# Privacy-Preserving Data Aggregation Protocol for Fog Computing-Assisted Vehicle-to-Infrastructure Scenario

Authors: Yanan Chen; Zhenyu Lu; Hu Xiong; Weixiang Xu
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Vehicle-to-infrastructure (V2I) communication enables moving vehicles to upload real-time data about road surface situation to the Internet via fixed roadside units (RSU). Thanks to the resource restriction of mobile vehicles, fog computation-enhanced V2I communication scenario has received increasing attention recently. However, how to aggregate the sensed data from vehicles securely and efficiently still remains open to the V2I communication scenario. In this paper, a light-weight and anonymous aggregation protocol is proposed for the fog computing-based V2I communication scenario. With the proposed protocol, the data collected by the vehicles can be efficiently obtained by the RSU in a privacy-preserving manner. Particularly, we first suggest a certificateless aggregate signcryption (CL-A-SC) scheme and prove its security in the random oracle model. The suggested CL-A-SC scheme, which is of independent interest, can achieve the merits of certificateless cryptography and signcryption scheme simultaneously. Then we put forward the anonymous aggregation protocol for V2I communication scenario as one extension of the suggested CL-A-SC scheme. Security analysis demonstrates that the proposed aggregation protocol achieves desirable security properties. The performance comparison shows that the proposed protocol significantly reduces the computation and communication overhead compared with the up-to-date protocols in this field.


---

## Body

## 1. Introduction

Most of road anomalies, that is, potholes, bumps and slipperiness, are potentially hazardous to the commuters and vehicles [1]. Naturally, the condition of road surface is considered to be an important criterion for assessing the quality of transportation infrastructure [2]. The continuous development of sensing technique provides a promising approach to build an autonomous system for monitoring road surface condition [3]. Specifically, the mobile sensors embedded in mobile vehicles are used to sense the real-time data about road surface condition [4]. With the V2I communication [5], the data collected by the vehicles can be uploaded to the backend server via the RSUs installed at road intersections. By collecting and analyzing these real-time road surface data, the congestion of traffic and car crashes can be reduced significantly. Thanks to the resource restraint of mobile vehicles, the vehicular cloud networking [6, 7] has been introduced to ease the cost of vehicles, where the sensed data are stored in the remote cloud centers. It is easy to observe that the delivery of these data to the cloud servers located in the core network is commonly considered to be cumbersome due to the unreliable latency and network congestion [8]. To address these issues, the fog computing [9–11] has been introduced as an alternative for cloud computing. Different from cloud computing, elastic and virtual cloud resources are extended to one or more collaborative edge devices in the fog computing. In this sense, the collected data can be preprocessed and aggregated by the edge devices, which are instantiated by the resource-abundant RSU, before uploading to the data analytic center [12]. Therefore, the real-time road surface data can be efficiently processed with the support of fog computing-assisted V2I communication.However, the fog computing-based V2I communication scenario cannot be accepted and deployed widely if the security of the transmitted data has not been considered appropriately. It is desirable to achieve data confidentiality such that the transmitted data can only be accessed by the intended RSU [13]. Otherwise, the collected data may be abused by the malicious adversary without any cost. Besides, it is also necessary to achieve message unforgeability such that the adversary is computationally infeasible to impersonate any vehicle [14]. Otherwise, the result about the analysis of collected data may be polluted by the forged data. To fulfill the mentioned security goals, it is naturally to introduce the public key encryption and signature to generate the ciphertext on the transmitted data. According to [15], signcryption is a promising primitive that achieves the security goals of encryption and signature simultaneously. It is realized by combining the public key encryption and digital signatures in one logical step. Moreover, this technique entails minimized computation and communication overhead compared with the sign-then-encrypt paradigm [16]. Since its introduction, the signcryption primitive has been studied in several cryptosystems, that is, traditional public key infrastructure- (PKI-) based cryptosystem [15], identity-based cryptosystem [17], and certificateless cryptosystem [16]. In the traditional PKI-based cryptosystem, the certificate management is a burdensome task. To alleviate the overhead of this task, the identity-based public key cryptosystem [18] has been introduced, where a trusted third party termed as private key generator is adopted to issue private keys for the users. This paradigm results in key escrow problem since the private key generator knows the private keys of all users in the system [18]. The certificateless cryptosystem [19] inherits from identity-based cryptosystem, whereas it eliminates the demand for the private key generator with key escrow capability. In this cryptosystem, a trusted third party named key generation center (KGC) is adopted to generate the private keys for users. Only a partial private key is issued by the KGC for each user. The full private key of a user is composed of the partial private key received from KGC and a secret value selected by his/herself. Because the full private key of a user is not held by the KGC, certificateless public key cryptosystem solves the key escrow problem of the identity-based cryptosystem. Thus, certificateless signcryption seems to be a promising primitive to ensure the security of the V2I communication.Based on the idea of certificateless signcryption, Basudan et al. [20] proposed an anonymous aggregation protocol to secure the V2I communication recently. Unfortunately, in this paper, the protocol of [20] is demonstrated to be subject to the forgery attack, by which an adversary is able to forge a valid signcryption on any data. Besides, this protocol is constructed by utilizing the expensive bilinear pairings, which makes this protocol inefficient. Therefore, it is fair to regard the construction of anonymous aggregation protocol for the fog computing-based V2I communication scenario as an open issue.Motivated by the practical needs, a privacy-preserving protocol for the V2I communication scenario with fog computing is proposed in this paper. The major contributions of this paper are summarized as follows:(i)
Firstly, Basudan et al.’s [20] protocol is demonstrated to be subject to the forgery attack, by which an adversary is able to forge a valid signcryption on any data. In this sense, the aggregation protocol in [20] does not provide unforgeability as they claimed.(ii)
Next, a light-weight and anonymous aggregation protocol for the V2I communication scenario with fog computing is proposed by elaborately combining a CL-A-SC scheme and the fog computing architecture. Specifically, the suggested protocol is realized without resorting to the costly bilinear pairings. Besides, the proposed protocol is proved secure under the standard computational Diffie–Hellman assumption and elliptic curve discrete logarithm problem in the random oracle model. Furthermore, the proposed aggregation protocol proved to be able to achieve desirable security properties including confidentiality, unforgeability, mutual authentication, anonymity, and key escrow resilience.(iii)
The practical performance of the proposed protocol and Basudan et al.’s protocol is presented through the experimental simulation. According to the simulation results, the proposed protocol outperforms Basudan et al.’s protocol in terms of computation and communication overhead.The organization of this paper is summarized as follows: the next section describes the system model, mathematical background, design objectives, the notion, and the security model of CL-A-SC scheme. In Section3, Basudan et al.’s protocol is briefly reviewed. After that, the forgery attack against this protocol is presented. The proposed protocol is introduced in Section 4. Furthermore, the security of the proposed protocol is discussed in Section 5, where the comparison of the practical performance of the proposed protocol and Basudan et al.’s protocol is also provided. Finally, Section 6 concludes this paper.


## 2. Preliminaries

The background information is introduced in this section.


### 2.1. System Model

The considered system is comprised of three types of entities: control center, mobile sensors and RSUs. For ease of understanding, the system model is depicted in Figure1. The definitions of the entities are described as follows:(i)
Control center (CC): CC is considered to be a trustee which is able to initialize the whole system and generate the partial private key for mobile sensors and RSUs.(ii)
Mobile sensors: the devices are embedded into the vehicles to generate the report about the road event, that is, potholes, slipperiness and bumps.(iii)
RSU: each RSU is able to receive and process the messages sent by the mobile sensors.Figure 1
System model.


### 2.2. Mathematical Background

#### 2.2.1. Elliptic Curve Group

Let an elliptic curveE over a prime finite field Fp denote a set of points (x,y), which are defined by the equation E(x,y):y2=x3+ax+b with the discriminant 4a3+27b2≠0 mod p(a,b∈RFp). This set of points and the point at infinity (denoted by O) form a group G={(x,y)∣(x,y)∈Fp∩E(x,y)=0}∪{O}. Particularly, G is an additive cyclic group formed by E and the point addition law, which is denoted by + and defined as follows. Let P, Q, and R be three elements in G, where R is the intersection of the line l and E. Specifically, l connects P and Q (tangent line to E if P=Q). Let l′ be another line, which connects R and O. The sum of P+Q is denoted by the intersection of l′ and E. Moreover, the scalar multiplication on E is calculated as mP=P+P+⋯+P︸mtimes.


#### 2.2.2. Bilinear Maps

LetG be an additive cyclic group of prime order q, GT be a multiplicative cyclic group of the same order, e^:G×G→GT be an admissible bilinear map and P∈G denote a generator of G. e^ is considered to have the following features:(1)
Bilinearity: for allP,Q∈G and a,b∈RZq∗, e^(aP,bQ)=e^(P,Q)ab.(2)
Nondegeneracy: there existsP,Q∈G such that e^(P,Q)≠1.(3)
Computability: for allP,Q∈G, there exists an efficient algorithm to calculate e^(P,Q).


#### 2.2.3. Cryptographic Assumptions

Given the mathematical background described above, the cryptographic assumptions are defined as follows.Definition 1 (computational Diffie–Hellman assumption).
This assumption is denoted asCDH. Given a tuple P,aP,bP∈G (a,b∈RZq∗), theCDH assumption in G is to calculate abP.Definition 2 (elliptic curve discrete logarithm problem).
This assumption is denoted asECDLP. Given a tuple P,aP∈G (a∈RZq∗), theECDLP assumption in G is to calculate a.


### 2.3. The CL-A-SC Scheme

#### 2.3.1. Definition

LetU={U1,U2,…,Un} denote a set of users. The user with identity IDR is assumed to be the message receiver. The scheme consists of the following algorithms:(i)
CL-A-SC.Setup: on inputting the security parameter, this algorithm generates the public parametersparams and the master private key msk.(ii)
CL-A-SC.Key-Generation: this algorithm is carried out by each Ui and KGC interactively.
(1)
Givenparams, each Ui generates his/her user public/private key pair (upki,1,uski,1).(2)
Givenparams, msk, the identity IDi of Ui, and its corresponding user public key upki,1, KGC generates the partial public/private key pair (upki,2,uski,2).(3)
(upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Ui, respectively.(iii)
CL-A-SC.Signcryption: this algorithm is carried out by each Ui. On inputting params, a message mi, full private key (uski,1,uski,2) of Ui, and the public key (upkR,1,upkR,2) of the user with identity IDR, this algorithm outputs signcryption Ci on mi.(iv)
CL-A-SC.Aggregate: on inputting a set of signcryption schemes  (Ci)i=1,…,n, this algorithm outputs aggregate signcryption C on messages (mi)i=1,…,n.(v)
CL-A-SC.Aggregate-Verification: on inputting params, aggregate signcryption C and the set of users with its public keys, this algorithm outputs true if C is valid or false otherwise.(vi)
CL-A-SC.Designcryption: on inputting an aggregate signcryption C and the full private key (uskR,1,uskR,2) of the user with identity IDR, this algorithm outputs a set of messages (mi)i=1,…,n.


#### 2.3.2. Security Model

There are two types of adversaries considered in the certificateless cryptosystem [19]. ATypeI adversary A1 is able to replace the public key of a legitimate user with a bogus one but cannot access the master private key. ATypeII adversary A2 is able to access the master private key but cannot execute the public key replacement. According to the protocol of [22], the security notions of data confidentiality and mutual authentication for the CL-A-SC scheme are captured by the indistinguishability and the existential unforgeability of the signcryption, respectively. By using the same security model provided in [22], the ability of the adversaries is modeled by the following four interactive games.Game 3.
This game is played by a challengerC and aType I adversary A1.(i)
Initializing: C executesCL-A-SC.Setup algorithm to obtain the public parameters params and the master private key msk. After that, C sends params to A1.(ii)
Training: A1 is able to query the following oracles (these oracles model the capability of A1 in reality) in an adaptive manner:
(a)
Secret-Value-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding secret value uski,1 to A1.(b)
Partial-Private-Key-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding partial private key uski,2 to A1.(c)
Public-Key-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding public key (upki,1,upki,2) to A1.(d)
Public-Key-Replacement(IDi,upki,1′,upki,2′): on receiving the query on IDi, this oracle updates the public key (upki,1,upki,2) into (upki,1′,upki,2′).(e)
Signcryption(mi,IDi,IDj): on receiving the query on IDi, IDj, and a message mi, this oracle prompts C to executeCL-A-SC.Signcryption algorithm to get signcryption Ci on mi, where IDi and IDj are considered to be identity of the sender and the receiver, respectively. After that, C returns Ci to A1.(f)
Designcryption(C,(IDi)i=1,…,n,IDj): on receiving the query on (IDi)i=1,…,n, IDj and aggregate signcryption C, where (IDi)i=1,…,n and IDj are considered to be identity of the senders and the receiver, respectively. This oracle prompts C to execute theCL-A-SC.Aggregate-Verification algorithm on (C,(IDi)i=1,…,n,IDj). If the output of this execution is false, this oracle returns “NULL” to A1; otherwise, C executesCL-A-SC.Designcryption algorithm on (C,(IDi)i=1,…,n,IDj) and returns the output of this execution to A1.(iii)
Challenging: A1 sends {(mi,0∗,mi,1∗,IDi∗)i=1,…,n,IDj∗} to C. On receiving this message, C randomly chooses a bit d∈{0,1}, generates the aggregate signcryption C∗ on ((mi,d∗,IDi∗)i=1,…,n,IDj∗), and then sends C∗ to A1. After that, A1 adaptively queries the same oracles as theTraining phase.(iv)
Guessing: a bit d′ is outputted by A1.A 1 is considered to win this game iff(1)
d′=d, where d and d′ are defined as above;(2)
The oraclePartial-Private-Key-Extraction(IDj) has never been queried;(3)
The oracleDesigncryption(C∗,(IDi′)i=1,…,n,IDj) has never been queried, where there exists i∈{1,…,n} such that IDi∗=IDi′.A 1’s advantage to win this game is defined as AdvA1IND-CCA-II=2Prd=d′-1.Game 4.
This game is played by a challengerC and a Type  II adversary A2.(i)
Initializing: this phase is the same as the first phase in Game 3, while C sends (params,msk) to A2.(ii)
Training: in this phase, A2 queries the same oracles (except thePublic-Key-Replacement oracle) and receives the same responses as the second phase in Game 3.(iii)
Guess: this phase is the same as the third phase in Game 3, where a bit d′ is outputted by A2.A 2 is considered to win this game iff(1)
d′=d, where d and d′ are defined as above;(2)
The oracleSecret-Value-Extraction(IDj) has never been queried;(3)
The oracleDesigncryption(C∗,(IDi′)i=1,…,n,IDj) has never been queried, where there exists i∈{1,…,n} such that IDi∗=IDi′.A 2’s advantage to win this game is defined as AdvA2IND-CCA-II=2Prd=d′-1.Definition 5.
A CL-A-SC scheme is considered to be secure against the adaptively chosen ciphertext attacks if there is no adversary ofType I orType II has a nonnegligible advantage to win Game 3 or Game 4, respectively.Game 6.
This game is played by a challengerC and aType I adversary A1.(i)
Initializing: this phase is the same as the first phase in Game 3.(ii)
Training: in this phase, A1 queries the same oracles and receives the same responses as the second phase of Game 3.(iii)
Forgery: A1 sends a forged aggregate signcryption C∗ on {(mi∗,IDi∗)i=1,…,n,IDj∗} to C, where (IDi∗)i=1,…,n and IDj∗ are considered to be identity of the senders and the receiver, respectively.A 1 is considered to win this game iff(1)
The output of the execution ofAggregate-Verification algorithm on (C∗,(IDi∗)i=1,…,n,IDj∗) is true;(2)
There existsi∈{1,…,n} such that theSigncryption(mi∗,IDi∗,IDj∗) oracle orPartial-Private-Key-Extraction(IDi∗) oracle has not been queried.Game 7.
This game is played by a challengerC and aTypeII adversary A2.(i)
Initializing: this phase is the same as the first phase in Game 4.(ii)
Training: this phase is the same as the second phase in Game 4.(iii)
Forgery: this phase is the same as the third phase in Game 6.A 2 is considered to win this game iff(1)
The output of the execution ofAggregate-Verification algorithm on (C∗,(IDi∗)i=1,…,n,IDj∗) is true;(2)
There existsi∈{1,…,n} such that theSigncryption(mi∗,ID∗i,IDj∗) oracle orSecret-Value-Extraction(IDi∗) oracle has not been queried.Definition 8.
A CL-A-SC is considered to be existentially unforgeable against the adaptively chosen-message attack if there is no adversary ofType I orType II has a nonnegligible advantage to win Game 6 or Game 7, respectively.


### 2.4. Objectives

The design goals of the proposed protocol are defined as follows:(1)
Data confidentiality and integrity: it is desirable to secure the transmitted data from revealing the sensitive information about the source mobile sensor. Besides, it is required to ensure the data has not been tampered [23].(2)
Mutual authentication: it is desirable that the RSU and the mobile sensor are allowed to authenticate each other [24].(3)
Anonymity: it is desirable to hide the real identity of the mobile sensor during the transmission [25, 26].(4)
Key escrow resilience: it is desirable that the adversary is unable to obtain the full private key of any mobile sensor even if CC has been compromised [27].


## 2.1. System Model

The considered system is comprised of three types of entities: control center, mobile sensors and RSUs. For ease of understanding, the system model is depicted in Figure1. The definitions of the entities are described as follows:(i)
Control center (CC): CC is considered to be a trustee which is able to initialize the whole system and generate the partial private key for mobile sensors and RSUs.(ii)
Mobile sensors: the devices are embedded into the vehicles to generate the report about the road event, that is, potholes, slipperiness and bumps.(iii)
RSU: each RSU is able to receive and process the messages sent by the mobile sensors.Figure 1
System model.


## 2.2. Mathematical Background

### 2.2.1. Elliptic Curve Group

Let an elliptic curveE over a prime finite field Fp denote a set of points (x,y), which are defined by the equation E(x,y):y2=x3+ax+b with the discriminant 4a3+27b2≠0 mod p(a,b∈RFp). This set of points and the point at infinity (denoted by O) form a group G={(x,y)∣(x,y)∈Fp∩E(x,y)=0}∪{O}. Particularly, G is an additive cyclic group formed by E and the point addition law, which is denoted by + and defined as follows. Let P, Q, and R be three elements in G, where R is the intersection of the line l and E. Specifically, l connects P and Q (tangent line to E if P=Q). Let l′ be another line, which connects R and O. The sum of P+Q is denoted by the intersection of l′ and E. Moreover, the scalar multiplication on E is calculated as mP=P+P+⋯+P︸mtimes.


### 2.2.2. Bilinear Maps

LetG be an additive cyclic group of prime order q, GT be a multiplicative cyclic group of the same order, e^:G×G→GT be an admissible bilinear map and P∈G denote a generator of G. e^ is considered to have the following features:(1)
Bilinearity: for allP,Q∈G and a,b∈RZq∗, e^(aP,bQ)=e^(P,Q)ab.(2)
Nondegeneracy: there existsP,Q∈G such that e^(P,Q)≠1.(3)
Computability: for allP,Q∈G, there exists an efficient algorithm to calculate e^(P,Q).


### 2.2.3. Cryptographic Assumptions

Given the mathematical background described above, the cryptographic assumptions are defined as follows.Definition 1 (computational Diffie–Hellman assumption).
This assumption is denoted asCDH. Given a tuple P,aP,bP∈G (a,b∈RZq∗), theCDH assumption in G is to calculate abP.Definition 2 (elliptic curve discrete logarithm problem).
This assumption is denoted asECDLP. Given a tuple P,aP∈G (a∈RZq∗), theECDLP assumption in G is to calculate a.


## 2.2.1. Elliptic Curve Group

Let an elliptic curveE over a prime finite field Fp denote a set of points (x,y), which are defined by the equation E(x,y):y2=x3+ax+b with the discriminant 4a3+27b2≠0 mod p(a,b∈RFp). This set of points and the point at infinity (denoted by O) form a group G={(x,y)∣(x,y)∈Fp∩E(x,y)=0}∪{O}. Particularly, G is an additive cyclic group formed by E and the point addition law, which is denoted by + and defined as follows. Let P, Q, and R be three elements in G, where R is the intersection of the line l and E. Specifically, l connects P and Q (tangent line to E if P=Q). Let l′ be another line, which connects R and O. The sum of P+Q is denoted by the intersection of l′ and E. Moreover, the scalar multiplication on E is calculated as mP=P+P+⋯+P︸mtimes.


## 2.2.2. Bilinear Maps

LetG be an additive cyclic group of prime order q, GT be a multiplicative cyclic group of the same order, e^:G×G→GT be an admissible bilinear map and P∈G denote a generator of G. e^ is considered to have the following features:(1)
Bilinearity: for allP,Q∈G and a,b∈RZq∗, e^(aP,bQ)=e^(P,Q)ab.(2)
Nondegeneracy: there existsP,Q∈G such that e^(P,Q)≠1.(3)
Computability: for allP,Q∈G, there exists an efficient algorithm to calculate e^(P,Q).


## 2.2.3. Cryptographic Assumptions

Given the mathematical background described above, the cryptographic assumptions are defined as follows.Definition 1 (computational Diffie–Hellman assumption).
This assumption is denoted asCDH. Given a tuple P,aP,bP∈G (a,b∈RZq∗), theCDH assumption in G is to calculate abP.Definition 2 (elliptic curve discrete logarithm problem).
This assumption is denoted asECDLP. Given a tuple P,aP∈G (a∈RZq∗), theECDLP assumption in G is to calculate a.


## 2.3. The CL-A-SC Scheme

### 2.3.1. Definition

LetU={U1,U2,…,Un} denote a set of users. The user with identity IDR is assumed to be the message receiver. The scheme consists of the following algorithms:(i)
CL-A-SC.Setup: on inputting the security parameter, this algorithm generates the public parametersparams and the master private key msk.(ii)
CL-A-SC.Key-Generation: this algorithm is carried out by each Ui and KGC interactively.
(1)
Givenparams, each Ui generates his/her user public/private key pair (upki,1,uski,1).(2)
Givenparams, msk, the identity IDi of Ui, and its corresponding user public key upki,1, KGC generates the partial public/private key pair (upki,2,uski,2).(3)
(upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Ui, respectively.(iii)
CL-A-SC.Signcryption: this algorithm is carried out by each Ui. On inputting params, a message mi, full private key (uski,1,uski,2) of Ui, and the public key (upkR,1,upkR,2) of the user with identity IDR, this algorithm outputs signcryption Ci on mi.(iv)
CL-A-SC.Aggregate: on inputting a set of signcryption schemes  (Ci)i=1,…,n, this algorithm outputs aggregate signcryption C on messages (mi)i=1,…,n.(v)
CL-A-SC.Aggregate-Verification: on inputting params, aggregate signcryption C and the set of users with its public keys, this algorithm outputs true if C is valid or false otherwise.(vi)
CL-A-SC.Designcryption: on inputting an aggregate signcryption C and the full private key (uskR,1,uskR,2) of the user with identity IDR, this algorithm outputs a set of messages (mi)i=1,…,n.


### 2.3.2. Security Model

There are two types of adversaries considered in the certificateless cryptosystem [19]. ATypeI adversary A1 is able to replace the public key of a legitimate user with a bogus one but cannot access the master private key. ATypeII adversary A2 is able to access the master private key but cannot execute the public key replacement. According to the protocol of [22], the security notions of data confidentiality and mutual authentication for the CL-A-SC scheme are captured by the indistinguishability and the existential unforgeability of the signcryption, respectively. By using the same security model provided in [22], the ability of the adversaries is modeled by the following four interactive games.Game 3.
This game is played by a challengerC and aType I adversary A1.(i)
Initializing: C executesCL-A-SC.Setup algorithm to obtain the public parameters params and the master private key msk. After that, C sends params to A1.(ii)
Training: A1 is able to query the following oracles (these oracles model the capability of A1 in reality) in an adaptive manner:
(a)
Secret-Value-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding secret value uski,1 to A1.(b)
Partial-Private-Key-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding partial private key uski,2 to A1.(c)
Public-Key-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding public key (upki,1,upki,2) to A1.(d)
Public-Key-Replacement(IDi,upki,1′,upki,2′): on receiving the query on IDi, this oracle updates the public key (upki,1,upki,2) into (upki,1′,upki,2′).(e)
Signcryption(mi,IDi,IDj): on receiving the query on IDi, IDj, and a message mi, this oracle prompts C to executeCL-A-SC.Signcryption algorithm to get signcryption Ci on mi, where IDi and IDj are considered to be identity of the sender and the receiver, respectively. After that, C returns Ci to A1.(f)
Designcryption(C,(IDi)i=1,…,n,IDj): on receiving the query on (IDi)i=1,…,n, IDj and aggregate signcryption C, where (IDi)i=1,…,n and IDj are considered to be identity of the senders and the receiver, respectively. This oracle prompts C to execute theCL-A-SC.Aggregate-Verification algorithm on (C,(IDi)i=1,…,n,IDj). If the output of this execution is false, this oracle returns “NULL” to A1; otherwise, C executesCL-A-SC.Designcryption algorithm on (C,(IDi)i=1,…,n,IDj) and returns the output of this execution to A1.(iii)
Challenging: A1 sends {(mi,0∗,mi,1∗,IDi∗)i=1,…,n,IDj∗} to C. On receiving this message, C randomly chooses a bit d∈{0,1}, generates the aggregate signcryption C∗ on ((mi,d∗,IDi∗)i=1,…,n,IDj∗), and then sends C∗ to A1. After that, A1 adaptively queries the same oracles as theTraining phase.(iv)
Guessing: a bit d′ is outputted by A1.A 1 is considered to win this game iff(1)
d′=d, where d and d′ are defined as above;(2)
The oraclePartial-Private-Key-Extraction(IDj) has never been queried;(3)
The oracleDesigncryption(C∗,(IDi′)i=1,…,n,IDj) has never been queried, where there exists i∈{1,…,n} such that IDi∗=IDi′.A 1’s advantage to win this game is defined as AdvA1IND-CCA-II=2Prd=d′-1.Game 4.
This game is played by a challengerC and a Type  II adversary A2.(i)
Initializing: this phase is the same as the first phase in Game 3, while C sends (params,msk) to A2.(ii)
Training: in this phase, A2 queries the same oracles (except thePublic-Key-Replacement oracle) and receives the same responses as the second phase in Game 3.(iii)
Guess: this phase is the same as the third phase in Game 3, where a bit d′ is outputted by A2.A 2 is considered to win this game iff(1)
d′=d, where d and d′ are defined as above;(2)
The oracleSecret-Value-Extraction(IDj) has never been queried;(3)
The oracleDesigncryption(C∗,(IDi′)i=1,…,n,IDj) has never been queried, where there exists i∈{1,…,n} such that IDi∗=IDi′.A 2’s advantage to win this game is defined as AdvA2IND-CCA-II=2Prd=d′-1.Definition 5.
A CL-A-SC scheme is considered to be secure against the adaptively chosen ciphertext attacks if there is no adversary ofType I orType II has a nonnegligible advantage to win Game 3 or Game 4, respectively.Game 6.
This game is played by a challengerC and aType I adversary A1.(i)
Initializing: this phase is the same as the first phase in Game 3.(ii)
Training: in this phase, A1 queries the same oracles and receives the same responses as the second phase of Game 3.(iii)
Forgery: A1 sends a forged aggregate signcryption C∗ on {(mi∗,IDi∗)i=1,…,n,IDj∗} to C, where (IDi∗)i=1,…,n and IDj∗ are considered to be identity of the senders and the receiver, respectively.A 1 is considered to win this game iff(1)
The output of the execution ofAggregate-Verification algorithm on (C∗,(IDi∗)i=1,…,n,IDj∗) is true;(2)
There existsi∈{1,…,n} such that theSigncryption(mi∗,IDi∗,IDj∗) oracle orPartial-Private-Key-Extraction(IDi∗) oracle has not been queried.Game 7.
This game is played by a challengerC and aTypeII adversary A2.(i)
Initializing: this phase is the same as the first phase in Game 4.(ii)
Training: this phase is the same as the second phase in Game 4.(iii)
Forgery: this phase is the same as the third phase in Game 6.A 2 is considered to win this game iff(1)
The output of the execution ofAggregate-Verification algorithm on (C∗,(IDi∗)i=1,…,n,IDj∗) is true;(2)
There existsi∈{1,…,n} such that theSigncryption(mi∗,ID∗i,IDj∗) oracle orSecret-Value-Extraction(IDi∗) oracle has not been queried.Definition 8.
A CL-A-SC is considered to be existentially unforgeable against the adaptively chosen-message attack if there is no adversary ofType I orType II has a nonnegligible advantage to win Game 6 or Game 7, respectively.


## 2.3.1. Definition

LetU={U1,U2,…,Un} denote a set of users. The user with identity IDR is assumed to be the message receiver. The scheme consists of the following algorithms:(i)
CL-A-SC.Setup: on inputting the security parameter, this algorithm generates the public parametersparams and the master private key msk.(ii)
CL-A-SC.Key-Generation: this algorithm is carried out by each Ui and KGC interactively.
(1)
Givenparams, each Ui generates his/her user public/private key pair (upki,1,uski,1).(2)
Givenparams, msk, the identity IDi of Ui, and its corresponding user public key upki,1, KGC generates the partial public/private key pair (upki,2,uski,2).(3)
(upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Ui, respectively.(iii)
CL-A-SC.Signcryption: this algorithm is carried out by each Ui. On inputting params, a message mi, full private key (uski,1,uski,2) of Ui, and the public key (upkR,1,upkR,2) of the user with identity IDR, this algorithm outputs signcryption Ci on mi.(iv)
CL-A-SC.Aggregate: on inputting a set of signcryption schemes  (Ci)i=1,…,n, this algorithm outputs aggregate signcryption C on messages (mi)i=1,…,n.(v)
CL-A-SC.Aggregate-Verification: on inputting params, aggregate signcryption C and the set of users with its public keys, this algorithm outputs true if C is valid or false otherwise.(vi)
CL-A-SC.Designcryption: on inputting an aggregate signcryption C and the full private key (uskR,1,uskR,2) of the user with identity IDR, this algorithm outputs a set of messages (mi)i=1,…,n.


## 2.3.2. Security Model

There are two types of adversaries considered in the certificateless cryptosystem [19]. ATypeI adversary A1 is able to replace the public key of a legitimate user with a bogus one but cannot access the master private key. ATypeII adversary A2 is able to access the master private key but cannot execute the public key replacement. According to the protocol of [22], the security notions of data confidentiality and mutual authentication for the CL-A-SC scheme are captured by the indistinguishability and the existential unforgeability of the signcryption, respectively. By using the same security model provided in [22], the ability of the adversaries is modeled by the following four interactive games.Game 3.
This game is played by a challengerC and aType I adversary A1.(i)
Initializing: C executesCL-A-SC.Setup algorithm to obtain the public parameters params and the master private key msk. After that, C sends params to A1.(ii)
Training: A1 is able to query the following oracles (these oracles model the capability of A1 in reality) in an adaptive manner:
(a)
Secret-Value-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding secret value uski,1 to A1.(b)
Partial-Private-Key-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding partial private key uski,2 to A1.(c)
Public-Key-Extraction(IDi): on receiving the query on IDi, this oracle returns the corresponding public key (upki,1,upki,2) to A1.(d)
Public-Key-Replacement(IDi,upki,1′,upki,2′): on receiving the query on IDi, this oracle updates the public key (upki,1,upki,2) into (upki,1′,upki,2′).(e)
Signcryption(mi,IDi,IDj): on receiving the query on IDi, IDj, and a message mi, this oracle prompts C to executeCL-A-SC.Signcryption algorithm to get signcryption Ci on mi, where IDi and IDj are considered to be identity of the sender and the receiver, respectively. After that, C returns Ci to A1.(f)
Designcryption(C,(IDi)i=1,…,n,IDj): on receiving the query on (IDi)i=1,…,n, IDj and aggregate signcryption C, where (IDi)i=1,…,n and IDj are considered to be identity of the senders and the receiver, respectively. This oracle prompts C to execute theCL-A-SC.Aggregate-Verification algorithm on (C,(IDi)i=1,…,n,IDj). If the output of this execution is false, this oracle returns “NULL” to A1; otherwise, C executesCL-A-SC.Designcryption algorithm on (C,(IDi)i=1,…,n,IDj) and returns the output of this execution to A1.(iii)
Challenging: A1 sends {(mi,0∗,mi,1∗,IDi∗)i=1,…,n,IDj∗} to C. On receiving this message, C randomly chooses a bit d∈{0,1}, generates the aggregate signcryption C∗ on ((mi,d∗,IDi∗)i=1,…,n,IDj∗), and then sends C∗ to A1. After that, A1 adaptively queries the same oracles as theTraining phase.(iv)
Guessing: a bit d′ is outputted by A1.A 1 is considered to win this game iff(1)
d′=d, where d and d′ are defined as above;(2)
The oraclePartial-Private-Key-Extraction(IDj) has never been queried;(3)
The oracleDesigncryption(C∗,(IDi′)i=1,…,n,IDj) has never been queried, where there exists i∈{1,…,n} such that IDi∗=IDi′.A 1’s advantage to win this game is defined as AdvA1IND-CCA-II=2Prd=d′-1.Game 4.
This game is played by a challengerC and a Type  II adversary A2.(i)
Initializing: this phase is the same as the first phase in Game 3, while C sends (params,msk) to A2.(ii)
Training: in this phase, A2 queries the same oracles (except thePublic-Key-Replacement oracle) and receives the same responses as the second phase in Game 3.(iii)
Guess: this phase is the same as the third phase in Game 3, where a bit d′ is outputted by A2.A 2 is considered to win this game iff(1)
d′=d, where d and d′ are defined as above;(2)
The oracleSecret-Value-Extraction(IDj) has never been queried;(3)
The oracleDesigncryption(C∗,(IDi′)i=1,…,n,IDj) has never been queried, where there exists i∈{1,…,n} such that IDi∗=IDi′.A 2’s advantage to win this game is defined as AdvA2IND-CCA-II=2Prd=d′-1.Definition 5.
A CL-A-SC scheme is considered to be secure against the adaptively chosen ciphertext attacks if there is no adversary ofType I orType II has a nonnegligible advantage to win Game 3 or Game 4, respectively.Game 6.
This game is played by a challengerC and aType I adversary A1.(i)
Initializing: this phase is the same as the first phase in Game 3.(ii)
Training: in this phase, A1 queries the same oracles and receives the same responses as the second phase of Game 3.(iii)
Forgery: A1 sends a forged aggregate signcryption C∗ on {(mi∗,IDi∗)i=1,…,n,IDj∗} to C, where (IDi∗)i=1,…,n and IDj∗ are considered to be identity of the senders and the receiver, respectively.A 1 is considered to win this game iff(1)
The output of the execution ofAggregate-Verification algorithm on (C∗,(IDi∗)i=1,…,n,IDj∗) is true;(2)
There existsi∈{1,…,n} such that theSigncryption(mi∗,IDi∗,IDj∗) oracle orPartial-Private-Key-Extraction(IDi∗) oracle has not been queried.Game 7.
This game is played by a challengerC and aTypeII adversary A2.(i)
Initializing: this phase is the same as the first phase in Game 4.(ii)
Training: this phase is the same as the second phase in Game 4.(iii)
Forgery: this phase is the same as the third phase in Game 6.A 2 is considered to win this game iff(1)
The output of the execution ofAggregate-Verification algorithm on (C∗,(IDi∗)i=1,…,n,IDj∗) is true;(2)
There existsi∈{1,…,n} such that theSigncryption(mi∗,ID∗i,IDj∗) oracle orSecret-Value-Extraction(IDi∗) oracle has not been queried.Definition 8.
A CL-A-SC is considered to be existentially unforgeable against the adaptively chosen-message attack if there is no adversary ofType I orType II has a nonnegligible advantage to win Game 6 or Game 7, respectively.


## 2.4. Objectives

The design goals of the proposed protocol are defined as follows:(1)
Data confidentiality and integrity: it is desirable to secure the transmitted data from revealing the sensitive information about the source mobile sensor. Besides, it is required to ensure the data has not been tampered [23].(2)
Mutual authentication: it is desirable that the RSU and the mobile sensor are allowed to authenticate each other [24].(3)
Anonymity: it is desirable to hide the real identity of the mobile sensor during the transmission [25, 26].(4)
Key escrow resilience: it is desirable that the adversary is unable to obtain the full private key of any mobile sensor even if CC has been compromised [27].


## 3. Cryptanalysis of Basudan et al.’s CL-A-SC Scheme

In this section, Basudan et al.’s CL-A-SC scheme is briefly reviewed. After that, their scheme is demonstrated to be insecure against the public-key-replacement attack.


### 3.1. Notations

To ensure the consistency, the notations are defined in the Symbols. Concretely, each sensorSi is able to generate a real-time message mi={Ti,j,Lj,Sigi} when sensing the road condition RCj. After that, Si generates signcryption on mi to construct the road condition report RCRi,j and then sends RCRi,j to the nearest RSU.


### 3.2. Review of Basudan et al.’s CL-A-SC Scheme

The CL-A-SC scheme in the protocol of [20] consists of the following algorithms:(i)
Setup: let G be an additive cyclic group of prime order q, GT be a multiplicative cyclic group of the same order, e^:G×G→GT be an admissible bilinear map, and P∈G denote a generator of G. Let H1, H2, H3, and H4 be four cryptographic hash functions such that H1:0,1∗→Zq∗, H2:{0,1}∗×{0,1}∗×G5→{0,1}n, H3:{0,1}∗×{0,1}∗×{0,1}∗×{0,1}n×G5→G, and H4:Zq∗→G, where n is assumed to be the bit length of messages. Randomly choose msk∈Zq∗ as the master private key and calculates mpk=mskP. The public parameters params={G,GT,e^,P,q,mpk,H1,H2,H3,H4}.(ii)
Key-Generation:
(1)
Fori ranges from 1 to n, each mobile sensor Si randomly chooses uski,1∈RZq∗ and calculates upki,1=uski,1·P, hi=H1(IDi). After that, Si sends IDi to CC.(2)
Upon receivingIDi from Si, CC randomly chooses yi∈RZq∗ and calculates upki,2=yi·P, uski,2=yi+H1(IDi)msk. After that, CC sends {upki,2,uski,2} to Si.(3)
Upon receiving{upki,2,uski,2} from CC, Si checks if uski,2P=upki,2+hi·mpk. If the verification holds, (upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Si, respectively.(iii)
Signcryption: the RSU with identity IDR is assumed to be the message receiver. For i ranges from 1 to n, Si randomly chooses ri∈RZq∗ and calculates vi,1=ri·upkR,1, vi,2=ri(upkR,2+hR·mpk), fi,1=ri·P, hi,1=H2(IDR,Δ,upkR,1,upkR,2,fi,1,vi,1,vi,2), fi,2=hi,1⊕mi, hi,2=H3(IDR,Δ,hi,fi,2,upkR,1,upkR,2,fi,1,upki,1,upki,2), hi,3=H4(Δ), and fi,3=uski,2·hi,3+ri·hi,2+uski,1·hi,3, where Δ is the state information and hR=H1(IDR). After that, Si constructs Ci={fi,1,fi,2,fi,3}, RCRi,j={hi,Ci} and sends RCRi,j to the RSU with identity IDR.(iv)
Aggregate: upon receiving (RCRi,j)i=1,…,n, the RSU with identity IDR calculates FR,3=∑i=1nfi,3.(v)
Aggregate-Verification: for i ranges from 1 to n, RSU calculates hi,2′=H3(IDR,Δ,hi,fi,2,upkR,1,upkR,2,fi,1,upki,1,upki,2) and hi,3′=H4(Δ), where hi=H1(IDi). RSU checks if e^(FR,3,P)=e^(∑i=1n(upki,2+hi·mpk),hi,3′)∏i=1n‍e^(fi,1,hi,2′)e^(∑i=1nupki,1,hi,3′).(vi)
Designcryption: if the verification in theAggregate-Verification algorithm holds, RSU calculates vi,1′=uskR,1·fi,1, vi,2′=uskR,2·fi,1, hi,1′=H2(IDR,Δ,upkR,1,upkR,2,fi,1,vi,1′,vi,2′), and mi′=fi,2⊕hi,1′ for i ranges from 1 to n.


### 3.3. Forgery Attack against Basudan et al.’s CL-A-SC Scheme

Basudan et al. [20] claimed that their CL-A-SC scheme proved to be able to achieve indistinguishability and unforgeability against theType I andType II adversary. However, the adversary A1 ofType I is able to forge signcryption on any message m∗ by launching a public-key-replacement attack, which is described as follows:(i)
Public-Key-Replacement: given a mobile sensor Si, A1 randomly chooses uski,1∗,yi∗∈Zq∗ and calculates upki,1∗=uski,1∗P, upki,2∗=yi∗P-hi·mpk, where hi=H1(IDi). After that, (upki,1∗,upki,2∗) is set to be the full public key of Si.(ii)
Signature-Forgery: A1 randomly chooses ri∗∈RZq∗ and calculates fi,1∗=ri∗P, vi,1∗=ri∗upkR,1, vi,2∗=ri∗(upkR,2+hR·mpk), hi,1∗=H2(IDR,Δ,upkR,1,upkR,2,fi,1∗,vi,1∗,vi,2∗), fi,2∗=hi,1∗⊕mi∗, hi,2∗=H3(IDR,Δ,hi,fi,2∗,upkR,1,upkR,2,fi,1∗,upki,1∗, upki,2∗), hi,3=H4(Δ), and fi,3∗=yi∗hi,3+ri∗hi,2∗+uski,1∗hi,3, where mi∗ is forged by A1 under the state information Δ and hR=H1(IDR). After that, A1 constructs Ci∗={fi,1∗,fi,2∗,fi,3∗}, RCRi,j∗={hi,Ci∗} and sends RCRi,j∗ to the RSU with identity IDR.(iii)
Aggregate: the RSU calculates FR,3=∑j=1n,j≠ifj,3+fi,3∗.(iv)
Aggregate-Verification: for j ranges from 1 to n, the RSU calculates hj,2′=H3(IDR,Δ,hj,fj,2,upkR,1,upkR,2,fj,1,upkj,1,upkj,2) and hj,3′=H4(Δ), where hj=H1(IDj). After that, the RSU checks if e^(FR,3,P)=e^(∑j=1nupkj,2+hj·mpk,hj,3′)∏j=1n‍e^(fj,1,hj,2′)e^(∑j=1nupkj,1,hj,3′).The correctness ofCi∗ can be easily verified since(1)e^FR,3,P=e^∑j=1nfj,3,P=e^∑j=1nuskj,2H4Δ+rjhj,2+uskj,1H4Δ,P=e^∑j=1n,j≠iuskj,2+yi∗H4Δ,P×e^∑j=1n,j≠irjhj,2′+ri∗hi,2′,P×e^∑j=1n,j≠iuskj,1+uski,1∗H4Δ,P=e^∑j=1n,j≠iupkj,2+hj·mpk+upki,2∗+hi·mpk,H4Δ×∏j=1n,j≠ie^fj,1,hj,2′×e^fi,1∗,hi,2′×e^∑j=1n,j≠iupkj,1+upki,1∗,H4Δ=e^∑j=1nupkj,2+hj·mpk,hj,3′×∏j=1ne^fj,1,hj,2′×e^∑j=1nupkj,1,hj,3′.Thus, the verification holds. The messagem∗ is recovered by the RSU according to the specification ofDesigncryption algorithm.Remark 9.
The fundamental flaw of Basudan et al.’s CL-A-SC scheme against this forgery attack is due to the unreasonable position of the valueH1(IDi)·msk. As described above, A1 is allowed to generate upki,2∗=yi∗P-hi·mpk to replace Si’s public key. According to the specification of the protocol in [20], uski,2P=upki,2+H1(IDi)mpk, and thus uski,2P=yi∗P. A1 calculates fi,3∗=yi∗hi,3∗+ri∗hi,2∗+uski,1∗hi,3∗ and then successfully forges the signcryption Ci∗. It is noted that this type of adversary has not been mentioned in their security proof. Hence, the proof fails.


## 3.1. Notations

To ensure the consistency, the notations are defined in the Symbols. Concretely, each sensorSi is able to generate a real-time message mi={Ti,j,Lj,Sigi} when sensing the road condition RCj. After that, Si generates signcryption on mi to construct the road condition report RCRi,j and then sends RCRi,j to the nearest RSU.


## 3.2. Review of Basudan et al.’s CL-A-SC Scheme

The CL-A-SC scheme in the protocol of [20] consists of the following algorithms:(i)
Setup: let G be an additive cyclic group of prime order q, GT be a multiplicative cyclic group of the same order, e^:G×G→GT be an admissible bilinear map, and P∈G denote a generator of G. Let H1, H2, H3, and H4 be four cryptographic hash functions such that H1:0,1∗→Zq∗, H2:{0,1}∗×{0,1}∗×G5→{0,1}n, H3:{0,1}∗×{0,1}∗×{0,1}∗×{0,1}n×G5→G, and H4:Zq∗→G, where n is assumed to be the bit length of messages. Randomly choose msk∈Zq∗ as the master private key and calculates mpk=mskP. The public parameters params={G,GT,e^,P,q,mpk,H1,H2,H3,H4}.(ii)
Key-Generation:
(1)
Fori ranges from 1 to n, each mobile sensor Si randomly chooses uski,1∈RZq∗ and calculates upki,1=uski,1·P, hi=H1(IDi). After that, Si sends IDi to CC.(2)
Upon receivingIDi from Si, CC randomly chooses yi∈RZq∗ and calculates upki,2=yi·P, uski,2=yi+H1(IDi)msk. After that, CC sends {upki,2,uski,2} to Si.(3)
Upon receiving{upki,2,uski,2} from CC, Si checks if uski,2P=upki,2+hi·mpk. If the verification holds, (upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Si, respectively.(iii)
Signcryption: the RSU with identity IDR is assumed to be the message receiver. For i ranges from 1 to n, Si randomly chooses ri∈RZq∗ and calculates vi,1=ri·upkR,1, vi,2=ri(upkR,2+hR·mpk), fi,1=ri·P, hi,1=H2(IDR,Δ,upkR,1,upkR,2,fi,1,vi,1,vi,2), fi,2=hi,1⊕mi, hi,2=H3(IDR,Δ,hi,fi,2,upkR,1,upkR,2,fi,1,upki,1,upki,2), hi,3=H4(Δ), and fi,3=uski,2·hi,3+ri·hi,2+uski,1·hi,3, where Δ is the state information and hR=H1(IDR). After that, Si constructs Ci={fi,1,fi,2,fi,3}, RCRi,j={hi,Ci} and sends RCRi,j to the RSU with identity IDR.(iv)
Aggregate: upon receiving (RCRi,j)i=1,…,n, the RSU with identity IDR calculates FR,3=∑i=1nfi,3.(v)
Aggregate-Verification: for i ranges from 1 to n, RSU calculates hi,2′=H3(IDR,Δ,hi,fi,2,upkR,1,upkR,2,fi,1,upki,1,upki,2) and hi,3′=H4(Δ), where hi=H1(IDi). RSU checks if e^(FR,3,P)=e^(∑i=1n(upki,2+hi·mpk),hi,3′)∏i=1n‍e^(fi,1,hi,2′)e^(∑i=1nupki,1,hi,3′).(vi)
Designcryption: if the verification in theAggregate-Verification algorithm holds, RSU calculates vi,1′=uskR,1·fi,1, vi,2′=uskR,2·fi,1, hi,1′=H2(IDR,Δ,upkR,1,upkR,2,fi,1,vi,1′,vi,2′), and mi′=fi,2⊕hi,1′ for i ranges from 1 to n.


## 3.3. Forgery Attack against Basudan et al.’s CL-A-SC Scheme

Basudan et al. [20] claimed that their CL-A-SC scheme proved to be able to achieve indistinguishability and unforgeability against theType I andType II adversary. However, the adversary A1 ofType I is able to forge signcryption on any message m∗ by launching a public-key-replacement attack, which is described as follows:(i)
Public-Key-Replacement: given a mobile sensor Si, A1 randomly chooses uski,1∗,yi∗∈Zq∗ and calculates upki,1∗=uski,1∗P, upki,2∗=yi∗P-hi·mpk, where hi=H1(IDi). After that, (upki,1∗,upki,2∗) is set to be the full public key of Si.(ii)
Signature-Forgery: A1 randomly chooses ri∗∈RZq∗ and calculates fi,1∗=ri∗P, vi,1∗=ri∗upkR,1, vi,2∗=ri∗(upkR,2+hR·mpk), hi,1∗=H2(IDR,Δ,upkR,1,upkR,2,fi,1∗,vi,1∗,vi,2∗), fi,2∗=hi,1∗⊕mi∗, hi,2∗=H3(IDR,Δ,hi,fi,2∗,upkR,1,upkR,2,fi,1∗,upki,1∗, upki,2∗), hi,3=H4(Δ), and fi,3∗=yi∗hi,3+ri∗hi,2∗+uski,1∗hi,3, where mi∗ is forged by A1 under the state information Δ and hR=H1(IDR). After that, A1 constructs Ci∗={fi,1∗,fi,2∗,fi,3∗}, RCRi,j∗={hi,Ci∗} and sends RCRi,j∗ to the RSU with identity IDR.(iii)
Aggregate: the RSU calculates FR,3=∑j=1n,j≠ifj,3+fi,3∗.(iv)
Aggregate-Verification: for j ranges from 1 to n, the RSU calculates hj,2′=H3(IDR,Δ,hj,fj,2,upkR,1,upkR,2,fj,1,upkj,1,upkj,2) and hj,3′=H4(Δ), where hj=H1(IDj). After that, the RSU checks if e^(FR,3,P)=e^(∑j=1nupkj,2+hj·mpk,hj,3′)∏j=1n‍e^(fj,1,hj,2′)e^(∑j=1nupkj,1,hj,3′).The correctness ofCi∗ can be easily verified since(1)e^FR,3,P=e^∑j=1nfj,3,P=e^∑j=1nuskj,2H4Δ+rjhj,2+uskj,1H4Δ,P=e^∑j=1n,j≠iuskj,2+yi∗H4Δ,P×e^∑j=1n,j≠irjhj,2′+ri∗hi,2′,P×e^∑j=1n,j≠iuskj,1+uski,1∗H4Δ,P=e^∑j=1n,j≠iupkj,2+hj·mpk+upki,2∗+hi·mpk,H4Δ×∏j=1n,j≠ie^fj,1,hj,2′×e^fi,1∗,hi,2′×e^∑j=1n,j≠iupkj,1+upki,1∗,H4Δ=e^∑j=1nupkj,2+hj·mpk,hj,3′×∏j=1ne^fj,1,hj,2′×e^∑j=1nupkj,1,hj,3′.Thus, the verification holds. The messagem∗ is recovered by the RSU according to the specification ofDesigncryption algorithm.Remark 9.
The fundamental flaw of Basudan et al.’s CL-A-SC scheme against this forgery attack is due to the unreasonable position of the valueH1(IDi)·msk. As described above, A1 is allowed to generate upki,2∗=yi∗P-hi·mpk to replace Si’s public key. According to the specification of the protocol in [20], uski,2P=upki,2+H1(IDi)mpk, and thus uski,2P=yi∗P. A1 calculates fi,3∗=yi∗hi,3∗+ri∗hi,2∗+uski,1∗hi,3∗ and then successfully forges the signcryption Ci∗. It is noted that this type of adversary has not been mentioned in their security proof. Hence, the proof fails.


## 4. Our Proposed Protocol

In this section, a concrete CL-A-SC scheme is proposed, which is the building block of our data aggregation protocol.


### 4.1. The Proposed CL-A-SC Scheme

This scheme consists of the following algorithms:(i)
CL-A-SC.Setup: let p and q be two large primes such that q divides p-1, E be an elliptic curve over a finite field Fp, and G be an additive cyclic group formed by E with the point addition law. Let P be a generator of G and H1:{0,1}∗×G3→Zq∗, H2:G×{0,1}∗×{0,1}n→Zq∗, H3:G×G→Zq∗ be three cryptographic hash functions. Randomly choose msk∈RZq∗ as the master private key and calculates mpk=mskP. The system parameter params=(p,q,P,mpk,H1,H2,H3).(ii)
CL-A-SC.Key-Generation:
(1)
The user randomly choosesuski,1∈RZq∗ and calculates upki,1=uski,1·P. After that, the user sends {IDi,upki,1} to KGC.(2)
KGC randomly choosesyi∈RZq∗ and calculates upki,2=yi·P, uski,2=yi+H1(IDi,upki,1,upki,2,mpk)msk. After that, KGC sends {upki,2,uski,2} to the user with identity IDi.(3)
The user with identityIDi checks if upki,2+hi·mpk=uski,2P, where hi=H1(IDi,upki,1,upki,2,mpk). If the verification holds, (upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of the user, respectively.(iii)
CL-A-SC.Signcryption: the user IDi randomly chooses ri∈RZq∗ and calculates vi,1=ri·upkR,1, fi,1=ri·P, fi,2=ri·(uski,1+uski,2+fi,3)-1, and ci=H3(vi,1,vi,2)⊕mi, where vi,2=ri(upkR,2+hR·mpk) and fi,3=H2(fi,1,IDi,mi)+H2(vi,1,IDR,mi), where hR=H1(IDR,upkR,1,upkR,2,mpk). After that, the user IDi sends the ciphertext Ci={fi,1,fi,2,fi,3,ci} to the user with identity IDR.(iv)
CL-A-SC.Aggregate: upon receiving (Ci)i=1,…,n, the user with identity IDR calculates FR,3=∑i=1nfi,3.(v)
CL-A-SC.Aggregate-Verification: for i ranges from 1 to n, the user with identity IDR calculates hi′=H1(IDi,upki,1,upki,2,mpk). After that, this user checks if ∑i=1nupki,1+∑i=1nupki,2+∑i=1nhi′·mpk+FR,3·P=∑i=1nfi,1·fi,2-1.(vi)
CL-A-SC.Designcryption: if the verification in theAggregate-Verification algorithm holds, the user with identity IDR calculates vi,1′=uskR,1·fi,1, vi,2′=uskR,2·fi,1, and mi=H3(vi,1′,vi,2′)⊕ci for i ranges from 1 to n.


### 4.2. The Data Aggregation Protocol

In this part, our data aggregation protocol is proposed, which involves the CC, RSU, and mobile sensors. The suggested protocol is comprised of four phases: system initialization, data generation and transmission, aggregate verification, and data retrieval.


#### 4.2.1. System Initialization

In this phase, CC performs theCL-A-SC.Setup algorithm to initialize the system. The system parameter params=(p,q,P,mpk,H1,H2,H3). After that, the mobile sensors and the RSUs are allowed to register to CC by performing the following steps:(1)
Fori ranges from 1 to n, each mobile sensor Si randomly chooses uski,1∈RZq∗ and calculates upki,1=uski,1·P. After that, Si sends {IDi,upki,1} to CC.(2)
Upon receiving{IDi,upki,1} from Si, CC randomly chooses yi∈RZq∗ and calculates upki,2=yi·P, uski,2=yi+H1(IDi,upki,1,upki,2,mpk)msk. After that, CC sends {upki,2,uski,2} to Si.(3)
Upon receiving{upki,2,uski,2} from CC, Si checks if upki,2+hi·mpk=uski,2P, where hi=H1(IDi,upki,1,upki,2,mpk). If the verification holds, (upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Si, respectively.It is worth noting that the format of the road condition report is defined by CC in this phase. Concretely, each mobile sensorSi is able to generate mi={Ti,j,Lj,Sigi} when sensing the road condition RCj, where Ti,j is the time when Si sensed RCj, Lj is the location where RCj occurred, and Sigi is the action signal about RCj. After that, Si generates signcryption on mi to construct the road condition report RCRi,j.


#### 4.2.2. Data Generation and Transmission

In this phase,Si is allowed to generate signcryption on mi to construct RCRi,j. After that, RCRi,j is sent to the nearest RSU. The identity of this RSU is assumed to be IDR. This phase consists of the following steps:(1)
Si randomly chooses ri∈RZq∗ and calculates vi,1=ri·upkR,1, fi,1=ri·P, fi,2=ri·(uski,1+uski,2+fi,3)-1, and ci=H3(vi,1,vi,2)⊕mi, where vi,2=ri(upkR,2+hR·mpk), fi,3=H2(fi,1,IDi,mi)+H2(vi,1,IDR,mi), and hR=H1(IDR,upkR,1,upkR,2,mpk).(2)
Si sends RCRi,j={fi,1,fi,2,fi,3,ci} to the RSU with identity IDR.To protect private information of mobile sensors, the real identity of eachSi cannot be retrieved from RCRi,j. In this way, the anonymity of mobile sensors is preserved.


#### 4.2.3. Aggregate Verification

Upon receiving the reports(RCRi,j)i=1,…,n from the sensors (Si)i=1,…,n on a road condition RCj, the RSU is allowed to aggregate the ciphertexts and then verify the authenticity of the aggregate data. The identity of this RSU is assumed to be IDR. The aggregation and verification procedures are carried out by performing the following steps:(1)
The RSU calculatesFR,3=∑i=1nfi,3.(2)
Fori ranges from 1 to n, the RSU calculates hi′=H1(IDi,upki,1,upki,2,mpk). After that, this RSU checks if ∑i=1nupki,1+∑i=1nupki,2+∑i=1nhi′·mpk+FR,3·P=∑i=1nfi,1·fi,2-1.If the equation holds, this RSU accepts the received reports and executes the next phase. Otherwise, this RSU aborts these reports.


#### 4.2.4. Data Retrieval

If the verification in the previous phase holds, the RSU retrieves(mi)i=1,…,n as follows:(1)
Fori ranges from 1 to n, the RSU calculates vi,1′=uskR,1·fi,1 and vi,2′=uskR,2·fi,1.(2)
This RSU calculatesmi=H3(vi,1′,vi,2′)⊕ci for i ranges from 1 to n.


## 4.1. The Proposed CL-A-SC Scheme

This scheme consists of the following algorithms:(i)
CL-A-SC.Setup: let p and q be two large primes such that q divides p-1, E be an elliptic curve over a finite field Fp, and G be an additive cyclic group formed by E with the point addition law. Let P be a generator of G and H1:{0,1}∗×G3→Zq∗, H2:G×{0,1}∗×{0,1}n→Zq∗, H3:G×G→Zq∗ be three cryptographic hash functions. Randomly choose msk∈RZq∗ as the master private key and calculates mpk=mskP. The system parameter params=(p,q,P,mpk,H1,H2,H3).(ii)
CL-A-SC.Key-Generation:
(1)
The user randomly choosesuski,1∈RZq∗ and calculates upki,1=uski,1·P. After that, the user sends {IDi,upki,1} to KGC.(2)
KGC randomly choosesyi∈RZq∗ and calculates upki,2=yi·P, uski,2=yi+H1(IDi,upki,1,upki,2,mpk)msk. After that, KGC sends {upki,2,uski,2} to the user with identity IDi.(3)
The user with identityIDi checks if upki,2+hi·mpk=uski,2P, where hi=H1(IDi,upki,1,upki,2,mpk). If the verification holds, (upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of the user, respectively.(iii)
CL-A-SC.Signcryption: the user IDi randomly chooses ri∈RZq∗ and calculates vi,1=ri·upkR,1, fi,1=ri·P, fi,2=ri·(uski,1+uski,2+fi,3)-1, and ci=H3(vi,1,vi,2)⊕mi, where vi,2=ri(upkR,2+hR·mpk) and fi,3=H2(fi,1,IDi,mi)+H2(vi,1,IDR,mi), where hR=H1(IDR,upkR,1,upkR,2,mpk). After that, the user IDi sends the ciphertext Ci={fi,1,fi,2,fi,3,ci} to the user with identity IDR.(iv)
CL-A-SC.Aggregate: upon receiving (Ci)i=1,…,n, the user with identity IDR calculates FR,3=∑i=1nfi,3.(v)
CL-A-SC.Aggregate-Verification: for i ranges from 1 to n, the user with identity IDR calculates hi′=H1(IDi,upki,1,upki,2,mpk). After that, this user checks if ∑i=1nupki,1+∑i=1nupki,2+∑i=1nhi′·mpk+FR,3·P=∑i=1nfi,1·fi,2-1.(vi)
CL-A-SC.Designcryption: if the verification in theAggregate-Verification algorithm holds, the user with identity IDR calculates vi,1′=uskR,1·fi,1, vi,2′=uskR,2·fi,1, and mi=H3(vi,1′,vi,2′)⊕ci for i ranges from 1 to n.


## 4.2. The Data Aggregation Protocol

In this part, our data aggregation protocol is proposed, which involves the CC, RSU, and mobile sensors. The suggested protocol is comprised of four phases: system initialization, data generation and transmission, aggregate verification, and data retrieval.


### 4.2.1. System Initialization

In this phase, CC performs theCL-A-SC.Setup algorithm to initialize the system. The system parameter params=(p,q,P,mpk,H1,H2,H3). After that, the mobile sensors and the RSUs are allowed to register to CC by performing the following steps:(1)
Fori ranges from 1 to n, each mobile sensor Si randomly chooses uski,1∈RZq∗ and calculates upki,1=uski,1·P. After that, Si sends {IDi,upki,1} to CC.(2)
Upon receiving{IDi,upki,1} from Si, CC randomly chooses yi∈RZq∗ and calculates upki,2=yi·P, uski,2=yi+H1(IDi,upki,1,upki,2,mpk)msk. After that, CC sends {upki,2,uski,2} to Si.(3)
Upon receiving{upki,2,uski,2} from CC, Si checks if upki,2+hi·mpk=uski,2P, where hi=H1(IDi,upki,1,upki,2,mpk). If the verification holds, (upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Si, respectively.It is worth noting that the format of the road condition report is defined by CC in this phase. Concretely, each mobile sensorSi is able to generate mi={Ti,j,Lj,Sigi} when sensing the road condition RCj, where Ti,j is the time when Si sensed RCj, Lj is the location where RCj occurred, and Sigi is the action signal about RCj. After that, Si generates signcryption on mi to construct the road condition report RCRi,j.


### 4.2.2. Data Generation and Transmission

In this phase,Si is allowed to generate signcryption on mi to construct RCRi,j. After that, RCRi,j is sent to the nearest RSU. The identity of this RSU is assumed to be IDR. This phase consists of the following steps:(1)
Si randomly chooses ri∈RZq∗ and calculates vi,1=ri·upkR,1, fi,1=ri·P, fi,2=ri·(uski,1+uski,2+fi,3)-1, and ci=H3(vi,1,vi,2)⊕mi, where vi,2=ri(upkR,2+hR·mpk), fi,3=H2(fi,1,IDi,mi)+H2(vi,1,IDR,mi), and hR=H1(IDR,upkR,1,upkR,2,mpk).(2)
Si sends RCRi,j={fi,1,fi,2,fi,3,ci} to the RSU with identity IDR.To protect private information of mobile sensors, the real identity of eachSi cannot be retrieved from RCRi,j. In this way, the anonymity of mobile sensors is preserved.


### 4.2.3. Aggregate Verification

Upon receiving the reports(RCRi,j)i=1,…,n from the sensors (Si)i=1,…,n on a road condition RCj, the RSU is allowed to aggregate the ciphertexts and then verify the authenticity of the aggregate data. The identity of this RSU is assumed to be IDR. The aggregation and verification procedures are carried out by performing the following steps:(1)
The RSU calculatesFR,3=∑i=1nfi,3.(2)
Fori ranges from 1 to n, the RSU calculates hi′=H1(IDi,upki,1,upki,2,mpk). After that, this RSU checks if ∑i=1nupki,1+∑i=1nupki,2+∑i=1nhi′·mpk+FR,3·P=∑i=1nfi,1·fi,2-1.If the equation holds, this RSU accepts the received reports and executes the next phase. Otherwise, this RSU aborts these reports.


### 4.2.4. Data Retrieval

If the verification in the previous phase holds, the RSU retrieves(mi)i=1,…,n as follows:(1)
Fori ranges from 1 to n, the RSU calculates vi,1′=uskR,1·fi,1 and vi,2′=uskR,2·fi,1.(2)
This RSU calculatesmi=H3(vi,1′,vi,2′)⊕ci for i ranges from 1 to n.


## 4.2.1. System Initialization

In this phase, CC performs theCL-A-SC.Setup algorithm to initialize the system. The system parameter params=(p,q,P,mpk,H1,H2,H3). After that, the mobile sensors and the RSUs are allowed to register to CC by performing the following steps:(1)
Fori ranges from 1 to n, each mobile sensor Si randomly chooses uski,1∈RZq∗ and calculates upki,1=uski,1·P. After that, Si sends {IDi,upki,1} to CC.(2)
Upon receiving{IDi,upki,1} from Si, CC randomly chooses yi∈RZq∗ and calculates upki,2=yi·P, uski,2=yi+H1(IDi,upki,1,upki,2,mpk)msk. After that, CC sends {upki,2,uski,2} to Si.(3)
Upon receiving{upki,2,uski,2} from CC, Si checks if upki,2+hi·mpk=uski,2P, where hi=H1(IDi,upki,1,upki,2,mpk). If the verification holds, (upki,1,upki,2) and (uski,1,uski,2) are set to be the full public key and full private key of Si, respectively.It is worth noting that the format of the road condition report is defined by CC in this phase. Concretely, each mobile sensorSi is able to generate mi={Ti,j,Lj,Sigi} when sensing the road condition RCj, where Ti,j is the time when Si sensed RCj, Lj is the location where RCj occurred, and Sigi is the action signal about RCj. After that, Si generates signcryption on mi to construct the road condition report RCRi,j.


## 4.2.2. Data Generation and Transmission

In this phase,Si is allowed to generate signcryption on mi to construct RCRi,j. After that, RCRi,j is sent to the nearest RSU. The identity of this RSU is assumed to be IDR. This phase consists of the following steps:(1)
Si randomly chooses ri∈RZq∗ and calculates vi,1=ri·upkR,1, fi,1=ri·P, fi,2=ri·(uski,1+uski,2+fi,3)-1, and ci=H3(vi,1,vi,2)⊕mi, where vi,2=ri(upkR,2+hR·mpk), fi,3=H2(fi,1,IDi,mi)+H2(vi,1,IDR,mi), and hR=H1(IDR,upkR,1,upkR,2,mpk).(2)
Si sends RCRi,j={fi,1,fi,2,fi,3,ci} to the RSU with identity IDR.To protect private information of mobile sensors, the real identity of eachSi cannot be retrieved from RCRi,j. In this way, the anonymity of mobile sensors is preserved.


## 4.2.3. Aggregate Verification

Upon receiving the reports(RCRi,j)i=1,…,n from the sensors (Si)i=1,…,n on a road condition RCj, the RSU is allowed to aggregate the ciphertexts and then verify the authenticity of the aggregate data. The identity of this RSU is assumed to be IDR. The aggregation and verification procedures are carried out by performing the following steps:(1)
The RSU calculatesFR,3=∑i=1nfi,3.(2)
Fori ranges from 1 to n, the RSU calculates hi′=H1(IDi,upki,1,upki,2,mpk). After that, this RSU checks if ∑i=1nupki,1+∑i=1nupki,2+∑i=1nhi′·mpk+FR,3·P=∑i=1nfi,1·fi,2-1.If the equation holds, this RSU accepts the received reports and executes the next phase. Otherwise, this RSU aborts these reports.


## 4.2.4. Data Retrieval

If the verification in the previous phase holds, the RSU retrieves(mi)i=1,…,n as follows:(1)
Fori ranges from 1 to n, the RSU calculates vi,1′=uskR,1·fi,1 and vi,2′=uskR,2·fi,1.(2)
This RSU calculatesmi=H3(vi,1′,vi,2′)⊕ci for i ranges from 1 to n.


## 5. Analysis and Comparison

The correctness and security properties of the proposed protocol are analyzed in this section. After that, the comparison in terms of efficiency and security properties of the proposed protocol and the related works is presented.


### 5.1. Correctness Analysis

The correctness of the decryption procedure is presented as follows:(2)mi=H3vi,1′,vi,2′⊕ci=H3uskR,1·fi,1,uskR,2·fi,1⊕ci=H3ri·upkR,1,riyR+hR·mskP⊕ci=H3ri·upkR,1,riupkR,2+hRmpk⊕ci=H3vi,1,vi,2⊕ci=mi.The correctness of the verification procedure is presented as follows: (3)∑i=1nupki,1+∑i=1nupki,2+∑i=1nhi′·mpk+FR,3·P=∑i=1nuski,1·P+∑i=1nuski,2·P+∑i=1nfi,3·P=∑i=1nuski,1+uski,2+fi,3P=∑i=1nriuski,1+uski,2+fi,3Pri=∑i=1nfi,1fi,2.


### 5.2. Security Proof

In this part, the security proof of the proposed protocol is given under the random oracle model [28].Lemma 10.
The proposed protocol is indistinguishable against the chosen ciphertext attacks(Ind-CCA-II) of theType I adversary A1 in the random oracle model under theCDH assumption.Proof.
See AppendixA.Lemma 11.
The proposed protocol is indistinguishable against the chosen ciphertext attacks(Ind-CCA-II) of theType II adversary A2 in the random oracle model under theCDH assumption.Proof.
The proof of this lemma is omitted since it follows the proof of Lemma10.Theorem 12.
The proposed protocol achievesIND-CCA security under theCDH assumption.Proof.
Theorem12 is derived directly from Lemmas 10 and 11.Lemma 13.
The proposed protocol is existentially unforgeable against adaptive chosen-message attacks(EUF-CMA-II) of the Type  I adversary A1 in the random oracle model under theECDLP assumption.Proof.
See AppendixB.Lemma 14.
The proposed protocol is existentially unforgeable against adaptive chosen-message attacks(EUF-CMA-II) of theType II adversary A2 in the random oracle model under theECDLP assumption.Proof.
The proof of this lemma is omitted since it follows the proof of Lemma13.Theorem 15.
The proposed protocol achievesEUF-CMA security under theECDLP assumption.Proof.
Theorem15 is derived directly from Lemmas 13 and 14.


### 5.3. Security Strength

(1)
Data confidentiality and integrity: eachci is calculated as ci=H3(vi,1,vi,2)⊕mi, where vi,1, vi,2 can only be recovered by the RSU. The confidentiality of the data is proved in Theorem 12. Moreover, the RSU is able to decrypt and verify the received data. Thus, the integrity of the data is ensured. (2)
Mutual authentication: each mobile sensorSi authenticates itself by sending RCRi,j to the RSU. Only the RSU which keeps the private key (uskR,1,uskR,2) can recover mi. Besides, the RSU authenticates each sensor by verifying the received data. The unforgeability of the data is proved in Theorem 15. (3)
Anonymity: according to the specification of the proposed protocol, the real identity of each mobile sensorSi cannot be retrieved from the ciphertext. Thus, the proposed protocol achieves anonymity. (4)
Key escrow resilience: the proposed protocol is designed under the certificateless cryptosystem. Specifically, CC is only allowed to issue the partial private keyuski,2 for each mobile sensor Si. The adversary is unable to obtain the full private key (uski,1,uski,2) of Si even if CC is compromised. Thus, this protocol achieves key escrow resilience.


### 5.4. Comparison

The comparison of the security properties is presented in Table1, which includes data confidentiality and integrity (DCI), mutual authentication (MA), anonymity (AN), key escrow resilience (KER), and timing attack resilience (TAR). The timing attack is considered as a kind of side-channel attack [29]. In the execution of the cryptographic protocols, variations of the executing timing can leak some information if sensitive data is involved. By measuring the time which the sensors take to perform the cryptographic operations, the adversary is able to obtain some secret parameters of the sensors. It is required to reduce the computation overhead of the sensors. According to this comparison, it can be concluded that the proposed protocol is able to achieve all of the security goals, while Basudan et al.’s [20] protocol fails to achieve mutual authentication.Table 1
Comparison of security properties.
Protocols DCI MA AN KER TAR Basudan et al.’s protocol [20] ✓ – ✓ ✓ ✓ Xiong and Qin’s protocol [21] ✓ ✓ ✓ ✓ ✓ Our protocol ✓ ✓ ✓ ✓ ✓The comparison of the communication overhead is presented in Figure2. To get an intuitive comparison of the efficiency, the practical performance of the protocols is presented in Figures 3–5, respectively. To ensure the consistency, the 80-bit security level (RSA-1024 bit, ECC-160 bit equivalent) is adopted for both protocols. The implementation is based on a common hardware platform with Intel Core i5-4460 CPU at 3.2 GHz using the PBC library [30]. According to this comparison, it can be concluded that the proposed protocol outperforms the related works in terms of communication and computation overhead.Figure 2
Comparison of communication overhead.Figure 3
Computation overhead of Basudan et al.’s protocol.Figure 4
Computation overhead of the proposed protocol.Figure 5
Computation overhead of the Xiong and Qin’s protocol.


## 5.1. Correctness Analysis

The correctness of the decryption procedure is presented as follows:(2)mi=H3vi,1′,vi,2′⊕ci=H3uskR,1·fi,1,uskR,2·fi,1⊕ci=H3ri·upkR,1,riyR+hR·mskP⊕ci=H3ri·upkR,1,riupkR,2+hRmpk⊕ci=H3vi,1,vi,2⊕ci=mi.The correctness of the verification procedure is presented as follows: (3)∑i=1nupki,1+∑i=1nupki,2+∑i=1nhi′·mpk+FR,3·P=∑i=1nuski,1·P+∑i=1nuski,2·P+∑i=1nfi,3·P=∑i=1nuski,1+uski,2+fi,3P=∑i=1nriuski,1+uski,2+fi,3Pri=∑i=1nfi,1fi,2.


## 5.2. Security Proof

In this part, the security proof of the proposed protocol is given under the random oracle model [28].Lemma 10.
The proposed protocol is indistinguishable against the chosen ciphertext attacks(Ind-CCA-II) of theType I adversary A1 in the random oracle model under theCDH assumption.Proof.
See AppendixA.Lemma 11.
The proposed protocol is indistinguishable against the chosen ciphertext attacks(Ind-CCA-II) of theType II adversary A2 in the random oracle model under theCDH assumption.Proof.
The proof of this lemma is omitted since it follows the proof of Lemma10.Theorem 12.
The proposed protocol achievesIND-CCA security under theCDH assumption.Proof.
Theorem12 is derived directly from Lemmas 10 and 11.Lemma 13.
The proposed protocol is existentially unforgeable against adaptive chosen-message attacks(EUF-CMA-II) of the Type  I adversary A1 in the random oracle model under theECDLP assumption.Proof.
See AppendixB.Lemma 14.
The proposed protocol is existentially unforgeable against adaptive chosen-message attacks(EUF-CMA-II) of theType II adversary A2 in the random oracle model under theECDLP assumption.Proof.
The proof of this lemma is omitted since it follows the proof of Lemma13.Theorem 15.
The proposed protocol achievesEUF-CMA security under theECDLP assumption.Proof.
Theorem15 is derived directly from Lemmas 13 and 14.


## 5.3. Security Strength

(1)
Data confidentiality and integrity: eachci is calculated as ci=H3(vi,1,vi,2)⊕mi, where vi,1, vi,2 can only be recovered by the RSU. The confidentiality of the data is proved in Theorem 12. Moreover, the RSU is able to decrypt and verify the received data. Thus, the integrity of the data is ensured. (2)
Mutual authentication: each mobile sensorSi authenticates itself by sending RCRi,j to the RSU. Only the RSU which keeps the private key (uskR,1,uskR,2) can recover mi. Besides, the RSU authenticates each sensor by verifying the received data. The unforgeability of the data is proved in Theorem 15. (3)
Anonymity: according to the specification of the proposed protocol, the real identity of each mobile sensorSi cannot be retrieved from the ciphertext. Thus, the proposed protocol achieves anonymity. (4)
Key escrow resilience: the proposed protocol is designed under the certificateless cryptosystem. Specifically, CC is only allowed to issue the partial private keyuski,2 for each mobile sensor Si. The adversary is unable to obtain the full private key (uski,1,uski,2) of Si even if CC is compromised. Thus, this protocol achieves key escrow resilience.


## 5.4. Comparison

The comparison of the security properties is presented in Table1, which includes data confidentiality and integrity (DCI), mutual authentication (MA), anonymity (AN), key escrow resilience (KER), and timing attack resilience (TAR). The timing attack is considered as a kind of side-channel attack [29]. In the execution of the cryptographic protocols, variations of the executing timing can leak some information if sensitive data is involved. By measuring the time which the sensors take to perform the cryptographic operations, the adversary is able to obtain some secret parameters of the sensors. It is required to reduce the computation overhead of the sensors. According to this comparison, it can be concluded that the proposed protocol is able to achieve all of the security goals, while Basudan et al.’s [20] protocol fails to achieve mutual authentication.Table 1
Comparison of security properties.
Protocols DCI MA AN KER TAR Basudan et al.’s protocol [20] ✓ – ✓ ✓ ✓ Xiong and Qin’s protocol [21] ✓ ✓ ✓ ✓ ✓ Our protocol ✓ ✓ ✓ ✓ ✓The comparison of the communication overhead is presented in Figure2. To get an intuitive comparison of the efficiency, the practical performance of the protocols is presented in Figures 3–5, respectively. To ensure the consistency, the 80-bit security level (RSA-1024 bit, ECC-160 bit equivalent) is adopted for both protocols. The implementation is based on a common hardware platform with Intel Core i5-4460 CPU at 3.2 GHz using the PBC library [30]. According to this comparison, it can be concluded that the proposed protocol outperforms the related works in terms of communication and computation overhead.Figure 2
Comparison of communication overhead.Figure 3
Computation overhead of Basudan et al.’s protocol.Figure 4
Computation overhead of the proposed protocol.Figure 5
Computation overhead of the Xiong and Qin’s protocol.


## 6. Conclusion

The security and privacy concerns are essential and challenging issues in road surface condition monitoring system. In this paper, the security flaw of a certificateless data aggregation protocol in [20] for monitoring system is pointed out. After that, a light-weight and anonymous data aggregation protocol is introduced, which is constructed by combining a CL-A-SC scheme and the fog computing architecture. The proposed protocol is proved secure under the random oracle model and achieves desirable security properties including data confidentiality, mutual authentication, anonymity and key escrow resilience. Besides, an experimental simulation of the proposed protocol and the protocol in [20] is presented. According to the comparison results, the proposed protocol is efficient and more practical for the road surface condition monitoring system.



---

*Source: 1378583-2018-04-18.xml*