# Provable Secure and Lightweight Vehicle Message Broadcasting Authentication Protocol with Privacy Protection for VANETs

Authors: Qi Xie; Panpan Zheng; Zixuan Ding; Xiao Tan; Bin Hu
Journal: Security and Communication Networks
 (2022)

---

## Abstract

With the emergence of intelligent transportation and the widespread use of vehicle network equipment, the vehicle ad hoc network (VANET) is widely used in the communication among participating entities to obtain traffic information, such as speed, traffic congestion, road conditions, and accident. In VANET, the secure and efficient message broadcasting protocol can effectively reduce the message transmission delay, to meet the requirements of openness, real-time, and high-speed mobility in the VANET environment. However, most related researches mainly rely on third parties, such as TA and RSU, to ensure the identity authentication of vehicles and the security of message transmission, which are not suitable for infrastructure-less scenario. Therefore, designing a protocol for decentralized message broadcasting, identity authentication without a third party, and the safe message transmission is meaningful. In this study, we propose a lightweight vehicle message broadcasting authentication protocol, which realizes the identity authentication of the message broadcasting vehicle and vehicle-to-vehicle (V2V) key agreement without the need of a trusted third party. In our protocol, the vehicle can verify the identity of the sending vehicle to identify the reliability of the message source and prevent malicious messages. Meanwhile, the vehicle can update its pseudonym identity to resist tracking attacks, but the trusted authority can always track the real identity of the malicious message sending vehicle according to the sent messages. The proposed protocol is proved secure by formal security proof. In addition, our scheme provides better security and computational efficiency over others by comparing with related schemes.


---

## Body

## 1. Introduction

With the help of advanced information and communication technology, wireless sensor networks, and Internet of things, the interconnection of all things has gradually become a reality, and the citizens’ lives have been greatly enhanced due to advanced equipment and infrastructure [1]. Specific to the transportation field, the concepts of intelligent transportation and vehicle ad hoc network (VANET) come into being. VANET is considered as a variant of a mobile ad hoc network, which is a mobile device network with continuous self-configuration, wireless connection, and no infrastructure [2]. It uses a hierarchical system structure to systematically monitor, schedule, and manage vehicles in cities, which can bring people a better driving experience and improve traffic safety and efficiency. Several studies have shown that approximately 60% of accidents can be avoided if warning messages from legitimate vehicles are provided a few seconds before the accident [3].Communication modes in VANETs can be divided into two categories: vehicle-to-vehicle (V2V) communication that vehicles within a certain range can directly communicate with each other and vehicle-to-infrastructure (V2I) communication that information from vehicles should be transmitted to the nearest RSU first, and both employ the dedicated short-range communication (DSRC) protocol [4]. Upon receiving those messages including location, speed, and traffic conditions, vehicles would take reasonable actions immediately such as rerouting and braking to avoid possible traffic emergency. It can effectively solve the traffic management problems caused by the increase in the number of vehicles, realize the update and release of road information, secure real-time communication among the entities in VANET, privacy protection, and so on to enhance the driving experience of users.Due to the mobility and variability of the vehicle itself and the wireless transmission characteristics, VANET communication has the characteristics of the limited mobile area, rapid change in network topology, frequent network access and interruption, complex communication environment, and security threats. Based on the above features, a large number of authentication schemes based on cryptography have been proposed to improve the security and efficiency of VANET. In 2007, Raya and Hubaux [5] proposed a PKI-based scheme to hide the real identities of users by anonymous certificates. Each vehicle is preloaded with a large number of anonymous public/private key pairs and the corresponding public key certificates to achieve the authentication and integrity of messages, which requires a large storage capacity to save and incur the high cost of message verification. Sun et al. [6] proposed an authentication protocol based on a pseudonym, which allows RSU to distribute certificate services and vehicles to update their certificate on the way. Bayat et al. [7] proposed an authentication scheme, which preloads the list of pseudonym IDs into the registered vehicle and uses them to sign and verify messages.To protect the trajectory and privacy information of OBU and improve the driving security of users, the concept of conditional privacy protection is put forward by Lu et al. [8], in which vehicles use a pseudonym to authenticate and transmit information in the VANET environment, and TA can obtain the real identity of vehicles and realize the tracking and revocation of malicious vehicles. Then, they proposed a conditional privacy protection protocol based on short-time anonymous certificates to realize the anonymous authentication and identity tracking in VANET. Nevertheless, frequently applying for such certificates from RSU reduces the efficiency. In the scheme based on PKI, the trusted authority needs to store all public key certificates of vehicles, which causes inefficiency for certificate management and is expensive for deployment. Meanwhile, due to the storage of the certificate revocation list (CRL) being linear, its length will increase with the increasing number of malicious vehicles, which will reduce the speed and efficiency of searching malicious vehicles in the CRL and delay the message transmitted on the public channels.To solve the problem of certificate management, Shamir [9] proposed identity-based cryptography (IBC) in 1984. It takes the user’s telephone number or ID card number as the public key, and then, the public key is directly associated with the user. However, it requires a trusted private key generator (PKG) to generate the corresponding private key for the user, which brings about the problem of key escrow. Zhang et al. [10] proposed an identity-based batch verification (IBV) scheme for VANETs. It was based on bilinear pairing for secure communication from vehicles to RSUs. Multiple received messages were simultaneously verified by the RSUs that the total authentication overhead was significantly reduced and faster compared with the PKI-based systems. Tsai et al. [11] proposed an efficient authentication scheme for distributed mobile cloud computing services that can provide security and convenience for mobile users to access multiple mobile cloud computing services from multiple service providers using only a single private key. However, it suffers from impersonation attacks and man-in-the-middle attacks and does not realize anonymity and mutual authentication. Meanwhile, the bilinear pairing operation has a high computational cost, which is not suitable for the VANET environment. Lin et al. [12] proposed a scheme based on group signature using group signature technology. In this scheme, the vehicle’s OBUs are not required to store a large number of anonymous keys and the TA can efficiently trace the targeted vehicle in the case of disputes. However, in this scheme, the vehicles are required to store the revocation list to avoid the communication with revoked vehicles, and a large amount of computational overhead is increased. Cui et al. [13] proposed a message authentication scheme based on ECC. In this scheme, a few vehicles are selected as edge nodes to support RSU for message authentication, which reduces the computational burden of RSU and improves the efficiency of message authentication. However, as an edge node, vehicles are more threatened by malicious nodes and choosing a reliable vehicle as an edge node is an important challenge. In 2019, Zhang et al. [14] proposed a conditional privacy-preserving authentication scheme based on the Chinese remainder theorem (CRT) for VANETs. In their scheme, they eliminated the requirement for preloading the master key of the system into the tamper-proof device (TPD) of the vehicle to ensure communication security. This scheme ensures that a fingerprint from a corrupted vehicle will not be authenticated. Wei et al. [15] suggested a conditional privacy-preserving authentication scheme based on the elliptic curve discrete logarithm hypothesis and system secret key update algorithm authentication, which can recover messages and resist side-channel attacks by updating system keys. To improve road safety and traffic efficiency, Ying et al. [16] proposed a privacy-preserving broadcast message authentication (PPBMA) scheme, which uses a two-level key hash chain and message authentication code (MAC) functionality to assist in avoiding message losses to authenticate messages, instead of performing asymmetric verification. Chen et al. [17] designed a fully aggregated conditional privacy-preserving certificate aggregate signature scheme for VANETs, which uses the elliptic curve cryptosystem (ECC) and general hash functions instead of using the expensive bilinear pairings and map-to-point hash function operations. To address the issues in the PKI-based authentication scheme, Othman et al. [18] proposed a physically secure privacy-preserving message authentication protocol using the physical unclonable function (PUF) and secret sharing to guarantee security, privacy against passive, active attacks even if the stored information is leaked. To address issues in pseudonym-based and group-based message signing and verifying scheme, Wang and Liu [19] proposed a secure and efficient message authentication protocol, which aims to achieve mutual authentication among vehicles and roadside units (RSUs) in VANETs by combining the advantages of pseudonym-based and group-based methods.In the existing scheme, if a vehicle receives a message or communication request broadcast by other vehicles without the participation of a trusted third party, it is difficult for the vehicle to verify the reliability of the message and the sender. In addition, if the vehicle receives a malicious message, it is difficult to track the real identity of the sender. Therefore, it is essential to authenticate vehicles and establish a safe and efficient communication environment to realize legal information exchange. Based on the above problems and security requirements in the VANET, we designed an ECC-based message broadcasting authentication and key agreement scheme. In the proposed scheme, when a moving vehicle broadcasts a message to other vehicles or requests to establish communication, other vehicles ensure that the received message is credible by verifying the legitimacy of the vehicle’s identity. Each vehicle can update its temporary identity to prevent tracking attacks. In addition, if the vehicle receives a malicious message, although the sender updates the temporary identity, the registration center can still track the real identity of the vehicle according to the malicious message, which can realize conditional privacy preservation. Our scheme has high practicability and application value. The main contributions of this study are summarized as follows:(1)
We designed a provable secure ECC-based decentralized vehicle broadcast authentication protocol to realize secure message transmission without the help of third party (e.g., TA or RSU) to authenticate the identity of vehicle and reduce the delay of message transmission.(2)
In this protocol, except TA, no entity can reveal the real identity of the vehicle and track the vehicle, which can realize the privacy protection of vehicle.(3)
We prove the security of the proposed protocol through formal security proof, which can not only resist various known attacks but also meet the security requirements.(4)
By comparing the performance with other related schemes, we show that our scheme provides better security and computational efficiency.The rest of this study is as follows. In Section2, we present the system model, the design goals, and the threat model of the proposed protocol. The proposed protocol is introduced in Section 3. The formal security proof in the random oracle model and performance analysis are given in Sections 4 and 5. Finally, the study concludes in Section 6.


## 2. Preliminaries

In this section, the system model, the design goals, and the threat model of this scheme are introduced.


### 2.1. System Model

The system model is shown in Figure1, which contains the trusted authority (TA), roadside units (RSUs), and the vehicles (OBU).Trusted Authority (TA): TA can generate all system parameters, and all RSUs and vehicles can register onto it. TA is the only entity that can reveal the real identity of a vehicle once a dispute happens.Roadside Units (RSUs): the RSU is a roadside infrastructure, which is used to forward messages from vehicles to TA.Vehicles (OBU): each vehicle equips with OBU, which is responsible for information storage, computation, and communication.Figure 1
System model of VANET.


### 2.2. Design Goals

We briefly demonstrate the design goals of the proposed protocol for VANET as follows:(1)
Message Authentication and Integrity: a receiver must be able to verify the authenticity of received messages and prove they are indeed sent by authorized entities without being modified or forged.(2)
Conditional Privacy Preserving: except TA, no entity (i.e., RSUs, vehicles, and other third participants) can track or extract the real identity of vehicle through messages sent by specific vehicles. The TA can track the vehicle’s real identity by analyzing the messages.(3)
Physical Protection: to resist physical attacks on vehicles or RSUs, which may enable an adversary to extract the secret information from their memory but cannot launch other attacks such as impersonation attacks.(4)
Broadcast Authentication: vehicles have the ability to verify the legality of the received messages and the identity of the broadcasting vehicle.(5)
Resistance Various Known Attacks: the protocol can withstand various known passive and active attacks, such as impersonation, replay, and man-in-the-middle attacks.


### 2.3. Threat Model

We will use the widely accepted Dolev and Yao model [20] to simulate the insecure communication between nodes and analyze the security of the proposed protocol:(1)
Attacker A can control the public channel and is considered to have the ability to eavesdrop, modify, delete, and interfere with messages transmitted between entities.(2)
Vehicles and other entities cannot be trusted, which means that any communication agency or entity can try to disguise itself on behalf of the other party.(3)
Attacker A can extract and analyze the parameters stored in the vehicle memory.(4)
All parameters of all entities including TA, such as identity and public key, can be easily accessed by other systems and unauthorized users.(5)
The private keys of participating entities including TA are secure.


## 2.1. System Model

The system model is shown in Figure1, which contains the trusted authority (TA), roadside units (RSUs), and the vehicles (OBU).Trusted Authority (TA): TA can generate all system parameters, and all RSUs and vehicles can register onto it. TA is the only entity that can reveal the real identity of a vehicle once a dispute happens.Roadside Units (RSUs): the RSU is a roadside infrastructure, which is used to forward messages from vehicles to TA.Vehicles (OBU): each vehicle equips with OBU, which is responsible for information storage, computation, and communication.Figure 1
System model of VANET.


## 2.2. Design Goals

We briefly demonstrate the design goals of the proposed protocol for VANET as follows:(1)
Message Authentication and Integrity: a receiver must be able to verify the authenticity of received messages and prove they are indeed sent by authorized entities without being modified or forged.(2)
Conditional Privacy Preserving: except TA, no entity (i.e., RSUs, vehicles, and other third participants) can track or extract the real identity of vehicle through messages sent by specific vehicles. The TA can track the vehicle’s real identity by analyzing the messages.(3)
Physical Protection: to resist physical attacks on vehicles or RSUs, which may enable an adversary to extract the secret information from their memory but cannot launch other attacks such as impersonation attacks.(4)
Broadcast Authentication: vehicles have the ability to verify the legality of the received messages and the identity of the broadcasting vehicle.(5)
Resistance Various Known Attacks: the protocol can withstand various known passive and active attacks, such as impersonation, replay, and man-in-the-middle attacks.


## 2.3. Threat Model

We will use the widely accepted Dolev and Yao model [20] to simulate the insecure communication between nodes and analyze the security of the proposed protocol:(1)
Attacker A can control the public channel and is considered to have the ability to eavesdrop, modify, delete, and interfere with messages transmitted between entities.(2)
Vehicles and other entities cannot be trusted, which means that any communication agency or entity can try to disguise itself on behalf of the other party.(3)
Attacker A can extract and analyze the parameters stored in the vehicle memory.(4)
All parameters of all entities including TA, such as identity and public key, can be easily accessed by other systems and unauthorized users.(5)
The private keys of participating entities including TA are secure.


## 3. The Proposed Scheme

In VANET, it is meaningful to realize a secure message transmission protocol between vehicles, which can effectively reduce the message transmission delay. However, at present, most related researches mainly rely on third parties, such as TA and RSU, to realize the authentication between vehicles.In this section, we propose a message broadcasting authentication protocol, without the help of third party, which consists of five phases: (1) initialization phase, (2) registration phase, (3) authentication and key agreement phase, (4) tracking phase, and (5) application of different pseudonym identities. In the initialization phase, TA generates its secret and public keys, and all system parameters then publish all public parameters. In the registration phase, a vehicle obtains a signature of its real identity from TA, and the vehicle can convert the signature of real identity into the signature of its pseudonym identity, which can be authenticated by other vehicles, and it establishes the session keys in the authentication and key agreement phase. In case of dispute, other vehicles can send the converted signature with its pseudonym identity to TA directly, or sends them to RSU, and RSU forwards them to TA, and TA has the ability to track the real identity in the tracking phase. For security consideration, any registered vehicle can use different pseudonym identities to be authenticated by other vehicles and broadcast messages in the application of different pseudonym identities. Notations used in the proposed protocol are listed in Table1.Table 1
Notations and descriptions.
NotationsDescriptionsTATrusted authorityVehicleiTheith vehicleIDvi,BIOviReal identity and biometricinformation ofVehicleiPIDviPseudonym identity ofVehicleiSKTA,PKTAPrivate and public key ofTAavi1,avi2,l,nvi,nvjRandom integersT1,T2,T3TimestampsSKvivj,SKvjviThe session key between vehicleshSecure one-way hash functions∥Concatenation⊕XOR operationESK/DSKThe symmetric encryption/decryption function


### 3.1. Initialization Phase

The initialization phase is executed offline by the trusted authority (TA). LetG be a cyclic group with prime order q over a finite field Fq, and the point P is its generator. TA selects its own private key SKTA∈Zq∗ and calculates PKTA=SKTA⋅P as its public key. TA selects the symmetric encryption/decryption function ESK/DSK and a secure one-way hash function h, where h is mapped to the 256-bit strings. Finally, TA stores the public key PKTA and private key SKTA and publishes the system parameters params=q,G,P,ESK,DSK,PKTA,h.


### 3.2. Registration Phase

In this phase, each vehicle can obtain a signature of its real identity from TA and convert the signature of real identity into the signature of its pseudonym identity, which is described in Figure2.(1)
LetIDvi be the ith user (Vehiclei)’s identity, and it wants to register onto the TA, and it sends IDvi and registration request to TA.(2)
After receivingIDvi,Request from Vehiclei, TA selects a random number avi1 and computes Avi1=avi1P and bvi=hIDvi‖Avi1−1∗SKTA+avi1. Then, it stores IDvi,avi1 in its vehicle’s identity mapping (VIM) table and sends Avi1,bvi to Vehiclei.(3)
After receiving the messageAvi1,bvi, Vehiclei first verifies the verification of bvi⊕P=?hIDvi‖Avi1−1∗PKTA+Avi1, then inputs its biometric information BIOvi into the vehicle sensing equipment, computes αi,βi=GenBIOvi, vvi1=hαi, and gvi1=bvi⊕hαi‖IDvi, and stores h,P,βi,vvi1,gvi1,IDvi,Avi1 in its memory.Figure 2
Registration phase.


### 3.3. Authentication and Key Agreement Phase

IfVehiclei wants to broadcast a message to other vehicles, other vehicles should authenticate the identity of Vehiclei and establish the session keys between Vehiclei and other vehicles, and the steps are described in Figure 3.(1)
Firstly, theith user inputs its biometric BIOvi∗ into Vehiclei sensing equipment, and then, Vehiclei computes αi=RepBIOvi∗,βi and verifies whether hαi=vvi1; if it holds, then it continues to compute bvi=gvi1⊕hαi‖IDvi; otherwise, it repeats again. Vehiclei selects a pseudonym identity PIDvi and three random numbers l, avi2, and nvi to calculate Evi=hαi‖T1⋅P, t=hEvi‖PIDvi‖T1∗hIDvi‖Avi1, jvi=t∗bvi+tavi2+nvi=hEvi‖PIDvi‖T1∗SKTA+t∗avi1+l∗avi2+t−l∗avi2+nvi, Cvi=t⋅Avi1+l∗avi2⋅P, Nvi=t−l∗avi2+nvi⋅P, vvi2=hjvi‖PIDvi‖Cvi‖Nvi‖Evi‖T1, and evi=hCvi‖Nvi‖PIDvi‖T1∗t−l∗avi2+nvi+hEvi‖jvi‖vvi2‖T1∗hαi‖T1. Finally, Vehiclei sends jvi,PIDvi,T1,Cvi,Nvi,Evi,evi to Vehiclej, where T1 is the current timestamp.(2)
After receiving the messagejvi,PIDvi,T1,Cvi,Nvi,Evi,evi, Vehiclej first verifies the freshness of T1 and then verifies whether jvi⋅P=hEvi‖PIDvi‖T1⋅PKTA+Cvi+Nvi, vvi2=hjvi‖PIDvi‖Cvi‖Nvi‖Evi‖T1, and eviP=hCvi‖Nvi‖PIDvi‖T1⋅Nvi+hEvi‖jvi‖vvi2‖T1⋅Evi. If not, it rejects it. Otherwise, Vehiclej selects a random number nvj to calculate Nvj=nvj⋅P, SKvjvi=hnvjNvi‖PIDvi‖PIDvj, andvvj2=hSKvjvi‖T2‖Nvj‖jvi‖PIDvi‖PIDvj, where T2 is the current timestamp. Then, Vehiclej sends the message T2,Nvj,vvj2,PIDvj to Vehiclei.(3)
After receiving the messageT2,Nvj,vvj2,PIDvj, Vehiclei first verifies the freshness of T2, calculates SKvivj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj, and verifies whether hSKvivj‖T2‖Nvj‖jvi‖PIDvi‖PIDvj=?vvj2. If not, it rejects it. Otherwise, Vehiclei shares a session key SKvivj with Vehiclej, which can encrypt or decrypt the subsequent messages between Vehiclei and Vehiclej.(4)
IfVehiclei wants to send the message MSG to Vehiclej, then Vehiclei encrypts the message MSG with the session key SKvivj as M1=ESKvivjPIDvi‖MSG‖T3, where T3 is the current timestamp. Then, it sends the message PIDvi,M1,T3 to Vehiclej.(5)
After receiving the messagePIDvi,M1,T3, Vehiclej first verifies the freshness of T3 and decrypts the message MSG with the corresponding session key SKvjvi as PIDvi,MSG,T3=DSKvjviM1. Only when the session key is correct, the obtained message is correct, and it is proved that it was transmitted by Vehiclei.Figure 3
Authentication and key agreement phase.


### 3.4. Tracking Phase

In our protocol, the vehicles use pseudonyms to realize privacy protection. In case of dispute,Vehiclej sends {jvi,Evi,PIDvi,T1,Cvi,Nvi} to TA directly, or sends {jvi,Evi,PIDvi,T1,Cvi,Nvi} to RSU, and RSU forwards the message to TA. TA has the ability to track Vehiclei. TA checks whether jvi−hEvi‖PIDvi‖T1∗SKTA−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P=Cvi+Nvi−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P is correct or not, where IDvi,avi1 is stored in its VIM table. If the equation is correct, then TA finds that the IDvi is the identity of Vehiclei.


### 3.5. Application of Different Pseudonym Identities

For security consideration, a legal user should be allowed to update the temporary identity, which can realize the unlinkability feature. IfVehiclei wants to update its temporary identity, it chooses a new pseudonym identity PIDinew and calculates tnew=hEvi‖PIDinew‖T1∗hIDvi‖Avi1, jvinew=tnew∗bvi+tnew∗avi2+nvi=hEvi‖PIDinew‖T1∗SKTA+tnew∗avi1+l∗avi2+tnew−l∗avi2+nvi, Cvinew=tnew⋅Avi1+l∗avi2⋅P, and Nvinew=tnew−l∗avi2+nvi⋅P. Then, Vehiclei can send new authentication message, which replaces PIDvi, t, jvi, Cvi, and Nvi with PIDinew, tnew, jvinew, Cvinew, and Nvinew, to be authenticated by other vehicles with the new temporary identity PIDinew.


## 3.1. Initialization Phase

The initialization phase is executed offline by the trusted authority (TA). LetG be a cyclic group with prime order q over a finite field Fq, and the point P is its generator. TA selects its own private key SKTA∈Zq∗ and calculates PKTA=SKTA⋅P as its public key. TA selects the symmetric encryption/decryption function ESK/DSK and a secure one-way hash function h, where h is mapped to the 256-bit strings. Finally, TA stores the public key PKTA and private key SKTA and publishes the system parameters params=q,G,P,ESK,DSK,PKTA,h.


## 3.2. Registration Phase

In this phase, each vehicle can obtain a signature of its real identity from TA and convert the signature of real identity into the signature of its pseudonym identity, which is described in Figure2.(1)
LetIDvi be the ith user (Vehiclei)’s identity, and it wants to register onto the TA, and it sends IDvi and registration request to TA.(2)
After receivingIDvi,Request from Vehiclei, TA selects a random number avi1 and computes Avi1=avi1P and bvi=hIDvi‖Avi1−1∗SKTA+avi1. Then, it stores IDvi,avi1 in its vehicle’s identity mapping (VIM) table and sends Avi1,bvi to Vehiclei.(3)
After receiving the messageAvi1,bvi, Vehiclei first verifies the verification of bvi⊕P=?hIDvi‖Avi1−1∗PKTA+Avi1, then inputs its biometric information BIOvi into the vehicle sensing equipment, computes αi,βi=GenBIOvi, vvi1=hαi, and gvi1=bvi⊕hαi‖IDvi, and stores h,P,βi,vvi1,gvi1,IDvi,Avi1 in its memory.Figure 2
Registration phase.


## 3.3. Authentication and Key Agreement Phase

IfVehiclei wants to broadcast a message to other vehicles, other vehicles should authenticate the identity of Vehiclei and establish the session keys between Vehiclei and other vehicles, and the steps are described in Figure 3.(1)
Firstly, theith user inputs its biometric BIOvi∗ into Vehiclei sensing equipment, and then, Vehiclei computes αi=RepBIOvi∗,βi and verifies whether hαi=vvi1; if it holds, then it continues to compute bvi=gvi1⊕hαi‖IDvi; otherwise, it repeats again. Vehiclei selects a pseudonym identity PIDvi and three random numbers l, avi2, and nvi to calculate Evi=hαi‖T1⋅P, t=hEvi‖PIDvi‖T1∗hIDvi‖Avi1, jvi=t∗bvi+tavi2+nvi=hEvi‖PIDvi‖T1∗SKTA+t∗avi1+l∗avi2+t−l∗avi2+nvi, Cvi=t⋅Avi1+l∗avi2⋅P, Nvi=t−l∗avi2+nvi⋅P, vvi2=hjvi‖PIDvi‖Cvi‖Nvi‖Evi‖T1, and evi=hCvi‖Nvi‖PIDvi‖T1∗t−l∗avi2+nvi+hEvi‖jvi‖vvi2‖T1∗hαi‖T1. Finally, Vehiclei sends jvi,PIDvi,T1,Cvi,Nvi,Evi,evi to Vehiclej, where T1 is the current timestamp.(2)
After receiving the messagejvi,PIDvi,T1,Cvi,Nvi,Evi,evi, Vehiclej first verifies the freshness of T1 and then verifies whether jvi⋅P=hEvi‖PIDvi‖T1⋅PKTA+Cvi+Nvi, vvi2=hjvi‖PIDvi‖Cvi‖Nvi‖Evi‖T1, and eviP=hCvi‖Nvi‖PIDvi‖T1⋅Nvi+hEvi‖jvi‖vvi2‖T1⋅Evi. If not, it rejects it. Otherwise, Vehiclej selects a random number nvj to calculate Nvj=nvj⋅P, SKvjvi=hnvjNvi‖PIDvi‖PIDvj, andvvj2=hSKvjvi‖T2‖Nvj‖jvi‖PIDvi‖PIDvj, where T2 is the current timestamp. Then, Vehiclej sends the message T2,Nvj,vvj2,PIDvj to Vehiclei.(3)
After receiving the messageT2,Nvj,vvj2,PIDvj, Vehiclei first verifies the freshness of T2, calculates SKvivj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj, and verifies whether hSKvivj‖T2‖Nvj‖jvi‖PIDvi‖PIDvj=?vvj2. If not, it rejects it. Otherwise, Vehiclei shares a session key SKvivj with Vehiclej, which can encrypt or decrypt the subsequent messages between Vehiclei and Vehiclej.(4)
IfVehiclei wants to send the message MSG to Vehiclej, then Vehiclei encrypts the message MSG with the session key SKvivj as M1=ESKvivjPIDvi‖MSG‖T3, where T3 is the current timestamp. Then, it sends the message PIDvi,M1,T3 to Vehiclej.(5)
After receiving the messagePIDvi,M1,T3, Vehiclej first verifies the freshness of T3 and decrypts the message MSG with the corresponding session key SKvjvi as PIDvi,MSG,T3=DSKvjviM1. Only when the session key is correct, the obtained message is correct, and it is proved that it was transmitted by Vehiclei.Figure 3
Authentication and key agreement phase.


## 3.4. Tracking Phase

In our protocol, the vehicles use pseudonyms to realize privacy protection. In case of dispute,Vehiclej sends {jvi,Evi,PIDvi,T1,Cvi,Nvi} to TA directly, or sends {jvi,Evi,PIDvi,T1,Cvi,Nvi} to RSU, and RSU forwards the message to TA. TA has the ability to track Vehiclei. TA checks whether jvi−hEvi‖PIDvi‖T1∗SKTA−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P=Cvi+Nvi−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P is correct or not, where IDvi,avi1 is stored in its VIM table. If the equation is correct, then TA finds that the IDvi is the identity of Vehiclei.


## 3.5. Application of Different Pseudonym Identities

For security consideration, a legal user should be allowed to update the temporary identity, which can realize the unlinkability feature. IfVehiclei wants to update its temporary identity, it chooses a new pseudonym identity PIDinew and calculates tnew=hEvi‖PIDinew‖T1∗hIDvi‖Avi1, jvinew=tnew∗bvi+tnew∗avi2+nvi=hEvi‖PIDinew‖T1∗SKTA+tnew∗avi1+l∗avi2+tnew−l∗avi2+nvi, Cvinew=tnew⋅Avi1+l∗avi2⋅P, and Nvinew=tnew−l∗avi2+nvi⋅P. Then, Vehiclei can send new authentication message, which replaces PIDvi, t, jvi, Cvi, and Nvi with PIDinew, tnew, jvinew, Cvinew, and Nvinew, to be authenticated by other vehicles with the new temporary identity PIDinew.


## 4. Security Analysis

In this section, we will present the formal security proof and informal security analysis to show that the proposed scheme is secure against various attacks.


### 4.1. Formal Security Proof

In this section, we use the formal security proof in the random oracle model to prove the security of the proposed protocolP. The relevant definitions are as follows:Participants: the participants of the scheme are composed of trusted authority (TA), Vehicle i (Vi), and Vehicle j (Vj). In the ith instance, the participants are denoted as ΠTAi, ΠVii, and ΠVji, respectively.States: the state of the oracle isAccept if it receives a correct request.Partnering: if the oraclesΠVii and ΠVji are in Accept and the session key SKVii (SKVji) has been agreed, the oracle ΠVii (ΠVji) gets its session identity SIDVii (SIDVji) and participant identity PIDVii (PIDVji). The oracles ΠVii and ΠVji can be considered partners if the following conditions are satisfied:(1)
The session keySKVii=SKVji.(2)
The session identitySIDVii=SIDVji.(3)
The participant identitiesPIDVii=ΠVji and PIDVji=ΠVii.Queries: to intercept all the messages, the queries are defined to simulate real attacks.ExecuteΠVii,ΠVji: all the messages exchanged between ΠVii and ΠVji are intercepted by the adversary.SendΠVii,m: A sends a message m to ΠVii, and if the message is correct, ΠVii responses A.RevealΠVii,ΠVji: A can get the agreed session key through this query.TestΠVii: it is allowed to be executed at most once. This query generates a random bit r; if r=1, the real session key SKVii=SKVji is returned, else a random number is returned.CorruptΠVii: it returns the stored information h,P,βi,vvi1,gvi1,IDvi,Avi1 of vehicle.Freshness: an instance can be regarded as fresh if it satisfies the following conditions: (1) the query Reveal has not been executed and (2) the states ofΠVii and ΠVji are Accept.Semantic Security: after executingTestΠVii, A guesses the generated random bit r. The possibility of success is AdvPA=2PrsucA−1; if AdvPA>η, the protocol is not secure, where η is sufficiently small.Theorem 1.
the advantage of obtaining the session key in polynomial time byA is as follows:(1)AdvPA≤qHA22lHA+qSE+qEX2n+qSE2lbio−1+2AdvECDLPA,where qHA, qSE, and qEX represent the times of executing hash, send, and execute, respectively. lHA, n, and lbio are the length of hash, transcripts, and biological key, respectively. The advantage of breaking elliptic curve discrete logarithm problem (ECDLP) by A is AdvECDLPA.Proof.
The gamesGamei0≤i≤4 are defined to simulate the attacks launched by A. Wini0≤i≤4 means A guesses the random bit r in the Gamei. The games are defined as follows:Game0: this game simulates the real attack first launched by A. According to the definition, we get the following:(2)AdvPA=2PrWin0−1.Game1: this game simulates the eavesdropping attack. A gets all the messages transmitted between ΠVii and ΠVji by executing ExecuteΠVii,ΠVji. Then, A executes TestΠVii and guesses whether the return is the session key. However, because of the random number and ECDLP, the attacker cannot calculate the session key from the transmission message. Therefore, we get the following:(3)PrWin0=PrWin1.Game2: this game simulates the collision attack on the transcripts and hash results, and according to the definition of birthday paradox, we have the following:(4)PrWin2−PrWin1≤qHA22lHA+1+qSE+qEX22n.Game3: this game simulates A that executes CorruptΠVii to obtain the stored information h,P,βi,vvi1,gvi1,IDvi,Avi1, where vvi1=hαi and gvi1=bvi⊕hαi‖IDvi. Because of the biological key αi, the attacker cannot recover any useful information about the user. Therefore, we have the following:(5)PrWin3−PrWin2≤qSend2lbio.Game4: the parameters Nvi2 and Nvj are transmitted publicly, which are used for session key agreement based on ECDLP. This game simulates that A calculates the session according to the transcripts. We have the following:(6)PrWin4−PrWin3≤AdvECDLPA.
The session keys are generated independently and randomly. Hence, the advantage of guessingr is equal to guessing the session key. We have the following:(7)PrWin4=12.
Combining the above, we have the following:(8)12AdvPA=PrWin0−12≤qHA22lHA+1+qSE+qEX22n+qSend2lbio+AdvECDLPAAdvPA≤qHA22lHA+qSE+qEX2n+qSend2lbio−1+2AdvECDLPA.


### 4.2. Informal Security Analysis

In this phase, we use informal security analysis to show that our proposed scheme is secure against various known attacks.


#### 4.2.1. Anonymity and Unlinkability

In the proposed scheme, all parameters in the messagejvi,PIDvi,T1,Cvi,Nvi,Evi,evi transmitted in public channel are different in each session, and PIDvi is pseudonym identity, and only TA can track the real identity of the vehicle, so our scheme achieves anonymity and unlinkability.


#### 4.2.2. Message Modification Attack

Suppose the adversary impersonatesVehiclei, intercepts and modifies the message jvi,PIDvi,T1,Cvi,Nvi,Evi,evi, and sends it to Vehiclej. Even if the message can be authenticated by the Vehiclej, the adversary cannot know t−l∗avi2+nvi and can also not share a session key SKvivj with Vehiclej due to the intractability of the computational Diffie–Hellman (CDH) problem, so the adversary cannot generate a valid ciphertext for fake message MSG′ without knowing the correct SKvivj.


#### 4.2.3. Broadcast Authentication

In the proposed scheme, only the legitimate user has the correct identityIDvi and biometric information BIOvi and can successfully login into the Vehiclei and obtain bvi and generate jvi,PIDvi,T1,Cvi,Nvi,Evi,evi, Vehiclej can be authenticated by according to verify whether jvi⋅P=hEvi‖PIDvi‖T1⋅PKTA+Cvi+Nvi is correct or not, and share a session key SKvjvi=hnvjNvi‖PIDvi‖PIDvj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj between Vehiclei and Vehiclej. Therefore, our proposed scheme can achieve broadcast authentication.


#### 4.2.4. Conditional Privacy Protection

In our protocol, any one can obtain {jvi,Evi,PIDvi,T1,Cvi,Nvi} from public channel, because these parameters are different in each session, and no one except TA has VIM table stored IDvi,avi1, so no one except TA can check whether jvi−hEvi‖PIDvi‖T1∗SKTA−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P=Cvi+Nvi−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P is correct or not. Therefore, our scheme achieves conditional privacy protection.


#### 4.2.5. Impersonation Attack

In the proposed scheme, only the legitimate user has the correct biometric informationBIOvi and can obtain bvi and generate the valid authentication message jvi,PIDvi,T1,Cvi,Nvi,Evi,evi and can share session keys with other vehicles. Therefore, our proposed scheme can resist impersonation attack.


#### 4.2.6. Replay Attack

In the proposed scheme, we use timestamps and random numbers to resist replay attack. In each session of our scheme, the freshness of timestamps should be first verified. Meanwhile, the session key is established using the random numbersnvi and nvj. Therefore, our scheme can resist replay attacks.


#### 4.2.7. Perfect Forward Security

Perfect forward security means that the leakage of the long-term keys will not lead to the leakage of the past session keys. In the proposed scheme, when the long-term private key in the VANET environment is leaked to the adversary, it cannot help the adversary to reveal the past session keys, because the generation of the session keySKvjvi=hnvjNvi‖PIDvi‖PIDvj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj is based on the nonce nvi and nvj. Under the assumption of the CDH problem, no one can compute t−l∗avi2+nvi⋅Nvj from t−l∗avi2+nvi⋅P and nvjP. Therefore, our scheme can achieve perfect forward security.


#### 4.2.8. Physical Attack

In the proposed scheme, the data stored in the vehicle are protected by biometric information, which makes the adversary unable to obtain the parametersbvi, which are needed for identity verification and session key agreement. Therefore, our protocol can resist physical attacks.


## 4.1. Formal Security Proof

In this section, we use the formal security proof in the random oracle model to prove the security of the proposed protocolP. The relevant definitions are as follows:Participants: the participants of the scheme are composed of trusted authority (TA), Vehicle i (Vi), and Vehicle j (Vj). In the ith instance, the participants are denoted as ΠTAi, ΠVii, and ΠVji, respectively.States: the state of the oracle isAccept if it receives a correct request.Partnering: if the oraclesΠVii and ΠVji are in Accept and the session key SKVii (SKVji) has been agreed, the oracle ΠVii (ΠVji) gets its session identity SIDVii (SIDVji) and participant identity PIDVii (PIDVji). The oracles ΠVii and ΠVji can be considered partners if the following conditions are satisfied:(1)
The session keySKVii=SKVji.(2)
The session identitySIDVii=SIDVji.(3)
The participant identitiesPIDVii=ΠVji and PIDVji=ΠVii.Queries: to intercept all the messages, the queries are defined to simulate real attacks.ExecuteΠVii,ΠVji: all the messages exchanged between ΠVii and ΠVji are intercepted by the adversary.SendΠVii,m: A sends a message m to ΠVii, and if the message is correct, ΠVii responses A.RevealΠVii,ΠVji: A can get the agreed session key through this query.TestΠVii: it is allowed to be executed at most once. This query generates a random bit r; if r=1, the real session key SKVii=SKVji is returned, else a random number is returned.CorruptΠVii: it returns the stored information h,P,βi,vvi1,gvi1,IDvi,Avi1 of vehicle.Freshness: an instance can be regarded as fresh if it satisfies the following conditions: (1) the query Reveal has not been executed and (2) the states ofΠVii and ΠVji are Accept.Semantic Security: after executingTestΠVii, A guesses the generated random bit r. The possibility of success is AdvPA=2PrsucA−1; if AdvPA>η, the protocol is not secure, where η is sufficiently small.Theorem 1.
the advantage of obtaining the session key in polynomial time byA is as follows:(1)AdvPA≤qHA22lHA+qSE+qEX2n+qSE2lbio−1+2AdvECDLPA,where qHA, qSE, and qEX represent the times of executing hash, send, and execute, respectively. lHA, n, and lbio are the length of hash, transcripts, and biological key, respectively. The advantage of breaking elliptic curve discrete logarithm problem (ECDLP) by A is AdvECDLPA.Proof.
The gamesGamei0≤i≤4 are defined to simulate the attacks launched by A. Wini0≤i≤4 means A guesses the random bit r in the Gamei. The games are defined as follows:Game0: this game simulates the real attack first launched by A. According to the definition, we get the following:(2)AdvPA=2PrWin0−1.Game1: this game simulates the eavesdropping attack. A gets all the messages transmitted between ΠVii and ΠVji by executing ExecuteΠVii,ΠVji. Then, A executes TestΠVii and guesses whether the return is the session key. However, because of the random number and ECDLP, the attacker cannot calculate the session key from the transmission message. Therefore, we get the following:(3)PrWin0=PrWin1.Game2: this game simulates the collision attack on the transcripts and hash results, and according to the definition of birthday paradox, we have the following:(4)PrWin2−PrWin1≤qHA22lHA+1+qSE+qEX22n.Game3: this game simulates A that executes CorruptΠVii to obtain the stored information h,P,βi,vvi1,gvi1,IDvi,Avi1, where vvi1=hαi and gvi1=bvi⊕hαi‖IDvi. Because of the biological key αi, the attacker cannot recover any useful information about the user. Therefore, we have the following:(5)PrWin3−PrWin2≤qSend2lbio.Game4: the parameters Nvi2 and Nvj are transmitted publicly, which are used for session key agreement based on ECDLP. This game simulates that A calculates the session according to the transcripts. We have the following:(6)PrWin4−PrWin3≤AdvECDLPA.
The session keys are generated independently and randomly. Hence, the advantage of guessingr is equal to guessing the session key. We have the following:(7)PrWin4=12.
Combining the above, we have the following:(8)12AdvPA=PrWin0−12≤qHA22lHA+1+qSE+qEX22n+qSend2lbio+AdvECDLPAAdvPA≤qHA22lHA+qSE+qEX2n+qSend2lbio−1+2AdvECDLPA.


## 4.2. Informal Security Analysis

In this phase, we use informal security analysis to show that our proposed scheme is secure against various known attacks.


### 4.2.1. Anonymity and Unlinkability

In the proposed scheme, all parameters in the messagejvi,PIDvi,T1,Cvi,Nvi,Evi,evi transmitted in public channel are different in each session, and PIDvi is pseudonym identity, and only TA can track the real identity of the vehicle, so our scheme achieves anonymity and unlinkability.


### 4.2.2. Message Modification Attack

Suppose the adversary impersonatesVehiclei, intercepts and modifies the message jvi,PIDvi,T1,Cvi,Nvi,Evi,evi, and sends it to Vehiclej. Even if the message can be authenticated by the Vehiclej, the adversary cannot know t−l∗avi2+nvi and can also not share a session key SKvivj with Vehiclej due to the intractability of the computational Diffie–Hellman (CDH) problem, so the adversary cannot generate a valid ciphertext for fake message MSG′ without knowing the correct SKvivj.


### 4.2.3. Broadcast Authentication

In the proposed scheme, only the legitimate user has the correct identityIDvi and biometric information BIOvi and can successfully login into the Vehiclei and obtain bvi and generate jvi,PIDvi,T1,Cvi,Nvi,Evi,evi, Vehiclej can be authenticated by according to verify whether jvi⋅P=hEvi‖PIDvi‖T1⋅PKTA+Cvi+Nvi is correct or not, and share a session key SKvjvi=hnvjNvi‖PIDvi‖PIDvj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj between Vehiclei and Vehiclej. Therefore, our proposed scheme can achieve broadcast authentication.


### 4.2.4. Conditional Privacy Protection

In our protocol, any one can obtain {jvi,Evi,PIDvi,T1,Cvi,Nvi} from public channel, because these parameters are different in each session, and no one except TA has VIM table stored IDvi,avi1, so no one except TA can check whether jvi−hEvi‖PIDvi‖T1∗SKTA−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P=Cvi+Nvi−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P is correct or not. Therefore, our scheme achieves conditional privacy protection.


### 4.2.5. Impersonation Attack

In the proposed scheme, only the legitimate user has the correct biometric informationBIOvi and can obtain bvi and generate the valid authentication message jvi,PIDvi,T1,Cvi,Nvi,Evi,evi and can share session keys with other vehicles. Therefore, our proposed scheme can resist impersonation attack.


### 4.2.6. Replay Attack

In the proposed scheme, we use timestamps and random numbers to resist replay attack. In each session of our scheme, the freshness of timestamps should be first verified. Meanwhile, the session key is established using the random numbersnvi and nvj. Therefore, our scheme can resist replay attacks.


### 4.2.7. Perfect Forward Security

Perfect forward security means that the leakage of the long-term keys will not lead to the leakage of the past session keys. In the proposed scheme, when the long-term private key in the VANET environment is leaked to the adversary, it cannot help the adversary to reveal the past session keys, because the generation of the session keySKvjvi=hnvjNvi‖PIDvi‖PIDvj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj is based on the nonce nvi and nvj. Under the assumption of the CDH problem, no one can compute t−l∗avi2+nvi⋅Nvj from t−l∗avi2+nvi⋅P and nvjP. Therefore, our scheme can achieve perfect forward security.


### 4.2.8. Physical Attack

In the proposed scheme, the data stored in the vehicle are protected by biometric information, which makes the adversary unable to obtain the parametersbvi, which are needed for identity verification and session key agreement. Therefore, our protocol can resist physical attacks.


## 4.2.1. Anonymity and Unlinkability

In the proposed scheme, all parameters in the messagejvi,PIDvi,T1,Cvi,Nvi,Evi,evi transmitted in public channel are different in each session, and PIDvi is pseudonym identity, and only TA can track the real identity of the vehicle, so our scheme achieves anonymity and unlinkability.


## 4.2.2. Message Modification Attack

Suppose the adversary impersonatesVehiclei, intercepts and modifies the message jvi,PIDvi,T1,Cvi,Nvi,Evi,evi, and sends it to Vehiclej. Even if the message can be authenticated by the Vehiclej, the adversary cannot know t−l∗avi2+nvi and can also not share a session key SKvivj with Vehiclej due to the intractability of the computational Diffie–Hellman (CDH) problem, so the adversary cannot generate a valid ciphertext for fake message MSG′ without knowing the correct SKvivj.


## 4.2.3. Broadcast Authentication

In the proposed scheme, only the legitimate user has the correct identityIDvi and biometric information BIOvi and can successfully login into the Vehiclei and obtain bvi and generate jvi,PIDvi,T1,Cvi,Nvi,Evi,evi, Vehiclej can be authenticated by according to verify whether jvi⋅P=hEvi‖PIDvi‖T1⋅PKTA+Cvi+Nvi is correct or not, and share a session key SKvjvi=hnvjNvi‖PIDvi‖PIDvj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj between Vehiclei and Vehiclej. Therefore, our proposed scheme can achieve broadcast authentication.


## 4.2.4. Conditional Privacy Protection

In our protocol, any one can obtain {jvi,Evi,PIDvi,T1,Cvi,Nvi} from public channel, because these parameters are different in each session, and no one except TA has VIM table stored IDvi,avi1, so no one except TA can check whether jvi−hEvi‖PIDvi‖T1∗SKTA−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P=Cvi+Nvi−hEvi‖PIDvi‖T1∗hIDvi‖avi1Pavi1P is correct or not. Therefore, our scheme achieves conditional privacy protection.


## 4.2.5. Impersonation Attack

In the proposed scheme, only the legitimate user has the correct biometric informationBIOvi and can obtain bvi and generate the valid authentication message jvi,PIDvi,T1,Cvi,Nvi,Evi,evi and can share session keys with other vehicles. Therefore, our proposed scheme can resist impersonation attack.


## 4.2.6. Replay Attack

In the proposed scheme, we use timestamps and random numbers to resist replay attack. In each session of our scheme, the freshness of timestamps should be first verified. Meanwhile, the session key is established using the random numbersnvi and nvj. Therefore, our scheme can resist replay attacks.


## 4.2.7. Perfect Forward Security

Perfect forward security means that the leakage of the long-term keys will not lead to the leakage of the past session keys. In the proposed scheme, when the long-term private key in the VANET environment is leaked to the adversary, it cannot help the adversary to reveal the past session keys, because the generation of the session keySKvjvi=hnvjNvi‖PIDvi‖PIDvj=ht−l∗avi2+nvi⋅Nvj‖PIDvi‖PIDvj is based on the nonce nvi and nvj. Under the assumption of the CDH problem, no one can compute t−l∗avi2+nvi⋅Nvj from t−l∗avi2+nvi⋅P and nvjP. Therefore, our scheme can achieve perfect forward security.


## 4.2.8. Physical Attack

In the proposed scheme, the data stored in the vehicle are protected by biometric information, which makes the adversary unable to obtain the parametersbvi, which are needed for identity verification and session key agreement. Therefore, our protocol can resist physical attacks.


## 5. Performance Analysis

In this section, we will analyze the security properties and computation cost between our protocol and other related existing schemes [11, 21–24] for VANET.


### 5.1. Security Comparison

Table2 provides a detailed overview of the security comparison of our scheme with other related schemes. The scheme designed by Wu et al. obtained the pre-shared key psk between LE and AS through the authentication with the law executor, which was used for the next secret key negotiation between vehicles. In their scheme, only registered legal vehicles can obtain the parameter psk. However, this scheme cannot resist the attack of selfish nodes. Assuming that a legitimate vehicle announced the parameter psk, any vehicle in the VANET can negotiate the session key. In the scheme designed by Nandy et al., the choice of pseudonym identity PIDva has no meaning, and the effective anonymity and conditional privacy preservation of vehicles cannot be realized. Assuming that a malicious vehicle is a registered vehicle and can obtain the parameters BVISvx,Dvx,Evx, he can distribute the parameters l⋅BVISvx,l⋅Dvx,l⋅Evx to other malicious vehicles instead of VIS, where l is a random number. Through the generated parameters, any vehicle can complete the session key agreement with the surrounding vehicles, and no entity can obtain the real identity of the vehicle. The schemes designed by Meng et al. and Li et al. use the public and private keys generated in the registration phase to realize the session key agreement between vehicles. However, in these schemes, the real identity of the vehicle is transmitted on the public channel, and anonymity, conditional privacy preservation, and unlinkability cannot be realized. Tsai et al.’s scheme suffers from impersonation attack and man-in-the-middle attack and does not realize anonymity and mutual authentication. Therefore, our scheme provides high security properties over others.Table 2
Security comparison.
Functionality featuresTsai et al. [11]Wu et al. [21]Nandy et al. [22]Meng et al. [23]Li et al. [24]OursResist impersonation attackNoNoNoYesYesYesResist message modificationYesYesYesYesYesYesConditional privacy preservationYesNoNoNoNoYesResist replay attackYesYesNoYesNoYesMan-in-the-middle attackNoYesNoYesYesYesMutual authenticationNoNoYesNoYesYesUnlinkabilityYesYesNoNoNoYesPerfect forward securityYesYesYesYesYesYesResist physical attackYesNoNoNoNoYesAnonymityNoYesYesNoNoYes


### 5.2. Computational Cost Comparison

We have compared the computation cost of our protocol with the related works, and Table3 portrays the result of the estimation costs for different protocols. Assume that time consumption for one-way hash (Th), ECC scalar multiplication (Tmul), ECC point addition (Tadd), bilinear pairing operation (Tbp), and symmetric-key cryptography (Ts) is 0.021 ms, 2.579 ms, 0.019 ms, 5.611 ms, and 0.013 ms, respectively [25, 26]. Compared with other execution times, the execution time of logical XOR operation is very short, which can be ignored. Although the computation cost of Nandy et al.’s scheme is lower than that of ours, it cannot achieve anonymity, vehicle identity authentication, and conditional privacy preservation. The scheme of Wu et al. only uses hash operation and XOR operations, so the computation cost is lower than other schemes; however, there are some security problems. Therefore, we have seen that our scheme is low computational complexity.Table 3
Computational cost comparison.
ProtocolAuthentication phase (ms)Communication phaseVehicleiRSUVehiclejTime costTsai et al. [11]5Th+4Tmul+2Tadd+Tbp3Th+2Tmul+2Tadd+3Tbp38.1622TsWu et al. [21]8Th16Th8Th0.67216Th+2TmulNandy et al. [22]2Th+3Tmul+2Tadd—2Th+3Tmul+2Tadd15.6342TsMeng et al. [23]Th+7Tmul+2Tadd—Th+7Tmul+2Tadd36.2242TsLi et al. [24]3Th+6Tmul+Tadd—3Th+6Tmul+Tadd31.1882TsOurs8Th+5Tmul+Tadd—6Th+7Tmul+3Tadd31.3182Ts


## 5.1. Security Comparison

Table2 provides a detailed overview of the security comparison of our scheme with other related schemes. The scheme designed by Wu et al. obtained the pre-shared key psk between LE and AS through the authentication with the law executor, which was used for the next secret key negotiation between vehicles. In their scheme, only registered legal vehicles can obtain the parameter psk. However, this scheme cannot resist the attack of selfish nodes. Assuming that a legitimate vehicle announced the parameter psk, any vehicle in the VANET can negotiate the session key. In the scheme designed by Nandy et al., the choice of pseudonym identity PIDva has no meaning, and the effective anonymity and conditional privacy preservation of vehicles cannot be realized. Assuming that a malicious vehicle is a registered vehicle and can obtain the parameters BVISvx,Dvx,Evx, he can distribute the parameters l⋅BVISvx,l⋅Dvx,l⋅Evx to other malicious vehicles instead of VIS, where l is a random number. Through the generated parameters, any vehicle can complete the session key agreement with the surrounding vehicles, and no entity can obtain the real identity of the vehicle. The schemes designed by Meng et al. and Li et al. use the public and private keys generated in the registration phase to realize the session key agreement between vehicles. However, in these schemes, the real identity of the vehicle is transmitted on the public channel, and anonymity, conditional privacy preservation, and unlinkability cannot be realized. Tsai et al.’s scheme suffers from impersonation attack and man-in-the-middle attack and does not realize anonymity and mutual authentication. Therefore, our scheme provides high security properties over others.Table 2
Security comparison.
Functionality featuresTsai et al. [11]Wu et al. [21]Nandy et al. [22]Meng et al. [23]Li et al. [24]OursResist impersonation attackNoNoNoYesYesYesResist message modificationYesYesYesYesYesYesConditional privacy preservationYesNoNoNoNoYesResist replay attackYesYesNoYesNoYesMan-in-the-middle attackNoYesNoYesYesYesMutual authenticationNoNoYesNoYesYesUnlinkabilityYesYesNoNoNoYesPerfect forward securityYesYesYesYesYesYesResist physical attackYesNoNoNoNoYesAnonymityNoYesYesNoNoYes


## 5.2. Computational Cost Comparison

We have compared the computation cost of our protocol with the related works, and Table3 portrays the result of the estimation costs for different protocols. Assume that time consumption for one-way hash (Th), ECC scalar multiplication (Tmul), ECC point addition (Tadd), bilinear pairing operation (Tbp), and symmetric-key cryptography (Ts) is 0.021 ms, 2.579 ms, 0.019 ms, 5.611 ms, and 0.013 ms, respectively [25, 26]. Compared with other execution times, the execution time of logical XOR operation is very short, which can be ignored. Although the computation cost of Nandy et al.’s scheme is lower than that of ours, it cannot achieve anonymity, vehicle identity authentication, and conditional privacy preservation. The scheme of Wu et al. only uses hash operation and XOR operations, so the computation cost is lower than other schemes; however, there are some security problems. Therefore, we have seen that our scheme is low computational complexity.Table 3
Computational cost comparison.
ProtocolAuthentication phase (ms)Communication phaseVehicleiRSUVehiclejTime costTsai et al. [11]5Th+4Tmul+2Tadd+Tbp3Th+2Tmul+2Tadd+3Tbp38.1622TsWu et al. [21]8Th16Th8Th0.67216Th+2TmulNandy et al. [22]2Th+3Tmul+2Tadd—2Th+3Tmul+2Tadd15.6342TsMeng et al. [23]Th+7Tmul+2Tadd—Th+7Tmul+2Tadd36.2242TsLi et al. [24]3Th+6Tmul+Tadd—3Th+6Tmul+Tadd31.1882TsOurs8Th+5Tmul+Tadd—6Th+7Tmul+3Tadd31.3182Ts


## 6. Conclusion

In the VANET environment, it is of great significance to realize safe and efficient communication between vehicles. At present, most related researches mainly rely on third parties, such as TA and RSU, to realize the authentication and the safe transmission of messages between vehicles. Therefore, we have designed a provable secure ECC-based decentralized vehicle broadcast authentication protocol to realize direct and secure communication between vehicles without a third party. Vehicles realize identity authentication by obtaining corresponding signatures from TA at the registration phase, to realize security features of anonymity and privacy protection through the reasonable design of signatures. The receiving vehicle can verify the identity of the sender and establish the session key for broadcasting messages. We use formal security proof to prove the security of our protocol. Compared with other related protocols, our scheme provides better security and computational efficiency over others.



---

*Source: 3372489-2022-05-06.xml*