# Enabling Trustworthy Multicast Wireless Services through D2D Communications in 5G Networks
## 4 The Proposed eCMS-sD2D Protocol
Thus, it randomly selects \(a\in Z_{q}^{*}\) and computes \(u=g^{a}\) as the first public key for generating the secret key \(k_{s}\) to use in the exchange of private messages with the selected D2D transmitter (i.e., the RN). To communicate to \(UE_{j}\), which has been chosen as RN of the D2D communication, the eNB sends to it the following message:  
\[PID_{j}||PID_{i}||z||u||P_{i}||h(\bullet,x_{j}). \tag{8}\]  
Simultaneously, to acknowledge the reception of the initialization message, the eNB sends to \(UE_{i}\) a response message with PID and public key of the selected RN:  
\[PID_{i}||PID_{j}||X_{j}||P_{i}||h(\bullet,x_{i}). \tag{9}\]  
_Step 7--Data transmission_  
First of all, the eNB must sign data to send to devices with \(\sigma_{1}\):  
\[\sigma_{1}=H_{1}(P_{i}||M)^{x_{0}}, \tag{10}\]  
where \(H_{1}\) is a secure hash function, \(x_{0}\) is the private key of the eNB, and \(M\) is data to be transmitted. After that, it performs multicast transmission to users with the best channel conditions, using a Conventional Multicast Scheme (CMS). \(UE_{j}\), which has received data sent by the eNB, has to forward them to the previously notified D2D receiver. Then, it carries out all the operations aimed at the secure D2D communication. First of all, to allow the receiver to generate the secret key \(k_{c}\), it randomly selects \(b\in Z_{q}^{*}\) and computes \(y=g^{b}\) as the second public key for \(k_{c}\). It does not send \(y\) directly to the \(UE_{i}\), but it sends it to the eNB, randomly choosing \(f\in Z_{q}^{*}\), generating the secret key \(k_{s}=u^{f}=g^{af}\) and using it to encrypt the public key \(y\). Then, \(UE_{j}\) must encrypt data, so it generates the communication key \(k_{c}=z^{b}=g^{cb}\) and uses it to encrypt the data \(M\). After computing \(M^{\prime}=Enc_{k_{c}}(M)\), \(UE_{j}\) signs the message calculating:  
\[\sigma_{2}=H_{1}(PID_{j}||P_{i}||M^{\prime}||T_{s}||\sigma_{1})^{x_{j}}, \tag{11}\]  
where \(T_{s}\) is the timestamp used against the replay attack. Thus, the secure D2D communication takes place when the RN sends the following message to the receiver:  
\[PID_{i}||PID_{j}||P_{i}||M^{\prime}||T_{s}||\sigma_{1}||\sigma_{2}. \tag{12}\]  
_Step 8--Public key report_  
In order to allow the eNB to generate the secret key \(k_{s}\) used to encrypt the public key \(y\), \(UE_{j}\) computes \(v=g^{f}\) as the second public key for \(k_{s}\), using \(f\in Z_{q}^{*}\) chosen in the previous step. Thus, it sends to the eNB a report:  
\[PID_{i}||PID_{j}||P_{i}||Enc_{k_{s}}(y)||v||T_{s}||h(\bullet,x_{j}). \tag{13}\]  
_Step 9--Data check_  
After receiving data, \(UE_{i}\) first has to verify the identity of the transmitter. To this aim, it compares the \(PID_{j}\) reported on the message received by \(UE_{j}\) with that communicated by the eNB and, if the two do not match, the packet is dropped, otherwise it proceeds with the next steps. Thus, it checks the signature of the transmitter \(\sigma_{2}\) and, if it is valid, data are considered sent by the entity corresponding to \(PID_{j}\). Once the identity of the sender is verified, \(UE_{i}\) needs to generate the decryption key \(k_{c}\) to obtain the plaintext. To do this, it sends a public key request message to the eNB:  
\[PID_{i}||PID_{j}||P_{i}||T_{s}||h(\bullet,x_{i}). \tag{14}\]  
After receiving this message, the eNB decrypts the \(Enc_{k_{s}}(y)\), first generating the decryption key \(k_{s}\), and sends the response message to \(UE_{i}\):  
Figure 2:0  
where \(T_{i}\) is employed to record the feedback time. It is important to underline that, in the traditional DHKE algorithm, public keys are exchanged directly between the direct-communicating users. Instead, in sD2D-eCMS, the public keys' exchange is mediated by the eNB, which represents the trusted third party. This can help to avoid the man-in-the-middle attack. Thanks to the reception of the public key \(y\), \(UE_{i}\) can get the communication key by computing \(k_{c}=y^{c}=g^{bc}\). Thus, it can decrypt the message \(M^{\prime}\) to obtain the original data \(M\).