# A New Certificateless Signcryption Scheme for Securing Internet of Vehicles in the 5G Era

Authors: Beibei Cui; Lu Wei; Wei He
Journal: Security and Communication Networks
 (2022)

---

## Abstract

The application of digital signature technology to the Internet of vehicles (IoV) is affected by its network and communication environment. In the 5G era, the influx of a large number of intelligent devices into the mobile Internet requires a low transmission delay and power consumption as well as high-security requirements. To the best of our knowledge, a well-designed solution in which signcryption technology is used has not been proposed in the IoV research area. Motivated by the fact, a certificateless signcryption scheme based on the elliptic curve digital signature algorithm, in which pseudonym and timestamp mechanism are also considered, has been designed in this paper. We prove that the scheme proposed by us can be reduced to solving the difficulty of the computational Diffie–Hellman problem with a standard model, showing that the scheme meets requirements on both security and efficiency, which provides a comparative analysis with the state-of-the-art schemes in terms of security analysis, computational cost, and communication cost, demonstrating that the scheme proposed by us is suitable to be deployed in the IoV environment, which is of the characteristics of high-speed vehicle movement.


---

## Body

## 1. Introduction

The Internet of vehicles (IoV) has made significant progress in the 5G era. To meet the needs of research and application, IoV communication can be divided into vehicle to vehicle (V2V), vehicle to infrastructure (V2I), vehicle to pedestrian (V2P), and vehicle to network (V2N). We call them vehicle to everything (V2X). At present, data transmission of the IoV is realized with the help of the DSRC and cellular network, and then, data are stored in the cloud [1]. Among them, V2X communication is based on the 5G network [2], which has been widely used by global operators and automobile manufacturers. Security issues such as counterfeiting, manipulation, and forgery exist in all the IoV links [3]. Since they are critical aspects in solving the problems of information security and privacy protection, anonymous authentication has become a hotspot of research in recent years. Kamat et al. [4] proposed an identity-based and cryptography-based VANET security framework (IBC). Shamir[5] proposed the concept of an identity-based system. In 1984, a cryptosystem based on arbitrary strings could use conventional anonymity approach for the first time, which entails a third-party trustworthy institution storing the correspondence between all vehicles and anonymous certificates. According to the report, if the authority is not authorized, it may intentionally disclose personal information of the vehicle, forge, and tamper with the legal vehicle identification. Tzeng et al. [6] integrated the identity-based public-key cryptosystem into the Internet of vehicles to meet this challenge. The user’s private key is generated by a third-party private key generator (PKG). What can be done if a third-party private key creation center is dishonest or malicious as public keys. For instance, Zhang et al. [7] recommended that fingerprint information be used for identity authentication. Cui et al. [8] adopted edge computing in VANETs to apply privacy protection. Raya and Hubaux[9] proposed that signature of any user can be forged, causing the problem of key escrow. As a result, Al-Riyami and Paterson[10] presented the concept of a key generation center (KGC), pointing out that any effective key can be generated by the secret value of OBU and partial keys distributed by KGC. A certificateless signature system was presented by Liu et al. [11] in 2007. Keys are no longer solely determined by the CA, and the traditional signature method was broken. Shim [12] devised a novel certificateless signature system and assessed its security using computational Diffie–Hellman (CDH), and Yang et al. [13] considered that the scheme was vulnerable to malicious and passive KGC attacks. Thumbur et al. [14] suggested a certificateless signature technique without bilinear pairing in 2020, claiming that the scheme can be used in IoV with limited resources. Mei et al. [15] suggested a bilinear pairing-based certificateless signature aggregation approach with conditional privacy protection. Under the random oracle paradigm, the approach achieved complete aggregation and was proved to be safe. For V2V secure communication, Ali et al. [16] devised an identity-based message authentication technique without bilinear pairing. When vehicles request to register with the trusted authority (TA), the TA creates pseudonyms and keys for them to secure its anonymity during the communication process. Barbosa and Farshim[17] proposed the certificateless signcryption (CLSC) concept, which can transmit signing and encryption simultaneously. Processing time, broadband occupation, and key management can all benefit from signcryption, which was first proposed by Zheng [18]. Barbosa’s method, however, has been shown to be vulnerable to malicious passive KGC assaults. For bilinear pairs, Barreto et al. [19] suggested a certificateless signcryption approach. Suzhen et al. [20] proposed a signcryption technique that includes a privacy protection feature in 2018. Vehicle keys and pseudonyms were generated by TA and PKG, respectively. The bilinear pairing operation was used in the same way in documents [20, 21], with low computational efficiency. Many researchers are now studying signcryption technology [22–25], but no systematic scheme is formed. Du et al. [26] put forward a certificateless signature scheme based on elliptic curve cryptosystems, but there is a replacement key attack. We improve Du et al.’s scheme, propose a new certificateless signcryption scheme based on an elliptic curve, and apply this scheme to the privacy protection of the IoV. We construct a new CLSC scheme to obtain a higher level of security. Our CLSC scheme proves its security of the scheme by using two different types of adversary selection message attacks. Compared with other existing schemes, this scheme avoids expensive bilinear pairing, is more cost-effective, and is suitable for rapidly changing IoV environment. The main contributions of this paper are as follows:(i)
To create pseudonyms, ECC cryptography is employed; the standard tamper-proof device (TPD) and password (PWD) are not used. Instead, the pseudonym is formed using the intermediate variables false identity and timestamp. Therefore, the hidden danger of password theft is avoided, and the system has a high level of privacy protection.(ii)
Combining certificateless and signcryption theory, anonymous is introduced into the scheme. Key generation is related to RSU, OBU, and KGC; the IBC algorithm is improved by two-way authentication among them. Thus, the security of the key is enhanced.(iii)
When compared to other related systems, the computational cost decreased. The scheme satisfies the security requirements of IND-CCA and EUF-CMA, giving the IoV system forward security, anonymity, traceability, and the capacity to prevent replay attacks.


## 2. Elliptic Curve

Ifq is a large prime, it satisfies q≥2160, and Zq includes all solutions in the finite domain Fq. Elliptic curve E:y2=x3+ax+b mod q, and EZq denotes the set of pairs x,y∈Zq×Zq, satisfying the above equation along with a special value O. That is, EZq=x,y|x,y∈Zq,y2=x3+ax+b mod q∪O. The elements EZq are called the points on the elliptic curve E, where 4a3+27b2≠0, and O is called the point at infinity.(i)
Elliptic curve digital signature algorithm (ECDSA) [27]: it is an algorithm through which a random integer k is generated and calculates the point P=kG as well as the number r=xp mod q is calculated, where xp is the x coordinate of P. Finally, s=k−1z+rdA mod q is calculated as a signature, and z is the hash truncation of message M.(ii)
Elliptic curve discrete logarithmic problem (ECDLP): there are two pointsM,N on the elliptic curve Ea,b, and M=k⋅N∀k∈Z∗ is calculated, when the points M,N are known, the problem of solving the coefficient k is called an elliptic curve discrete logarithmic problem, and the coefficient k cannot be calculated in the polynomial time.(iii)
Elliptic curve Diffie–Hellman problem (ECDHP): the problem is that on inputsa,b∈Z∗, point G is taken as the base point in the finite field of elliptic curve Ea,b to have the given equation, M=a⋅G,N=b⋅G,R=ab⋅G when the values of M and N are known, solving the value of R is called an elliptic curve Diffie–Hellman problem, which cannot be effectively solved in the polynomial time.


### 2.1. System Overview

In our scheme, the IoV model consists of vehicles, roadside units, key generator centers, and trusted authorities. The specific division of labor is as follows:Onboard unit (OBU): intelligent vehicles with OBU can exchange information and data with roadside units or other vehicles. Each vehicle periodically broadcasts information for safe driving. To ensure location privacy, each vehicle needs to use a pseudonym to replace its real identity to transmit information.RSUs (roadside units): RSUs are deployed alongside urban roads, which consist primarily of a wireless communication interface and a local data preprocessing unit. The roadside units are deployed by specific guidelines. As a result, the vehicle can access the roadside units. All the RSUs should be interconnected with the intelligent transportation information data center.Trusted authority (TA): the TA is managed by the traffic management department and is mainly in charge of OBU identity registration and authentication. It is fully trusted in this scheme and is responsible for generating the false identity of the vehicle.Key generation center (KGC): the KGC is in charge of communicating with TA to generate partial public/private keys for legitimate OBU and RSUs.The model is shown in Figure1.Figure 1
System structure diagram of the IoV.


### 2.2. Scheme

Our CLSC scheme is designed for IoV communication, eliminates the issue of key escrow, and makes use of a pseudonym mechanism to protect the real identities of both parties to the communication, so ensuring the privacy of the identity and vehicle traceability.First, in order to eliminate the impact of replacing the public key, the system master key is added to the pseudonym generation formula to make it more difficult for attackers to forge signatures, and make thes impossible to bypass. It can be seen that in the Du et al.’ scheme [26], part private key SKi was calculated by the system master key. The malicious signer cannot calculate the value of the system master key and SKi through technical means, but the public key of the certificateless signature scheme is not authenticated between the signer and the verifier. The malicious signer forges the signature by forging the secret value and bypassing the unknown system master key. Therefore, there is a key replacement attack. So, in our scheme, signcryption algorithm is introduced to ensure the confidentiality of transmission and improve transmission efficiency. Finally, the security of the scheme is proved in the standard model. The meaning of relevant symbols is shown in Table 1. The flowchart of the algorithm is shown in Figure 2. The algorithm steps are provided.Table 1
Parameter description table.
ParameterImplicationsGAdditive cyclic group of orderqPGenerator of groupGsSystem master keyZq∗Zq∗=x:0<x<q,gcdx,q=1H0,H1,H2,H3,H4Five safe hash functionsPj,Kj,kjThe identity of roadside unitj, public key Yj, and private key yjSiPartial private keyriKGC generate the secret value to generate public/private keysxiSecret value of the vehicleξiSecret value for the RSUPKi,SKiPublic key and private key for a vehicleRIDiList of true vehicle identitiesFiFalse identity of a vehicleFIDiPseudonym of a vehicleTiCurrent timestamp of a vehicleδCiphertext between two vehiclesY,Y∗Encryption key and decryption keyVA,VBVehicle of data sender and vehicle of data receiverAI,AIIType-I and type-II adversariesFigure 2
The CLSC of our scheme.


### 2.3. Algorithm

There are five participants in the improved certificateless signcryption scheme algorithm: KGC, TA, RSU, the sender of vehicleVA, and the receiver of vehicle VB. OBU and RSU conduct two-way authentication through TA [28]. We divide the entire scheme into six algorithms, which are listed as follows.


#### 2.3.1. Initialization

The KGC chooses five collision-resistant Hash functions:(1)H0:0,1∗⟶Zq∗,H1:0,1∗×G⟶Zq∗,H2:0,1∗×G×G⟶Zq∗,H3:0,1∗×Zq∗×G×G⟶Zq∗,H4:0,1∗×G×G⟶Zq∗.The KGC secret saves system master keys and encrypted transmits s to TA, and TA saves s,RIDi and generates system public key Ppub=sP. The common parameter is pp=q,G,P,Ppub,H0,H1,H2,H3,H4.


#### 2.3.2. Registration

OBU executes the algorithm, randomly selectszi∈Zi∗, calculates the negotiation key [29] Zi=ziP, generates false identity Fi=RIDi⊕H0ziPpub, and then sends Zi,Fi to TA. The algorithm is executed by TA, and TA receives the message Zi,Fi from OBU. TA calculates RIDi=Fi⊕H0sZi and queries whether the vehicle identity list containing RIDi. If not, the algorithm is terminated by TA, and the OBU is determined to be illegal. RSU sets identity as Pj, randomly selects ki∈Zq∗ as its private key, RSU calculates negotiation key Ki=kiP and public key Kj=kiPpub, and sends Pj,Ki to TA, and TA calculates Kj=sKi and forwards Pj,Kj to the legitimate OBU.


#### 2.3.3. Pseudonym Generation

The trusted organization no longer issues the public-key certificates (PKI) to vehicles but generates pseudonyms for them. In this scheme, the generation of a pseudonym consists of three parameters, including false identity of its own, RSU identity information, and timestamp, rather than the device password information. When the vehicle enters the area responsible for RSU, OBU receivesKj from the RSU broadcast. When OBU receives multiple RSU broadcast signals at the same time in a critical environment, it can only record the strongest RSU broadcast information and discard relatively weak RSU broadcast information. The OBU checks the RSU’s public key; if Kj∉Pj,Kj, the RSU will be illegal, and the algorithm will not be executed. Otherwise, OBU obtains the current timestamp Ti and the public key Kj of the current RSU, then selects the secret value ξi∈Zq∗ for the RSU. The OBU calculates FIDi1=Fi⊕H0Kjξi‖Ti, FIDi2=PjQ, and sets the pseudonym of the vehicle FIDi=FIDi1,FIDi2,Ti.Through the above operations, TA indirectly judges the legitimacy of RSU. OBU generates the pseudonym through legal RSU, false identity of the vehicle, and the timestamp.


#### 2.3.4. Key Generation

(i)
Secret value: OBU chooses a randomxi∈Zq∗ as its secret value. When the pseudonym is updated, the secret value should also be changed randomly, to maintain forward safety [30].(ii)
Partial private/public key: KGC inputs the pseudonym of the vehicleFIDi and the parameter value PP, KGC chooses ri∈Zq∗ randomly and calculates partial public key Ri=riP and partial private key Si=ri+his mod q, which is hi=H1FIDi,Ri. KGC sends Si,Ri to OBU via secure channel.(iii)
Public key extract: OBU calculatesPi=xiP,ui=H2FIDi,Pi, Qi=Ri+uiPi then generates the public key, which is PKi=Ri,Qi.(iv)
Private key extract: OBU checks whether theSiP=Ri+hiPpub is established. If so, it will be accepted. If not, it will be rejected. The private key is generated as SKi=Si,xi. Proof of correctness is as follows: SiP=ri+hisP=Ri+hiPpub.


#### 2.3.5. Signcryption

VA is the sender of OBU, while VB is the receiver of OBU, and VA takes message M, FIDA, FIDB, PP, SKA, and PKB as input; generates a random integer t; and produces signcryptext δ. The signcryption generation process is based on ECDSA, and the specific calculation process is as follows:(i)
T=tP=Tx,Ty, Tx, Ty are the x coordinate value and y coordinate value of point T.(ii)
τ=t−1vA+rSA+uAxAmodq, where r=Txmodq can be considered as an important parameter for verifying signatures, and there has three hash functions.(2)hA=H1FIDA,RA,uA=H2FIDA,PA,vA=H3FIDA,m,hA,PKA,T.Hash functionsh1, h2, and h3 are used to protect the pseudonym FIDA, message m, and public key PKA.(3)C=M⊕w,C is signcryptext, which is generated by M XOR W.(4)w=H4FIDA,FIDB,Y,(5)Y=uAxAQB−RB,VA sends δ=T,τ,C to VB.


#### 2.3.6. Unsigncryption

VB takes δ, FIDA, FIDB, PP, SKB, and PKA as input and returns massage M, if τT=vAP+rQA+hAPpub is hold. VB performs the following steps:(6)w∗=H4FIDA,FIDB,Y∗,(7)Y∗=uBxBQA−RA,uB=H2FIDB,PB.VB executes the algorithm M=C⊕w∗ to decrypt the signcryption.


## 2.1. System Overview

In our scheme, the IoV model consists of vehicles, roadside units, key generator centers, and trusted authorities. The specific division of labor is as follows:Onboard unit (OBU): intelligent vehicles with OBU can exchange information and data with roadside units or other vehicles. Each vehicle periodically broadcasts information for safe driving. To ensure location privacy, each vehicle needs to use a pseudonym to replace its real identity to transmit information.RSUs (roadside units): RSUs are deployed alongside urban roads, which consist primarily of a wireless communication interface and a local data preprocessing unit. The roadside units are deployed by specific guidelines. As a result, the vehicle can access the roadside units. All the RSUs should be interconnected with the intelligent transportation information data center.Trusted authority (TA): the TA is managed by the traffic management department and is mainly in charge of OBU identity registration and authentication. It is fully trusted in this scheme and is responsible for generating the false identity of the vehicle.Key generation center (KGC): the KGC is in charge of communicating with TA to generate partial public/private keys for legitimate OBU and RSUs.The model is shown in Figure1.Figure 1
System structure diagram of the IoV.


## 2.2. Scheme

Our CLSC scheme is designed for IoV communication, eliminates the issue of key escrow, and makes use of a pseudonym mechanism to protect the real identities of both parties to the communication, so ensuring the privacy of the identity and vehicle traceability.First, in order to eliminate the impact of replacing the public key, the system master key is added to the pseudonym generation formula to make it more difficult for attackers to forge signatures, and make thes impossible to bypass. It can be seen that in the Du et al.’ scheme [26], part private key SKi was calculated by the system master key. The malicious signer cannot calculate the value of the system master key and SKi through technical means, but the public key of the certificateless signature scheme is not authenticated between the signer and the verifier. The malicious signer forges the signature by forging the secret value and bypassing the unknown system master key. Therefore, there is a key replacement attack. So, in our scheme, signcryption algorithm is introduced to ensure the confidentiality of transmission and improve transmission efficiency. Finally, the security of the scheme is proved in the standard model. The meaning of relevant symbols is shown in Table 1. The flowchart of the algorithm is shown in Figure 2. The algorithm steps are provided.Table 1
Parameter description table.
ParameterImplicationsGAdditive cyclic group of orderqPGenerator of groupGsSystem master keyZq∗Zq∗=x:0<x<q,gcdx,q=1H0,H1,H2,H3,H4Five safe hash functionsPj,Kj,kjThe identity of roadside unitj, public key Yj, and private key yjSiPartial private keyriKGC generate the secret value to generate public/private keysxiSecret value of the vehicleξiSecret value for the RSUPKi,SKiPublic key and private key for a vehicleRIDiList of true vehicle identitiesFiFalse identity of a vehicleFIDiPseudonym of a vehicleTiCurrent timestamp of a vehicleδCiphertext between two vehiclesY,Y∗Encryption key and decryption keyVA,VBVehicle of data sender and vehicle of data receiverAI,AIIType-I and type-II adversariesFigure 2
The CLSC of our scheme.


## 2.3. Algorithm

There are five participants in the improved certificateless signcryption scheme algorithm: KGC, TA, RSU, the sender of vehicleVA, and the receiver of vehicle VB. OBU and RSU conduct two-way authentication through TA [28]. We divide the entire scheme into six algorithms, which are listed as follows.


### 2.3.1. Initialization

The KGC chooses five collision-resistant Hash functions:(1)H0:0,1∗⟶Zq∗,H1:0,1∗×G⟶Zq∗,H2:0,1∗×G×G⟶Zq∗,H3:0,1∗×Zq∗×G×G⟶Zq∗,H4:0,1∗×G×G⟶Zq∗.The KGC secret saves system master keys and encrypted transmits s to TA, and TA saves s,RIDi and generates system public key Ppub=sP. The common parameter is pp=q,G,P,Ppub,H0,H1,H2,H3,H4.


### 2.3.2. Registration

OBU executes the algorithm, randomly selectszi∈Zi∗, calculates the negotiation key [29] Zi=ziP, generates false identity Fi=RIDi⊕H0ziPpub, and then sends Zi,Fi to TA. The algorithm is executed by TA, and TA receives the message Zi,Fi from OBU. TA calculates RIDi=Fi⊕H0sZi and queries whether the vehicle identity list containing RIDi. If not, the algorithm is terminated by TA, and the OBU is determined to be illegal. RSU sets identity as Pj, randomly selects ki∈Zq∗ as its private key, RSU calculates negotiation key Ki=kiP and public key Kj=kiPpub, and sends Pj,Ki to TA, and TA calculates Kj=sKi and forwards Pj,Kj to the legitimate OBU.


### 2.3.3. Pseudonym Generation

The trusted organization no longer issues the public-key certificates (PKI) to vehicles but generates pseudonyms for them. In this scheme, the generation of a pseudonym consists of three parameters, including false identity of its own, RSU identity information, and timestamp, rather than the device password information. When the vehicle enters the area responsible for RSU, OBU receivesKj from the RSU broadcast. When OBU receives multiple RSU broadcast signals at the same time in a critical environment, it can only record the strongest RSU broadcast information and discard relatively weak RSU broadcast information. The OBU checks the RSU’s public key; if Kj∉Pj,Kj, the RSU will be illegal, and the algorithm will not be executed. Otherwise, OBU obtains the current timestamp Ti and the public key Kj of the current RSU, then selects the secret value ξi∈Zq∗ for the RSU. The OBU calculates FIDi1=Fi⊕H0Kjξi‖Ti, FIDi2=PjQ, and sets the pseudonym of the vehicle FIDi=FIDi1,FIDi2,Ti.Through the above operations, TA indirectly judges the legitimacy of RSU. OBU generates the pseudonym through legal RSU, false identity of the vehicle, and the timestamp.


### 2.3.4. Key Generation

(i)
Secret value: OBU chooses a randomxi∈Zq∗ as its secret value. When the pseudonym is updated, the secret value should also be changed randomly, to maintain forward safety [30].(ii)
Partial private/public key: KGC inputs the pseudonym of the vehicleFIDi and the parameter value PP, KGC chooses ri∈Zq∗ randomly and calculates partial public key Ri=riP and partial private key Si=ri+his mod q, which is hi=H1FIDi,Ri. KGC sends Si,Ri to OBU via secure channel.(iii)
Public key extract: OBU calculatesPi=xiP,ui=H2FIDi,Pi, Qi=Ri+uiPi then generates the public key, which is PKi=Ri,Qi.(iv)
Private key extract: OBU checks whether theSiP=Ri+hiPpub is established. If so, it will be accepted. If not, it will be rejected. The private key is generated as SKi=Si,xi. Proof of correctness is as follows: SiP=ri+hisP=Ri+hiPpub.


### 2.3.5. Signcryption

VA is the sender of OBU, while VB is the receiver of OBU, and VA takes message M, FIDA, FIDB, PP, SKA, and PKB as input; generates a random integer t; and produces signcryptext δ. The signcryption generation process is based on ECDSA, and the specific calculation process is as follows:(i)
T=tP=Tx,Ty, Tx, Ty are the x coordinate value and y coordinate value of point T.(ii)
τ=t−1vA+rSA+uAxAmodq, where r=Txmodq can be considered as an important parameter for verifying signatures, and there has three hash functions.(2)hA=H1FIDA,RA,uA=H2FIDA,PA,vA=H3FIDA,m,hA,PKA,T.Hash functionsh1, h2, and h3 are used to protect the pseudonym FIDA, message m, and public key PKA.(3)C=M⊕w,C is signcryptext, which is generated by M XOR W.(4)w=H4FIDA,FIDB,Y,(5)Y=uAxAQB−RB,VA sends δ=T,τ,C to VB.


### 2.3.6. Unsigncryption

VB takes δ, FIDA, FIDB, PP, SKB, and PKA as input and returns massage M, if τT=vAP+rQA+hAPpub is hold. VB performs the following steps:(6)w∗=H4FIDA,FIDB,Y∗,(7)Y∗=uBxBQA−RA,uB=H2FIDB,PB.VB executes the algorithm M=C⊕w∗ to decrypt the signcryption.


## 2.3.1. Initialization

The KGC chooses five collision-resistant Hash functions:(1)H0:0,1∗⟶Zq∗,H1:0,1∗×G⟶Zq∗,H2:0,1∗×G×G⟶Zq∗,H3:0,1∗×Zq∗×G×G⟶Zq∗,H4:0,1∗×G×G⟶Zq∗.The KGC secret saves system master keys and encrypted transmits s to TA, and TA saves s,RIDi and generates system public key Ppub=sP. The common parameter is pp=q,G,P,Ppub,H0,H1,H2,H3,H4.


## 2.3.2. Registration

OBU executes the algorithm, randomly selectszi∈Zi∗, calculates the negotiation key [29] Zi=ziP, generates false identity Fi=RIDi⊕H0ziPpub, and then sends Zi,Fi to TA. The algorithm is executed by TA, and TA receives the message Zi,Fi from OBU. TA calculates RIDi=Fi⊕H0sZi and queries whether the vehicle identity list containing RIDi. If not, the algorithm is terminated by TA, and the OBU is determined to be illegal. RSU sets identity as Pj, randomly selects ki∈Zq∗ as its private key, RSU calculates negotiation key Ki=kiP and public key Kj=kiPpub, and sends Pj,Ki to TA, and TA calculates Kj=sKi and forwards Pj,Kj to the legitimate OBU.


## 2.3.3. Pseudonym Generation

The trusted organization no longer issues the public-key certificates (PKI) to vehicles but generates pseudonyms for them. In this scheme, the generation of a pseudonym consists of three parameters, including false identity of its own, RSU identity information, and timestamp, rather than the device password information. When the vehicle enters the area responsible for RSU, OBU receivesKj from the RSU broadcast. When OBU receives multiple RSU broadcast signals at the same time in a critical environment, it can only record the strongest RSU broadcast information and discard relatively weak RSU broadcast information. The OBU checks the RSU’s public key; if Kj∉Pj,Kj, the RSU will be illegal, and the algorithm will not be executed. Otherwise, OBU obtains the current timestamp Ti and the public key Kj of the current RSU, then selects the secret value ξi∈Zq∗ for the RSU. The OBU calculates FIDi1=Fi⊕H0Kjξi‖Ti, FIDi2=PjQ, and sets the pseudonym of the vehicle FIDi=FIDi1,FIDi2,Ti.Through the above operations, TA indirectly judges the legitimacy of RSU. OBU generates the pseudonym through legal RSU, false identity of the vehicle, and the timestamp.


## 2.3.4. Key Generation

(i)
Secret value: OBU chooses a randomxi∈Zq∗ as its secret value. When the pseudonym is updated, the secret value should also be changed randomly, to maintain forward safety [30].(ii)
Partial private/public key: KGC inputs the pseudonym of the vehicleFIDi and the parameter value PP, KGC chooses ri∈Zq∗ randomly and calculates partial public key Ri=riP and partial private key Si=ri+his mod q, which is hi=H1FIDi,Ri. KGC sends Si,Ri to OBU via secure channel.(iii)
Public key extract: OBU calculatesPi=xiP,ui=H2FIDi,Pi, Qi=Ri+uiPi then generates the public key, which is PKi=Ri,Qi.(iv)
Private key extract: OBU checks whether theSiP=Ri+hiPpub is established. If so, it will be accepted. If not, it will be rejected. The private key is generated as SKi=Si,xi. Proof of correctness is as follows: SiP=ri+hisP=Ri+hiPpub.


## 2.3.5. Signcryption

VA is the sender of OBU, while VB is the receiver of OBU, and VA takes message M, FIDA, FIDB, PP, SKA, and PKB as input; generates a random integer t; and produces signcryptext δ. The signcryption generation process is based on ECDSA, and the specific calculation process is as follows:(i)
T=tP=Tx,Ty, Tx, Ty are the x coordinate value and y coordinate value of point T.(ii)
τ=t−1vA+rSA+uAxAmodq, where r=Txmodq can be considered as an important parameter for verifying signatures, and there has three hash functions.(2)hA=H1FIDA,RA,uA=H2FIDA,PA,vA=H3FIDA,m,hA,PKA,T.Hash functionsh1, h2, and h3 are used to protect the pseudonym FIDA, message m, and public key PKA.(3)C=M⊕w,C is signcryptext, which is generated by M XOR W.(4)w=H4FIDA,FIDB,Y,(5)Y=uAxAQB−RB,VA sends δ=T,τ,C to VB.


## 2.3.6. Unsigncryption

VB takes δ, FIDA, FIDB, PP, SKB, and PKA as input and returns massage M, if τT=vAP+rQA+hAPpub is hold. VB performs the following steps:(6)w∗=H4FIDA,FIDB,Y∗,(7)Y∗=uBxBQA−RA,uB=H2FIDB,PB.VB executes the algorithm M=C⊕w∗ to decrypt the signcryption.


## 3. Correctness

Only if the following two equations are true, respectively, the scheme meets the correctness.(i)
Public verifiability. The message is signed byVA, if the verification signature is valid, VB receives the message. Otherwise, if the signature is invalid, VB rejects the message.(8)τT=t−1vA+rSA+uAxAtpmodq=vA+rrA+hAs+uAxAP=vAP+rRA+uAPA+hAPpub=vAP+rQA+hAPpub.(ii)
Consistency of encryption and decryption. IfY∗=Y is true, w∗=w must be true, and M=C⊕w∗=M⊕w⊕w∗ must be established.(9)Y=uAxAQB−RB=uAxAuBxBP,(10)Y∗=uBxBQA−RA=uBxBuAxAP.BothY and Y∗ are deduced from the public key generation algorithm QA=RA+uAPA, QB=RB+uBPB, PA=xAP, and PB=xBP. From the formulas (4), (6), (9), and (10), it is deduced that the equation w∗=w holds.(11)M=C⊕w∗=M⊕w⊕w∗=M⊕w⊕w.Thus, the messageM can be restored.


## 4. Security Proof

Two types of adversaries are considered to prove the security of our scheme [31]. These requirements on security are described via some games between adversaries (AI or AII) and a challenger ℂ. Adversaries can be divided into two cases: one is that the adversary AI is a malicious who does not know the system master key s, but can replace the public key of any user; the second type of adversary AII is a malicious KGC attacker, who knows the master key s but cannot replace any public key. In our CLSC scheme, the adversaries may access the following oracles:(i)
HPK: FIDi is entered as an identifier, and a public key PKi matching FIDi will be returned.(ii)
Hd: FIDi is entered as an identifier, and a partial private key Si will be returned.(iii)
HReplace.PK: FIDi is entered as an identifier, a new public key PKi′ that can be used will replace the original public key PKi.(iv)
HSK: FIDi is entered as an identifier, a private key SKi matching FIDi will be returned, when the public key is not replaced.(v)
HSigncrypt: When there is a message M, identity of a sender is FIDA, and identity of a receiver is FIDB as input, and an available signcryption δ on M will be returned.(vi)
HUnsigncrypt: When a signcryption δ, identity of a sender is FIDA, and identity of a receiver is FIDB as input, the message M will be restored, when δ is available.AI can access all the above oracles, while AII can access all of them except HReplace.PK and Hd, because AII owns the system master key s, AII can forge partial private key γ; meanwhile, AI and AII can suppose HI=HPK,Hd,HReplace.PK,HSK,HSigncrypt,HUnsigncrypt and HII=HPK,HSK,HSigncrypt,HUnsigncrypt, respectively. We prove our CLSC scheme from two aspects: confidentiality and unforgeability.


### 4.1. Confidentiality

This property is considered as the indistinguishability under chosen-ciphertext attack (IND-CCA). In this section, the security proof is proved by some games between adversariesAIorAII and a challenger ℂ.Game 1: The game interactions between an adversaryA and a challenger ℂ are as follows:(i)
Setup:ℂ inputs a security parameter λ, a common parameter pp and α are generated, of which α is kept as a secret.(ii)
Phase 1 queries:AI sends bounded queries in polynomial time to the oracles HI, and the ℂ responds to the queries passing through these oracle models.(iii)
Challenge:AI sends two equal length messages m0 and m1 to challenger ℂ with FIDA∗ and FIDB∗ as identifiers. A bit γ∈0,1 is randomly selected by ℂ, through which SigncrptionPP,M,FIDA∗,FIDB∗,SKA∗,PKB∗ is implemented by ℂ and δ is sent to AI.(iv)
Phase 2 queries:AI sends bounded queries in polynomial time to the oracle HI, and the ℂ responds to the queries passing through these oracle models.(v)
Guess:AI outputs a guess of γ, which is γ∗.It is said thatAI wins game 1, if γ∗=γ and the following conditions are established:(1)
SKA∗ cannot be extracted by AI at any point(2)
SA∗ cannot be extracted by AI, if AI has replaced PKA∗ with PKA′ before accepting the challenge(3)
In phase 2 queries,AI is unable to perform unsigncryption query on δ∗ under FIDA∗ or FIDB∗, and signcryption FIDB∗, PKA∗, or PKB∗ has been replaced after the challenge is issued.Game 2: The game interactions between an adversaryA and a challenger ℂ: the challenge steps are the same as those of game 1.(i)
Setup:ℂ inputs a security parameter λ, and a common parameter pp and α are generated. ℂ sends parameter pp and α to AII.(ii)
Phase 1 queries:AII sends bounded queries in polynomial time to the oracle HII, and ℂ responds to the queries passing through these oracle models.(iii)
Challenge:AII sends two equal length messages m0 and m1 to challenger ℂ with FIDA∗ and FIDB∗ as identifiers. A bit γ∈0,1 is randomly selected by ℂ, through which SigncryptionPP,M,FIDA∗,FIDB∗,SKA∗,PKB∗ is implemented, and then, δ is sent to AII.(iv)
Phase 2 queries:AII sends bounded queries in polynomial time to the oracle HII, and ℂ responds to the queries passing through these oracle models.(v)
Guess:AII outputs a guess γ∗ of γ.It is said thatAII wins game 2 if γ∗=γ and the following conditions are hold:(1)
AII cannot extract SKA∗ at any point. Because the secret value xi cannot be obtained by AII, AII solves xi as ECDLP problem.(2)
In phase 2 queries,AII is unable to perform an unsigncryption query on δ∗ under FIDA∗ or FIDB∗.If the probabilityAdvA=2∗PrA−1/2 is negligible, we say that the scheme is IND-CCA safe. We know that AI can access to all of the oracles, while AII can access to all of them except HReplace.PK and Hd.AI sends bounded queries in polynomial time to the oracle HI making a signcryption query HSigncrypt but cannot win δ under FIDA∗ or FIDB∗. The key generation process is QA∗−RA∗=uA∗xA∗P, QB∗−RB∗=uB∗xB∗P, and Y=uB∗xB∗uA∗xA∗P. It is still difficult to solve Y, which is an ECDHP problem.AII sends bounded queries in polynomial time to the oracle HII, making a public key query HPK, but HII cannot be used to obtain xi∗; thus, AII cannot obtain PKi, and solving xi∗ is an ECDLP problem.The probability forAI and AII to win game 1 and game 2 is negligible.


### 4.2. Unforgeability

This property is considered as the existential unforgeability against the chosen message attack (EUF-CMA). In this section, the security proof is proved through some games between adversariesAIorAII and a challenger ℂ.Game 3: The game interactions between an adversaryA and a challenger ℂ are as follows:(i)
Setup:ℂ inputs a security parameter λ, a common parameter pp and α are generated, and α is kept as a secret.(ii)
Phase 1 queries:AI sends bounded queries in polynomial time to the oracle HI, and ℂ responds to the queries passing through these oracle models.(iii)
Forgery:AI forges the message M∗ and signcryption δ∗=T∗,τ∗,C∗ from the sender VA∗ to the receiver VB∗.If the decryption output isM∗ and the following conditions are met, it is said that AI wins game 3.(1)
AI cannot extract SKA∗ at any point(2)
AI cannot extract SKi∗ for any pseudonym FIDi, if PKi∗ has been replaced(3)
AI cannot extract xA∗(4)
AI cannot make a signcryption query on M∗ under FIDA∗ or FIDB∗Game 4: The game interactions between an adversaryA and a challenger ℂ: the challenge steps are the same those of as game 3.(i)
Setup:ℂ inputs a security parameter λ, and a common parameter pp and α are generated. ℂ sends parameter pp and α to AII.(ii)
Queries:AII sends bounded queries in polynomial time to the oracle HII, and the ℂ responds to the queries passing through these oracle models.(iii)
Forgery:AII creates a forged message m∗ or signcryption δ∗=T∗,τ∗,C∗ from the sender VA∗ to the receiver VB∗.If the decryption output isM∗ and the following conditions are met, it is said that AII wins game 4.(1)
AII cannot extract SKA∗ at any point(2)
AII cannot make a signcryption query on M∗ under FIDA∗ or FIDB∗If it is negligibleAI or AII to win game 3 and game 4 AdvSigϵ,ACMAk≤neglk, we say that the scheme is EUF-CMA safe. Note that AI has access to all of the mentioned oracles, while AII has access to all of them except HReplace.PK and Hd.AI executes public key replacement queries from HReplace.PK, which can replace the public key with PKA′=RA,QA′, PKB′=RB,QB′, signcryption queries from HSigncrypt, and unsigncryption queries from HUnsigncryption; AI randomly selects t∗∈Zq∗, xA∗∈Zq∗, and xB∗∈Zq∗, which is used to T∗=t∗P=Tx,Ty, r∗=Tx mod q, vA∗=H3FIDA∗,m,hA∗,PKA′,T, QA′=xA∗P−hA∗Ppub, and QB′=xB∗P−hB∗Ppub, which are forged, so as to signcrypt the message m∗. Then, signcryption δ∗=T∗,τ∗,C∗ is forged, VB receives δ∗, and feasibility verification is conducted:(12)τ∗T∗=tA∗−1vA∗+r∗xA∗tA∗P=vA∗+r∗xA∗P=v∗P+r∗QA′+hA∗Ppub.If it is only a signature algorithm without signcryption, the adversary can still forge a signature and pass the authentication by signing before encryption or encrypting before signature, which is the same as Du et al. [26].(13)Y′=uA∗xA∗QB′−RB=uAxAxB∗P−hB∗Ppub−RB,(14)Y∗=uB∗xB∗QA′−RA=uBxBxA∗P−hA∗Ppub−RA.According to formulas (13) and (14), it is known that Y∗≠Y′, so w∗≠w′, the adversary AI cannot pass the encryption consistency verification. Public key replacement fails. AII cannot execute query partial private key from Hd; thus, γ is forged to replace xA∗, and t′∈Zq∗ is selected to forge δ∗=T∗,τ∗,C∗, where T∗=t′P, τ∗=t′−1vA+rSA+uA′γmodq, and C∗=m∗⊕w, in which PA′=γP and uA′=H2FIDA,PA′, and VB gets δ∗; then, a feasibility verification is done.(15)τ∗T∗=t′−1v+rSA+uA′γt′Pmodq=v′+rrA+hAs+uA′γ=P=v′P+rRA+hAPpub+uA′PA,.AII cannot replace any public key. It is known that QA≠RA+hAPA; thus, τ∗T∗≠vP+rQA+hAPpub. The output will be INVALID, and VB discards the ciphertext.The probability ofAI and AII to win game 3 and game 4 is negligible.


## 4.1. Confidentiality

This property is considered as the indistinguishability under chosen-ciphertext attack (IND-CCA). In this section, the security proof is proved by some games between adversariesAIorAII and a challenger ℂ.Game 1: The game interactions between an adversaryA and a challenger ℂ are as follows:(i)
Setup:ℂ inputs a security parameter λ, a common parameter pp and α are generated, of which α is kept as a secret.(ii)
Phase 1 queries:AI sends bounded queries in polynomial time to the oracles HI, and the ℂ responds to the queries passing through these oracle models.(iii)
Challenge:AI sends two equal length messages m0 and m1 to challenger ℂ with FIDA∗ and FIDB∗ as identifiers. A bit γ∈0,1 is randomly selected by ℂ, through which SigncrptionPP,M,FIDA∗,FIDB∗,SKA∗,PKB∗ is implemented by ℂ and δ is sent to AI.(iv)
Phase 2 queries:AI sends bounded queries in polynomial time to the oracle HI, and the ℂ responds to the queries passing through these oracle models.(v)
Guess:AI outputs a guess of γ, which is γ∗.It is said thatAI wins game 1, if γ∗=γ and the following conditions are established:(1)
SKA∗ cannot be extracted by AI at any point(2)
SA∗ cannot be extracted by AI, if AI has replaced PKA∗ with PKA′ before accepting the challenge(3)
In phase 2 queries,AI is unable to perform unsigncryption query on δ∗ under FIDA∗ or FIDB∗, and signcryption FIDB∗, PKA∗, or PKB∗ has been replaced after the challenge is issued.Game 2: The game interactions between an adversaryA and a challenger ℂ: the challenge steps are the same as those of game 1.(i)
Setup:ℂ inputs a security parameter λ, and a common parameter pp and α are generated. ℂ sends parameter pp and α to AII.(ii)
Phase 1 queries:AII sends bounded queries in polynomial time to the oracle HII, and ℂ responds to the queries passing through these oracle models.(iii)
Challenge:AII sends two equal length messages m0 and m1 to challenger ℂ with FIDA∗ and FIDB∗ as identifiers. A bit γ∈0,1 is randomly selected by ℂ, through which SigncryptionPP,M,FIDA∗,FIDB∗,SKA∗,PKB∗ is implemented, and then, δ is sent to AII.(iv)
Phase 2 queries:AII sends bounded queries in polynomial time to the oracle HII, and ℂ responds to the queries passing through these oracle models.(v)
Guess:AII outputs a guess γ∗ of γ.It is said thatAII wins game 2 if γ∗=γ and the following conditions are hold:(1)
AII cannot extract SKA∗ at any point. Because the secret value xi cannot be obtained by AII, AII solves xi as ECDLP problem.(2)
In phase 2 queries,AII is unable to perform an unsigncryption query on δ∗ under FIDA∗ or FIDB∗.If the probabilityAdvA=2∗PrA−1/2 is negligible, we say that the scheme is IND-CCA safe. We know that AI can access to all of the oracles, while AII can access to all of them except HReplace.PK and Hd.AI sends bounded queries in polynomial time to the oracle HI making a signcryption query HSigncrypt but cannot win δ under FIDA∗ or FIDB∗. The key generation process is QA∗−RA∗=uA∗xA∗P, QB∗−RB∗=uB∗xB∗P, and Y=uB∗xB∗uA∗xA∗P. It is still difficult to solve Y, which is an ECDHP problem.AII sends bounded queries in polynomial time to the oracle HII, making a public key query HPK, but HII cannot be used to obtain xi∗; thus, AII cannot obtain PKi, and solving xi∗ is an ECDLP problem.The probability forAI and AII to win game 1 and game 2 is negligible.


## 4.2. Unforgeability

This property is considered as the existential unforgeability against the chosen message attack (EUF-CMA). In this section, the security proof is proved through some games between adversariesAIorAII and a challenger ℂ.Game 3: The game interactions between an adversaryA and a challenger ℂ are as follows:(i)
Setup:ℂ inputs a security parameter λ, a common parameter pp and α are generated, and α is kept as a secret.(ii)
Phase 1 queries:AI sends bounded queries in polynomial time to the oracle HI, and ℂ responds to the queries passing through these oracle models.(iii)
Forgery:AI forges the message M∗ and signcryption δ∗=T∗,τ∗,C∗ from the sender VA∗ to the receiver VB∗.If the decryption output isM∗ and the following conditions are met, it is said that AI wins game 3.(1)
AI cannot extract SKA∗ at any point(2)
AI cannot extract SKi∗ for any pseudonym FIDi, if PKi∗ has been replaced(3)
AI cannot extract xA∗(4)
AI cannot make a signcryption query on M∗ under FIDA∗ or FIDB∗Game 4: The game interactions between an adversaryA and a challenger ℂ: the challenge steps are the same those of as game 3.(i)
Setup:ℂ inputs a security parameter λ, and a common parameter pp and α are generated. ℂ sends parameter pp and α to AII.(ii)
Queries:AII sends bounded queries in polynomial time to the oracle HII, and the ℂ responds to the queries passing through these oracle models.(iii)
Forgery:AII creates a forged message m∗ or signcryption δ∗=T∗,τ∗,C∗ from the sender VA∗ to the receiver VB∗.If the decryption output isM∗ and the following conditions are met, it is said that AII wins game 4.(1)
AII cannot extract SKA∗ at any point(2)
AII cannot make a signcryption query on M∗ under FIDA∗ or FIDB∗If it is negligibleAI or AII to win game 3 and game 4 AdvSigϵ,ACMAk≤neglk, we say that the scheme is EUF-CMA safe. Note that AI has access to all of the mentioned oracles, while AII has access to all of them except HReplace.PK and Hd.AI executes public key replacement queries from HReplace.PK, which can replace the public key with PKA′=RA,QA′, PKB′=RB,QB′, signcryption queries from HSigncrypt, and unsigncryption queries from HUnsigncryption; AI randomly selects t∗∈Zq∗, xA∗∈Zq∗, and xB∗∈Zq∗, which is used to T∗=t∗P=Tx,Ty, r∗=Tx mod q, vA∗=H3FIDA∗,m,hA∗,PKA′,T, QA′=xA∗P−hA∗Ppub, and QB′=xB∗P−hB∗Ppub, which are forged, so as to signcrypt the message m∗. Then, signcryption δ∗=T∗,τ∗,C∗ is forged, VB receives δ∗, and feasibility verification is conducted:(12)τ∗T∗=tA∗−1vA∗+r∗xA∗tA∗P=vA∗+r∗xA∗P=v∗P+r∗QA′+hA∗Ppub.If it is only a signature algorithm without signcryption, the adversary can still forge a signature and pass the authentication by signing before encryption or encrypting before signature, which is the same as Du et al. [26].(13)Y′=uA∗xA∗QB′−RB=uAxAxB∗P−hB∗Ppub−RB,(14)Y∗=uB∗xB∗QA′−RA=uBxBxA∗P−hA∗Ppub−RA.According to formulas (13) and (14), it is known that Y∗≠Y′, so w∗≠w′, the adversary AI cannot pass the encryption consistency verification. Public key replacement fails. AII cannot execute query partial private key from Hd; thus, γ is forged to replace xA∗, and t′∈Zq∗ is selected to forge δ∗=T∗,τ∗,C∗, where T∗=t′P, τ∗=t′−1vA+rSA+uA′γmodq, and C∗=m∗⊕w, in which PA′=γP and uA′=H2FIDA,PA′, and VB gets δ∗; then, a feasibility verification is done.(15)τ∗T∗=t′−1v+rSA+uA′γt′Pmodq=v′+rrA+hAs+uA′γ=P=v′P+rRA+hAPpub+uA′PA,.AII cannot replace any public key. It is known that QA≠RA+hAPA; thus, τ∗T∗≠vP+rQA+hAPpub. The output will be INVALID, and VB discards the ciphertext.The probability ofAI and AII to win game 3 and game 4 is negligible.


## 5. Security Analysis

### 5.1. Forward Security

If the system master keys is omitted, it is calculated due to the difficulty of ECDLP, it is still difficult to calculates ri and xi, and PKi,SKi remains unknown. Therefore, it is guaranteed that the past signcryption information will not be disclosed, because of the randomness of ri and xi. When the system master key is omitted, the new values will immediately replace it. The key update is realized, and these actions further confirm the security of the communication [32].


### 5.2. Traceability

The ciphertext should contain relevant information about the vehicle identity. In the scheme, TA can be used to calculateRIDi=Fi⊕H0sZi using the system master key s, which queries whether RIDi is listed in the vehicle identity. It seems that only the trusted authority TA can track the vehicle according to the relevant information. In addition, the IoV requires an extremely high real-time nature. The ciphertext contains timestamp information, which can also prevent replay attacks. Because ciphertext C=M⊕w; w=H4FIDA,FIDB,Y, here we can use the pseudonym of the vehicle FIDi=FIDi1,FIDi2,Ti, making the ciphertext contains timestamp information.


### 5.3. Anonymous

Pseudonyms are used in V2V and V2I communications to protect the true identity of the vehicle. The pseudonym of the vehicle consists of three parts:FIDi=FIDi1,FIDi2,Ti, where FIDi1 is generated by the false identity Fi of the vehicle, FIDi1=Fi⊕H0Kjξi‖Ti, Fi=RIDi⊕H0ziPpub, FIDi2=Pj, and Ti is the timestamp to ensure the anonymity of the vehicle. It is necessary to protect the identity information RIDi of the vehicle when the pseudonym information is disclosed. According to the irreversibility of a hash function and the difficulty of ECDLP, the attacker cannot calculate zi, ξi, or ki in polynomial time, so the RIDi of the vehicle cannot be obtained. In addition, vehicles carry different pseudonyms in different RSU communication ranges and timestamps; that is, the pseudonym information of the vehicle changes with position and time, which makes the generation process of a pseudonym a one-way trapdoor function.


### 5.4. Unforgeable

The unforgeability of the CLSC scheme is proven in the unforgeability section using a (existential unforgeability against selected message attacks, EUF-CMA) security model. The signature ciphertext forged by an attacker does not satisfy the encryption consistency or convey the attacker’s intentions.


## 5.1. Forward Security

If the system master keys is omitted, it is calculated due to the difficulty of ECDLP, it is still difficult to calculates ri and xi, and PKi,SKi remains unknown. Therefore, it is guaranteed that the past signcryption information will not be disclosed, because of the randomness of ri and xi. When the system master key is omitted, the new values will immediately replace it. The key update is realized, and these actions further confirm the security of the communication [32].


## 5.2. Traceability

The ciphertext should contain relevant information about the vehicle identity. In the scheme, TA can be used to calculateRIDi=Fi⊕H0sZi using the system master key s, which queries whether RIDi is listed in the vehicle identity. It seems that only the trusted authority TA can track the vehicle according to the relevant information. In addition, the IoV requires an extremely high real-time nature. The ciphertext contains timestamp information, which can also prevent replay attacks. Because ciphertext C=M⊕w; w=H4FIDA,FIDB,Y, here we can use the pseudonym of the vehicle FIDi=FIDi1,FIDi2,Ti, making the ciphertext contains timestamp information.


## 5.3. Anonymous

Pseudonyms are used in V2V and V2I communications to protect the true identity of the vehicle. The pseudonym of the vehicle consists of three parts:FIDi=FIDi1,FIDi2,Ti, where FIDi1 is generated by the false identity Fi of the vehicle, FIDi1=Fi⊕H0Kjξi‖Ti, Fi=RIDi⊕H0ziPpub, FIDi2=Pj, and Ti is the timestamp to ensure the anonymity of the vehicle. It is necessary to protect the identity information RIDi of the vehicle when the pseudonym information is disclosed. According to the irreversibility of a hash function and the difficulty of ECDLP, the attacker cannot calculate zi, ξi, or ki in polynomial time, so the RIDi of the vehicle cannot be obtained. In addition, vehicles carry different pseudonyms in different RSU communication ranges and timestamps; that is, the pseudonym information of the vehicle changes with position and time, which makes the generation process of a pseudonym a one-way trapdoor function.


## 5.4. Unforgeable

The unforgeability of the CLSC scheme is proven in the unforgeability section using a (existential unforgeability against selected message attacks, EUF-CMA) security model. The signature ciphertext forged by an attacker does not satisfy the encryption consistency or convey the attacker’s intentions.


## 6. Performance Evaluation

Computational cost, communication cost, and safety analysis are analyzed in this section compared with other relevant schemes [33–38]. The schemes selected for comparison are certificateless signcryption, which can be applied to the IoV.The computational cost mainly depends on the amount of signcryption and unsigncryption algorithms, which can be measured based on the number of execution times of statistical elliptic curve scalar multiplication, elliptic curve scalar addition, bilinear pairing, and mapping to point operation. The computational cost of XOR operation onZq∗ is too small to make comparison. The operation results are listed in Table 2. The experimental system environment is as follows:CPU: Intel core i7-6700@3.40 GHz; RAM: 8 GB;OS: Ubuntu 16.04;Library: MIRACL, a public C++cryptographic library;[https://github.com/miracl/MIRACL/archive/master.zip].Table 2
Run time of the different encryption operations.
SymbolOperationParameterRuntime (ms)TemElliptic curve point multiplicationx⋅PP∈G,x∈zq∗0.341TinInverse modet−1 mod qt∈zq∗,q∈zq∗0.029TeaElliptic curve point plusP+QP∈G,Q∈G0.002TbpTime required for the bilinear pairingeS¯,T¯S¯∈G1,T¯∈G14.669TpmPairing multiplication operationx¯⋅P¯x¯∈zq∗,P¯∈G0.788TpaPairing additionS¯+T¯S¯∈G1,S¯∈G10.002TmtpMapToPoint hash functionH1:0,1∗⟶G10.145TeModular exponentiationg∗ mod n1.915Under the same operating environment, our scheme costs 1.397 ms, Kasyoka et al.’s scheme [33] costs 1.705 ms, Karati et al.’s scheme [34] costs 2.424 ms based no pairing, Karati et al.’s scheme [35] costs 18.913 ms based on bilinear pairing, He et al.’s [36] scheme costs 2.05 ms, and Seo et al.’s [38] scheme costs 3.41 ms. Compared with the other schemes [33–36, 38], our scheme in this paper decreases by 18.06%, 42.37%, 92.61%, 31.85%, and 59.03%, respectively.Communication cost is measured by the length of a single ciphertext. In the bilinear pairing operation scheme, the length ofG1 is 1024 bit, and that of G2 is the same. To provide the security schemes of the same level for a scheme based on the elliptic curve, q is the prime number and the length of Zq∗ is 160 bit. The additive cyclic group with q order generation for point P on a nonsingular elliptic curve is G, and the length of G is 320 bit.The superiority of this scheme is illustrated by comparing the computation and communication overhead of a single ciphertext, which is statistically analyzed in Table3.Table 3
Performance comparison of different signcryption schemes.
SchemeCalculate costCommunication costSigncryptionUnsigncryptionRuntimeSigncryptextLength[33]2Tem3Tem1.705 s3Zq∗480 bit[34]3Tem+2Tea+Tin4Tem+2Tea2.424 s2Zq∗+G640 bit[35]3Te2Te+2Tbp18.913 s4G1+Zq∗4256 bit[36]3Tem3Tem+2Tea2.05 s3G+Zq∗1120 bit[38]3Tem7Tem3.41 s3Zq∗480 bitOur CLSCTin+Tem2Tea+3Tem1.397 s2Zq∗+G640 bitIn the comparative analysis of communication cost, the length of a single ciphertext is used as the unit of comparison, which is 640 bit in our scheme, slightly higher than that of Kasyoka et al.’s [33] and Seo et al.’s [38] and is lower than that of Karati et al.’s [35] and He et al.’s [36] bilinear pairing scheme, the same as no pairing scheme of Karati et al. [34].Our CLSC scheme is designed according to a certificateless signcryption model and relies on ECDSA, which depends on the difficulty of pseudonyms generation. In this section, the security of the algorithm is compared and with that of similar schemes and is then analyzed. The result is in Table4.Table 4
Safety comparison.
SchemeConfidentialityUnforgeabilityForward securityAnonymous[33]FalseTrueFalseFalse[34]FalseFalseFalseFalse[35]TrueFalseFalseFalse[36]FalseTrueFalseTrue[37]FalseTrueFalseFalse[38]TrueTrueFalseFalseOur CLSCTrueTrueTrueTrue


## 7. Conclusion

In this paper, we construct a reliable certificateless signcryption scheme without bilinearity, where a pseudonym mechanism is also designed to protect the privacy of vehicles. We use certificateless signcryption technology to implement the scheme, which can secure vehicular communication with a low computation overhead. Performance analysis demonstrates that the scheme proposed by us can be used to reduce computational and communication cost compared with other related schemes. Security proofs and analyses show that the scheme proposed by us can be used to avoid replacement public key attacks, and ensure the satisfaction of the security of IND-CCA as well as EUF-CMA. Other requirements on security including perfect forward secrecy, anonymity, traceability, and resistance of replay attacks can also be ensured.



---

*Source: 3214913-2022-09-19.xml*