockchain.  
Behavioral honesty can also be illustrated for both the collaborative routing and the route validation processes. Given that the MPC protocol ensures no privacy leakage risks, vehicles participating in collaborative routing have no privacy concerns. And [21] has shown that under this condition, vehicles will behave honestly (i.e., provide genuine inputs to the collaborative routing scheme) to maximize their own utilities. In the route validation scheme, first, the cryptographic tools used in the scheme design mitigate common types of attacks. The identity-based asymmetric key generation mitigates Sybil attacks, in which a single entity operates multiple fake identities simultaneously to undermine the system by gaining the most influence in the network. Also, the EC digital signature algorithm widely applied in the proposed scheme ensures that signatures cannot be forged, and messages are tamper-resistant. Therefore, adversaries cannot launch replay attacks in the route validation scheme by re-sending messages they received before. Also, \(\mathcal{L}^{V}\) cannot generate a fake position proof by forging more than \(n_{p}-n_{w}\) signatures. Because \(\mathcal{L}^{V}\) has no control over the \(m_{i}\) corresponding to fake signatures, it can forge at most \(n_{p}-n_{w}\) signatures to identify \(n_{p}-n_{w}\) points on \(GF\big{(}2^{i}\big{)}\) (there is an additional point \((0,\ H_{4}(des))\)) and determine a polynomial with degree \(n_{p}-n_{w}\). If it forges more signatures, it cannot ensure that the corresponding \(m_{i}\) is on the polynomial, which can be easily detected by \(V\).