## 5 Security Analysis
### Security Analysis  
This subsection presents the analysis of the proposed scheme security under the above-stated security proof.  
* Message integrity and authentication: Consistent with the above security proof, no attacker can forge a valid signature in polynomial time because the ECDL problem is hard. Thus, the recipient can verify the validity of messages received from other vehicles using Equation (5).
* Identity privacy-preserving: The real identity of the vehicle \(ID_{i}\) is hidden in the pseudonym ID such as \(AID_{i}=ID_{i}\oplus H_{1}(s||R_{i})\), where \(R_{i}=r_{i}P\) and \(r_{i}\in Z_{q}\). Since the system's private key is secret and \(r_{i}\in Z_{q}\) is random, others cannot obtain the vehicle's original identity.
* Traceability and Revocability: Once illegal information or error messages are sent by a vehicle using a pseudonym ID \(AID_{i}\), the TA can disclose the identity of the vehicle \(ID_{i}\) utilizing \(ID_{i}=AID_{i}\oplus H_{1}(s||R_{i})\). In addition, after revoking the malicious vehicle's certificate, the TA saves it on the certificate revocation list (CRL). Once the vehicles group wants to update their pseudonym ID and domain key while joining or leaving, the TA only updates them to non-revoked vehicles. After the expiry of the old domain key, the revoked vehicle's certificate will no longer be usable in the future.
* Unlinkability: Since all registered participating vehicles dynamically update their pseudonym ID when joining or leaving a domain, no adversary can link multiple messages to the same vehicle during its travel.
* Resistance to security attacks: The proposed scheme could resist the following known attacks:
* Resistance to modify attack: In the proposed scheme, a registered participating vehicle broadcasts message-signature tuple \(\{AID_{i},\,R_{i},\,M_{i},\,T_{i},\,\sigma_{i}\}\) wirelessly to others. Since the signature \(\sigma_{i}\) of each message includes a hidden domain private key \(s_{d}\), there is no disclosure of the key, preventing adversaries from modifying the message undetected. The receiver detects modifications to the message since the signature verification fails. Hence, the proposed system is resistant to modify attacks.
* Resistance to replay attack: In the proposed scheme, a timestamp \(T_{i}\) is included in the signature \(\sigma_{i}\) of each message-signature tuple \(\{AID_{i},\,R_{i},\,M_{i},\,T_{i},\,\sigma_{i}\}\), where \(\sigma_{i}=s_{d}.\alpha_{i}+\frac{1}{p}\beta_{i}\) mod q, \(\alpha_{i}=H_{2}\ (AID_{i}||R_{i}||M_{i}||T_{i})\) and \(\beta_{i}=H_{3}(AID_{i}||R_{i}||T_{i})\), making it impossible to tamper with the signature. By validating the signature, the recipient can detect any replay attacks. Hence, the proposed system is resistant to replay attacks.
* Resistance to impersonation attack: Consistent with the above security proof, no adversary can forge a valid signature message without the domain private key \(s_{d}\). Hence, the proposed system is resistant to impersonation attacks.
* Resistance to password-guessing attack: Once the driver's real identity \(DID_{i}\), the vehicle's identity \(ID_{i}\), and the login password \(PW_{i}\) are submitted to the local TA, there will no longer be a threat of disclosure. The driver holds two secret authentication parameters \(A_{i}\) and \(B_{i}\) that TA computed. After the login phase, only a legitimate driver can control the registered participating vehicle, thus preventing adversaries from taking control of the vehicle. Hence, the proposed system is resistant to password-guessing attacks.