## 3 The Proposed Solution
### High Level Description  
Let \(\mathbb{V}=\{V\}\) and \(\mathbb{I}=\{RSU\}\) represent the set of VANET nodes (vehicles) and infrastructures (RSUs) respectively. We assume two independent honest-but-curious authorities. Let CA denote a certification authority for managing the long term credentials for the vehicles and for providing an AoN-PKEET. Let SA denote a Signing Authority, whose main role is to authenticate (by blindly signing) messages of anonymously authenticated vehicles. The RSUs will only accept messages sent by vehicles, only if the messages have been previously authenticated by the SA. Vehicles may send/receive messages from RSUs within range (e.g., traffic information, emergency events etc). The proposed scheme will achieve the security, privacy and efficiency properties described above for V2I communication. The protocol consists of the following four phases/protocols. **Phase 1 (Set Up):** During this phase the Credential Authority (CA) will publish all the system parameters, including the public encryption key of an AoN-PKEET scheme. In addition, the CA will securely transfer to the Signing Authority (SA) the trapdoor information \(tk\), to allow the SA to perform equality tests on messages encrypted with the AoN-PKEET scheme. It is important to note that although in our set up we assume a single CA, extending the CA to a threshold setting is straightforward. The underlying AoN-PKEET scheme can be easily extended to a threshold scenario, where the role of the CA is distributed to multiple entities and a majority of CAs is needed for decryption. **Phase 2 (Registration):** Registration is an ongoing phase and allows new vehicles to dynamically join. For each new vehicle \(V\) generates a unique identified \(ID\), is chosen by the CA and it is AoN-PKEET encrypted by \(V\), using the AoN public key of the CA. The randomness used for the encryption is not revealed to the CA and will be later used by the vehicle, to provide a NIZKP of the assigned \(ID\). The vehicle also receives from the CA signed proofs on the registration parameters. The CA will forward the encrypted credential to the SA, who will append this to a private list \(BB_{SA}\) containing the encrypted credentials of all registered users. The scheme allows SA to perform tests on encrypted messages and determine if they origin from the same original message. Thus SA can determine if a user is indeed a member of the authorized users of the protocol by blindly checking if the users' encrypted credential belongs to a list of encrypted credentials of all authorized users. **Phase 3 (Secure communication):** During the secure communication phase, a registered vehicle \(V\) will communicate with the SA in order to authorize the message to be send to the RSU via a partially blind signature. As described in Section 3.1, messages in partially blind signatures schemes, an input message \(\mathcal{M}=(m,m^{\prime})\) has two parts: the message to be blinded and an unblinded part with a predefined structure. In our scheme the structure of the unblinded part is defined as \(m^{\prime}=t_{cur}||rand\), consisting of the current time, concatenated with a randomness that is computed in a predefined way and will serve as the challenge of the NIZKP. Efficiency of the scheme is improved by applying methods presented in [58]. The vehicle will first provide to the SA a fresh AoN-PKEET encryption and an NIZKP of its credential. The SA will use the private list \(BB_{SA}\) of the encrypted credentials, to check if a match is found with a freshly encrypted credential provided by \(V\). In that case, the SA will blindly sign the message that \(V\) wants to send to the RSU. **Phase 4 (Revocation):** When needed, the revocation phase will be executed, to anonymously revoke a counterfeit, misused or compromised credential. According to a predefined policy, revocation will be equivalent to the deletion of the encrypted credential stored in the private list \(BB_{SA}\) maintained by the SA.