# An Anonymous Signature-Based Authentication and Key Agreement Scheme for Vehicular Ad Hoc Networks

Authors: Azees M; Arun Sekar Rajasekaran; Muhammad Islam Satti
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Anonymous authentication is a critical step in safeguarding vehicle privacy and security in VANETs. VANETs connected with blockchain are gaining popularity as a means to increase the effectiveness of anonymous authentication across many security domains. However, present blockchain-assisted authentication systems cannot successfully achieve anonymity since colluding RSUs or vehicles may acquire linkability via the same retrieved record, hence destroying anonymity. To solve the problem, the proposed work offers an unlinkable anonymous signature-based authentication for VANET to ensure collusion resistance. To provide V2R unlinkability, a trusted authority issues anonymous parameters that conceal the vehicle's identification from RSUs and other vehicles in the VANET system. The vehicle user produces anonymous signatures, and RSUs validate them during anonymous authentication. Moreover, the proposed authentication methods are based on an anonymous certificateless signature (ACS) approach that is computationally more efficient and provably safe against eternal forgery in the random oracle model. Additionally, the proposed work guarantees that neither an RSU nor a vehicle has the authority to divulge users’ true identities. Hence, the proposed system has stringent unlinkability and better anonymity, and it enhances the efficiency of V2R and V2V communications considerably according to security analysis and performance assessment.


---

## Body

## 1. Introduction

Vehicular ad hoc networks (VANETs) are a vital part of the intelligent transportation system (ITS). VANETs are composed of trusted authority (TA), roadside units (RSUs) that are spread along the road, and the vehicles that are embedded with OBUs. VANET offers current traffic data (e.g., congested state) and driving situations (e.g., position and speed) through vehicles to RSU (V2R) and vehicle to vehicle (V2V) communications to help the users to cope with crises and reduce accidents. Traffic management may also gather traffic situations through RSUs in order to respond in a timely manner, such as altering traffic signals, to improve the efficiency and safety of vehicle transport. Vehicles transmit traffic conditions and driving status information on a regular basis, according to the approved IEEE standard, that is, IEEE 802.11p. Moreover, the source of the information must be authorized to avert malevolent vehicles from delivering fake and inaccurate road data for their benefit or impersonating other vehicles to conduct security attacks. Furthermore, the authentication message, on the other hand, should include anonymous data about the user vehicle’s identification to protect the vehicle’s privacy. Otherwise, if the communication is transmitted in normal plaintext, the vehicle user identity and privacy are compromised. Many studies have suggested anonymous authentication techniques based on pseudonyms for VANETs [1]. Unfortunately, just attaining anonymity is insufficient. This is due to the fact that if an intruder can connect different pseudonyms of a vehicle user, it may allow it to gather and study different parameters such as the address of the vehicle user, location of travel, and other data, so inventing the vehicle’s identity data even endangering the user’s security. As a result, both anonymity and unlinkability must be ensured. However, most current solutions just guarantee anonymity but neglecting unlinkability. In many authentication schemes [2–4] designed for VANETs, the TA serves as the management centre, generating anonymous authentication credentials for vehicles, like anonymous public keys, and also assisting in the completion of vehicles and RSU’s registration in its domain. To enable a diverse variety of Internet of vehicle networks, the TA must be dispersed in nature. Each TA is assigned to a domain, and it is in charge of governing vehicles within that domain. Researchers suggest a way of constructing a network model in such a way that all the TAs are interconnected with each other to improve the authentication effectiveness of vehicle users in many TA domains, which achieves sharing of vehicle registration details among all the TAs. When the vehicle user commences authentication, the respective TA may indirectly authenticate them with the support of locally locating RSUs. The RSUs in any TA area may request the vehicle for the V2R authentication in VANETs. RSUs also offer an interface for vehicles to contact the TA in case of disputes during V2V authentication in VANETs. But, in many of the anonymous authentication schemes, (1) RSUs are considered to be entirely trustworthy; however, various studies revealed that RSUs may be considered as an untrustworthy entity. (2) V2V verification of a vehicle in many places may also result in unlinkability failure. As a result, the attacker may accomplish linkability using the same authentication credentials received from the vehicle, monitoring the car, gathering and studying about vehicular data, and deducing the vehicle user’s uniqueness. As a consequence, the identity of the vehicle user cannot be entirely safeguarded, resulting in the loss of anonymity and the leaking of personal information. For unlinkability, three ways have been proposed: vehicle prestorage of various pseudonyms, exchange of pseudonyms, and synchronous derivation. However, these methods have flaws, such as high storage complexity and recurrent contact with a trusted party. Based on the issues in the earlier works, in this paper, an unlinkable anonymous signature-based authentication scheme is proposed with collusion resistance for VANETs to achieve unlinkability and counterattack RSU collusion. For V2R authentication, the vehicles create anonymous signatures, and these signatures are used by RSUs to validate vehicles. Among the remaining challenges, privacy leakage is a key source of worry for potential users, hindering the continued development and practical deployment of such networks. This problem is predominantly difficult in VANETs due to its unique properties, such as open wireless medium channel, signal noise, mobile vehicles, and dynamic infrastructure, which all contribute to the emergence of several new security vulnerabilities and threats. In other words, genuine users should be able to retain their privacy to the fullest extent possible. An anonymous signature-based authentication system, which is discussed in this article, is one of the best ways to do this. In summary, the followings are the important contributions of this work: (1) we devise an efficient V2R authentication scheme based on an anonymous signature scheme, which prevents vehicular pseudonyms in authentication messages from being linked; (2) a security study reveals that our technique increases unlinkability and anonymity. Furthermore, simulated studies conducted by CYGWIN-based PBC library reveal that the efficiency of the V2R and V2V phases is increased with reference to computational cost when compared to the most competitive methods.The remainder of this work is organised as follows. Section2 examines the related anonymous authentication mechanisms. Section 3 discusses the preliminaries. Section 4 describes the suggested protocol. Section 5 examines the protocol's accuracy in terms of security. Section 6 assesses the proposed protocol’s performance. Finally, Section 7 provides a summary of the study.


## 2. Related Work

Many academics have concentrated on building secure, anonymized, and effective VANET technologies in order to cope with the difficulty of VANETs. The major key agreement protocols are PKI-based, id-based, and password-based protocols based on key agreement. The Diffie–Hellman key agreement [5] was proposed by Diffie and Hellman in 1976. At a given moment, the system creates a temporary session key that is only valid for the duration of the particular session in which it was generated and expires once the session gets completed. The key agreement protocol, on the other hand, will be quite busy if numerous communication sessions are started at the same time. Burmester and colleagues [6] suggested a group key management technique based on two rounds in 1995. Choi et al. [7] proposed an id-based secure group key agreement scheme in 2004. Later, the authors revised this paper in 2008 [8], proposing an id-based secure group key agreement approach to safeguard against impersonation security assaults. However, Wu et al. [9] noted in 2009 that the upgraded work was still vulnerable to internal collusion assaults. Huang et al. [10] implemented anonymous group authentication and key agreement scheme in 2011, allowing many vehicles to concurrently authenticate requests and create session keys. Lai et al. [11] introduced a significant authentication mechanism in 2018 which uses message authentication code technology to withstand a denial-of-service attack. Mahmood et al. [12] introduced a novel multiparty key strategy that uses a one-way hash function provided by chaotic maps, and public multiparty keys are established using Chebyshev polynomials. Zhang et al. [13], in a paper published in 2019, suggested a key agreement procedure based on orientable features. Ma et al. [14] suggested a new key authentication scheme that does not need bilinear pairings in 2019. Not only does the technique provide reciprocal authentication and safe session key concession but it also protects privacy.Vehicles utilise many pseudonyms to give authentication unlinkability. Three approaches for creating a large number of different pseudonyms are described as follows. One of the primary approaches is to accumulate multiple pseudonyms [15]. It permits vehicle users to obtain multiple pseudonyms from a reliable TA during the registration process [16]. To enable the authentication mechanism, the user needs to preload multiple pseudonyms [17]. According to Raya et al. [18], the vehicle should have multiple preloaded anonymous public key values which should be used within a year and then expire. They [19] also remind us that if a vehicle is driven for 2 hours every day, 43 800 pseudonyms are needed. As a result, the drawback of this technique is that the pseudonym credentials and private keys take a lot of storage space in the vehicles. Since it avoids the need for vehicles to hold significant amounts of pseudonyms and secret keys, pseudonym sharing has gained in popularity. Wang et al. [20] used RSU to trade pseudonyms with 1-hop neighbours. As part of its pseudonym exchange operation, RSU would have to convey the request message to TA, and TA used to have to update its mapping database. At each pseudonym exchange, RSU selected two vehicles at random to switch, and it informed TA of the outcome so that the pseudonym mapping could be updated. Li et al. [21] strengthened the unlinkability of pseudonyms and increased the constraints for choosing vehicles to interchange pseudonyms by applying differential privacy. They continued to depend on RSU to complete the pseudonym transition. The foremost disadvantage of this system is that it relies on a trusted authority to conduct the pseudonym exchange procedure and to constantly update the mapping link to guarantee pseudonym management and vehicle tracking. Jiang et al. [22] suggested that a shared secret seed was used to simultaneously produce a very similar pseudonym between the TA and the vehicles for successive authentication to minimize communication overhead. On the downside, they required the TA to do real-time synchronous online derivation. He et al. [23] were able to allow the vehicle to produce many pseudonyms by inserting a tamper-proof mechanism within the seed. Vijayakumar et al. [24] used a tamper-proof device to disseminate diverse private and public keys for the users of vehicles or generate random numbers like temporary session keys to break the link among anonymous signatures. In the V2R and V2V stages, we achieve unlinkability by gathering numerous decrypted coupons in the blockchain and self-generating numerous vehicle pseudonyms.


## 3. Preliminary

In this section, some preliminary mathematical notations and bilinear pairing used in the proposed work are initially recalled.


### 3.1. Notations

In order to undoubtedly understand this proposed work, the cyphers used in this article are given in Table1.Table 1
Notations and descriptions.
NotificationDescriptionqLarge prime numberG1,G2, G2Multiplicative groupseBilinear mapmPrivate key value of the TAPTAPublic key value of the TADI4Dummy identity of the userΝPrivate key of the userPuPublic key of the userPPKPartial private key value of the TAfPKFull private key value of the TAAcAuthentication codeτAnonymous signaturer1,r2,ρ,r3,r4,Zc,r5Temporary parameters calculated by the user


### 3.2. Bilinear Pairing

Let us considerG1 and G2 are the multiplicative groups of prime order p. Let Zq∗ be the multiplicative group of the finite field Fp. A bilinear map e:G1∗G2⟶G2, that obeys the given three important properties.


#### 3.2.1. Bilinearity Principle: for anyK,L,M∈G1

(1)eK,L+M=eK,LeK,MandeK+L,M=eK,MeL,M.


#### 3.2.2. Nondegeneracy

For any nonidentify pointsU,V∈G1, eU,V≠1G2, where 1G2 is the identity point of G2


#### 3.2.3. Computability

For any two pointsU,V∈G1, there is a polynomial time procedure to find the value of eU,V.


### 3.3. System Model

The suggested scheme’s system model is shown in Figure1, which is made up of three components namely the trusted authority (TA), roadside units (RSUs), and the vehicles furnished with on-board units (OBUs).(i)
Two-level architecture model: the TA, RSUs, and vehicle users are the components of the VANET, and the TA serves like a manager for the VANET. Every RSU forms a small group with the vehicles in its coverage area, and the RSU distributes the local coverage area information to the vehicles in that region.(ii)
TA :  the TA creates and distributes the VANET system parameters, real and dummy identities for vehicles, and RSUs during the time of registration. The TA is accountable for the registration of all vehicles and RSUs in the VANET system. Moreover, the TA can produce some public and secret keys for the RSUs and the vehicles. Moreover, the TA is like a trusted agency, and it will never compromise with anyone.(iii)
RSUs :  RSUs are stationed along the roadside. Each RSU is in charge of managing a local coverage region, and the RSU’s work is to provide local coverage area information to the vehicles in that same region. RSUs are considered as semitrusted agency.(iv)
Vehicles: vehicles with an OBU are thought to have restricted storage and compute capabilities. In addition, each vehicle should have a (GPS) global positioning system, and the time between cars should be generally synchronised.Figure 1
VANET system model.


## 3.1. Notations

In order to undoubtedly understand this proposed work, the cyphers used in this article are given in Table1.Table 1
Notations and descriptions.
NotificationDescriptionqLarge prime numberG1,G2, G2Multiplicative groupseBilinear mapmPrivate key value of the TAPTAPublic key value of the TADI4Dummy identity of the userΝPrivate key of the userPuPublic key of the userPPKPartial private key value of the TAfPKFull private key value of the TAAcAuthentication codeτAnonymous signaturer1,r2,ρ,r3,r4,Zc,r5Temporary parameters calculated by the user


## 3.2. Bilinear Pairing

Let us considerG1 and G2 are the multiplicative groups of prime order p. Let Zq∗ be the multiplicative group of the finite field Fp. A bilinear map e:G1∗G2⟶G2, that obeys the given three important properties.


### 3.2.1. Bilinearity Principle: for anyK,L,M∈G1

(1)eK,L+M=eK,LeK,MandeK+L,M=eK,MeL,M.


### 3.2.2. Nondegeneracy

For any nonidentify pointsU,V∈G1, eU,V≠1G2, where 1G2 is the identity point of G2


### 3.2.3. Computability

For any two pointsU,V∈G1, there is a polynomial time procedure to find the value of eU,V.


## 3.2.1. Bilinearity Principle: for anyK,L,M∈G1

(1)eK,L+M=eK,LeK,MandeK+L,M=eK,MeL,M.


## 3.2.2. Nondegeneracy

For any nonidentify pointsU,V∈G1, eU,V≠1G2, where 1G2 is the identity point of G2


## 3.2.3. Computability

For any two pointsU,V∈G1, there is a polynomial time procedure to find the value of eU,V.


## 3.3. System Model

The suggested scheme’s system model is shown in Figure1, which is made up of three components namely the trusted authority (TA), roadside units (RSUs), and the vehicles furnished with on-board units (OBUs).(i)
Two-level architecture model: the TA, RSUs, and vehicle users are the components of the VANET, and the TA serves like a manager for the VANET. Every RSU forms a small group with the vehicles in its coverage area, and the RSU distributes the local coverage area information to the vehicles in that region.(ii)
TA :  the TA creates and distributes the VANET system parameters, real and dummy identities for vehicles, and RSUs during the time of registration. The TA is accountable for the registration of all vehicles and RSUs in the VANET system. Moreover, the TA can produce some public and secret keys for the RSUs and the vehicles. Moreover, the TA is like a trusted agency, and it will never compromise with anyone.(iii)
RSUs :  RSUs are stationed along the roadside. Each RSU is in charge of managing a local coverage region, and the RSU’s work is to provide local coverage area information to the vehicles in that same region. RSUs are considered as semitrusted agency.(iv)
Vehicles: vehicles with an OBU are thought to have restricted storage and compute capabilities. In addition, each vehicle should have a (GPS) global positioning system, and the time between cars should be generally synchronised.Figure 1
VANET system model.


## 4. Proposed Work

In this section, the proposed key agreement and anonymous signature-based authentication scheme are explained. The proposed work includes five sections namely system setup, user registration, anonymous signature generation, anonymous authentication, and conditional tracking.


### 4.1. System Setup

The TA initially chooses two multiplicative cyclic groupsG1 and G2 of prime order q and Q represents the generator of group G1. Moreover, the TA chooses a bilinear map e:G1∗G2⟶G2 and a hash function H:0,1∗⟶zq∗. After choosing these parameters, the TA computes a public parameter g=eQ,Q. Furthermore, the TA selects a random value m∈zq∗ and computes its own public key as PTA=mQ. Here, the random value m is considered as the private key of the TA. Then, the TA publishes G1,G2,e,g,q,Q,PTA,H as the system public parameters.


### 4.2. User Registration

Initially, all the VANET users are required to submit the original credentials to VANET for registration. Then, the TA produces the public and private key pair for each registered user as follows:(i)
The TA first assigns a dummy identityDIu to each user(i)
Then, the TA selects a random integerv∈zq∗ and computes the public key for the user as Pu=HDIuvQ.After computing the public key to the user, the TA gives the public and private key pair to the VANET user. However, the private keyv should be kept secret by the VANET user. In addition, the TA calculates the partial secret key for the vehicle user as(2)PPk=HPu+m−1Q.After computing the valuePPk, the TA computes the full secret key for the VANET user as(3)fPk=v−1PPk.Finally, the TA returnsfPk,Pu,DIu,v,Ac to the vehicle user in the offline mode. In these parameters, Ac represents the authentication code, and it is calculated as(4)Ac=v−1m−1Q.


### 4.3. Anonymous Signature Generation

After the successful registration only, the registered vehicle users can communicate with the RSUs and other vehicles. However, the RSUs and other vehicles initiate the anonymous authentication to ensure the legitimacy of the particular vehicle before going to make communication with that vehicle. To prove its validity to the other vehicles or RSUs, a vehicle user computes some temporary parameters as follows:(5)r1=vPTA,r2=HPuvQ,ρ=gywhereyϵZq∗,r3=γ−1fPkwhereγϵZq∗,r4=Hm,ρwhere m is the message,r5=y+r4γmodq,Zc=r5−1Ac.By calculating these parameters, a vehicle user can set its anonymous signature as(6)τ=r1,r2,m,r3,r4,r5,Zc.


### 4.4. Anonymous Authentication

By receiving these parameters, other vehicle users or an RSU can check the following two conditions to ensure the legitimacy of the message transmitting vehicle.(7)eZc,r5r1=g,r4=Hm,eSc,r1+r2g−r4.Here,Sc=r3.r5. If these two conditions are valid, then the signature τ is valid, and hence, the vehicle user is authenticated, and otherwise, the user is rejected.Proof of correctness is as follows:(8)eZc,r5r1=er5−1Ac,r5r1=er5−1v−1m−1Q,r5vmQ=eQ,Qr5−1r5vm−1v−1m=eQ,Q=g,Sc=r3.r5=γ−1fPky+r4γ=fPky+r4=v−1PPky+r4=v−1HPu+m−1Qy+r4=y+r4vHPu+mQ,r1+r2=vPTA+HPuvQ=HPuvQ+vmQ=HPu+mvQ,eSc,r1+r2=ey+r4QvHpu+m,HPu+mvQ=eQ,Qy+r4=gy+r4Hm,eSc,r1+r2g−r4=Hm,gy+r4g−r4=Hm,gy=Hm,ρ=r4.


## 4.1. System Setup

The TA initially chooses two multiplicative cyclic groupsG1 and G2 of prime order q and Q represents the generator of group G1. Moreover, the TA chooses a bilinear map e:G1∗G2⟶G2 and a hash function H:0,1∗⟶zq∗. After choosing these parameters, the TA computes a public parameter g=eQ,Q. Furthermore, the TA selects a random value m∈zq∗ and computes its own public key as PTA=mQ. Here, the random value m is considered as the private key of the TA. Then, the TA publishes G1,G2,e,g,q,Q,PTA,H as the system public parameters.


## 4.2. User Registration

Initially, all the VANET users are required to submit the original credentials to VANET for registration. Then, the TA produces the public and private key pair for each registered user as follows:(i)
The TA first assigns a dummy identityDIu to each user(i)
Then, the TA selects a random integerv∈zq∗ and computes the public key for the user as Pu=HDIuvQ.After computing the public key to the user, the TA gives the public and private key pair to the VANET user. However, the private keyv should be kept secret by the VANET user. In addition, the TA calculates the partial secret key for the vehicle user as(2)PPk=HPu+m−1Q.After computing the valuePPk, the TA computes the full secret key for the VANET user as(3)fPk=v−1PPk.Finally, the TA returnsfPk,Pu,DIu,v,Ac to the vehicle user in the offline mode. In these parameters, Ac represents the authentication code, and it is calculated as(4)Ac=v−1m−1Q.


## 4.3. Anonymous Signature Generation

After the successful registration only, the registered vehicle users can communicate with the RSUs and other vehicles. However, the RSUs and other vehicles initiate the anonymous authentication to ensure the legitimacy of the particular vehicle before going to make communication with that vehicle. To prove its validity to the other vehicles or RSUs, a vehicle user computes some temporary parameters as follows:(5)r1=vPTA,r2=HPuvQ,ρ=gywhereyϵZq∗,r3=γ−1fPkwhereγϵZq∗,r4=Hm,ρwhere m is the message,r5=y+r4γmodq,Zc=r5−1Ac.By calculating these parameters, a vehicle user can set its anonymous signature as(6)τ=r1,r2,m,r3,r4,r5,Zc.


## 4.4. Anonymous Authentication

By receiving these parameters, other vehicle users or an RSU can check the following two conditions to ensure the legitimacy of the message transmitting vehicle.(7)eZc,r5r1=g,r4=Hm,eSc,r1+r2g−r4.Here,Sc=r3.r5. If these two conditions are valid, then the signature τ is valid, and hence, the vehicle user is authenticated, and otherwise, the user is rejected.Proof of correctness is as follows:(8)eZc,r5r1=er5−1Ac,r5r1=er5−1v−1m−1Q,r5vmQ=eQ,Qr5−1r5vm−1v−1m=eQ,Q=g,Sc=r3.r5=γ−1fPky+r4γ=fPky+r4=v−1PPky+r4=v−1HPu+m−1Qy+r4=y+r4vHPu+mQ,r1+r2=vPTA+HPuvQ=HPuvQ+vmQ=HPu+mvQ,eSc,r1+r2=ey+r4QvHpu+m,HPu+mvQ=eQ,Qy+r4=gy+r4Hm,eSc,r1+r2g−r4=Hm,gy+r4g−r4=Hm,gy=Hm,ρ=r4.


## 5. Security Analysis

In this section, the proposed work’s security is examined in terms of forgery, impersonation, message alteration, and replay attacks.


### 5.1. Forgery

Suppose the user is giving only one conditionr4=Hm,eSc,r1+r2g−r4 for the legitimacy verification by the other users, then an adversary follows the following steps to construct the anonymous signature of any message without knowing the partial private key value of the user. To forge any signature, an adversary randomly chooses r,K,β,α∈Zq∗ and computes the temporary parameters as follows:(9)r4=Hm,gr,r5=β,Sc=KQ,r3=r5−1KQ,σ=r4+r,r1=αQ,r2=σK−1Q−αQ.Here,r1+r2=σK−1QThen, an adversary fixes the signature asr1,r2,r4,r5 for the message m. By receiving this signature, an RSU can check whether the following condition is satisfied or not:(10)r4=Hm,eSc,r1+r2g−r4.If it is satisfied, the adversary is successfully authenticated. Otherwise, it will be rejected. However, as per the temporary parameters taken by the adversary, the following condition will be satisfied, and hence, the proposed work will be vulnerable to forgery.Proof of correctness is as follows:(11)Hm,eSc,r1+r2g−r4=Hm,eKQ,αQ+σK−1Q−αQg−r4=Hm,eKQ,σK−1Qg−r4=Hm,eQ,σQKK−1g−r4=Hm,eQ,σQg−r4=Hm,eQ,Qσg−r4=Hm,gσ−r4p=Hm,gr=r4.Based on the above proof of correctness, it is successful for an adversary to generate the signature of any message of the registered user. Since the conditionr4=Hm,eSc,r1+r2g−r4 is satisfied, the adversary can be successfully authenticated by the RSU. To overcome this issue, in this proposed work, one more condition is given for legitimacy verification by the user. Suppose if an adversary tries to forge the condition eZc,r5r1=g, the adversary needs to generate the Ac and Pu values which are given by the TA. Therefore, it is infeasible for an adversary to forge the condition eZc,r5r1=g. Therefore, this proposed work can withstand against forgery attacks.


### 5.2. Impersonation Attack

An attacker attempts to impersonate a genuine user of the RSUS and other vehicles in this assault. The adversary must get theAc from the TA in order to launch the impersonation assault because the TA provides the user with the authentication code Ac in this suggested system. As a result, in order to mimic, the adversary must know the user's Ac. Moreover, to pass the authentication, the adversary should satisfy the condition eZc,r5r1. However, it is not possible for the adversary to compute the value Zc without knowing the value of Ac. In addition, Ac is computed with the private key value of the user and the TA. Therefore, it is practically impracticable for the attacker to impersonate as a valid vehicle user.


### 5.3. Message Integrity Preservation

In V2V communication, the registered vehicle can send a messageM in the anonymous signature itself. Let us consider the message M, which is eavesdropped on and changed as M′ by an adversary. In that case, the r4 which is generated with the support of the hash function is also changed with the message. Let us denote the changed r4 value as r4′, and it is represented as H′M,e. To be authenticated by the other vehicles, an adversary should then satisfy the condition r4′=HM′,eSc,r1+r2g−r4′. However, it is not possible for an adversary to calculate r4′ without knowing random number e. Suppose if the adversary choosing any random number xϵZq∗ and computes H′M,x, then the value of r5 should be modified. If r5 is modified, then it is required to modify Zc for the adversary. However, it is not possible for an adversary to modify Zc because the Zc value is calculated with the support of the Ac which was given to the user by the TA during the offline registration procedure. Hence, message tampering attacks have no effect on the proposed technique.


### 5.4. Traceability

Suppose an authenticated vehicle is found for sending a malicious message to other entities like other vehicles or RSUs, then the TA can figure out the particular vehicle with the support of the Ac code attached in every anonymous signature of the message. Moreover, the value of r3 is calculated with the support of fPk of the user. Therefore, in case of any disputes, the TA can easily trace the vehicle and revoke it from the VANET system.


## 5.1. Forgery

Suppose the user is giving only one conditionr4=Hm,eSc,r1+r2g−r4 for the legitimacy verification by the other users, then an adversary follows the following steps to construct the anonymous signature of any message without knowing the partial private key value of the user. To forge any signature, an adversary randomly chooses r,K,β,α∈Zq∗ and computes the temporary parameters as follows:(9)r4=Hm,gr,r5=β,Sc=KQ,r3=r5−1KQ,σ=r4+r,r1=αQ,r2=σK−1Q−αQ.Here,r1+r2=σK−1QThen, an adversary fixes the signature asr1,r2,r4,r5 for the message m. By receiving this signature, an RSU can check whether the following condition is satisfied or not:(10)r4=Hm,eSc,r1+r2g−r4.If it is satisfied, the adversary is successfully authenticated. Otherwise, it will be rejected. However, as per the temporary parameters taken by the adversary, the following condition will be satisfied, and hence, the proposed work will be vulnerable to forgery.Proof of correctness is as follows:(11)Hm,eSc,r1+r2g−r4=Hm,eKQ,αQ+σK−1Q−αQg−r4=Hm,eKQ,σK−1Qg−r4=Hm,eQ,σQKK−1g−r4=Hm,eQ,σQg−r4=Hm,eQ,Qσg−r4=Hm,gσ−r4p=Hm,gr=r4.Based on the above proof of correctness, it is successful for an adversary to generate the signature of any message of the registered user. Since the conditionr4=Hm,eSc,r1+r2g−r4 is satisfied, the adversary can be successfully authenticated by the RSU. To overcome this issue, in this proposed work, one more condition is given for legitimacy verification by the user. Suppose if an adversary tries to forge the condition eZc,r5r1=g, the adversary needs to generate the Ac and Pu values which are given by the TA. Therefore, it is infeasible for an adversary to forge the condition eZc,r5r1=g. Therefore, this proposed work can withstand against forgery attacks.


## 5.2. Impersonation Attack

An attacker attempts to impersonate a genuine user of the RSUS and other vehicles in this assault. The adversary must get theAc from the TA in order to launch the impersonation assault because the TA provides the user with the authentication code Ac in this suggested system. As a result, in order to mimic, the adversary must know the user's Ac. Moreover, to pass the authentication, the adversary should satisfy the condition eZc,r5r1. However, it is not possible for the adversary to compute the value Zc without knowing the value of Ac. In addition, Ac is computed with the private key value of the user and the TA. Therefore, it is practically impracticable for the attacker to impersonate as a valid vehicle user.


## 5.3. Message Integrity Preservation

In V2V communication, the registered vehicle can send a messageM in the anonymous signature itself. Let us consider the message M, which is eavesdropped on and changed as M′ by an adversary. In that case, the r4 which is generated with the support of the hash function is also changed with the message. Let us denote the changed r4 value as r4′, and it is represented as H′M,e. To be authenticated by the other vehicles, an adversary should then satisfy the condition r4′=HM′,eSc,r1+r2g−r4′. However, it is not possible for an adversary to calculate r4′ without knowing random number e. Suppose if the adversary choosing any random number xϵZq∗ and computes H′M,x, then the value of r5 should be modified. If r5 is modified, then it is required to modify Zc for the adversary. However, it is not possible for an adversary to modify Zc because the Zc value is calculated with the support of the Ac which was given to the user by the TA during the offline registration procedure. Hence, message tampering attacks have no effect on the proposed technique.


## 5.4. Traceability

Suppose an authenticated vehicle is found for sending a malicious message to other entities like other vehicles or RSUs, then the TA can figure out the particular vehicle with the support of the Ac code attached in every anonymous signature of the message. Moreover, the value of r3 is calculated with the support of fPk of the user. Therefore, in case of any disputes, the TA can easily trace the vehicle and revoke it from the VANET system.


## 6. Performance Analysis

In the following section, we examine the performance of our proposed work in terms of computational cost, communication overhead, and RSU service provisioning capability.


### 6.1. Computational Cost

The computational cost is evaluated in terms of cryptographic operations involved in the suggested work. In order to perform the anonymous authentication and verification between the vehicle users and RSU, several cryptographic operations such as one point addition, E-xor operation, point multiplication, pairing, and hashing operations are used in the proposed protocol. The execution step up is carried out using CYGWIN software [25] installed in 4 GHz PC having 8 GB memory. The execution time for scalar multiplication Exm, one-point modular multiplication Expm, hashing operation Exh, pairing function Exp, and one-point addition Exa are calculated as 0.0212 ms, 2.226 ms, 0.0023 ms, 2.91 ms, and 0.011 ms. The proposed protocol is compared with the relevant similar schemes such as Zhou et al. [26], Kumar et al. [27], Wu et al. [28], and Qi et al. [29]. The total computational cost for executing the cryptographic operations for the single-vehicle user in the above schemes is 22.35ms, 18.32ms, 13.18ms, and 11.65ms, respectively, whereas the suggested work consumes only 8.05ms. On the basis of these estimates, it is noticeable that our proposed methodology requires less computation time than alternative schemes. Table 2 also indicates the computational cost of authenticating a large number of vehicle users. The graphical depiction of computing cost for various strategies is shown in Figure 2.Table 2
Computational time for relevant schemes.
SchemesVerification time forn number of vehicle user in ms′Zhou et al.12nExh+10nExpm+6nExaKumar et al.4nExp+2n+1Expm+n+1ExhWu et al.n+1Expm+n+1Exh+2n+1ExpQi et al.2n+1Exp+7nExh+nExpProposed schemen+1Exp+nExh+nExpm+nExmFigure 2
Computational time for different relevant schemes.


### 6.2. Communication Cost

The number of bits necessary to communicate information between the vehicle users and RSU is referred to as communication cost. In our suggested work, the vehicle user transfers the following parametersr1,r2,r3,r4,r5,M,Zc to the nearby RSU. Here, r1,r2,r3,Zc are the points belonging to the group G1. Moreover, r4 is the output of the hash function, and M is the message to be transferred. The elements of G1 and the output of the hash function consume 160 bits. The overall communication cost for the proposed work is 1120 bits. As indicated in Table 3, the proposed scheme communication analysis is compared to current relevant schemes such as Zhou et al. [26], Kumar et al. [27], Wu et al. [28], and Qi et al. [29]. A schematic diagram of communication analysis for so many schemes is shown in Figure 3.Table 3
Communication cost For relevant Schemes.
SchemesSingle vehicle user verification (bits)″n″ vehicle user verification (bits)Zhou et al.53125312nKumar et al.20802080nWu et al.54405440nQi et al.49804980nProposed scheme11201120nFigure 3
Communication cost for different relevant schemes.


### 6.3. RSU Serving Ratio

When more number of vehicle users arrived at the RSU, the service provided by RSU to the vehicle users is referred as RSU serving ratio. The performance of VANET is determined based on the RSU serving capability. In general phenomenon, after anonymous authentication among the user’s vehicles and the RSUs, the RSU sends the required location-based data to the vehicle users. It mainly depends on probability of the location-based data issued by RSUρ, computational cost for verifying the vehicle user z=n+1Exp+nExh+nExpm+nExm, density of the vehicle users n. RSU service-providing capability is given by RSUser=ρ/n∗Z∗n. Figure 4 shows the RSU service providing capability of the proposed work. Here, as the density of the vehicle user increases, the serving ratio decreases with the increase in the computational time.Figure 4
RSU service providing capability.


## 6.1. Computational Cost

The computational cost is evaluated in terms of cryptographic operations involved in the suggested work. In order to perform the anonymous authentication and verification between the vehicle users and RSU, several cryptographic operations such as one point addition, E-xor operation, point multiplication, pairing, and hashing operations are used in the proposed protocol. The execution step up is carried out using CYGWIN software [25] installed in 4 GHz PC having 8 GB memory. The execution time for scalar multiplication Exm, one-point modular multiplication Expm, hashing operation Exh, pairing function Exp, and one-point addition Exa are calculated as 0.0212 ms, 2.226 ms, 0.0023 ms, 2.91 ms, and 0.011 ms. The proposed protocol is compared with the relevant similar schemes such as Zhou et al. [26], Kumar et al. [27], Wu et al. [28], and Qi et al. [29]. The total computational cost for executing the cryptographic operations for the single-vehicle user in the above schemes is 22.35ms, 18.32ms, 13.18ms, and 11.65ms, respectively, whereas the suggested work consumes only 8.05ms. On the basis of these estimates, it is noticeable that our proposed methodology requires less computation time than alternative schemes. Table 2 also indicates the computational cost of authenticating a large number of vehicle users. The graphical depiction of computing cost for various strategies is shown in Figure 2.Table 2
Computational time for relevant schemes.
SchemesVerification time forn number of vehicle user in ms′Zhou et al.12nExh+10nExpm+6nExaKumar et al.4nExp+2n+1Expm+n+1ExhWu et al.n+1Expm+n+1Exh+2n+1ExpQi et al.2n+1Exp+7nExh+nExpProposed schemen+1Exp+nExh+nExpm+nExmFigure 2
Computational time for different relevant schemes.


## 6.2. Communication Cost

The number of bits necessary to communicate information between the vehicle users and RSU is referred to as communication cost. In our suggested work, the vehicle user transfers the following parametersr1,r2,r3,r4,r5,M,Zc to the nearby RSU. Here, r1,r2,r3,Zc are the points belonging to the group G1. Moreover, r4 is the output of the hash function, and M is the message to be transferred. The elements of G1 and the output of the hash function consume 160 bits. The overall communication cost for the proposed work is 1120 bits. As indicated in Table 3, the proposed scheme communication analysis is compared to current relevant schemes such as Zhou et al. [26], Kumar et al. [27], Wu et al. [28], and Qi et al. [29]. A schematic diagram of communication analysis for so many schemes is shown in Figure 3.Table 3
Communication cost For relevant Schemes.
SchemesSingle vehicle user verification (bits)″n″ vehicle user verification (bits)Zhou et al.53125312nKumar et al.20802080nWu et al.54405440nQi et al.49804980nProposed scheme11201120nFigure 3
Communication cost for different relevant schemes.


## 6.3. RSU Serving Ratio

When more number of vehicle users arrived at the RSU, the service provided by RSU to the vehicle users is referred as RSU serving ratio. The performance of VANET is determined based on the RSU serving capability. In general phenomenon, after anonymous authentication among the user’s vehicles and the RSUs, the RSU sends the required location-based data to the vehicle users. It mainly depends on probability of the location-based data issued by RSUρ, computational cost for verifying the vehicle user z=n+1Exp+nExh+nExpm+nExm, density of the vehicle users n. RSU service-providing capability is given by RSUser=ρ/n∗Z∗n. Figure 4 shows the RSU service providing capability of the proposed work. Here, as the density of the vehicle user increases, the serving ratio decreases with the increase in the computational time.Figure 4
RSU service providing capability.


## 7. Conclusion

This research proposes a signature-based secure and efficient authentication system for VANETs that not only meets security standards but also has a low computation cost for VANET elements. Due to its great efficiency, performance analysis and simulation reveal that the proposed work is feasible. Furthermore, the proposed work may be applied to other Internet of Things (IoT) applications such as autonomous vehicles and UAV communication networks, due to its improved security and efficiency. This work can be enhanced and developed in the future in three different ways. The first way is to add postquantum technologies like lattice-based algorithms to make it more resistant to quantum attacks. The second way is to extend the authentication algorithm to ensure the legitimacy of the RSUs also to enhance the security of the proposed work. The third way is to use the blockchain technology to decentralise our schemes. Additionally, an extensive VANET authentication system will be evaluated using test-bed technology.



---

*Source: 1222660-2022-07-18.xml*