# An Efficient V2I Authentication Scheme for VANETs

Authors: Yousheng Zhou; Siling Liu; Min Xiao; Shaojiang Deng; Xiaojun Wang
Journal: Mobile Information Systems
 (2018)

---

## Abstract

The advent of intelligent transportation system has a crucial impact on the traffic safety and efficiency. To cope with security issues such as spoofing attack and forgery attack, many authentication schemes for vehicular ad hoc networks (VANETs) have been developed, which are based on the hypothesis that secret keys are kept perfectly secure. However, key exposure is inevitable on account of the openness of VANET environment. To address this problem, key insulation is introduced in our proposed scheme. With a helper device, vehicles could periodically update their own secret keys. In this way, the forward and backward secrecy has been achieved. In addition, the elliptic curve operations have been integrated to improve the performance. The random oracle model is adopted to prove the security of the proposed scheme, and the experiment has been conducted to demonstrate the comparison between our scheme and the existing similar schemes.


---

## Body

## 1. Introduction

Due to the growing demands for a safer and more efficient intelligent transportation system, the development of vehicular ad hoc networks (VANETs) has captured a large amount of attentions from research institutions and industries in recent years. VANETs are deemed to be a variant of the mobile ad hoc network, which is a type of continuously self-configuring, wirelessly connected, and infrastructure-less network of mobile devices [1].There are two indispensable infrastructure elements in VANETs: on-board units (OBUs), which are mounted in each vehicle, and roadside units (RSUs), which are used to communicate and to assist authentication [2]. In addition, a third trusted party (TA) should also be deployed in VANETs, which mainly provides services of registration and authentication.A common model of VANETs is exhibited in Figure1. Communication modes in VANETs could be sorted into two categories: vehicle-to-vehicle (V2V) communication and vehicle-to-infrastructure (V2I) communication. By employing the dedicated short range communication (DSRC) protocol [3], these dynamic nodes (vehicles) could broadcast and exchange traffic information via RSU and other nearby moving vehicles. Upon receiving those messages including location, speed, and traffic conditions, vehicles would take reasonable actions immediately such as rerouting and braking to avoid possible traffic emergency.Figure 1
A common model of VANETs.As we all know, the communication channels in VANETs are open, so an attacker could capture, modify, replay, and delete messages transmitted in VANETs easily, leading to a large number of security problems, which will have a strong impact on the whole system. Assume that an original message is actually a warning that there is a serious traffic jam ahead, if it is tampered to a different message which tells vehicles that the road is unblocked, a completely opposite result would be caused. Therefore, authentication between vehicle and infrastructure should be employed to guarantee the authenticity of the transmitted messages in this situation.Moreover, many devices of infrastructure such as RSU are unmanned, and the units installed on the vehicles which are used to run cryptographic algorithms are resource limited; thus, the risk of key exposure is unavoidable and should not be overlooked. In addition, in the majority of cases, it is much easier for an attacker to obtain a secret key from an insecure device than to get it by breaking cryptogrammic hypothesis which system’s security relies on. Once key exposure occurs, it means that security of the whole system loses. Taken into account efficiency, difficulties of construction, and security, key insulation is a desirable method to deal with the key exposure issue.However, the vast majority of security protocols for VANETs are established on bilinear pairing, which would inevitably cause heavy computation costs. In order to enhance the security and performance of VANET-oriented authentication schemes, a novel practical V2I authentication scheme for VANETs is proposed, which attempts to lower computation complexity and the risk of losing secret keys.To be specific, the main contributions of this paper represent as follows:(1)
Firstly, the key-insulated method is applied into V2I authentication for VANETs. In our proposed scheme, the user’s private key is divided into two portions: one is managed by a secure device called helper or assistant and the other is held by the user, and both of them are updated periodically.(2)
Secondly, ECC, instead of bilinear pairing, is utilized to construct the proposed scheme. As most of devices in VANETs are resource limited, the computation consumption of the adopted schemes should be minimized as much as possible. Operations based on ECC in our construction can save far less time and computation burden than bilinear pairing operations, which is expected to gain higher efficiency.(3)
Finally, the forward and backward secrecy is achieved. The secret key of OBU consists of two fractions in which private information is involved. The secret key must be generated with the helper’s participation, and it updates periodically so that malicious attackers cannot obtain the user’s private key in the previous periods or in the subsequent periods.The remainder of this paper proceeds as follows. Section2 reviews the related work about V2I authentication scheme for VANETs. Section 3 presents the related essential knowledge. Section 4 describes the construction of the proposed scheme in detail. The security analysis and performance evaluation are given in Sections 5 and 6, respectively. Finally, this paper is concluded.


## 2. Related Works

In recent years, efforts on authentication have been made to address the problems of verification and efficiency. The privacy-preserving scheme [4] introduced by Wang et al. employs membership validity to replace the certificate revocation list and batch verification to improve efficiency, which achieved nonreputation, anonymity, traceability, and forward and backward secrecy. Wang [5] developed a privacy-preserving and accountable authentication protocol for IoT end-devices by adopting short group signature and secret sharing scheme. Shen et al. [6] proposed a multilayer authentication protocol with session key generation for wireless body area networks which is used for one-to-many group authentication scenario. The scheme with group testing towards a secure batch verification was introduced by Lee and Lai [7]. Unfortunately, this scheme is vulnerable to the impersonation attack since a malicious user could generate a fake signature on behalf of other vehicle. Based on this defect, another secure authentication scheme was introduced by Bayat et al. [8] to improve it. Wang and Yao [9] proposed the LIAP scheme, in which the vehicle and RSU are assigned with a long-term certification from the certificate authority (CA). If the vehicle is compromised, CA could easily revoke the vehicle’s long-term certificate to terminate its behavior in the network. Jiang et al. [10] proposed an efficient anonymous batch authentication scheme to replace the CRL checking process by calculating the hash message authentication code, which divides the whole area into several domains. However, every vehicle has stored enough pseudonyms; if any of them is revoked, the rest pseudonyms are wasted. Azees et al. [11] proposed another anonymous scheme to avoid malicious nodes attending the activities in VANETs, which provides conditional tracking mechanism, low-cost certificate, and signature verification. Many secure schemes have achieved authentication by various means; however, most of them adopt bilinear pairing to realize their security characteristics. Actually, the bilinear pairing is not efficient for limited VANET devices on account of its vast computation costs. In view of this, pairing-free schemes have been put forward over the past years. For instance, Cui et al. [12] proposed a privacy-preserving scheme, using cuckoo filter and the binary search methods instead of map-to-point hash function and bilinear pairing operations to achieve high efficiency. Xie et al. [13] proposed an ECC-based authentication scheme to realize reliability and integrity of message. Lo and Tsai [14] proposed an efficient authentication scheme for V2I in vehicular sensor networks without bilinear pairing to improve performance, which achieves message integrity, traceability, and unlinkability. He et al. [15] proposed a new ID-based and elliptic curve-based authentication scheme, which withstands diverse types of attacks and yields better performance.To address the problem of key exposure, Dodis et al. presented the idea of key insulation and came up with the first key-insulated public key cryptosystem [16] and the first strong key-insulated signature scheme [17]. Following the pioneering works, great efforts have been devoted to the key-insulated signature (KIS) schemes [18–20]. The scheme proposed by Gonzlez-Deleito et al. [18] uses numerous power operations, which adopts multiple private keys and master keys to achieve security. Le et al. [19] utilized multiple certification authorities to shorten verification path and mitigated damage. Hanaoka et al. [20] used two helpers to update the secret key and to enhance the system security. Later, quantities of identity-based or attribution-based key insulation schemes have been proposed [21–27], which are all based on bilinear pairing with random key updating. Additionally, key insulation has been applied into various other research fields. Zhou et al. [28] proposed a certificateless key-insulated generalized signcryption scheme without bilinear pairing in the context of cloud, which is proved to be secure under the computational Diffie–Hellman (CDH) assumption and the elliptic curve discrete logarithm (EC-DL) assumption. Hong et al. [29] proposed a key-insulated attribute-based signature without pairings for wireless communications, which attempts to minimize the potential threat and to relieve the computational burden. Kun et al. [30] and Shi et al. [31] put key insulation into peer-to-peer (P2P) networks and electronic commerce environment, respectively. Moreover, key insulation was introduced into mobile ad hoc networks (MANETs) by V. Kumar and R. Kumar [32]. Park et al. [33] proposed the EA2P scheme and first used key insulation in VANET environment. Although EA2P provides anonymity, identity extraction, and traceability, it only isolates the public key certification, not the private key, which actually fails to achieve a practical sense of key insulation.


## 3. Preliminaries

In this part, some necessary knowledge including system model, KIS framework, the random oracle model, and discrete logarithm (DL) problem is introduced.


### 3.1. System Model

As shown in Figure2, the whole system model in this paper consists of three kinds of entities as follows:Figure 2
Model of VANET in this paper.PKG: Private key generator, which is deemed to be fully trusted, is responsible for producing keys including secrete keys as well as public keys.RSU: Roadside unit, the infrastructure of VANET. It is a kind of computing device located on the roadside, which uses DSRC protocol and provides connectivity support for passing vehicles [34].Vehicle: Each vehicle is equipped with an on-board unit (OBU) and a tamper-proof device (TPD). OBU is used to help vehicle communicate wirelessly with RSU. TPD acts as a helper which is physically secure but computationally limited, and its stored information can never be disclosed.There are mainly four procedures in our proposed schemes as shown in Figure2. Firstly, PKG preloads the related keys into TPD, produces, and publishes system parameters in initialization phase (Phase 1). Secondly, TPD helps the OBU to generate the vehicle’s temporary secret key in Phase 2. Then OBU generates the signature and sends it to RSU in Phase 3. Finally, RSU validates the signature in Phase 4.As illustrated in [15], the formalized definition of key-insulated signature (KIS) displays as follows:Definition 1 (key-insulated signature (KIS)). A 5-tuple of polynomial time algorithm Kgen,UpdD,UpdU,Sig,Ver makes up a key-insulated signature scheme as listed below:Kgen: the key generation algorithm, which falls into the initialized stage, takes a security parameter 1k and the total number of time periods N as input to return a public key PK, a master key SK∗, and an initial key SK0.UpdD: the key update algorithm for the device, which takes indices i,j for time periods (throughout, 1≤i,j≤N) and the master key SK∗ as input to return a partial secret SKi,j′ɛ.UpdU: the key update algorithm for the user, which takes indices i,j, a secret key SKi, and a partial secret key SKi,j′ as input to return the secret key SK∗ for the time period j.Sign: the signing algorithm, which takes an index i of a time period, a message M, and a secret key SKi as input. Then SignSKii,M returns a signature <i,s> constituting the time period i and a signature S.Verf: the verification algorithm, which takes the public key PK, a message M, and a pair <i,s> as input. Then VerfPKM,<i,s> returns a bit b, where b=1 means that the signature is accepted.IfVerfPKM,<i,s>=1, we say that <i,s> is a valid signature of M for the time period i.


### 3.2. Security Model

The random oracle model was first proposed by Bellare and Rogaway [35] to prove the security of cryptographic protocols, and it is quoted in our proof. Oracle is an external device (it is usually being treated as a theoretical black box) that could provide true outputs for any inputs. In the case of inputting x, running a random oracle could be thought to pick a hash function h⋅ at random and outputs hx. Besides, the relationship between the oracle’s output and input satisfies properties of function; namely, the same input corresponds to the same output. As a matter of fact, each output is selected from its output domain, and acquired inputs/outputs are completely independent of current inputs/outputs on account of randomness.Definition 2 (unforgeability). To prove the unforgeability, a game played between a challenger C and an adversary A is defined. Our scheme is unforgeable against the malicious OBU if the following condition is satisfied: for any probabilistic polynomial time (PPT) adversary A, the probability that A wins the following game is negligible. The adversary can adaptively issue a series of undermentioned queries in the game.Configuration‐oracle: this can be considered as an initialization stage. The challenger C generates the system secret key and public parameters. C conveys these public parameters to the adversary A.H1‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh1, and returns e to the adversary A.H2‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh2, and returns e to the adversary A.TSK‐oracle: upon receiving the query issued by the adversary A on the secret key SKi, the challenger C computes it, puts the tuple m,SKi into the list Lkey, and returns SKi to A.H3‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh3, and returns e to the adversary A.H4‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh4, and returns e to the adversary A.Signing‐oracle: the challenger C generates the message required by the adversary A and sends it to A.Verification: the adversary A inputs the signature Ui,σi,λi,Mi,Ti given by the challenger C, and the verification algorithm returns a bit b, where b=1 means that the signature is valid.After a polynomial number of queries, if the adversaryA can violate the unforgeability of the proposed scheme by generating a tuple Ui∗,σi∗,λi∗,Mi∗,Ti∗ on the condition that the verification phase outputs 1, then we say the adversary A wins the game.


### 3.3. Discrete Logarithm (DL) Problem

Provided with two stochastic pointsP, Q over an elliptic curve E, the DL problem is to compute a number x to meet the equation Q=x⋅P.


## 3.1. System Model

As shown in Figure2, the whole system model in this paper consists of three kinds of entities as follows:Figure 2
Model of VANET in this paper.PKG: Private key generator, which is deemed to be fully trusted, is responsible for producing keys including secrete keys as well as public keys.RSU: Roadside unit, the infrastructure of VANET. It is a kind of computing device located on the roadside, which uses DSRC protocol and provides connectivity support for passing vehicles [34].Vehicle: Each vehicle is equipped with an on-board unit (OBU) and a tamper-proof device (TPD). OBU is used to help vehicle communicate wirelessly with RSU. TPD acts as a helper which is physically secure but computationally limited, and its stored information can never be disclosed.There are mainly four procedures in our proposed schemes as shown in Figure2. Firstly, PKG preloads the related keys into TPD, produces, and publishes system parameters in initialization phase (Phase 1). Secondly, TPD helps the OBU to generate the vehicle’s temporary secret key in Phase 2. Then OBU generates the signature and sends it to RSU in Phase 3. Finally, RSU validates the signature in Phase 4.As illustrated in [15], the formalized definition of key-insulated signature (KIS) displays as follows:Definition 1 (key-insulated signature (KIS)). A 5-tuple of polynomial time algorithm Kgen,UpdD,UpdU,Sig,Ver makes up a key-insulated signature scheme as listed below:Kgen: the key generation algorithm, which falls into the initialized stage, takes a security parameter 1k and the total number of time periods N as input to return a public key PK, a master key SK∗, and an initial key SK0.UpdD: the key update algorithm for the device, which takes indices i,j for time periods (throughout, 1≤i,j≤N) and the master key SK∗ as input to return a partial secret SKi,j′ɛ.UpdU: the key update algorithm for the user, which takes indices i,j, a secret key SKi, and a partial secret key SKi,j′ as input to return the secret key SK∗ for the time period j.Sign: the signing algorithm, which takes an index i of a time period, a message M, and a secret key SKi as input. Then SignSKii,M returns a signature <i,s> constituting the time period i and a signature S.Verf: the verification algorithm, which takes the public key PK, a message M, and a pair <i,s> as input. Then VerfPKM,<i,s> returns a bit b, where b=1 means that the signature is accepted.IfVerfPKM,<i,s>=1, we say that <i,s> is a valid signature of M for the time period i.


## 3.2. Security Model

The random oracle model was first proposed by Bellare and Rogaway [35] to prove the security of cryptographic protocols, and it is quoted in our proof. Oracle is an external device (it is usually being treated as a theoretical black box) that could provide true outputs for any inputs. In the case of inputting x, running a random oracle could be thought to pick a hash function h⋅ at random and outputs hx. Besides, the relationship between the oracle’s output and input satisfies properties of function; namely, the same input corresponds to the same output. As a matter of fact, each output is selected from its output domain, and acquired inputs/outputs are completely independent of current inputs/outputs on account of randomness.Definition 2 (unforgeability). To prove the unforgeability, a game played between a challenger C and an adversary A is defined. Our scheme is unforgeable against the malicious OBU if the following condition is satisfied: for any probabilistic polynomial time (PPT) adversary A, the probability that A wins the following game is negligible. The adversary can adaptively issue a series of undermentioned queries in the game.Configuration‐oracle: this can be considered as an initialization stage. The challenger C generates the system secret key and public parameters. C conveys these public parameters to the adversary A.H1‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh1, and returns e to the adversary A.H2‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh2, and returns e to the adversary A.TSK‐oracle: upon receiving the query issued by the adversary A on the secret key SKi, the challenger C computes it, puts the tuple m,SKi into the list Lkey, and returns SKi to A.H3‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh3, and returns e to the adversary A.H4‐oracle: upon receiving the query issued by the adversary A with the message m, the challenger C picks a stochastic number e∈Zq, puts the tuple m,e into the list Lh4, and returns e to the adversary A.Signing‐oracle: the challenger C generates the message required by the adversary A and sends it to A.Verification: the adversary A inputs the signature Ui,σi,λi,Mi,Ti given by the challenger C, and the verification algorithm returns a bit b, where b=1 means that the signature is valid.After a polynomial number of queries, if the adversaryA can violate the unforgeability of the proposed scheme by generating a tuple Ui∗,σi∗,λi∗,Mi∗,Ti∗ on the condition that the verification phase outputs 1, then we say the adversary A wins the game.


## 3.3. Discrete Logarithm (DL) Problem

Provided with two stochastic pointsP, Q over an elliptic curve E, the DL problem is to compute a number x to meet the equation Q=x⋅P.


## 4. The Proposed V2I Authentication Scheme

The proposed scheme consists of four phases: system initialization, key generation, signing stage, and verification stage. In the first place, notations used are defined in Table1.Table 1
Definition of notations.
Notations
Definition
p
,
q
Two large prime numbers
E
p
a
,
b
An elliptic curve defined by the equationy2=x3+ax+bmodpa,b∈Fp
G
An additive group with the orderq, where G is constitutive of all points on E and the point at infinity O
P
A generator of the groupG
H
1
,
H
2
,
H
3
,
H
4
Four security functions, whereH1:0,1∗→Zq, H2:0,1∗→Zq, H3:0,1∗→Zq and H4:0,1∗→Zq
S
K
msk
The master secret key of system
P
K
pub
The public key of system
S
K
TPD
The secret key of assistant device (some papers also called it a base or a helper)
P
K
TPD
The public key of assistant device
S
K
rsu
The secret key of RSU
P
K
rsu
The public key of RSU
T
i
The time of the time periodi
I
D
obu
The identity of OBU
K
part
i
The partial key in time periodi which is generated by TPD offering assistance to key update of secret key of OBU
S
K
obu
i
The temporary secret key in time periodi of OBU
P
K
obu
i
The temporary public key in time periodi of OBU
σ
i
The signature of OBU
⊕
The exclusive disjunction operation
∥
The message concatenation operation


### 4.1. System Initialization

In this phase, every appliance in VANETs performs initialization.(1)
PKG generates fundamental system parameters including a group over the chosen elliptic curveEpa,b, a random number SKmsk∈Zq∗ as the system master key, and the system public key computed as follows:(1)PKpub=SKmsk⋅P.(2)
PKG selects a random numberSKTPD∈Zq∗ as the private key of the helper (TPD) and calculates its corresponding public key(2)PKTPD=SKTPD⋅P.All these four parameters should be preloaded into TPD.(3)
RSU selects a random numberSKrsu∈Zq∗ as its private key and computes the corresponding public key(3)PKrsu=SKrsu⋅P.(4)
PKG publishes the public parameter set:(4)param=a,b,p,q,P,PKpub,PKTPD,PKrsu,H1,H2,H3,H4.In this paper, we assume that the OBU’s public key and its TPD public key have been preloaded.


### 4.2. Key Generation

#### 4.2.1. Initial Key Generation

Set the parameterαi corresponding to the time period i as αi=H2H1IDobuSKTPD⋅PKrsuTi. Note that it is default for TPD to keep its OBU’s identity. TPD computes α0=H2H1IDobuSKTPD⋅PKrsuT0 and the initial private key of the OBU as(5)SKobu0=SKmsk⋅H1IDobu+SKTPD⋅α0,which is preloaded into the OBU.


#### 4.2.2. Partial Key Generation

TPD calculates(6)Kparti=SKTPD⋅αi−αi−1,as the partial key corresponding to the time period i, and sends it to the OBU to assist in generating the temporary secret key.


#### 4.2.3. Temporary Secret Key Generation

OBU calculates its own temporary secret key in the time periodi(7)SKobui=SKobui−1+Kparti,as soon as it receivesKparti from the TPD.The temporary public key in the time periodi of OBU is set as(8)PKobui=SKobui⋅P,and it is published by the OBU, while the partial key Kparti and the initial key SKobui−1 are removed after key updating.


### 4.3. Signing Stage

An OBU can generate the signature on messageMi in the time period i as follows.Step 1. Selects the random number ui∈Zq∗ to compute.(9)Ui=ui⋅P.Step 2. Uses the identity IDobu, the temporary secret key in the time period i SKobui, the public key of RSU PKrsu, the corresponding time stamp Ti, and hash functions to compute(10)ωi=H1IDobu⊕H3SKobui⋅PKrsu,(11)ηi=H2.H1IDobuSKobui⋅PKrsuTi.Step 3. Selects another random number λi∈Zq∗ and uses the identity and ηi to compute(12)θi=ηi+λi⋅H1IDobu.Step 4. Concatenates the hash value of identity H1IDobu, λi, Ui, the message about traffic status Mi and current time stamp Ti to compute(13)βi=H4H1IDobuλiUiMiTi.Step 5. Uses the two random numbers ui and λi, βi, and the temporary secret key SKobui to compute(14)σi=λi⋅SKobui+βi⋅uimodp.Step 6. Sends the message Ui,σi,ωi,θi,Mi,Ti to the regional RSU.


### 4.4. Verification Stage

Upon receiving the signature, RSU proceeds the following steps to verify it.Step 1. Examines the freshness of Ti. If it is fresh, goes to step 2; otherwise, the signature is rejected.Step 2. Uses own secret key SKrsu, the private key in the time period i of the vehicle PKobui and ωi to count the hash value of identity of the vehicle:(15)H1IDobu=ωi⊕H3SKrsu⋅PKobui.Step 3. Uses the hash value of IDobu, its own secret key SKrsu, the private key of the vehicle, the private key of TPD, and current time stamp Ti to evaluate(16)αi=H2H1IDobuSKrsu⋅PKTPDTi,(17)ηi=H2H1IDobuSKrsu⋅PKobuiTi.Step 4. Uses the hash value of IDobu, θi, and ηi to evaluate(18)λi=θi−ηiH1IDobu.Step 5. Concatenates the hash value of IDobu, λi, Ui, the message about traffic status Mi, and current time stamp Ti to evaluate(19)βi=H4H1IDobuλiUiMiTi.Step 6. Checks whether the equation(20)σi⋅P=H1IDobu⋅PKpub+PKTPD⋅αi⋅λi+Ui⋅βiholds. If it holds, the signature is valid.


## 4.1. System Initialization

In this phase, every appliance in VANETs performs initialization.(1)
PKG generates fundamental system parameters including a group over the chosen elliptic curveEpa,b, a random number SKmsk∈Zq∗ as the system master key, and the system public key computed as follows:(1)PKpub=SKmsk⋅P.(2)
PKG selects a random numberSKTPD∈Zq∗ as the private key of the helper (TPD) and calculates its corresponding public key(2)PKTPD=SKTPD⋅P.All these four parameters should be preloaded into TPD.(3)
RSU selects a random numberSKrsu∈Zq∗ as its private key and computes the corresponding public key(3)PKrsu=SKrsu⋅P.(4)
PKG publishes the public parameter set:(4)param=a,b,p,q,P,PKpub,PKTPD,PKrsu,H1,H2,H3,H4.In this paper, we assume that the OBU’s public key and its TPD public key have been preloaded.


## 4.2. Key Generation

### 4.2.1. Initial Key Generation

Set the parameterαi corresponding to the time period i as αi=H2H1IDobuSKTPD⋅PKrsuTi. Note that it is default for TPD to keep its OBU’s identity. TPD computes α0=H2H1IDobuSKTPD⋅PKrsuT0 and the initial private key of the OBU as(5)SKobu0=SKmsk⋅H1IDobu+SKTPD⋅α0,which is preloaded into the OBU.


### 4.2.2. Partial Key Generation

TPD calculates(6)Kparti=SKTPD⋅αi−αi−1,as the partial key corresponding to the time period i, and sends it to the OBU to assist in generating the temporary secret key.


### 4.2.3. Temporary Secret Key Generation

OBU calculates its own temporary secret key in the time periodi(7)SKobui=SKobui−1+Kparti,as soon as it receivesKparti from the TPD.The temporary public key in the time periodi of OBU is set as(8)PKobui=SKobui⋅P,and it is published by the OBU, while the partial key Kparti and the initial key SKobui−1 are removed after key updating.


## 4.2.1. Initial Key Generation

Set the parameterαi corresponding to the time period i as αi=H2H1IDobuSKTPD⋅PKrsuTi. Note that it is default for TPD to keep its OBU’s identity. TPD computes α0=H2H1IDobuSKTPD⋅PKrsuT0 and the initial private key of the OBU as(5)SKobu0=SKmsk⋅H1IDobu+SKTPD⋅α0,which is preloaded into the OBU.


## 4.2.2. Partial Key Generation

TPD calculates(6)Kparti=SKTPD⋅αi−αi−1,as the partial key corresponding to the time period i, and sends it to the OBU to assist in generating the temporary secret key.


## 4.2.3. Temporary Secret Key Generation

OBU calculates its own temporary secret key in the time periodi(7)SKobui=SKobui−1+Kparti,as soon as it receivesKparti from the TPD.The temporary public key in the time periodi of OBU is set as(8)PKobui=SKobui⋅P,and it is published by the OBU, while the partial key Kparti and the initial key SKobui−1 are removed after key updating.


## 4.3. Signing Stage

An OBU can generate the signature on messageMi in the time period i as follows.Step 1. Selects the random number ui∈Zq∗ to compute.(9)Ui=ui⋅P.Step 2. Uses the identity IDobu, the temporary secret key in the time period i SKobui, the public key of RSU PKrsu, the corresponding time stamp Ti, and hash functions to compute(10)ωi=H1IDobu⊕H3SKobui⋅PKrsu,(11)ηi=H2.H1IDobuSKobui⋅PKrsuTi.Step 3. Selects another random number λi∈Zq∗ and uses the identity and ηi to compute(12)θi=ηi+λi⋅H1IDobu.Step 4. Concatenates the hash value of identity H1IDobu, λi, Ui, the message about traffic status Mi and current time stamp Ti to compute(13)βi=H4H1IDobuλiUiMiTi.Step 5. Uses the two random numbers ui and λi, βi, and the temporary secret key SKobui to compute(14)σi=λi⋅SKobui+βi⋅uimodp.Step 6. Sends the message Ui,σi,ωi,θi,Mi,Ti to the regional RSU.


## 4.4. Verification Stage

Upon receiving the signature, RSU proceeds the following steps to verify it.Step 1. Examines the freshness of Ti. If it is fresh, goes to step 2; otherwise, the signature is rejected.Step 2. Uses own secret key SKrsu, the private key in the time period i of the vehicle PKobui and ωi to count the hash value of identity of the vehicle:(15)H1IDobu=ωi⊕H3SKrsu⋅PKobui.Step 3. Uses the hash value of IDobu, its own secret key SKrsu, the private key of the vehicle, the private key of TPD, and current time stamp Ti to evaluate(16)αi=H2H1IDobuSKrsu⋅PKTPDTi,(17)ηi=H2H1IDobuSKrsu⋅PKobuiTi.Step 4. Uses the hash value of IDobu, θi, and ηi to evaluate(18)λi=θi−ηiH1IDobu.Step 5. Concatenates the hash value of IDobu, λi, Ui, the message about traffic status Mi, and current time stamp Ti to evaluate(19)βi=H4H1IDobuλiUiMiTi.Step 6. Checks whether the equation(20)σi⋅P=H1IDobu⋅PKpub+PKTPD⋅αi⋅λi+Ui⋅βiholds. If it holds, the signature is valid.


## 5. Security Analysis

In this part, the correctness and the security analysis under the random oracle model of our proposed scheme are illustrated.


### 5.1. Correctness Proof

Theorem 1.A signature from the OBU could pass the verification of the RSU.Proof. Actually, given a signature Ui,σi,ωi,θi,Mi,Ti from an OBU, the RSU could compute(21)σi=λi⋅SKobui+βi⋅ui=λi⋅SKobui−1+Kparti+βi⋅ui=λi⋅SKobui−2+Kparti−1+Kparti+βi⋅ui=λi⋅SKobui−3+Kparti−2+Kparti−1+Kparti+βi⋅ui=λi⋅SKobu0+Kpart1+Kpart2+…Kparti+βi⋅ui=λi⋅SKobu0+SKTPD⋅α1−α0+α2−α1+…αi−1−αi−2+αi−αi−1+βi⋅ui=λi⋅SKobu0+SKTPD⋅αi−α0+βi⋅ui=λi⋅SKmsk⋅H1IDobu+SKTPD⋅α0+SKTPD⋅αi−α0+βi⋅ui=λi⋅SKmsk⋅H1IDobu+SKTPD⋅αi+βi⋅ui,(22)σi⋅P=λi⋅SKmsk⋅H1IDobu⋅P+SKTPD⋅αi⋅P+βi⋅ui⋅P=H1IDobu⋅PKpub+PKTPD⋅αi⋅λi+Ui⋅βi.Therefore, the signature is verified to be valid.


### 5.2. Security Proof

Theorem 2.Our proposed V2I authentication scheme is secure under the random oracle model.Proof. Assume that there is a PPT adversary A who could forge a signature to pass the verification successfully. The challenger C is constructed to tackle the DL problem with a nonnegligible probability by interacting with A. Given a DL instance P,PKTPD=x⋅P=X, the game between A and C is played as follows.


#### 5.2.1. Query Phase

C
o
n
f
i
g
u
r
a
t
i
o
n
‐
o
r
a
c
l
e: The challenger C allocates PKpub=s⋅P and PKTPD=x⋅P, generates the public parameter param=a,b,p,q,P,PKpub,PKTPD,PKrsu, and conveys these parameters to the adversary A.
H
1
−
o
r
a
c
l
e: A list H1list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti from the adversary A, C first examines whether the tuple IDobu,Ti,R1 is in H1list. If so, C returns R1=H1IDobu to A; otherwise, C picks a random number R1∈Zq∗, puts the tuple IDobu,Ti,R1 into H1list, and returns R1=H1IDobu to A.
H
2
−
o
r
a
c
l
e: A list H2list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti,D2 from the adversary A, C first extracts the tuple IDobu,Ti,R1 from the list H1list. Then, C examines whether the tuple IDobu,Ti,D2,R2 is in H2list. If so, C returns R2=H2R1D2Ti to A; otherwise, C picks two random numbers ω,R2∈Zq∗ and allocates D2=ω⋅PKrsu. Finally, C puts the tuple IDobu,Ti,D2,R2 into H2list and returns R2=H2R1D2Ti to A.
T
e
m
p
o
r
a
r
y
s
e
c
r
e
t
k
e
y
−
o
r
a
c
l
e: The adversary A asks for the temporary private key SKobui in the current time period i. The challenger C first extracts the tuples IDobu,Ti,R1 and IDobu,Ti,D2,R2 from lists H1list and H2list, respectively. Then, C computes
(23)
S
K
obu
i
=
S
K
msk
⋅
H
1
I
D
obu
+
S
K
TPD
⋅
α
i
=
s
⋅
R
1
+
S
K
TPD
⋅
R
2
.Finally,C adds the tuple IDobu,Ti,SKobui into the list Keylist and returns SKobui to A.H3−oracle: A list H3list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti from the adversary A, C first examines whether the tuple IDobu,Ti,R3 is in H3list. If so, C returns R3 to A; otherwise, C picks a random number R3∈Zq∗, puts the tuple IDobu,Ti,R3 into H3list, and returns R3 to A.H4−oracle: A list H4list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti,Ui,λi,Mi from the adversary A, C first extracts the tuple IDobu,Ti,R1 from the list H1list. Then, C examines whether the tuple IDobu,Ti,Ui,λi,Mi,R4 is in the list H4list. If so, C returns R4=H4R1UiλiMiTi to A; otherwise, C picks a random number R4∈Zq∗, puts the tuple IDobu,Ti,Ui,λi,Mi,R4 into H4list, and returns R4=H4R1UiλiMiTi to A.Signing−oracle: Upon receiving the query about the signature on message Mi from the adversary A, the challenger C picks random numbers ui,σi∈Zq∗ and r1,r2,r4,d2∈Zq∗. C sets Ui=ui⋅P and λi=r1⋅Ppub+r2⋅X−1⋅σi⋅P−r4⋅Ui and adds the tuples IDobu,Ti,r1, IDobu,Ti,d2,r2, and IDobu,Ti,Ui,λi,Mi,r4 into the lists H1list, H2list, and H4list separately. At last, C returns Ui,σi,λi,Mi,Ti to A.Verification: The verifier checks if the equation σi⋅P=λi⋅R1⋅PKpub+PKTPD⋅R2+Ui⋅R4 holds. If it does not hold, the verification algorithm outputs 0 and the process is aborted. Otherwise, the verification algorithm outputs 1 and the signature is accepted.


#### 5.2.2. Forgery Phase

If an adversaryA could successfully output a signature which can pass the verification with nonneglectable probability according to the forking lemma [36], then A could output a second signature in an attack by using a different random oracle with nonneglectable probability. Consequently, A could output another signature Ui∗,σi∗,λi∗,Mi∗,Ti∗ by repeating the process with a different choice of R2, which leads to a distinguishing σi, while the value of λi remains unchanged. Such that, the following equation is obtained:(24)σi⋅P=λi⋅R1⋅PKpub+X⋅R2+Ui⋅R4σi′⋅P=λi⋅R1⋅PKpub+X⋅R2′+Ui⋅R4,(25)σi−σi′⋅P=λi⋅X⋅R2−R2′x=R2−R2′−1⋅λi−1⋅σi−σi′.At last, the challengerC outputs R2−R2′−1⋅λi−1⋅σi−σi′ as the answer of the DL problem instance P,PKTPD=x⋅P=X. This contradicts with the difficulty of the DL problem. Hence, our proposed V2I authentication scheme is secure against forgery under the random oracle model on the condition of adaptive chosen message attack.


## 5.1. Correctness Proof

Theorem 1.A signature from the OBU could pass the verification of the RSU.Proof. Actually, given a signature Ui,σi,ωi,θi,Mi,Ti from an OBU, the RSU could compute(21)σi=λi⋅SKobui+βi⋅ui=λi⋅SKobui−1+Kparti+βi⋅ui=λi⋅SKobui−2+Kparti−1+Kparti+βi⋅ui=λi⋅SKobui−3+Kparti−2+Kparti−1+Kparti+βi⋅ui=λi⋅SKobu0+Kpart1+Kpart2+…Kparti+βi⋅ui=λi⋅SKobu0+SKTPD⋅α1−α0+α2−α1+…αi−1−αi−2+αi−αi−1+βi⋅ui=λi⋅SKobu0+SKTPD⋅αi−α0+βi⋅ui=λi⋅SKmsk⋅H1IDobu+SKTPD⋅α0+SKTPD⋅αi−α0+βi⋅ui=λi⋅SKmsk⋅H1IDobu+SKTPD⋅αi+βi⋅ui,(22)σi⋅P=λi⋅SKmsk⋅H1IDobu⋅P+SKTPD⋅αi⋅P+βi⋅ui⋅P=H1IDobu⋅PKpub+PKTPD⋅αi⋅λi+Ui⋅βi.Therefore, the signature is verified to be valid.


## 5.2. Security Proof

Theorem 2.Our proposed V2I authentication scheme is secure under the random oracle model.Proof. Assume that there is a PPT adversary A who could forge a signature to pass the verification successfully. The challenger C is constructed to tackle the DL problem with a nonnegligible probability by interacting with A. Given a DL instance P,PKTPD=x⋅P=X, the game between A and C is played as follows.


### 5.2.1. Query Phase

C
o
n
f
i
g
u
r
a
t
i
o
n
‐
o
r
a
c
l
e: The challenger C allocates PKpub=s⋅P and PKTPD=x⋅P, generates the public parameter param=a,b,p,q,P,PKpub,PKTPD,PKrsu, and conveys these parameters to the adversary A.
H
1
−
o
r
a
c
l
e: A list H1list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti from the adversary A, C first examines whether the tuple IDobu,Ti,R1 is in H1list. If so, C returns R1=H1IDobu to A; otherwise, C picks a random number R1∈Zq∗, puts the tuple IDobu,Ti,R1 into H1list, and returns R1=H1IDobu to A.
H
2
−
o
r
a
c
l
e: A list H2list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti,D2 from the adversary A, C first extracts the tuple IDobu,Ti,R1 from the list H1list. Then, C examines whether the tuple IDobu,Ti,D2,R2 is in H2list. If so, C returns R2=H2R1D2Ti to A; otherwise, C picks two random numbers ω,R2∈Zq∗ and allocates D2=ω⋅PKrsu. Finally, C puts the tuple IDobu,Ti,D2,R2 into H2list and returns R2=H2R1D2Ti to A.
T
e
m
p
o
r
a
r
y
s
e
c
r
e
t
k
e
y
−
o
r
a
c
l
e: The adversary A asks for the temporary private key SKobui in the current time period i. The challenger C first extracts the tuples IDobu,Ti,R1 and IDobu,Ti,D2,R2 from lists H1list and H2list, respectively. Then, C computes
(23)
S
K
obu
i
=
S
K
msk
⋅
H
1
I
D
obu
+
S
K
TPD
⋅
α
i
=
s
⋅
R
1
+
S
K
TPD
⋅
R
2
.Finally,C adds the tuple IDobu,Ti,SKobui into the list Keylist and returns SKobui to A.H3−oracle: A list H3list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti from the adversary A, C first examines whether the tuple IDobu,Ti,R3 is in H3list. If so, C returns R3 to A; otherwise, C picks a random number R3∈Zq∗, puts the tuple IDobu,Ti,R3 into H3list, and returns R3 to A.H4−oracle: A list H4list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti,Ui,λi,Mi from the adversary A, C first extracts the tuple IDobu,Ti,R1 from the list H1list. Then, C examines whether the tuple IDobu,Ti,Ui,λi,Mi,R4 is in the list H4list. If so, C returns R4=H4R1UiλiMiTi to A; otherwise, C picks a random number R4∈Zq∗, puts the tuple IDobu,Ti,Ui,λi,Mi,R4 into H4list, and returns R4=H4R1UiλiMiTi to A.Signing−oracle: Upon receiving the query about the signature on message Mi from the adversary A, the challenger C picks random numbers ui,σi∈Zq∗ and r1,r2,r4,d2∈Zq∗. C sets Ui=ui⋅P and λi=r1⋅Ppub+r2⋅X−1⋅σi⋅P−r4⋅Ui and adds the tuples IDobu,Ti,r1, IDobu,Ti,d2,r2, and IDobu,Ti,Ui,λi,Mi,r4 into the lists H1list, H2list, and H4list separately. At last, C returns Ui,σi,λi,Mi,Ti to A.Verification: The verifier checks if the equation σi⋅P=λi⋅R1⋅PKpub+PKTPD⋅R2+Ui⋅R4 holds. If it does not hold, the verification algorithm outputs 0 and the process is aborted. Otherwise, the verification algorithm outputs 1 and the signature is accepted.


### 5.2.2. Forgery Phase

If an adversaryA could successfully output a signature which can pass the verification with nonneglectable probability according to the forking lemma [36], then A could output a second signature in an attack by using a different random oracle with nonneglectable probability. Consequently, A could output another signature Ui∗,σi∗,λi∗,Mi∗,Ti∗ by repeating the process with a different choice of R2, which leads to a distinguishing σi, while the value of λi remains unchanged. Such that, the following equation is obtained:(24)σi⋅P=λi⋅R1⋅PKpub+X⋅R2+Ui⋅R4σi′⋅P=λi⋅R1⋅PKpub+X⋅R2′+Ui⋅R4,(25)σi−σi′⋅P=λi⋅X⋅R2−R2′x=R2−R2′−1⋅λi−1⋅σi−σi′.At last, the challengerC outputs R2−R2′−1⋅λi−1⋅σi−σi′ as the answer of the DL problem instance P,PKTPD=x⋅P=X. This contradicts with the difficulty of the DL problem. Hence, our proposed V2I authentication scheme is secure against forgery under the random oracle model on the condition of adaptive chosen message attack.


## 5.2.1. Query Phase

C
o
n
f
i
g
u
r
a
t
i
o
n
‐
o
r
a
c
l
e: The challenger C allocates PKpub=s⋅P and PKTPD=x⋅P, generates the public parameter param=a,b,p,q,P,PKpub,PKTPD,PKrsu, and conveys these parameters to the adversary A.
H
1
−
o
r
a
c
l
e: A list H1list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti from the adversary A, C first examines whether the tuple IDobu,Ti,R1 is in H1list. If so, C returns R1=H1IDobu to A; otherwise, C picks a random number R1∈Zq∗, puts the tuple IDobu,Ti,R1 into H1list, and returns R1=H1IDobu to A.
H
2
−
o
r
a
c
l
e: A list H2list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti,D2 from the adversary A, C first extracts the tuple IDobu,Ti,R1 from the list H1list. Then, C examines whether the tuple IDobu,Ti,D2,R2 is in H2list. If so, C returns R2=H2R1D2Ti to A; otherwise, C picks two random numbers ω,R2∈Zq∗ and allocates D2=ω⋅PKrsu. Finally, C puts the tuple IDobu,Ti,D2,R2 into H2list and returns R2=H2R1D2Ti to A.
T
e
m
p
o
r
a
r
y
s
e
c
r
e
t
k
e
y
−
o
r
a
c
l
e: The adversary A asks for the temporary private key SKobui in the current time period i. The challenger C first extracts the tuples IDobu,Ti,R1 and IDobu,Ti,D2,R2 from lists H1list and H2list, respectively. Then, C computes
(23)
S
K
obu
i
=
S
K
msk
⋅
H
1
I
D
obu
+
S
K
TPD
⋅
α
i
=
s
⋅
R
1
+
S
K
TPD
⋅
R
2
.Finally,C adds the tuple IDobu,Ti,SKobui into the list Keylist and returns SKobui to A.H3−oracle: A list H3list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti from the adversary A, C first examines whether the tuple IDobu,Ti,R3 is in H3list. If so, C returns R3 to A; otherwise, C picks a random number R3∈Zq∗, puts the tuple IDobu,Ti,R3 into H3list, and returns R3 to A.H4−oracle: A list H4list is set up and retained by the challenger C, which is initialized to empty. Upon receiving the query about IDobu,Ti,Ui,λi,Mi from the adversary A, C first extracts the tuple IDobu,Ti,R1 from the list H1list. Then, C examines whether the tuple IDobu,Ti,Ui,λi,Mi,R4 is in the list H4list. If so, C returns R4=H4R1UiλiMiTi to A; otherwise, C picks a random number R4∈Zq∗, puts the tuple IDobu,Ti,Ui,λi,Mi,R4 into H4list, and returns R4=H4R1UiλiMiTi to A.Signing−oracle: Upon receiving the query about the signature on message Mi from the adversary A, the challenger C picks random numbers ui,σi∈Zq∗ and r1,r2,r4,d2∈Zq∗. C sets Ui=ui⋅P and λi=r1⋅Ppub+r2⋅X−1⋅σi⋅P−r4⋅Ui and adds the tuples IDobu,Ti,r1, IDobu,Ti,d2,r2, and IDobu,Ti,Ui,λi,Mi,r4 into the lists H1list, H2list, and H4list separately. At last, C returns Ui,σi,λi,Mi,Ti to A.Verification: The verifier checks if the equation σi⋅P=λi⋅R1⋅PKpub+PKTPD⋅R2+Ui⋅R4 holds. If it does not hold, the verification algorithm outputs 0 and the process is aborted. Otherwise, the verification algorithm outputs 1 and the signature is accepted.


## 5.2.2. Forgery Phase

If an adversaryA could successfully output a signature which can pass the verification with nonneglectable probability according to the forking lemma [36], then A could output a second signature in an attack by using a different random oracle with nonneglectable probability. Consequently, A could output another signature Ui∗,σi∗,λi∗,Mi∗,Ti∗ by repeating the process with a different choice of R2, which leads to a distinguishing σi, while the value of λi remains unchanged. Such that, the following equation is obtained:(24)σi⋅P=λi⋅R1⋅PKpub+X⋅R2+Ui⋅R4σi′⋅P=λi⋅R1⋅PKpub+X⋅R2′+Ui⋅R4,(25)σi−σi′⋅P=λi⋅X⋅R2−R2′x=R2−R2′−1⋅λi−1⋅σi−σi′.At last, the challengerC outputs R2−R2′−1⋅λi−1⋅σi−σi′ as the answer of the DL problem instance P,PKTPD=x⋅P=X. This contradicts with the difficulty of the DL problem. Hence, our proposed V2I authentication scheme is secure against forgery under the random oracle model on the condition of adaptive chosen message attack.


## 6. Performance Evaluation

To examine the performance of our proposed scheme in reality, an experiment has been conducted on a Windows 10-installed laptop with Intel(R) Core(TM) i7, and the cryptographic operations have been implemented by using the TEPLA library [37], which requires GMP library and OpenSSL [38].TEPLA Elliptic Curve and Pairing Library is a free C library which provides functions such as finite field arithmetic with 254-bit prime number, elliptic curve arithmetic over Barreto–Neahrig curve, and pairing arithmetic using optimal ate pairing over BN curve. To set up the system environment as the library required, MinGW64 and MSYS are needed to simulate Linux environment to compile cryptography libraries. To install TEPLA, GNU MP library and OpenSSL are required. GNU MP is a free library for big number related operations, and OpenSSL is used to realize cryptographic operations. After finishing compiling, environment variables for Visual Studio are configured and header files of these cryptography libraries are included to conduct the experiment for our scheme.The experimental results show that the proposed scheme costs1.050ms and 3.683ms in terms of signing and verification, respectively. We compare our proposed scheme with seven existing similar authentication schemes [9, 22–27], including a pairing-free authentication scheme [9] for VANETs and six key-insulated authentication schemes [22–27]. Note that in our comparison, only consumption of signing phase and verification phase is put into consideration. For convenience, the description of the symbols used in the comparison is listed in Table 2, the results of the comparison on computational costs of various KIS schemes in theory are listed in Table 3, the real running time is displayed in Table 4, and the intuitive comparison about signing and verification is shown in Figure 3 and Figure 4, respectively.Table 2
Definition of symbols.
Symbols
Definition
T
exp
The running time of an exponentiation operation
T
bili
−
pairing
The running time of a bilinear pairing operation
T
bilipair
−
mul
The running time of multiplication operation with two bilinear pairings
T
poi
−
add
The running time of a point addition operation correlated with the ECC
T
poi
−
mul
The running time of a scale multiplication operation correlated with the ECC
T
h
The running time of a common hash function operationTable 3
Computational costs comparison of the signature and verification phases in theory (ms).
Signing
Verification
Wang and Yao [9]
T
poi
−
add
+
3
T
h
+
4
T
poi
−
mul
2
T
h
+
3
T
bili
−
pairing
+
T
bilipair
−
mul
Weng et al. [22]
T
poi
−
mul
+
T
h
3
T
h
+
4
T
bili
−
pairing
+
2
T
bilipair
−
mul
Zhou et al. [23]
2
T
exp
+
T
h
3
T
h
+
4
T
bili
−
pairing
+
2
T
bilipair
−
mul
Wan et al. [24]
6
T
exp
5
T
bili
−
pairing
+
3
T
bilipair
−
mul
Zhao et al. [25]
2
T
poi
−
mul
+
T
h
T
h
+
3
T
bili
−
pairing
+
T
bilipair
−
mul
+
T
poi
−
mul
+
T
poi
−
add
Weng et al. [26]
6
T
exp
6
T
bili
−
pairing
+
4
T
bilipair
−
mul
Chen et al. [27]
7
T
exp
T
exp
+
4
T
bili
−
pairing
+
2
T
bilipair
−
mul
Our scheme
2
T
poi
−
mul
+
4
T
h
7
T
poi
−
mul
+
2
T
poi
−
add
+
4
T
hTable 4
Computational costs comparison of the signature and verification phases in simulation (ms).
Signing
Verification
Wang and Yao [9]
2.104
4.724
Weng et al. [22]
5.24
×
10
−
1
6.305
Zhou et al. [23]
6.3
×
10
−
2
6.305
Wan et al. [24]
1.86
×
10
−
1
7.882
Zhao et al. [25]
1.047
5.255
Weng et al. [26]
1.86
×
10
−
1
9.462
Chen et al. [27]
2.17
×
10
−
1
6.333
Our scheme
1.050
3.683Figure 3
Computational costs of signature phase in different schemes.Figure 4
Computational costs of verification phase in different schemes.Except the operations listed in Table2, other operations have not been considered since their running time is ignorable. In terms of the verification phase, according to Table 3, in the scheme of Wang and Yao [9], RSU needs to run two hash operations, three bilinear pairing operations, and one multiplication operation. In the scheme of Weng [22] and Zhou [23], RSU needs to run three hash operations, four bilinear pairing operations, and two multiplication operations. In the scheme of Wan [24], RSU needs to run five bilinear pairing operations, and three multiplication operations. In the scheme of Zhao [25], RSU needs to run one hash operations, three bilinear pairing operations, one multiplication operation, one point addition operation, and one multiplication operation related to ECC. In the scheme of Weng [26], RSU needs to run six bilinear pairing operations and four multiplication operations. In the scheme of Chen [27], RSU needs to run one exponentiation operation, four bilinear pairing operations, and two multiplication operations. As we all know, the bilinear pairing operation is the most time-consuming, while hash function is the least time-consuming. Furthermore, time consumption for the operations listed could be ranked as follows: Tbili−pairing>Tpoi−mul>Texp>Tbilipair−mul≈Tpoi−add>Th. It could be seen from Table 4 that our scheme possesses comparatively high efficiency in verification since our scheme is constructed by using comparatively light-weighted operations. To show the advantage clearly, the improved ratio of our scheme against other seven schemes is defined as Tnum−Tours/Tnum, where Tnum refers to time costs of the scheme with the reference number “num” and Tours refers to time costs of our scheme. In terms of the verification stage, the improved ratios of our scheme against the schemes [9, 22–27] are 4.724−3.683/4.724=22.04%, 6.305−3.683/6.305=41.59%, 6.305−3.683/6.305=41.59%, 7.882−3.683/7.882=53.27%, 5.255−3.683/5.255=29.91%, 9.462−3.683/9.462=61.08%, and 6.333−3.683/6.333=41.84%, respectively. When it comes to the total costs of signing and verifying stages, the improved ratios of our scheme against other seven schemes [9, 22–27] are 30.68%, 30.69%, 25.68%, 41.34%, 24.9%, 50.94%, and 27.74% individually. From Figures 3 and 4, the computation costs of singing phase of our proposed scheme are lightly higher than some schemes, because indispensable operations in this phase are needed to achieve key insulation and to provide better security. Even that our promotion comes at a little price of efficiency of signing, the gain of key-insulated secrecy deserves it, and on the whole, the proposed scheme achieves a better trade-off between security and efficiency than the compared schemes.


## 7. Conclusion

Vehicular ad hoc networks (VANETs) are one of the most promising technologies nowadays. For the sake of providing efficient and secure authentication for VANETs, a key-insulated V2I authentication scheme has been constructed in this paper. The core idea of the proposed scheme is dividing private key of the vehicle into two parts which are, respectively, held by a temper-proofing device (TPD) and the vehicle itself, and these two parts of the private key are used to generate a signature. The proposed scheme supports dynamically updating private key in different time periods. For the vehicle, it obtains its updated secret key by the help of TPD before signing. For the RSU, it first checks whether the time stamp is valid before verification, and then it validates the signature from the vehicle. The security analysis manifests that the proposed scheme is secure under the adaptive chosen message attack. The comparison is also conducted among our scheme and other similar schemes. The performance evaluation shows that our bilinear pairing-free scheme harvests a better trade-off between security and efficiency, and it is feasible for VANET environment.In our proposed scheme, the helper is assumed as a fully-trusted device, and the private key of the vehicle is generated by its helper. However, the helper is actually semitrusted in some situations, which means that the assistant device can generate signature without the user’s approval. In this situation, 2-out-of-2 threshold manner should be a considerable method to prevent the misuse of the user’s secret key by the helper. The core idea of 2-out-of-2 threshold manner is that the user and the helper device could share the threshold valuen using standard threshold techniques, where the user keeps n1 and the helper keeps n2 such that n1+n2=n. In addition, because the RSU would receive and verify numerous signatures from the vehicles within its region, this would inevitably cause burden of computational consumption if the RSU proceeds verification on by one. Taken into account the requirements for efficiency and security in the context discussed above, design of an efficient threshold key-insulated authentication scheme is our future work, which aims to achieve feasible secure V2I communication for VANETs.



---

*Source: 4070283-2018-03-01.xml*