## 1 Introduction
### Related Work  
While various VANET applications have been emerging, studies on secure vehicular communications have also been widely performed [4; 8; 9; 10; 11; 12; 13; 14; 15; 16]. One of the challenging issues is privacy-preserving vehicular communications for protecting location privacy of vehicles in VANETs. To prevent a global eavesdropping attacker from tracking a target vehicle, most privacy-preserving secure vehicular communications recommend using anonymous authentication schemes based on a group signature or pseudonymous credentials of vehicles when exchanging messages [17]. In addition to sender's anonymity, to achieve message receiver's location privacy preservation in VANETs, [PERSON] et al. [18] and [PERSON] et al. [19] proposed secure RSU-assisted message delivery protocols from a source vehicle to a destination vehicle, respectively. However, their work assumes that a receiver vehicle is stationary at a fixed location [18] and the location of a receiver is already known to senders beforehand [19]. For efficient message delivery from an RSU to moving vehicles in VANETS, [PERSON] et al. proposed an architecture for trajectory-based data delivery [7]. Their work was not focused on security mechanisms for protecting location privacy of vehicles. Instead, they just assume that a control center maintains vehicle trajectories and will not expose the trajectory data to others. In their system,  
Figure 1: Service scenario of trajectory-based message delivery. we cannot help but rely on the control center that the center will carry out its role faithfully. However, from user's viewpoint, the control center may be also a source of concern and users want to control who can access their trajectory data by themselves with a proper security mechanism. With regard to secure location-sharing in mobile environments, the works in [20; 21; 22; 23; 24] proposed some methods to protect user's privacy for location-sharing in mobile online social network services. They are mainly focused on a proximity application to find a nearby friend whose current location is within some distance. Some previous work did not consider preventing a service provider from accessing user's locations data except the work of [20; 24]. Even though a service provider is usually involved in location sharing services to distribute the location data of one user to other authorized users, the provider does not need to know the data content. [PERSON] et al. [20] and [PERSON] et al. [24] proposed a system for protecting user location data from the provider by using data encryption, respectively. However, if a user wants to share his/her location data with multiple friends, the user has to generate multiple encrypted data for the same location data under a different key of each friend or needs interactions to establish a shared secret key with his friends. It burdens the user with computation and communication overheads proportional to the number of friends. [PERSON] et al. introduced a concept of secure location-sharing based on a proxy re-encryption scheme for mobile applications [25]. Proxy re-encryption is a cryptographic technique to allow a semi-trusted proxy to convert a ciphertext under one party's public key (e.g., \(\mathrm{V_{d}}\) in our scenario) into a new ciphertext under another party's public key (e.g., sRSU designated by \(\mathrm{V_{d}}\)). While the proxy uses re-encryption keys to perform the conversion, the proxy cannot learn any information about the underlying plaintext. [PERSON] et al. presented an idea that a user can efficiently share its location data with other users as shifting computational overheads for distributing encrypted location data to a proxy, and their idea motivated our work. However, if we adopt an ordinary public key based proxy re-encryption scheme, sRSU has to be involved in generating a re-encryption key to be used for converting a ciphertext by giving its public key certificate to \(\mathrm{V_{d}}\).