# Threshold Key Management Scheme for Blockchain-Based Intelligent Transportation Systems

Authors: Tianqi Zhou; Jian Shen; Yongjun Ren; Sai Ji
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Intelligent transportation systems (ITS) have always been an important application of Internet of Things (IoT). Today, big data and cloud computing have further promoted the construction and development of ITS. At the same time, the development of blockchain has also brought new features and convenience to ITS. However, due to the endless emergence of increasingly advanced types of attacks, the security of blockchain-based ITS needs more attention from industry and academia. In this paper, we focus on exploring the primitives in cryptography to guarantee the security of blockchain-based ITS. In particular, the authentication, encryption, and key management schemes in cryptography are discussed. Furthermore, we propose two methods for achieving the threshold key management in blockchain-based ITS. The proposed threshold key management scheme (with thresholdt) enables various stakeholders to recover a secret if the number of participated stakeholders is at least t. It should be noted that the proposed threshold key management scheme is efficient and secure for multiple users in blockchain-based ITS, especially for the data-sharing scenario.


---

## Body

## 1. Introduction

Nowadays, Internet of Things (IoT) [1, 2] have experienced unprecedented development due to the widespread of big data and cloud computing [3]. Modern intelligent transportation systems (ITS) [4–7] have extensively benefited from IoT technology. At the same time, the development of blockchain [8, 9] has also brought new features and convenience to ITS. However, due to the endless emergence of increasingly advanced types of attacks, the security of blockchain-based ITS needs more attention from industry and academia. The problems in ITS, such as data origin authentication, reliability, and trustworthiness, are required to be solved. Note that the blockchain technology maintains the decentralized, distributed, and tamperproof properties [8], which can guarantee the security and reliability of ITS communication. Also, the security of ITS requires more attention and delicate design to prevent it from various attacks. Generally speaking, the security attributes of ITS security mainly include confidentiality, integrity, consistency, and availability. Confidentiality means that the transmitted data in ITS will not be leaked and accessed illegally. Note that encryption is an effective method to protect the confidentiality of the transmitted data in ITS. Integrity means that the data in ITS will not be maliciously destroyed and deleted. Consistency means that the data in ITS meets the entity integrity. The auditing scheme in cryptography can be employed to protect the integrity and consistency of ITS. Availability means that if a user is authorized, she/he can access ITS. Undoubtedly, cryptography plays a vital role in protecting the security of ITS.In recent years, cryptography has developed rapidly and has been widely used in various fields of the Internet and computers. Generally, cryptography can be divided into two parts: classical cryptography and modern cryptography. Classical cryptography is based on replacement and substitution methods, while modern cryptography is based on mathematics, computer, and communication science. The main research topics of modern cryptography include information encryption, digital signatures, data integrity, and identity authentication. More precisely, the paper [10] published by Shannon marks the beginning of modern cryptography. In this paper, the concept of unconditional security was proposed. Based on this concept, one-time pad (OTP) [11] is unconditional security; that is, even if an attacker has unlimited computing resources, it is impossible to decipher the ciphertext encrypted by OTP. However, it is obvious that OTP is unrealistic since the OTP requires that the transmission channel is secure, which is unpractical in reality. In addition, if one can transmit the secret for the OPT, why not she/he transmits the message of the same length? Although unconditional security drives the proposal of computational security [12], the computational security is the fundamental of modern cryptography.Modern cryptography includes symmetric cryptography and asymmetric cryptography. The later is also known as the public key cryptography [13]. The pioneer work of the public key cryptography is the well-known Diffie–Hellman key exchange [14], which was proposed by Diffie and Hellman in 1976. After that, the RSA algorithm [15] was designed by Rivest et al. The security of RSA algorithm is based on the factoring problem. Since then, a large number of excellent research results have emerged in the field of public cryptography. In this paper, primitives in cryptography is explored and utilized for achieving ITS security. Specifically, the threshold key management scheme is designed based on the t,n threshold secret sharing, which is an efficient and secure cryptography primitive.The rest of this paper is organized as follows. Section2 introduces ITS security architecture and some corresponding cryptographic techniques. Section 3 presents three secret-sharing schemes in detail. Section 4 proposes the threshold key management scheme for ITS security. Section 5 draws the conclusion for this paper.


## 2. Related Works

Cryptography plays a vital role in protecting the security of ITS. Figure1 shows the mechanism in protecting ITS security and the corresponding cryptography primitives.Figure 1
ITS security architecture and the corresponding cryptographic technologies.The ITS security architecture mainly includes access management, security management, and data encryption. In particular, access management consists of user authentication and access control. Security management can be classified into decentralize management and centralize management. Data encryption falls into two categories: the encryption at the client side and the encryption at the server side. Generally speaking, the encryption at the server side can achieve higher security level than the encryption at the client side.On the contrary, various cryptography technologies can be used to protect ITS security. Figure1 lists some effective and well-designed schemes in cryptography, which can be employed at the different branches of ITS architecture to ensure security. In the access management branch, MAC and digital signature are suitable. Currently, the most commonly used techniques in digital signature are BLS signature [16], group signature [17], and ring signature [18]. BLS signature has many desirable properties such as the length of the signature, which is short, and the aggregatability of the signature. The group signature and ring signature enable a group of users to sign on a message with properties of anonymity, traceability, and unforgeability. In the data encryption branch, various encryption schemes in cryptography can be referred to protect the data security of both the client side and the server side. Generally speaking, the encryption can be divided into the symmetric encryption and the asymmetric encryption. In addition, the key management [19] plays an essential role in both the symmetric encryption and the asymmetric encryption. At present, the well-recognized symmetric encryption schemes are DES, AES, RC6, and TwoFish, while the cutting edge asymmetric encryption schemes include the searchable encryption [20] and homomorphic encryption [21]. The key management is an essential mechanism in encryption, which ensures the security of the key. Improper key management may threaten the security of encrypted data. The key exchange protocol [22], secret sharing [23], and hierarchical key management [24] are effective methods in key management. In this paper, we mainly focus on the secret-sharing scheme to protect ITS security.The main contributions of this paper can be summarized as follows:(1)
ITS security architecture is presented. In this paper, the main branches of ITS security are outlined. In addition, the corresponding cryptographic technologies are listed, which can ensure the security of ITS.(2)
Three kinds of secret-sharing schemes are studied in this paper. The mainstream schemes in the field of secret sharing are being studied. In particular, Shamir’s secret-sharing scheme, Blakley’s secret-sharing scheme, and CRT secret-sharing scheme are studied in this paper.(3)
The threshold key management scheme for ITS security is designed. Based on Shamir’s secret-sharing scheme and the CRT secret-sharing scheme, we proposed the threshold key management scheme. The proposed scheme enablesn stakeholders to share data and gives each stakeholder the control over the data. Note that the fault tolerance is also supported by taking advantage of the secret-sharing scheme. Namely, the system can perform well, provided that, at least, t stakeholders are legal.In the paper, aiming at the security threats in ITS, the secret-sharing schemes are employed in the blockchain-based ITS to support threshold key management, thus, ensuring the reliability and the privacy of ITS.


## 3. Secret-Sharing Schemes

In this section, three types of secret sharing are introduced. Generally speaking, a secret sharing in cryptography is a scheme that enables the division of a secrets into n shares such that if and only if the combination of at least t shares can recover the secret. The secret sharing with t threshold can also be named t,n secret sharing.


### 3.1. Shamir’s Secret Sharing

The secret-sharing scheme [25] proposed by Shamir is based on the Lagrange polynomials. Essentially, the basic idea of Shamir’s scheme is based on the fact that two points decide a line, three points decide a parabola, and so on. In general, a polynomial of degree t−1 can be defined by t points on it. Specifically, a polynomial fx of degree t−1 is selected for a secret-sharing scheme with t threshold:(1)fx=a0+a1x+a2x2+⋯+at−1xt−1.Here, the coefficient ofx is selected at random while the secret is encoded as the constant a0. The share that is distributed to distinct stakeholders i is a point in fx with random selected xi and corresponding yi=fxi. In order to recover the secret (i.e., a0), the corporation of at least t stakeholders is required. In particular, these t stakeholders maintain t point in the curve defined by fx. Based on the Lagrange polynomial shown in equation (2), these t stakeholders can reconstruct the polynomial fx, and therefore, recovering the secret a0,(2)Lx=∑j=0t−1yj⋅ljx.From Shamir’s works, various secret-sharing schemes based on the Lagrange polynomials were proposed, which can be found in [26–28]. Moreover, Shamir’s secret sharing is employed in various applications such as the cloud computing [29, 30] and the privacy-preserving environment [31].


### 3.2. Blakley’s Secret Sharing

The secret-sharing scheme [32] proposed by Blakley is based on the hyperplanes. The basic fact of Blakley’s secret sharing is that n nonparallel hyperplanes in n-dimensional space must intersect at exactly one point. For example, three nonparallel planes must intersect at exactly one point in 3-dimensional space. In this scheme, with n stakeholders and t threshold, the secret is encoded as a point in a t-dimensional space, while the share of each stakeholders is the affine hyperplane that passes through the secret point (it is clear that the number of the affine hyperplane is infinite). In particular, the affine hyperplanes in the t-dimensional space can be defined by(3)a1x1+a2x2+a3x3+⋯+atxt=b.In order to generaten share for n stakeholders, t random coefficients are selected for stakeholders i and corresponding yi can be calculated as(4)yi=a1ix1+a2ix2+a3ix3+⋯+atixt.Note that the secret is encoded as one coordinatexi, which is fixed and the rest t−1 coordinates can be selected at random. Any t stakeholders together can calculate the secret by solving the solution of(5)a11a21a31…at1a12a22a32…at2a13a23a33…at3…a1ta2ta3t…attx1x2x3…xt=y1y2y3…yt.Blakley’s secret sharing has also been studied and improved since it has been proposed. In [33–35], the extension and application of Blakley’s secret sharing can be found.


### 3.3. CRT Secret Sharing

The secret-sharing scheme [36] proposed by Asmuth and Bloom is based on Chinese remainder theorem (CRT).Given a set of pairwise co-prime numberm1,m2,m3,…,mn, the following linear congruence equations have a unique solution for modular M, where M=∏i=1nmi:(6)a1modm1=x,a2modm1=x,a3modm1=x,…,anmodm1=x.Moreover, the unique solution can be calculated by(7)x≡∑i=1naiCiCi−1modmimodM,where Ci=M/mi.CRT is a fundamental theorem in cryptography; the CRT-based secret sharing has always been studied since it was proposed. The recent research progress in the CRT-based secret sharing can be found in [37–39].In the following, we employ these three kinds of secret-sharing schemes to design the threshold key management scheme for multiple stakeholders in ITS.


## 3.1. Shamir’s Secret Sharing

The secret-sharing scheme [25] proposed by Shamir is based on the Lagrange polynomials. Essentially, the basic idea of Shamir’s scheme is based on the fact that two points decide a line, three points decide a parabola, and so on. In general, a polynomial of degree t−1 can be defined by t points on it. Specifically, a polynomial fx of degree t−1 is selected for a secret-sharing scheme with t threshold:(1)fx=a0+a1x+a2x2+⋯+at−1xt−1.Here, the coefficient ofx is selected at random while the secret is encoded as the constant a0. The share that is distributed to distinct stakeholders i is a point in fx with random selected xi and corresponding yi=fxi. In order to recover the secret (i.e., a0), the corporation of at least t stakeholders is required. In particular, these t stakeholders maintain t point in the curve defined by fx. Based on the Lagrange polynomial shown in equation (2), these t stakeholders can reconstruct the polynomial fx, and therefore, recovering the secret a0,(2)Lx=∑j=0t−1yj⋅ljx.From Shamir’s works, various secret-sharing schemes based on the Lagrange polynomials were proposed, which can be found in [26–28]. Moreover, Shamir’s secret sharing is employed in various applications such as the cloud computing [29, 30] and the privacy-preserving environment [31].


## 3.2. Blakley’s Secret Sharing

The secret-sharing scheme [32] proposed by Blakley is based on the hyperplanes. The basic fact of Blakley’s secret sharing is that n nonparallel hyperplanes in n-dimensional space must intersect at exactly one point. For example, three nonparallel planes must intersect at exactly one point in 3-dimensional space. In this scheme, with n stakeholders and t threshold, the secret is encoded as a point in a t-dimensional space, while the share of each stakeholders is the affine hyperplane that passes through the secret point (it is clear that the number of the affine hyperplane is infinite). In particular, the affine hyperplanes in the t-dimensional space can be defined by(3)a1x1+a2x2+a3x3+⋯+atxt=b.In order to generaten share for n stakeholders, t random coefficients are selected for stakeholders i and corresponding yi can be calculated as(4)yi=a1ix1+a2ix2+a3ix3+⋯+atixt.Note that the secret is encoded as one coordinatexi, which is fixed and the rest t−1 coordinates can be selected at random. Any t stakeholders together can calculate the secret by solving the solution of(5)a11a21a31…at1a12a22a32…at2a13a23a33…at3…a1ta2ta3t…attx1x2x3…xt=y1y2y3…yt.Blakley’s secret sharing has also been studied and improved since it has been proposed. In [33–35], the extension and application of Blakley’s secret sharing can be found.


## 3.3. CRT Secret Sharing

The secret-sharing scheme [36] proposed by Asmuth and Bloom is based on Chinese remainder theorem (CRT).Given a set of pairwise co-prime numberm1,m2,m3,…,mn, the following linear congruence equations have a unique solution for modular M, where M=∏i=1nmi:(6)a1modm1=x,a2modm1=x,a3modm1=x,…,anmodm1=x.Moreover, the unique solution can be calculated by(7)x≡∑i=1naiCiCi−1modmimodM,where Ci=M/mi.CRT is a fundamental theorem in cryptography; the CRT-based secret sharing has always been studied since it was proposed. The recent research progress in the CRT-based secret sharing can be found in [37–39].In the following, we employ these three kinds of secret-sharing schemes to design the threshold key management scheme for multiple stakeholders in ITS.


## 4. Threshold Key Management for Database Security

In this section, the threshold key management scheme in blockchain-based ITS is proposed based on the secret-sharing scheme.


### 4.1. The System Model

In this section, the system model of the threshold key management for blockchain-based ITS security is presented. Figure2 depicts the system model. In the system model, the shared data are possessed by n vehicles. In order to facilitate the use and sharing [40], they want to store the data in the cloud. However, storing plaintext data may bring many security issues. Thus, these n vehicles can generate a key to encrypt data to ensure data storage security. In our system, the secret-sharing scheme is utilized to generate the key. Note that, in the secret-sharing scheme, the key is divided into n pieces and distributed to n vehicles in a secure channel. After that, if and only if at least t vehicles together can recover the key, here, t is the threshold of the secret-sharing scheme. In this way, the data are protected with the following properties:(i)
Each of then vehicles has control over the data. Specifically, any t vehicles of these n vehicles together can recover the key. Thus, they can decrypt the data.(ii)
The invalidation of some vehicles will not cause the key to be unrecoverable. More precise, the invalidation ofn−t+1 is tolerable.Figure 2
The system model.


### 4.2. Cross-Domain Communication Architecture

The architecture of ITS cross-domain communication changes when the blockchain technology is introduced. Figure3 shows the cross-domain communication in ITS of the traditional architecture. In Figure 3, it can be observed that the communication between vehicles in distinct domains triggers five channels including the communication between vehicle and RSU, the communication between CA and RSU, and the communication between CAs. The detailed channels are marked with red color in Figure 3. In contrast, Figure 4 shows the cross-domain communication in ITS of the blockchain-based architecture. It can be seen in Figure 4 that the communication of vehicles in distinct domains can be simplified by the blockchain network. Also, by taking advantage of the blockchain technology, the reliability of the communication can be guaranteed.Figure 3
The traditional cross-domain communication architecture.Figure 4
The blockchain-based cross-domain communication architecture.


### 4.3. Key Management Scheme Based on Shamir’s Secret Sharing

Based on Shamir’s secret sharing, the key management scheme for blockchain-based ITS can be designed as follows:(i)
Key generation: to share dataD for n stakeholders, the owner of the data D selected a random AES key. The key can be key←0,1l. Here, l is the security parameter of the system, which can be 128-bit, 192-bit, or 256-bit depending on the security level of the system.(ii)
Threshold selection: then stakeholders jointly decide the threshold t.(iii)
Polynomial generation: the owner of the data selects a polynomial of degreet−1 as equation (1). The key is encoded as the constant a0, while the other t−1 coefficients are selected randomly.(iv)
Share generation: for each stakeholderi, the data owner chooses a point xi and calculates the corresponding yi. Then, the data owner distributes the pair xi,yi to stakeholder i. To distribute key for n stakeholders, the data owner needs to calculate n pairs of xi,yi and distribute these pairs to the corresponding stakeholder in a secure way.(v)
Encryption: after the key distribution, the data owner encrypts dataD with key and uploads the encrypted data E to the cloud. Here, E=AESkeyD.(vi)
Decryption: with the received part, a stakeholder, together with othert−1 stakeholders, can recover the key. After that, these stakeholders can decrypt the encrypted data E.In the following, an example is presented for the key management scheme. In this example, 10 stakeholders are involved and the threshold is 4. The selected polynomial is shown equation (8). The corresponding secret is 2006, which is in a decimal form:(8)fx=2006+8x+25x2+30x3.The 10 pairs ofxi,yi are distributed to each stakeholders. Table 1 shows the 10 pairs of xi,yi selected based on equation (7). Here, in order to facilitate readers’ understanding, x is set from 2 to 11. We note that, in practice, the value of xi can be selected randomly over the function domain to preserve security.Table 1
The distributed for 10 stakeholders.
x234567891011.......y236230654358642194931357719030259733458645049.......Then, we show that any 4 pairs from Table1 can be used to recover the secret 2006. In the example, 4,4358, 5,6421, 6,9493, and 7,13577 are selected for the secret recovery. In equation (2), ljx is Lagrange basis polynomials, which is shown in equation (8):(9)ljx=∑i=0,i≠jtx−xixj−xi.Note that based on equations (2) and (9) and the four selected pairs, the secret can be recovered. Equation (10) shows the calculation in detail:(10)Lx=∑j=0t−1yj⋅ljx⇒L0=∑j=0t−1yj⋅ljx=y1⋅∑i=1,i≠14−xix1−xi+y2⋅∑i=1,i≠24−xix2−xi+y3⋅∑i=1,i≠34−xix3−xi+y4⋅∑i=1,i≠44−xix4−xi=4358⋅55−4⋅66−4⋅77−4+6421⋅44−5⋅66−5⋅77−5+9434⋅44−6⋅55−6⋅77−6+13577⋅44−7⋅55−7⋅66−7=4358⋅35−6421⋅84+9434⋅70−13577⋅20=2006.It can be observed from equation (9) that the secret value 2006 is recovered by 4 pairs xi,yi of the polynomial. In fact, any 4 pairs are sufficient for the secret recovery based on the interpolation polynomial.In addition, Figure5 depicts three different polynomials constructed based on the selected secret 2006. In Figure 5, the polynomial of y1, y2, and y3 are y1=2006+10x+45x2+56x3, y2=2006+25x+60x2+80x3, and y3=2006+8x+25x2+30x3, respectively.Figure 5
The different polynomials of the same selected secret.


### 4.4. Key Management Scheme Based on CRT

Based on CRT secret sharing, the key management scheme for blockchain-based ITS can be designed as follows:(i)
Key generation: this phase is identical to the key management scheme based on Shamir’s secret sharing. The data owner selects an AESkey.(ii)
Threshold selection: then stakeholders jointly decide the threshold t.(iii)
Parameters’ selection: the owner of the data selectsn co-prime numbers m such that mi,mj=1 holds for each pair of mi and mj, i≠j. After that, based on the selected threshold, the owner of the data calculates the product of these n co-prime numbers as M=∑i=1tmi. Here, the selected key should satisfy 0≤key<m1.(iv)
Share generation: to divide the secretkey, the data owner selects a random number r and calculates S=key+r⋅m1. Here, the selected random number r should satisfy 0≤r<M/m1−1.(v)
Share distribution: for each stakeholderii>1, the data owner distributes Si to stakeholder i. Here, Si=Smodmi. Similarly, this value is transmitted in a secure way.(vi)
Encryption and decryption: after the key distribution, the data owner encrypts dataD with key and uploads the encrypted data E to the cloud. In addition, the decryption needs the involvement of at least t stakeholders. They can construct the following linear congruence equations:(11)S2modm2=S,S3modm3=S,S4modm4=S,……,Stmodmt=S.Based on CRT, this linear congruence equations has a unique solution:(12)S=∑i=2tSi⋅Ci⋅Ci−1modmimodM∗,where M∗=∏i=2tmiandCi=M∗/mi.To show the performance of CRT and Shamir’s secret-sharing-based key management scheme, the complexity of recovery operations of these two schemes is analyzed. Figure6 depicts the comparison between Shamir’s secret-sharing-based key management scheme and CRT secret-sharing-based key management scheme. It can be observed from Figure 6 that the scheme based on CRT is more efficient than the scheme based on Shamir’s secret sharing.Figure 6
The comparison between Shamir’s secret sharing and CRT secret sharing.


## 4.1. The System Model

In this section, the system model of the threshold key management for blockchain-based ITS security is presented. Figure2 depicts the system model. In the system model, the shared data are possessed by n vehicles. In order to facilitate the use and sharing [40], they want to store the data in the cloud. However, storing plaintext data may bring many security issues. Thus, these n vehicles can generate a key to encrypt data to ensure data storage security. In our system, the secret-sharing scheme is utilized to generate the key. Note that, in the secret-sharing scheme, the key is divided into n pieces and distributed to n vehicles in a secure channel. After that, if and only if at least t vehicles together can recover the key, here, t is the threshold of the secret-sharing scheme. In this way, the data are protected with the following properties:(i)
Each of then vehicles has control over the data. Specifically, any t vehicles of these n vehicles together can recover the key. Thus, they can decrypt the data.(ii)
The invalidation of some vehicles will not cause the key to be unrecoverable. More precise, the invalidation ofn−t+1 is tolerable.Figure 2
The system model.


## 4.2. Cross-Domain Communication Architecture

The architecture of ITS cross-domain communication changes when the blockchain technology is introduced. Figure3 shows the cross-domain communication in ITS of the traditional architecture. In Figure 3, it can be observed that the communication between vehicles in distinct domains triggers five channels including the communication between vehicle and RSU, the communication between CA and RSU, and the communication between CAs. The detailed channels are marked with red color in Figure 3. In contrast, Figure 4 shows the cross-domain communication in ITS of the blockchain-based architecture. It can be seen in Figure 4 that the communication of vehicles in distinct domains can be simplified by the blockchain network. Also, by taking advantage of the blockchain technology, the reliability of the communication can be guaranteed.Figure 3
The traditional cross-domain communication architecture.Figure 4
The blockchain-based cross-domain communication architecture.


## 4.3. Key Management Scheme Based on Shamir’s Secret Sharing

Based on Shamir’s secret sharing, the key management scheme for blockchain-based ITS can be designed as follows:(i)
Key generation: to share dataD for n stakeholders, the owner of the data D selected a random AES key. The key can be key←0,1l. Here, l is the security parameter of the system, which can be 128-bit, 192-bit, or 256-bit depending on the security level of the system.(ii)
Threshold selection: then stakeholders jointly decide the threshold t.(iii)
Polynomial generation: the owner of the data selects a polynomial of degreet−1 as equation (1). The key is encoded as the constant a0, while the other t−1 coefficients are selected randomly.(iv)
Share generation: for each stakeholderi, the data owner chooses a point xi and calculates the corresponding yi. Then, the data owner distributes the pair xi,yi to stakeholder i. To distribute key for n stakeholders, the data owner needs to calculate n pairs of xi,yi and distribute these pairs to the corresponding stakeholder in a secure way.(v)
Encryption: after the key distribution, the data owner encrypts dataD with key and uploads the encrypted data E to the cloud. Here, E=AESkeyD.(vi)
Decryption: with the received part, a stakeholder, together with othert−1 stakeholders, can recover the key. After that, these stakeholders can decrypt the encrypted data E.In the following, an example is presented for the key management scheme. In this example, 10 stakeholders are involved and the threshold is 4. The selected polynomial is shown equation (8). The corresponding secret is 2006, which is in a decimal form:(8)fx=2006+8x+25x2+30x3.The 10 pairs ofxi,yi are distributed to each stakeholders. Table 1 shows the 10 pairs of xi,yi selected based on equation (7). Here, in order to facilitate readers’ understanding, x is set from 2 to 11. We note that, in practice, the value of xi can be selected randomly over the function domain to preserve security.Table 1
The distributed for 10 stakeholders.
x234567891011.......y236230654358642194931357719030259733458645049.......Then, we show that any 4 pairs from Table1 can be used to recover the secret 2006. In the example, 4,4358, 5,6421, 6,9493, and 7,13577 are selected for the secret recovery. In equation (2), ljx is Lagrange basis polynomials, which is shown in equation (8):(9)ljx=∑i=0,i≠jtx−xixj−xi.Note that based on equations (2) and (9) and the four selected pairs, the secret can be recovered. Equation (10) shows the calculation in detail:(10)Lx=∑j=0t−1yj⋅ljx⇒L0=∑j=0t−1yj⋅ljx=y1⋅∑i=1,i≠14−xix1−xi+y2⋅∑i=1,i≠24−xix2−xi+y3⋅∑i=1,i≠34−xix3−xi+y4⋅∑i=1,i≠44−xix4−xi=4358⋅55−4⋅66−4⋅77−4+6421⋅44−5⋅66−5⋅77−5+9434⋅44−6⋅55−6⋅77−6+13577⋅44−7⋅55−7⋅66−7=4358⋅35−6421⋅84+9434⋅70−13577⋅20=2006.It can be observed from equation (9) that the secret value 2006 is recovered by 4 pairs xi,yi of the polynomial. In fact, any 4 pairs are sufficient for the secret recovery based on the interpolation polynomial.In addition, Figure5 depicts three different polynomials constructed based on the selected secret 2006. In Figure 5, the polynomial of y1, y2, and y3 are y1=2006+10x+45x2+56x3, y2=2006+25x+60x2+80x3, and y3=2006+8x+25x2+30x3, respectively.Figure 5
The different polynomials of the same selected secret.


## 4.4. Key Management Scheme Based on CRT

Based on CRT secret sharing, the key management scheme for blockchain-based ITS can be designed as follows:(i)
Key generation: this phase is identical to the key management scheme based on Shamir’s secret sharing. The data owner selects an AESkey.(ii)
Threshold selection: then stakeholders jointly decide the threshold t.(iii)
Parameters’ selection: the owner of the data selectsn co-prime numbers m such that mi,mj=1 holds for each pair of mi and mj, i≠j. After that, based on the selected threshold, the owner of the data calculates the product of these n co-prime numbers as M=∑i=1tmi. Here, the selected key should satisfy 0≤key<m1.(iv)
Share generation: to divide the secretkey, the data owner selects a random number r and calculates S=key+r⋅m1. Here, the selected random number r should satisfy 0≤r<M/m1−1.(v)
Share distribution: for each stakeholderii>1, the data owner distributes Si to stakeholder i. Here, Si=Smodmi. Similarly, this value is transmitted in a secure way.(vi)
Encryption and decryption: after the key distribution, the data owner encrypts dataD with key and uploads the encrypted data E to the cloud. In addition, the decryption needs the involvement of at least t stakeholders. They can construct the following linear congruence equations:(11)S2modm2=S,S3modm3=S,S4modm4=S,……,Stmodmt=S.Based on CRT, this linear congruence equations has a unique solution:(12)S=∑i=2tSi⋅Ci⋅Ci−1modmimodM∗,where M∗=∏i=2tmiandCi=M∗/mi.To show the performance of CRT and Shamir’s secret-sharing-based key management scheme, the complexity of recovery operations of these two schemes is analyzed. Figure6 depicts the comparison between Shamir’s secret-sharing-based key management scheme and CRT secret-sharing-based key management scheme. It can be observed from Figure 6 that the scheme based on CRT is more efficient than the scheme based on Shamir’s secret sharing.Figure 6
The comparison between Shamir’s secret sharing and CRT secret sharing.


## 5. Conclusion

In this paper, blockchain-based ITS architecture and the corresponding cryptographic technologies are presented. Moreover, the threshold key management scheme for blockchain-based ITS is proposed. To achieve threshold key management, the secret-sharing schemes are employed, which supports threshold key sharing for multiple stakeholders. Taking advantage of the secret-sharing schemes, the security and fault tolerance data sharing in ITS can be supported. The comparison of CRT and Shamir’s secret sharing-based key management scheme is also conducted, which indicates that CRT-based scheme has an advantage over Shamir’s secret-sharing-based scheme on the complexity of recovery operations.



---

*Source: 1864514-2021-09-08.xml*