# CLASRM: A Lightweight and Secure Certificateless Aggregate Signature Scheme with Revocation Mechanism for 5G-Enabled Vehicular Networks

Authors: Zhihua Wang; Haofan Wang; Yongjian Wang; Xiaolong Yang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The rapid deployment of 5G technology has further strengthened the large-scale interconnection between sensing devices and systems and promoted the rapid development of smart cities and intelligent transportation systems. 5G-enabled vehicular networks take advantage of cellular vehicle-to-everything (C-V2X) technology to achieve the connection between moving vehicles, between vehicles and infrastructure, and between vehicles and the cloud, which can reduce the possibility of traffic jams and accidents, improve transportation efficiency, and realize automatic driving. Besides, 5G-enabled vehicular networks also provide infotainment services and industry application services. High-strength data transmission, however, will bring a serious burden of resource overhead, and there are hidden dangers of security and privacy in the communication process of vehicular networks. Some current vehicular network authentication schemes adopt public key infrastructure-based (PKI-based) and identity-based authentication methods to achieve conditional privacy preservation. Still, these schemes are too expensive and cannot address the problems of costly certificate management or risky key escrow. Some schemes use computationally complex bilinear pairing operations that result in low efficiency and do not consider the revocation of malicious nodes so that they cannot effectively prevent further malicious attacks. This paper proposes a lightweight certificateless aggregate signature (CLAS) scheme with a revocation mechanism suitable for 5G-enabled vehicular networks in response to the above problems. Our proposed scheme uses aggregation signature technology to aggregate multiple signatures into a single short signature, thus reducing communication overhead and storage overhead of road side units (RSUs). Furthermore, our proposed scheme utilizes the elliptic curve cryptography (ECC) to reduce verification time and computational overhead. Moreover, in order to prevent malicious users from sending invalid signatures to attack, our proposed scheme uses binary search to identify invalid signatures and introduces a cuckoo filter to revoke malicious users to prevent reattack. Finally, formal proof and experimental analysis show that our proposed scheme has greater advantages with respect to security and efficiency compared with the previous schemes.


---

## Body

## 1. Introduction

The large-scale commercial deployment of 5G technology has brought richer application scenarios, promoted the rapid development of smart cities and intelligent transportation systems, and provided more convenience for our lives and work. As an emerging communication technology, 5G enables higher data transmission rate and lower latency and supports direct communication between device-to-device (D2D). Simultaneously, as a crucial part of the smart city sensing system, the rapid development of intelligent sensing technology also makes innovative applications based on the Internet of Vehicles (IoVs) emerged in an endless stream. The traditional vehicular ad hoc networks (VANETs) primarily make use of the dedicated short range communication (DSRC) standard for vehicle-to-vehicle (V2V) communication and vehicle-to-infrastructure (V2I) communication. However, some studies have shown that the DSRC standard has a high probability of collision [1–3], especially at higher vehicle density. Moreover, the DSRC standard also has defects in scalability, mobility, and latency, so that it cannot be well suited for delay-sensitive vehicle-to-everything (V2X) applications. Intelligent transportation systems and autonomous driving technologies put forward more stringent requirements on system performance such as communication rate, delay, and reliability of the IoVs. Therefore, C-V2X based on 5G communication technology that can provide low-latency and high-reliability V2X communication capabilities is proposed [4]. Multiple vehicles with intelligent sensing devices make use of C-V2X communication technology to jointly build 5G-enabled vehicular networks to provide a variety of V2X services and applications. For example, vehicles equipped with on-board units (OBUs) can communicate with adjacent vehicles and can also communicate with the RSUs to share information related to road safety and industrial applications. Then, vehicles and RSUs use the emergency and beacon information to make decisions in a timely manner to achieve intelligent driving assistance and reduce the possibility of traffic jams and accidents. In addition, vehicles can also collect sensing information in real time and send it to the cloud to provide services such as environmental monitoring and accident reporting, which realize vehicle-to-network (V2N) communication. Therefore, in order to provide high-quality applications and services, it is necessary to ensure the security and reliable connection of the IoVs.In 5G-enabled vehicular networks, due to the openness and vulnerability of wireless channels, attackers can intercept, forge, and modify information through malicious means and even inject false information to cause vehicles to change lane or accelerate, which will cause unpredictable consequences [5]. Therefore, in 5G-enabled vehicular networks, the primary problem is how to ensure security of message transmission and exchange. It is not only necessary to authenticate identity of each message sender but also to check the integrity of the message, etc. Secondly, attackers can also obtain sensitive information such as the vehicles’ trajectory through analysing the information sent by vehicles and then carry out some criminal acts, thereby reducing the enthusiasm of vehicles to join the IoVs [6]. Therefore, privacy leakage of vehicles is also a problem that must be solved. A pseudonym can be used to replace the vehicle’s real identity for communication to ensure privacy and unlinkability. Moreover, a trusted third party that stores the vehicle’s real identity is also needed to trace the anonymous vehicle and revoke its identity. Some conditional privacy-preserving authentication schemes have been surveyed [7–10]. Among them, two authentication schemes based on PKI have been proposed [7, 8] to meet security and privacy requirements. However, due to the large number of certificates that needs to be stored and the limited storage capacity of vehicles or RSUs, it is challenging to meet the requirements of PKI-based authentication mechanisms. Besides, in order to alleviate the problem of public key certificate management in PKI-based authentication schemes, many identity-based authentication schemes for VANETs have been proposed [9, 10] to realize conditional privacy preservation. However, once the private key generated by the private key generation centre is leaked, the problem of risky key escrow will appear. Fortunately, the certificateless signature (CLS) scheme can solve the above two problems well while retaining the advantages of the identity-based authentication mechanism [11–13].There are also many resource-constrained devices in 5G-enabled vehicular networks. Large-scale communication between vehicles will place a severe burden on these devices. Therefore, the communication, computing, storage, and other overhead in IoVs are also worthy of our attention. Using aggregate signature or batch verification can reduce overhead so as to improve authentication efficiency and overcome the delay-sensitive problem [14]. Some schemes using bilinear pairing operations have been proposed [15–17], but these schemes incur huge computational overhead and low efficiency of message signing and verification. Therefore, these schemes cannot meet the applications requirements of low latency in 5G-enabled vehicular networks. Recently, Cui et al. [18] proposed a message authentication framework based on reputation score for delay-sensitive 5G-enabled vehicular networks, in which vehicles with poor reputation value cannot communicate with other vehicles. Moreover, Cui et al. [18] proposed an authentication scheme based on ECC, which supports batch authentication to reduce computational overhead. Taha and Shen [19] proposed a vehicular clustering algorithm based on speed, location, and signal strength and proposed a group authentication scheme for 5G scenarios to reduce the computational overhead of handover authentication. The above two schemes are both efficient and feasible, but they do not solve the problems of how to reduce communication overhead and how to revoke malicious users.Therefore, in 5G-enabled vehicular networks, in order to achieve efficient communication between large-scale vehicles and to meet the requirements of security and privacy preservation, this paper proposes a CLAS scheme with revocation mechanism for 5G-enabled vehicular networks. The main contributions of this paper are summarized as below.(1)
In order to reduce the computational overhead, we propose a CLAS scheme based on ECC without using computationally complex bilinear pairing operations and map to point hash functions. When many vehicles send a large number of messages with signatures to the RSUs, there is huge communication overhead and storage overhead. To solve this problem, we utilize the aggregate signature technology to aggregate multiple signatures into a single short signature and verify it once(2)
In order to prevent malicious vehicles from influencing the aggregation verification and interfering with the normal communication of vehicles by inserting invalid signatures into the aggregation signatures, we make use of binary search to identify invalid signatures and take advantage of a cuckoo filter to construct a revocation mechanism to prevent malicious vehicles from attacking again. In order to prevent information injection attacks that often appear in 5G-enabled vehicular networks, the method with a random vector is used to ensure security in the signature aggregation phase(3)
Formal proof and security analysis can prove that the proposed CLAS scheme can meet the security and privacy preservation requirements in efficient communication. In addition, experimental results indicate that the proposed CLAS scheme has a particular improvement in computing and communication efficiency compared with the previous schemesThe organization of this paper is summarized as follows. We review related work in Section2. We introduce background knowledge in Section 3. Section 4 describes the proposed CLAS scheme in detail. In Section 5, we give the formal proof and security requirements analysis of the proposed CLAS scheme. In Section 6, we compare our proposed scheme with other schemes in detail in terms of performance. Section 7 concludes this paper.


## 2. Related Work

This section will introduce the authentication schemes in traditional VANETs and the security protection methods applied to 5G-enabled vehicular networks, respectively.At present, a variety of traditional PKI-based authentication schemes have been proposed [7, 8]. However, as the number of users increases, a large number of public key certificates will lead to a gradual increase in storage and communication overhead. In 1984, Shamir [20] proposed the identity-based public key cryptography (ID-PKC), which solved the problems existing in the use of certificates in traditional PKI-based schemes and reduced the overhead of certificate management. Although many identity-based authentication schemes have been proposed [20], it still cannot solve the key escrow problem. In these schemes, it is assumed that all users must completely trust the key generation centre (KGC), but this assumption is too ideal to be adopted practically in many applications.Al-Riyami and Paterson [21] proposed an authentication scheme based on the certificateless public key cryptography (CL-PKC) in 2003, in which the user’s private key is a combination of the partial private key generated by the KGC and the secret value generated by the user. After that, many CLS schemes and security models based on CL-PKC have been proposed [22–24]. Huang et al. [24] proved that the CLS scheme proposed in [21] could not resist the public key replacement attack and further proposed an improved CLS scheme. Subsequently, Yum and Lee [22] introduced a general CLS framework. However, the above solutions still have problems in terms of efficiency and are not suitable for the low-latency requirements of 5G-enabled vehicular networks.Boneh et al. [14] first proposed the concept of aggregate signature in 2003. The aggregation signature technology can aggregate n signatures of n messages from n users into a single short signature to reduce the signature length and the authentication burden of RSUs. The validity of the aggregate signature is guaranteed by verifying the validity of each signature involved in the aggregate signature. Batch verification technology is also considered to be an effective method to improve verification efficiency. With this technique, multiple signatures from different signers of different messages can be verified at once. Subsequently, many CLAS schemes applied to VANETs have been proposed. In 2018, Cui et al. [25] proposed a CLAS scheme based on ECC, which has the advantages of certificateless public key cryptography and aggregate signature. This scheme can achieve trade-off between privacy preservation and traceability, and the security of the proposed scheme is proved by the random oracle model (ROM). Gayathri et al. [11] and Bayat et al. [12] proposed some effective CLS schemes for VANETs with batch verification. Unfortunately, Li and Zhang [13] found that the scheme proposed by Bayat et al. was insecure in their security model and proposed an improved scheme. In 2019, Kamil and Ogundoyin [26] proved that the CLS and CLAS schemes proposed by Cui et al. [25] were not secure against AdvII adversary in the ROM and proposed an improved CLAS scheme for VANETs. Subsequently, Zhao et al. [27] proved that the scheme proposed by Kamil and Ogundoyin [26] could not resist AdvI and AdvII adversaries and proposed an improved CLAS scheme based on ECC. However, Thumbur et al. [28] pointed out that the construction of the CLS scheme [27] was incorrect in 2020. Zhong et al. [29] also proposed a privacy-preserving authentication scheme that realized full aggregation in VANETs, in which the length of the aggregate signature was kept constant, reducing communication and storage overhead. However, Kamil and Ogundoyin [30] proved that the scheme [29] was not secure in the standard security model by designing two specific attacks in 2020. Then, they modified the signature, verification, and aggregation verification algorithms [29] to make it more secure and effective. In 2020, Ren et al. [15] and Ali et al. [16], respectively, designed a CLS scheme with batch verification for V2I secure communication in VANETs using blockchain technology. Ali et al. [16] also proposed an efficient CLAS scheme based on bilinear pairing, which took advantage of the immutability and openness of blockchain and could verify whether the identities of all vehicles in VANETs was legitimate. Recently, Mei et al. [17] proposed an effective CLAS scheme with conditional privacy preservation, which used full aggregation technology to reduce bandwidth resources and computational overhead. However, since these schemes [15–17, 29, 30] are all implemented based on bilinear pairing, the process of signing and verifying has a lot of overhead.With the arrival of the 5G era, the research on security and privacy preservation methods in 5G-enabled vehicular networks is gradually started [2, 3, 18, 19, 31, 32]. Eiza et al. [3] proposed a novel system model for 5G-enabled vehicular networks, which provided a reliable and secure real-time video reporting service, and also proposed a real-time video reporting service protocol that met security and privacy preservation requirements. Similarly, Zhang et al. [2] also proposed an authentication scheme based on edge computing, which used edge computing vehicles to realize communication and verification between vehicles without the participation of RSUs. Recently, Cui et al. [31] proposed a reliable and efficient content sharing scheme for 5G-enabled vehicular networks. Wang et al. [32] proposed a hybrid D2D message authentication scheme for 5G-enabled vehicular networks.


## 3. Preliminaries

This section first introduces the theoretical basis of our proposed scheme. ECC and cuckoo filter are important components of the proposed CLAS scheme, in which ECC can ensure the efficient performance and security of the system, while the cuckoo filter has an efficient search feature to find malicious user quickly. After that, the system model and the authentication process are described. Then, the basic framework and execution process of the general CLAS scheme are given. Besides, the threat model elaborates the assumption conditions, attack model, and adversary model. Finally, the design goals are summarized.


### 3.1. ECC

ECC is widely used in the design of cryptographic protocols and security schemes because of its higher computational efficiency and communication efficiency.Suppose that a finite fieldFp is defined over a large prime p and an elliptic curve E defined over the field Fp is the set of solutions x,y to the equation E:y2=x3+ax+bmodp, where a,b∈Fp, x,y∈Fp∗Fp, and 4a3+27b2modp≠0. Therefore, the elliptic curve E is the set of such solutions together with a point at infinity O, where O is identity element, and the points of E form a finite Abelian group. Here, p and E are fixed and publicly known. Furthermore, suppose that P∈E is a fixed and publicly know point, and Gp is an additive group whose order is a large prime q and whose generator is P. Therefore, Gp is a finite cyclic subgroup on the elliptic curve E. A brief description of the two difficult problems of ECC is as follows.
(1)
Elliptic curve discrete logarithm problem (ECDLP): for any given two random pointsP,Q∈Gp, where x∈0..q−1 is unknown and Q=xP is known, it is hard to compute x in polynomial time with nonnegligible probability(2)
Computational Diffie–Hellman problem (CDHP): for any given two random pointsaP,bP∈Gp, where a,b∈0..q−1 are unknown, it is hard to computer Q=abP, Q∈Gp in polynomial time with nonnegligible probabilityThe security of ECC is based on the difficulties of the ECDLP and CDHP.


### 3.2. Cuckoo Filter

A cuckoo filter is a compact variant of a cuckoo hash table and a probabilistic data structure for approximate set membership tests. It only stores fingerprints for each item inserted, supports dynamic addition and deletion of items, and provides higher lookup performance compared to standard Bloom filters without incurring higher overhead in space and performance. Therefore, cuckoo filter is suitable for applications that store many items and aim for low false-positive rates [33].The cuckoo filter uses two hash functionsh1x and h2x to insert a new item x into a hash table. If one of x’s two locations is empty, then the algorithm just puts x in there. But if both are full, the algorithm randomly selects one of them, kicks out the existing item, and puts x in there. At the same time, the kicked item is put to its own alternate location. The insertion operation of the cuckoo filter is shown in Figure 1, where Figures 1(a) and 1(b) show the process of inserting a new item x into a hash table and Figure 1(c) shows an instance of a cuckoo filter.Figure 1
Insertion operation of cuckoo filter.


### 3.3. System Model

As shown in Figure2, the system model of 5G-enabled vehicular networks mainly consists of four entities: trusted authority (TA), application server (AS), RSUs (i.e., 5G-RSUs or 5G-BSs), and vehicles, and they communicate with each other via C-V2X. The system model can be divided into two layers, in which the upper network is composed of TA and AS and the lower network is composed of RSUs and vehicles equipped with OBUs.Figure 2
The system model of 5G-enabled vehicular networks.TA: TA includes a KGC and a trace authority (TRA). TA uses secure wired channels to communicate with other facilities and is mainly responsible for initializing system parameters for each registered vehicle and RSU in 5G-enabled vehicular networks. TA can also conditionally trace and revoke malicious vehicles to meet the requirements of security and privacy preservation. KGC is responsible for generating a partial private key for each vehicle, while TRA is responsible for generating a pseudonym for each vehicle and can trace the vehicle’s real identity through the pseudo identity of the vehicle. TA’s executive agency is generally the government’s traffic management centre (TMC)AS: AS is an application server with strong computing and storage capabilities. AS uses secure wired channels to communicate with other facilities and is mainly responsible for providing large-scale computing and storage services for 5G-enabled vehicular networks to collect and analyse traffic-related dataRSUs: RSUs are located on both sides of the road and generally include 5G base stations and road side units. RSUs use V2I communication mode to receive and transmit vehicles’ information. RSUs can also communicate with TA and AS using secure wired channels. Therefore, RSUs have the ability to store and forward data and cooperate with vehicles for data analysis. Moreover, RSUs also check the integrity and authenticity of the messages to fulfil security requirementsVehicles: vehicles are the main carrier for collecting driving data and sensing information in vehicular networks. Vehicles can use V2V communication mode to exchange information with adjacent vehicles and can also use V2N communication mode to communicate with TA and ASWhen vehicles join vehicular networks, TA initializes system parameters so that each vehicle can be assigned a pseudo identity and a corresponding public and private key pair. The vehicle must sign each message before sending it. After receiving the message signature pair, the RSU needs to verify the signature to ensure the authenticity of the signature and the integrity of the message. When the RSU receives a large number of traffic-related messages, the messages are aggregated, and the messages and signatures are sent to AS for verification and analysis. Finally, AS feeds back the results of authentication and analysis to the TA for further processing.


### 3.4. System Framework

Generally, the CLAS scheme consist of the following algorithms [11, 25]. According to the overview of our proposed scheme, the process of each algorithm is roughly described as follows:
(1)
System initialization: according to the security parameterλ input by the system, TA generates an elliptic curve E, master secret keys x ands, system public keys Kpub andTpub, and system parameters params, respectively. TA broadcasts system parameters params and keeps the master secret keysx ands(2)
Pseudo identity generation: vehicleVi sends its real identity RIDi and its partial pseudo identity PIDi,1 to TRA. TRA verifies the authenticity of the vehicle’s real identity RIDi and generates pseudonym PIDi and then sends it to KGC and vehicle Vi(3)
Partial private key generation: KGC takes system parametersparams, master secret key x, and a vehicle’s pseudo identity PIDi as input, returns vehicle’s partial private key ppki, and sends it to the vehicle Vi over a secure channel(4)
Vehicle key generation: vehicleVi takes its pseudo identity PIDi, partial private key ppki, state information ∇, and system parameters params as input and outputs a private key vski, a public key vpki, a full public key PKi, and a full private key ski(5)
Individual signature generation: this algorithm is performed by each vehicleVi that takes state information ∇, its pseudo identity PIDi and a message Mi as input and responds with a signature σi as output(6)
Individual signature verification: this is an algorithm performed by a verifier, such as an RSU, that uses system parametersparams, pseudo identity PIDi, message Mi, and signature σi to verify the validity of the signature σi(7)
Signature aggregation: this is an algorithm performed by an aggregate signature generator, such as an RSU, that aggregatesn signatures σi of n messages Mi from n users Vi into a single short aggregate signature σ and send it to AS(8)
Aggregate signature verification: this algorithm is performed by AS for verifying the validity of the aggregate signatureσ. It takes system parameters params, n pseudo identities PID1,PID2,‥‥PIDn, n messages M1,M2,‥‥Mn, and the aggregate signature σ as input and outputs true if the aggregate signature σ is valid and false otherwiseBased on the above algorithm process, the execution flow of our proposed scheme is shown in Figure3.Figure 3
The execution flow of our proposed CLAS scheme for 5G-enabled vehicular networks.


### 3.5. Threat Model

The proposed CLAS scheme has the following assumptions:(1)
TA and AS are fully trusted, independent, and reliable entities with sufficient storage and computation capabilities(2)
Each RSU is an honest-but-curious entity with slightly less storage and computation capabilities than TA and AS and provides good network coverage and ultrafast information transmission speed(3)
Each vehicle is an untrusted entity, equipped with an OBU with limited storage and computation capabilities and equipped with a tamper proof device (TPD) to protect absolute data securityIn order to prove that our proposed CLAS scheme is not existentially forgeable against adaptive chosen-message attack in ROM, we define two types of adversaries which are similar to these schemes [10, 12, 13, 34].Type 1.A1 adversary is an external adversary who has the ability to launch a public key replacement attack but cannot obtain the master secret key or the partial private keyType 2.A2 adversary represents a malicious-but-passive internal attacker who can access the master secret key and the partial private key but cannot replace any user’s public keyWe consider two games played by a challengerC and an adversary A∈A1,A2 to define the security of our proposed scheme.The adversaryA can query the following oracles.CreateVehicleID. When receiving a query from A, C takes a vehicle’s identity ID as input, calculates vpki, and sends it to APartialPrivateKeyID. When receiving the partial private key query for a vehicle whose identity is ID from A, C sends ppki to APublicKeyID. When A requests C for the public key of a vehicle whose identity is ID, C calculates PKi and sends it to ASecretKeyID. Given a vehicle whose identity is ID, the oracle sends vski to AReplacePublicKeyID,PKi∗. When receiving this query from A, C replaces the public key PKi with PKi∗SignID,Mi. When receiving a message Mi from a vehicle whose identity is ID, C calculates a certificateless signature σi and sends it to A


### 3.6. Security and Privacy Requirements

Considering that 5G-enabled vehicular networks must meet the requirements of security, efficiency, and privacy protection, the proposed CLAS scheme needs to satisfy the security and privacy requirements described as follows:Message integrity and authentication: in 5G-enabled vehicular networks, when an RSU receives a signature and message sent by a vehicle, it must verify the authenticity and integrity of the message to ensure the legitimacy of the vehicle and to ensure that the message has not been tampered with, impersonated, or forged by a malicious attackerPrivacy preserving: during the authentication process for 5G-enabled vehicular networks, vehicles are not allowed to communicate using their real identities and must use pseudonymsTraceability and revocability: when vehicles communicate with pseudonyms, they are likely to be attacked by malicious vehicles. Therefore, TRA must have the ability to obtain the real identity of the malicious vehicle in order to trace its malicious act, as well as put in place certain mechanisms for management, such as revoking the malicious vehicleUnlinkability: an attacker must not be able to infer a vehicle from multiple messages sent by the same vehicle by cross-linkingResistance to various attacks: 5G-enabled vehicular networks are vulnerable, so the proposed CLAS scheme must have the ability to resist various general attacks, such as impersonation attacks, replay attacks, modification attacks, and information injection attacks


## 3.1. ECC

ECC is widely used in the design of cryptographic protocols and security schemes because of its higher computational efficiency and communication efficiency.Suppose that a finite fieldFp is defined over a large prime p and an elliptic curve E defined over the field Fp is the set of solutions x,y to the equation E:y2=x3+ax+bmodp, where a,b∈Fp, x,y∈Fp∗Fp, and 4a3+27b2modp≠0. Therefore, the elliptic curve E is the set of such solutions together with a point at infinity O, where O is identity element, and the points of E form a finite Abelian group. Here, p and E are fixed and publicly known. Furthermore, suppose that P∈E is a fixed and publicly know point, and Gp is an additive group whose order is a large prime q and whose generator is P. Therefore, Gp is a finite cyclic subgroup on the elliptic curve E. A brief description of the two difficult problems of ECC is as follows.
(1)
Elliptic curve discrete logarithm problem (ECDLP): for any given two random pointsP,Q∈Gp, where x∈0..q−1 is unknown and Q=xP is known, it is hard to compute x in polynomial time with nonnegligible probability(2)
Computational Diffie–Hellman problem (CDHP): for any given two random pointsaP,bP∈Gp, where a,b∈0..q−1 are unknown, it is hard to computer Q=abP, Q∈Gp in polynomial time with nonnegligible probabilityThe security of ECC is based on the difficulties of the ECDLP and CDHP.


## 3.2. Cuckoo Filter

A cuckoo filter is a compact variant of a cuckoo hash table and a probabilistic data structure for approximate set membership tests. It only stores fingerprints for each item inserted, supports dynamic addition and deletion of items, and provides higher lookup performance compared to standard Bloom filters without incurring higher overhead in space and performance. Therefore, cuckoo filter is suitable for applications that store many items and aim for low false-positive rates [33].The cuckoo filter uses two hash functionsh1x and h2x to insert a new item x into a hash table. If one of x’s two locations is empty, then the algorithm just puts x in there. But if both are full, the algorithm randomly selects one of them, kicks out the existing item, and puts x in there. At the same time, the kicked item is put to its own alternate location. The insertion operation of the cuckoo filter is shown in Figure 1, where Figures 1(a) and 1(b) show the process of inserting a new item x into a hash table and Figure 1(c) shows an instance of a cuckoo filter.Figure 1
Insertion operation of cuckoo filter.


## 3.3. System Model

As shown in Figure2, the system model of 5G-enabled vehicular networks mainly consists of four entities: trusted authority (TA), application server (AS), RSUs (i.e., 5G-RSUs or 5G-BSs), and vehicles, and they communicate with each other via C-V2X. The system model can be divided into two layers, in which the upper network is composed of TA and AS and the lower network is composed of RSUs and vehicles equipped with OBUs.Figure 2
The system model of 5G-enabled vehicular networks.TA: TA includes a KGC and a trace authority (TRA). TA uses secure wired channels to communicate with other facilities and is mainly responsible for initializing system parameters for each registered vehicle and RSU in 5G-enabled vehicular networks. TA can also conditionally trace and revoke malicious vehicles to meet the requirements of security and privacy preservation. KGC is responsible for generating a partial private key for each vehicle, while TRA is responsible for generating a pseudonym for each vehicle and can trace the vehicle’s real identity through the pseudo identity of the vehicle. TA’s executive agency is generally the government’s traffic management centre (TMC)AS: AS is an application server with strong computing and storage capabilities. AS uses secure wired channels to communicate with other facilities and is mainly responsible for providing large-scale computing and storage services for 5G-enabled vehicular networks to collect and analyse traffic-related dataRSUs: RSUs are located on both sides of the road and generally include 5G base stations and road side units. RSUs use V2I communication mode to receive and transmit vehicles’ information. RSUs can also communicate with TA and AS using secure wired channels. Therefore, RSUs have the ability to store and forward data and cooperate with vehicles for data analysis. Moreover, RSUs also check the integrity and authenticity of the messages to fulfil security requirementsVehicles: vehicles are the main carrier for collecting driving data and sensing information in vehicular networks. Vehicles can use V2V communication mode to exchange information with adjacent vehicles and can also use V2N communication mode to communicate with TA and ASWhen vehicles join vehicular networks, TA initializes system parameters so that each vehicle can be assigned a pseudo identity and a corresponding public and private key pair. The vehicle must sign each message before sending it. After receiving the message signature pair, the RSU needs to verify the signature to ensure the authenticity of the signature and the integrity of the message. When the RSU receives a large number of traffic-related messages, the messages are aggregated, and the messages and signatures are sent to AS for verification and analysis. Finally, AS feeds back the results of authentication and analysis to the TA for further processing.


## 3.4. System Framework

Generally, the CLAS scheme consist of the following algorithms [11, 25]. According to the overview of our proposed scheme, the process of each algorithm is roughly described as follows:
(1)
System initialization: according to the security parameterλ input by the system, TA generates an elliptic curve E, master secret keys x ands, system public keys Kpub andTpub, and system parameters params, respectively. TA broadcasts system parameters params and keeps the master secret keysx ands(2)
Pseudo identity generation: vehicleVi sends its real identity RIDi and its partial pseudo identity PIDi,1 to TRA. TRA verifies the authenticity of the vehicle’s real identity RIDi and generates pseudonym PIDi and then sends it to KGC and vehicle Vi(3)
Partial private key generation: KGC takes system parametersparams, master secret key x, and a vehicle’s pseudo identity PIDi as input, returns vehicle’s partial private key ppki, and sends it to the vehicle Vi over a secure channel(4)
Vehicle key generation: vehicleVi takes its pseudo identity PIDi, partial private key ppki, state information ∇, and system parameters params as input and outputs a private key vski, a public key vpki, a full public key PKi, and a full private key ski(5)
Individual signature generation: this algorithm is performed by each vehicleVi that takes state information ∇, its pseudo identity PIDi and a message Mi as input and responds with a signature σi as output(6)
Individual signature verification: this is an algorithm performed by a verifier, such as an RSU, that uses system parametersparams, pseudo identity PIDi, message Mi, and signature σi to verify the validity of the signature σi(7)
Signature aggregation: this is an algorithm performed by an aggregate signature generator, such as an RSU, that aggregatesn signatures σi of n messages Mi from n users Vi into a single short aggregate signature σ and send it to AS(8)
Aggregate signature verification: this algorithm is performed by AS for verifying the validity of the aggregate signatureσ. It takes system parameters params, n pseudo identities PID1,PID2,‥‥PIDn, n messages M1,M2,‥‥Mn, and the aggregate signature σ as input and outputs true if the aggregate signature σ is valid and false otherwiseBased on the above algorithm process, the execution flow of our proposed scheme is shown in Figure3.Figure 3
The execution flow of our proposed CLAS scheme for 5G-enabled vehicular networks.


## 3.5. Threat Model

The proposed CLAS scheme has the following assumptions:(1)
TA and AS are fully trusted, independent, and reliable entities with sufficient storage and computation capabilities(2)
Each RSU is an honest-but-curious entity with slightly less storage and computation capabilities than TA and AS and provides good network coverage and ultrafast information transmission speed(3)
Each vehicle is an untrusted entity, equipped with an OBU with limited storage and computation capabilities and equipped with a tamper proof device (TPD) to protect absolute data securityIn order to prove that our proposed CLAS scheme is not existentially forgeable against adaptive chosen-message attack in ROM, we define two types of adversaries which are similar to these schemes [10, 12, 13, 34].Type 1.A1 adversary is an external adversary who has the ability to launch a public key replacement attack but cannot obtain the master secret key or the partial private keyType 2.A2 adversary represents a malicious-but-passive internal attacker who can access the master secret key and the partial private key but cannot replace any user’s public keyWe consider two games played by a challengerC and an adversary A∈A1,A2 to define the security of our proposed scheme.The adversaryA can query the following oracles.CreateVehicleID. When receiving a query from A, C takes a vehicle’s identity ID as input, calculates vpki, and sends it to APartialPrivateKeyID. When receiving the partial private key query for a vehicle whose identity is ID from A, C sends ppki to APublicKeyID. When A requests C for the public key of a vehicle whose identity is ID, C calculates PKi and sends it to ASecretKeyID. Given a vehicle whose identity is ID, the oracle sends vski to AReplacePublicKeyID,PKi∗. When receiving this query from A, C replaces the public key PKi with PKi∗SignID,Mi. When receiving a message Mi from a vehicle whose identity is ID, C calculates a certificateless signature σi and sends it to A


## 3.6. Security and Privacy Requirements

Considering that 5G-enabled vehicular networks must meet the requirements of security, efficiency, and privacy protection, the proposed CLAS scheme needs to satisfy the security and privacy requirements described as follows:Message integrity and authentication: in 5G-enabled vehicular networks, when an RSU receives a signature and message sent by a vehicle, it must verify the authenticity and integrity of the message to ensure the legitimacy of the vehicle and to ensure that the message has not been tampered with, impersonated, or forged by a malicious attackerPrivacy preserving: during the authentication process for 5G-enabled vehicular networks, vehicles are not allowed to communicate using their real identities and must use pseudonymsTraceability and revocability: when vehicles communicate with pseudonyms, they are likely to be attacked by malicious vehicles. Therefore, TRA must have the ability to obtain the real identity of the malicious vehicle in order to trace its malicious act, as well as put in place certain mechanisms for management, such as revoking the malicious vehicleUnlinkability: an attacker must not be able to infer a vehicle from multiple messages sent by the same vehicle by cross-linkingResistance to various attacks: 5G-enabled vehicular networks are vulnerable, so the proposed CLAS scheme must have the ability to resist various general attacks, such as impersonation attacks, replay attacks, modification attacks, and information injection attacks


## 4. The Proposed CLAS Scheme

In this section, we propose an efficient and secure CLAS scheme, which is implemented without bilinear pairing and map to point hash operations. Moreover, when the aggregate signature is verified to be invalid, the proposed CLAS scheme uses binary search to identify invalid signatures and introduces a cuckoo filter to revoke malicious vehicles to prevent the attack again. In addition, the proposed CLAS scheme also uses a random vector to resist information injection attacks. This scheme includes eleven phases: system initialization, pseudo identity generation, vehicle registration, partial private key generation, vehicle key generation, individual signature generation, individual signature verification, signature aggregation, aggregate signature verification, invalid signature identification, and malicious vehicle revocation. The main symbols and description used in this scheme are shown in Table1.Table 1
Symbols and description.
SymbolsDescriptionp,qTwo large primesEAn elliptic curve:y2=x3+ax+bmodpGA cyclic additive groupPA generator of the groupGTAA trusted authorityKGCA key generation centreTRAA trace authorityViTheith vehicleRSUA road side unitOBUAn onboard unitKpub,xThe public/private key pair of the KGCTpub,sThe public/private key pair of the TRAh1,h2,h3,h4Four one-way collision-resistant hash functionsppkiThe partial private key of the vehicleVivski,vpkiThe public/private key pair of the vehicleViPIDiThe pseudo identity of the vehicleViRIDiThe real identity of the vehicleViVPiA valid period of the pseudo identitytiThe latest time stamp⊕The bit-wise exclusive-OR (XOR) operation||The message concatenation operationMiA traffic-related sensing messageσiA certificateless signature on a messageMiThe detailed implement process of each phase of the proposed CLAS scheme is described as follows.(i)
System initialization: in this phase, KGC and TRA initialize system parameters for RSUs and vehicles(1)
According to the security parameterλ, KGC selects two large prime numbers p,q, respectively, and generates an elliptic curve E:y2=x3+ax+bmodp, where p>3, a,b∈Fp, x,y∈Fp∗Fp, and 4a3+27b2modp≠0(2)
KGC selects a pointP on the elliptic curve E as its random generator and generates a group G with order q from P. TRA also selects a point P on the elliptic curve E as its random generator and generates a group G with order q from P(3)
KGC selects a random numberx∈Zq∗ from the finite field as its master private key, which is used to extract the partial private key ppki. Then, it calculates the corresponding public key Kpub=x·P, where x is only known by KGC(4)
TRA selects a random numbers∈Zq∗ as its master private key for traceability and calculates the system public key Tpub=s·P, where s is only known by TRA(5)
KGC and TRA choose four secure hash functions:h1, h2, h3, and h4, where h1:0,1∗⟶Zq∗, h2:0,1∗×G⟶Zq∗, h3:0,1∗×G×G⟶Zq∗, and h4:0,1∗×G×G×G⟶Zq∗(6)
KGC and TRA keep the master secrets keyx ands and issue the system parameters:(1)params=P,p,q,E,G,h1,h2,h3,h4,Kpub,TpubAny vehicle that has successfully registered with the TA can access the system parameters via a secure channel and store them in its TPD. Similarly, any RSU can also access the system parameters after successful registration.(ii)
Pseudo identity generation: in this phase, TRA works with vehicles to generate pseudo identities for vehicles to conditionally preserve their privacy, which allows them to send messages anonymously(1)
The vehicleVi with its real identity RIDi picks a random number ξi∈Zq∗ to calculate the its partial pseudo identity PIDi,1=ξi·P, and(2)Ai=RIDi⊕h1ξi·PIDi,1Tpub·ξi·TpubThe vehicleVi then sends PIDi,1,Ai securely to TRA.
(2)
When TRA receives the tuplePIDi,1,Ai from the vehicle Vi, it first checks whether(3)RIDi=Ai⊕h1ξi·PIDi,1Tpub·ξi·Tpubis valid or not. If the identity of the vehicle Vi fails, the TRA will discard the tuple; otherwise, it will calculate
(4)PIDi,2=RIDi⊕h1s·PIDi,1VPiparamsand generate the vehicle’s pseudo identity PIDi=PIDi,1,PIDi,2,VPi, where VPi is the valid period of the vehicle’s pseudo identity. Finally, TRA sends PIDi to KGC and the vehicle Vi through a secure channel
(iii)
Vehicle registration: after receiving the pseudo identityPIDi, the vehicle Vi stores it in its TPD and then communicates with other entities using the pseudo identity PIDi in 5G-enabled vehicular networks. To preserve vehicle’s privacy and trace malicious vehicle, TRA stores both the real identity RIDi and the pseudo identity PIDi of the vehicle Vi. Once a vehicle or RSU reports a malicious vehicle, TRA can obtain the real identity of the vehicle from the vehicle’s pseudo identity according to the master private key, and TRA inserts the malicious vehicle’s pseudo identity PIDi into the negative cuckoo filter (RPID-cuckoo) to revoke it(iv)
Partial private key generation: in this phase, KGC generates a partial private key based on the received pseudo identity of the vehicle. The preload method is also used to store the pseudo identities of the vehicle and the partial private keys of the vehicle and to reload when them needs to be updated(1)
After receiving the pseudo identityPIDi of the vehicle Vi, KGC checks the validity of the VPi in PIDi and queries the RPID-cuckoo filter to ensure that the pseudo identity of the vehicle has not been revoked by the TRA(2)
If the pseudo identity has not expired and the vehicle has not been revoked, KGC chooses a random numberui∈Zq∗ to calculate Ui=ui·P, h2i=h2PIDiKpubparams and creates a partial private key ppki=ui+xh2imodq for the vehicle Vi(3)
KGC sends the tupleUi,ppki to the vehicle Vi through a secure channel(v)
Vehicle key generation: in this phase, the vehicle generates a partial public/private key pair and creates its full public/private key pair(1)
After receiving the tupleUi,ppki from KGC, the vehicle Vi calculates h2i=h2PIDiKpubparams and checks the validity of the partial private key ppki by calculating whether the equation(5)ppki·P=ui·P+xh2i·Pmodq=Ui+h2iKpubmodqholds or not. If it holds, the vehicle Vi stores the partial private key ppki in its TPD; otherwise, the vehicle Vi discards the partial private key ppki(2)
The vehicleVi chooses two random numbers ai,bi∈Zq∗ and calculates h3i=h3PIDi∇params, θi=aih3i, Bi=bi·P, and Ci=θi·P, respectively(3)
The vehicleVi selects θi as the vehicle private key vski, Ci+Ui as the vehicle public key vpki and forms the vehicle’s full private key ski=ppki,vski and full public key PKi=Ui,vpki(vi)
Individual signature generation: in this phase, the vehicle signs each traffic-related message that is about to be sent to meet authentication and message integrity requirements(1)
The vehicleVi randomly selects a pseudo identity PIDi from its TPD and picks a latest timestamp ti to prevent replay attacks and ensure the timeliness of sensing information collection(2)
The vehicleVi picks a random number ri∈Zq∗, computes Ri=ri·Bi, h4i=h4MiPIDivpkiRi∇ti,(6)Si=ribi+h4iθi+ppkimodq,and then constructs a certificateless signature σi=Ri,Si on the traffic-related sensing message Mi(3)
The signature-message tuplemsg=MiPIDivpkiσiti is broadcasted to the nearby RSUs or other vehicles for verification(vii)
Individual signature verification: in this phase, each RSU or vehicle that receive the signature-message tuple is responsible for verifying the validity of the individual signature(1)
After receiving the signature-message tuplemsg, each RSU or vehicle acts as a verifier to check whether that both ti in msg and VPi in PIDi are valid, and as long as one of them is invalid, the verifier can reject the message and stop verification(2)
The verifier looks up the RPID-cuckoo filter to ensure that thePIDi has not been revoked by TRA. If the vehicle Vi has not been revoked, the verifier performs the following procedures(3)
The verifier computesh2i=h2PIDiKpubparams and h4i=h4MiPIDivpkiRi∇ti, respectively, and checks the validity of the signature σi by verifying whether the equation(7)Si·P=Ri+h4ivpki+h2iKpub,holds or not. If it holds, the verifier accepts the signature-message tuple msg(viii)
Signature aggregation: in this phase, each RSU acts as an aggregate signature generator. When receiving multiple signature-message tuplesM1PID1vpk1σ1t1, M2PID2vpk2σ2t2, …, MnPIDnvpknσntn from n vehicles V1,V2,‥‥Vn, the aggregate signature generator aggregates multiple certificateless signatures into a single short signature, which can both reduce the communication overhead and make full use of the computational resources of the RSU. In this phase, the adversary can launch an injection attack by tampering with several valid signatures [29]. In order to prevent information injection attacks in the aggregation signature phase, we use the random vector to resist this attack(1)
The aggregate signature generator randomly generates a vectorv=v1,v2,v3⋯,vn that is used to resist information injection attacks, where each vi is a random exponent in the range 1,2t and t is a very small integer(2)
The aggregate signature generator calculatesS=∑i=1nviSi, R=∑i=1nviRi, and C=∑i=1nh4ivivpki, respectively(3)
The aggregate signature generator outputsσ=R,S as the certificateless aggregate signature and sends it to the AS(ix)
Aggregate signature verification: in this phase, AS is responsible for verifying the validity of the certificateless aggregate signature aggregated by the aggregate signature generator(1)
AS checks whetherti in msg and VPi in PIDi are both valid for i=1,2,3,⋯,n. If they are all valid, then AS performs the following procedures(2)
AS looks up the RPID-cuckoo filter to ensuren pseudo identitiesPID1,PID2,‥‥PIDn have not been revoked by TRA. If a set of vehicles V1,V2,⋯Vn has not been revoked, AS performs the following procedures(3)
AS computesh2i=h2PIDiKpubparams and h4i=h4MiPIDivpkiRi∇ti for i=1,2,3,⋯,n(4)
AS checks whether the following equation holds or not(8)S·P=R+C+∑i=1nvih4ih2iKpub.If it holds, then AS accepts the certificateless aggregate signature; otherwise, AS performs the following phasesAll of the above phases are shown in Figure4.
(x)
Invalid signature identification: in this phase, when an attacker inserts an invalid signature into the aggregate signature in order to interfere with the verification resulting in invalid aggregate signature verification, AS identifies invalid signatures from the aggregate signature, requests TRA to revoke the malicious vehicles and broadcast them, and accepts the remaining valid signatures in order to reduce the computational overhead caused by repeated verification and prevent malicious vehicles from attacking. In the process of invalid signature identification, binary search is used jointly by AS and RSU(1)
The RSU sorts the previously received multiple signatures, finds the middle position, divides the multiple signatures into two sets and then performs aggregate signature on them, respectively, and sends the two aggregate signatures to AS for verification(2)
If AS verifies that either of the two aggregate signatures is invalid, the above procedures 1 and 2 are repeated for the invalid aggregate signatures until an invalid signature is found(3)
AS sends multiple pseudo identities corresponding to invalid signaturesPIDi,ti to TRA to trace the real identity RIDi of malicious vehicles and revoke them while sending also multiple pseudo identities corresponding to valid signatures PIDi,ti to TRA and receiving these valid signaturesFigure 4
The detailed algorithm of our proposed CLAS scheme.The overall invalid signature identification steps are shown in Algorithm1(xi)
Malicious vehicle revocation: in this phase, after AS identifies invalid and valid signatures from the aggregate signature and sends them to TRA, TRA traces the real identityRIDi of the malicious vehicle through the pseudo identity PIDi corresponding to the invalid signature and then maps out all preloaded pseudo identities of the vehicle Vi. Finally, TRA makes use of the cuckoo filter to revoke the malicious vehicles. Moreover, when the fingerprint of each vehicle is known, in order to improve the efficiency of signature verification, a cuckoo filter is used to assist in verifying the signature. At the same time, in order to reduce false positives, two cuckoo filters are used to store relative fingerprint information: the positive filter (PID-cuckoo) is used to store fingerprints with valid signatures, and the negative filter (RPID-cuckoo) is used to store fingerprints with invalid signatures(1)
TRA generates a fingerprintfi=FingerprintLinv and stores it in the RPID-cuckoo, where Linv=PIDi is a list of all the preloaded pseudo identities of the malicious vehicle Vi. Then, TRA generates a fingerprint fi=FingerprintLvalid and stores it in the PID-cuckoo, where Lvalid=PIDi is a list that stores the current pseudo identity of the valid vehicle Vi(2)
TRA generates a notification message and sends the received aggregation signature verification result through RSU to all vehicles in its range. In order to save communication resources, TRA only broadcasts the negative cuckoo filter results, except for vehicle and RSU active queries. The specific implementation of the notification message is shown in Algorithm2(3)
When the receiver of the messageMi proactively verifies the pseudo identity PIDi of the vehicle Vi to determine whether the vehicle Vi is a malicious vehicle, it calculates the fingerprint fi=FingerprintLi corresponding to the vehicle Vi, where Li=PIDi, then lookups the RPID-cuckoo and the PID-cuckoo, respectively, and obtains the query result. The four possible query results are listed in Table 2Algorithm 1:Invalid signature identification (List, invList, low, and high).
//List represents the aggregate signature that needs to be verified//invList represents invalid signatures that have been identified1:if aggregate-verify(List,low,high) == true then2:  return3:else4:if low == high then5:  invList.ppend(ist[low])6:  return7:else8:  mid=(high+low)/29:  InvalidSignature-dentification(List,invList,low,mid)10:  InvalidSignature-dentification(List,invList,mid+1,high)11:  //return 112:end if13:end ifAlgorithm 2: Notification message generation.
//validList represents valid signatures that have been identified//invList represents invalid signatures that have been identified1:forPIDi∈validListVido2:Lvalid⟵PIDi3:PID−Cuckoo.insertLvalid4:end for5:forPIDi∈invListVido6:Linv⟵PIDi7:RPID−Cuckoo.insertLinv8:end for9: returnRPID−Cuckoo,SigsRPID−CuckooTable 2
The query results of the cuckoo filter.
CasePositive filterNegative filterResult1TrueFalseValid2FalseTrueInvalid3FalseFalseWait for next broadcast4TrueTrueWait for reconfirmationBoth case 1 and case 2 explicitly state whether the pseudo identityPIDi is revoked or not. There is a certain probability that the result of the query is case 3. Case 3 indicates that AS has not yet verified the pseudo identity PIDi, or the verification result has not been updated to the cuckoo filter in time. Therefore, the signature verification of the vehicle needs to wait for the next round of cuckoo filter update. However, if the number of queries exceeds the preset number of rounds of the system and the query still fails, the message receiver will check whether the message Mi is valid or not according to equation (7). Case 4 occurs because the cuckoo filter has a certain false-positive rate. Therefore, the message receiver needs to send a reconfirmation message to TRA via RSU. The process of the message receiver querying the cuckoo filter to verify the pseudo identity PIDi is shown in Algorithm 3Algorithm 3: Cuckoo filter query.
Require:Li⟵PIDi1: Receiver calculates aFingerprintfi=FingerprintLi2:While VP is valid3:  Receiver queriesRPID−Cuckoo and PID−Cuckoo with query4:iffi∈PID−Cuckoothen5:iffi∉RPID−Cuckoothen6:   Receiver continues to execute the signature verification;break;7:else8:iffi∈RPID−Cuckoothen9:   Receiver re-confirmation needed;break;10:end if11:end if12:else13:iffi∈RPID−Cuckoothen14:   Receiver stops executing signature verification;break;15:end if16:iffi∉RPID−Cuckoothen17:   Receiver wait for next broadcast;break;18:end if19:end if20:end while


## 5. Security Proof and Analysis

In this section, we explain the correctness of the verification process in our proposed scheme and prove the unforgeability of the signature in the proposed CLAS scheme. Finally, we analyse how the proposed CLAS scheme meets the requirements of security and privacy protection.


### 5.1. Correctness Proof

We need to explain why signature is verified to be valid if and only if equations (7) and (8) hold. The proof derivation goes as follows.
(1)
Individual signature verification:(9)L.H.S=Si⋅P=ribi+h4iθi+ppki⋅P=ribi⋅P+h4iθi⋅P+ppki⋅P=riBi+h4iCi+ui+xh2i⋅P=riBi+h4iCi+Ui+h2iKpub=Ri+h4ivpki+h2iKpub=R.H.S.(2)
Aggregate signature verification:(10)L.H.S=S⋅P=∑i=1nviSi⋅P=∑i=1nviribi+h4iθi+ppki⋅P=∑i=1nviriBi+∑i=1nvih4iCi+∑i=1nvih4iui+xh2i⋅P=∑i=1nviriBi+∑i=1nvih4iCi+∑i=1nviUi+∑i=1nvih4ih2i⋅Kpub=∑i=1nviRi+∑i=1nvih4ivpki+∑i=1nvih4ih2iKpub=R+C+∑i=1nvih4ih2iKpub=R.H.S.


### 5.2. Security Proof

In this section, we provide formal security proof for the proposed CLAS scheme for 5G-enabled vehicular networks. As mentioned earlier, in order to prove that our proposed scheme is existentially unforgeable against an adaptive chosen message attack under the ROM, we define two types of adversaries which are similar to [10, 12, 13, 34] and consider two games.Theorem 1.
In the ROM, if there is a polynomial time Type 1 adversaryA1 who can forge a valid signature of our scheme in an attack model of game 1 after making at most qh times queries to the random oracles hiQuery, qc times CreateVehicleID queries, and qs times SignID,Mi queries, that is, win the game with an nonnegligible probability PrSuccA1, then there must be a polynomial time challenger C that can solve the ECDLP with a nonnegligible advantage ε.Proof.
In the ROM, it is assumed that there is a probabilistic polynomial time adversaryA1 who has enough ability to forge the signature-message tuple msg=MiPIDivpkiσiti of the user IDτ. Given a random instance P,Q=s·P of the ECDLP to compute s, a polynomial time challenger C calls A1 as its subroutine and solves the ECDLP with a nonnegligible advantage in polynomial time.
A1 performs the following queries:
SetupID). C inputs the security parameter λ in the system initialization phase and then sets Kpub=Q and sends the system parameter params=P,p,q,E,G,h2,h3,h4,Kpub,Tpub to A1. In this process, C constructs and maintains five hash lists Lh2i, Lh3i, Lh4i, Lu, and Lpk, all of which are initialized to empty
CreateVehicleID. C maintains a list Lu=ID,Ui,vpki,ppki,vski,h2i. When A1 makes a query on ID, and if ID is in Lu, then C sends ID,Ui,vpki,ppki,vski,h2 to A1. Otherwise, C selects three random numbers x,y,z∈Zq∗ and calculates Ui=xKpub+xyP, vpki=xzP+xy+xKpub, ppki=xz, vski=xy, and h2i=h2IDKpubparams⟵−xmodq. Finally, C sends ID,Ui,vpki,ppki,vski,h2 to A1and inserts ID,Kpub,params,h2i into Lh2
h2iQuery. C maintains a list Lh2=ID,Kpub,params,h2i. When C receives a query ID,Kpub,params from A1, if ID is in Lh2, then it sends h2i to A1. Otherwise, C executes CreateVehicleID to calculate h2i=h2IDKpubparams and then sends it to A1
h3iQuery. C maintains a list Lh3i=ID,params,∇,h3i. When C receives a query ID,params,∇ from A1, if Lh3i contains ID,params,∇,h3i, then C sends h3i to A1. Otherwise, C chooses a random number h3i∈Zq∗, calculates h3i=h3ID∇params, sends h3i to A1, and inserts ID,params,∇,h3i into Lh3i
h4iQuery. C maintains a list Lh4i=ID,Mi,vpki,Ri,∇,ti,h4i. When A1 makes a query on ID, and if ID is in Lh4i, then C sends h4i to A1. Otherwise, C selects a random number h4i∈Zq∗, calculates h4i=h4MiIDvpkiRi∇ti, sends h4i to A1, and inserts ID,Mi,vpki,Ri,∇,ti,h4i into Lh4i
PartialPrivateKeyID. When C receives a partial private key query from A1 for ID, if ID≠IDτ, C checks whether ID is already in Lu or not. If ID is in Lu, C sends ppki to A1. Otherwise, C runs CreateVehicleID to obtain ppki and sends it to A1. In addition, if ID=IDτ, C stops the game
PublicKeyID. When C receives a public key query from A1 for ID, C checks whether ID exists in Lu or not. If it exists, C sends PKi=Ui,vpki to A1. Otherwise, C executes CreateVehicleID to obtain the tuple Ui,vpki and sends it to A1
ReplacePublicKeyID,PKi∗. C maintains a list Lpk=ID,ui,Ui,vski,vpki. When A1 makes a public key replacement query with ID,PKi∗, where Ui∗=ui∗·P, vpki∗=vski∗·P and PKi∗=Ui∗,vpki∗, C sets Ui=Ui∗, vpki=vpki∗, vski=vski∗, and ppki=⊥, and inserts ID,ui∗,Ui∗,vski∗,vpki∗ to Lpk
SignID,Mi. When A1 makes a signature query with ID,Mi, C performs the following steps:
(1)
IfID is in Lpk, C picks three random numbers x,y,z∈Zq∗ such that Si=x, h4i=h4MiIDvpkiRi∇ti⟵x−1modq and Ri=x−y−z·P, then inserts ID,Mi,vpki,Ri,∇,ti,h4i to Lh4i, and finally sends the signature σi=Ri,Si to A1(2)
IfID is not in Lpk, because C knows the private key of the vehicle with ID, C acts like the procedure of the scheme
Forgery. In the end, A1 outputs a forged but valid certificateless signature σi=Ri,Si on ID,Mi, which passes the signature verification phase. If ID≠IDτ, C fails and stops
According to the forking lemma [35], A1 can obtain another forged valid signature σi∗=Ri∗,Si∗ by simulating the game again with the same random tape but different choice of h4i in polynomial time. We can get s according to the following equation; that is, C successfully solves the ECDLP. Then, we have
(11)Si·P=Ri+h4ivpki+h2iKpub,Si∗·P=Ri+h4i∗vpki+h2iKpub.
From these two linear equations, we can derive the values by
(12)Si−Si∗·P=Ri+h4ivpki+h2iKpub−Ri+h4i∗vpki+h2iKpub⇒Si−Si∗·P=h4i−h4i∗·h2i·s·P⇒Si−Si∗=h4i−h4i∗·h2i·s⇒s=Si−Si∗h4i−h4i∗·h2i.
Probabilistic Analysis. We analyse the advantages ofC successfully obtaining s from P,Q=s·P to solve the ECDLP
In the process of executingCreateVehicleID query, the random oracle assignment h2IDKpubparams causes inconsistency, which happens with probability at most qh/q. Therefore, the probability of successful simulation of qc times is at least 1−qh/qqc≥1−qhqc/q. And, the probability of successful simulation of qh times is at least 1−qh/qqh≥1−qh2/q. In addition, ID=IDτ has a probability of 1/qc. Therefore, the overall probability of successful simulation is PrSuccA1≥1−qhqc/q1−qh2/q1/qcε. It should be noted here that the time complexity t+Oqc+qsS of C is determined by the exponentiations executed in the CreateVehicleID and SignID,Mi queries, where S is the time of a scalar multiplication operation.
C can successfully obtain s from P,Q=s·P with an advantage 1−qhqc/q1−qh2/q1/qcε, where the time complexity of algorithm is t+Oqc+qsS, which contradicts the ECDLP assumption. Therefore, the proposed scheme can resist the forgery attack of type 1 adversary A1 under the ROM.Theorem 2.
In the ROM, if there is a polynomial time Type 2 adversaryA2 who can forge a valid signature of our scheme in an attack model of Game 2 after making at most qh times queries to the random oracles hiQuery, qc times CreateVehicleID queries, and qs times SignID,Mi queries, that is, win the game with an non-negligible probability PrSuccA2, then there must be a polynomial time challenger C that can solve the ECDLP with a nonnegligible advantage ε.Proof.
In the ROM, it is assumed that there is a probabilistic polynomial time adversaryA2 who has enough ability to forge the signature-message tuple msg=MiPIDivpkiσiti of the user IDτ. Given a random instance P,Q=t·P of the ECDLP to compute t, a polynomial time challenger C calls A2 as its subroutine and solves the ECDLP with a nonnegligible advantage in polynomial time.
A2 performs the following queries:
SetupID. C inputs the security parameter λ in the system initialization phase, picks a random number w∈Zq∗ and sets Kpub=w·P, and then sends the system parameter params=P,p,q,E,G,h2,h3,h4,Kpub,Tpub to A2. In this process, C constructs and maintains five hash lists Lh2i, Lh3i, Lh4i, Lu, and Lpk, all of which are initialized to null
CreateVehicleID. C maintains a list Lu=ID,Ui,vpki,ppki,vski,h2i. When A2 makes a query on ID, and if ID is in Lu, then C sends ID,Ui,vpki,ppki,vski,h2 to A2. Otherwise, if ID=IDτ, C selects two random numbers x,y∈Zq∗ and then calculates Ui=xP, vpki=Q, ppki=x+w·h2i, vski=⊥, and h2i=h2IDKpubparams⟵−yx−1modq. If ID≠IDτ, C selects three random numbers x,y,z∈Zq∗ and then calculates Ui=x−1P, vpki=y−x−1P, ppki=x−1+w·h2i, vski=y, and h2i=h2IDKpubparams⟵−yx−1modq. Finally, C sends ID,Ui,vpki,ppki,vski,h2 to A2 and inserts ID,Kpub,params,h2i into Lh2
h2iQuery. C maintains a list Lh2=ID,Kpub,params,h2i. When C receives a query ID,Kpub,params from A2, if ID is already in Lh2, it sends h2i to A2. Otherwise, C executes CreateVehicleID to calculate h2i=h2IDKpubparams and then sends it to A2
h3iQuery. C maintains a list Lh3i=ID,params,∇,h3i. When C receives a query ID,params,∇fromA2, if Lh3i contains ID,params,∇,h3i, then C sends h3i to A2. Otherwise, C chooses a random number h3i∈Zq∗, calculates h3i=h3ID∇params, sends h3i to A2, and inserts ID,params,∇,h3i into Lh3i
h4iQuery. C maintains a list Lh4i=ID,Mi,vpki,Ri,∇,ti,h4i. When A2 makes a query on ID, and if ID is in Lh4i, then C sends h4i to A2. Otherwise, C selects a random number h4i∈Zq∗, calculates h4i=h4MiIDvpkiRi∇ti, sends h4i to A2, and inserts ID,Mi,vpki,Ri,∇,ti,h4i into Lh4i.
PartialPrivateKeyID. When C receives a partial private key query from A2 for ID, C checks whether ID is already in Lu or not. If ID is in Lu, C sends ppki to A2. Otherwise, C runs CreateVehicleID to obtain ppki and sends it to A2.
PublicKeyID. When C receives a public key query from A2 for ID, C checks whether ID exists in Lu or not. If it exists, C sends PKi=Ui,vpki to A2. Otherwise, C executes CreateVehicleID to obtain the tuple Ui,vpki and sends it to A2
SecretKeyID. When C receives a private key query from A2 for ID, if ID≠IDτ, C checks whether Lu contains ID or not. If ID is in Lu, C sends vski to A2. Otherwise, C executes CreateVehicleID to obtain vski and sends it to A2. In addition, if ID=IDτ, C stops the game.
SignID,Mi. When A2 makes a signature query with ID,Mi, C performs the following steps:
(1)
IfID is in Lpk, C picks three random numbers x,y,z∈Zq∗ such that Si=x, h4i=h4MiIDvpkiRi∇ti⟵xmodq and Ri=x·P+yKpub−xvpki, then inserts ID,Mi,vpki,Ri,∇,ti,h4i to Lh4i, and finally sends the signature σi=Ri,Si to A2(2)
IfID is not in Lpk, because C knows the private key of the vehicle with ID, C acts like the procedure of the scheme
Forgery. In the end, A2 outputs a forged but valid certificateless aggregate signature σ=R,S on the tuple ID,Mi which passes the signature verification phase. If ID≠IDτ, C fails and stops
According to the forking lemma [35], A2 can obtain another valid signature σ∗=R∗,S∗ by simulating the game again with the same random tape but different choice of h4i in polynomial time. We can get t according to the following equation; that is, C successfully solves the ECDLP. Then, we have
(13)S⋅P=R+C+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4ivpki+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4i⋅t⋅P+∑i=1nvih4ih2i⋅Kpub,S∗⋅P=R+C∗+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4i∗Ci+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4i∗⋅t⋅P+∑i=1nvih4ih2i⋅Kpub.
From these two equations, we can derive the valuet by
(14)S−S∗⋅P=R+∑i=1nvih4i⋅t⋅P+∑i=1nvih4ih2i⋅Kpub−R+∑i=1nvih4i∗⋅t⋅P+∑i=1nvih4ih2i⋅Kpub⇒S−S∗⋅P=vih4i−h4i∗⋅t⋅P⇒S−S∗=vih4i−h4i∗⋅t⇒t=S−S∗vih4i−h4i∗.
Probabilistic Analysis. We analyse the advantages ofC successfully obtaining t from P,Q=t·P to solve the ECDLP
In the process of executingCreateVehicleID query, the random oracle assignment h4i=h4MiIDvpkiRi∇ti causes inconsistency, which happens with probability at most qh/q. Therefore, the probability of successful simulation of qc times is at least 1−qh/qqc≥1−qhqc/q. And, the probability of successful simulation qh times is at least 1−qh/qqh≥1−qh2/q. In addition, ID=IDτ has a probability of 1/qc. Therefore, the overall probability of successful simulation is PrSuccA2≥1−qhqc/q1−qh2/q1/qcε. It should be noted here that the time complexity t+Oqc+qsS of C is determined by the exponentiations executed in the CreateVehicleID and SignID,Mi queries, where S is the time of a scalar multiplication operation.
C can successfully obtain t from P,Q=t·P with an advantage 1−qhqc/q1−qh2/q1/qcε, where the time complexity of algorithm is t+Oqc+qsS, which contradicts ECDLP assumption. Therefore, the proposed scheme can resist the forgery attack of type 2 adversary A2 under the ROM.


### 5.3. Security Analysis

Section3.6 has given the security and privacy requirements that 5G-enabled vehicular networks. In this section, we analyse the proposed CLAS scheme to meet the above security requirements according to Theorems 1 and 2.
(i)
Message integrity and authentication: according to Theorems1 and 2, it is known that any polynomial adversary has no ability to forge a valid message. When a message msg is received from a vehicle, RSUs check the validity and integrity of the message by verifying the equation Si·P=Ri+h4ivpki+h2iKpub to prevent the message from being tampered with and forged by malicious vehicles. As a result, no malicious adversary can construct h2i=h2PIDiKpubparams and h4i=h4MiPIDivpkiRi∇ti to forge a signature σi=Ri,Si. Therefore, our proposed scheme meets the security requirements for message integrity and authentication(ii)
Privacy preserving: in 5G-enabled vehicular networks, each vehicle adopts pseudonym technology to hide its real identityRIDi to communicate, and the pseudo identity of any vehicle involves the TRA’s master private key s and a random number. If an attacker wants to know the real identity of a vehicle, it can only do so through a pseudo identity. However, when given Tpub, PIDi,1=ξi·P, it is hard to calculate ξi·P·Tpub. Besides, TRA keeps the master private key s. Therefore, our proposed scheme can meet the requirements of privacy preserving(iii)
Traceability and revocability: in our scheme, TRA can trace the identity of malicious vehicle by getting its real identityRIDi. And only TRA can extract the real identity RIDi from PIDi by its master private key through the equation RIDi=Ai⊕h1ξi·PIDi,1Tpub·ξi·Tpub. When a malicious action takes place, TRA can effectively trace and revoke the malicious vehicle and insert relevant information of the malicious vehicle into RPID-Cuckoo filter for revocation. Therefore, our proposed scheme can meet the requirements of traceability and revocability(i)
Unlinkability: in our scheme, a different pseudo identity is used for each message sent by the vehicle, and the corresponding private key is used to sign the message, in which the numberξi in the pseudo identity is random. Moreover, there is no relationship between the new pseudo identity and the old pseudo identity for each vehicle. Therefore, the attacker cannot link two messages to the same vehicle, so our scheme meets the requirement of unlinkability(ii)
Resistance to replay attacks: in our scheme, the timestampti is used to resist replay attacks. After receiving the message and signature, the receiver checks the freshness of the timestamp and whether the validity of the pseudo identity has expired. If the valid time is exceeded, the message is discarded. Therefore, our scheme is resistant to replay attacks(iii)
Resistance to modification attack: if the attacker modifies the message and sends it to others, the verifier can easily determine the message has been modified by verifying equationSi·P=Ri+h4ivpki+h2iKpub. Therefore, our scheme is resistant to modification attacks(iv)
Resistance to impersonation attack: according to Theorems1 and 2, it is proved that our scheme is existentially unforgeable against an adaptive chosen message attack under the ROM. The adversary has not the ability to launch an impersonation attack by forging a valid signature. It is easy to determine if there is an impersonation attack by verifying the equationSi·P=Ri+h4ivpki+h2iKpub. Therefore, our scheme is resistant to impersonation attacks(v)
Resistance to information injection attack: in our scheme, the value of equationS·P=R+C+∑i=1nvih4ih2iKpub can be changed by using a random vector v in the aggregation verification phase. Therefore, our scheme is resistant to information injection attacks


## 5.1. Correctness Proof

We need to explain why signature is verified to be valid if and only if equations (7) and (8) hold. The proof derivation goes as follows.
(1)
Individual signature verification:(9)L.H.S=Si⋅P=ribi+h4iθi+ppki⋅P=ribi⋅P+h4iθi⋅P+ppki⋅P=riBi+h4iCi+ui+xh2i⋅P=riBi+h4iCi+Ui+h2iKpub=Ri+h4ivpki+h2iKpub=R.H.S.(2)
Aggregate signature verification:(10)L.H.S=S⋅P=∑i=1nviSi⋅P=∑i=1nviribi+h4iθi+ppki⋅P=∑i=1nviriBi+∑i=1nvih4iCi+∑i=1nvih4iui+xh2i⋅P=∑i=1nviriBi+∑i=1nvih4iCi+∑i=1nviUi+∑i=1nvih4ih2i⋅Kpub=∑i=1nviRi+∑i=1nvih4ivpki+∑i=1nvih4ih2iKpub=R+C+∑i=1nvih4ih2iKpub=R.H.S.


## 5.2. Security Proof

In this section, we provide formal security proof for the proposed CLAS scheme for 5G-enabled vehicular networks. As mentioned earlier, in order to prove that our proposed scheme is existentially unforgeable against an adaptive chosen message attack under the ROM, we define two types of adversaries which are similar to [10, 12, 13, 34] and consider two games.Theorem 1.
In the ROM, if there is a polynomial time Type 1 adversaryA1 who can forge a valid signature of our scheme in an attack model of game 1 after making at most qh times queries to the random oracles hiQuery, qc times CreateVehicleID queries, and qs times SignID,Mi queries, that is, win the game with an nonnegligible probability PrSuccA1, then there must be a polynomial time challenger C that can solve the ECDLP with a nonnegligible advantage ε.Proof.
In the ROM, it is assumed that there is a probabilistic polynomial time adversaryA1 who has enough ability to forge the signature-message tuple msg=MiPIDivpkiσiti of the user IDτ. Given a random instance P,Q=s·P of the ECDLP to compute s, a polynomial time challenger C calls A1 as its subroutine and solves the ECDLP with a nonnegligible advantage in polynomial time.
A1 performs the following queries:
SetupID). C inputs the security parameter λ in the system initialization phase and then sets Kpub=Q and sends the system parameter params=P,p,q,E,G,h2,h3,h4,Kpub,Tpub to A1. In this process, C constructs and maintains five hash lists Lh2i, Lh3i, Lh4i, Lu, and Lpk, all of which are initialized to empty
CreateVehicleID. C maintains a list Lu=ID,Ui,vpki,ppki,vski,h2i. When A1 makes a query on ID, and if ID is in Lu, then C sends ID,Ui,vpki,ppki,vski,h2 to A1. Otherwise, C selects three random numbers x,y,z∈Zq∗ and calculates Ui=xKpub+xyP, vpki=xzP+xy+xKpub, ppki=xz, vski=xy, and h2i=h2IDKpubparams⟵−xmodq. Finally, C sends ID,Ui,vpki,ppki,vski,h2 to A1and inserts ID,Kpub,params,h2i into Lh2
h2iQuery. C maintains a list Lh2=ID,Kpub,params,h2i. When C receives a query ID,Kpub,params from A1, if ID is in Lh2, then it sends h2i to A1. Otherwise, C executes CreateVehicleID to calculate h2i=h2IDKpubparams and then sends it to A1
h3iQuery. C maintains a list Lh3i=ID,params,∇,h3i. When C receives a query ID,params,∇ from A1, if Lh3i contains ID,params,∇,h3i, then C sends h3i to A1. Otherwise, C chooses a random number h3i∈Zq∗, calculates h3i=h3ID∇params, sends h3i to A1, and inserts ID,params,∇,h3i into Lh3i
h4iQuery. C maintains a list Lh4i=ID,Mi,vpki,Ri,∇,ti,h4i. When A1 makes a query on ID, and if ID is in Lh4i, then C sends h4i to A1. Otherwise, C selects a random number h4i∈Zq∗, calculates h4i=h4MiIDvpkiRi∇ti, sends h4i to A1, and inserts ID,Mi,vpki,Ri,∇,ti,h4i into Lh4i
PartialPrivateKeyID. When C receives a partial private key query from A1 for ID, if ID≠IDτ, C checks whether ID is already in Lu or not. If ID is in Lu, C sends ppki to A1. Otherwise, C runs CreateVehicleID to obtain ppki and sends it to A1. In addition, if ID=IDτ, C stops the game
PublicKeyID. When C receives a public key query from A1 for ID, C checks whether ID exists in Lu or not. If it exists, C sends PKi=Ui,vpki to A1. Otherwise, C executes CreateVehicleID to obtain the tuple Ui,vpki and sends it to A1
ReplacePublicKeyID,PKi∗. C maintains a list Lpk=ID,ui,Ui,vski,vpki. When A1 makes a public key replacement query with ID,PKi∗, where Ui∗=ui∗·P, vpki∗=vski∗·P and PKi∗=Ui∗,vpki∗, C sets Ui=Ui∗, vpki=vpki∗, vski=vski∗, and ppki=⊥, and inserts ID,ui∗,Ui∗,vski∗,vpki∗ to Lpk
SignID,Mi. When A1 makes a signature query with ID,Mi, C performs the following steps:
(1)
IfID is in Lpk, C picks three random numbers x,y,z∈Zq∗ such that Si=x, h4i=h4MiIDvpkiRi∇ti⟵x−1modq and Ri=x−y−z·P, then inserts ID,Mi,vpki,Ri,∇,ti,h4i to Lh4i, and finally sends the signature σi=Ri,Si to A1(2)
IfID is not in Lpk, because C knows the private key of the vehicle with ID, C acts like the procedure of the scheme
Forgery. In the end, A1 outputs a forged but valid certificateless signature σi=Ri,Si on ID,Mi, which passes the signature verification phase. If ID≠IDτ, C fails and stops
According to the forking lemma [35], A1 can obtain another forged valid signature σi∗=Ri∗,Si∗ by simulating the game again with the same random tape but different choice of h4i in polynomial time. We can get s according to the following equation; that is, C successfully solves the ECDLP. Then, we have
(11)Si·P=Ri+h4ivpki+h2iKpub,Si∗·P=Ri+h4i∗vpki+h2iKpub.
From these two linear equations, we can derive the values by
(12)Si−Si∗·P=Ri+h4ivpki+h2iKpub−Ri+h4i∗vpki+h2iKpub⇒Si−Si∗·P=h4i−h4i∗·h2i·s·P⇒Si−Si∗=h4i−h4i∗·h2i·s⇒s=Si−Si∗h4i−h4i∗·h2i.
Probabilistic Analysis. We analyse the advantages ofC successfully obtaining s from P,Q=s·P to solve the ECDLP
In the process of executingCreateVehicleID query, the random oracle assignment h2IDKpubparams causes inconsistency, which happens with probability at most qh/q. Therefore, the probability of successful simulation of qc times is at least 1−qh/qqc≥1−qhqc/q. And, the probability of successful simulation of qh times is at least 1−qh/qqh≥1−qh2/q. In addition, ID=IDτ has a probability of 1/qc. Therefore, the overall probability of successful simulation is PrSuccA1≥1−qhqc/q1−qh2/q1/qcε. It should be noted here that the time complexity t+Oqc+qsS of C is determined by the exponentiations executed in the CreateVehicleID and SignID,Mi queries, where S is the time of a scalar multiplication operation.
C can successfully obtain s from P,Q=s·P with an advantage 1−qhqc/q1−qh2/q1/qcε, where the time complexity of algorithm is t+Oqc+qsS, which contradicts the ECDLP assumption. Therefore, the proposed scheme can resist the forgery attack of type 1 adversary A1 under the ROM.Theorem 2.
In the ROM, if there is a polynomial time Type 2 adversaryA2 who can forge a valid signature of our scheme in an attack model of Game 2 after making at most qh times queries to the random oracles hiQuery, qc times CreateVehicleID queries, and qs times SignID,Mi queries, that is, win the game with an non-negligible probability PrSuccA2, then there must be a polynomial time challenger C that can solve the ECDLP with a nonnegligible advantage ε.Proof.
In the ROM, it is assumed that there is a probabilistic polynomial time adversaryA2 who has enough ability to forge the signature-message tuple msg=MiPIDivpkiσiti of the user IDτ. Given a random instance P,Q=t·P of the ECDLP to compute t, a polynomial time challenger C calls A2 as its subroutine and solves the ECDLP with a nonnegligible advantage in polynomial time.
A2 performs the following queries:
SetupID. C inputs the security parameter λ in the system initialization phase, picks a random number w∈Zq∗ and sets Kpub=w·P, and then sends the system parameter params=P,p,q,E,G,h2,h3,h4,Kpub,Tpub to A2. In this process, C constructs and maintains five hash lists Lh2i, Lh3i, Lh4i, Lu, and Lpk, all of which are initialized to null
CreateVehicleID. C maintains a list Lu=ID,Ui,vpki,ppki,vski,h2i. When A2 makes a query on ID, and if ID is in Lu, then C sends ID,Ui,vpki,ppki,vski,h2 to A2. Otherwise, if ID=IDτ, C selects two random numbers x,y∈Zq∗ and then calculates Ui=xP, vpki=Q, ppki=x+w·h2i, vski=⊥, and h2i=h2IDKpubparams⟵−yx−1modq. If ID≠IDτ, C selects three random numbers x,y,z∈Zq∗ and then calculates Ui=x−1P, vpki=y−x−1P, ppki=x−1+w·h2i, vski=y, and h2i=h2IDKpubparams⟵−yx−1modq. Finally, C sends ID,Ui,vpki,ppki,vski,h2 to A2 and inserts ID,Kpub,params,h2i into Lh2
h2iQuery. C maintains a list Lh2=ID,Kpub,params,h2i. When C receives a query ID,Kpub,params from A2, if ID is already in Lh2, it sends h2i to A2. Otherwise, C executes CreateVehicleID to calculate h2i=h2IDKpubparams and then sends it to A2
h3iQuery. C maintains a list Lh3i=ID,params,∇,h3i. When C receives a query ID,params,∇fromA2, if Lh3i contains ID,params,∇,h3i, then C sends h3i to A2. Otherwise, C chooses a random number h3i∈Zq∗, calculates h3i=h3ID∇params, sends h3i to A2, and inserts ID,params,∇,h3i into Lh3i
h4iQuery. C maintains a list Lh4i=ID,Mi,vpki,Ri,∇,ti,h4i. When A2 makes a query on ID, and if ID is in Lh4i, then C sends h4i to A2. Otherwise, C selects a random number h4i∈Zq∗, calculates h4i=h4MiIDvpkiRi∇ti, sends h4i to A2, and inserts ID,Mi,vpki,Ri,∇,ti,h4i into Lh4i.
PartialPrivateKeyID. When C receives a partial private key query from A2 for ID, C checks whether ID is already in Lu or not. If ID is in Lu, C sends ppki to A2. Otherwise, C runs CreateVehicleID to obtain ppki and sends it to A2.
PublicKeyID. When C receives a public key query from A2 for ID, C checks whether ID exists in Lu or not. If it exists, C sends PKi=Ui,vpki to A2. Otherwise, C executes CreateVehicleID to obtain the tuple Ui,vpki and sends it to A2
SecretKeyID. When C receives a private key query from A2 for ID, if ID≠IDτ, C checks whether Lu contains ID or not. If ID is in Lu, C sends vski to A2. Otherwise, C executes CreateVehicleID to obtain vski and sends it to A2. In addition, if ID=IDτ, C stops the game.
SignID,Mi. When A2 makes a signature query with ID,Mi, C performs the following steps:
(1)
IfID is in Lpk, C picks three random numbers x,y,z∈Zq∗ such that Si=x, h4i=h4MiIDvpkiRi∇ti⟵xmodq and Ri=x·P+yKpub−xvpki, then inserts ID,Mi,vpki,Ri,∇,ti,h4i to Lh4i, and finally sends the signature σi=Ri,Si to A2(2)
IfID is not in Lpk, because C knows the private key of the vehicle with ID, C acts like the procedure of the scheme
Forgery. In the end, A2 outputs a forged but valid certificateless aggregate signature σ=R,S on the tuple ID,Mi which passes the signature verification phase. If ID≠IDτ, C fails and stops
According to the forking lemma [35], A2 can obtain another valid signature σ∗=R∗,S∗ by simulating the game again with the same random tape but different choice of h4i in polynomial time. We can get t according to the following equation; that is, C successfully solves the ECDLP. Then, we have
(13)S⋅P=R+C+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4ivpki+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4i⋅t⋅P+∑i=1nvih4ih2i⋅Kpub,S∗⋅P=R+C∗+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4i∗Ci+∑i=1nvih4ih2i⋅Kpub=R+∑i=1nvih4i∗⋅t⋅P+∑i=1nvih4ih2i⋅Kpub.
From these two equations, we can derive the valuet by
(14)S−S∗⋅P=R+∑i=1nvih4i⋅t⋅P+∑i=1nvih4ih2i⋅Kpub−R+∑i=1nvih4i∗⋅t⋅P+∑i=1nvih4ih2i⋅Kpub⇒S−S∗⋅P=vih4i−h4i∗⋅t⋅P⇒S−S∗=vih4i−h4i∗⋅t⇒t=S−S∗vih4i−h4i∗.
Probabilistic Analysis. We analyse the advantages ofC successfully obtaining t from P,Q=t·P to solve the ECDLP
In the process of executingCreateVehicleID query, the random oracle assignment h4i=h4MiIDvpkiRi∇ti causes inconsistency, which happens with probability at most qh/q. Therefore, the probability of successful simulation of qc times is at least 1−qh/qqc≥1−qhqc/q. And, the probability of successful simulation qh times is at least 1−qh/qqh≥1−qh2/q. In addition, ID=IDτ has a probability of 1/qc. Therefore, the overall probability of successful simulation is PrSuccA2≥1−qhqc/q1−qh2/q1/qcε. It should be noted here that the time complexity t+Oqc+qsS of C is determined by the exponentiations executed in the CreateVehicleID and SignID,Mi queries, where S is the time of a scalar multiplication operation.
C can successfully obtain t from P,Q=t·P with an advantage 1−qhqc/q1−qh2/q1/qcε, where the time complexity of algorithm is t+Oqc+qsS, which contradicts ECDLP assumption. Therefore, the proposed scheme can resist the forgery attack of type 2 adversary A2 under the ROM.


## 5.3. Security Analysis

Section3.6 has given the security and privacy requirements that 5G-enabled vehicular networks. In this section, we analyse the proposed CLAS scheme to meet the above security requirements according to Theorems 1 and 2.
(i)
Message integrity and authentication: according to Theorems1 and 2, it is known that any polynomial adversary has no ability to forge a valid message. When a message msg is received from a vehicle, RSUs check the validity and integrity of the message by verifying the equation Si·P=Ri+h4ivpki+h2iKpub to prevent the message from being tampered with and forged by malicious vehicles. As a result, no malicious adversary can construct h2i=h2PIDiKpubparams and h4i=h4MiPIDivpkiRi∇ti to forge a signature σi=Ri,Si. Therefore, our proposed scheme meets the security requirements for message integrity and authentication(ii)
Privacy preserving: in 5G-enabled vehicular networks, each vehicle adopts pseudonym technology to hide its real identityRIDi to communicate, and the pseudo identity of any vehicle involves the TRA’s master private key s and a random number. If an attacker wants to know the real identity of a vehicle, it can only do so through a pseudo identity. However, when given Tpub, PIDi,1=ξi·P, it is hard to calculate ξi·P·Tpub. Besides, TRA keeps the master private key s. Therefore, our proposed scheme can meet the requirements of privacy preserving(iii)
Traceability and revocability: in our scheme, TRA can trace the identity of malicious vehicle by getting its real identityRIDi. And only TRA can extract the real identity RIDi from PIDi by its master private key through the equation RIDi=Ai⊕h1ξi·PIDi,1Tpub·ξi·Tpub. When a malicious action takes place, TRA can effectively trace and revoke the malicious vehicle and insert relevant information of the malicious vehicle into RPID-Cuckoo filter for revocation. Therefore, our proposed scheme can meet the requirements of traceability and revocability(i)
Unlinkability: in our scheme, a different pseudo identity is used for each message sent by the vehicle, and the corresponding private key is used to sign the message, in which the numberξi in the pseudo identity is random. Moreover, there is no relationship between the new pseudo identity and the old pseudo identity for each vehicle. Therefore, the attacker cannot link two messages to the same vehicle, so our scheme meets the requirement of unlinkability(ii)
Resistance to replay attacks: in our scheme, the timestampti is used to resist replay attacks. After receiving the message and signature, the receiver checks the freshness of the timestamp and whether the validity of the pseudo identity has expired. If the valid time is exceeded, the message is discarded. Therefore, our scheme is resistant to replay attacks(iii)
Resistance to modification attack: if the attacker modifies the message and sends it to others, the verifier can easily determine the message has been modified by verifying equationSi·P=Ri+h4ivpki+h2iKpub. Therefore, our scheme is resistant to modification attacks(iv)
Resistance to impersonation attack: according to Theorems1 and 2, it is proved that our scheme is existentially unforgeable against an adaptive chosen message attack under the ROM. The adversary has not the ability to launch an impersonation attack by forging a valid signature. It is easy to determine if there is an impersonation attack by verifying the equationSi·P=Ri+h4ivpki+h2iKpub. Therefore, our scheme is resistant to impersonation attacks(v)
Resistance to information injection attack: in our scheme, the value of equationS·P=R+C+∑i=1nvih4ih2iKpub can be changed by using a random vector v in the aggregation verification phase. Therefore, our scheme is resistant to information injection attacks


## 6. Performance Analysis

In this section, we compare our proposed scheme with some schemes proposed [11, 15, 16, 29, 36–38] in order to evaluate its performance from the perspective of computational overhead and communication overhead.


### 6.1. Computational Overhead Analysis

We adopt the same evaluation method as He et al. [10] to analyse the computational overhead of the proposed scheme. The basic configuration is 3.40GHz clock frequency, 4GB of running memory, an Intel i7-4770 processor, and MIRACL library running on the Windows 7 operating system. The MIRACL library is a well-known cryptographic library. The bilinear pairing on the security level of 80 bits is constructed as ⅇ¯:G1×G2⟶G2, where G1 is an additive group of order q^ defined on a super-singular elliptic curve E¯:y2=x3modp^ with embedding degree of 2. Here, we consider p^ as a 512-bit prime number and q^ as a 160-bit solinas prime number. The ECC on the security level of 80 bits is created on the nonsingular elliptic curve E:y2=x3+ax+bmodp as follows: G is an additive group of order q, where p,q are 160-bit primes and a,b∈zp∗. The execution time of the basic cryptographic operations in the scheme is shown in Table 3.Table 3
Execution time of cryptographic operations.
NotationsDescriptionRun time (ms)Tpa_bpBilinear pairing point addition0.0071Tsm_bpBilinear pairing scalar multiplication1.7090TbpBilinear pairing4.2110Tsm_eccElliptic curve scalar multiplication0.4420TmtpMap to point hash function4.4060Tpa_eccElliptic curve point addition0.0018ThOne-way hash function0.0001We compare the computational overhead of our scheme with these schemes [11, 15, 16, 29, 36–38] in three phases: individual signature generation phase, individual signature verification phase, and aggregate signature verification phase. These schemes [15, 16, 29, 37] are based on bilinear pair construction, and these schemes [11, 36, 38] and our scheme are constructed using ECC. Since the general one-way hash operation Th only incurs very little overhead in the signing and verification process, we no longer count the running time of this operation. The specific analysis of the computation overhead is shown in Table 4.Table 4
Analysis of the computation overhead for related schemes.
SchemeSignVerifyn signature verifyWithout pairingSignature scheme supportsAli et al. [16]Tsm_bp=1.709msTsm_bp+Tpa_bp+Tbp=5.9271msnTsm_bp+nTpa_bp+Tbp=1.7161n+4.211msNoBatch and aggregationRen et al.[15]2Tsm_bp=3.418msTpa_bp+2Tbp=8.4291msnTpa_bp+2Tbp=0.0071n+8.422msNoBatch and aggregationZhong et al.[29]Tmtp+2Tpa_bp+4Tsm_bp=11.2562 ms2Tmtp+2Tsm_bp+Tpa_bp+3Tbp=24.8701msnTmtp+2nTsm_bp+2n−1Tpa_bp+3Tbp=7.8382n+12.6259msNoAggregationXu et al.[37]Tmtp+Tpa_bp+3Tsm_bp=9.5401ms2Tmtp+2Tsm_bp+Tpa_bp+3Tbp=24.8701msn+1Tmtp+2nTsm_bp+3n−2Tpa_bp+3Tbp=7.8453n+17.0248msNoAggregationGayathri et al.[36]2Tsm_ecc=0.884ms5Tsm_ecc+3Tpa_ecc=2.2154msn+2Tsm_ecc+2nTpa_ecc=0.4456n+0.884msYesAggregationGayathri et al.[11]2Tsm_ecc=0.884ms5Tsm_ecc+3Tpa_ecc=2.2154ms5nTsm_ecc+5n−2Tpa_ecc=2.219n−0.0036msYesBatch verificationMing and Cheng [38]3Tsm_ecc=1.326ms4Tsm_ecc+3Tpa_ecc=1.7734ms2n+1Tsm_ecc+3nTpa_ecc=0.8897n+0.884msYesBatch verificationThe proposed schemeTsm_ecc=0.442ms3Tsm_ecc+2Tpa_ecc=1.3296ms2Tsm_ecc+2Tpa_ecc=0.8876msYesAggregationThe computation overhead of the individual signature generation phase and individual signature verification phase are shown in Figure5. It is seen that a signature needs to consist of bilinear pairing based four scalar multiplications and two scalar point additions. It also needs a map to point hash function operation in Zhong et al.’s scheme [29]. Therefore, the computational cost of the signature generation phase of the scheme is Tmtp+2Tpa_bp+4Tsm_bp=11.2562 ms. In the signature verification phase, operations performed include three bilinear pairing operations, two scalar multiplication operations based on bilinear pairing, one scalar point addition operation based bilinear pairing, and two map to point hash operations. Thus, the computation cost is 2Tmtp+2Tsm_bp+Tpa_bp+3Tbp=24.8701ms. The aggregate signature verification phase of Zhong et al.’s [29] scheme requires three bilinear pairing operations, 2n scalar multiplication operations based on bilinear pairing, 2n−1 scalar point addition operations based on bilinear pairing and n map to point hash operations, where n is the number of sensing information transmitted by the sender within a period of time. In this phase, the computation cost is nTmtp+2nTsm_bp+2n−1Tpa_bp+3Tbp=7.8382n+12.6259ms.Figure 5
Computation overhead of the individual signature generation and individual signature verification.In the proposed scheme, the signature generation phase requires one scalar multiplication operation based ECC and one scalar point addition operation based ECC, whose computational cost isTsm_ecc=0.442ms in this phase. In the signature verification phase, operations performed include three scalar multiplication operations based ECC and two scalar point addition operations based ECC. The computational cost in this phase is 3Tsm_ecc+2Tpa_ecc=1.3296ms. In the aggregate signature verification phase, operations performed include two scalar multiplication operations based ECC and two scalar point addition operations based ECC. In the aggregate signature verification phase of this scheme, the computation cost is 2Tsm_ecc+2Tpa_ecc=0.8876ms.Computational cost in these schemes [11, 15, 16, 36–38] can be analysed by using similar analysis methods described. The aggregate verification time relating to the number of signatures is given as Figure 6. It can be observed that the schemes of Ren et al. [15], Ali et al. [16], and Gayathri et al. [37] adopted scalar multiplication operation and scalar point addition operation-based bilinear pairing and map to point hash operations. It is well known that bilinear pairing operations are time-consuming. In addition, despite the application of ECC, the schemes of Gayathri et al. [11, 36] and Ming and Cheng [38] failed to outperform the proposed scheme. For example, in the n signature verification phase of the schemes in [11, 36, 38], the computation cost requires 5nTsm_ecc+5n−2Tpa_ecc=2.219n−0.0036ms, n+2Tsm_ecc+2nTpa_ecc=0.4456n+0.884ms, and 2n+1Tsm_ecc+3nTpa_ecc=0.8897n+0.884ms, respectively. However, the proposed scheme only needs 2Tsm_ecc+Tpa_ecc=0.8858ms to verify n signatures. Compared with the scheme of Zhong et al. [29], the performance efficiency of the proposed scheme is about 11.2562−0.442/11.2562×100%≈96.07% and 24.8701−1.3296/24.8701×100%≈94.65%, respectively. Similarly, compared with the scheme of Xu et al. [37], the proposed scheme improves signature generation and signature verification by approximately 95.36% and 94.65%. Our scheme improves signature generation and signature verification by approximately 87.06% and 84.22% over Ren et al.’s [15] scheme. Compared with Ali et al.’s [16] scheme, our scheme improves signature generation and signature verification by about 74.13% and 77.56%. Our scheme improves signature generation and signature verification by approximately 66.67% and 24.80% over Ming et al.’s [38] scheme. Compared with Gayathri et al.’s [11, 36] scheme, our scheme improves signature generation and signature verification by about 50% and 40%. In addition, with respect to total computation overhead, the proposed scheme increases performances by 98.55%,87.32%,94.52%,98.81%, and 97.13%, respectively, compared to the CLAS schemes [11, 15, 16, 36, 38]. It can be observed from the above results that the proposed scheme outperforms other related works. The comparison in percentage is shown in Table 5.Figure 6
Aggregate verification time versus number of signatures.Table 5
Comparison in percentage.
SchemeSignVerifyAli et al. [16]74.13%77.56%Ren et al. [15]87.06%84.22%Zhong et al. [29]96.07%94.65%Xu et al. [37]95.36%94.65%Gayathri et al. [36]50%39.39%Gayathri et al. [11]50%39.39%Ming and Cheng [38]66.67%24.80%


### 6.2. Communication Overhead Analysis

Driven by 5G, the IoVs need to support the interconnection between smart devices and systems. It will provide access to users everywhere at any time and bring high-intensity data transmission pressure to vehicular networks. Therefore, it is crucial to reduce communication overhead. For fairness, we use the variables in Table6 to simulate the equivalent security levels of the schemes. On the 80-bit security level, let the sizes of the elements in G and G1 be 40 bytes and 128 bytes, where G and G1 are an additive group on a nonsingular elliptic curve and an additive group on a super singular curve, respectively. The signature sizes of the schemes [15, 29, 36, 37] are compared with that of the proposed scheme as shown in Table 7. The aggregate signature generated by the proposed scheme consists of one Zq∗ element and one G element based on elliptic curve; therefore, it only takes 100 bytes to send the aggregate signature. It should be noted that the size of the aggregate signature bears no relation with the number of messages in the scheme of Ren et al. [15], Zhong et al. [29], Gayathri et al. [36], and our scheme. Although these schemes have lower communication cost, the length of Ali et al.’s scheme [16] and Zhong et al.’s scheme [29] are 128 bytes and 256 bytes, respectively, which far exceeds communication cost required by our scheme to send an aggregate signature. Due to the proposed scheme has lower transmission cost than other schemes, it can meet the low delay requirements for 5G-enabled vehicular networks.Table 6
Variables used for communication overhead analysis.
SymbolDescriptionLength(bytes)G1ThesizeofelementsingroupG1128bytesGThesizeofelementsingroupG40bytesqThesizeoftheelementsinZq∗20bytesTable 7
Communication overhead comparison.
SchemeSingle signatureAggregate signatureAli et al. [16]G1=128bytesG1=128bytesZhong et al. [29]2G1=256bytes2G1=256bytesXu et al. [37]2G1=256bytesn+1G1=128n+128bytesOur schemeG+Zq∗=60bytes2G+Zq∗=100bytes


## 6.1. Computational Overhead Analysis

We adopt the same evaluation method as He et al. [10] to analyse the computational overhead of the proposed scheme. The basic configuration is 3.40GHz clock frequency, 4GB of running memory, an Intel i7-4770 processor, and MIRACL library running on the Windows 7 operating system. The MIRACL library is a well-known cryptographic library. The bilinear pairing on the security level of 80 bits is constructed as ⅇ¯:G1×G2⟶G2, where G1 is an additive group of order q^ defined on a super-singular elliptic curve E¯:y2=x3modp^ with embedding degree of 2. Here, we consider p^ as a 512-bit prime number and q^ as a 160-bit solinas prime number. The ECC on the security level of 80 bits is created on the nonsingular elliptic curve E:y2=x3+ax+bmodp as follows: G is an additive group of order q, where p,q are 160-bit primes and a,b∈zp∗. The execution time of the basic cryptographic operations in the scheme is shown in Table 3.Table 3
Execution time of cryptographic operations.
NotationsDescriptionRun time (ms)Tpa_bpBilinear pairing point addition0.0071Tsm_bpBilinear pairing scalar multiplication1.7090TbpBilinear pairing4.2110Tsm_eccElliptic curve scalar multiplication0.4420TmtpMap to point hash function4.4060Tpa_eccElliptic curve point addition0.0018ThOne-way hash function0.0001We compare the computational overhead of our scheme with these schemes [11, 15, 16, 29, 36–38] in three phases: individual signature generation phase, individual signature verification phase, and aggregate signature verification phase. These schemes [15, 16, 29, 37] are based on bilinear pair construction, and these schemes [11, 36, 38] and our scheme are constructed using ECC. Since the general one-way hash operation Th only incurs very little overhead in the signing and verification process, we no longer count the running time of this operation. The specific analysis of the computation overhead is shown in Table 4.Table 4
Analysis of the computation overhead for related schemes.
SchemeSignVerifyn signature verifyWithout pairingSignature scheme supportsAli et al. [16]Tsm_bp=1.709msTsm_bp+Tpa_bp+Tbp=5.9271msnTsm_bp+nTpa_bp+Tbp=1.7161n+4.211msNoBatch and aggregationRen et al.[15]2Tsm_bp=3.418msTpa_bp+2Tbp=8.4291msnTpa_bp+2Tbp=0.0071n+8.422msNoBatch and aggregationZhong et al.[29]Tmtp+2Tpa_bp+4Tsm_bp=11.2562 ms2Tmtp+2Tsm_bp+Tpa_bp+3Tbp=24.8701msnTmtp+2nTsm_bp+2n−1Tpa_bp+3Tbp=7.8382n+12.6259msNoAggregationXu et al.[37]Tmtp+Tpa_bp+3Tsm_bp=9.5401ms2Tmtp+2Tsm_bp+Tpa_bp+3Tbp=24.8701msn+1Tmtp+2nTsm_bp+3n−2Tpa_bp+3Tbp=7.8453n+17.0248msNoAggregationGayathri et al.[36]2Tsm_ecc=0.884ms5Tsm_ecc+3Tpa_ecc=2.2154msn+2Tsm_ecc+2nTpa_ecc=0.4456n+0.884msYesAggregationGayathri et al.[11]2Tsm_ecc=0.884ms5Tsm_ecc+3Tpa_ecc=2.2154ms5nTsm_ecc+5n−2Tpa_ecc=2.219n−0.0036msYesBatch verificationMing and Cheng [38]3Tsm_ecc=1.326ms4Tsm_ecc+3Tpa_ecc=1.7734ms2n+1Tsm_ecc+3nTpa_ecc=0.8897n+0.884msYesBatch verificationThe proposed schemeTsm_ecc=0.442ms3Tsm_ecc+2Tpa_ecc=1.3296ms2Tsm_ecc+2Tpa_ecc=0.8876msYesAggregationThe computation overhead of the individual signature generation phase and individual signature verification phase are shown in Figure5. It is seen that a signature needs to consist of bilinear pairing based four scalar multiplications and two scalar point additions. It also needs a map to point hash function operation in Zhong et al.’s scheme [29]. Therefore, the computational cost of the signature generation phase of the scheme is Tmtp+2Tpa_bp+4Tsm_bp=11.2562 ms. In the signature verification phase, operations performed include three bilinear pairing operations, two scalar multiplication operations based on bilinear pairing, one scalar point addition operation based bilinear pairing, and two map to point hash operations. Thus, the computation cost is 2Tmtp+2Tsm_bp+Tpa_bp+3Tbp=24.8701ms. The aggregate signature verification phase of Zhong et al.’s [29] scheme requires three bilinear pairing operations, 2n scalar multiplication operations based on bilinear pairing, 2n−1 scalar point addition operations based on bilinear pairing and n map to point hash operations, where n is the number of sensing information transmitted by the sender within a period of time. In this phase, the computation cost is nTmtp+2nTsm_bp+2n−1Tpa_bp+3Tbp=7.8382n+12.6259ms.Figure 5
Computation overhead of the individual signature generation and individual signature verification.In the proposed scheme, the signature generation phase requires one scalar multiplication operation based ECC and one scalar point addition operation based ECC, whose computational cost isTsm_ecc=0.442ms in this phase. In the signature verification phase, operations performed include three scalar multiplication operations based ECC and two scalar point addition operations based ECC. The computational cost in this phase is 3Tsm_ecc+2Tpa_ecc=1.3296ms. In the aggregate signature verification phase, operations performed include two scalar multiplication operations based ECC and two scalar point addition operations based ECC. In the aggregate signature verification phase of this scheme, the computation cost is 2Tsm_ecc+2Tpa_ecc=0.8876ms.Computational cost in these schemes [11, 15, 16, 36–38] can be analysed by using similar analysis methods described. The aggregate verification time relating to the number of signatures is given as Figure 6. It can be observed that the schemes of Ren et al. [15], Ali et al. [16], and Gayathri et al. [37] adopted scalar multiplication operation and scalar point addition operation-based bilinear pairing and map to point hash operations. It is well known that bilinear pairing operations are time-consuming. In addition, despite the application of ECC, the schemes of Gayathri et al. [11, 36] and Ming and Cheng [38] failed to outperform the proposed scheme. For example, in the n signature verification phase of the schemes in [11, 36, 38], the computation cost requires 5nTsm_ecc+5n−2Tpa_ecc=2.219n−0.0036ms, n+2Tsm_ecc+2nTpa_ecc=0.4456n+0.884ms, and 2n+1Tsm_ecc+3nTpa_ecc=0.8897n+0.884ms, respectively. However, the proposed scheme only needs 2Tsm_ecc+Tpa_ecc=0.8858ms to verify n signatures. Compared with the scheme of Zhong et al. [29], the performance efficiency of the proposed scheme is about 11.2562−0.442/11.2562×100%≈96.07% and 24.8701−1.3296/24.8701×100%≈94.65%, respectively. Similarly, compared with the scheme of Xu et al. [37], the proposed scheme improves signature generation and signature verification by approximately 95.36% and 94.65%. Our scheme improves signature generation and signature verification by approximately 87.06% and 84.22% over Ren et al.’s [15] scheme. Compared with Ali et al.’s [16] scheme, our scheme improves signature generation and signature verification by about 74.13% and 77.56%. Our scheme improves signature generation and signature verification by approximately 66.67% and 24.80% over Ming et al.’s [38] scheme. Compared with Gayathri et al.’s [11, 36] scheme, our scheme improves signature generation and signature verification by about 50% and 40%. In addition, with respect to total computation overhead, the proposed scheme increases performances by 98.55%,87.32%,94.52%,98.81%, and 97.13%, respectively, compared to the CLAS schemes [11, 15, 16, 36, 38]. It can be observed from the above results that the proposed scheme outperforms other related works. The comparison in percentage is shown in Table 5.Figure 6
Aggregate verification time versus number of signatures.Table 5
Comparison in percentage.
SchemeSignVerifyAli et al. [16]74.13%77.56%Ren et al. [15]87.06%84.22%Zhong et al. [29]96.07%94.65%Xu et al. [37]95.36%94.65%Gayathri et al. [36]50%39.39%Gayathri et al. [11]50%39.39%Ming and Cheng [38]66.67%24.80%


## 6.2. Communication Overhead Analysis

Driven by 5G, the IoVs need to support the interconnection between smart devices and systems. It will provide access to users everywhere at any time and bring high-intensity data transmission pressure to vehicular networks. Therefore, it is crucial to reduce communication overhead. For fairness, we use the variables in Table6 to simulate the equivalent security levels of the schemes. On the 80-bit security level, let the sizes of the elements in G and G1 be 40 bytes and 128 bytes, where G and G1 are an additive group on a nonsingular elliptic curve and an additive group on a super singular curve, respectively. The signature sizes of the schemes [15, 29, 36, 37] are compared with that of the proposed scheme as shown in Table 7. The aggregate signature generated by the proposed scheme consists of one Zq∗ element and one G element based on elliptic curve; therefore, it only takes 100 bytes to send the aggregate signature. It should be noted that the size of the aggregate signature bears no relation with the number of messages in the scheme of Ren et al. [15], Zhong et al. [29], Gayathri et al. [36], and our scheme. Although these schemes have lower communication cost, the length of Ali et al.’s scheme [16] and Zhong et al.’s scheme [29] are 128 bytes and 256 bytes, respectively, which far exceeds communication cost required by our scheme to send an aggregate signature. Due to the proposed scheme has lower transmission cost than other schemes, it can meet the low delay requirements for 5G-enabled vehicular networks.Table 6
Variables used for communication overhead analysis.
SymbolDescriptionLength(bytes)G1ThesizeofelementsingroupG1128bytesGThesizeofelementsingroupG40bytesqThesizeoftheelementsinZq∗20bytesTable 7
Communication overhead comparison.
SchemeSingle signatureAggregate signatureAli et al. [16]G1=128bytesG1=128bytesZhong et al. [29]2G1=256bytes2G1=256bytesXu et al. [37]2G1=256bytesn+1G1=128n+128bytesOur schemeG+Zq∗=60bytes2G+Zq∗=100bytes


## 7. Conclusion

This paper proposes a lightweight CLAS scheme with revocation mechanism for 5G-enabled vehicular networks. The proposed scheme uses binary search to identify invalid signatures and introduces a cuckoo filter to revoke malicious users to prevent reattack. The security analysis shows that the proposed scheme is secure under ROM and meets all security and privacy requirements. Moreover, our CLAS scheme uses ECC to construct the specific algorithm, which does not need the computationally complex bilinear pairing operations and map to the point hash functions, thus improving the computational efficiency. Through experimental comparison with other related schemes, our CLAS scheme has significant advantages in computational overhead and communication overhead.



---

*Source: 3646960-2022-04-12.xml*