# Pas: Privacy-Preserving Authentication Scheme Based on SDN for VANETs
## 6 Performance Analysis
### Computational Cost
In TAAP, the given private key \(x_{obu}\), group certificate \(C_{1},C_{2}\), group public key \(y_{gm}\), \(y^{\prime}_{gm,1}\), \(y^{\prime}_{gm,2}\) vehicle chooses random numbers \(r\), \(\alpha\), \(\beta\), \(s\) and signs the message \(M\) to get the signature \(<\sigma_{1},\sigma_{2},\sigma_{3},\sigma_{4},\sigma_{5},\sigma_{6},\sigma_{7}, \sigma_{8},\sigma_{9},\sigma_{10},\sigma_{11}>\), where \(\sigma_{1}=C_{1}(y^{\prime}_{gm})\), \(\sigma_{2}=C_{2}g^{\prime}_{1}\), \(\sigma_{3}=g^{\prime\prime}_{1}\), \(\sigma_{4}=g^{\prime\prime}_{2}\), \(\sigma_{5}=g^{\prime\prime}_{1}\), \(\sigma_{6}=\sigma_{2}^{\prime\prime}_{2}\), \(\sigma_{7}=\sigma_{2}^{\prime}\), \(\sigma_{8}=\sigma_{2}^{\beta}\), \(\sigma_{9}=H_{1}(M)^{x_{obu}}\), \(\sigma_{10}=H_{2}(M|\sigma_{1}||\sigma_{2}||...||\sigma_{9}||\sigma_{2}^{ \prime}||H_{1}(M)^{s})\), \(\sigma_{11}=s-\sigma_{10}^{\prime\alpha\alpha}\)_mod_\(q,g_{1}\in G_{1}\), \(g^{\prime}_{1},g^{\prime}_{2}\in G_{2}\). If receiving the message from the vehicle, the verifier computes:  
\[e(\sigma_{1},g^{\prime}_{1})e(\sigma_{6},g^{\prime}_{gm,1}) ==e(g,g^{\prime}_{gm,2})\] \[e(\sigma_{2},\sigma_{3}) ==e(\sigma_{7},g^{\prime}_{1})\] \[e(\sigma_{2},\sigma_{4}) ==e(\sigma_{8},g^{\prime}_{2})\] \[e(\sigma_{2},\sigma_{5})e(\sigma_{6},g^{\prime}_{1}) ==e(\sigma_{7}\sigma_{8},g^{\prime}_{gt})\]  
where \(y^{\prime}_{gt}\) is the public key of group tracer. If all the above equalities hold, a vehicle is considered to be legal; otherwise, the verifier refuses to communicate with the vehicle. Hence, the computational cost of TAAP includes 11 point exponentiation operations, 10 bilinear pairing operations, and 2 hash-to-point function operations in \(G_{1}\). In LIAP, vehicle chooses random number \(k_{i}\in Z_{q}^{*}\) to get \(PID_{i}^{1}=k_{i}P\), \(PID_{i}^{2}=RID_{i}\oplus H(k_{i}PK_{CA})\), \(PSK_{i}^{1}=m_{i}^{1}PID_{i}^{1}\), and \(PSK_{i}^{2}=m_{i}^{2}H(PID_{i}^{1},PID_{i}^{2})\), where \(RID_{i}\) is vehicle real identity, \(PID_{i}=(PID_{i}^{1},PID_{i}^{2})\) is the pseudonym of vehicle, \(PSK_{i}=(PSK_{i}^{1},PSK_{i}^{2})\) is the corresponding private key. The signatures of message \(M\) are computed: \(\sigma_{i}=PSK_{i}^{1}+h(M)PSK_{i}^{2}\). Then, \(PID_{i}\), \(M\), \(PK_{R_{i}}\), and \(\sigma_{i}\) are sent to RSU. When receiving the message, RSU checks the equation \(e(\sigma_{1},P)==e(PID_{i}^{1},RPK_{i}^{1})e(h(M)H(PID_{i}^{1}||PID_{i}^{2}), RPK_{i}^{2})\). If the equation holds, the signature is legal; otherwise, the RSU rejects it. Consequently, the computational cost of LIAP consists of six point-multiplication operations, three bilinear pairing operations, and three hash-to-point operations in \(G_{1}\). In PAS, vehicle needs to generate its signature \(Sign_{v}=Sign_{BLS}Sk_{v}^{i}\{PS_{v}^{i},TS,N\}\), where \(Sign_{v}=SK_{v}^{i}H_{1}(PS_{v}^{i}||TS||N)\). When receiving the signature, RSU checks \(e(P,Sign_{v})\) == \(e(PK_{v}^{i},H_{1}(PS_{v}^{i}||TS||N))\) to verify the legality of vehicle. Thus, the communicational cost includes one point multiplication-operation, two bilinear pairings operations, and two map-to-point hash function operations in \(G_{1}\). The computational cost of each scheme is shown in Table 4. We can see that PAS owns the lowest computational cost compared with other ones.