# Data Distribution for Multiple Receivers in a Connected Car Environment Using 5G Communication

Authors: Won-Bin Kim; Daehee Seo; Donghyun Kim; Im-Yeong Lee
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The development of communication technology has brought changes to various environments. The evolution from 3G to 4G Long-Term Evolution (LTE) was mainly aimed at improving communication speed. However, the evolution from 4G LTE to 5G New Radio (NR) is not aimed at improving speed alone. In addition to the existing communication types, 5G aims to improve communication to support the Internet of Things (IoT), media, and complex content to which things are connected. In such environments, point-to-point communication has a very inefficient structure to allow content providers to transmit data to many content users. In the 5G era, content providers must distribute content to numerous users, and in this process, they need to protect the content. Multireceiver encryption (MRE) is an encryption technology developed for this purpose. MRE allows multiple recipients to decrypt data using their own private key with single encryption of a data provider. With this technology, even if the number of data recipients is 100,000 or 1,000,000, data can be distributed with single encryption. Therefore, while using the existing 1 : 1 encryption method, it is possible to solve the problem of inefficiency in performing encryption for each recipient. However, existing proposed MREs can cause key escrow problems and partial key verification problems. Furthermore, the privacy issues identifying the recipient may arise because anonymity is not available to the recipient. In addition, it is necessary to ensure a fair decryption process for all recipients which a legitimate user cannot decrypt. In this study, we attempted to address these problems, and through our model, it is possible to distribute the data more securely and efficiently in a 5G environment.


---

## Body

## 1. Introduction

Mobile communication technology has changed significantly in our lifetime. Since the development of the first mobile communication technology, it has undergone various changes, from the previous generations to the current 5th generation communication. As mobile communication technology supports the transmission of digital data beyond simple voice transmission, it is possible to perform tremendous functions using a cellular terminal represented by a smartphone.The evolution of the Internet has made daily life more convenient and made it possible to communicate through mobile devices anytime, anywhere. Mobile communication technology is at the center of this change and is currently in its fifth generation. 5G NR communication (hereafter referred to as 5G), which was first commercialized in 2018, is designed to support future technologies beyond the limitations of the existing 4G Long-Term Evolution (LTE). Rapidly emerging technologies, such as the Internet of Things (IoT), autonomous vehicles, and Virtual Reality (VR), are extensively large that they are insufficiently covered by conventional 4G LTE in terms of the number of connected devices, amount of transmitted data, and delay speed as shown in Figure1. According to the Ericsson-LG report, the number of IoT devices is expected to reach 28 billion by 2021. In addition, 4 TB data is transmitted per day for autonomous vehicles, and approximately 1 GB data per minute is required for 8K VR content. Therefore, it is difficult to provide smooth services with 4G LTE, and 5G is being developed to provide increasingly diverse services in a stable manner.Figure 1
Examples of 5G communication.
(a)(b)(c)5G is developed to communicate quickly and reliably with a large number of devices. Considering IoT and autonomous vehicles (including Vehicle-To-Everything (V2X)), which are representative services to which 5G is applied, a large number of devices can communicate with each other. It can be observed that communication among multiple devices is one of the representative characteristics of 5G. In addition, it is possible to service technologies directly connected to life and security, such as military drones, implantable medical devices, and transportation systems. Therefore, communication security must also be guaranteed. As a result, to provide a 5G service, a technology is required that can safely and efficiently transmit data to multiple recipients (devices).Data encryption technology prevents the transmission of data to third parties who do not have permission to view it [1–4]. In general, data encryption technology uses public key encryption and symmetric key encryption; therefore, a third party without a decryption key cannot decipher the contents of the data. However, a common encryption method is a 1 : 1 communication between the sender and receiver. Therefore, to provide the same data to multiple recipients (devices) in services such as IoT and autonomous vehicles in a 5G environment through this format, the number of encryptions that must be performed for each recipient is equal to the number of recipients. This leads to an increase in processing speed and latency, along with an increase in the data processing cost. Therefore, to solve this problem, an encryption method is required that allows multiple recipients to decrypt data with only one encryption. Multireceiver Encryption (MRE) is a suitable encryption technology in such environments. MRE allows each recipient to decrypt data using their own private key if the data owner uses the public keys and IDs of multiple recipients to secure data only once. Therefore, the data sender need not encrypt multiple times even if the number of recipients increases, thereby leading to efficient data distribution. Therefore, by using MRE, it is easy to distribute data to multiple users in 5G environments.However, different 5G based-technologies have different requirements depending on the purpose and application method. For example, a remote drone control system controls multiple drones with a limited amount of power, and there is no need for frequent communication outside of the origin and destination. Therefore, an encryption method with low computation power is suitable. In addition, the encryption applied to a smart metering system transmits only a small amount of data at a low frequency. However, as power is always supplied, there is no need to apply a lightweight encryption method. However, in the case of a connected car, a large amount of data must be transmitted at a high speed, and the data regarding the surrounding environment must be transmitted to all vehicles and transportation systems. Thus, an appropriate encryption method is required. In this study, we considered separate requirements for various applications. As a result, an environment for distributing encrypted data to multiple recipients is set to ensure quick and safe application of a large amount of data in a connected car environment. In addition, we set the requirements, developed a system model in the relevant environment, and proceeded to design and analyze the MRE for a safe and efficient data cannon in a connected car environment using 5G.


## 2. Related Works

In this section, we discuss the existing literature as it can enhance the understanding of the contents of this study.


### 2.1. 5G Communication

5G communication technology has been developed by supplementing the limitations of 4G LTE as a fifth-generation mobile communication technology. 5G communication is designed to support emerging technologies such as IoT, VR, and smart cars (or connected cars). Therefore, it is faster, more stable, and able to communicate with more devices at the same time with lower latency compared with existing mobile communication technologies. When utilizing the characteristics of 5G communication in a drone, diverse tasks such as delivery, monitoring, and rescue support can be carried out by remotely controlling multiple drones as shown in Figure2. In addition, it is possible to establish a safer and more convenient transportation system by interacting with autonomous/remote driving vehicles and real-time road traffic conditions, and this has been a long-standing goal of humanity. Furthermore, using next-generation content technologies such as VR, it is possible to provide various services through the use of immersive content and combination with mobile devices. 5G communication can provide more complex and high-level services because it can transmit a larger amount of data compared to a reference time while extending from the existing unicast communication environment to multicast and broadcast services.Figure 2
Data distribution in the 5G environment.5G communication can ensure more reliable communication with a larger number of devices at the same time. Therefore, it is possible to control multiple devices at the same time to perform more tasks within a limited time. A typical example is drone control. In the drone industry, 5G plays a key role by controlling multiple drones simultaneously. Services using these industrial drones include drone delivery, which is currently being developed by Amazon. As these services require control of a large number of drones at the same time, a technology is required that can control drones in a stable manner. Another example is intelligent transportation systems. These include not only autonomous vehicles but also V2X technologies such as vehicle-to-vehicle communication and vehicle-to-road side unit (RSU) communication. As such intelligent transportation systems need to process and transmit data generated from numerous sensors and equipment mounted on a vehicle, stable communication is required between numerous vehicles and RSUs. As the technology gradually improves, more machines will interact, and more tasks will be possible. However, as an increasing number of machines are being used in daily life, these machines can be exploited for nefarious purposes to take unfair advantage or threaten life. For example, it is possible to hack drone communications to steal items being delivered or to create a threat to life using drones. In the case of vehicles, there is a greater risk to life. Therefore, for a wider area of 5G usage, there is more emphasis on the safety of communication.


### 2.2. Certificateless Public Key Cryptography

The public key encryption method basically consists of a public key and a private key pair. Users can use the public key encryption system by revealing the secret private key and the public key corresponding to the private key. The initial public key encryption method was a Public Key Infrastructure (PKI) structure that proved that it was the owner of an individual corresponding to the public key by registering a certificate for a public key with a Certificate Authority (CA). However, in the PKI method, the process of generating, registering, and managing certificates is complicated, and a large cost is incurred. To solve this problem, ID-based Cryptography (IBC) was proposed by Adi Shamir in 1984 as shown in Figure3 [5]. IBC is a technology that does not use a certificate, which is a disadvantage of the PKI method but uses the unique identity information (domain address, unique number, etc.) of a user as a public key. Therefore, the public key of a user is used as a tool to verify the user’s identity. In addition, IBC receives a private key by registering the public key of a user in the Key Generation Center (KGC). However, this causes a key escrow problem in which the KGC knows the private keys of all users. Finally, various studies have been conducted to solve the key escrow problem, and certificateless public key cryptography (CL-PKC) has appeared.Figure 3
Comparison with common PKE and MRE.CL-PKC overcame the key escrow problem of IBC with the method proposed by Al-Riyami and Paterson in 2003 [6]. CL-PKC generates a key using unique identity information similar to the existing IBC. However, the KGC does not issue the complete private key of a user but rather a part of the private key of each user. Specifically, a partial private key of each user is issued by using their unique identity information, and the user uses the private key by selecting and adding a secret value to the partial private key. Therefore, the key escrow problem does not occur because the KGC cannot know the complete private key. However, in recent years, additional security problems such as public key substitution attacks and partial private key verification problems have been highlighted, and various studies are being conducted.


### 2.3. Multireceiver Encryption

MRE is a cryptographic primitive and is a technology that can deliver the same message to multiple recipients with single encryption. MRE has been conducted in various studies based on the form of designating multiple recipients using their public keys by taking advantage of IBC, as shown in Figures3 and 4 [7–22]. However, in the MRE method, an issue of identifying the recipient has been raised. This has occurred because the information that can specify the recipient can be extracted from the value included in the ciphertext. To solve this problem, Fan et al. [23] proposed a scheme using a Lagrange interpolation polynomial. This scheme used a method of polynomiating the information of the recipient such that their identity could not be directly extracted, and it was argued that the identity of the recipient was not disclosed to anyone. However, several studies, such as Wang et al.’s study, have demonstrated that the recipient can acquire the identity of another recipient [23–25]. Accordingly, Fan et al. [26] proposed an improved scheme. Later, Zhang and Takagi [27] proposed a scheme that provided anonymity for both the sender and receiver. However, Zhang and Mao [28] revealed that anonymity was not perfect in this scheme as well, and a new ID-based MRE (IBMRE) was proposed.Figure 4
Basic form of MRE.Since the first MRE was introduced, various MREs using IBC have been studied. However, with the rise of the key escrow problem in IBC, a study was conducted to apply CL-PKC to replace IBC in MRE. Sur et al. [29] improved the implicit certificate-based IBMRE proposed in 2007 and proposed certificateless MRE (CL-MRE) in 2011 [30]. In addition, many researchers have proposed CL-MRE, but confidentiality and anonymity have not been proven in the Oracle model. Subsequently, Hafizul et al. [31] first proposed CL-MRE, which proved confidentiality and anonymity in a random Oracle model. Later, Hung et al. [32] pointed out that the method of Hafizul et al. [31] involved a large amount of computation. Accordingly, they proposed CL-MRE using double-linear pairing with improved association efficiency. However, their method also encountered a problem such that the map-to-point (MTP) hash operation, which required considerable operation time, increased linearly with the number of users. He et al. [33] proposed a CL-MRE scheme that did not use double-linear pairing and MTP operation to solve the problem of Hung et al. Gao et al. [34] proposed a method that does not use bilinear pairing, which takes a lot of computation time. However, because it is not possible to verify whether the sender is a registered user in KGC, an attack by an outsider is possible. Deng [35] and Zhu [36] also proposed a method to solve the key escrow problem, but many operations occur using bilinear pairing, and Zhu et al. cannot provide receiver anonymity. Win et al. [37] proposed a method that does not use double-linear pairing but does not provide receiver anonymity and decryption fairness. Wang et al. [38] used bilinear pairing and did not provide partial key verification.


## 2.1. 5G Communication

5G communication technology has been developed by supplementing the limitations of 4G LTE as a fifth-generation mobile communication technology. 5G communication is designed to support emerging technologies such as IoT, VR, and smart cars (or connected cars). Therefore, it is faster, more stable, and able to communicate with more devices at the same time with lower latency compared with existing mobile communication technologies. When utilizing the characteristics of 5G communication in a drone, diverse tasks such as delivery, monitoring, and rescue support can be carried out by remotely controlling multiple drones as shown in Figure2. In addition, it is possible to establish a safer and more convenient transportation system by interacting with autonomous/remote driving vehicles and real-time road traffic conditions, and this has been a long-standing goal of humanity. Furthermore, using next-generation content technologies such as VR, it is possible to provide various services through the use of immersive content and combination with mobile devices. 5G communication can provide more complex and high-level services because it can transmit a larger amount of data compared to a reference time while extending from the existing unicast communication environment to multicast and broadcast services.Figure 2
Data distribution in the 5G environment.5G communication can ensure more reliable communication with a larger number of devices at the same time. Therefore, it is possible to control multiple devices at the same time to perform more tasks within a limited time. A typical example is drone control. In the drone industry, 5G plays a key role by controlling multiple drones simultaneously. Services using these industrial drones include drone delivery, which is currently being developed by Amazon. As these services require control of a large number of drones at the same time, a technology is required that can control drones in a stable manner. Another example is intelligent transportation systems. These include not only autonomous vehicles but also V2X technologies such as vehicle-to-vehicle communication and vehicle-to-road side unit (RSU) communication. As such intelligent transportation systems need to process and transmit data generated from numerous sensors and equipment mounted on a vehicle, stable communication is required between numerous vehicles and RSUs. As the technology gradually improves, more machines will interact, and more tasks will be possible. However, as an increasing number of machines are being used in daily life, these machines can be exploited for nefarious purposes to take unfair advantage or threaten life. For example, it is possible to hack drone communications to steal items being delivered or to create a threat to life using drones. In the case of vehicles, there is a greater risk to life. Therefore, for a wider area of 5G usage, there is more emphasis on the safety of communication.


## 2.2. Certificateless Public Key Cryptography

The public key encryption method basically consists of a public key and a private key pair. Users can use the public key encryption system by revealing the secret private key and the public key corresponding to the private key. The initial public key encryption method was a Public Key Infrastructure (PKI) structure that proved that it was the owner of an individual corresponding to the public key by registering a certificate for a public key with a Certificate Authority (CA). However, in the PKI method, the process of generating, registering, and managing certificates is complicated, and a large cost is incurred. To solve this problem, ID-based Cryptography (IBC) was proposed by Adi Shamir in 1984 as shown in Figure3 [5]. IBC is a technology that does not use a certificate, which is a disadvantage of the PKI method but uses the unique identity information (domain address, unique number, etc.) of a user as a public key. Therefore, the public key of a user is used as a tool to verify the user’s identity. In addition, IBC receives a private key by registering the public key of a user in the Key Generation Center (KGC). However, this causes a key escrow problem in which the KGC knows the private keys of all users. Finally, various studies have been conducted to solve the key escrow problem, and certificateless public key cryptography (CL-PKC) has appeared.Figure 3
Comparison with common PKE and MRE.CL-PKC overcame the key escrow problem of IBC with the method proposed by Al-Riyami and Paterson in 2003 [6]. CL-PKC generates a key using unique identity information similar to the existing IBC. However, the KGC does not issue the complete private key of a user but rather a part of the private key of each user. Specifically, a partial private key of each user is issued by using their unique identity information, and the user uses the private key by selecting and adding a secret value to the partial private key. Therefore, the key escrow problem does not occur because the KGC cannot know the complete private key. However, in recent years, additional security problems such as public key substitution attacks and partial private key verification problems have been highlighted, and various studies are being conducted.


## 2.3. Multireceiver Encryption

MRE is a cryptographic primitive and is a technology that can deliver the same message to multiple recipients with single encryption. MRE has been conducted in various studies based on the form of designating multiple recipients using their public keys by taking advantage of IBC, as shown in Figures3 and 4 [7–22]. However, in the MRE method, an issue of identifying the recipient has been raised. This has occurred because the information that can specify the recipient can be extracted from the value included in the ciphertext. To solve this problem, Fan et al. [23] proposed a scheme using a Lagrange interpolation polynomial. This scheme used a method of polynomiating the information of the recipient such that their identity could not be directly extracted, and it was argued that the identity of the recipient was not disclosed to anyone. However, several studies, such as Wang et al.’s study, have demonstrated that the recipient can acquire the identity of another recipient [23–25]. Accordingly, Fan et al. [26] proposed an improved scheme. Later, Zhang and Takagi [27] proposed a scheme that provided anonymity for both the sender and receiver. However, Zhang and Mao [28] revealed that anonymity was not perfect in this scheme as well, and a new ID-based MRE (IBMRE) was proposed.Figure 4
Basic form of MRE.Since the first MRE was introduced, various MREs using IBC have been studied. However, with the rise of the key escrow problem in IBC, a study was conducted to apply CL-PKC to replace IBC in MRE. Sur et al. [29] improved the implicit certificate-based IBMRE proposed in 2007 and proposed certificateless MRE (CL-MRE) in 2011 [30]. In addition, many researchers have proposed CL-MRE, but confidentiality and anonymity have not been proven in the Oracle model. Subsequently, Hafizul et al. [31] first proposed CL-MRE, which proved confidentiality and anonymity in a random Oracle model. Later, Hung et al. [32] pointed out that the method of Hafizul et al. [31] involved a large amount of computation. Accordingly, they proposed CL-MRE using double-linear pairing with improved association efficiency. However, their method also encountered a problem such that the map-to-point (MTP) hash operation, which required considerable operation time, increased linearly with the number of users. He et al. [33] proposed a CL-MRE scheme that did not use double-linear pairing and MTP operation to solve the problem of Hung et al. Gao et al. [34] proposed a method that does not use bilinear pairing, which takes a lot of computation time. However, because it is not possible to verify whether the sender is a registered user in KGC, an attack by an outsider is possible. Deng [35] and Zhu [36] also proposed a method to solve the key escrow problem, but many operations occur using bilinear pairing, and Zhu et al. cannot provide receiver anonymity. Win et al. [37] proposed a method that does not use double-linear pairing but does not provide receiver anonymity and decryption fairness. Wang et al. [38] used bilinear pairing and did not provide partial key verification.


## 3. Preliminaries

In this section, the system model that is the background of this study is set up. Therefore, the role of the object participating in this model is defined and security requirements are set.


### 3.1. System Model

Participating objects in this study can be classified into three categories, and the overall form is shown in Figure5. Among them, the sender and receiver are objects included in the user and may be senders with fixed roles depending on the system environment, and any of the users may be senders. A detailed description of this is as follows:(i)
KGC: in this proposed model environment, KGC can be an organization that manages all transportation systems. For example, it may be the National Highway Traffic Safety Administration (NHTSA) of the United States, and a third party authorized to do so may play a role. Since KGC manages all users within the system, KGC creates common public parameters for the system and makes it possible to use the system by generating partial private keys at the user’s request. As the KGC is a semitrusted participant and has the property of honest-but-curious, it responds honestly to user requests. However, there is a possibility of privacy leakage.(ii)
Userssenderandreceivers: in this proposed environment, the user basically includes both the sender and the receiver. However, a designated sender may exist separately depending on the application environment as shown in Figure 6. First, if the role of the sender is not fixed, the sender may be all vehicles and transportation equipment (RSU, etc.) in a connected car environment. On the other hand, in the case of an environment in which the role of the sender is fixed, the sender plays the role of the sender by the entity that generally manages the transport system, not the end user, such as a traffic control center or RSU.Figure 5
Example of the system model environment.Figure 6
Cases of the sender role.All users must obtain a partial private key from the KGC to use the system provided by the KGC. Users who have issued a partial private key can create and disclose their public key. In addition, any user can act as a sender or receiver. The user assuming the sender role must know the public key of the user who becomes the receiver to generate a ciphertext for that user.(iii)
Sendertrafficcontroldevicesorvehicles: a sender refers to a user who sends data among users. One sender can designate multiple receivers, and the public keys of all receivers are required to generate ciphertext for multiple receivers. CL-MRE can deliver ciphertext to multiple receivers with a single encryption operation such that, for multiple receivers, it can process more efficiently than general public key encryption.(iv)
Receivervehicles: a receiver is a user who receives data from a sender. In this environment, the connected car used by the end user is applicable, and it receives data from a traffic control center or RSU or receives data from another vehicle depending on the application environment. The receiver reveals the public key after completing the key generation process. Thereafter, when the user receives the ciphertext included in the recipient list, the ciphertext can be decrypted with the private key and public key. In this process, the receiver cannot identify other receivers, and other ciphertexts that are not designated as targets cannot be decrypted.


### 3.2. Formal Definition

This section describes the formal definition of the algorithm used in this study. This section describes the formal definition of the algorithm used in this study. This study is largely divided into four parts (setup phase, key generation phase, data generation phase, and data receiving phase), and in detail, it consists of a total of seven algorithms, which are as follows:(i)
Setup: this algorithm begins by selecting and entering the security parameter λ. The public parameter params and master secret key are generated by the semitrusted participant KGC, and some of them are distributed by the KGC. Distributed params are used by system participants at all phases.(ii)
Partial-Private-Key-Extract: this algorithm is executed by the KGC according to the input of user i’s identity IDi. The PKG computes the corresponding partial private key si using the master private key and delivers it to user i.(iii)
Set-Secret-Value: this algorithm allows users to directly generate their own secret information by using the user’s own identity, the IDi.(iv)
Set-Private-Key: this algorithm is executed by the user i with identity IDi. It considers params,si,ti as the input and returns the full private key ski to user i as the output.(v)
Set-Public-Key: this algorithm is executed by the user i himself/herself to generate his/her public key pki according to his/her secret value ti.(vi)
Multiencryption: this is the Probabilistic Polynomial Time (PPT) algorithm. The sender executes this algorithm to generate a ciphertext for the message m by identities and the public parameters of selected receivers.(vii)
Multidecryption: a selected receiver runs this algorithm to decrypt the received ciphertext using the full private key of the receiver.


### 3.3. Security Requirements

This section describes the requirements of the system model of this study. There are seven security requirements, and a detailed description of each requirement is as follows:(i)
Confidentiality: the contents of the transmitted data must not be known except by the designated recipient. In addition, the recipients included in the recipient list must be able to know the contents of the data using their own private key.(ii)
Integrity: data transmitted from the sender to the receiver must not be altered due to the intervention of a third party or problems in the communication path during the transmission process. If data changes, legitimate users must know.(iii)
Keyescrowproblem: in a public key-based encryption environment, the KGC generates individuals who respond to the public key of the user. However, the KGC should not be able to use the private key of the user that it has created and kept to exercise the rights of the user.(iv)
Partialkeyverifiability: the user must be able to verify whether the partial private key issued from the KGC is the correct partial private key.(v)
Receiveranonymity: the legitimate recipients included in the recipient list must not be able to identify third parties other than themselves through the encrypted message. Therefore, in the process of determining whether the recipient is a recipient, it should not be possible to distinguish or specify data including the identity information of other recipients.(vi)
Decryptionfairness: a legitimate user included in the recipient list must not be interrupted by other recipients or third parties in the decryption process. Therefore, it is necessary to prevent the data being transmitted from being modulated or partially missing, making decoding impossible in a proper way.(vi)
Participantverifiability: in general MRE, the sender’s key is not entered during the encryption process. Therefore, the sender cannot be identified, and a user outside the system can transmit malicious data to a user inside the system. This has both advantages and disadvantages from many perspectives. However, in an environment such as this study, it is safe to ensure that data can only be distributed among users inside the system. So you can add a signature or use a method like signcryption. However, these methods require a lot of operations, and the sender has the burden of performing a signature with his or her own key.


## 3.1. System Model

Participating objects in this study can be classified into three categories, and the overall form is shown in Figure5. Among them, the sender and receiver are objects included in the user and may be senders with fixed roles depending on the system environment, and any of the users may be senders. A detailed description of this is as follows:(i)
KGC: in this proposed model environment, KGC can be an organization that manages all transportation systems. For example, it may be the National Highway Traffic Safety Administration (NHTSA) of the United States, and a third party authorized to do so may play a role. Since KGC manages all users within the system, KGC creates common public parameters for the system and makes it possible to use the system by generating partial private keys at the user’s request. As the KGC is a semitrusted participant and has the property of honest-but-curious, it responds honestly to user requests. However, there is a possibility of privacy leakage.(ii)
Userssenderandreceivers: in this proposed environment, the user basically includes both the sender and the receiver. However, a designated sender may exist separately depending on the application environment as shown in Figure 6. First, if the role of the sender is not fixed, the sender may be all vehicles and transportation equipment (RSU, etc.) in a connected car environment. On the other hand, in the case of an environment in which the role of the sender is fixed, the sender plays the role of the sender by the entity that generally manages the transport system, not the end user, such as a traffic control center or RSU.Figure 5
Example of the system model environment.Figure 6
Cases of the sender role.All users must obtain a partial private key from the KGC to use the system provided by the KGC. Users who have issued a partial private key can create and disclose their public key. In addition, any user can act as a sender or receiver. The user assuming the sender role must know the public key of the user who becomes the receiver to generate a ciphertext for that user.(iii)
Sendertrafficcontroldevicesorvehicles: a sender refers to a user who sends data among users. One sender can designate multiple receivers, and the public keys of all receivers are required to generate ciphertext for multiple receivers. CL-MRE can deliver ciphertext to multiple receivers with a single encryption operation such that, for multiple receivers, it can process more efficiently than general public key encryption.(iv)
Receivervehicles: a receiver is a user who receives data from a sender. In this environment, the connected car used by the end user is applicable, and it receives data from a traffic control center or RSU or receives data from another vehicle depending on the application environment. The receiver reveals the public key after completing the key generation process. Thereafter, when the user receives the ciphertext included in the recipient list, the ciphertext can be decrypted with the private key and public key. In this process, the receiver cannot identify other receivers, and other ciphertexts that are not designated as targets cannot be decrypted.


## 3.2. Formal Definition

This section describes the formal definition of the algorithm used in this study. This section describes the formal definition of the algorithm used in this study. This study is largely divided into four parts (setup phase, key generation phase, data generation phase, and data receiving phase), and in detail, it consists of a total of seven algorithms, which are as follows:(i)
Setup: this algorithm begins by selecting and entering the security parameter λ. The public parameter params and master secret key are generated by the semitrusted participant KGC, and some of them are distributed by the KGC. Distributed params are used by system participants at all phases.(ii)
Partial-Private-Key-Extract: this algorithm is executed by the KGC according to the input of user i’s identity IDi. The PKG computes the corresponding partial private key si using the master private key and delivers it to user i.(iii)
Set-Secret-Value: this algorithm allows users to directly generate their own secret information by using the user’s own identity, the IDi.(iv)
Set-Private-Key: this algorithm is executed by the user i with identity IDi. It considers params,si,ti as the input and returns the full private key ski to user i as the output.(v)
Set-Public-Key: this algorithm is executed by the user i himself/herself to generate his/her public key pki according to his/her secret value ti.(vi)
Multiencryption: this is the Probabilistic Polynomial Time (PPT) algorithm. The sender executes this algorithm to generate a ciphertext for the message m by identities and the public parameters of selected receivers.(vii)
Multidecryption: a selected receiver runs this algorithm to decrypt the received ciphertext using the full private key of the receiver.


## 3.3. Security Requirements

This section describes the requirements of the system model of this study. There are seven security requirements, and a detailed description of each requirement is as follows:(i)
Confidentiality: the contents of the transmitted data must not be known except by the designated recipient. In addition, the recipients included in the recipient list must be able to know the contents of the data using their own private key.(ii)
Integrity: data transmitted from the sender to the receiver must not be altered due to the intervention of a third party or problems in the communication path during the transmission process. If data changes, legitimate users must know.(iii)
Keyescrowproblem: in a public key-based encryption environment, the KGC generates individuals who respond to the public key of the user. However, the KGC should not be able to use the private key of the user that it has created and kept to exercise the rights of the user.(iv)
Partialkeyverifiability: the user must be able to verify whether the partial private key issued from the KGC is the correct partial private key.(v)
Receiveranonymity: the legitimate recipients included in the recipient list must not be able to identify third parties other than themselves through the encrypted message. Therefore, in the process of determining whether the recipient is a recipient, it should not be possible to distinguish or specify data including the identity information of other recipients.(vi)
Decryptionfairness: a legitimate user included in the recipient list must not be interrupted by other recipients or third parties in the decryption process. Therefore, it is necessary to prevent the data being transmitted from being modulated or partially missing, making decoding impossible in a proper way.(vi)
Participantverifiability: in general MRE, the sender’s key is not entered during the encryption process. Therefore, the sender cannot be identified, and a user outside the system can transmit malicious data to a user inside the system. This has both advantages and disadvantages from many perspectives. However, in an environment such as this study, it is safe to ensure that data can only be distributed among users inside the system. So you can add a signature or use a method like signcryption. However, these methods require a lot of operations, and the sender has the burden of performing a signature with his or her own key.


## 4. Secure Multireceiver Data Distribution for the Connected Car System

In this chapter, based on the system model presented in Section 3, we design a safe data transmission method for a connected car environment using 5G. To this end, a system model is designed, security requirements are set, and a method suitable for the system model is proposed.


### 4.1. System Parameters

The following are the system parameters used in this proposed scheme:(i)
∗: participants (KGC, sender, and receiver)(ii)
E: elliptic curve(iii)
p,q: λ-bit prime integer(iv)
l1,l2: λ-bit integer(v)
G: additive group on elliptic curve E(vi)
Gq: subgroup of G with prime order q(vii)
d: randomly selected master key, d∈Zq∗(viii)
params: KGC’s system public parameters(ix)
ski: participant i’s private key(x)
pki: participant i’s public key(xi)
m: plaintext(xii)
CT: ciphertext(xiii)
H1: one-way hash function, 0,1∗⟶Zq∗(xiv)
H2: one-way hash function, 0,1∗⟶Zq∗(xv)
H3: one-way hash function, 0,1∗⟶Zq∗(xvi)
H4: one-way hash function, 0,1∗⟶0,1l1+l2


### 4.2. Proposed Scheme for the 5G Connected Car System Environment

In this section, the CL-MRE proposed in Section 3 is applied to the 5G connected car system environment and specified. The overall flow of this is shown in Figure7.Figure 7
Flow of the proposed scheme for the connected car system on the 5G communication environment.


#### 4.2.1. Setup Phase

In this step, KGC creates a secret light disclosure parameter for the proposed CL-MRE data distribution.(i)
Setup: with the given security parameter λ, this algorithm is executed by KGC to generate the system’s parameters. The following steps will be implemented KGC in this algorithm:(1)
Choose twoλ-bit prime integers p,q, two λ-bit integers l1,l2, and an elliptic curve E defined on Fp. Let G be the additive group on elliptic curve E and Gq be the subgroup of G with prime order q.(2)
Select randomly a generatorP∈Gq.(3)
Randomly choosed∈Zq∗ as the master key and Ppub=d⋅P.(4)
Select four secure one-way hash functions are follows:Hi:0,1∗⟶Zq∗i=1,2,3,H4:0,1∗⟶0,1l1+l2.(5)
Publish system’s public parametersparams=p,q,l1,l2,E,G,Gq,P,Ppub,H1,H2,H3,H4 and message space M=0,1l1.


#### 4.2.2. Key Generation Phase

In this phase, the process of generating private and public keys for each receiver device are included as shown in Figure8.(i)
Set-Secret-Value: a user i with IDi randomly selects ti∈Zq∗ as his or her secret value and computes Ti=ti⋅P as the corresponding public key, and user i sends Ti,IDi to KGC.(ii)
Partial-Private-Key-Extract: according to the identity IDi of receiver i, the KGC performs the following steps:(1)
Randomly selectri∈Zq∗ and compute Ri=ri⋅P(2)
Calculateki=ri+dH1Ri+Ti,IDi+H1dTi+IDimodP(3)
Calculateji=d+riH1Ri+Ti,IDi+H1dTi+IDimodP(4)
After that,Ri,ji, and ki are delivered to receiver i through the public channel(iii)
Set-Private-Key: after receiving Ri,ji, and si from KGC, the user i verifies these. If verification passes, user i computes private key ski=si,ti as in the following steps:(1)
Verify whether the equation:ki⋅P=Ri+H1Ri+Ti,IDiPPub+H1tiPPub,IDiP. ji⋅P=PPub+Ri+H1Ri+Ti,IDi+H1tiPPub,IDiP(2)
If yes, computesi=ki−H1tiPPub,IDi and hi=ji−H1tiPPub,IDi(3)
After that, useri keeps secret ski=si,ti,hi as his or her full private(iv)
Set-Public-Key: user i keeps pki=Ri,Ti as the full public key.Figure 8
Flow of the key generation phase.


#### 4.2.3. Data Generation Phase

In this phase, the sender of the data specifies the recipient of the data and generates a ciphertext using the recipient’s public key as shown in Figure9.(i)
Multiencryption: this algorithm is executed by sender to generate a ciphertext for given message m and list of selected receivers i with identity IDi1≤i≤n, respectively. The following steps will be performed in this algorithm:(1)
Computew=H1Rsender+Tsender,IDsender and given message m∈M. Calculate z=H2m,w and Z=zP.(2)
ComputeUi=z⋅Ri+H1Ri+Ti,IDiPpub+Ti and μi=H3Ui,w,IDi, where i=1,2,…,n.(3)
Randomly selectθ∈Zq∗ and compute a polynomial fx with degree n as follows.(4)
Then, compute a polynomialfx with degree n as follows: fx=∏i=0nx−μi+θmodq=xn+an−1xn−1+⋯+a1x+a0, where ai∈Zp∗i=0,1,…,n−1 (2).(5)
ComputeC=H4Z,θ⊕m‖w.(6)
ComputeV=ssender+hsender.(7)
Generate ciphertextCT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1.Figure 9
Flow of the data generation phase.


#### 4.2.4. Data Receiving Phase

In this phase, the device uses its own private key to decrypt the received ciphertext to get the plaintext as shown in Figure10.(i)
Multidecryption: this algorithm is executed by selected receiver Ri to extract plaintext from the received ciphertext CT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1. Receiver i performs the following steps:(1)
ComputeUi=si+ti⋅Z and μi=H3Ui,IDi,w, i∈1,2,…,n.(2)
Calculatefx=xn+an−1xn−1+⋯+a1x+a0 and θ=fμi.(3)
Verify whether the equation:V⋅P=Rsender+PPub1+w.(4)
If yes, computem‖w=H4Z,θ⊕C.(5)
Verify ifZ=zP=H2m,wP holds. If not, return ⊥; otherwise, receiver i outputs the plaintext m.Figure 10
Flow of the data receiving phase.


## 4.1. System Parameters

The following are the system parameters used in this proposed scheme:(i)
∗: participants (KGC, sender, and receiver)(ii)
E: elliptic curve(iii)
p,q: λ-bit prime integer(iv)
l1,l2: λ-bit integer(v)
G: additive group on elliptic curve E(vi)
Gq: subgroup of G with prime order q(vii)
d: randomly selected master key, d∈Zq∗(viii)
params: KGC’s system public parameters(ix)
ski: participant i’s private key(x)
pki: participant i’s public key(xi)
m: plaintext(xii)
CT: ciphertext(xiii)
H1: one-way hash function, 0,1∗⟶Zq∗(xiv)
H2: one-way hash function, 0,1∗⟶Zq∗(xv)
H3: one-way hash function, 0,1∗⟶Zq∗(xvi)
H4: one-way hash function, 0,1∗⟶0,1l1+l2


## 4.2. Proposed Scheme for the 5G Connected Car System Environment

In this section, the CL-MRE proposed in Section 3 is applied to the 5G connected car system environment and specified. The overall flow of this is shown in Figure7.Figure 7
Flow of the proposed scheme for the connected car system on the 5G communication environment.


### 4.2.1. Setup Phase

In this step, KGC creates a secret light disclosure parameter for the proposed CL-MRE data distribution.(i)
Setup: with the given security parameter λ, this algorithm is executed by KGC to generate the system’s parameters. The following steps will be implemented KGC in this algorithm:(1)
Choose twoλ-bit prime integers p,q, two λ-bit integers l1,l2, and an elliptic curve E defined on Fp. Let G be the additive group on elliptic curve E and Gq be the subgroup of G with prime order q.(2)
Select randomly a generatorP∈Gq.(3)
Randomly choosed∈Zq∗ as the master key and Ppub=d⋅P.(4)
Select four secure one-way hash functions are follows:Hi:0,1∗⟶Zq∗i=1,2,3,H4:0,1∗⟶0,1l1+l2.(5)
Publish system’s public parametersparams=p,q,l1,l2,E,G,Gq,P,Ppub,H1,H2,H3,H4 and message space M=0,1l1.


### 4.2.2. Key Generation Phase

In this phase, the process of generating private and public keys for each receiver device are included as shown in Figure8.(i)
Set-Secret-Value: a user i with IDi randomly selects ti∈Zq∗ as his or her secret value and computes Ti=ti⋅P as the corresponding public key, and user i sends Ti,IDi to KGC.(ii)
Partial-Private-Key-Extract: according to the identity IDi of receiver i, the KGC performs the following steps:(1)
Randomly selectri∈Zq∗ and compute Ri=ri⋅P(2)
Calculateki=ri+dH1Ri+Ti,IDi+H1dTi+IDimodP(3)
Calculateji=d+riH1Ri+Ti,IDi+H1dTi+IDimodP(4)
After that,Ri,ji, and ki are delivered to receiver i through the public channel(iii)
Set-Private-Key: after receiving Ri,ji, and si from KGC, the user i verifies these. If verification passes, user i computes private key ski=si,ti as in the following steps:(1)
Verify whether the equation:ki⋅P=Ri+H1Ri+Ti,IDiPPub+H1tiPPub,IDiP. ji⋅P=PPub+Ri+H1Ri+Ti,IDi+H1tiPPub,IDiP(2)
If yes, computesi=ki−H1tiPPub,IDi and hi=ji−H1tiPPub,IDi(3)
After that, useri keeps secret ski=si,ti,hi as his or her full private(iv)
Set-Public-Key: user i keeps pki=Ri,Ti as the full public key.Figure 8
Flow of the key generation phase.


### 4.2.3. Data Generation Phase

In this phase, the sender of the data specifies the recipient of the data and generates a ciphertext using the recipient’s public key as shown in Figure9.(i)
Multiencryption: this algorithm is executed by sender to generate a ciphertext for given message m and list of selected receivers i with identity IDi1≤i≤n, respectively. The following steps will be performed in this algorithm:(1)
Computew=H1Rsender+Tsender,IDsender and given message m∈M. Calculate z=H2m,w and Z=zP.(2)
ComputeUi=z⋅Ri+H1Ri+Ti,IDiPpub+Ti and μi=H3Ui,w,IDi, where i=1,2,…,n.(3)
Randomly selectθ∈Zq∗ and compute a polynomial fx with degree n as follows.(4)
Then, compute a polynomialfx with degree n as follows: fx=∏i=0nx−μi+θmodq=xn+an−1xn−1+⋯+a1x+a0, where ai∈Zp∗i=0,1,…,n−1 (2).(5)
ComputeC=H4Z,θ⊕m‖w.(6)
ComputeV=ssender+hsender.(7)
Generate ciphertextCT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1.Figure 9
Flow of the data generation phase.


### 4.2.4. Data Receiving Phase

In this phase, the device uses its own private key to decrypt the received ciphertext to get the plaintext as shown in Figure10.(i)
Multidecryption: this algorithm is executed by selected receiver Ri to extract plaintext from the received ciphertext CT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1. Receiver i performs the following steps:(1)
ComputeUi=si+ti⋅Z and μi=H3Ui,IDi,w, i∈1,2,…,n.(2)
Calculatefx=xn+an−1xn−1+⋯+a1x+a0 and θ=fμi.(3)
Verify whether the equation:V⋅P=Rsender+PPub1+w.(4)
If yes, computem‖w=H4Z,θ⊕C.(5)
Verify ifZ=zP=H2m,wP holds. If not, return ⊥; otherwise, receiver i outputs the plaintext m.Figure 10
Flow of the data receiving phase.


## 4.2.1. Setup Phase

In this step, KGC creates a secret light disclosure parameter for the proposed CL-MRE data distribution.(i)
Setup: with the given security parameter λ, this algorithm is executed by KGC to generate the system’s parameters. The following steps will be implemented KGC in this algorithm:(1)
Choose twoλ-bit prime integers p,q, two λ-bit integers l1,l2, and an elliptic curve E defined on Fp. Let G be the additive group on elliptic curve E and Gq be the subgroup of G with prime order q.(2)
Select randomly a generatorP∈Gq.(3)
Randomly choosed∈Zq∗ as the master key and Ppub=d⋅P.(4)
Select four secure one-way hash functions are follows:Hi:0,1∗⟶Zq∗i=1,2,3,H4:0,1∗⟶0,1l1+l2.(5)
Publish system’s public parametersparams=p,q,l1,l2,E,G,Gq,P,Ppub,H1,H2,H3,H4 and message space M=0,1l1.


## 4.2.2. Key Generation Phase

In this phase, the process of generating private and public keys for each receiver device are included as shown in Figure8.(i)
Set-Secret-Value: a user i with IDi randomly selects ti∈Zq∗ as his or her secret value and computes Ti=ti⋅P as the corresponding public key, and user i sends Ti,IDi to KGC.(ii)
Partial-Private-Key-Extract: according to the identity IDi of receiver i, the KGC performs the following steps:(1)
Randomly selectri∈Zq∗ and compute Ri=ri⋅P(2)
Calculateki=ri+dH1Ri+Ti,IDi+H1dTi+IDimodP(3)
Calculateji=d+riH1Ri+Ti,IDi+H1dTi+IDimodP(4)
After that,Ri,ji, and ki are delivered to receiver i through the public channel(iii)
Set-Private-Key: after receiving Ri,ji, and si from KGC, the user i verifies these. If verification passes, user i computes private key ski=si,ti as in the following steps:(1)
Verify whether the equation:ki⋅P=Ri+H1Ri+Ti,IDiPPub+H1tiPPub,IDiP. ji⋅P=PPub+Ri+H1Ri+Ti,IDi+H1tiPPub,IDiP(2)
If yes, computesi=ki−H1tiPPub,IDi and hi=ji−H1tiPPub,IDi(3)
After that, useri keeps secret ski=si,ti,hi as his or her full private(iv)
Set-Public-Key: user i keeps pki=Ri,Ti as the full public key.Figure 8
Flow of the key generation phase.


## 4.2.3. Data Generation Phase

In this phase, the sender of the data specifies the recipient of the data and generates a ciphertext using the recipient’s public key as shown in Figure9.(i)
Multiencryption: this algorithm is executed by sender to generate a ciphertext for given message m and list of selected receivers i with identity IDi1≤i≤n, respectively. The following steps will be performed in this algorithm:(1)
Computew=H1Rsender+Tsender,IDsender and given message m∈M. Calculate z=H2m,w and Z=zP.(2)
ComputeUi=z⋅Ri+H1Ri+Ti,IDiPpub+Ti and μi=H3Ui,w,IDi, where i=1,2,…,n.(3)
Randomly selectθ∈Zq∗ and compute a polynomial fx with degree n as follows.(4)
Then, compute a polynomialfx with degree n as follows: fx=∏i=0nx−μi+θmodq=xn+an−1xn−1+⋯+a1x+a0, where ai∈Zp∗i=0,1,…,n−1 (2).(5)
ComputeC=H4Z,θ⊕m‖w.(6)
ComputeV=ssender+hsender.(7)
Generate ciphertextCT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1.Figure 9
Flow of the data generation phase.


## 4.2.4. Data Receiving Phase

In this phase, the device uses its own private key to decrypt the received ciphertext to get the plaintext as shown in Figure10.(i)
Multidecryption: this algorithm is executed by selected receiver Ri to extract plaintext from the received ciphertext CT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1. Receiver i performs the following steps:(1)
ComputeUi=si+ti⋅Z and μi=H3Ui,IDi,w, i∈1,2,…,n.(2)
Calculatefx=xn+an−1xn−1+⋯+a1x+a0 and θ=fμi.(3)
Verify whether the equation:V⋅P=Rsender+PPub1+w.(4)
If yes, computem‖w=H4Z,θ⊕C.(5)
Verify ifZ=zP=H2m,wP holds. If not, return ⊥; otherwise, receiver i outputs the plaintext m.Figure 10
Flow of the data receiving phase.


## 5. Analysis of the Proposed CL-MRE Scheme

In this section, we analyze the proposed scheme based on the security requirements set inSection 3. The security requirements consist of confidentiality, integrity, the key escrow issue, partial key verification possibility, recipient anonymity, decryption fairness, and efficiency. The analysis results are shown in Table 1.Table 1
Comparison of security requirements.
Without bilinear pairing (yes/no)Secure for the key escrow problem (secure/insecure)Partial key verifiability (offer/not offer)Receiver anonymity (offer/not offer)Decryption fairness (offer/not offer)Message integrity (offer/not offer)Participant verifiability (offer/not offer)Sur et al. [30]X√XXX√XHung et al. [32]X√X√X√XGao et al. [34]√√√√√√XDeng [35]X√√√√√XZhu [36]X√XXX√XWin et al. [37]√√√XX√XWang et al. [38]X√X√√√XProposed scheme√√√√√√√√: yes/offer/secure. X: no/not offer/insecure.


### 5.1. Correctness

In this section, we will prove the correctness of the scheme proposed inSection 4.Theorem 1.
The receiver can perform decryption using the ciphertextC received from the sender and his/her private key and obtain the plaintext m.Proof.
Assuming that one of the receivers isReceiver1, Receiver1 can perform the following process using CT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1 received from the sender and its own private key sk1=s1,t1. Receiver1 constructs the following equation using ai,i∈1,2,…,n−1 of CT:(1)fx=xn+an−1xn−1+⋯+a1x+a0=∏i=0nx−μi+θmodq.
Receiver1 creates U1 and μ1 as follows using his private key sk1=s1,t1:(2)U1⟵s1+t1⋅Z,μ1⟵H3U1,ID1,w.
Receiver1 obtains θ using the generated equation and μ1 as follows:(3)θ⟵fμ1=∏i=0nμ1−μi+θmodq=μ1−μ1⋅μ1−μ2⋯μ1−μn+θmodq=0⋅μ1−μ2⋯μ1−μn+θmodq.
Receiver1 can obtain m as follows using Z, C, and the acquired θ:(4)mw⟵H4Z,θ⊕C.Theorem 2.
The receiver can confirm that the sender is a registered user in KGC.Proof.
Assuming that one of the receivers isReceiver1, Receiver1 can perform the following process using CT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1 received from the sender.
Receiver1 performs the following operation using V, R, and w included in CT and public parameters P and P_pub of KGC to check if the values match:(5)V⋅P=Rsender+PPub1+w=rsender⋅P+d⋅P1+w=rsender+d⋅P⋅1+w=rsender+d+rsenderw+dw⋅P=rsender+dw+d+rsenderw⋅P=rsender+dH1Rsender+Tsender,IDsender+d+riH1Rsender+Tsender,IDsender⋅P=rsender+dH1Rsender+Tsender,IDsender+H1dTsender+IDsender−H1dTsender+IDsender+d+riH1Rsender+Tsender,IDsender+H1dTsender+IDsender−H1dTsender+IDsender⋅P=ksender−H1dTsender+IDsender+jsender−H1dTsender+IDsender⋅P=Ssender+hsender⋅P=V⋅P.


### 5.2. Analysis of Security Requirements

In this section, we analyze the proposed scheme based on the security requirements set inSection 3. The security requirements consist of confidentiality, integrity, the key escrow issue, partial key verification possibility, recipient anonymity, decryption fairness, and efficiency. The analysis results are shown in Table 1.Confidentiality: in this proposed scheme, an ECC-based encryption operation is performed to provide confidentiality of the data. In this process, the message itself is not encrypted with the public key of each recipient, but a session key is created to encrypt the message. Therefore, to decrypt a message, a session key must be obtained, and to obtain a session key, only a legitimate recipient must carry out computation. For this, the proposed scheme has a recipient verification procedure based on the Lagrange interpolation polynomial, which is as follows:(6)fx=∏i=0nx−μi+θmodq=xn+an−1xn−1+⋯+a1x+a0.Here,μi is μi=H3Ui,IDi,w, and Ui is Ui=s⋅RIDi+kIDiPpub+PKIDi. Therefore, each recipient must have their own private key to generate μi, and the user who generates μi can obtain the session key e through the following process:(7)θ=fμi=∏i=0nμi−μi+θmodq.Integrity: the receiver having decrypted the data can verify the integrity of the data using the values included in the ciphertext and the parameters of the public KGC as follows:Verify:Z=zP=H2m,wP, whereH4Z,θ⊕C.Keyescrowproblem: this proposed scheme uses the form of CL-PKC to solve the IBC key escrow problem. Therefore, the KGC can solve the key escrow problem because it can only know the partial private key, not the full private key.Partialkeyverifiability: this proposed scheme is designed to satisfy several security requirements. In this process, there is some increase in the amount of computation, but it can be observed from Figure 11 that the difference is not significant compared to other methods. Table 2 shows the detailed calculations generated in each step of this proposed scheme.Figure 11
Comparison of computation time (number of users: 100).Table 2
Comparison of computation complexity.
Private key genPublic key gen (user)Encryption (sender)Decryption (receiver)(KGC)(User)Sur et al. [30]nTe—2Te2n+1Te+nTm1Tp+1TeHung et al. [32]nTh+nTm—1TmnTh+nTp+nTe+n+1Tm1Tp+1TmGao et al. [34]2nTm3Tm—4n+1Tm2TmDeng [35]2nTm—1Tm1Tp+3n+3Tm1Tp+1TmZhu [36]nTh+nTm—1TmnTh+1Tp+2n+2Tm2Tp+2TmWin et al. [37]nTm2Tm1Tmn+3Tm+1SE4Tm+1SDWang et al. [38]nTh+2nTm——nTh+1Tp+1Te+n2+n+1Tm3Tp+2TmProposed scheme5nTm2Tm—4n+1Tm4TmTm: time for a modular multiplication operation; Tb: time for a bilinear pairing operation; Te: time for a modular exponentiation operation; Th: time for a map-to-point (MTP) hash function operation; SE: symmetric encryption; SD: symmetric decryption; n: number of users.Receiveranonymity: in this proposed scheme, a Lagrange interpolation polynomial is applied to provide anonymity of the recipient. In this method, the information of the user included in the polynomial cannot be obtained because the process of confirming the recipient is confirmed by a polynomial. The formula of this polynomial is as follows:(8)fx=∏i=0nx−μi+θmodq=x−μ1⋅x−μ2⋅⋯⋅x−μn+θmodq=xn+an−1xn−1+⋯+a1x+a0.Decryptionfairness: the decryption process of the recipient data included in the recipient list should not be unfavorable or impossible to decrypt because of the intervention of a third party or KGC.Participantverifiability: in this study, the participant verification function was designed to solve the problem of not being able to distinguish whether the data sender is an internal user of the system. This is a function that allows the sender of data to simply check whether the sender of the data is an internal user of the system, rather than allowing the sender to identify himself by using his key in the encryption step. For this purpose, only KGC knows, and verification is performed using d, which is a value issued to users inside the system by KGC. The data receiver uses that users do not know d but can obtain public parameter PPub and several parameters by calculating public parameter P on the calculated value of d. To this end, KGC calculates two values kiandji and provides them to the user (sender).(9)ki=ri+dH1Ri+Ti,IDi+H1dTi+IDimodP,ji=d+riH1Ri+Ti,IDi+H1dTi+IDimodP.The user (sender) verifies the received value and obtainsji and ki, respectively, and si and hi through the following operation:(10)si=ki−H1tiPPub,IDi=ri+dH1Ri+Ti,IDi,hi=ji−H1tiPPub,IDi=d+riH1Ri+Ti,IDi.The user (sender) who obtainssi and hi performs encryption for data distribution, and creates V using si and hi in the encryption step.(11)V=ri+dH1Ri+Ti,IDi+d+riH1Ri+Ti,IDi=ri+d+riH1Ri+Ti,IDi+dH1Ri+Ti,IDi=ri+d1+ri+dH1Ri+Ti,IDi=ri+d1+H1Ri+Ti,IDi.Thereafter, the receiver who receives the ciphertextCT=Z,C,w,V,Riai,i∈1,2,…,n−1 including V may perform the following operation using the parameters included in CT:(12)V⋅P=Ri+PPub1+w=riP+dP1+w=ri+d1+wP=ri+d1+H1Ri+Ti,IDiP=V⋅P,wherew=H1Ri+Ti,IDi.Through this process, the receiver can verify that the sender has received the KGC’s master secret keyd from the KGC without verifying the sender’s identity.Efficiency: this proposed scheme was designed with the highest priority to achieve security requirements for a safe 5G communication environment. Although this proposed scheme satisfies all security requirements, computational efficiency decreased in some stages. This test was performed assuming that there were 100 users. First, the amount of computation significantly increased in the key generation step, and the computation time increased about twice as much as that of Gao et al., the basis of this study. However, in terms of users, the amount of computation and computation time were similar to those of the previous one. In the end, from the user’s perspective, the security level has been further improved without significantly increasing computing costs as shown in Table 2. Therefore, the proposed form shows sufficiently meaningful results for the purpose of improving security without significantly increasing the amount of computation.


## 5.1. Correctness

In this section, we will prove the correctness of the scheme proposed inSection 4.Theorem 1.
The receiver can perform decryption using the ciphertextC received from the sender and his/her private key and obtain the plaintext m.Proof.
Assuming that one of the receivers isReceiver1, Receiver1 can perform the following process using CT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1 received from the sender and its own private key sk1=s1,t1. Receiver1 constructs the following equation using ai,i∈1,2,…,n−1 of CT:(1)fx=xn+an−1xn−1+⋯+a1x+a0=∏i=0nx−μi+θmodq.
Receiver1 creates U1 and μ1 as follows using his private key sk1=s1,t1:(2)U1⟵s1+t1⋅Z,μ1⟵H3U1,ID1,w.
Receiver1 obtains θ using the generated equation and μ1 as follows:(3)θ⟵fμ1=∏i=0nμ1−μi+θmodq=μ1−μ1⋅μ1−μ2⋯μ1−μn+θmodq=0⋅μ1−μ2⋯μ1−μn+θmodq.
Receiver1 can obtain m as follows using Z, C, and the acquired θ:(4)mw⟵H4Z,θ⊕C.Theorem 2.
The receiver can confirm that the sender is a registered user in KGC.Proof.
Assuming that one of the receivers isReceiver1, Receiver1 can perform the following process using CT=Z,C,w,V,Rsender,ai,i∈1,2,…,n−1 received from the sender.
Receiver1 performs the following operation using V, R, and w included in CT and public parameters P and P_pub of KGC to check if the values match:(5)V⋅P=Rsender+PPub1+w=rsender⋅P+d⋅P1+w=rsender+d⋅P⋅1+w=rsender+d+rsenderw+dw⋅P=rsender+dw+d+rsenderw⋅P=rsender+dH1Rsender+Tsender,IDsender+d+riH1Rsender+Tsender,IDsender⋅P=rsender+dH1Rsender+Tsender,IDsender+H1dTsender+IDsender−H1dTsender+IDsender+d+riH1Rsender+Tsender,IDsender+H1dTsender+IDsender−H1dTsender+IDsender⋅P=ksender−H1dTsender+IDsender+jsender−H1dTsender+IDsender⋅P=Ssender+hsender⋅P=V⋅P.


## 5.2. Analysis of Security Requirements

In this section, we analyze the proposed scheme based on the security requirements set inSection 3. The security requirements consist of confidentiality, integrity, the key escrow issue, partial key verification possibility, recipient anonymity, decryption fairness, and efficiency. The analysis results are shown in Table 1.Confidentiality: in this proposed scheme, an ECC-based encryption operation is performed to provide confidentiality of the data. In this process, the message itself is not encrypted with the public key of each recipient, but a session key is created to encrypt the message. Therefore, to decrypt a message, a session key must be obtained, and to obtain a session key, only a legitimate recipient must carry out computation. For this, the proposed scheme has a recipient verification procedure based on the Lagrange interpolation polynomial, which is as follows:(6)fx=∏i=0nx−μi+θmodq=xn+an−1xn−1+⋯+a1x+a0.Here,μi is μi=H3Ui,IDi,w, and Ui is Ui=s⋅RIDi+kIDiPpub+PKIDi. Therefore, each recipient must have their own private key to generate μi, and the user who generates μi can obtain the session key e through the following process:(7)θ=fμi=∏i=0nμi−μi+θmodq.Integrity: the receiver having decrypted the data can verify the integrity of the data using the values included in the ciphertext and the parameters of the public KGC as follows:Verify:Z=zP=H2m,wP, whereH4Z,θ⊕C.Keyescrowproblem: this proposed scheme uses the form of CL-PKC to solve the IBC key escrow problem. Therefore, the KGC can solve the key escrow problem because it can only know the partial private key, not the full private key.Partialkeyverifiability: this proposed scheme is designed to satisfy several security requirements. In this process, there is some increase in the amount of computation, but it can be observed from Figure 11 that the difference is not significant compared to other methods. Table 2 shows the detailed calculations generated in each step of this proposed scheme.Figure 11
Comparison of computation time (number of users: 100).Table 2
Comparison of computation complexity.
Private key genPublic key gen (user)Encryption (sender)Decryption (receiver)(KGC)(User)Sur et al. [30]nTe—2Te2n+1Te+nTm1Tp+1TeHung et al. [32]nTh+nTm—1TmnTh+nTp+nTe+n+1Tm1Tp+1TmGao et al. [34]2nTm3Tm—4n+1Tm2TmDeng [35]2nTm—1Tm1Tp+3n+3Tm1Tp+1TmZhu [36]nTh+nTm—1TmnTh+1Tp+2n+2Tm2Tp+2TmWin et al. [37]nTm2Tm1Tmn+3Tm+1SE4Tm+1SDWang et al. [38]nTh+2nTm——nTh+1Tp+1Te+n2+n+1Tm3Tp+2TmProposed scheme5nTm2Tm—4n+1Tm4TmTm: time for a modular multiplication operation; Tb: time for a bilinear pairing operation; Te: time for a modular exponentiation operation; Th: time for a map-to-point (MTP) hash function operation; SE: symmetric encryption; SD: symmetric decryption; n: number of users.Receiveranonymity: in this proposed scheme, a Lagrange interpolation polynomial is applied to provide anonymity of the recipient. In this method, the information of the user included in the polynomial cannot be obtained because the process of confirming the recipient is confirmed by a polynomial. The formula of this polynomial is as follows:(8)fx=∏i=0nx−μi+θmodq=x−μ1⋅x−μ2⋅⋯⋅x−μn+θmodq=xn+an−1xn−1+⋯+a1x+a0.Decryptionfairness: the decryption process of the recipient data included in the recipient list should not be unfavorable or impossible to decrypt because of the intervention of a third party or KGC.Participantverifiability: in this study, the participant verification function was designed to solve the problem of not being able to distinguish whether the data sender is an internal user of the system. This is a function that allows the sender of data to simply check whether the sender of the data is an internal user of the system, rather than allowing the sender to identify himself by using his key in the encryption step. For this purpose, only KGC knows, and verification is performed using d, which is a value issued to users inside the system by KGC. The data receiver uses that users do not know d but can obtain public parameter PPub and several parameters by calculating public parameter P on the calculated value of d. To this end, KGC calculates two values kiandji and provides them to the user (sender).(9)ki=ri+dH1Ri+Ti,IDi+H1dTi+IDimodP,ji=d+riH1Ri+Ti,IDi+H1dTi+IDimodP.The user (sender) verifies the received value and obtainsji and ki, respectively, and si and hi through the following operation:(10)si=ki−H1tiPPub,IDi=ri+dH1Ri+Ti,IDi,hi=ji−H1tiPPub,IDi=d+riH1Ri+Ti,IDi.The user (sender) who obtainssi and hi performs encryption for data distribution, and creates V using si and hi in the encryption step.(11)V=ri+dH1Ri+Ti,IDi+d+riH1Ri+Ti,IDi=ri+d+riH1Ri+Ti,IDi+dH1Ri+Ti,IDi=ri+d1+ri+dH1Ri+Ti,IDi=ri+d1+H1Ri+Ti,IDi.Thereafter, the receiver who receives the ciphertextCT=Z,C,w,V,Riai,i∈1,2,…,n−1 including V may perform the following operation using the parameters included in CT:(12)V⋅P=Ri+PPub1+w=riP+dP1+w=ri+d1+wP=ri+d1+H1Ri+Ti,IDiP=V⋅P,wherew=H1Ri+Ti,IDi.Through this process, the receiver can verify that the sender has received the KGC’s master secret keyd from the KGC without verifying the sender’s identity.Efficiency: this proposed scheme was designed with the highest priority to achieve security requirements for a safe 5G communication environment. Although this proposed scheme satisfies all security requirements, computational efficiency decreased in some stages. This test was performed assuming that there were 100 users. First, the amount of computation significantly increased in the key generation step, and the computation time increased about twice as much as that of Gao et al., the basis of this study. However, in terms of users, the amount of computation and computation time were similar to those of the previous one. In the end, from the user’s perspective, the security level has been further improved without significantly increasing computing costs as shown in Table 2. Therefore, the proposed form shows sufficiently meaningful results for the purpose of improving security without significantly increasing the amount of computation.


## 6. Conclusions

This study focuses on technology for the safe and efficient distribution of data in 5G. To this end, we have performed a comparison with the recent literature and showed that our proposed scheme is better in some areas. Existing methods pose a threat in terms of security, and in some methods, it has been observed that the amount of computation increases rapidly as the number of users increases. In addition, there are issues such as the key escrow issue, partial key verification, recipient anonymity, and decryption fairness not being provided. Such problems may cause the data to be forged or damaged by an external third party or a disadvantage in decrypting and obtaining the data by the data receiver inside the system. Therefore, to solve this problem, we used a Lagrange polynomial-based recipient identification process and achieved recipient anonymity at the same time. In addition, by solving the problem of decryption fairness that may appear in this process, we have solved the problem of disadvantage to a legitimate data receiver to acquire data by a third party. In addition, this proposed scheme is designed to determine, through participant verification, whether the user who transmits data belongs to the system. This is intended to perform quick verification while tackling external attacks that may appear in the connected car environment using 5G on which this study is focused. Through this, data can be transmitted more safely and efficiently in a connected car environment, which is an environment in which a large amount of data is simultaneously distributed in a fast-moving vehicle. Finally, our model can provide a basis for more efficient use of the 5G environment.



---

*Source: 5599996-2021-06-12.xml*