# An Anonymous Authentication Scheme in VANETs of Smart City Based on Certificateless Group Signature

Authors: Yuanpan Zheng; Guangyu Chen; Liguan Guo
Journal: Complexity
 (2020)

---

## Abstract

With the change of the network communication environment in vehicular ad hoc networks (VANETs) of a smart city, vehicles may encounter security threats such as eavesdropping, positioning, and tracking, so appropriate anonymity protection is required. Based on the certificateless cryptosystem and group signature ideas, this paper proposes a certificateless group signature anonymous authentication scheme for the VANETs of a smart city. In this scheme, it can implement the process of adding, signing, verifying, and revoking group members only by simple multiplication of the elliptic curve and synchronization factor technology, which shortens the length of the signature and improves the efficiency of the signature. From the proofs of correctness and security, we know that it does not only has anonymity and traceability of the group signature scheme but also has unforgeability and forward security. According to the performance verification, this scheme has lower calculation overhead and higher authentication efficiency.


---

## Body

## 1. Introduction

Vehicular ad hoc networks (VANETs) [1] of a smart city, as a typical application of the Internet of Things technology, enable real-time traffic information interaction between vehicles and vehicles and between vehicles and the infrastructure. And, it has played a positive role in reducing traffic accidents and has been widely developed in the field of intelligent transportation. With the continuous change of the network environment, a variety of information security and privacy leakage issues have also emerged, seriously threatening the personal safety and personal privacy of vehicle users. Therefore, it is necessary to provide corresponding security policies, which can effectively protect the communication security and personal privacy of vehicle users while providing fast services for vehicle users.At present, anonymous authentication technologies in VANETs mainly include PKI-based authentication, identity-based authentication, and group signature-based authentication. In the early days, the public key infrastructure- (PKI-) based public key certificate scheme proposed by Raya and Hubaux [1] in 2007 was mainly used. This scheme requires a large number of public-private key pairings and related certificates to be stored in the vehicles. By occupying a large amount of storage space, it increases communication and computational overheads and causes certificate management problems. Shim [2] proposed an identity-based batch authentication scheme. The scheme uses a pseudonym to represent vehicle identity information and uses a pseudonym replacement strategy for each message signature to achieve message traceability. However, in this scheme, PKG knows the private keys of all users, so it is inevitable that the key escrow problem will occur.In 1991, Chaum and Heyst [3] first proposed the concept of the group signature. It allows group members to sign anonymously on behalf of the group. The group administrator is responsible for the creation and distribution of group member keys. The group members use group member certificates to sign on messages. The group public key is used to verify its authenticity. The verifier can only verify that the signer is from a member of the group but cannot determine the identity of specific members in the group, thereby protecting the group members’ identity. In addition, the group administrator can open the signature and reveal the true identity of the signing members to resolve the dispute. But, it is computationally infeasible to distinguish whether two different group signatures come from the same signer. Therefore, the group signature technology has been widely used, and it has been gradually introduced into the anonymous authentication scheme in VANETs [4–7]. Shao et al. [5] proposed a threshold anonymous authentication protocol capable of implementing batch authentication based on the group signature. Zheng et al. [6] introduced a lightweight group signature technology, which made the group public key and signature length fixed and did not depend on the number of group members. Zhao [7] proposed a revocable group signature scheme based on the Chinese remainder theorem in VANETs. When members join and revoke, they only need to regenerate a new group public key without changing the key pairings of other members, improving the efficiency of member joining and revoking. However, in these schemes, each member needs to generate a corresponding group member certificate, which will increase storage overhead and computational overhead.In 2003, Al-Riyami and Paterson [8] first proposed a certificateless cryptosystem. In the system, a part of the user key is provided by the key generation center and the rest is generated by the user to form the user key, which ensures that the key generation center does not know all the user’s private keys, and it solves the problem of certificate management in traditional public key cryptosystems and key escrow in identity-based cryptosystems. Based on the group signature technology, Chen et al. [9] and Li et al. [10] proposed different certificateless group signature schemes. At the same time, certificateless group signature schemes applied to VANETs have also been proposed [11–17], which has also become a hotspot in the security of VANETs. Zhang et al. [12] and Chen et al. [14] used bilinear pairings to study the application of the certificateless group signature in VANETs, avoiding the problem of key escrow, without the need for certificate management, effectively reducing the system storage load.However, the current certificateless group signature schemes are implemented with the help of bilinear pairing operations, which increases the overhead of the system operation. Therefore, this paper proposes a certificateless group signature scheme based on elliptic curves, which uses elliptic curves instead of bilinear pairings for operations. This scheme not only inherits the security and anonymity of group signature schemes but also greatly reduces the computational overhead. In particular, the introduction of the synchronization factor technology in this scheme makes it unnecessary to modify the public key information of the group administrator when the members in the group change. Only the group synchronization factor and group members’ synchronization factor are calculated and modified, which greatly reduces the calculation steps when group members join and revoke.


## 2. Preliminaries

### 2.1. System Model

In the general mode, the system model of VANETs consists of fixed RSUs (road side units) at the road side, mobile OBUs (on-board units) equipped in vehicles, and a TA (trusted authority), as shown in Figure1.Figure 1
The system model of VANETs.OBUs access the VANETs through the road side deployment infrastructure RSUs and periodically broadcast their own vehicle information to other vehicles, including safety information such as the location, speed, direction, acceleration, road conditions, traffic events, and time stamps, so that other OBUs can quickly obtain useful information on the road. RSUs can broadcast and receive some signature information in the group and provide various services for the OBUs. And, when needed, they reveal the real identification of some illegal vehicles and broadcast the identification information of revoked vehicles. RSUs have their own storage space and computing capabilities. The TA, as a third-party trusted agency in this scheme, saves the real identity information of OBUs and RSUs and generates public and private key pairings of OBUs and RSUs for identification in VANETs.


### 2.2. Elliptic Curve

The elliptic curve is an encryption algorithm in the current public key encryption system, and it is also the encryption algorithm that can provide the highest encryption strength for data. The encryption strength corresponding to the encryption calculation using the 160-bit key length is equivalent to the encryption length corresponding to the RSA algorithm using the 1024-bit key length in the public key encryption system. However, the elliptic curve has the characteristics of fewer calculation parameters, shorter key length, and faster operating speed. Therefore, it is appropriate to apply the elliptic curve encryption algorithm to the VANETs with limited computing capacity, storage space, and transmission bandwidth.Definition 1.
(elliptic curve definition). This scheme uses a 160-bit elliptical encryption algorithm. Assume thatq is a large prime number and Fq is a finite field of the module q. An elliptic curve over a finite field Fq can be defined as: E:y2≡x3+ax+bmodq, where a,b,x, and y∈FqandΔ=4a3+27b2≠0.Definition 2.
(addition of elliptic curves). Assume that the point of an elliptic curveP=x1,y1∈E, −P=x1,−y1 is the negative point of P, Q=x2,y2∈E,Q≠−P, the line l passes through P and Q, and it intersects the elliptic curve at a point R′=x3,−y3, The symmetrical point about the x-axis with R′ is R=x3,y3 and R=P+Q. The addition cyclic group of the prime order q on the elliptic curve E is Gq=x,y:a,b,x,y∈Fq,x,y∈Fq,a,b where G is a generator on the elliptic curve E and the scalar multiplication operation on the elliptic curve is kP=P+P+P+⋯+Pk,k∈Zq∗.Definition 3.
(elliptic curve discrete logarithm problem (ECDLP)). There are two pointsP1 and P2 on the elliptic curve E on the finite field Fq and there exists k∈Zq∗, such that P1=kP2; it is feasible to calculate P1 from k and P2, but it is not advisable to calculate k from P1 and P2.


## 2.1. System Model

In the general mode, the system model of VANETs consists of fixed RSUs (road side units) at the road side, mobile OBUs (on-board units) equipped in vehicles, and a TA (trusted authority), as shown in Figure1.Figure 1
The system model of VANETs.OBUs access the VANETs through the road side deployment infrastructure RSUs and periodically broadcast their own vehicle information to other vehicles, including safety information such as the location, speed, direction, acceleration, road conditions, traffic events, and time stamps, so that other OBUs can quickly obtain useful information on the road. RSUs can broadcast and receive some signature information in the group and provide various services for the OBUs. And, when needed, they reveal the real identification of some illegal vehicles and broadcast the identification information of revoked vehicles. RSUs have their own storage space and computing capabilities. The TA, as a third-party trusted agency in this scheme, saves the real identity information of OBUs and RSUs and generates public and private key pairings of OBUs and RSUs for identification in VANETs.


## 2.2. Elliptic Curve

The elliptic curve is an encryption algorithm in the current public key encryption system, and it is also the encryption algorithm that can provide the highest encryption strength for data. The encryption strength corresponding to the encryption calculation using the 160-bit key length is equivalent to the encryption length corresponding to the RSA algorithm using the 1024-bit key length in the public key encryption system. However, the elliptic curve has the characteristics of fewer calculation parameters, shorter key length, and faster operating speed. Therefore, it is appropriate to apply the elliptic curve encryption algorithm to the VANETs with limited computing capacity, storage space, and transmission bandwidth.Definition 1.
(elliptic curve definition). This scheme uses a 160-bit elliptical encryption algorithm. Assume thatq is a large prime number and Fq is a finite field of the module q. An elliptic curve over a finite field Fq can be defined as: E:y2≡x3+ax+bmodq, where a,b,x, and y∈FqandΔ=4a3+27b2≠0.Definition 2.
(addition of elliptic curves). Assume that the point of an elliptic curveP=x1,y1∈E, −P=x1,−y1 is the negative point of P, Q=x2,y2∈E,Q≠−P, the line l passes through P and Q, and it intersects the elliptic curve at a point R′=x3,−y3, The symmetrical point about the x-axis with R′ is R=x3,y3 and R=P+Q. The addition cyclic group of the prime order q on the elliptic curve E is Gq=x,y:a,b,x,y∈Fq,x,y∈Fq,a,b where G is a generator on the elliptic curve E and the scalar multiplication operation on the elliptic curve is kP=P+P+P+⋯+Pk,k∈Zq∗.Definition 3.
(elliptic curve discrete logarithm problem (ECDLP)). There are two pointsP1 and P2 on the elliptic curve E on the finite field Fq and there exists k∈Zq∗, such that P1=kP2; it is feasible to calculate P1 from k and P2, but it is not advisable to calculate k from P1 and P2.


## 3. Establishment of an Anonymous Authentication Scheme Based on Certificateless Group Signature

Design Idea. In this paper, the certificateless design idea is integrated into the scheme based on the group signature, which simplifies the member joining process and can resist public key replacement attacks. During the member joining process, the member A uses the private key to sign SKA, obtains the identity signature information hA, and sends IDAYAhAvAbA to RSU and RSU obtains A’s public key from TA to verify the identity information sent by A. It not only proves the legitimacy of A but also avoids public key replacement attacks. In addition, in the process of generating the group member certificate, the vehicle user needs to verify the identity of the group administrator RSU before accepting the member certificate to enhance the credibility of the certificate.The certificateless group signature anonymous authentication scheme includes system initialization, public and private key generation for group administrators and group members, group member joining, signature generation, signature verification, member revocation, and opening signature. The specific work is as follows:(1)
System Initialization. TA chooses the system parameters and generates the master key and its own public key, and public key information is made public.(2)
Public and Private Key Generation for Group Administrators and Group Members. TA generates relevant public and private keys for administrators RSU and vehicle users OBU. The administrator generates an initial group synchronization factor T.(3)
Member Joining. The new member A joins according to the group joining method and generates a self-synchronization factor and updates the group synchronization factor.(4)
Signature Generation. Group member A signs the message M based on the signature algorithm.(5)
Signature Verification. In VANETs, the verifier verifies the message signature through making information and signature information public and confirms that the signed message is signed and issued by a member of the group.(6)
Member Revocation. When a member in the group leaves the group for some reason, RSU recalculates the synchronization factor T′ in the group according to the identity information of the member A which left the group and sends the new synchronization factor T′ and related information of A’s synchronization factor to other members B in the group, which updates their synchronization factor to TB' according to the information.(7)
Opening Signature. When A finds that the message signature sent by the group member vehicle user is false information or a dispute occurs between the group members, the signature is calculated by opening the signature to reveal the identity of the user.


## 4. Proposed Scheme

### 4.1. Initialization

Based on the selected security parameterk, TA generates two large prime numbers p and q, such that qp−1. Choose the generator P on the cyclic group G on the elliptic curve of the order q. Then, choose two collision-free hash functions: H:0,1∗⟶Zq∗ and H1:0,1∗×G⟶Zq∗. TA chooses a random parameter z∈Zq∗ as the system master key and calculates Pz=zP as the public key. TA makes system parameters params=p,q,G,P,Pz,H,H1 public and secretly saves the system master key z.


### 4.2. Public and Private Key Generation

(1)
In this scheme,RSU acts as a group manager to manage vehicle members in the group. Assume that the identity information of the group manager RSU is IDRSU, then RSU randomly chooses xRSU∈Zq∗, calculates PRSU=xRSUP, and sends PIDRSU,PRSU to TA; TA randomly chooses rRSU∈Zq∗, calculates RRSU=rRSUP and SRSU=rRSU+zH1IDRSUPRSURRSU, and sends RRSU,sRSU to RSU secretly, where RRSU is a partial public key of RSU and sRSU is a partial private key of RSU; RSU receives the information, verifies whether sRSUP=RRSU+PzH1IDRSUPRSURRSU is established, and judges the validity of the partial private key sRSU. At this time, RSU gets a complete private key pairing SKRSU=xRSU,sRSU and a complete public key pairing PKRSU=xRSUP,sRSUP=PRSU,SRSU. TA saves the corresponding information IDRSU,PRSU,SRSU,sRSU of RSU and saves the public key to the public list.
(2)
Assume that the identity information of the userOBUA is IDA. Through the above process, the private key pairing SKA=xA,sA and the public key pairing PKA=PA,SA of the user OBUA are generated, and the public key PKA is made public. The hash function H1 is used to generate a part of the private key.
(3)
The group managerRSU randomly chooses e∈Zq∗ and calculates T0=eP as the initial group synchronization factor of the group, and the engaged synchronization factor is T.


### 4.3. Joining

(1)
When the userOBUA wants to join the group, OBUA randomly chooses yA∈Zq∗ and bA∈Zq∗ and calculates YA=yAP, hA=HIDAPKAYAbA, and vA=yA−hA⋅SKA. The user OBUA sends IDAYAhAvAbA to RSU.
(2)
RSU sends IDA to TA, obtains OBUA’s public key PKA, verifies that whether YA′=vAP+hAPKA=YA is established, and generates a certificate for OBUA if it holds.
(3)
RSU randomly chooses eA∈Zq∗, calculates EA=YA+eAP=eA+yAP, hRSU=HEAPKRSUT, and sRSU=eA+SKRSU⋅hRSU, sends EA,hRSU,sRSU,T to OBUA, and stores IDA,PKA,YA,bA,EA,EAP,eA,hA,sA into the group member information list.
(4)
OBU
A verifies RSU’s public key PKRSU and calculates that whether EA′=sRSU+yAP−hRSUPKRSU=EA is established. If it holds, the user OBUA joins the group and generates the group member certificate as IDA,PKRSU,YA,EA,bA,T.
(5)
RSU sends T,bA to other members in the group, and member OBUB updates their synchronization factor TB. Assuming that OBUB’s certificate is IDB,PKRSU,YB,EB,bB,TB, OBUB calculates a new synchronization factor as TB′=T+TBbB−bB, and OBUB’s new certificate is IDB,PKRSU,YB,EB,bB,TB′.
(6)
RSU updates the synchronization factor as T′=T⋅bA+xRSU.


### 4.4. Other Steps

The remaining four steps in the scheme are, in order, signature generation, signature verification, member revocation, and signature opening.


#### 4.4.1. Signature Generation

Assume that the group memberOBUA generates a signature on message M, calculates C1=EAP+TAPKRSU and C2=TAP, C3=bAEA, randomly chooses r1,r2,r3,r4∈Zq∗, and calculates d1=r1C1−r2PKRSU, d2=r1C2+r3SRSU, d3=r3P, d4=r3PKRSU+r4P, c=HPKRSUMC1C2C3d1d2d3d4, s1=r1−cbA, s2=r2−cbATA, s3=r3−cTA, and s4=r4−cEA; the output signature is RM=c,s1,s2,s3,s4,C1,C2,C3.


#### 4.4.2. Signature Verification

The verifier calculatesd1′=s1C1−s2PKRSU+cPC3, d2′=s1C2+s3SRSU+cTP, d3′=s3P+cC2, d4′=cC1+s4P+s3PKRSU, and c′=HPKRSUmC1C2C3d1′d2′d3′d4′ based on c,s1,s2,s3,s4,C1,C2,C3. If the equation c′=c holds, the verification passes.


#### 4.4.3. Member Revocation

To revoke the userOBUA, RSU calculates a new synchronization factor T′=T⋅bA+xRSU−1 based on T,bA. Then, RSU sends T′,bA to other members in the group OBUB, and OBUB updates their synchronization factor TB to TB′, where TB′=TB−T′⋅bA−bB−1.


#### 4.4.4. Signature Opening

WhenRSU finds that the message signature sent by the group member vehicle user is false information or a dispute occurs between the group members, it calculates EAP=C1−C2SKRSU based on the signed message RM=c,s1,s2,s3,s4,C1,C2,C3 and the group manager’s private key SKRSU=xRSU,sRSU and then finds the corresponding identity of the group member.


## 4.1. Initialization

Based on the selected security parameterk, TA generates two large prime numbers p and q, such that qp−1. Choose the generator P on the cyclic group G on the elliptic curve of the order q. Then, choose two collision-free hash functions: H:0,1∗⟶Zq∗ and H1:0,1∗×G⟶Zq∗. TA chooses a random parameter z∈Zq∗ as the system master key and calculates Pz=zP as the public key. TA makes system parameters params=p,q,G,P,Pz,H,H1 public and secretly saves the system master key z.


## 4.2. Public and Private Key Generation

(1)
In this scheme,RSU acts as a group manager to manage vehicle members in the group. Assume that the identity information of the group manager RSU is IDRSU, then RSU randomly chooses xRSU∈Zq∗, calculates PRSU=xRSUP, and sends PIDRSU,PRSU to TA; TA randomly chooses rRSU∈Zq∗, calculates RRSU=rRSUP and SRSU=rRSU+zH1IDRSUPRSURRSU, and sends RRSU,sRSU to RSU secretly, where RRSU is a partial public key of RSU and sRSU is a partial private key of RSU; RSU receives the information, verifies whether sRSUP=RRSU+PzH1IDRSUPRSURRSU is established, and judges the validity of the partial private key sRSU. At this time, RSU gets a complete private key pairing SKRSU=xRSU,sRSU and a complete public key pairing PKRSU=xRSUP,sRSUP=PRSU,SRSU. TA saves the corresponding information IDRSU,PRSU,SRSU,sRSU of RSU and saves the public key to the public list.
(2)
Assume that the identity information of the userOBUA is IDA. Through the above process, the private key pairing SKA=xA,sA and the public key pairing PKA=PA,SA of the user OBUA are generated, and the public key PKA is made public. The hash function H1 is used to generate a part of the private key.
(3)
The group managerRSU randomly chooses e∈Zq∗ and calculates T0=eP as the initial group synchronization factor of the group, and the engaged synchronization factor is T.


## 4.3. Joining

(1)
When the userOBUA wants to join the group, OBUA randomly chooses yA∈Zq∗ and bA∈Zq∗ and calculates YA=yAP, hA=HIDAPKAYAbA, and vA=yA−hA⋅SKA. The user OBUA sends IDAYAhAvAbA to RSU.
(2)
RSU sends IDA to TA, obtains OBUA’s public key PKA, verifies that whether YA′=vAP+hAPKA=YA is established, and generates a certificate for OBUA if it holds.
(3)
RSU randomly chooses eA∈Zq∗, calculates EA=YA+eAP=eA+yAP, hRSU=HEAPKRSUT, and sRSU=eA+SKRSU⋅hRSU, sends EA,hRSU,sRSU,T to OBUA, and stores IDA,PKA,YA,bA,EA,EAP,eA,hA,sA into the group member information list.
(4)
OBU
A verifies RSU’s public key PKRSU and calculates that whether EA′=sRSU+yAP−hRSUPKRSU=EA is established. If it holds, the user OBUA joins the group and generates the group member certificate as IDA,PKRSU,YA,EA,bA,T.
(5)
RSU sends T,bA to other members in the group, and member OBUB updates their synchronization factor TB. Assuming that OBUB’s certificate is IDB,PKRSU,YB,EB,bB,TB, OBUB calculates a new synchronization factor as TB′=T+TBbB−bB, and OBUB’s new certificate is IDB,PKRSU,YB,EB,bB,TB′.
(6)
RSU updates the synchronization factor as T′=T⋅bA+xRSU.


## 4.4. Other Steps

The remaining four steps in the scheme are, in order, signature generation, signature verification, member revocation, and signature opening.


### 4.4.1. Signature Generation

Assume that the group memberOBUA generates a signature on message M, calculates C1=EAP+TAPKRSU and C2=TAP, C3=bAEA, randomly chooses r1,r2,r3,r4∈Zq∗, and calculates d1=r1C1−r2PKRSU, d2=r1C2+r3SRSU, d3=r3P, d4=r3PKRSU+r4P, c=HPKRSUMC1C2C3d1d2d3d4, s1=r1−cbA, s2=r2−cbATA, s3=r3−cTA, and s4=r4−cEA; the output signature is RM=c,s1,s2,s3,s4,C1,C2,C3.


### 4.4.2. Signature Verification

The verifier calculatesd1′=s1C1−s2PKRSU+cPC3, d2′=s1C2+s3SRSU+cTP, d3′=s3P+cC2, d4′=cC1+s4P+s3PKRSU, and c′=HPKRSUmC1C2C3d1′d2′d3′d4′ based on c,s1,s2,s3,s4,C1,C2,C3. If the equation c′=c holds, the verification passes.


### 4.4.3. Member Revocation

To revoke the userOBUA, RSU calculates a new synchronization factor T′=T⋅bA+xRSU−1 based on T,bA. Then, RSU sends T′,bA to other members in the group OBUB, and OBUB updates their synchronization factor TB to TB′, where TB′=TB−T′⋅bA−bB−1.


### 4.4.4. Signature Opening

WhenRSU finds that the message signature sent by the group member vehicle user is false information or a dispute occurs between the group members, it calculates EAP=C1−C2SKRSU based on the signed message RM=c,s1,s2,s3,s4,C1,C2,C3 and the group manager’s private key SKRSU=xRSU,sRSU and then finds the corresponding identity of the group member.


## 4.4.1. Signature Generation

Assume that the group memberOBUA generates a signature on message M, calculates C1=EAP+TAPKRSU and C2=TAP, C3=bAEA, randomly chooses r1,r2,r3,r4∈Zq∗, and calculates d1=r1C1−r2PKRSU, d2=r1C2+r3SRSU, d3=r3P, d4=r3PKRSU+r4P, c=HPKRSUMC1C2C3d1d2d3d4, s1=r1−cbA, s2=r2−cbATA, s3=r3−cTA, and s4=r4−cEA; the output signature is RM=c,s1,s2,s3,s4,C1,C2,C3.


## 4.4.2. Signature Verification

The verifier calculatesd1′=s1C1−s2PKRSU+cPC3, d2′=s1C2+s3SRSU+cTP, d3′=s3P+cC2, d4′=cC1+s4P+s3PKRSU, and c′=HPKRSUmC1C2C3d1′d2′d3′d4′ based on c,s1,s2,s3,s4,C1,C2,C3. If the equation c′=c holds, the verification passes.


## 4.4.3. Member Revocation

To revoke the userOBUA, RSU calculates a new synchronization factor T′=T⋅bA+xRSU−1 based on T,bA. Then, RSU sends T′,bA to other members in the group OBUB, and OBUB updates their synchronization factor TB to TB′, where TB′=TB−T′⋅bA−bB−1.


## 4.4.4. Signature Opening

WhenRSU finds that the message signature sent by the group member vehicle user is false information or a dispute occurs between the group members, it calculates EAP=C1−C2SKRSU based on the signed message RM=c,s1,s2,s3,s4,C1,C2,C3 and the group manager’s private key SKRSU=xRSU,sRSU and then finds the corresponding identity of the group member.


## 5. Anonymous Scheme Analysis

### 5.1. Correctness Analysis

#### 5.1.1. Correctness of Key Distribution

After the group managerRSU receives RRSU,sRSU, it verifies whether sRSUP=RRSU+PzH1IDRSUPRSURRSU is established. Since sRSUP=rRSUP+zPH1IDRSUPRSURRSU=RRSU+PzH1IDRSUPRSURRSU, the verification result is consistent with the result of the signature generation algorithm, so the signature scheme satisfies the correctness.Similarly, after the userOBUA receives OBUA, it verifies whether sAP=RA+PzH1IDAPARA is established. Since sAP=rAP+zPH1IDAPARA=RA+PzH1IDAPARA, the signature scheme satisfies the correctness.


#### 5.1.2. Correctness of Signature in Joining

AfterRSU receives the signature information IDAYAhAvAbA from the user OBUA, if hA,vA is a legitimate signature, the equation YA′=vAP+hAPKA=yAP−hASKAP+hAPKA=YA holds, and then RSU calculates hA′=HIDAPKAYA′bA based on YA′ and gets hA′=hA. And so, the r4P−cEAP+r3PK signature is valid, that is, the identity of the user OBUA is valid.Similarly, whenOBUA receives the message EA,hRSU,sRSU,T sent by RSU and calculates EA′=sRSU+yAP−hRSUPKRSU based on RSU’s public key PKRSU and sRSU=eA+SKRSU⋅hRSU, then the equation EA′=EA holds. And so, the signature is valid.


#### 5.1.3. Correctness of Group Signature

Ifc,s1,s2,s3,s4,C1,C2,C3 is a legitimate signature, the verifier calculates d1′=s1C1−s2PKRSU+cPC3=r1C1−cbAEAP−cbATAPKRSU−r2PKRSU+cbATAPKRSU+cbAEAP=r1C1−r2PKRSU=d1, d2′=s1C2+s3SRSU+cTP=r1C2−cbATAP+r3SRSU−cTASRSU+cTP=r1C2+r3SRSU=d2, d3′=s3P+cC2=r3P−cTAP+cTAP=r3P=d3, and d4′=cC1+s4P+s3PKRSU=cEAP+cTAPKRSU+r4P−cEAP+r3PKRSU−cTAPKRSU=r3PKRSU+r4P=d4, based on TP=TAbA+xRSUP=TAbAP+TASRSU and gets c′=c from the existing public information, so the signature verification algorithm is correct.


### 5.2. Unforgeability

Unforgeability means that the group certificate of the members in the group is unforgeable.In this scheme,RSU’s private key pairing is SKRSU=xRSU,sRSU, where sRSU=rRSU+zH1IDRSUPRSURRSU; the group certificate for the group member OBUA is IDA,PKRSU,YA,EA,bA,TA, where EA=YA+eAP=eA+yAP, YA=yAP, and the synchronization factor of the group T and the synchronization factor of the group member OBUA have the following relationship: T=TAbA+xRSU. yA, bA, xRSU, and eA are private to group members OBUA and RSU, respectively, so no single party can complete the group member certificate creation independently. Therefore, the group certificate is unforgeable.


### 5.3. Forward Security

When group memberOBUA joins the group, the group synchronization factor T is updated as follows: T′=T⋅bA+xRSU, based on bA provided by OBUA, and the synchronization factors of other members OBUB in the group are updated as follows: TB′=T+TBbB−bB; when the group member OBUA is revoked, the group synchronization factor T is updated as follows: T′=T⋅bA+xRSU−1, and the synchronization factors of other members OBUB in the group are updated as follows: TB′=TB−T′⋅bA−bB−1. It can be seen that the signature in the verification phase and the synchronization factor used in the verification phase will be updated synchronously according to the membership addition and revocation. After the update, the previous signature verification equation will not be established, so the forward security can be guaranteed.


### 5.4. Performance Analysis

In this section, performance analysis will be performed in terms of communication costs and calculation costs. For this scheme, the communication cost needs to consider the length of the group manager’s public key and the length of the group member’s signature. In the calculation aspect, the cost of joining the group, the cost of revoking the group, the cost of computing the signature, and the cost of verifying the signature are considered. Compared with other group signature schemes, some performance analysis comparisons are made as given in Table1, where N represents the number of current group members and the number of joined and revoked members each time is set to 1.Table 1
Performance analysis.
Scheme
Length of public key
Signature length
Joining cost
Revocation cost
Signature cost
Verification cost
LPY [4]
O (1)
O (1)
O (N)
O (1)
O (1)
O (1)
YJD [11]
O (1)
O (1)
O (N)
O (1)
O (Nlogn)
O (1)
This scheme
O (1)
O (1)
O (N)
O (N)
O (1)
O (1)In this scheme, the length of the group manager’s public key and the length of the group member’s signature information are not directly related to the number of members in the group and are constant.In this scheme, when joining and revoking, the synchronization factor of each user needs to be updated, so the cost of joining and revoking is O (N).In this scheme, the efficiency of the calculation cost of the information signature and the verification cost of the signature information are both constant, and the number of group members does not affect the time spent on signature and verification.For this scheme, the performance analysis mainly considers the cost of group membership joining and revocation, the cost of information signature, and the cost of verifying signature information.According to the literature [15], we choose a hardware platform consisting of Intel I7-6700 and Windows7 with 8G processor memory. By performing elliptic curve/bilinear pairing simulation experiments multiple times and taking the average value of the results, the operation execution schedule can be obtained as shown in Table 2. The comparison of this paper’s average execution time of simulation operations is shown in Figure 2.Table 2
Average execution time of simulation operations.
Symbol
Description
Execution time (ms)
T
M
C
_
MUL
Multiplication on elliptic curves
0.3476
T
M
C
_
ADD
Addition on elliptic curves
0.002
T
M
U
L
Modular multiplication
0.0119
T
H
General hash function operations
0.0012
T
P
B
_
SM
Scalar multiplication
0.817
T
P
B
Bilinear operation
5.5852Figure 2
Comparison of average execution time of simulation operations.Considering the overall performance of the scheme, we will focus on analyzing the time overhead in the signature generation and signature verification process. This scheme is compared with the existing schemes [14, 15]. In the signature generation phase, scalar multiplication of bilinear pairs is mainly used in the scheme [14, 15]. The overall multiplication operation is less than this scheme, but the length of a single multiplication operation is longer than the elliptic curve multiplication and modular multiplication operations used in this scheme, and the overall time overhead is greater than the time overhead of this scheme; moreover, in the signature generation, the calculation of 2TEC_MUL+2TMUL is a fixed calculation, and it does not need to participate in each calculation process, which can further reduce the calculation cost of group members when performing signature generation. In the signature verification phase, the time-consuming bilinear operation in the scheme [14, 15] increases the time overhead, and the signature verification process of this scheme is not much different from the signature generation calculation overheads, as shown in Table 3. The comparison of signature generation and signature verification overhead for the three schemes is shown in Figure 3.Table 3
Signature generation and verification calculation overhead.
Scheme
Signature generation
Signature verification
Calculation overhead
Time overhead (ms)
Calculation overhead
Time overhead (ms)
Scheme [14]
2
T
P
B
+
1
T
H
+
10
T
P
B
_
SM
19.3416
2
T
P
B
+
1
T
PB
_
SM
11.9874
Scheme [15]
5
T
P
B
_
SM
4.085
4
T
P
B
+
2
T
P
B
_
SM
23.9748
This scheme
4
T
M
C
_
MUL
+
12
T
M
U
L
+
T
H
1.5344
4
T
M
C
_
MUL
+
7
T
M
U
L
+
T
H
1.4749Figure 3
Comparison of signature generation and signature verification overhead.In the process of the group member joining, since the group members and the group management need to verify the identity of each other, the group members need to perform four elliptic curve multiplication operations and two hash comparisons. During the joining and revocation stages of group members, the group management broadcasts the synchronization coefficients of new members, and the members within the group update their respective synchronization factors. Without modifying the group public key, the calculation costs caused by changes in the members of the group will be spent, allocating sales to members in the group and reducing the calculation requirements for group management.


## 5.1. Correctness Analysis

### 5.1.1. Correctness of Key Distribution

After the group managerRSU receives RRSU,sRSU, it verifies whether sRSUP=RRSU+PzH1IDRSUPRSURRSU is established. Since sRSUP=rRSUP+zPH1IDRSUPRSURRSU=RRSU+PzH1IDRSUPRSURRSU, the verification result is consistent with the result of the signature generation algorithm, so the signature scheme satisfies the correctness.Similarly, after the userOBUA receives OBUA, it verifies whether sAP=RA+PzH1IDAPARA is established. Since sAP=rAP+zPH1IDAPARA=RA+PzH1IDAPARA, the signature scheme satisfies the correctness.


### 5.1.2. Correctness of Signature in Joining

AfterRSU receives the signature information IDAYAhAvAbA from the user OBUA, if hA,vA is a legitimate signature, the equation YA′=vAP+hAPKA=yAP−hASKAP+hAPKA=YA holds, and then RSU calculates hA′=HIDAPKAYA′bA based on YA′ and gets hA′=hA. And so, the r4P−cEAP+r3PK signature is valid, that is, the identity of the user OBUA is valid.Similarly, whenOBUA receives the message EA,hRSU,sRSU,T sent by RSU and calculates EA′=sRSU+yAP−hRSUPKRSU based on RSU’s public key PKRSU and sRSU=eA+SKRSU⋅hRSU, then the equation EA′=EA holds. And so, the signature is valid.


### 5.1.3. Correctness of Group Signature

Ifc,s1,s2,s3,s4,C1,C2,C3 is a legitimate signature, the verifier calculates d1′=s1C1−s2PKRSU+cPC3=r1C1−cbAEAP−cbATAPKRSU−r2PKRSU+cbATAPKRSU+cbAEAP=r1C1−r2PKRSU=d1, d2′=s1C2+s3SRSU+cTP=r1C2−cbATAP+r3SRSU−cTASRSU+cTP=r1C2+r3SRSU=d2, d3′=s3P+cC2=r3P−cTAP+cTAP=r3P=d3, and d4′=cC1+s4P+s3PKRSU=cEAP+cTAPKRSU+r4P−cEAP+r3PKRSU−cTAPKRSU=r3PKRSU+r4P=d4, based on TP=TAbA+xRSUP=TAbAP+TASRSU and gets c′=c from the existing public information, so the signature verification algorithm is correct.


## 5.1.1. Correctness of Key Distribution

After the group managerRSU receives RRSU,sRSU, it verifies whether sRSUP=RRSU+PzH1IDRSUPRSURRSU is established. Since sRSUP=rRSUP+zPH1IDRSUPRSURRSU=RRSU+PzH1IDRSUPRSURRSU, the verification result is consistent with the result of the signature generation algorithm, so the signature scheme satisfies the correctness.Similarly, after the userOBUA receives OBUA, it verifies whether sAP=RA+PzH1IDAPARA is established. Since sAP=rAP+zPH1IDAPARA=RA+PzH1IDAPARA, the signature scheme satisfies the correctness.


## 5.1.2. Correctness of Signature in Joining

AfterRSU receives the signature information IDAYAhAvAbA from the user OBUA, if hA,vA is a legitimate signature, the equation YA′=vAP+hAPKA=yAP−hASKAP+hAPKA=YA holds, and then RSU calculates hA′=HIDAPKAYA′bA based on YA′ and gets hA′=hA. And so, the r4P−cEAP+r3PK signature is valid, that is, the identity of the user OBUA is valid.Similarly, whenOBUA receives the message EA,hRSU,sRSU,T sent by RSU and calculates EA′=sRSU+yAP−hRSUPKRSU based on RSU’s public key PKRSU and sRSU=eA+SKRSU⋅hRSU, then the equation EA′=EA holds. And so, the signature is valid.


## 5.1.3. Correctness of Group Signature

Ifc,s1,s2,s3,s4,C1,C2,C3 is a legitimate signature, the verifier calculates d1′=s1C1−s2PKRSU+cPC3=r1C1−cbAEAP−cbATAPKRSU−r2PKRSU+cbATAPKRSU+cbAEAP=r1C1−r2PKRSU=d1, d2′=s1C2+s3SRSU+cTP=r1C2−cbATAP+r3SRSU−cTASRSU+cTP=r1C2+r3SRSU=d2, d3′=s3P+cC2=r3P−cTAP+cTAP=r3P=d3, and d4′=cC1+s4P+s3PKRSU=cEAP+cTAPKRSU+r4P−cEAP+r3PKRSU−cTAPKRSU=r3PKRSU+r4P=d4, based on TP=TAbA+xRSUP=TAbAP+TASRSU and gets c′=c from the existing public information, so the signature verification algorithm is correct.


## 5.2. Unforgeability

Unforgeability means that the group certificate of the members in the group is unforgeable.In this scheme,RSU’s private key pairing is SKRSU=xRSU,sRSU, where sRSU=rRSU+zH1IDRSUPRSURRSU; the group certificate for the group member OBUA is IDA,PKRSU,YA,EA,bA,TA, where EA=YA+eAP=eA+yAP, YA=yAP, and the synchronization factor of the group T and the synchronization factor of the group member OBUA have the following relationship: T=TAbA+xRSU. yA, bA, xRSU, and eA are private to group members OBUA and RSU, respectively, so no single party can complete the group member certificate creation independently. Therefore, the group certificate is unforgeable.


## 5.3. Forward Security

When group memberOBUA joins the group, the group synchronization factor T is updated as follows: T′=T⋅bA+xRSU, based on bA provided by OBUA, and the synchronization factors of other members OBUB in the group are updated as follows: TB′=T+TBbB−bB; when the group member OBUA is revoked, the group synchronization factor T is updated as follows: T′=T⋅bA+xRSU−1, and the synchronization factors of other members OBUB in the group are updated as follows: TB′=TB−T′⋅bA−bB−1. It can be seen that the signature in the verification phase and the synchronization factor used in the verification phase will be updated synchronously according to the membership addition and revocation. After the update, the previous signature verification equation will not be established, so the forward security can be guaranteed.


## 5.4. Performance Analysis

In this section, performance analysis will be performed in terms of communication costs and calculation costs. For this scheme, the communication cost needs to consider the length of the group manager’s public key and the length of the group member’s signature. In the calculation aspect, the cost of joining the group, the cost of revoking the group, the cost of computing the signature, and the cost of verifying the signature are considered. Compared with other group signature schemes, some performance analysis comparisons are made as given in Table1, where N represents the number of current group members and the number of joined and revoked members each time is set to 1.Table 1
Performance analysis.
Scheme
Length of public key
Signature length
Joining cost
Revocation cost
Signature cost
Verification cost
LPY [4]
O (1)
O (1)
O (N)
O (1)
O (1)
O (1)
YJD [11]
O (1)
O (1)
O (N)
O (1)
O (Nlogn)
O (1)
This scheme
O (1)
O (1)
O (N)
O (N)
O (1)
O (1)In this scheme, the length of the group manager’s public key and the length of the group member’s signature information are not directly related to the number of members in the group and are constant.In this scheme, when joining and revoking, the synchronization factor of each user needs to be updated, so the cost of joining and revoking is O (N).In this scheme, the efficiency of the calculation cost of the information signature and the verification cost of the signature information are both constant, and the number of group members does not affect the time spent on signature and verification.For this scheme, the performance analysis mainly considers the cost of group membership joining and revocation, the cost of information signature, and the cost of verifying signature information.According to the literature [15], we choose a hardware platform consisting of Intel I7-6700 and Windows7 with 8G processor memory. By performing elliptic curve/bilinear pairing simulation experiments multiple times and taking the average value of the results, the operation execution schedule can be obtained as shown in Table 2. The comparison of this paper’s average execution time of simulation operations is shown in Figure 2.Table 2
Average execution time of simulation operations.
Symbol
Description
Execution time (ms)
T
M
C
_
MUL
Multiplication on elliptic curves
0.3476
T
M
C
_
ADD
Addition on elliptic curves
0.002
T
M
U
L
Modular multiplication
0.0119
T
H
General hash function operations
0.0012
T
P
B
_
SM
Scalar multiplication
0.817
T
P
B
Bilinear operation
5.5852Figure 2
Comparison of average execution time of simulation operations.Considering the overall performance of the scheme, we will focus on analyzing the time overhead in the signature generation and signature verification process. This scheme is compared with the existing schemes [14, 15]. In the signature generation phase, scalar multiplication of bilinear pairs is mainly used in the scheme [14, 15]. The overall multiplication operation is less than this scheme, but the length of a single multiplication operation is longer than the elliptic curve multiplication and modular multiplication operations used in this scheme, and the overall time overhead is greater than the time overhead of this scheme; moreover, in the signature generation, the calculation of 2TEC_MUL+2TMUL is a fixed calculation, and it does not need to participate in each calculation process, which can further reduce the calculation cost of group members when performing signature generation. In the signature verification phase, the time-consuming bilinear operation in the scheme [14, 15] increases the time overhead, and the signature verification process of this scheme is not much different from the signature generation calculation overheads, as shown in Table 3. The comparison of signature generation and signature verification overhead for the three schemes is shown in Figure 3.Table 3
Signature generation and verification calculation overhead.
Scheme
Signature generation
Signature verification
Calculation overhead
Time overhead (ms)
Calculation overhead
Time overhead (ms)
Scheme [14]
2
T
P
B
+
1
T
H
+
10
T
P
B
_
SM
19.3416
2
T
P
B
+
1
T
PB
_
SM
11.9874
Scheme [15]
5
T
P
B
_
SM
4.085
4
T
P
B
+
2
T
P
B
_
SM
23.9748
This scheme
4
T
M
C
_
MUL
+
12
T
M
U
L
+
T
H
1.5344
4
T
M
C
_
MUL
+
7
T
M
U
L
+
T
H
1.4749Figure 3
Comparison of signature generation and signature verification overhead.In the process of the group member joining, since the group members and the group management need to verify the identity of each other, the group members need to perform four elliptic curve multiplication operations and two hash comparisons. During the joining and revocation stages of group members, the group management broadcasts the synchronization coefficients of new members, and the members within the group update their respective synchronization factors. Without modifying the group public key, the calculation costs caused by changes in the members of the group will be spent, allocating sales to members in the group and reducing the calculation requirements for group management.


## 6. Conclusion

Aiming at the problem of low authentication efficiency in the anonymous authentication scheme in VANETs, this paper proposes a certificateless elliptic curve anonymous authentication scheme. Though based on a certificateless signature scheme, this scheme does not have to consider certificate maintenance and key escrow issues. It also uses elliptic curves to perform calculations on the basis of certificatelessness and introduces synchronization factor technology to further improve computing efficiency of group members when joining, revoking, and signing. The analysis of the scheme shows that the proposed scheme can not only ensure the anonymity and traceability of the group signature scheme but also ensure unforgeability and forward security under the premise of correctness. The partial key generation scheme adopted in this scheme effectively ensures the security of user keys, and there is no need to save too much certificate information in the system, and the calculation and storage overhead is low. Therefore, it is very suitable for OBUs and RSUs with very limited computing and storage space in the VANETs.



---

*Source: 1378202-2020-06-29.xml*