###### Abstract
Data privacy includes driver-related data (e.g., the identity of the driver) and vehicle-related data (e.g., vehicle id, current location, itinerary, trip routes or any other kind of information that may lead to driver/vehicle profiling [5]. Besides anonymity, _unlinkability_ and _untraceability_ are additional privacy concerns. Although it is possible to hide the identity of a node using pseudonyms, if an adversary is able to link different messages with a single pseudonym, then it is relatively easy to trace the itinerary of a unique vehicle and ultimately reveal the actual identity, using other out-of-band information. Researchers have examined a wide variety of attacks in the past that proved to have an effect both on the vehicle/driver privacy and on road safety [6]. Examples of such attacks are Denial of Service (DoS) [7], sybil attacks [8, 9], wormhole attacks [10, 11], illusion attacks [12] and purposeful attacks [13]. In the case of sybil attacks, malicious nodes may using fake identities in order to send false information multiple times, thus misleading RSUs on accepting this information as valid. In other cases, malicious nodes may attempt to abuse anonymity in order to mislead RSUs to accept information from forged nodes. Obviously vehicle privacy and VANET security are orthogonal issues, since privacy may be abused to violate VANET communication security and vise versa. Thus, achieving both security and privacy in VANET is still a challenging problem. _Contribution._ We propose a distributed model that provides strong privacy and security guarantees for all nodes in V2I communications. Our main contributions involve:  
1. _Trust distribution._ To avoid strong trust assumptions for a single TMA authority, our model assumes two independent _honest but curious_ authorities: a _Credential Authority_ (CA) who is responsible for issuing/revoking credentials for vehicles; and a _Signing Authority_ (SA) who is responsible to anonymously authenticating messages of authorized vehicles. 2. _Enhanced conditional privacy preserving authentication_, since _all_ the involved entities (CA, SA and the relevant RSUs) need to collaborate, to trace a message back to a vehicle. 3. _Vehicle unforgeability and unframeability._ Even if all the entities (CA, SA and RSUs) collude, it is not possible to forge messages and/or frame a honest vehicle, by tracing a forged message back to an honest vehicle. 4. _Efficient Revocation._ Revocation will be equivalent to the deletion of an encrypted credential, stored in an anonymous credential list. Revocation management is significantly more efficient in comparison with the use of certificate revocation lists. Our scheme makes use of crypto building blocks like bilinear pairings, All-or-Nothing Public Key Encryption with Equality Tests (AoN-PKEET), Non-Interative Zero Knowledge Proofs (NIZKP) and partially blind signatures. However, the communication protocol does not require heavy crypto operations for the vehicles. To achieve unframeability and impersonation protection, each vehicle selects a random number upon registration, while for each V2I communication a zero knowledge proof of knowledge is used. The computational intensive operations like pairings are performed by the SA, which can be equipped with advanced computing capabilities. Security is formally analyzed and is based on the security of the underlying primitives used such as bilinear pairings, partially blind signatures and NIZKP. _Paper Structure._ The remainder of this paper is organized as follows. In Section 2 we discuss the related work. In Section 3 we describe the proposed model. In Sections 4 and 5 we thoroughly analyze the security and the efficiency of our model respectively. Finally, in Section 6 we conclude the paper and we discuss the advantages, limitations and possible future extensions.